Vendors of digital products should of course prioritise security testing and vulnerability management for the sake of their users and their own reputation.

Now they have 36 months to do so to the standards set by the EU Cyber Resilience Act (CRA) if they want to sell their software or hardware inside the world’s largest trading bloc. 🇪🇺

The CRA has just been published in the EU’s Official Journal, kickstarting a three-year countdown to full compliance. Covering everything from laptops to smart TVs, the law was introduced primarily to address “widespread vulnerabilities and the insufficient and inconsistent provision of security updates to address them”. 📱 Following our 

vulnerability testing/management explainer for NIS 2

 after it came into force last month, we’ve now 

summarised the new vulnerability-focused CRA rules

, which advocate Bug Bounty Programs.🐞

 roundup of OffSec insights (originally published as a LinkedIn newsletter), the global Bug Bounty market is 

 to grow at a compound annual growth rate (CAGR) of nearly 16% between now and 2032 – up from $1.52 billion to $4.95 billion. 📈 Business Research Insights attributes its prediction to “growth and demand returning to pre-pandemic levels”, as well as organisations needing to “regularly test their IT infrastructure” given “constantly evolving” tech stacks and the fact “a hacker could potentially destroy a company's reputation in a matter of minutes”. It also notes that, while Bug Bounty has traditionally been dominated by the software development industry, recent growth has also been fuelled by increasing adoption by governments and large corporations. 

“Many advantages, including inexpensive pricing based on output, software testing in real-time, scalability, and device and geographic coverage, can be obtained through crowdsource testing,” writes Business Research Insights in a separate but related report that notes how crowdsourced security testing is growing particularly fast in the 

Coincidentally, Research and Markets has released its own 

forecast for the global security testing market

, anticipating 24.7% CAGR until 2029 in part due to AI development that will “make anomaly detection and vulnerability prediction more reliable”. 🤖 Application security testing is the fastest growing segment of tech, says the report, while “the healthcare vertical holds the largest market share in the security testing market due to its critical need for stringent security measures”. 🏥

distilled details of a CISA red team engagement

 where they compromised a critical national infrastructure entity through a web shell “left from a third party’s previous security assessment”. 😬 CISA (the US Cybersecurity and Infrastructure Security Agency) wrote that leadership of the entity “deprioritized the treatment of a vulnerability their own cybersecurity team identified, and in their risk-based decision-making, miscalculated the potential impact and likelihood of its exploitation.” About the previous engagement's oversight, the head of research and discovery at Google threat intelligence 

: “I've seen too many red team screw ups like this [...] Stay humble and clean up after yourselves.” An infosec consultant also 

: “CISA red teaming exercise reports have been stellar in the past, but this newly released one is a really great read.” 📚

A bill that would require US federal contractors to implement NIST-compliant vulnerability disclosure policies (VDPs) has moved a step closer to becoming law after clearing a key Senate panel, 

. Civilian federal agencies are already required by law to have VDPs, and the same will soon apply to federal contractors it seems given bipartisan support for the Federal Contractor Cybersecurity Vulnerability Reduction Act. 🏛️

We conclude our roundup of useful OffSec content beyond our own output with these three interesting articles:

 – interview with Canonical CISO Stephanie Domas on 

: With great responsibility comes little or no power

Triage chief on keeping hunters and customers happy

“Giving Bug Bounty customers clear, relevant and actionable vulnerability reports gives them confidence in the process,” says Adrien Jeanneau, who heads up YesWeHack’s in-house triage team. Speaking in an interview 

, Adrien reflects on how the triage team strives to facilitate a “virtuous circle” 🔄 by keeping both customers and bug hunters happy, as well as discussing the role of automation, prioritising vulnerability reports by severity and impact, and beating YesWeHack’s first-response SLA by a wide margin. 🔥

How does an organisation identify – let alone secure – its proliferating internet-facing assets amid tight budgets and increasing cyber-attacks? 🤔 In the first of a new series of articles about attack surface management, we explain the process of 

 and make the case for implementing Continuous Threat Exposure Management (CTEM) to achieve a unified, comprehensive and real-time overview of your exposed vectors. 🚀

“We’ve had around 20 really serious reports that we would never get from a traditional pentest,” said the subject of our 

