Loading story…
Microsoft has announced a significant expansion of its bug bounty program, now offering rewards for critical vulnerabilities found in any of its online services, regardless of whether the flaw exists in Microsoft-owned code or third-party components. This new 'in scope by default' approach was unveiled by Tom Gallagher, VP of engineering at the Microsoft Security Response Center, during Black Hat Europe. The policy shift means that all new Microsoft online services are automatically eligible for bounty awards from launch, and researchers will be compensated for impactful vulnerabilities in both Microsoft and third-party codebases, including open-source and commercial dependencies.
The change is part of Microsoft's broader Secure Future Initiative, which aims to strengthen the company's security posture amid an evolving threat landscape, particularly in cloud and AI domains. In addition to the expanded bounty program, Microsoft has recently implemented other security measures, such as disabling all ActiveX controls in Microsoft 365 and Office 2024 apps and updating security defaults to block legacy authentication methods. Over the past year, Microsoft has paid out over $17 million in bounty awards, underscoring its commitment to incentivizing security research in the highest-risk areas targeted by threat actors.
See the reporting duties and controls this puts on the clock.
4 events from the most recent confirmed update back to the earliest known activity.
With the new approach, Microsoft said products and online services will be considered in scope by default, including newly launched offerings, rather than waiting for separate bounty program updates. The company said it expects bounty payouts to increase as a result of the broader coverage.
At Black Hat Europe 2025, Microsoft announced that any critical vulnerability with demonstrable impact on its online services would be eligible for a bounty, regardless of whether the affected code is Microsoft-owned, third-party, or open source. The change expanded coverage to flaws in third-party dependencies and services without previously defined bounty scope.
Over the year preceding the announcement, Microsoft awarded more than $17 million to 344 security researchers through its bug bounty programs. The payout level was cited as evidence of Microsoft's continued investment in external security research.
Microsoft launched its bug bounty program in 2013, establishing a formal process to reward security researchers for reporting vulnerabilities in its products and services.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
5 references tracked. Mallory keeps watching after this page renders.
go.theregister.com
Open sourcesecurityboulevard.com
Open sourcecsoonline.com
Open sourcebleepingcomputer.com
Open sourcemicrosoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft paid **$2.3 million** to security researchers after its 2026 **Zero Day Quest** hacking contest produced nearly **700 submissions**, including more than **80 high-impact vulnerabilities** uncovered during a live event at the company's Redmond campus. Researchers from more than 20 countries tested Microsoft systems in authorized environments and reported serious cloud and AI issues such as credential exposure, `SSRF` chains, and cross-tenant access, with Microsoft saying customer data was not affected. The contest forms part of Microsoft's **Secure Future Initiative**, launched after a U.S. government review sharply criticized the company's security culture and called for major improvements. Microsoft said it is expanding bug bounty incentives as part of that effort, citing a **$5 million** prize pool for the 2026 event, **$1.6 million** awarded after the 2025 contest, and a record **$17 million** paid to 344 researchers between July 2024 and June 2025; the company also highlighted growing attention to third-party code flaws in Microsoft services as part of a broader push for shared cybersecurity responsibility.
Jun 29, 2026
Apple has announced a significant expansion of its bug bounty program, raising the maximum payout for the most dangerous exploit chains to $2 million, with the potential for total rewards to reach $5 million when including bonuses. The company made this announcement at the Hexacon offensive security conference in Paris, emphasizing its commitment to incentivizing security researchers to report critical vulnerabilities rather than selling them to malicious actors. The new $2 million maximum applies specifically to exploit chains that could be abused for spyware, reflecting the growing threat posed by the mercenary spyware industry. Apple’s bonus structure further increases rewards for vulnerabilities that bypass Lockdown Mode, a security feature designed to protect users from sophisticated attacks, as well as for exploits discovered in beta versions of Apple software. The company’s bug bounty program now offers increased rewards across five key attack vectors, including full Gatekeeper bypasses with no user interaction, exploit chains involving WebKit code execution and sandbox escapes, unauthorized iCloud access, and wireless proximity exploits over all radio interfaces. For example, a full Gatekeeper bypass can earn $100,000, while a complex exploit chain involving WebKit, sandbox escape, and arbitrary entitlements can reach $1 million. Apple’s updated program ensures that the highest rewards are reserved for vulnerabilities affecting the latest versions of its software and hardware, which have the most advanced security protections. The company has also introduced Target Flags, a new mechanism to help researchers focus on specific areas of interest. Apple’s leadership has stated that these changes are intended to match the increasing difficulty and value of finding critical vulnerabilities in its ecosystem, especially as attackers continue to evolve their techniques. The company acknowledges that the time and expertise required to discover such vulnerabilities are considerable, and the new rewards are designed to reflect that effort. Apple’s move is seen as a direct response to the escalating arms race with mercenary spyware vendors, who are willing to pay high prices for zero-click exploits. The expanded bug bounty program is expected to attract more top-tier security researchers to responsibly disclose vulnerabilities. Apple’s approach also includes rewarding individual components of exploit chains, not just the full chain, to encourage incremental security improvements. The company’s ongoing investment in security features like Lockdown Mode and Memory Integrity Enforcement demonstrates its proactive stance against advanced threats. By offering some of the highest bug bounty rewards in the industry, Apple aims to set a new standard for vulnerability disclosure incentives. The changes to the bug bounty program will take effect next month, and Apple has indicated its willingness to pay out millions of dollars to researchers who help protect its users from the most severe threats.
Jun 29, 2026
Microsoft said Windows customers should expect more frequent security updates as the company expands AI-driven vulnerability discovery across its codebase. The effort centers on **MDASH**, a proprietary multi-model scanning system used by Microsoft's Autonomous Code Security team to scan critical Windows components, validate findings with multiple AI models, and reduce false positives through a Windows-specific validation pipeline. Microsoft said AI is also being used to analyze failures, suggest fixes, and locate similar flaws elsewhere in source code, while human engineers remain responsible for reviewing code changes and approving remediations. The company said MDASH has already contributed to the disclosure of **16 previously unknown Windows vulnerabilities**, including **four Critical remote code execution flaws** affecting the **TCP/IP kernel stack**, **IKEv2**, **Netlogon**, and the **DNS API library**, all patched in a May 2026 security release. Microsoft also tied the initiative to updates in its **Secure Development Lifecycle** to address AI-enabled attack techniques and introduce AI earlier in development, while reports noted that June 2026 Patch Tuesday fixed more than 200 vulnerabilities, underscoring how AI-assisted discovery is beginning to affect Microsoft's patching cadence and enterprise update workloads.
Jul 15, 2026