PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

What Hardware Manufacturers Can Learn From OPPO's Vulnerability Prioritization Program

hackerone.com | blog | #vulnerability-management | #compliance | #hardware-security | #hackerone | #cra | #oppo
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Lessons for hardware makers from OPPO: with the EU Cyber Resilience Act requiring 24-hour reporting of exploited flaws, OPPO runs 120+ assets on HackerOne with triage under 30 days.
Published
Collected

Related coverage

research · eshard.com
What does the EU Cyber Resilience Act (CRA) mean for connected device manufacturers?
The Cyber Resilience Act is a new legislation proposed by the European Commission to improve the cybersecurity posture of organisations using digital assets.
blog · hackenproof.com
What Is Penetration Testing? How It Works, What You Get, and When to Test
A pentest is a time-boxed, authorized attack where ethical hackers chain flaws to prove exploitable risk, not just run scans. It outlines deliverables, audit drivers, and when to test.
blog · hackenproof.com
Vulnerability Disclosure Policy: A Guide for Business Leaders
Explains what a vulnerability disclosure policy is and why the EU CRA and NIS2 now make it a compliance expectation, then walks through the key decisions behind each policy section, offering a free template for security and legal teams to adapt.
blog · hackerone.com
Measuring The Fix: How We Evaluate Frontier Models on Remediation Quality
HackerOne tested frontier models on security fix quality and found the judge mattered more than the model. See how CTEM remediation earns engineer trust.
blog · hackerone.com
Critical PHP Vulnerabilities: What Security Teams Need to Know
Learn about the critical PHP vulnerabilities, HackerOne’s response, and the rise in reports. Review patching guidance and coordinated disclosure practices.
blog · hackerone.com
EU CRA Reporting Goes Live This Friday. Are You Ready?
The EU Cyber Resilience Act's mandatory reporting starts September 11: manufacturers must warn ENISA of exploited vulnerabilities within 24 hours, notify within 72, and then file follow-up reports.
Back