. 🔥 Transcribed from a video interview we’ve posted previously, this interview sees Erik Täfvander, head of cybersecurity at Swedish betting company ATG, reflects on the intrinsic benefits of Bug Bounty, recalls how ATG fine-tuned its approach to crowdsourced security testing, and offers his peers in other organisations some OffSec advice. 💎

As the year draws to our close, our 2024 events calendar concludes this week with 

 (11-12 December, London). 🇬🇧 Finally, we’re also proud sponsors of the Bug Bounty Village at the upcoming 

 in Brazil (14-15 December, São Paulo). ‍

Read this monthly roundup even sooner by subscribing to 

 – our LinkedIn newsletter curating news, insights and inspiration around offensive security topics like Bug Bounty, vulnerability disclosure and management, pentest management and attack surface protection.

Are you a bug hunter or do you have an interest in ethical hacking? Check out our ethical hacking-focused sister newsletter, 

 – offering hunting advice, interviews with hunters and CTF-style challenges, among other things.

Clock ticking on Cyber Resilience Act compliance, Bug Bounty forecasts, intriguing CISA red team find – OffSec roundup for CISOs

A 36-month countdown to compliance with the EU 

Vendors of products with digital elements (PDEs) now have three years to fulfil all the law’s security requirements – which are focused heavily on eliminating vulnerabilities – if they want to sell their devices or software in the world’s largest trading bloc.

Cyber Resilience Act timeline, scope and penalties

 in the Official Journal of the EU on Wednesday (20 November). This means the act enters into force from 10 December. However, to give regulated organisations more time to prepare, most of the act’s provisions will apply from 11 December 2027.

Depending on the gravity of the offence, violations could result in fines of up to €15 million, €10 million or €5 million, or, respectively, up to 2.5 %, 2% or 1.5% of an entity’s worldwide annual turnover (whichever is higher). Offending products could also be banned from sale within the single market.

PDEs are defined as any software or hardware that connects to networks or other devices. That definition covers the vast majority of modern devices, from smartphones, laptops and tablets to smart TVs, cameras and toys. There are certain exemptions for open-source software, and products covered by existing rules, such as medical, aviation and automobile products.

EU CRA focused on tackling ‘widespread vulnerabilities’

 in 2022 to address “a low level of cybersecurity” in digital products, the European Commission set out to tackle certain deficiencies above all. As well as observing a lack of security information provided to users, it noted “widespread vulnerabilities and the insufficient and inconsistent provision of security updates to address them.”

As a result, the European Cyber Resilience Act has a big focus on identifying, disclosing and fixing vulnerabilities.

For instance, products must arrive on the market in a secure-by-default configuration (with certain exceptions) and free from “known exploitable vulnerabilities”. Identifying the presence of known vulnerabilities is facilitated by the mandatory creation of a 

 (SBOM), which must cover a product’s top-level dependencies as a minimum.

Vulnerabilities should be addressed and remediated “without delay”, the CRA instructs.

Bug Bounty backed by the Cyber Resilience Act

The CRA requires that coordinated vulnerability disclosure policies (CVD policies or VDPs) are implemented to facilitate the external reporting of vulnerabilities, both directly to the vendor “and where requested anonymously, via CSIRTs”. There should also be a single point of contact to which vulnerability information can be relayed and where the CVD policy can be found.

Bug Bounty Programs are explicitly referenced as a vehicle for fulfilling CVD obligations. “Given the fact that information about exploitable vulnerabilities in widely used products with digital elements can be sold at high prices on the black market, manufacturers of such products should be able to use programmes, as part of their coordinated vulnerability disclosure policies, to incentivise the reporting of vulnerabilities by ensuring that individuals or entities receive recognition and compensation for their efforts,” reads the act. “This refers to so-called ‘bug bounty programmes’.”

The Cyber Resilience Act 2024 also urges member states to protect vulnerability researchers from legal harms by adopting “guidelines as regards the non-prosecution of information security researchers and an exemption from civil liability for their activities”.

Specific Cyber Resilience Act requirements are detailed for “high-risk AI systems”, including accounting for “AI specific vulnerabilities such as data poisoning or adversarial attacks, as well as, as relevant, risks to fundamental rights”.

Security updates should be distributed promptly, securely and free of charge, and be accompanied by security advisories, according to the CRA. Where applicable, they should be automatic or separate from functionality updates.

