<p><strong>TLDR:</strong> Vercel has confirmed unauthorized access to internal systems after an attacker compromised an employee account through a third-party AI platform breach. Non-sensitive environment variables were exposed, and a threat actor is reportedly selling stolen data for $2 million. Separately, a four-year-old Notion bug still leaks editor emails from any public page with a single unauthenticated API call. Anthropic’s unreleased Mythos model is making the rounds for its ability to chain software vulnerabilities and complete expert-level CTF tasks at a 73% success rate.</p>
<hr>
<h2>Vercel breach: third-party AI platform was the entry point</h2>
<p>Vercel CEO Guillermo Rauch confirmed the breach started with a compromised employee account — the employee had been using an AI platform that was itself breached, giving attackers access to his Google Workspace and then Vercel’s internal systems. A threat actor claiming to be ShinyHunters (the actual group has denied involvement) posted on a hacking forum offering to sell 580 employee records, source code, database contents, and API keys for $2 million. The real exposure for customers is non-sensitive environment variables, which the attacker could enumerate. Sensitive variables stored with Vercel’s encryption feature appear unaffected. If you’re a Vercel customer: rotate all secrets now, audit which variables are marked non-sensitive, and review access logs for linked services. The broader lesson here is uncomfortable — the breach didn’t start at Vercel, it started at a SaaS tool one employee was using.</p>
<h2>Notion has been leaking editor emails since 2022</h2>
<p>Any public Notion page exposes the full names, emails, and profile photos of every editor via an unauthenticated POST to their API. No cookies, no tokens — one request returns the data. A researcher reported this on HackerOne in July 2022. Notion triaged it as “informative,” issued no fix, and the endpoint still works today. The scale is significant: a company wiki with 500 employees sharing a public page exposes 500 corporate emails in a single request, with no rate limiting. Pair it with Notion’s <code>getLoginOptions</code> endpoint (also unauthenticated) and you can identify which accounts use passwords versus SSO — a ready-made target list for credential stuffing. If your team has any public Notion pages, check your sharing settings now.</p>
<h2>Anthropic’s Mythos model raises the floor for cyberattacks</h2>
<p>Anthropic’s unreleased Mythos model reportedly completed a 32-step corporate network attack simulation end-to-end and succeeded on expert-level CTF tasks 73% of the time. Anthropic has gated access via “Project Glass Wing,” sharing it only with major defenders including AWS, Apple, Google, and Microsoft before any public release. The concern isn’t that the model is a sentient attacker — it’s that it lowers the skill floor for sophisticated exploits, potentially turning rare attack chains into something a less experienced actor can execute. Governments in the US, UK, Canada, and EU have responded. The practical takeaway is the same as always: patch discipline, least privilege, asset inventory, and supply chain hygiene. The threat model just got cheaper on the attacker’s side.</p>
<h2>Cline npm package compromise: prompt injection to cache poisoning to stolen publish token</h2>
<p>A detailed post-mortem on the February 2026 Cline CLI compromise lays out a genuinely clever attack chain. An attacker injected a malicious prompt via a GitHub issue title into an AI-powered triage bot that had Bash and Write tool access on the CI runner. That runner lacked publish secrets, so the attacker pivoted to GitHub Actions cache poisoning — flooding the shared cache to evict the legitimate node_modules entry, then writing a poisoned replacement with the same predictable cache key. When the nightly release workflow ran, it restored the poisoned node_modules, which exfiltrated the NPM_RELEASE_TOKEN. Eight days later, cline@2.3.0 shipped with a malicious postinstall hook. Mitigations: disable npm lifecycle scripts by default, use <code>npm ci</code>, and run <code>npm audit signatures</code> in CI.</p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>Vibe-coded apps leaking user data:</strong> A recurring pattern of authorization logic placed on the frontend rather than enforced server-side — one gaming site returned its entire user database to every client, a content platform exposed unpublished drafts, and a self-hosted tool served plaintext passwords via unauthenticated endpoints. Audit every endpoint as if an attacker will call it directly.</li>
