Loading story…
GitHub has overhauled its bug bounty program, reducing public-program payouts, replacing variable reward ranges with fixed amounts by severity, and creating a permanent invite-only VIP tier for researchers who consistently deliver high-impact findings. The company said the changes are intended to reduce triage pressure, improve researcher experience, and strengthen collaboration with trusted contributors, with the new structure applying to reports submitted on or after July 27, 2026.
Under the revised model, top rewards are being concentrated in the VIP program, which offers higher payouts, faster engagement, and closer access to GitHub’s security engineering team, while public submissions will face stricter quality controls. GitHub is also requiring stronger HackerOne signal from participants to curb low-effort and AI-generated reports, reflecting broader industry concern that automated and commoditized vulnerability discovery is increasing report volume while making validated, product-specific findings more valuable.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
GitHub announced major changes to its bug bounty program, including a permanent invite-only VIP tier for high-impact researchers, fixed public bounty payouts by severity, and a HackerOne signal requirement intended to reduce low-quality submissions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcexakep.ru
Open sourcesecurityonline.info
Open sourcehelpnetsecurity.com
Open sourcethehackernews.com
Open sourcegithub.blog
Open sourcehackerone.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GitHub has offered a **$100,000 bug bounty** for a **critical remote code execution (RCE)** vulnerability disclosed by security researcher `@sagitz_`. Public reporting indicates the company elevated the reward because of the severity of the issue, signaling that the flaw could have enabled highly impactful compromise if abused. Technical details, including an affected component, `CVE` identifier, and exploitation status, were not provided in the available reporting. Even so, the unusually large payout underscores the seriousness of the disclosed RCE and highlights GitHub's response through its vulnerability disclosure and bug bounty process.
Jul 23, 2026
HackerOne has reported a significant increase in bug bounty payouts, distributing $81 million to ethical hackers worldwide over the past 12 months, marking a 13% year-over-year growth. The platform, which manages over 1,950 bug bounty programs for major organizations such as Anthropic, Crypto.com, General Motors, GitHub, Goldman Sachs, Uber, and the U.S. Department of Defense, has seen its top 100 programs alone pay out $51 million between July 2024 and June 2025. The average annual payout per active program reached nearly $42,000, with the top 10 programs accounting for $21.6 million. Individual researchers are now consistently earning six-figure sums, and the top 100 all-time earners collectively received $31.8 million. A notable trend in the past year has been the dramatic rise in AI-related vulnerabilities, with prompt injection flaws increasing by 540% and overall AI security issues rising by more than 200%. This surge is attributed to both the expansion of enterprise AI security initiatives—growing at nearly three times last year's pace—and the emergence of 'bionic hackers' who leverage AI tools to enhance vulnerability discovery. In 2025, 1,121 bug bounty programs on HackerOne included AI in their scope, representing a 270% year-over-year increase, and autonomous AI-powered agents submitted over 560 valid reports. While traditional vulnerabilities such as cross-site scripting (XSS) and SQL injection (SQLi) have declined, authorization-related flaws, including insecure direct object reference (IDOR) and improper access control, are on the rise. HackerOne's CEO, Kara Sprague, highlighted the unprecedented scale at which security issues are being discovered due to the integration of AI in both offensive and defensive security practices. The company also noted that 70% of surveyed researchers have incorporated AI tools into their workflows, further accelerating the identification of vulnerabilities. The data underscores a shift in the threat landscape, with AI security becoming a primary concern for organizations participating in bug bounty programs. The increased payouts reflect both the growing complexity of vulnerabilities and the value organizations place on proactive security research. HackerOne's annual report serves as a barometer for industry trends, indicating that as AI adoption accelerates, so too does the need for robust security measures and incentives for ethical hackers. The platform's continued growth and the rising sophistication of its researcher community suggest that bug bounty programs will remain a critical component of organizational security strategies. The findings also emphasize the importance of adapting vulnerability management processes to address emerging threats, particularly those associated with AI technologies. As enterprises expand their AI initiatives, the collaboration between organizations and the ethical hacking community is proving essential in mitigating evolving risks. The report concludes that the intersection of AI and cybersecurity will continue to shape the future of vulnerability discovery and remediation.
Jul 12, 2026
Bug bounty programs have significantly enhanced software security by leveraging a global network of ethical hackers to identify vulnerabilities that internal teams may overlook. Organizations have benefited from cost-effective, continuous security testing, with real-world examples showing that even critical flaws missed by experienced engineers can be discovered by external researchers, sometimes preventing losses in the millions. The diversity and scale of the bug bounty community have enabled companies to access a wide range of skills and perspectives, making digital systems safer and more resilient. However, the operational complexity of managing bug bounty programs has led to new challenges. The rise of bug bounty platforms as intermediaries was intended to filter out noise and streamline vulnerability management, but these platforms now struggle with overwhelming volumes of low-quality, duplicate, and AI-generated reports. The triage process has become bogged down by administrative burdens, reducing the effectiveness of these platforms and prompting a shift toward more targeted, expert-driven security testing as part of continuous offensive security programs. Organizations are increasingly seeking solutions that prioritize actionable risk reduction over sheer volume of findings.
Jul 12, 2026