A researcher reported a critical PS5 hypervisor vulnerability to Sony for $50,000, triggering fierce debate and halting the PS5 Linux project.
Related Posts:
The post PS5 Hypervisor Vulnerability Bounty Sparks Backlash appeared first on Daily CyberSecurity.
Update — October 30, 2026: Thank you to everyone who has participated in the PHP Capture the Flag challenge. We have received a strong response from the security research community, and the submissions have helped us harden our existing php2shell WAF protections and create new detections.
Details of managed-rule changes are available in the Cloudflare WAF changelog.
The CTF remains open. We encourage researchers to continue submitting materially distinct, reproducible bypasses through the Cloudflare HackerOne program. We will share further information and feedback as the challenge progresses. Thank you again for your contributions.
Last week was one for the Internet security history books. First, eight eMudhra intermediate certificates were compromised, creating the possibility of forged certificates that could be used to impersonate servers. Then came php2shell: serious vulnerabilities in PHP, the runtime behind a large portion of the Web.
Cloudflare worked around the clock as these events unfolded to protect our customers and help protect the Internet. We shipped client updates and multiple mitigations, updated our web application firewall (WAF) with new rules to block attackers from exploiting the PHP vulnerabilities, and introduced a new feature called full transaction detection.
As always in situations like this, these new capabilities were made available on all plans, including Free.
Protecting systems from vulnerabilities like these is always an ongoing process, not a one-time event. The widespread adoption of AI allows attackers to discover new vectors with unprecedented speed and efficiency, so collecting real-world data to test our assumptions and strengthen defenses is essential.
That’s why today we're launching the Cloudflare PHP Capture the Flag challenge, run through our Bug Bounty program. We've put a deliberately vulnerable PHP installation behind our WAF, and we're inviting security researchers on HackerOne to try to bypass the protections and capture a flag.
We are keeping this simple. The challenge focuses on CVE-2026-109618 and CVE-2026-109619, the two PHP vulnerabilities behind php2shell. The target runs stock PHP 8.5.11 (with standard PHP extensions), Apache 2 (via mod_php), and an empty index.php inside a Cloudflare Container, with our default WAF protection rules for these vulnerabilities enabled in front of it. Inside the sandbox is a file called /flag.
The sandbox is reset every few minutes, including the flag file.
Your mission, should you choose to accept it: bypass the WAF protections, exploit the PHP sandbox, and recover the contents of /flag. You can use your own research tools. The challenge page has the environment details, scope, and flag verification form.
This limited-time challenge is run via Cloudflare's Bug Bounty program on HackerOne. All aspects of this challenge are subject to HackerOne terms and the Cloudflare HackerOne program rules the (“Bounty Terms”). If you find an eligible bypass, you must follow these requirements in order to claim the bounty:
UI verification does not submit a HackerOne report or establish reporting priority. File disclosure without RCE, RCE without successful flag recovery and UI verification, local-only exploits, rediscovery of the known PHP vulnerabilities, and WAF detection differences or partial chains without the full objective are not eligible.
Awards require a materially distinct Firewall (WAF) bypass method, even for the same PHP CVE. Reports using the same Firewall-bypass mechanism are duplicates, regardless of differences in the PHP exploit, payload, RCE technique, or flag-recovery method. New flags, resets, attempt IDs, or cosmetic changes—including equivalent encodings—do not qualify as unique. Equivalent submissions are duplicates even if unfixed; only the first complete, reproducible HackerOne report is considered. Cloudflare makes final duplicate and reward decisions.
We record attempted metadata and request payloads to help analyze reports, so please use test data only. Do not send credentials, personal information, or anything else you would not want included in a research record. Read Cloudflare’s privacy notice before testing.
Testing is authorized only against the challenge hostname's WAF-protected /php/* endpoints (POST method only). Other Cloudflare services, direct access to the underlying infrastructure, the upstream PHP project, and third-party systems are out of scope. No denial of service, high-volume scanning, persistence, social engineering, or attacks on other participants. If you get a 429 or 503, back off.
In the event of any conflict between this blog post and the Bounty Terms, the Bounty Terms shall prevail.
Cloudflare reserves the right to suspend or terminate this challenge at any time. Once the competition is removed from HackerOne, it is officially terminated, so please refer to the Cloudflare HackerOne page for the most up-to-date information on whether this challenge remains open.
Our WAF protects you, but it is not a replacement for fixing vulnerable software. Response blocking can prevent exposed data from reaching an attacker, but it cannot undo actions already performed at the origin. If you run PHP, follow the latest PHP security advisories and apply the relevant updates.
