PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Five years of the GitHub Bug Bounty program

hackerone.com | research | #bug-bounty | #github | #hackerone | #milestone | #legal-protection | #live-hacking
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

GitHub marked five years of its bug bounty program with $250,000 paid to researchers in 2018. It announced full legal protection, broader reward scope, and higher payouts for the coming year.
Published
Collected

Related coverage

research · github.com
Steal My Bitcoin Challenge Writeup: PHP 8.4.26 Session Upload Progress Memory Exhaustion Analysis
Provides a detailed binary-level case study on PHP Zend memory manager behavior and worker state persistence after fatal out-of-memory errors.
research · portswigger.net
Responsible denial of service with web cache poisoning
James Kettle shows how web cache poisoning can take down websites with a single request without collateral damage, earning bounties from Tesla and HackerOne along the way.
research · projectdiscovery.io
PHP2Shell: finding and patching affected PHP
Two CVSS 9.2 bugs in the PHP runtime allow unauthenticated code execution; the patch is a package upgrade and a restart, and this guide shows how to find every PHP runtime you need to patch.
research · github.com
php2shell: Pure HTTP Full-Chain RCE and ASLR Bypass on Stock PHP 8.4 Configurations
Overcomes historical constraints where PHP heap exploitation required display_errors=On, restricted memory limits, or target application vulnerabilities, demonstrating reliable pure-HTTP RCE and ASLR defeat against standard production ini configurations.
research · wiz.io
The Blue Agent POV: Investigating Multi-Platform Data Exfiltration Across AWS and GitHub
Wiz's Blue Agent walks through investigating a multi-platform data exfiltration campaign spanning AWS, S3 and GitHub, showing how the agent gathers evidence and reconstructs the full attack chain in minutes instead of hours.
research · github.com
[CVE-2024-6100] CyberKimi Benchmarks: Autonomous Exploitation Traces & Evidence
Provides verifiable, transparent evidence of advanced LLMs performing complex, multi-step binary and browser exploitation autonomously under strict ASLR and memory randomization defenses.
Back