site platform
Vercel: security status
Summary
Vercel bulletin (dated Oct 21): WAF rules blocking known exploit patterns were deployed before disclosure and apply automatically, at no cost, to all projects, covering PHP functions on Vercel and requests proxied to external PHP backends. It does not say Vercel patched any PHP runtime. It tells customers to upgrade their PHP runtime immediately, since WAF rules do not replace patching.
Customer action:
Static or JavaScript-only sites (e.g. Next.js) need no PHP work. If you use PHP functions on Vercel or proxy to an external PHP backend through Vercel, update PHP to 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 or later, redeploy, and restrict direct access to the backend.
Source: https://vercel.com/kb/bulletin/php2shell-security-bulletin
Verified: 2026-10-30
Most Vercel sites do not use PHP. Where PHP functions are used, the customer controls the PHP version.
The provider's own security incidents
April 2026 security incident (environment variables exposed)
patchedofficial notice · 2026-10-16Summary
Official bulletin: an employee's account was taken over through a third-party AI tool, and the attacker reached internal Vercel systems and enumerated and decrypted some customers' environment variables not marked sensitive. Affected customers were notified. On Oct 16 Vercel announced remediation complete and the incident closed.
Customer action:
If Vercel notified you, or you have not acted yet, rotate environment variables not marked sensitive (API keys, tokens, database credentials, signing keys) and mark secrets as sensitive. Turn on MFA and review activity logs and unexpected deployments.
Source: https://vercel.com/kb/bulletin/vercel-april-2026-security-incident
Verified: 2026-10-24
How this tool recognises the provider
- Name servers
*.vercel-dns.com- CNAME
*.vercel-dns.com*.vercel-dns-017.com*.vercel-dns-0.com- Response headers (names)
x-vercel-id