PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Bugcrowd Founder on Google Increasing Android Bounty to $1.5 Million

bugcrowd.com | vulnerability | #bug-bounty | #rce | #android | #casey-ellis | #google | #titan-m | #zerodium | #vulnerability-economics
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Casey Ellis comments on Google raising its Android bounty to $1.5 million for a full-chain Titan M exploit, arguing top payouts pull rare skills away from brokers like Zerodium toward defense.
Published
Collected

Related coverage

vulnerability · blog.quarkslab.com
Attacking Titan M with Only One Byte
How CVE-2022-20233, found via emulation-based fuzzing with AFL++ in Unicorn mode, was exploited to obtain code execution on Google's Titan M security chip.
vulnerability · vercel.com
Our $1 million hacker challenge for React2Shell
We paid $1M to security researchers to break our WAF. Here's what we learned defending against React2Shell.
research · bughunters.google.com
Google's PageBreak Project – Real-World Findings
This post provides a technical deep dive into specific, real-world vulnerabilities discovered by Google's PageBreak scanner
research · github.com
Steal My Bitcoin Challenge Writeup: PHP 8.4.26 Session Upload Progress Memory Exhaustion Analysis
Provides a detailed binary-level case study on PHP Zend memory manager behavior and worker state persistence after fatal out-of-memory errors.
vulnerability · bugcrowd.com
Why Every Company Should Have a Vulnerability Disclosure Program
Bugcrowd CTO Casey Ellis and CSO David Baker argue every company needs a VDP: as attacks and InfoSec spending grow, disclosure programs act like a neighborhood watch for internet-facing assets.
vulnerability · bugcrowd.com
Evaluating the Business Impact of Software Vulnerabilities
After Google raised top payouts for RCE bugs by 50%, Bugcrowd discusses when to adjust bounty ranges, noting most self-run programs stall without managed support.
Back