PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Shopify Awards $116,000 to Hackers in Canada: h1-514 Recap

hackerone.com | blog | #bug-bounty | #rce | #hackerone | #shopify | #live-hacking-event | #h1-514 | #montreal
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Forty hackers from 12 countries hacked Shopify at the h1-514 live event in Montréal, earning over $116,000 for 55 valid vulnerabilities, including a $15,000 RCE in Shopify's Kit.
Published
Collected

Related coverage

blog · hackerone.com
Commerce Giant Shopify Kicks Off 2021 with HackerOne (Virtual) Live Hacking Event: h1-2102
Shopify hosted its third HackerOne live hacking event h1-2102, a 10-day virtual challenge with over 30 hackers from seven countries, giving researchers access to closed, high-impact systems.
research · github.com
Steal My Bitcoin Challenge Writeup: PHP 8.4.26 Session Upload Progress Memory Exhaustion Analysis
Provides a detailed binary-level case study on PHP Zend memory manager behavior and worker state persistence after fatal out-of-memory errors.
vulnerability · vercel.com
Our $1 million hacker challenge for React2Shell
We paid $1M to security researchers to break our WAF. Here's what we learned defending against React2Shell.
blog · hackerone.com
Measuring The Fix: How We Evaluate Frontier Models on Remediation Quality
HackerOne tested frontier models on security fix quality and found the judge mattered more than the model. See how CTEM remediation earns engineer trust.
blog · hackerone.com
Critical PHP Vulnerabilities: What Security Teams Need to Know
Learn about the critical PHP vulnerabilities, HackerOne’s response, and the rise in reports. Review patching guidance and coordinated disclosure practices.
blog · hackerone.com
Project Glasswing: What We Learned Running a Frontier Model on Our Own Codebase
HackerOne ran Anthropic's Mythos 5 model against its own production code; it surfaced a critical RCE spanning three safe-in-isolation commits, illustrating compositional risk that diff review misses.
Back