Top all-time · #1103
Zero Day Initiative
Company blog · zerodayinitiative.com/blogsecurity
Zero Day Initiative is the company blog at zerodayinitiative.com, writing about security. Since 2009, 63 different Hacker News readers have linked it 79 times, most often “PWN2OWN Vancouver 2019: Results”. It is still writing: the last post was on 2026-10-27, and you can follow it by feed.
Rarely recommended · 0 of 38 sampled comments recommend it?
Why HN links it
HN readers link Zero Day Initiative's blog and advisories as references for Pwn2Own contest results, vulnerability disclosure timelines, and the market for buying bugs. Comments mostly cite it without judging the writing.
Summarised by Claude from a sample of 38 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- /3 people · 3 mentions · first linked 2020-10-08
- /3 people · 3 mentions · first linked 2010-06-20
- PWN2OWN Vancouver 2019: Results2 people · 2 mentions · first linked 2019-03-22
- Linux Kernel Ksmbd Use-After-Free Remote Code Execution Vulnerability2 people · 2 mentions · first linked 2022-12-22
- Mobile Pwn2Own Day One Results2 people · 2 mentions · first linked 2017-11-01
- Pwn2own 2021: Schedule and live results2 people · 2 mentions · first linked 2021-04-07
- /advisories/ZDI-23-710/2 people · 2 mentions · first linked 2023-05-22
- Possible Azure RCE2 people · 2 mentions · first linked 2024-06-07
What Hacker News says?
There is kind of a market for server side vulnerabilities but I'm not sure if you would call it grey. I suspect ZDI will purchase commodity server side vulnerabilities ( https://www.zerodayinitiative.com/ ). So stuff like apache, nginx, and maybe opensource webapps that have a narrower usage.
Comment linking /
on “Leaking the email of any YouTube user for $10k”Submitted Two Winning Pwn2Own JIT Vulnerabilities in Mozilla Firefox as a story · 88 points
HN discussionCERT and the Zero Day Initiative handle disclosure for you, in some cases. https://vulcoord.cert.org/VulReport/ http://www.zerodayinitiative.com/about/
Comment linking /about/
on “What Happens When You Send a Zero-Day to a Bank?”Submitted Remote Root in DirectTV's Wireless Video Bridge as a story · 52 points
HN discussionThe following companies buy 0-days. Each has a slightly different business model: Zerodium - http://zerodium.com/ Azimuth Security - https://www.azimuthsecurity.com/ NSO Group - https://www.nsogroup.com/ ZDI - https://www.zerodayinitiative.com/ SSD - https://ssd-disclosure.com/
Comment linking /
on “We Hacked Apple for 3 Months”Submitted Possible Azure RCE as a story · 44 points
HN discussionYes - if you go by the iOS 12.1.1 security notes, for instance https://support.apple.com/en-us/HT209340 , it appears that CVE-2018-4435 was discovered independently (on the same day, even!) by TrendMicro / ZDI https://www.zerodayinitiative.com/advisories/ZDI-18-1365/ and Google Project Zero https://crbug.com/project-zero/1671 , whose reports don't mention each other. CVE-2018-4438 is also credited separately to both…
Comment linking /advisories/ZDI-18-1365/
on “Apple Confirms $1M Reward for Anyone Who Can Hack an iPhone”Submitted The Resuts – Pwn2Own 2017 Day Three as a story · 38 points
HN discussionAdding to this comment, see prices for 2018's Pwn2Own contest [1], for which Google Chrome has a 50% premium over Firefox and Safari. The Chromium bug bounty [2] is also the most accessible in terms of documentation and requirements; likewise it has the lowest floor and highest ceiling on potential payouts. ______________________ 1. https://www.zerodayinitiative.com/Pwn2Own2018Rules.html 2. https://www.google.com/ab…
Comment linking /Pwn2Own2018Rules.html
on “Am I logged in or not? GDPR case study on the example of Chrome browser change”Submitted The July 2019 Security Update Review as a story · 10 points
HN discussionI wonder why people suck things like Cloud, Co-Pilot or Adobe, WhatsApp or Windows? Let me guess. It seemed once convenient . This is the root of all evil. Don’t use it because it was pre-installed (Windows). Don’t keep using it because it was good before the Cloud (Photoshop). Don’t use it because others force you (WhatsApp). Literally all quick and convenient decisions are something we will regret. If you don’t li…
Comment linking /advisories/ZDI-24-581/
on “Cancel Adobe if you are a creative under NDA with your clients”Submitted From Pwn2Own 2021: A New Attack Surface on Microsoft Exchange – ProxyShell as a story · 4 points
HN discussionUbiquity introduced new vulns while fixing that fiasco from last year: https://www.zerodayinitiative.com/blog/2021/5/24/cve-2021-22... On the other hand, all of the other networking HW sucks just as much. E.g. here are Netgear vulnerabilities published just this week: https://www.microsoft.com/security/blog/2021/06/30/microsoft...
