No Verified 'React2Shell' Bulletin Exists: What Next.js Teams Should Check
A 'React2Shell' Vercel security bulletin is circulating, but no primary advisory, CVE, or technical write-up could be located as of 2026-06-29. Here is how to verify.
The archive · Page 2 of 4
Security
Where AI infrastructure inherits the unpatched assumptions of the web stack beneath it, and trust boundaries collapse faster than disclosure timelines can keep up.
The archive
25–48 of 75 articles · Newest first
Vercel on the Axios npm Compromise: Platform Scanning Has a Blind Spot
Vercel's Axios changelog exposes where platform defenses stop: post-publication egress blocks leave the install-time window on dev laptops and CI runners uncovered.
Diffusion Model Safety: How Training-Schedule Poisoning Slips Past Prompt Filters
TEMPO-Diffusion gates its backdoor to a training-timestep window, so clean inference output no longer proves a clean checkpoint. Output-only audits miss the poisoning.
Bandit Algorithms Let Non-Experts Auto-Select the Best LLM Jailbreak
A June 2026 arXiv preprint uses bandit algorithms to auto-select jailbreaks, hitting 97% ASR on open-weight LLMs and invalidating blocklist-based defenses.
RAG Poisoning Hijacks Model Attention, Not Just Retrieval Ranking
Eyes-on-Me (ICML 2026) shows attention attractors in poisoned documents redirect generator focus post-retrieval, lifting attack success from 21.9% to 57.8% across 18 settings.
CVE-2026-LGTM and the Limits of Trust in Automated Advisory Intake
CVE IDs certify disclosure, not exploitability. Scanners that ingest the feed without VEX attestation treat every advisory that cleared CNA intake as a confirmed risk.
ShareLock Splits MCP Poisoning Across Tools, Defeating Per-Tool Scanners by Construction
ShareLock splits an MCP poisoning payload across tool descriptions via Shamir's threshold scheme. No individual share is flagged. Combined, attack success tops 90%.
Prompt Injection in AI Résumé Screening: Single vs Multi-Injection Attacks
A June 2026 preprint plants prompt injection in résumés fed to LLM screeners, flipping rankings when few candidates inject and forcing vendors to isolate untrusted input.
OpenAI's TanStack npm Writeup Shifts Dependency-Control Burden onto AI Tooling Teams
OpenAI's TanStack npm writeup is its second macOS signing compromise within a month, and it raises the dependency-control bar for every team pulling npm into AI tooling.
OpenAI's ChatGPT Atlas Treats Prompt Injection as Unfixed, Not Patched
OpenAI frames ChatGPT Atlas's prompt-injection hardening as continuous rather than a closed patch, pushing the burden onto runtime controls for agent builders.
Can Provable Bounds Defend LLM Fine-Tuning Against Poisoned Data?
BBoxER, a 2025 gradient-free post-training method, claims non-vacuous poisoning-robustness bounds for LLMs. The abstract never states how tight those bounds are.
Measuring LLM Safety by Refusal Alignment Instead of Attack Success Rate
A June 2026 preprint proposes RAS, a white-box metric that scores LLM safety by hidden-state refusal alignment rather than blocked output, challenging ASR-only leaderboards.
Poisoning Physics-Informed Neural Networks Slips Past Loss-Based Validation
A June 2026 preprint shows poisoned physics-informed neural networks hit clean training loss while their solutions diverge up to 128%, defeating loss-based validation.
Catching LLM Jailbreaks by Watching Per-Layer Entropy, Not Outputs
A June 2026 paper reports jailbreaks perturb per-layer entropy of frozen LLMs before any harmful token emits, but adaptive attackers will likely follow one layer deeper.
How Reliable Are the LLM Judges Scoring Jailbreak Attacks?
Published jailbreak attack-success rates depend on the judges scoring them. A June 2026 audit finds both judge families miscalibrated and manipulable without removing harm.
Auto-Reproducing Text-to-Image Jailbreaks From Papers: The PixJail Pipeline
PixJail converts text-to-image jailbreak papers into runnable pipelines, reproducing eleven methods with 2.1% error, a fidelity figure, not a real bypass rate.
Vercel BotID's Telemetry Is a Threat Intelligence Feed Most Teams Discard
Vercel BotID emits session telemetry, verdicts, JA4 digests, paths, and verified-bot labels, rich enough to repurpose as a threat feed and flag what the WAF lets through.
Extracting Unseen Training Data From an LLM by Poisoning Its Loss Landscape
Loss landscape poisoning reshapes a model's loss function so that ordinary training forces it to memorize a record the attacker never possessed, lifting extraction to 100%.
React Router CVE-2025-31137: Vercel's Edge Fix Is Not the Patch
Vercel's edge mitigation for CVE-2025-31137 covers only traffic on its network. Self-hosted, preview, and non-Vercel Remix deploys still need the adapter patch.
Reported React Server Components Leak Is Unconfirmed: Audit the Payload
A reported React Server Components source-code leak has no CVE or advisory in React or Vercel's channels. Audit what your app serializes before trusting the boundary.
Vercel's Secure AI Agent Guidance Pushes Defense Into the Sandbox
Vercel treats prompt injection and agent hallucination as unsolvable at the model layer, routing defense into per-session sandboxes and shifting security onto deployment ops.
Nx Supply-Chain Attack Used Developers' Own AI CLIs to Hunt Secrets
s1ngularity's malicious Nx packages invoked installed AI CLIs with permission bypass flags to enumerate secrets, making any local agent a scriptable recon primitive.
Mixed Compliance Data Makes Safety Fine-Tuning a Curation Problem
A June 2026 preprint shows benign and harmful compliance examples are not interchangeable, with DPO, not SFT, the stage that stops benign examples from amplifying harm.
Defending Agentic AI With Deception: Misdirecting Model-Guided Attacks
A preprint shows defensive misdirection can cut estimated attacker-success bounds by up to two orders of magnitude, but leaves the cost to legitimate tasks unmeasured.