Uncategorized
Google "Root-in-Cloud" xatolik mukofoti dasturida 250 000 dollarlik eng yuqori mukofotni joriy etdi
Eng yuqori to‘lov to‘liq ma’muriy nazoratni ko‘rsatadigan yuqori ta’sirli arxitektura tadqiqotlari uchun mo‘ljallangan.
Muallif
Ionut Arghire
| 2026-yil 2-noyabr (ET vaqti bilan 9:25)
Google o‘zining Cloud Vulnerability Reward Program (VRP) dasturini kengaytirdi va to‘liq ma’muriy nazoratga olib kelishi mumkin bo‘lgan xavfsizlik zaifliklari uchun yangi 250 000 dollarlik yuqori darajali mukofotni joriy etdi.
Asosiy to‘lov "yuqori ta’sirli arxitektura tadqiqotlarini tan olish uchun maxsus mo‘ljallangan" va tadqiqotchilarga "roles/owner" huquqlarini yoki Google Cloud tashkilotlari yoki loyihalari ustidan to‘liq IAM nazoratini qo‘lga kiritishni ko‘rsatgan holda beriladi.
Internet gigantining ma’lumotiga ko‘ra, mukofotga loyiq bo‘lish uchun ekspluatatsiya yo‘li loyihaga oldindan mavjud kirish huquqiga, avval buzilgan hisob ma’lumotlariga yoki foydalanuvchi o‘zaro ta’siriga / ijtimoiy muhandislikka bog‘liq bo‘lmasligi kerak.
Borg (Google’ning asosiy ishlab chiqarish infratuzilmasi) da masofaviy kod bajarilishini (RCE) yoki root-in-production ni ko‘rsatadigan hisobotlar ham yangi 250 000 dollarlik root-in-cloud mukofoti uchun baholanadi.
"Borg’da kod bajarilishi xizmat mavjudligiga ta’sir qilishi yoki ijarachilararo ma’lumotlarga ta’sir qilishi mumkinligi sababli, tadqiqotchilar Borg’da har qanday bajarilishni erishgan zahoti barcha tekshiruvni darhol to‘xtatishlari kerak. Kengaytirish, ishlab chiqarish hisob ma’lumotlarini olish va yon tomonga harakatlanish ruxsat etilmaydi va tadqiqotchining diskvalifikatsiyasiga olib keladi," dedi Google Cloud CISO Chris Betz.
Kompaniya root-in-cloud tekshirish mezonlarini o‘zining Cloud VRP sahifasiga qo‘shdi va agar uning dastlabki kirish nuqtasi, bajarilish konteksti va hujum yuzasi tahlili to‘liq ixtiyoriy ijarachi yoki loyiha egallab olish mumkinligini ko‘rsatsa, xatolik mukofotini berishini tushuntirdi.
Reklama. O‘qishni davom ettirish uchun pastga aylantiring.
"Ijarachi izolyatsiyasini chetlab o‘tish va murakkab xizmatlararo mantiq zaifliklarini aniqlash inson ijodkorligi, sezgi va qat’iy tizimlar tahlilini agent tizimlar kuchi bilan birlashtirishni talab qiladi," deb ta’kidladi Betz.
Google Cloud’ning zaiflik mukofoti dasturi rahbari Michael Cote’ning so‘zlariga ko‘ra, o‘z sezgilarini agent vositalari bilan birlashtirgan birinchi marta tadqiqotchilar o‘rtacha hisobda, ikki yil oldin yangi boshlovchilar topganidan ko‘ra qiziqarliroq xatoliklarni topmoqda.
U shuningdek, yangi root-in-cloud darajasiga loyiq xatoliklarni topish chuqur arxitektura sezgi va sun’iy intellektni talab qilishini ta’kidladi.
"Yuqori rag‘batlantirish aniq, xavfsiz o‘zaro ta’sir qoidalarini talab qiladi. Biz tadqiqotchilarning haqiqiy mijoz loyihalariga qarshi ekspluatatsiyalarni sinab ko‘rishlarini hech qachon xohlamaymiz. Buning o‘rniga, biz belgilangan xizmat hisobi yordamida deterministik root-isbot mexanizmini yaratdik. Tadqiqotchilar ushbu identifikatorga qarshi ruxsatsiz kirishni kriptografik tarzda isbotlashlari mumkin," dedi Cote.
Bog‘liq: Google Chrome xatolik mukofoti qisqartirishlarini qisman bekor qildi
Bog‘liq: Google ochiq manbali xatolik mukofotini avtomatlashtirilgan hisobotlar to‘lqini fonida toraytirdi
Bog‘liq: Microsoft xatolik mukofoti dasturi: 500 tadqiqotchiga 20 million dollar to‘landi
Bog‘liq: Sun’iy intellekt xatolik mukofoti sanoatini o‘ldiradimi?
