PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

A Bountiful Year: Top Bugs and Hacktivity Highlights in 2016

hackerone.com | blog | #bug-bounty | #php | #deserialization | #year-in-review | #hackerone | #hacktivity
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

HackerOne's 2016 Hacktivity year in review: the community's five most upvoted vulnerability reports, led by a PHP deserialization chain enabling remote shell, plus payouts like $12,500 — the largest from HackerOne's own program.
Published
Collected

Related coverage

blog · hackerone.com
Critical PHP Vulnerabilities: What Security Teams Need to Know
Learn about the critical PHP vulnerabilities, HackerOne’s response, and the rise in reports. Review patching guidance and coordinated disclosure practices.
research · github.com
Steal My Bitcoin Challenge Writeup: PHP 8.4.26 Session Upload Progress Memory Exhaustion Analysis
Provides a detailed binary-level case study on PHP Zend memory manager behavior and worker state persistence after fatal out-of-memory errors.
research · projectdiscovery.io
PHP2Shell: finding and patching affected PHP
Two CVSS 9.2 bugs in the PHP runtime allow unauthenticated code execution; the patch is a package upgrade and a restart, and this guide shows how to find every PHP runtime you need to patch.
blog · hackerone.com
Measuring The Fix: How We Evaluate Frontier Models on Remediation Quality
HackerOne tested frontier models on security fix quality and found the judge mattered more than the model. See how CTEM remediation earns engineer trust.
blog · hackerone.com
Project Glasswing: What We Learned Running a Frontier Model on Our Own Codebase
HackerOne ran Anthropic's Mythos 5 model against its own production code; it surfaced a critical RCE spanning three safe-in-isolation commits, illustrating compositional risk that diff review misses.
blog · hackerone.com
CTEM for Enterprise: Scaling Continuous Exposure Management Across Complex Environments
This coverage gives security teams current context for monitoring, validation, and remediation.
Back