PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Oath’s Big Year of Bug Bounties Capped off with NYC Live Hacking Event

hackerone.com | blog | #bug-bounty | #hackerone | #live-hacking-event | #oath | #yahoo | #h1-212
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Oath closed a record bounty year with the h1-212 live hacking event in NYC. In 2018 it received over 1,900 valid vulnerabilities and paid $5 million, nearly five times its 2017 payouts.
Published
Collected

Related coverage

blog · hackerone.com
The Paranoids at Oath Take Bug Bounties to Argentina: h1-5411 Recap
Oath's Paranoids took bug bounties to Buenos Aires with h1-5411, paying $260,000+ to 50-plus hackers — half of them first-time live event participants — alongside Ekoparty and the MemeCTF contest.
blog · hackerone.com
Oath Bug Bounty Program Update: $1M in payouts and expansion of the program
Oath's bug bounty update: $1M paid after a live event netted $400,000 in 12 hours; published payout table, more bounty-eligible bug classes, faster responses, and EdgeCast joining the program.
blog · hackerone.com
H1-415 Recap: Oath Pays Over $400,000 to Hackers in One Day
Recap of H1-415 in San Francisco: 41 hackers from 11 countries earned Oath more than $400,000 in bounties in nine hours—a record for HackerOne's live-hacking series.
blog · hackerone.com
Measuring The Fix: How We Evaluate Frontier Models on Remediation Quality
HackerOne tested frontier models on security fix quality and found the judge mattered more than the model. See how CTEM remediation earns engineer trust.
blog · hackerone.com
Critical PHP Vulnerabilities: What Security Teams Need to Know
Learn about the critical PHP vulnerabilities, HackerOne’s response, and the rise in reports. Review patching guidance and coordinated disclosure practices.
blog · hackerone.com
Project Glasswing: What We Learned Running a Frontier Model on Our Own Codebase
HackerOne ran Anthropic's Mythos 5 model against its own production code; it surfaced a critical RCE spanning three safe-in-isolation commits, illustrating compositional risk that diff review misses.
Back