PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Apple declines to pay Kaspersky vuln reward, Bug Bounty ‘extortion’ dispute, Microsoft Recall backlash – OffSec roundup for CISOs

yeswehack.com | blog | #bug-bounty | #cloud | #apple | #ciso | #disclosure | #roundup | #kaspersky
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Inaugural CISO roundup: Apple declining to pay Kaspersky for iOS zero-days, Microsoft's Azure Service Tags dispute with Tenable, and Certik returning $3m to Kraken amid extortion claims.
Published
Collected

Related coverage

blog · hackenproof.com
Inside American Express India's Cloud Storage Exposure
An open MongoDB exposed 3M American Express India records, including Aadhaar and PAN numbers. What happened, and does Amex run a bug bounty today?
tool · github.com
Apple Private Cloud Compute (PCC) Security Source Code and Research Tools
Provides unprecedented source-level visibility into Apple's cloud AI infrastructure, allowing security researchers to verify cryptographic privacy guarantees and audit components eligible for Apple's PCC Security Bounty.
blog · yeswehack.com
‘AI a force multiplier not a replacement’, small vs large models, the state of vibe-coded security – ethical hacker news roundup
Roundup: Xclow3n argues AI is a force multiplier but expert judgment still separates noise from CVEs; LiveOverflow finds smaller LLMs win on cost-to-recall; plus the state of vibe-coded security.
blog · yeswehack.com
The Mythos moment, accelerating exploits, CVE Program under pressure – offsec roundup for CISOs
A CISO roundup: Anthropic's Mythos delay as part of exploitation-automation trends, why Bug Bounty still matters amid record Google payouts, shrinking time-to-exploitation and CVE Program pressure.
blog · yeswehack.com
Notepad++ hijack, pwning Claude Code, top web hacking techniques of 2025 – ethical hacker news roundup
Roundup: PortSwigger's top 10 web hacking techniques of 2025 (won by error-based SSTI research), a six-bug pre-auth RCE chain in a SIEM/SOAR appliance, and notable writeups.
blog · yeswehack.com
LLM bug hunters lack intuition, ‘security teams will consolidate visibility’ in 2026, EU Cyber Act vuln disclosure revisions – offsec roundup for CISOs
A CISO roundup: the EU's revised Cybersecurity Act strengthening vulnerability disclosure, 2026 predictions on consolidating visibility and AI agents, and post-quantum migration pressure.
Back