Once patches have been issued, manufacturers are obliged to publicly disclose remediated vulnerabilities, providing a description and information about impact, severity and remediation/mitigation. However, disclosure can be delayed to give users more time to apply patches where “manufacturers consider the security risks of publication to outweigh the security benefits”.

Manufacturers are also expected to notify Computer Security Incident Response Teams (CSIRTs) and ENISA, the EU cyber agency, about “severe incidents” and the active exploitation of vulnerabilities. These requirements apply in 21 months, from 11 September 2026.

Recognising the complexity of the threat landscape, lawmakers have designed the CRA to increase cyber-resilience both throughout the supply chain and lifecycle of digital products.

Vendors must handle vulnerabilities for a minimum support period of five years, unless the product’s lifetime expires sooner. Longer support periods are prescribed for typically long-life components like microprocessors, network devices and operating systems.

When support periods end, “manufacturers should consider releasing the source code of such products” to the public domain or “other undertakings which commit to extending the provision of vulnerability handling services”.

Other CRA requirements cover areas such as authentication, encryption, minimising attack surfaces, reducing the impact of cyber-attacks, and the collection of personal data.

Irrespective of their place of manufacture, PDEs must be compliant if they are sold in the EU single market, encompassing 27 member states plus Norway, Iceland and Liechtenstein. Alongside safety, health and environmental protection standards, CRA compliance is now a condition of bearing a CE mark.

The CRA forms a key plank of the EU’s recent drive to upgrade its cybersecurity framework. Other notable pillars are 

 (introduced a common certification framework for ICT products), 

NIS 2 (Network and Information Security) Directive

 (wide-ranging requirements for member states and ‘essential’ or ‘important’ services) and the 

 (ICT security rules for financial services firms).

These regulations all prioritise – in common with cyber laws emerging elsewhere in the world – a risk-based approach to understanding and minimising your attack surface, and proactively finding, fixing and remediating vulnerabilities.

YesWeHack crowdsourced security testing and VDP solutions can help you fulfil your compliance obligations in a scalable and cost-effective fashion. In particular:

 that provides agile security testing adapted to your development model, results-based pricing, in-house triage, seamless integration with your security tools and more secure development practices

 of our Bug Bounty and vulnerability management platform.

Cyber Resilience Act: compliance countdown set to start for EU law focused on eliminating vulnerabilities

Our latest ethical hacker roundup leads with a 

new open source tool for understanding how browsers parse HTML

 and uncovering mutated XSS vulnerabilities. 🛠️ The handiwork of our resident security researcher, 

, Dom-Explorer incorporates popular HTML sanitizers Ammonia, Angular, DomPurify, JsXss and SafeValues, while supported parsers include DomParser, Parse5, srcdocParser and TemplateParser. “By using this tool, you can generate this weird behaviour where if your input is not valid, it will change to something that might indicate the potential for vulnerabilities,” says Bitk. The researcher believes Dom-Explorer can simplify, accelerate and send in fresh directions this niche area of security research. 🔥

A client-side exploit chain across various Google services has impressed the InfoSec world. Leveraging Google Slides’ YouTube embed feature to access a victim’s Google Drive file, path traversal, open redirects across YouTube subdomains and oddities in Google Docs’ sharing UI, the discovery has 

netted security researcher Lyra/’Rebane’ an oddly specific bounty of $4,133.70.

 as an exemplar of how exploits can become “easier the longer you spend targeting a single company”, and evidence of an unusual combination of hacking skills. “Most white-hats specialize a bit, website logic shenanigans like iframes or the hardcore code analysis stuff like the link I posted for example. But not this [person, she] seems to have mastered both,” 

In other hacking tool news, ‘Cfreal’, highly respected for his PHP work, has made another significant contribution to this field with the 

, which helps ethical hackers exploit blind file read primitives in PHP. The researcher says the utility transcends most limitations undermining similar tools. 🚀

Speaking of PHP, the star of our YouTube channel’s latest hunter Q&A, Blaklis, also favours PHP targets. As well as discussing his preferred scopes, the prolific hunter, who sits 21st on our all-time leaderboard, reflects on how hacking video games introduced him to bug hunting, outlines his typical working day, and tells us which non-computing-related career he thinks most closely resembles Bug Bounty (watch the video below). 🐞 Similarly, we’ve also published a new 

, complete with related video, starring HakuPiku, in which he declares a fondness for hacking Android apps and open-source code. 📱

