Google pays $90,000 for DevSite flaw that let anyone run code without an account
rez0__ · x · 2026-10-14
Researcher Simon Köck found that Google DevSite signed its session cookies with a secret it also handed out inside the cookie itself, letting him forge his own session cookies and run code on developers.google.com without an account. Google awarded $90,000 for the flaw but took two months to fix it. Reposter rez0 complains the news account keeps adding ragebait comments to otherwise informative posts.
Related event: Researcher Earns $90K Google Bounty for Flask Cookie Key Leak RCE(3 posts)→
More from Safety
- DeepMind Details Gemini 4 Argon's CoT Monitor That Intervenes When Reasoning Goes Off the Rails — danielrock · 2026-10-14
- Miles Brundage: 'neolabs' are the elephant in the room of AI safety policy — Miles_Brundage · 2026-10-14
- Eight AI Agents Hit Taiwan's Government for Four Days: Should AI Safety Refocus? — Low-Presentation-936 · 2026-10-14
- Gary Marcus flags NYT report: AI making ransomware attacks easier as Japan hit hard — GaryMarcus · 2026-10-14
- "Pacing" debate concedes we don't know what's dangerous about AI — ohlennart · 2026-10-14
- Gladstone AI co-founder on Nonzero: superintelligence may be impossible to control — jeremiecharris · 2026-10-14