Loading story…
Microsoft paid $2.3 million to security researchers after its 2026 Zero Day Quest hacking contest produced nearly 700 submissions, including more than 80 high-impact vulnerabilities uncovered during a live event at the company's Redmond campus. Researchers from more than 20 countries tested Microsoft systems in authorized environments and reported serious cloud and AI issues such as credential exposure, SSRF chains, and cross-tenant access, with Microsoft saying customer data was not affected.
The contest forms part of Microsoft's Secure Future Initiative, launched after a U.S. government review sharply criticized the company's security culture and called for major improvements. Microsoft said it is expanding bug bounty incentives as part of that effort, citing a $5 million prize pool for the 2026 event, $1.6 million awarded after the 2025 contest, and a record $17 million paid to 344 researchers between July 2024 and June 2025; the company also highlighted growing attention to third-party code flaws in Microsoft services as part of a broader push for shared cybersecurity responsibility.
Track how attackers are adapting to this technology.
6 events from the most recent confirmed update back to the earliest known activity.
Microsoft announced it had awarded $2.3 million to security researchers for submissions from the 2026 Zero Day Quest contest. The payouts covered nearly 700 findings tied to cloud and AI security weaknesses.
During Microsoft's 2026 Zero Day Quest live hacking event at its Redmond campus, researchers from more than 20 countries submitted nearly 700 findings and identified more than 80 high-impact cloud and AI vulnerabilities. The flaws included credential exposure, SSRF chains, and cross-tenant access issues, all tested in authorized environments without affecting customer data.
Following its 2025 Zero Day Quest contest, Microsoft paid out $1.6 million for more than 600 submissions. The event preceded the larger 2026 contest and showed growing researcher participation.
Between July 2024 and June 2025, Microsoft paid a record $17 million to 344 researchers through its bug bounty program. This reflected a major expansion of the company's vulnerability reward efforts.
Microsoft launched its Secure Future Initiative in response to the critical review of its security practices. The program emphasized transparency and secure-by-design improvements across the company.
A U.S. Department of Homeland Security Cyber Safety Review Board report found Microsoft's security culture inadequate and in need of overhaul. The criticism later served as the catalyst for broader security changes at the company.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft has announced a significant expansion of its bug bounty program, now offering rewards for critical vulnerabilities found in any of its online services, regardless of whether the flaw exists in Microsoft-owned code or third-party components. This new 'in scope by default' approach was unveiled by Tom Gallagher, VP of engineering at the Microsoft Security Response Center, during Black Hat Europe. The policy shift means that all new Microsoft online services are automatically eligible for bounty awards from launch, and researchers will be compensated for impactful vulnerabilities in both Microsoft and third-party codebases, including open-source and commercial dependencies. The change is part of Microsoft's broader Secure Future Initiative, which aims to strengthen the company's security posture amid an evolving threat landscape, particularly in cloud and AI domains. In addition to the expanded bounty program, Microsoft has recently implemented other security measures, such as disabling all ActiveX controls in Microsoft 365 and Office 2024 apps and updating security defaults to block legacy authentication methods. Over the past year, Microsoft has paid out over $17 million in bounty awards, underscoring its commitment to incentivizing security research in the highest-risk areas targeted by threat actors.
Jun 29, 2026
Microsoft said Windows customers should expect more frequent security updates as the company expands AI-driven vulnerability discovery across its codebase. The effort centers on **MDASH**, a proprietary multi-model scanning system used by Microsoft's Autonomous Code Security team to scan critical Windows components, validate findings with multiple AI models, and reduce false positives through a Windows-specific validation pipeline. Microsoft said AI is also being used to analyze failures, suggest fixes, and locate similar flaws elsewhere in source code, while human engineers remain responsible for reviewing code changes and approving remediations. The company said MDASH has already contributed to the disclosure of **16 previously unknown Windows vulnerabilities**, including **four Critical remote code execution flaws** affecting the **TCP/IP kernel stack**, **IKEv2**, **Netlogon**, and the **DNS API library**, all patched in a May 2026 security release. Microsoft also tied the initiative to updates in its **Secure Development Lifecycle** to address AI-enabled attack techniques and introduce AI earlier in development, while reports noted that June 2026 Patch Tuesday fixed more than 200 vulnerabilities, underscoring how AI-assisted discovery is beginning to affect Microsoft's patching cadence and enterprise update workloads.
Jul 15, 2026
Researchers at **Pwn2Own Berlin 2026** earned **$523,000** on the first day after demonstrating **24 unique zero-day vulnerabilities** against fully patched targets spanning browsers, operating systems, AI platforms, and NVIDIA-related infrastructure. The standout exploit came from **Orange Tsai** of **DEVCORE Research Team**, who chained **four logic bugs** to escape the **Microsoft Edge** sandbox and collected **$175,000**. **Windows 11** was also successfully compromised three times through separate local privilege-escalation zero-days, underscoring continued risk in core desktop platforms. Other successful demonstrations targeted **Red Hat Linux for Workstations**, **NVIDIA Container Toolkit**, **NVIDIA Megatron Bridge**, **LiteLLM**, **Chroma**, **OpenAI Codex**, and **LM Studio**, showing that enterprise AI tooling was a major attack surface at the event. Some attempts, including attacks against **Oracle Autonomous AI Database** and one **OpenAI Codex** entry, failed, but AI products still featured prominently as the competition’s enterprise-and-AI theme drove testing. After day one, **DEVCORE Research Team** led the standings with **$205,000**, and disclosed bugs now move into the contest’s **90-day vendor remediation window**.
Jun 29, 2026