Da98bd977879112188f6c905ff8243bb7636299f default


  • $1,500
    Minimum bounty
  • 2
    Hackers thanked
  • 2
    Bugs closed

Top Hackers

Latest Thanks To

The Internet Bug Bounty Panel is awarding bounties for critical security vulnerabilities in popular, open source programming languages. Thanks to the hard work of the developers of these languages, uncovering vulnerabilities in this software is increasingly challenging. These bounties are our way of saying "Thanks" to the security researchers who take up this challenge.

Bounty Qualification

Only critical vulnerabilities that demonstrate complete compromise of the system's integrity or confidentiality are eligible for a bounty - typically Arbitrary Code Execution or equivalent impact. While we encourage you to submit all potential issues, lower severity issues are not in scope at this time.

The project maintainers have final decision on which issues constitute security vulnerabilities. The Panel will respect their decision, and we ask that you do as well.

It's important to keep in mind that not all submissions will qualify for a bounty, and that the decision to award a bounty is entirely at the discretion of the Panel.

Submission Process

  • Disclose a previously unknown security vulnerability directly to the project maintainers.
  • Follow the disclosure process established by the project maintainers.
  • Clearly demonstrate the security vulnerability. Respect the time of the project volunteers as they cannot invest significant effort into incomplete reports. Low-quality reports may be disqualified.
  • Finding the vulnerability is only half the battle, so we'll award a matching bounty for an accepted patch. We encourage you to fully investigate the issue, adhere to the project's code quality standards, and submit a patch. Otherwise, we'll donate the additional bounty to the OSU Open Source Lab or a non-profit chosen by the project maintainers.
  • Once a public security advisory has been issued, please contact us at ibb-panel@hackerone.com. You must not send us the details of the vulnerability until it has been validated, accepted, and publicly disclosed by the project maintainers.
The Internet Bug Bounty rewarded kubabrecka with a $1,500 bounty for a PHP bug: PHP Heap Overflow Vulnerability in imagecrop().
2 months ago
PHP resolved PHP Heap Overflow Vulnerability in imagecrop() that was submitted by kubabrecka.
3 months ago
The Internet Bug Bounty rewarded sesser with a $4,000 bounty for a PHP bug: PHP openssl_x509_parse() Memory Corruption Vulnerability.
4 months ago
PHP resolved PHP openssl_x509_parse() Memory Corruption Vulnerability that was submitted by sesser.
4 months ago
PHP has started using HackerOne.
5 months ago