<li><strong>ATHR vishing platform:</strong> A voice phishing-as-a-service platform selling for $4,000 plus 10% commission automates lure emails, call routing via Asterisk/WebRTC, AI voice agents for social engineering, and real-time credential capture — all from a single dashboard, targeting Google, Microsoft, Coinbase, and Binance impersonation flows.</li>
<li><strong>Spring Boot 3.5 EOL:</strong> Open-source support ends June 30, 2026; the real risk is that CVE reporting dries up post-EOL while vulnerabilities keep accumulating, as demonstrated by Spring Boot 2.7’s post-EOL trajectory with CVE-2024-38807.</li>
<li><strong>AWS Agent Registry preview:</strong> AWS launched a centralized registry for tracking and governing AI agents across enterprise environments, aimed at the agent sprawl problem as organizations scale AI workloads.</li>
<li><strong>Swagger drift detection:</strong> SmartBear updated Swagger with CI/CD contract testing that catches OpenAPI spec-to-runtime divergence, directly targeting the API drift problem that accelerates when AI coding tools generate code faster than specs get updated.</li>
<li><strong>Pulumi OpenAPI docs:</strong> Pulumi’s Cloud REST API reference is now auto-generated from the live OpenAPI spec at build time, replacing handwritten pages that drifted out of sync — also improves reliability for AI agents calling the API programmatically.</li>
<li><strong>Lakehouse SQL identifier resolution:</strong> Different engines in a lakehouse (Spark, Trino, Hive, Snowflake) handle case sensitivity and quoting rules differently, creating subtle cross-engine bugs that are easy to miss until a pipeline breaks in production.</li>
<li><strong>Cloudflare code mode:</strong> Sunil Pai’s talk on having LLMs generate executable JavaScript instead of chaining JSON tool calls reduced Cloudflare’s 2,600-endpoint API surface from ~1.2 million tokens to ~1,000 tokens using just two tool calls.</li>
<li><strong>MCP at 110M monthly downloads:</strong> Anthropic’s David Soria Parra notes MCP hit that number faster than React did; roadmap includes a stateless transport protocol from Google landing in June, async agent-to-agent primitives, and cross-app SSO for enterprises.</li>
<li><strong>Nubank on Clojure:</strong> Co-founder Edward Wible explains the choice traces back to “Out of the Tar Pit” — mutable state as the root of accidental complexity — with Datomic’s immutable database providing the audit history banking regulators require.</li>
<li><strong>Apple phishing via account change alerts:</strong> Attackers embed scam text in Apple ID name fields so fake purchase alerts arrive in real Apple security emails that pass SPF, DKIM, and DMARC checks; Apple has not patched the abuse vector.</li>
<li><strong>North Korea’s Kimsuky using GitHub as C2:</strong> FortiGuard Labs found the group exfiltrating data to attacker-controlled GitHub repos via obfuscated LNK files and PowerShell scripts, with Dropbox used as interim C2 in a related variant.</li>
<li><strong>AWS S3 Files vs EFS:</strong> S3 Files offers up to 13x lower storage costs ($0.023/GB vs $0.30/GB) but has a 60-second write-back delay that breaks coordination patterns and lacks hard links, cross-client file locking, and atomic directory renames.</li>
<li><strong>Java ecosystem:</strong> Spring Framework 7.0.7 and 6.2.18 ship three CVE fixes for DoS vulnerabilities in WebFlux and MVC; JEP 534 (Compact Object Headers by Default) and JEP 533 (Structured Concurrency 7th Preview) elevated to Candidate status.</li>
</ul>


Server-side development, system design, API patterns, and distributed architecture.

Backend Digest

A security-focused roundup covering several incidents and threats. Vercel confirmed a breach originating from a compromised employee's third-party AI platform account, exposing non-sensitive environment variables; a threat actor is selling stolen data for $2M. A four-year-old Notion bug still leaks editor emails and SSO status from public pages via unauthenticated API calls. Anthropic's unreleased Mythos model reportedly completes expert-level CTF tasks at 73% and end-to-end corporate network attack simulations. A detailed post-mortem on the Cline npm package compromise reveals a prompt injection to cache poisoning to stolen publish token attack chain. Additional items cover vibe-coded apps leaking data, a voice phishing-as-a-service platform, Spring Boot 3.5 EOL risks, AWS Agent Registry, MCP hitting 110M monthly downloads, and North Korea's Kimsuky using GitHub as C2.

Vercel breach confirmed, Notion leaks editor emails with zero auth