Yozgan: Ionut Arghire
Ionut Arghire SecurityWeek uchun xalqaro muxbir.
Kundalik axborot byulleteni
Eng so‘nggi kiberxavfsizlik tahdidlari, tendensiyalar va mutaxassis fikrlari haqida xabardor bo‘lish uchun SecurityWeek elektron pochta axborot byulleteniga obuna bo‘ling.
Biznes elektron pochta*
emailsignupsource
Qo‘shimcha ma’lumot uchun Maxfiylik siyosatimizni o‘qing.
Ionut Arghiredan ko‘proq
- Bulletproof Host Virtualine domenini FBI musodara qildi
- WordPress’dagi yangi zaiflik hujumchilarning nishonida
- Alpine Linux’ga qarshi ishlatilgan maksimal jiddiylikdagi GitLab zaifligi
- TeamViewer zaifligi zararli xostlarga texnik yordam mutaxassislarining mashinalarini egallab olishga imkon berishi mumkin
- Adobe, Veeam, Juniper Networks muhim zaifliklarni tuzatdi
- 41 000 dan ortiq DHS xodimlarining ma’lumotlari onlayn tarqaldi
- HHS arizasi iRhythm ma’lumotlar buzilishini 8,2 millionga yetkazdi
- Xitoylik xakerlar ESXi jurnal yozish zaifligidan nol kun sifatida jimgina foydalandi
Eng so‘nggi yangiliklar
- Zararli Claude Code kengaytmasi Cursor ta’minot zanjiri hujumida tarqatildi
- Chainalysis sun’iy intellekt asosidagi kiberhujumdan so‘ng ma’lumotlar buzilishini oshkor qildi
- Polymarket DNS o‘g‘irlanishi deb DebugBear ayblagan holda savdogarlarga 3,9 million dollarni qaytardi
- FBI Binance o‘g‘irligiga bog‘liq 600 dan ortiq manzilni belgiladi
- Ivanti Connect Secure hujum zanjirida ishlatilgan yana ikkita nol kun zaifligini tuzatdi
- Northstar Security 7 million dollar bilan yashirin rejimdan chiqdi va zaharli xavf kombinatsiyalarini fosh etish maqsadida
- Suriyalik xaker AQShda o‘n yildan ortiq qochqinlikdan so‘ng qamoq jazosiga hukm qilindi
- PHP2Shell hujumlari Palo Alto xavfsizlik devorlarini ildizdan o‘chiradi, lekin WordPress’ga qarshi muvaffaqiyatsiz
Trendda
PHP2Shell hujumlari Palo Alto xavfsizlik devorlarini ildizdan o‘chiradi, lekin WordPress’ga qarshi muvaffaqiyatsiz
Northstar Security 7 million dollar bilan yashirin rejimdan chiqdi va zaharli xavf kombinatsiyalarini fosh etish maqsadida
Suriyalik xaker AQShda o‘n yildan ortiq qochqinlikdan so‘ng qamoq jazosiga hukm qilindi
WordPress’dagi yangi zaiflik hujumchilarning nishonida
Parollar parollardan yaxshiroq. Lekin ular yetarli emas.
Tashkilotlar parollarni yo‘q qilgan sari, hujumchilar moslashadi. Autentifikatorga to‘g‘ridan-to‘g‘ri hujum qilish o‘rniga, ular uning atrofidagi imkoniyatlarni qidiradi. (Torsten George)
Xavf shaxsiy bo‘lganda: Xavfsizlik rahbarlari saraton tashxisidan nimani o‘rganishi mumkin
Xavf menejerlari zaif signallarni aniqlash, buzilishlarga tayyorgarlik ko‘rish va noaniqlik sharoitida qiyin qarorlar qabul qilishga o‘rgatilgan. Ammo intizom xavf tizim yoki korxona emas, balki siz bo‘lganingizda boshqacha ko‘rinadi. (Steve Durbin)
Hech kim xavfsizlik so‘rovnomasiga ishonmaydi. Shunga qaramay, biz unga tayanamiz.
