In Other News: $900k for XSS Bugs, HybridPetya Malware, Burger King Censors Research

In this week’s round-up, SecurityWeek reports that Burger King’s parent, Restaurant Brands International, used a DMCA complaint to censor security research detailing vulnerabilities in RBI systems. Noteworthy vulnerabilities were reported with RBI’s systems, while researchers saw the blog post removed from the Internet Archive as well.

The piece also notes that Google paid out about $1.6 million at a cloud-hacking event, bringing its cloud vulnerability payouts to roughly $2.5 million for the year, after findings from 20 researchers across 91 vulnerabilities. It highlights that there are still around 1,000 known XSS vulnerabilities in Microsoft services since January 2024, with SecurityWeek noting that SecurityWeek’s article corroborates ongoing, high-value bug bounty activity, including rewards up to $20,000 in a 12-month window.

According to ESET, HybridPetya bypasses UEFI Secure Boot using CVE-2024-7344, though there is no evidence of its use in the wild and it may be a proof-of-concept. The roundup also covers other items such as a Kosovo national pleading guilty to operating the BlackDB cybercrime marketplace and a California bill requiring opt-out controls in browsers.