HakuPiku’s penchant for open source means he features on our new 

, which tracks the most successful hunters in terms of valid vulnerabilities reported to our open source programs. Top spots are currently held by calehuri, mdisec and foobar0x7 (visualised on the image below). 🏆 Hunters are further incentivised by the fact that any valid bugs reported to our open source Bug Bounty Programs will score hunters some exclusive merch, as well as the usual financial rewards. 🎁 Applicable scopes for this swag include 

’s seven public programs, which offer max €10,000 rewards: Log4j, Systemd, GNOME, ntpd-rs, OpenPGP.js, Sequoia PGP and CycloneDX Rust Cargo. The swag is also available via three programs managed by Open-Xchange: 

. Incidentally, the bounty grid for PowerDNS, an open-source DNS server, was recently increased to a €8,000 maximum. 💰 🎯

As for the general leaderboard, Rabhi, Xel and pocsir currently head both the overall 

Using AFL++, afl-cov and basic custom harnesses to find a libsoup bug

Back to the research writeups: we're spotlighting research from a hunter who also stars on the aforementioned open source leaderboard. In a new blog post, 'Sigabrt' 

 in which he used AFL++, afl-cov and basic custom harnesses to find a heap overflow bug in libsoup on a YesWeHack public program, namely that of 

'Ading2210', meanwhile, has recounted how he 

 for reporting Chromium vulnerabilities that allowed for a sandbox escape from malicious browser extensions with just “a tiny bit of user interaction”.  The potential consequences were grave: “Instead of merely stealing your passwords and compromising your browser, an attacker could take control of your entire operating system,” he wrote. Eek. One redditor called it “

 I've read since The Cuckoo's Egg”. 💰

Multiple vulnerabilities in a Realtek SD card reader, meanwhile, apparently “enabled non-privileged users to leak the contents of kernel pool and kernel stack, write to arbitrary kernel memory, and, the most interesting, read and write physical memory from user mode via the DMA capability of the device”. 💻  An 

 details Realtek’s fixes for what were seemingly highly serious flaws. “If your laptop is equipped with an SD card reader, it is highly likely to be manufactured by Realtek, making it susceptible to these vulnerabilities as well,” 

Our latest white-box penetration testing guide explores 

how to debug for JavaScript vulnerabilities

. In testing a web application vulnerable to prototype pollution within a Docker container, Brumens’, another of our resident hackers, demonstrates how to debug JavaScript inside Visual Studio Code in order to track payloads throughout the code process and learn how security filters can hide vulnerabilities. Relatedly, we’ve also detailed our 

top 5 hacking tools for white-box pen testing

Exploiting trust: Weaponizing permissive CORS configurations

’, Outpost24’s Thomas Stacey reveals the results of a project initiated to answer the question: “Are we underestimating CORS vulnerabilities?”. 🤔 Possibly, it seems, given the application security auditor uncovered multiple CORS (Cross-Origin Resource Sharing) flaws affecting customers, including critical issues including user sessions. He observes that both the detection and exploitation of permissive CORS can be tricky, the latter “due to modern security controls like the “SameSite” cookie attribute, or even modern application architectures like single-page applications”. Mindful of these challenges, he sets out some tooling and methodology advice for finding vulnerabilities in CORS implementations.

Other recent writeups and InfoSec news of interest include “

 of an AI agent finding a previously unknown exploitable memory-safety issue in widely used real-world software”; Sonar showing how to turn a file write vulnerability in a Node.js application into RCE 

when the target’s file system is mounted as read-only

data breach involving France’s second largest internet service provider (ISP) and telephone operator

, affecting more than 19 million customers and 5.11 million IBAN numbers. 😮

Next up, Dojo news. Trick or treating might be over for another year, but our platform’s new dark mode 🖤 – 

 to coincide with the celebration – is here to stay, while our Halloween-themed monthly CTF challenge – ‘

’ – has concluded (congrats to the winners: Atlas_py, qu35t3190 and Fravoi). 👻 The current active challenge is ‘

’, open for submissions until 12 December. Elsewhere on Dojo, another new training module has dropped: 

. And finally, check out our new feature, Talkie Pwnii, a series of videos from one of our researcher enablement analysts, pwnwithlove aka pwnii! In the first video, below, pwnii shows you two alternative solutions to our latest Dojo challenge, '

', and a few technical tips and tricks. 🚀

Over the weekend, we ran a successful live Bug Bounty in Buenos Aires, Argentina.