Deyarli har bir B2B bitimini nazorat qiladigan jarayon — yuboruvchi ishonmaydigan va qabul qiluvchi qabul qiladigan o‘z-o‘zini baholash. Nihoyat, kompaniyalar o‘rtasida ishonch uchun yaxshiroq asos paydo bo‘ldi. (Sravish Sridhar)
Bu normal: NetScaler nol kun zaifliklari bizga yangi normal haqida nimani aytadi
Agar Citrix NetScaler tuzatishlari tez orada yana bir turkum chiqarilsa, yamoqni boshqarish quvurlarini tayyor saqlang. (Tod Beardsley)
Sun’iy intellekt dasturiy ta’minot xavfsizligi kaliti tezlik emas, balki yetuklik
Sizning ishlab chiquvchilaringiz sun’iy intellektni qabul qilish shkalasida qayerda joylashganligi xavfsizlik xavfini qanday hal qilayotganingizga haqiqiy ta’sir ko‘rsatadi. (Matias Madou)
Kundalik axborot byulleteni
Eng so‘nggi tahdidlar, tendensiyalar va texnologiyalar haqida xabardor bo‘lish, shuningdek, soha mutaxassislarining chuqur fikrli ustunlari bilan tanishish uchun SecurityWeek elektron pochta axborot byulleteniga obuna bo‘ling.
Biznes elektron pochta*
emailsignupsource
Qo‘shimcha ma’lumot uchun Maxfiylik siyosatimizni o‘qing.
Vebinar: Kuchliroq CTEM dasturi uchun agent pentesting
2026-yil 4-noyabr
Pentestlar orasidagi xavfsizlik bo‘shliqlarini yoping. Ushbu sessiyada agent pentestingni o‘rganing va CTEM dasturingizda uzluksiz ta’sirni tekshirish uchun amaliy asosga ega bo‘ling.
Ro‘yxatdan o‘ting
Virtual tadbir: CISO Forum 2026 sammiti
2026-yil 10 va 11-noyabr
CISO’lar, yuqori darajali kiberxavfsizlik rahbarlari, amaliyotchilar, soha mutaxassislari va boshqa xavfsizlik rahbarlarini amaliy tajriba almashish va korxona kiberxavfsizlik strategiyasini shakllantiradigan masalalarni ko‘rib chiqish uchun birlashtiramiz.
Ro‘yxatdan o‘ting
Harakatdagi odamlar
Barracuda Dan Fletcher’ni CFO etib tayinladi.
Artemis Security Arun Singh’ni CGO etib tayinladi.
General Paul M. Nakasone Armadin direktorlar kengashiga qo‘shildi.
Harakatdagi ko‘proq odamlar
Mutaxassis fikrlari
Parollar parollardan yaxshiroq. Lekin ular yetarli emas.
Tashkilotlar parollarni yo‘q qilgan sari, hujumchilar moslashadi. Autentifikatorga to‘g‘ridan-to‘g‘ri hujum qilish o‘rniga, ular uning atrofidagi imkoniyatlarni qidiradi. (Torsten George)
Xavf shaxsiy bo‘lganda: Xavfsizlik rahbarlari saraton tashxisidan nimani o‘rganishi mumkin
Xavf menejerlari zaif signallarni aniqlash, buzilishlarga tayyorgarlik ko‘rish va noaniqlik sharoitida qiyin qarorlar qabul qilishga o‘rgatilgan. Ammo intizom xavf tizim yoki korxona emas, balki siz bo‘lganingizda boshqacha ko‘rinadi. (Steve Durbin)
Hech kim xavfsizlik so‘rovnomasiga ishonmaydi. Shunga qaramay, biz unga tayanamiz.
Deyarli har bir B2B bitimini nazorat qiladigan jarayon — yuboruvchi ishonmaydigan va qabul qiluvchi qabul qiladigan o‘z-o‘zini baholash. Nihoyat, kompaniyalar o‘rtasida ishonch uchun yaxshiroq asos paydo bo‘ldi. (Sravish Sridhar)
Bu normal: NetScaler nol kun zaifliklari bizga yangi normal haqida nimani aytadi
Agar Citrix NetScaler tuzatishlari tez orada yana bir turkum chiqarilsa, yamoqni boshqarish quvurlarini tayyor saqlang. (Tod Beardsley)
Sun’iy intellekt dasturiy ta’minot xavfsizligi kaliti tezlik emas, balki yetuklik
Sizning ishlab chiquvchilaringiz sun’iy intellektni qabul qilish shkalasida qayerda joylashganligi xavfsizlik xavfini qanday hal qilayotganingizga haqiqiy ta’sir ko‘rsatadi. (Matias Madou)
Uncategorized
Google Introduces $250,000 Root-in-Cloud Bug Bounty Reward
The top payout is for high-impact architectural research demonstrating full administrative control.
By
Ionut Arghire
| November 2, 2026 (9:25 AM ET)
*
Google has expanded its Cloud Vulnerability Reward Program (VRP) with a new $250,000 top-tier reward for security weaknesses that could lead to full administrative control.
The premier payout is “specifically designed to recognize high-impact architectural research” and will be handed out to researchers who can demonstrate gaining ‘roles/owner’ privileges or complete IAM control over arbitrary Google Cloud organizations or projects.
