Trigger.dev disclosed a security incident on Sunday, November 1, 2026. The company says an attacker used an exploit to gain unauthorized access to environment variables belonging to a subset of customer organizations. These variables can hold configuration values and credentials, so their exposure may require affected customers to take protective action. Trigger.dev says it blocked the exploit and identified the organizations whose environments were exposed during its investigation.
The notice says Trigger.dev emailed the owners of affected accounts with mitigation steps and will publish further updates on its status page. Customers with questions are directed to contact the company. The disclosure does not specify how the exploit worked, when the unauthorized access began or ended, how many organizations were affected, or what kinds of environment variables were accessed. It also does not describe any confirmed misuse of exposed information. Those details are left for subsequent updates, making the notice primarily an initial alert for impacted customers rather than a full technical account of the incident.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
A tampered Claude Code extension in Cursor’s marketplace installed a persistent SSH backdoor, letting attackers maintain remote access to affected systems. Microsoft advised users to remove the malicious versions and investigate for signs of compromise. (microsoft.com)
A security researcher avoids LLMs because hands-on investigation is enjoyable, and using AI makes it hard to claim authorship when it produces confidently wrong results. They recognize LLMs’ power but argue that finding vulnerabilities still depends on skilled researchers guiding them. (eva.ac)
A buyer wants a 60-80-inch 4K TV that functions only as a display for an Apple TV, without using its built-in smart features. They’re seeking models that offer strong privacy and pair well with Apple TV. (news.ycombinator.com)
Meta’s Muse AI assistant is accused of accessing private messages, financial accounts, contacts, and other data to build behavioral profiles, including of people who never installed it. The account also alleges that Muse data is used for AI training by default and that internal warnings about privacy and security risks were overridden. (paulfwalsh.substack.com)
The title alleges that Frontier Airlines was likely breached. The page only displays a Reddit network-security block and gives no details to verify the claim. (reddit.com)
Researchers chained a flaw in ChatGPT’s sandboxed HTML previews with a JavaScript injection path to access private user data or act on users’ behalf through a malicious share link. OpenAI fixed the vulnerability and paid a $5,000 bug bounty. (simonwillison.net)
Today's best Hacker News stories, summarized and screenshotted, one email a day.