Zero Day Initiative Blog
zerodayinitiative.com · Company blog · on HN since 2009
Trend Micro's Zero Day Initiative, which buys vulnerabilities and runs Pwn2Own, publishes advisories, contest results, and details of unpatched bugs.
What HN saysHN commenters point to it as a legitimate place to sell vulnerabilities, especially commodity server-side bugs, and as the source of Pwn2Own bounty results.
62HN people shared it
36linked it in comments
37stories submitted
284story points
3 months agolast shared
2009people per year2026
Most-shared posts
- 1Homepage7 people · first shared 2010
- 2Possible Azure RCE2 people · 44 points · first shared 2024 · 6 comments on HN
- 3Mobile Pwn2Own Day One Results2 people · 4 points · first shared 2017 · discussion on HN
- 4Linux Kernel Ksmbd Use-After-Free Remote Code Execution Vulnerability2 people · 3 points · first shared 2022 · discussion on HN
- 5PWN2OWN Vancouver 2019: Results2 people · 3 points · first shared 2019 · discussion on HN
- 6ZDI-CAN-30207: Unpatched 9.8 RCE zero-day in Telegram2 people · 3 points · first shared 2026 · discussion on HN
- 7Pwn2own 2021: Schedule and live results2 people · 1 points · first shared 2021 · discussion on HN
- 8Announcing pwn2own vancouver 20212 people · first shared 2021
- 9ZDI 23 7102 people · first shared 2023
- 10Two Winning Pwn2Own JIT Vulnerabilities in Mozilla Firefox1 people · 88 points · first shared 2019 · 5 comments on HN
- 11Remote Root in DirectTV's Wireless Video Bridge1 people · 52 points · first shared 2017 · 4 comments on HN
- 12The Resuts – Pwn2Own 2017 Day Three1 people · 38 points · first shared 2017 · 13 comments on HN
- 13The July 2019 Security Update Review1 people · 10 points · first shared 2019 · discussion on HN
- 14From Pwn2Own 2021: A New Attack Surface on Microsoft Exchange – ProxyShell1 people · 4 points · first shared 2021 · discussion on HN
- 15Pwn2Own Vancouver 2019: Day One Results1 people · 3 points · first shared 2019 · discussion on HN
What HN people wrote when they linked it
bigmac · 2010-11-01
This is an appealing program and makes it legitimate to get paid for vuln research. The other group that pays for vulnerabilities is the zero-day initiative. Here: http://www.zerodayinitiative.com/
That said, since we're kind of a free-market bunch of folks here, what do you think these vulnerabilities are worth on the black market? Just curious if the prices are competitive vs. selling to Russian black hats.
darkamaul · 2025-10-07
I believe this will be more detailed in the author following talk at HexaCon [0].
They used this bug in Pwn2Own Berlin 2025, earning a 40,000 bounty in the process [1].
[0] https://www.hexacon.fr/conference/speakers/#rce_in_redis [1] https://www.zerodayinitiative.com/blog/2025/5/16/pwn2own-berlin-2025-d…
benmmurphy · 2025-02-12
There is kind of a market for server side vulnerabilities but I'm not sure if you would call it grey. I suspect ZDI will purchase commodity server side vulnerabilities (https://www.zerodayinitiative.com/). So stuff like apache, nginx, and maybe opensource webapps that have a narrower usage.
99112000 · 2022-10-12
Sell it to TrendMicro Zero Day Initiative
https://www.zerodayinitiative.com/
nbk_2000 · 2020-10-08
The following companies buy 0-days. Each has a slightly different business model:
Zerodium - http://zerodium.com/
Azimuth Security - https://www.azimuthsecurity.com/
NSO Group - https://www.nsogroup.com/
ZDI - https://www.zerodayinitiative.com/
SSD - https://ssd-disclosure.com/
dogma1138 · 2017-08-24
Also FYI probably the first large scale broker of exploits was TippingPoint/HP (i don't remember if this thing started before or after HP acquired TippingPoint), they would buy exploits develop signatures for their IPS products then notify the vendors of the affected products and later disclose the vulnerability to the public.
http://www.zerodayinitiative.com
sp_ · 2011-03-17
Find vulnerability, develop exploit, sell to http://www.zerodayinitiative.com/ or http://labs.idefense.com/vcp/ if you are a "White Hat" or the Russian mafia if you want to make more money and don't care what your exploit is used for.
