PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

HackerOne Joins Forces with Node.js Foundation to Build a Safer Internet

hackerone.com | vulnerability | #bug-bounty | #open-source | #community | #vulnerability-disclosure | #hackerone | #nodejs | #internet-bug-bounty
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

HackerOne joins the Node.js Foundation as a Silver member, boosting open-source security work with disclosures for GitLab, WordPress and Nextcloud and Internet Bug Bounty's infrastructure rewards.
Published
Collected

Related coverage

blog · hackerone.com
Report Smarter, Not Harder: HackerOne's Case for Better CIRCIA Rules
This coverage gives security teams current context for monitoring, validation, and remediation.
tool · projectdiscovery.io
Community Spotlight: Rishi (@rxerium)
“Open source isn’t about perfection; it’s about putting an idea forward and improving it together as a community.” Rishi (@rxerium) If you’ve spent any time in the Nuclei Templates repository, you’ve almost certainly run something Rishi engineered. With over 500 templates merged, picked up by the likes of the UK’s National Cyber Security Center (NCSC), California Cybersecurity Integration Center, CERT Polska, Spain’s national security agency, and many others, he’s one of the most prolific con
blog · wiz.io
Increasing transparency in cloud security: Wiz is now a CVE Numbering Authority (CNA)
Wiz became a CVE Numbering Authority able to assign CVE IDs and disclose cloud vulnerabilities—the latest step after helping build the community cloud vulnerability database.
vulnerability · hackerone.com
HackerOne CEO joins Node.js Foundation Board
HackerOne joins the Node.js Foundation with CEO Marten Mickos on its board; he discusses the platform's 140,000 hackers, 55,000 fixed vulnerabilities, and CVE work with the Node Security Project.
vulnerability · yeswehack.com
CVE-2023-54391 and beyond: excavating silent patches and the attacker-defender information gap
CVE-2023-54391: a Proxmox VE auth bypass fixed silently in 2023, exploited in 2026 before any advisory. The piece taxonomizes 'silent patch gaps' and why AI-assisted diffing makes them cheap to mine.
vulnerability · about.gitlab.com
Critical remote code execution in vm2, a widely used Node.js sandbox library
GitLab's Threat Research Group found a critical vm2 sandbox escape (CVSS 10.0) reachable with require.external enabled per the library's README; v3.11.7 blocks it, but config hardening is still urged.
Back