https://vercel.com/kb/bulletin/vercel-april-2026-security-incident (Related HN thread: https://news.ycombinator.com/item?id=47824463)

I just did a write up about this. https://aicoe.fit/vercel-has-a-confirmed-breach-40e32d If you use Vercel, you should rotate secrets. Even if you don’t use Vercel directly, this matters. Vercel sits close to Next.js and other core JavaScript tooling, so the supply-chain risk extends well beyond Vercel customers. Public reporting suggests Vercel may be in contact with the threat actor, but the scope is still developing. If you rely on Next.js or other Vercel-maintained packages, pin versions and watch this closely.

More info from Vercel here: https://x.com/rauchg/status/2045995362499076169