Loading story…
Security researcher Joseph Thacker proposed Operation Floodlight, a U.S. government-funded bug-bounty grant program to pay for verified high-severity vulnerabilities affecting critical-infrastructure systems that fall outside existing disclosure programs and commercial bug-bounty scopes. The proposal warns that AI-assisted vulnerability research is lowering discovery costs, increasing the likelihood that serious flaws in internet-facing systems are exploited, privately sold, publicly disclosed without coordination, or never reported.
Floodlight would offer payouts and safe-harbor protections for good-faith researchers, centralized vulnerability validation and disclosure coordination, and possible remediation grants for under-resourced asset owners. The recommended pilot would prioritize healthcare, water, emergency services, and state or local government vendors, using professional triage and expedited handling for vulnerabilities with major public-safety implications; the proposal aligns with broader efforts such as Operation Patchlight and CISA’s critical-infrastructure protection framework.
See the actors and campaigns active against you right now.
1 event from the most recent confirmed update back to the earliest known activity.
Joseph Thacker proposed Operation Floodlight, a U.S. government-funded bounty and disclosure-coordination program for reproducible high- and critical-severity vulnerabilities affecting critical infrastructure that fall outside existing vulnerability-disclosure and bug-bounty scopes. The proposal includes safe-harbor rules, centralized validation, researcher payouts, and a suggested pilot focused on healthcare, water, emergency services, and relevant state or local government vendors.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Recent discussions in the cybersecurity community have highlighted the evolving landscape of vulnerability disclosure, particularly focusing on the legal and contractual restrictions imposed by managed bug bounty programs. Experts warn that confidentiality agreements required by some platforms can prevent researchers from publicly sharing their findings, undermining the original intent of coordinated vulnerability disclosure (CVD) and potentially allowing software vulnerabilities to remain unaddressed. This shift has sparked debate about the balance between responsible disclosure, researcher rights, and vendor interests, as well as the broader impact on software security. At the same time, bug bounty programs are increasingly recognized as a strategic solution for organizations seeking to enhance their security posture. These programs offer economic efficiency by leveraging external expertise and paying only for validated vulnerabilities, allowing organizations to redirect resources toward remediation and proactive security initiatives. However, the rise of such programs also brings new challenges, including the need to ensure that legal frameworks do not stifle the open exchange of critical security information or hinder the overall effectiveness of vulnerability management efforts.
Jun 29, 2026
The White House has launched **Gold Eagle**, a federal AI-backed clearinghouse designed to collect software vulnerability findings from government and industry, prioritize the most consequential flaws, and coordinate remediation across critical infrastructure. Created under a June 2 executive order, the initiative brings together the White House, **CISA**, the Departments of **Treasury**, **Homeland Security**, and **Defense**, along with open-source software organizations and critical infrastructure operators. Administration officials said the program is already processing vulnerability reports and using AI to help identify weaknesses, share threat intelligence, and accelerate patching before attackers can exploit them. The announcement positions Gold Eagle as a coordination mechanism rather than a mandate for companies to fix vulnerabilities, and several operational details remain undisclosed. Officials have not identified all participating companies, explained who will handle day-to-day operations, or detailed how sensitive vulnerability data will be protected, and they have not said whether any processed findings have yet resulted in completed patches. The effort comes as federal agencies push faster remediation timelines for high-risk flaws and as policymakers warn that increasingly capable AI models could speed vulnerability discovery and exploit development, particularly in widely used open-source software such as **Log4J**.
Sep 3, 2026
The Linux Foundation announced a **$12.5 million** initiative to strengthen open-source security and help maintainers manage a surge of low-quality, AI-generated vulnerability reports that are overwhelming triage and review processes. Funding comes from **Anthropic, AWS, GitHub, Google, Google DeepMind, Microsoft, and OpenAI**, and the program will be run through **Alpha-Omega** and the **Open Source Security Foundation (OpenSSF)** to improve remediation workflows, expand practical security support, and build longer-term resilience for widely used open-source software. Project leaders and maintainers said the volume of automated submissions has outpaced the capacity of many open-source teams, turning vulnerability handling into an operational burden. The effort follows complaints from groups including the **Python Software Foundation** and the **cURL** project, whose maintainer ended its bug bounty program after being flooded with poor-quality AI-generated reports; GitHub is also providing **$5.5 million** in Azure credits and support services, while Google said it plans to contribute security tools including **Big Sleep**, **CodeMender**, and research such as **Sec-Gemini**.
Jun 29, 2026