Last updated
Vercel: Cybersecurity Incident
CVE-2026-64650/64651: Vercel @ai-sdk/harness-codex/opencode vulnerabilities (CVSS 6.3 Medium) involved process-path validation bypass allowing malicious code in Linux sandbox to satisfy security checks. Fixes released July 20, 2026 in versions 1.0.29 and 1.0.28.
Source: Forkast News
- What happened
- CVE-2026-64650/64651: Vercel @ai-sdk/harness-codex/opencode vulnerabilities (CVSS 6.3 Medium) involved process-path validation bypass allowing malicious code in Linux sandbox to satisfy security checks. Fixes released July 20, 2026 in versions 1.0.29 and 1.0.28.
- Who
- Vercel · USA
- When
- 2026-08-16
- Source
- Forkast News
- So what
- A breach is a governance event before it is a technical one.
The leadership read
A breach is a governance event before it is a technical one. For Vercel in the sector, the hiring consequence is rarely more engineers; it is senior accountability, security, risk and data governance reporting high enough to change decisions. Across Americas, watch whether the response is a hire or a contractor; that distinction says how the board has read it.
Market context: Against a Talent Market Index of 122.7 (Hot) (up 17.8 month-on-month), Americas is at rising (+34.4pts) on signal share.
Vercel: 9 signals in the last 90 days; 0.5% of MitchelLake's Oceania signal flow; 14 tracked across 183 days.
MitchelLake in this thematic
Also at Vercel →
More signals across Americas
Cybersecurity Incident · Americas
Coinkite Inc. →Toronto-based bitcoin wallet maker Coinkite faces a proposed class-action lawsuit after hackers allegedly stole more than US$140 million in bitcoin from users, with negligence claims against the company and its co-founders.
Cybersecurity Incident · Americas
Pentagon (U.S. Department of Defense) →Two Marines are suing the Defense Department over a breach of the Defense Manpower Data Center's information system that exposed personal information of more than 3 million people.
Cybersecurity Incident · Americas
The Money Store →The Money Store is the reported victim of a ransomware group's claim to have stolen mortgage customer data. Plaintiff law firms are soliciting class action claimants, indicating likely legal and regulatory exposure.
Cybersecurity Incident · Americas
MSUFCU →MSUFCU (Michigan State University Federal Credit Union) took e-banking services offline after an NSA warning tied to the PHP2Shell remote code execution vulnerability, which is affecting a large share of internet-facing sites.
Cybersecurity Incident · Americas
City of Columbia (South Carolina) →South Carolina's state capital city was hit by a cyberattack that disrupted systems including the MyColaSC citizen services platform used to pay utility bills and report non-emergency issues.
Cybersecurity Incident · Americas
Defense Manpower Data Center (Pentagon / US Department of Defense) →Pentagon's Defense Manpower Data Center disclosed a data breach after a file-sharing system vulnerability (found July 16) exposed unencrypted PII of service members and affiliates for about nine months. A class-action lawsuit alleges failed cybersecurity controls and late victim notification, citing Office of Inspector General reports that found 14 of 20 FISMA core metrics ineffective.
Where this lands in our work
- Private Equity →
Listed and PE-backed boards renew leadership against a value-creation clock.
- AI Leadership →
AI capability is being built into executive stacks, not bolted on beneath them.
- Executive Search: Americas →
Our Americas practice runs the searches behind signals like this one.
Intelligence powered by Autonodal ↗