Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Apple bug bounty program expansion with doubled zero-click rewards

Security Tool/Service
First reported
Last updated
Happening score
H score 14
2 unique sources, 2 articles

Summary

Hide ▲

Apple’s bug bounty program has been expanded and redesigned, doubling rewards for zero-click remote compromise and adding new research categories that raise the payoff for high-end vulnerability reporting. The change matters because it increases incentives to find exploit chains across iPhone, WebKit, iCloud, and Gatekeeper. Apple also says the updated structure is more transparent and can push some rewards above $5 million with bonuses.

Related Happenings

Apple out-of-band iOS/iPadOS security updates (CVE-2026-28950)

Security Patch Release
H score28 First: 22.04.2026 23:58 Last: 22.04.2026 23:58 Sources 1

About this happening: Apple released out-of-band security updates for iPhone and iPad on April 22, 2026 to fix CVE-2026-28950. The patch addresses a Notification Services flaw t...

Latest development: 23.04.2026 11:50

Apple issued iOS 26.4.2, iPadOS 26.4.2, iOS 18.7.8, and iPadOS 18.7.8 on 2026-04-23 to close CVE-2026-28950, which could preserve deleted-message notifications on affected devices.

Open Happening

Apple Notification Services notification retention flaw (CVE-2026-28950)

Vulnerability
H score14 First: 22.04.2026 23:58 Last: 22.04.2026 23:58 Sources 1

About this happening: Apple released out-of-band updates for iPhone and iPad to fix CVE-2026-28950, a Notification Services flaw that could let deleted notifications remain stored o...

Latest development: 23.04.2026 11:50

Apple released iOS 26.4.2, iPadOS 26.4.2, iOS 18.7.8, and iPadOS 18.7.8 to address CVE-2026-28950, a logging flaw that could retain notifications marked for deletion on the device. The update improves data redaction so inadvertently preserved notifications are removed, and reporting also links the flaw to recovered Signal chats in the Prairieland case involving law enforcement and the FBI.

Open Happening

Apple iOS 18.7.7 security update expansion for DarkSword

Security Patch Release
H score41 First: 02.04.2026 00:50 Last: 02.04.2026 00:50 Sources 1

About this happening: Apple expanded iOS 18.7.7 availability to more older iPhones and iPads on April 1, 2026, letting devices that stay on iOS 18 receive protections against the acti...

Open Happening

Operation Triangulation updated iPhone espionage campaign

Campaign
H score41 First: 26.03.2026 15:10 Last: 26.03.2026 15:10 Sources 1

About this happening: The Operation Triangulation espionage lineage has resurfaced through Coruna, extending zero-click iPhone targeting to newer A17 and M3 devices and iOS 17.2...

Open Happening

Coruna iOS exploit analysis ties updated Triangulation kernel exploit lineage

Technical Analysis
H score33 First: 26.03.2026 15:10 Last: 26.03.2026 15:10 Sources 1

About this happening: Coruna has been linked to an updated exploit lineage from Operation Triangulation, showing that a long-running iPhone attack framework continues to evolve and can stil...

Open Happening

Timeline

  1. 10.10.2025 19:50 3 articles · 9mo ago

    Apple expands bug bounty payouts and categories

    Initial Disclosure

    Apple announced a major expansion and redesign of its bug bounty program, raising the top reward to $2 million for zero-click remote compromise reports and allowing bonus payouts above $5 million. The updated structure adds or raises rewards for one-click remote attacks, wireless proximity attacks, broad unauthorized iCloud access, WebKit exploit chains, locked-device access, app sandbox escapes, one-click WebKit sandbox escapes, and a macOS Gatekeeper complete bypass, while also expanding wireless proximity coverage to Apple-developed C1 and C1X modems and the N1 wireless chip. Apple also said it will distribute 1,000 secured iPhone 17 devices to civil society organizations in 2026 and that researchers can apply for the Security Research Device Program by October 31.

    Show sources
    Open in new tab