Last week was a reminder that helping build a better Internet often takes many people—researchers, maintainers, and teams across the industry—doing difficult, urgent work together.
We hope this challenge gives everyone a useful way to join in. Head over to php-rce.cloudflare.app if you want to participate: the flag is there, and we'd like to know if you can get it.
Microsoft has introduced a new report-assessment system across its bug bounty programs, making the evidence security researchers submit a key factor in their rewards.
Under the Azure bounty program, eligible critical remote code execution and privilege escalation reports can earn $40,000 when assessed as Complete, compared with $4,000 when marked Not Complete.
The change applies to reports submitted from October 20, 2026, at 8 AM Pacific Time. Earlier submissions remain subject to the previous report quality requirements.
Microsoft says the update aims to reduce requests for missing details and help its security teams reproduce and assess vulnerabilities faster.
The $40,000 figure is not a standard payment for every Azure vulnerability. Microsoft’s Azure Bounty Program ties awards to security impact, severity, and report completeness.
Critical information disclosure reports carry general awards of $12,000 when complete and $1,200 when incomplete. Critical spoofing and tampering reports qualify for $8,000 or $800, respectively.
Important remote code execution reports can receive $30,000 when complete, against $3,000 when incomplete. Azure’s published award range remains $400 to $60,000, with additional rewards possible at Microsoft’s discretion. Certain high-impact scenarios also carry percentage increases.
A complete report does not automatically qualify for payment or make a vulnerability critical. Microsoft assesses severity and security impact separately. Azure submissions must also meet program rules, including demonstrating an eligible issue on the latest, fully patched service or product.
Microsoft expects clear reproduction steps, a reliable proof of concept, the vulnerability type, and accurate technical analysis. Researchers must identify the affected environment, relevant versions, attack requirements, and what an attacker could achieve. They should explain the root cause where possible.
The key test is whether an engineer unfamiliar with the finding can reproduce and assess it using the initial submission. Missing a required detail or supporting file can result in a Not Complete assessment, even if Microsoft later requests more information.
Evidence requirements depend on the vulnerability. Memory corruption reports may need crash data, call stacks, and proof-of-concept source code.
File redirection findings may require Process Monitor logs, while NTLM coercion or relay reports may need packet captures. Web application findings can require videos and scripts.
Researchers must enter reproduction steps and technical details directly into the MSRC Researcher Portal fields. An attached document does not replace those entries. Microsoft’s report completeness guidance explains the required evidence.
Microsoft says AI-assisted research makes it easier to submit potential findings at scale. It welcomes AI use, but reports must still contain accurate analysis and evidence that demonstrates the issue.
Previous reporting on Azure application spoofing flaws shows why the exact bypass matters. Researchers demonstrated how invisible Unicode characters could defeat restrictions on reserved application names.
Coverage of a Microsoft authentication flaw also illustrates the link between research, disclosure, and remediation. After receiving the report, Microsoft restricted the affected endpoint and awarded the researcher $5,000.
For researchers, the practical change is that documentation now carries a clear financial consequence. A valid finding needs a reproducible demonstration, supported technical claims, and the required files from the start. Testing must still stay within Microsoft’s rules rather than exceed permitted access simply to prove greater impact.
Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.
The post Microsoft Offers $40,000 for Complete Azure Vulnerability Reports, Just $4,000 for Incomplete Ones appeared first on Cyber Security News.
Google restructures its Chrome VRP rewards, raising baseline payouts for memory corruption bugs to $2,000 and offering up to $20,000 for critical exploits.
Related Posts:
The post Google Updates Chrome VRP Rewards for Memory Flaws appeared first on Daily CyberSecurity.
Learn AI-assisted recon, payload generation, and report writing alongside Burp Suite in this lifetime course.
The post Use AI to Hunt Bugs Smarter With This $14.99 Course appeared first on TechRepublic.
Google has stopped accepting new “product vulnerability” reports through its Open Source Software Vulnerability Reward Program (OSS VRP) due to a significant increase in automated submissions that are predominantly invalid. This restriction took effect on October 1, 2026, and Google plans to provide an update regarding this part of the program in the first quarter […]
The post Google Tightens Open-Source Bug Bounty Rules After Surge in AI-Generated Vulnerability Reports appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
Learn how the LLM-generated PhantomRaven information stealer targets developers. The PhantomRaven information stealer uses npm to hijack CI/CD secrets.
Related Posts:
The post LLM-Generated PhantomRaven Information Stealer Discovered appeared first on Daily CyberSecurity.
Entrar