 across two days, the live hacking event involved targets from Galicia Bank. This was the final top 3:

💉 First Blood: Damián Gambacorta aka g4mb4

💥 Best Impact: 🎩 Alan L. aka soyelmago

A huge thank you to Galicia Bank for their trust and involvement. We also want to extend our gratitude to Ekoparty and Bug Bounty Argentina for their support in making this event a resounding success. 🙏

Highlights from the Ferrero live Bug Bounty

And here is the final podium for another live Bug Bounty that took place at the end of September, with legendary sweet-packaged food brand Ferrero providing the targets:

Watch highlights from this competition, which was Italy’s 

Read this monthly roundup of content aimed at ethical hackers even sooner by subscribing to 

Are you a CISO, other security professional or security-conscious dev? Check out our CISO-focused sister newsletter, 

 – bringing you news, insights and inspiration around offensive security topics like Bug Bounty, vulnerability disclosure and management, pentest management and attack surface protection.

New tool for finding mutated XSS, $20k Chromium sandbox escape, Live bug bounty results from Ekoparty – ethical hacker news roundup

Security teams should note two fresh milestones in the EU’s regulatory framework, begins our latest 

 roundup of OffSec insights (originally published as a LinkedIn newsletter). 

 by the European Commission. With market access to the world’s largest trading bloc contingent on compliance and multimillion-euro fines the potential penalties for violations, CISOs from around the world will certainly be paying attention. 🚨

In light of this, we have published a new guide to the 

security testing and vulnerability management dimensions of NIS 2

, which introduces wide-ranging requirements for member states and ‘essential’ or ‘important’ services. We’re publishing a guide to the CRA, which applies to vendors of products with digital elements (PDEs), soon. 📱 These laws form key planks of the 

EU’s recent drive to upgrade its cybersecurity framework

. The emerging framework, in common with cyber laws emerging elsewhere in the world, has many prescriptions and recommendations for undertaking activities we happen to be experts in: understanding and minimising your attack surface, proactively and continuously finding vulnerabilities, and adopting a risk-based approach to their remediation. 😉

 suggests the ongoing global shortage of cybersecurity skills helps to explain how 

spending growth on security software and services

 is outstripping that of recruitment and staffing. 📈 The article points out that Gartner expects security service spending to increase 15.8% next year, while IDC forecasts a global CAGR of 12.2% between 2023-2028 for managed security services. As CSO senior writer John Leyden writes, “CISOs are turning to managed security services to take advantage of seasoned practitioners that they would struggle to hire and retain internally.”👨🏼‍💻

With security teams growing more slowly than attack surfaces, we believe growing demand for crowdsourced security testing is partly fuelled by the same dynamics. And even if the skills shortage were magically addressed tomorrow, no organisation will ever have the kind of internal OffSec resources they can access when they launch a Bug Bounty Program – namely the diverse skills of tens of thousands of ethical hackers. Relatedly, 

Foundry’s 2024 Security Priorities Study

22% of new vulnerability assessment roles are outsourced

US Cybersecurity and Infrastructure Security Agency (CISA)

 about the performance of its Vulnerability Disclosure Policy (VDP) platform. “Since launching in 2021, the VDP Platform has triaged over 12,000 submissions (over 7,000 in 2023) on behalf of 51 onboarded agency programs, saving agencies a significant amount of time and resources,” the annual report disclosed. “Over 2,400 unique, valid vulnerability disclosures have been identified, of which nearly 2,000 have been remediated by agencies. Since launch, over 3,200 security researchers have participated.” VDPs, as we’re rather fond of reminding our readers, offer 

 and are increasingly a compliance must-have not just nice-to-have. 🛡️

is confirmed as the president elect for a second time, there’s a lot of uncertainty about his agenda for funding CISA and policies related to cybersecurity. 

