Meta's Bug Bounty Program marked its 15th anniversary, awarding over $4 million in bounties this year alone, totaling more than $25 million since its start. The program is expanding with a new pilot for experienced researchers and highlighting significant findings, including vulnerabilities in WhatsApp and Oculus.

A security researcher has criticized Apple's macOS bug bounty program for significantly lowering payouts for certain vulnerabilities. Despite increasing rewards for high-profile exploits, many macOS categories now offer much smaller financial incentives, which could discourage researchers from reporting flaws.

Microsoft will now reward researchers for identifying critical vulnerabilities in any of its online services, regardless of the code's origin. This change aims to enhance security by incentivizing the discovery of flaws in both Microsoft's own and third-party components that impact its services.

This article explores how differing syntax interpretations across programming languages can lead to security vulnerabilities. It outlines techniques for creating payloads that exploit these ambiguities, allowing attackers to bypass filters and perform unauthorized actions. Practical examples and case studies illustrate the potential impact of syntax confusion.

This article outlines key security vulnerabilities in Next.js applications, including SSRF, XSS, and CSRF. It provides practical tips and techniques for penetration testers to effectively assess Next.js apps.

This article examines early instances of cache poisoning vulnerabilities from various platforms like HackerOne and GitHub. It details how attackers exploited misconfigurations to compromise web applications, leading to severe impacts, including redirects, denial of service, and XSS attacks.

Apple has expanded its bug bounty program by doubling the maximum reward to $2 million for reporting zero-click remote compromise vulnerabilities, with potential payouts exceeding $5 million through bonuses. The program, which has awarded $35 million since its inception in 2020, also introduces new categories and increased rewards for various types of attacks, aiming to incentivize security researchers to report critical vulnerabilities. Additionally, Apple plans to distribute secured iPhone 17 devices to civil society organizations at risk of spyware attacks in 2026.

Microsoft awarded $17 million to 344 security researchers in the past year through its bug bounty programs, marking the highest annual payout since the programs began in 2018. The total amount distributed across all years now reaches $92.5 million, with ongoing updates to enhance program coverage and align with emerging security challenges.

The article explores the critical web vulnerability known as Insecure Direct Object References (IDOR), a common issue in access control that allows unauthorized users to access or modify data by manipulating identifiers in URLs and requests. It emphasizes the importance of proper access control mechanisms, outlines various types of access control flaws, and provides practical strategies for identifying and exploiting these vulnerabilities during bug bounty hunting.

HackerOne has disbursed $81 million in bug bounties over the past year, reflecting a 13% year-over-year increase. The demand for AI security has surged, with AI vulnerabilities rising by over 200%, while traditional vulnerabilities like XSS and SQL injection are declining. A significant number of researchers are now utilizing AI tools to enhance their security testing efforts.

A security researcher details their experience discovering multiple vulnerabilities in the McDonald's app and internal systems, highlighting poor security practices and difficulties in reporting issues. Despite successfully prompting fixes, the researcher emphasizes the need for better security channels and practices within the company.