Once upon a time http://www.wslabi.com/ tried to create some kind of eBay for vulnerabilities too but it did not seem to go well.
ig1 · 2010-06-20
Sell it to TippingPoint (http://www.zerodayinitiative.com/) and let them deal with it, having a major security company approach them will force them to take it seriously.
Klonoar · 2026-07-13
You have somehow lived in a strange bubble.
2025: https://redis.io/blog/security-advisory-cve-2025-49844/
2023: https://seclists.org/oss-sec/2023/q2/133
2022: https://www.zerodayinitiative.com/advisories/ZDI-22-1690/
2014: https://ftp.openbsd.org/pub/OpenBSD/patches/5.4/common/008_openssl.pat…
It's an issue as old as time, or thereabouts.
ziddoap · 2025-03-18
>No wonder it was given a "ZDI-CAN" number (whatever that is) instead of an actual CVE.
ZDI = Zero Day Initiative.
https://www.zerodayinitiative.com/advisories/published/
I don't particularily agree with some of their philosophy, but they are smart folks and valuable to monitor alongside CVE. It's not like it's some backalley discount version of CVE. They've been around for 20 years, after all.
bArray · 2025-03-12
> Virtual machines still suck a lot of CPU and bandwidth for nothing but emulation. Containers in Linux with cgroups are still full of RCE (remote command execution) and priviledge escalation. New ones are discovered each year. The first report I got on those listed 10 or more RCE + PE (remote root on the machine). Remote root can also escape VMs probably also.
A proper virtual machine is extremely difficult to break out of (but it can still happen [1]). Containers are a lot easier to break out of. I virtual machines were more efficient in either CPU or RAM, I would want to use them more, but it's the worst of both.
[1] https://www.zerodayinitiative.com/advisories/ZDI-23-982/
some_random · 2025-01-23
Actual results here: https://www.zerodayinitiative.com/blog/2025/1/21/pwn2own-automotive-20…
Edit: Day 2 - https://www.zerodayinitiative.com/blog/2025/1/22/pwn2own-automotive-20…
ho_schi · 2024-06-07
I wonder why people suck things like Cloud, Co-Pilot or Adobe, WhatsApp or Windows?
Let me guess. It seemed once convenient. This is the root of all evil. Don’t use it because it was pre-installed (Windows). Don’t keep using it because it was good before the Cloud (Photoshop). Don’t use it because others force you (WhatsApp). Literally all quick and convenient decisions are something we will regret. If you don’t like Gimp, Blender, Krita or Linux you need help to improve it.
Look at the dumpster fire Azure. Nobodies data shall be stored there: https://www.zerodayinitiative.com/advisories/ZDI-24-581/
If the Chinese government isn’t right now reading your E-Mails somebody else does. Literally everything in Azure or any other Cloud must be considered compromised. And between the security issues the rise the prices.
wepple · 2023-05-22
Timeline here: https://www.zerodayinitiative.com/advisories/ZDI-23-710/
ZDI have been doing disclosure since forever. I doubt Mikrotiks claim that they were never notified.
dboreham · 2023-05-22
> disagreement between Mikrotik and the researchers about whether the vuln was actually disclosed in Dec
It seems likely that it was not properly disclosed because according to https://mikrotik.com/supportsec "you will be notified within 48 hours with acknowledgement of the issue" , but the reporter's web site states "ZDI reported the vulnerability to the vendor during Pwn2Own Toronto".
According to MT, none of their staff attended that event.
https://www.zerodayinitiative.com/advisories/ZDI-23-710/
belter · 2023-03-26
BossHogg · 2022-05-23
More complete results: https://www.zerodayinitiative.com/blog/2022/5/18/pwn2own-vancouver-202…
IainIreland · 2022-01-06
> Then pwn2own decided not to include Firefox in another year hacks because Firefox made no improvements at all in previous 2 years.
Uh, [citation needed]?