, cyber reporter David DiMolfetta gives a decent summary of the fears (notably about budget cuts) and more positive takes (for instance, cyber has recently been one of vanishingly few bipartisan issues) expressed by current and former government officials. 🤔

, about the need to defend their organisations against the 

 in creating and distributing malware, phishing lures and deepfake videos. 🤖

Back to our own output, and Bug Bounty beating pentesting in terms of both the breadth of skills available and the depth of their deployment, as per the views of TeamViewer’s senior project manager for security, Michael Gillig, expressed in our 

. In this interview Michael marvels at the 

Bug Bounty discoveries missed by pentesting

, lauds YesWeHack’s triage team and recounts how TeamViewer, whose remote access/control software is installed on more than 2.5 billion devices worldwide, has grown and fine-tuned its program since launch. 🛡️

We recently collaborated with another instantly recognisable brand, the makers of Ferrero Rocher and Kinder Surprise no less, in the successful delivery of 

Read what Ferrero, one of the world's largest sweet-packaged food companies, made of the event

, and watch highlights from this live Bug Bounty below. 🍫 

Our next live Bug Bounty is imminent, taking place in Buenos Aires, Argentina at 

 this week. The two-day competition, running between 14-15 November, will help an as-yet-unnamed brand (unmasked when the event kicks off) significantly harden their digital assets thanks to the dozens of vulnerabilities routinely reported during these events. Our team will discuss our platform on booth 10 throughout the three-day Ekoparty event. Learn about the 

 to the organisations providing the targets. 🚀 

NIS 2 in force, Cyber Resilience Act adopted, CISA hails VDP impact – OffSec roundup for CISOs

We start our latest roundup for CISOs with Forrester advice about making supply chain security, securing business-critical IT assets and tackling tech sprawl your top priorities for 2025.

“While security leaders say budgets will increase this year, so will tech sprawl, with software costs doubling up spend on hardware and also outpacing personnel costs,” observes the market research firm in its 

2025 Budget Planning Guide For Security And Risk Leaders

 of the results if you don’t want to trawl the full report. 📰

Also in this roundup (originally published as our 

 from IANS Research and Artico Search similarly observes increases to cybersecurity budgets, albeit the days of double-digit growth are over and a significant minority of security teams are having to perform increasingly complex jobs with either flat or falling budgets. 📉

Clearly, handling myriad threats – not to mention the growing compliance burden and 

 – in the context of tight budgets makes for a stressful vocation. 😓 It seems appropriate then to bring to your attention a 

Q&A between Intelligent CIO and Steve Bray

, head of Australia & New Zealand for Cloudflare, about the prevalence of CISO burnout, the factors at play and how to protect security executives from mental overload. 🧠🛡️

Malta considers national VDP… while citizen bug reporters await court date

public consultation has concluded in Malta

 on a government proposal for a national 

coordinated vulnerability disclosure policy (VDP)

. While we must confess to bias insofar as we have a VDP product to pitch, such a policy is surely necessary when you consider the 

arrest of three computer science students

 over their reporting (which they assert was in good faith) of a vulnerability in Malta’s largest student application, FreeHour, to the vendor. The university students had asked for a bug bounty reward but were reportedly ‘rewarded’ instead with being strip-searched, having their computer equipment seized and a court date in March 2025 (their lecturer is also being charged as an accomplice). 🚔

The consultation ran concurrently with another consultation over Malta’s transposition of the NIS 2 Directive, which has just entered into force. NIS 2 is intended to achieve “a high common level of security of network and information systems across the Union” more effectively than its predecessor from 2016, NIS 1. We’ve just published a 

 explaining why NIS 2 has global implications and ramifications for our area of expertise: security testing and vulnerability management.

In reassuring news about open source security, project maintainers are 

spending three times as much time on security

 than they did three years ago and have become less credulous of contributors following the 

, according to a report from open source security firm Tidelift. 🔒 Less reassuringly, they remain mostly unpaid and overworked. Moreover, given how discouraging this status quo is, they are ageing as a cohort. 😓

This is precisely why in 2023 the Sovereign Tech Fund launched the 

, which helps time-poor open source maintainers prevent and patch vulnerabilities through technical debt reduction, secure code audits and Bug Bounty Programs managed by yours truly, YesWeHack. 🛠️ Our army of bug hunters have been 

entrusted with hardening a number of open source libraries

 that are benefitting from STF funding, including the near-ubiquitous 

, the site of possibly the most impactful vulnerability of all time, no less. 🐞

Relatedly, Stephanie Domas, CISO of Canonical, the makers of open-source Linux operating system Ubuntu, has written about 

The potential impact of AI in almost every human endeavour is both mind-blowing and unpredictable – and with unpredictability, comes all manner of risk. Organisations should therefore be mindful of the safety and security risks of using AI in any use case, and this includes AI cyber-defense tools – especially now that the US Department of Justice (DoJ) has updated  (PDF) aimed at enterprise compliance officers with instructions to start evaluating the potential harms of their AI applications and how to mitigate these risks. Organisations, the rules make clear, will be held accountable for the misdeeds of their AIs. 🤖⚠️

A dispute between Automattic and WP Engine, which has been banned from WordPress.org, has “left “thousands of end-users without security updates and, by extension, millions of internet users exposed to potential hacks”, 

 that “WordPress has banned its user groups from accepting sponsorship from WP Engine” as the multifaceted dispute continues to escalate.

