#1 Trusted Cybersecurity News Platform
Followed by 4.50+ million
The Hacker News Logo
Subscribe – Get Latest News
AI Security

vulnerability disclosure | Breaking Cybersecurity News | The Hacker News

The Rise of the Open Bug Bounty Project

The Rise of the Open Bug Bounty Project

Feb 06, 2020
Can you imagine launching a global bug bounty platform with almost 500,000 submissions and 13,000 researchers without consuming a cent from venture capitalists? If not, this success story is for you. The once skyrocketing bug bounty industry seems to be not in the best shape today. While prominent security researchers are talking about a growing multitude of hurdles they experience with the leading commercial bug bounty platforms, the latter are trying to reinvent themselves as "next-generation penetration testing" or similar services. You be the judge of how successful they will be. Generous venture funds have poured many millions into rapidly spending bug bounty startups that have not replaced Managed Penetration Testing (MPT) services (as some declared). However, these startups have positively improved the price/quality ratio of pen testing services on the global market. Amid the uncertainty for the future of commercial bug bounty platforms, the not-for-profit Op
Google Offers Financial Support to Open Source Projects for Cybersecurity

Google Offers Financial Support to Open Source Projects for Cybersecurity

Dec 18, 2019
Besides rewarding ethical hackers from its pocket for responsibly reporting vulnerabilities in third-party open-source projects, Google today announced financial support for open source developers to help them arrange additional resources, prioritizing the security of their products. The initiative, called " Patch Rewards Program ," was launched nearly 6 years ago, under which Google rewards hackers for reporting severe flaws in many widely used open source software, including OpenSSH, OpenSSL, Linux kernel, Apache, Nginx, jQuery, and OpenVPN. So far, Google has paid hundreds of thousands of dollars as bounty to hackers across the world who helped improve the overall security of many crucial open source software and technologies that power the Internet, operating systems, and networks. The company has now also decided to motivate volunteer work done by the open source community by providing upfront financial help to project teams, using which they can acquire addition
AppSec Webinar: How to Turn Developers into Security Champions

AppSec Webinar: How to Turn Developers into Security Champions

Jul 18, 2024App Security / Security Awareness
Let's face it: AppSec and developers often feel like they're on opposing teams. You're battling endless vulnerabilities while they just want to ship code. Sound familiar? It's a common challenge, but there is a solution. Ever wish they proactively cared about security? The answer lies in a proven, but often overlooked, strategy: Security Champion Programs — a way to turn developers from adversaries into security advocates? Join our upcoming FREE webinar, " Turn Developers into Allies: The Power of Security Champion Programs, " to discover the secrets behind this game-changing approach. In this webinar, you'll learn: Overcoming the Resistance: Proven tactics to bridge the gap between developers and security, fostering a spirit of collaboration and trust. The Power of Effective Communication: Learn how to make security messaging resonate with developers, without the jargon overload. Creating a Culture of Champions: Discover how to build a Securi
Facebook Now Pays Hackers for Reporting Security Bugs in 3rd-Party Apps

Facebook Now Pays Hackers for Reporting Security Bugs in 3rd-Party Apps

Oct 16, 2019
Following a series of security mishaps and data abuse through its social media platform, Facebook today expanding its bug bounty program in a very unique way to beef up the security of third-party apps and websites that integrate with its platform. Last year, Facebook launched " Data Abuse Bounty " program to reward anyone who reports valid events of 3rd-party apps collecting Facebook users' data and passing it off to malicious parties, violating Facebook's revamped data policies. Apparently, it turns out that most of the time, Facebook users' data that had been misused was exposed in the first place as the result of a vulnerability or security weakness in third-party apps or services. The Facebook ecosystem contains millions of third-party apps, and unfortunately, very few of them have a vulnerability disclosure program or offer bug bounty rewards to white-hat hackers for responsibly reporting bugs in their codebase. Because of this communication g
cyber security

How Can You Strengthen SaaS Security Without Impeding the Pace of Work?

websiteNudge SecuritySaaS Security / Governance
Learn how cloud-first org Stravito scaled their SaaS security program while cutting SaaS spend and supporting rapid company growth.
Google Increases Bug Bounty Payouts by 50% and Microsoft Just Doubles It!

Google Increases Bug Bounty Payouts by 50% and Microsoft Just Doubles It!

Mar 03, 2017
Well, there's some good news for hackers and bug bounty hunters! Both tech giants Google and Microsoft have raised the value of the payouts they offer security researchers, white hat hackers and bug hunters who find high severity flaws in their products. While Microsoft has just doubled its top reward from $15,000 to $30,000, Google has raised its high reward from $20,000 to $31,337, which is a 50 percent rise plus a bonus $1,337 or 'leet' award. In past few years, every major company, from Apple to P*rnHub and Netgear , had started Bug Bounty Programs to encourage hackers and security researchers to find and responsibly report bugs in their services and get rewarded. But since more and more bug hunters participating in bug bounty programs at every big tech company, common and easy-to-spot bugs are hardly left now, and if any, they hardly make any severe impact. Sophisticated and remotely exploitable vulnerabilities are a thing now, which takes more time and
Google sets 7 Day deadline For vulnerability disclosure

Google sets 7 Day deadline For vulnerability disclosure

May 31, 2013
Google will release details of any zero-day flaws it finds in software, if the affected vendor fails to issue a patch or disclose the issue itself within a week. Now, Google is shortening that timeline a good bit to just 7 days. " Based on our experience...we believe that more urgent action within 7 days is appropriate for critical vulnerabilities under active exploitation ", wrote Google Security engineers Chris Evans and Drew Hintz in a blog post . " The reason for this special designation is that each day an actively exploited vulnerability remains undisclosed to the public and unpatched, more computers will be compromised. " Right now, companies use either responsible disclosure or full disclosure when dealing with vulnerabilities . Responsible disclosure allows a company as much time as they want to patch an exploit, and the details surrounding the bug aren't revealed to the public until a patch is issued. Full disclosure, on the other hand, means the company and th
Expert Insights
Cybersecurity Resources