According to the internet giant, to qualify for the reward, the exploit path should not depend on pre-existing access to a project, previously compromised credentials, or user interaction/social engineering.
Reports that demonstrate remote code execution (RCE) in Borg (Google’s underlying production infrastructure) or root-in-production will also be evaluated for the new $250,000 root-in-cloud reward.
“Because code execution in Borg has the potential to impact service availability or cross-tenant data, researchers must halt all probing immediately upon achieving any execution in Borg. Escalation, extracting production credentials, and lateral movement are not allowed and will result in researcher disqualification,” Google Cloud CISO Chris Betz said.
The company has added the root-in-cloud validation criteria to its Cloud VRP page, explaining that it will award the bug bounty if its analysis of the initial entry point, execution context, and attack surface demonstrates that full arbitrary tenant or project takeover is possible.
Advertisement. Scroll to continue reading.
“Identifying tenant-isolation bypasses and complex cross-service logic flaws requires human creativity, intuition, and rigorous systems analysis combined with the power of agentic systems,” Betz noted.
According to Michael Cote, Google Cloud’s vulnerability reward program lead, first-time researchers who combine their own intuition with agentic tools are finding more interesting bugs, on average, than novices did two years ago.
He also pointed out that finding bugs eligible for the new root-in-cloud tier requires deep architectural intuition and AI.
“High incentives require clear, safe rules of engagement. We never want researchers testing exploits against real customer projects. Instead, we created a deterministic proof-of-root mechanism using a designated service account. Researchers can cryptographically prove unauthorized access against that identity,” Cote said.
Related:Google Partially Reverses Chrome Bug Bounty Cuts
Related:Google Narrows Open Source Bug Bounty Amid Wave of Invalid Automated Reports
Related:Microsoft Bug Bounty Program: $20 Million Paid to 500 Researchers
Related:Will AI Kill the Bug Bounty Industry?
Written ByIonut Arghire
Ionut Arghire is an international correspondent for SecurityWeek.
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.
Business Email*
emailsignupsource
Read our Privacy Policy for more information.
More from Ionut Arghire
- Bulletproof Host Virtualine Loses Its Domain to FBI Seizure
- Fresh WordPress Vulnerability in Attackers’ Crosshairs
- Max-Severity GitLab Vulnerability Exploited Against Alpine Linux
- TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ Machines
- Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities
- Over 41,000 DHS Employee Records Leaked Online
- HHS Filing Puts iRhythm Data Breach Toll at 8.2 Million
- Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
Latest News
- Malicious Claude Code Extension Served in Cursor Supply Chain Attack
- Chainalysis Discloses Data Breach Following AI-Driven Cyberattack
- Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack
- FBI Flags Over 600 Addresses Tied to North Korea’s Binance Heist
- Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain
- Northstar Security Exits Stealth With $7M to Expose Toxic Risk Combinations
- Syrian Hacker Gets Prison Time in US After Over a Decade on the Run
- PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress
Trending
PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress
Northstar Security Exits Stealth With $7M to Expose Toxic Risk Combinations
Syrian Hacker Gets Prison Time in US After Over a Decade on the Run
Fresh WordPress Vulnerability in Attackers’ Crosshairs
Passkeys Are Better Than Passwords. But They Are Not Enough.
Drupal Commerce Core Vulnerability Exploited Against Online Stores
$6 Billion Binance Hack Bears Hallmarks of North Korea’s TraderTraitor
Chrome and Firefox Updates Patch Over 200 Vulnerabilities
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Business Email*
emailsignupsource
Read our Privacy Policy for more information.
Webinar: Agentic Pentesting for a Stronger CTEM Program
November 4, 2026
Close the security gaps between pentests. Join this session to explore agentic pentesting and gain a practical framework for continuous exposure validation in your CTEM program.
Register
Virtual Event: CISO Forum 2026 Summit
November 10 & 11, 2026
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
Register
People on the Move
Barracuda has appointed Dan Fletcher as CFO.
Artemis Security has appointed Arun Singh as CGO.
General Paul M. Nakasone has joined Armadin’s Board of Directors.
More People On The Move
Expert Insights
*
Passkeys Are Better Than Passwords. But They Are Not Enough.
As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.(Torsten George)
When Risk Becomes Personal: What Security Leaders Can Learn From a Cancer Diagnosis
Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.(Steve Durbin)
Nobody Trusts the Security Questionnaire. We Rely on It Anyway.
The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.(Sravish Sridhar)
This is Fine: What NetScaler Zero-Days Tell Us About the New Normal
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.(Tod Beardsley)
The Key to AI Software Security Isn’t Speed, It’s Maturity
Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.(Matias Madou)