Loading story…
Apple has announced a significant expansion of its bug bounty program, raising the maximum payout for the most dangerous exploit chains to $2 million, with the potential for total rewards to reach $5 million when including bonuses. The company made this announcement at the Hexacon offensive security conference in Paris, emphasizing its commitment to incentivizing security researchers to report critical vulnerabilities rather than selling them to malicious actors. The new $2 million maximum applies specifically to exploit chains that could be abused for spyware, reflecting the growing threat posed by the mercenary spyware industry. Apple’s bonus structure further increases rewards for vulnerabilities that bypass Lockdown Mode, a security feature designed to protect users from sophisticated attacks, as well as for exploits discovered in beta versions of Apple software. The company’s bug bounty program now offers increased rewards across five key attack vectors, including full Gatekeeper bypasses with no user interaction, exploit chains involving WebKit code execution and sandbox escapes, unauthorized iCloud access, and wireless proximity exploits over all radio interfaces. For example, a full Gatekeeper bypass can earn $100,000, while a complex exploit chain involving WebKit, sandbox escape, and arbitrary entitlements can reach $1 million. Apple’s updated program ensures that the highest rewards are reserved for vulnerabilities affecting the latest versions of its software and hardware, which have the most advanced security protections. The company has also introduced Target Flags, a new mechanism to help researchers focus on specific areas of interest. Apple’s leadership has stated that these changes are intended to match the increasing difficulty and value of finding critical vulnerabilities in its ecosystem, especially as attackers continue to evolve their techniques. The company acknowledges that the time and expertise required to discover such vulnerabilities are considerable, and the new rewards are designed to reflect that effort. Apple’s move is seen as a direct response to the escalating arms race with mercenary spyware vendors, who are willing to pay high prices for zero-click exploits. The expanded bug bounty program is expected to attract more top-tier security researchers to responsibly disclose vulnerabilities. Apple’s approach also includes rewarding individual components of exploit chains, not just the full chain, to encourage incremental security improvements. The company’s ongoing investment in security features like Lockdown Mode and Memory Integrity Enforcement demonstrates its proactive stance against advanced threats. By offering some of the highest bug bounty rewards in the industry, Apple aims to set a new standard for vulnerability disclosure incentives. The changes to the bug bounty program will take effect next month, and Apple has indicated its willingness to pay out millions of dollars to researchers who help protect its users from the most severe threats.
See the reporting duties and controls this puts on the clock.
2 events from the most recent confirmed update back to the earliest known activity.
Coverage of the updated program said Apple also introduced bonus payouts that can raise rewards to as much as $5 million for zero-click spyware-class exploits that bypass Lockdown Mode. This expanded the scope of the announcement beyond the new $2 million base maximum.
Apple announced changes to its Security Bounty program, increasing the maximum reward to $2 million for qualifying zero-click remote code execution exploit chains. Multiple reports describe the move as a response to the growing threat from high-end exploit development and commercial spyware activity.
See what this changes for your reporting obligations and which controls it puts on the clock.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apple quietly changed its security report intake in June 2026 to limit how many active vulnerability submissions some researchers can keep open at once, after a wave of AI-assisted reports increased triage pressure and included many claims the company considered low-quality or nonexistent. The company now requires human validation before confirming submissions, allows researchers to request higher limits, and is also using AI internally to help process incoming reports. Apple’s bug bounty rules already warn that repeated ineligible or theoretical AI-generated submissions can trigger a 180-day suspension or permanent removal from the program. The policy drew attention after Italian security startup **Bynario** said its Atlas platform, using **GPT-5.5**, identified more than 50 possible flaws in the latest macOS release within three weeks, but the cap initially prevented it from submitting all findings. Apple and Bynario both acknowledged that at least one report was valid: **`CVE-2026-43760`**, a macOS Screen Sharing flaw that could allow an authenticated **VNC** user to access protected data and create files with root privileges, later fixed in **macOS Tahoe 26.6**. The dispute has highlighted a broader industry problem as AI speeds up vulnerability discovery faster than vendors and bug bounty platforms can review reports, raising concerns that blunt submission limits could also delay legitimate disclosures.
Aug 6, 2026
Microsoft has announced a significant expansion of its bug bounty program, now offering rewards for critical vulnerabilities found in any of its online services, regardless of whether the flaw exists in Microsoft-owned code or third-party components. This new 'in scope by default' approach was unveiled by Tom Gallagher, VP of engineering at the Microsoft Security Response Center, during Black Hat Europe. The policy shift means that all new Microsoft online services are automatically eligible for bounty awards from launch, and researchers will be compensated for impactful vulnerabilities in both Microsoft and third-party codebases, including open-source and commercial dependencies. The change is part of Microsoft's broader Secure Future Initiative, which aims to strengthen the company's security posture amid an evolving threat landscape, particularly in cloud and AI domains. In addition to the expanded bounty program, Microsoft has recently implemented other security measures, such as disabling all ActiveX controls in Microsoft 365 and Office 2024 apps and updating security defaults to block legacy authentication methods. Over the past year, Microsoft has paid out over $17 million in bounty awards, underscoring its commitment to incentivizing security research in the highest-risk areas targeted by threat actors.
Jun 29, 2026
HackerOne has reported a significant increase in bug bounty payouts, distributing $81 million to ethical hackers worldwide over the past 12 months, marking a 13% year-over-year growth. The platform, which manages over 1,950 bug bounty programs for major organizations such as Anthropic, Crypto.com, General Motors, GitHub, Goldman Sachs, Uber, and the U.S. Department of Defense, has seen its top 100 programs alone pay out $51 million between July 2024 and June 2025. The average annual payout per active program reached nearly $42,000, with the top 10 programs accounting for $21.6 million. Individual researchers are now consistently earning six-figure sums, and the top 100 all-time earners collectively received $31.8 million. A notable trend in the past year has been the dramatic rise in AI-related vulnerabilities, with prompt injection flaws increasing by 540% and overall AI security issues rising by more than 200%. This surge is attributed to both the expansion of enterprise AI security initiatives—growing at nearly three times last year's pace—and the emergence of 'bionic hackers' who leverage AI tools to enhance vulnerability discovery. In 2025, 1,121 bug bounty programs on HackerOne included AI in their scope, representing a 270% year-over-year increase, and autonomous AI-powered agents submitted over 560 valid reports. While traditional vulnerabilities such as cross-site scripting (XSS) and SQL injection (SQLi) have declined, authorization-related flaws, including insecure direct object reference (IDOR) and improper access control, are on the rise. HackerOne's CEO, Kara Sprague, highlighted the unprecedented scale at which security issues are being discovered due to the integration of AI in both offensive and defensive security practices. The company also noted that 70% of surveyed researchers have incorporated AI tools into their workflows, further accelerating the identification of vulnerabilities. The data underscores a shift in the threat landscape, with AI security becoming a primary concern for organizations participating in bug bounty programs. The increased payouts reflect both the growing complexity of vulnerabilities and the value organizations place on proactive security research. HackerOne's annual report serves as a barometer for industry trends, indicating that as AI adoption accelerates, so too does the need for robust security measures and incentives for ethical hackers. The platform's continued growth and the rising sophistication of its researcher community suggest that bug bounty programs will remain a critical component of organizational security strategies. The findings also emphasize the importance of adapting vulnerability management processes to address emerging threats, particularly those associated with AI technologies. As enterprises expand their AI initiatives, the collaboration between organizations and the ethical hacking community is proving essential in mitigating evolving risks. The report concludes that the intersection of AI and cybersecurity will continue to shape the future of vulnerability discovery and remediation.
Jul 12, 2026