Firefox was a valid target in Pwn2Own 2021: https://www.zerodayinitiative.com/blog/2021/1/25/announcing-pwn2own-va…
Nobody attacked Firefox successfully, but that's hardly a point against it. I don't know what "made no improvements at all in previous 2 years is supposed to mean", either, since we had just released a major overhaul of the optimizing compiler a few months before Pwn2Own: https://hacks.mozilla.org/2020/11/warp-improved-js-performance-in-fire…
wg-throw-away · 2021-12-09
The CVE for this is probably CVE-2021-3489 based on hints of "pwn2own" and "April 2021" and "Flatt Security" -> https://www.zerodayinitiative.com/advisories/ZDI-21-590/
aj3 · 2021-07-03
Ubiquity introduced new vulns while fixing that fiasco from last year: https://www.zerodayinitiative.com/blog/2021/5/24/cve-2021-22909-diggin…
On the other hand, all of the other networking HW sucks just as much. E.g. here are Netgear vulnerabilities published just this week: https://www.microsoft.com/security/blog/2021/06/30/microsoft-finds-new…
rand846633 · 2021-04-10
One reason is that chrome vulnerabilities are between 3 and 5 times more expensive. And thus, I would guess, more rare.
Sources: https://www.zerodium.com/program.html
https://www.zerodayinitiative.com/blog/2021/1/25/announcing-pwn2own-va…
oefrha · 2021-04-09
Related, the two other $200k entries from Pwn2Own 2021:[1]
- DEVCORE targeting Microsoft Exchange in the Server category (The DEVCORE team combined an authentication bypass and a local privilege escalation to complete take over the Exchange server.)
- The researcher who goes by OV targeting Microsoft Teams in the Enterprise Communications category (OV combined a pair of bugs to demonstrate code execution on Microsoft Teams.)
It would be kind of funny if Slack had one too...
[1] https://www.zerodayinitiative.com/blog/2021/4/2/pwn2own-2021-schedule-…
anotheryou · 2019-01-15
I found the tesla rules: you need to exploit as many systems as possible as hard as possible:
https://static1.squarespace.com/static/5894c269e4fcb5e65a1ed623/t/5c36…
via https://www.zerodayinitiative.com/blog/2019/1/14/pwn2own-vancouver-201…
jaybosamiya · 2019-01-15
As per the full contest rules (https://www.zerodayinitiative.com/Pwn2Own2019Rules.html):
> If more than one contestant registers for a given category, the order of the contestants will be drawn at random. Based on the contestant order, the first contestant will be given an opportunity to attempt to compromise the selected target. If unsuccessful, the next randomly drawn contestant will be given an opportunity. This will continue until a contestant successfully compromises the target. The first contestant to successfully compromise a selected target will win the prize money for that target in that category. After a target has been compromised, the contest for that category is over and no other contestants will participate in the contest for that category (unless Sponsor has offered an additional winner option, which would be announced at the conference if applicable).
throwawaymath · 2018-09-24
Adding to this comment, see prices for 2018's Pwn2Own contest [1], for which Google Chrome has a 50% premium over Firefox and Safari. The Chromium bug bounty [2] is also the most accessible in terms of documentation and requirements; likewise it has the lowest floor and highest ceiling on potential payouts.
______________________
1. https://www.zerodayinitiative.com/Pwn2Own2018Rules.html
2. https://www.google.com/about/appsecurity/chrome-rewards/
helper · 2017-12-07
The person you are replying to has discovered multiple exploitable bugs in Illumos via DTrace from inside zones:
Here are the first two that pop up if you google his name.
http://www.zerodayinitiative.com/advisories/ZDI-16-168/
http://www.zerodayinitiative.com/advisories/ZDI-16-274/
He gave a talk at DTrace conf 2016 about all the security vulnerabilities he personally found in DTrace in SmartOS. Here are the slides: http://slides.com/benmurphy/deck
hcs · 2017-05-06
The article in question mentions they reported essentially the same bug in IBM solidDB [1], and I recall that the first big break in Nintendo Wii application signing [2] was similar.
[1] http://www.zerodayinitiative.com/advisories/ZDI-11-115/
[2] http://wiibrew.org/wiki/Signing_bug
vellum · 2017-04-21
CERT and the Zero Day Initiative handle disclosure for you, in some cases.
https://vulcoord.cert.org/VulReport/
http://www.zerodayinitiative.com/about/
mi100hael · 2017-03-29
Not widespread, but they do exist.
https://www.zerodayinitiative.com/blog/2017/3/16/pwn2own-2017-day-thre…
israrkhan · 2017-03-26
The team that was trying to hack chrome, could not do it in allocated time.
https://www.zerodayinitiative.com/blog/2017/3/15/the-results-pwn2own-2…