And Eugenio Benincasa, senior researcher in the Cyberdefense Project at the Center for Security Studies (CSS) at ETH Zurich, discussed the 

 of Chinese vulnerability researchers and the geopolitical implications in 

Our latest customer success story sees the cybersecurity chief of a Swedish betting brand ATG reveal that, through Bug Bounty, they have received “really serious reports we would never get from a traditional pentest”. ATG, which powers Sweden’s horse racing industry, has enjoyed a more-than-satisfactory return on investment, according to Erik Täfvander. In the 

 below, Erik discusses why ATG decided to crowdsource security testing, the process of launching and growing the program, and the benefits and challenges encountered along the way. 🐎🔍

, Guillaume Kermarrec, who oversees L’Oréal’s Bug Bounty Program, discusses the iconic cosmetics brand's preparations and hopes for a live Bug Bounty shortly before the event began during leHACK in Paris, over the summer. 💄 Incidentally, we’ve also previously published a 

video highlights of the hacking competition

! Watch highlights below from the live Bug Bounty, featuring targets from Ferrero, the Italian sweet-packaged food giant.

“Vulnerabilities exist in increasingly complex modern applications,” said Guillaume Vassault-Houlière, CEO and co-founder of YesWeHack. “A 

 helps organisations find and fix many vulnerabilities in a short period of time. Hacking against the clock, ethical hackers collaborate and compete to achieve eye-catching results, as well as giving developers and security teams advice that reduces the risk of new vulnerabilities being created in future.”

We’re gearing up for another live hacking event on a different continent entirely, taking place at Ekoparty in Buenos Aires next month (14 November). As usual, the identity of the vendor providing targets will be kept confidential until the event kicks off. YesWeHack will also be showcasing our vulnerability management solutions at Ekoparty, as well as at 

Tackling tech sprawl, CISO burnout, NIS 2 now enforceable – OffSec roundup for CISOs

ETHICAL HACKERS CHALLENGED TO FIND SECURITY SYSTEMS VULNERABILITIES DURING THE LATEST EDITION OF ROMHACK

News

Clock ticking on Cyber Resilience Act compliance, Bug Bounty forecasts, intriguing CISA red team find – OffSec roundup for CISOs

Cyber Resilience Act: compliance countdown set to start for EU law focused on eliminating vulnerabilities

New tool for finding mutated XSS, $20k Chromium sandbox escape, Live bug bounty results from Ekoparty – ethical hacker news roundup

NIS 2 in force, Cyber Resilience Act adopted, CISA hails VDP impact – OffSec roundup for CISOs

Tackling tech sprawl, CISO burnout, NIS 2 now enforceable – OffSec roundup for CISOs

YesWeHack and Ferrero inaugurate Italy’s first live hacking event

NIS 2 in force, Cyber Resilience Act adopted, CISA hails VDP impact – OffSec roundup for CISOs

Web timing attacks, Apache HTTP confusion attacks, email parsing discrepancies – ethical hacker news roundup

NIS 2 in brief, security tech hype cycle, Italy’s first ever live Bug Bounty – OffSec roundup for CISOs

ORM leaks, CSRF is alive, lockpicking lessons – ethical hacker news roundup

Web timing attacks, Apache HTTP confusion attacks, email parsing discrepancies – ethical hacker news roundup

Partial SolarWinds reprieve, CrowdStrike lessons, LLM kryptonite – OffSec roundup for CISOs

Hack Me I’m Famous #2: Louis Vuitton sets trend with first live hacking event in luxury fashion sector

L'Oréal lauds live Bug Bounty success at LeHack 2024

Partial SolarWinds reprieve, CrowdStrike lessons, LLM kryptonite – OffSec roundup for CISOs

Produits

Chercheurs

Ressources

A propos

Suivez-nous