$45,000 bounty offered for Linux zero days

The $15,000 price bump is likely a result of higher demand.

A startup that buys zero-day exploits will pay hackers $45,000 for Linux local privilege escalation exploits against popular operating systems like Ubuntu, Debian and Fedora.

The company, Zerodium, is famous for its exploit-buying program. It pays bounties as high as $1.5 million bounty if the research is completely original and the target is right. The price depends on the security of the target and the demand in the market.

The program might be widely known in the cybersecurity community, but the results are highly secret: Zerodium, based in Washington, D.C., sells its exploits to government customers who will pay for the ability to break virtually any kind of computer. Privilege escalation exploits are particularly valuable because they allow an attacker to gain access to parts of a computer that would otherwise be restricted from them.

The new $45,000 bounty for Linux local privilege escalations is a $15,000 raise above Zerodium’s usual $30,000 price tag, suggesting a rise in demand. It’s an offer with an expiration date: Increased payouts will last only until March 31.

Zerodium founder Chaouki Bekrar did not respond to a request for comment.

Here’s the announcement via Twitter:

Last year, Zerodium offered a $1 million bounty to any hackers who found bugs and exploits against the anonymizing Tor Browser. That offer lasted three months and ended in December. The usual price for those zero days is up to $100,000. Some observers saw that that seven-figure payout as a publicity stunt, but Bekrar said at the time that demand among government customers was high. He never commented on the outcome of the program.

Zerodium’s highest bounty is $1.5 million for a zero-click remote jailbreak against the iPhone. That lofty price, along with comments from others in the industry, showcase the high level of difficulty hackers are having against Apple’s flagship device, which is notorious for its increasingly high level of security compared to the rest of the world’s mobile gadgets. Zerodium also offers $500,000 for zero days against secure messenger apps like Signal, WhatsApp, Telegram and iMessage.

“The price that Zerodium puts on a product is always an indication of the security of that product, the higher the price, the better is the security of that product,” Bekrar told CyberScoop last year. “The prices result from both a high demand and a small attack surface in these apps which makes the discovery and exploitation of critical bugs very challenging for security researchers.”

Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

While the vendor hit another monthly record, it hasn’t resulted in a flood of active exploits. Researchers encourage customers to focus on their specific areas of risk…

What the Hugging Face breach reveals about defense in the age of agentic AI

Cisco customers encounter another SD-WAN zero-day under attack

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

• FBI raises alarm over deceptive phishing campaign targeting prominent people

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure