PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Google VRPs in Review – 2025

bughunters.google.com | blog | #bug-bounty | #vulnerability-research | #security-research | #year-in-review | #google | #vulnerability-rewards | #vrp
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

This blog post reviews the 2025 highlights and key outcomes across Google's various Vulnerability Reward Programs (VRPs).
Published
Collected

Related coverage

blog · bughunters.google.com
Standardizing Rewards in Google VRP: Introducing Information Tiers and Action Criticality
We are evolving our reward model to reflect the changing security landscape by introducing two new dimensions to our model: Information Tiers and Action Criticality.
blog · projectzero.google
Announcing Project Zero
The founding announcement of Google Project Zero, a team dedicated to researching and reporting security bugs with the goal of making the internet safer.
research · bughunters.google.com
Changes to the Chrome VRP
Today we are announcing changes to the [Chrome Vulnerability Rewards Program](about/rules/chrome-friends/chrome-vulnerability-reward-program-rules), adjusting our reward amounts and program categories to reward deeper security research, recognize high-value fixes across more severity tiers, and provide new opportunities for researcher recognition.
research · github.com
Steal My Bitcoin Challenge Writeup: PHP 8.4.26 Session Upload Progress Memory Exhaustion Analysis
Provides a detailed binary-level case study on PHP Zend memory manager behavior and worker state persistence after fatal out-of-memory errors.
research · projectdiscovery.io
PHP2Shell: finding and patching affected PHP
Two CVSS 9.2 bugs in the PHP runtime allow unauthenticated code execution; the patch is a package upgrade and a restart, and this guide shows how to find every PHP runtime you need to patch.
vulnerability · vercel.com
The Vercel OSS Bug Bounty program is now available
Vercel is opening its open source software bug bounty program to the public for researchers find vulnerabilities and make OSS safer
Back