PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Evaluating the Business Impact of Software Vulnerabilities

bugcrowd.com | vulnerability | #bug-bounty | #rce | #bugcrowd | #rewards | #google | #vulnerability-pricing | #managed-programs
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

After Google raised top payouts for RCE bugs by 50%, Bugcrowd discusses when to adjust bounty ranges, noting most self-run programs stall without managed support.
Published
Collected

Related coverage

vulnerability · vercel.com
Our $1 million hacker challenge for React2Shell
We paid $1M to security researchers to break our WAF. Here's what we learned defending against React2Shell.
research · github.com
Steal My Bitcoin Challenge Writeup: PHP 8.4.26 Session Upload Progress Memory Exhaustion Analysis
Provides a detailed binary-level case study on PHP Zend memory manager behavior and worker state persistence after fatal out-of-memory errors.
vulnerability · bugcrowd.com
Bugcrowd Announces the Availability of Self-Service Vulnerability Disclosure Programs
Bugcrowd launches self-service Vulnerability Disclosure Programs: a structured intake and triage pipeline for bug reports, with managed triage for the first 15 or 75 submissions.
vulnerability · bugcrowd.com
Why a DIY Bug Bounty is a Bad Idea
Bugcrowd argues against DIY bug bounties: its application security engineers handle triage, validation, and researcher communication — expertise honed via the open source VRT.
vulnerability · bugcrowd.com
Jet.com Increases Rewards to Match the Market Rate of Security Bugs
Jet.com raises its bug bounty rewards to match Bugcrowd's Defensive Vulnerability Pricing Model, after rewarding 97 vulnerabilities since early 2015, and expands scope to its mobile apps.
vulnerability · blog.quarkslab.com
Attacking Titan M with Only One Byte
How CVE-2022-20233, found via emulation-based fuzzing with AFL++ in Unicorn mode, was exploited to obtain code execution on Google's Titan M security chip.
Back