Comment linking /blog/2021/5/24/cve-2021-22909-digging-into-a-ubiquiti-firmware-update-bug
on “US companies hit by 'colossal' cyber-attack”Submitted Linux Kernel Ksmbd Use-After-Free Remote Code Execution Vulnerability as a story · 3 points
HN discussionNot OP, but JS engine JIT bugs are pretty common. https://phrack.org/issues/70/exploiting-logic-bugs-in-javasc... https://www.sentinelone.com/vulnerability-database/cve-2026-... https://projectzero.google/2020/09/jitsploitation-one.html https://www.zerodayinitiative.com/blog/2021/12/6/two-birds-w...
Comment linking /blog/2021/12/6/two-birds-with-one-stone-an-introduction-to-v8-and-jit-exploitation
on “Python's experimental JIT to be removed”Submitted Pwn2Own Vancouver 2019: Day One Results as a story · 3 points
HN discussionRelated, the two other $200k entries from Pwn2Own 2021:[1] - DEVCORE targeting Microsoft Exchange in the Server category (The DEVCORE team combined an authentication bypass and a local privilege escalation to complete take over the Exchange server.) - The researcher who goes by OV targeting Microsoft Teams in the Enterprise Communications category (OV combined a pair of bugs to demonstrate code execution on Microsof…
Comment linking /blog/2021/4/2/pwn2own-2021-schedule-and-live-results
on “Zoom zero-day discovery”Submitted 0Day MS Win JetDBE Out-Of-Bounds Remote Code Execution: Unpatched After 120 Days as a story · 3 points
HN discussionWas similarly curious. Reading the rules here: http://zerodayinitiative.com/Pwn2Own2015Rules.html Major points: - You register for which browser + os combination[0]. Then they randomly order the contestants. - When you are called, you have 30 minutes. - The user browses to a particular piece of content that you specify. Then no further user interaction is allowed (like clicking a dialog, downloading a file). [1][2]…
Comment linking /Pwn2Own2015Rules.html
on “All Major Browsers Fall at Pwn2Own Day Two”- km · 2026-03-27
Submitted ZDI-CAN-30207: Unpatched 9.8 RCE zero-day in Telegram as a story · 2 points
HN discussion > Then pwn2own decided not to include Firefox in another year hacks because Firefox made no improvements at all in previous 2 years. Uh, [citation needed]? Firefox was a valid target in Pwn2Own 2021: https://www.zerodayinitiative.com/blog/2021/1/25/announcing-... Nobody attacked Firefox successfully, but that's hardly a point against it. I don't know what "made no improvements at all in previous 2 years is supposed…
Comment linking /blog/2021/1/25/announcing-pwn2own-vancouver-2021
on “Mozilla Foundation pausing cryptocurrency donations”Submitted Zoom Heap Based Buffer Overflow Remote Code Execution Vulnerability as a story · 2 points
HN discussion> Virtual machines still suck a lot of CPU and bandwidth for nothing but emulation. Containers in Linux with cgroups are still full of RCE (remote command execution) and priviledge escalation. New ones are discovered each year. The first report I got on those listed 10 or more RCE + PE (remote root on the machine). Remote root can also escape VMs probably also. A proper virtual machine is extremely difficult to brea…
Comment linking /advisories/ZDI-23-982/
on “I stopped everything and started writing C again”Submitted CVE-2021-20226: A Reference-Counting Bug in the Linux Kernel Io_uring Subsystem as a story · 2 points
HN discussionAs per the full contest rules ( https://www.zerodayinitiative.com/Pwn2Own2019Rules.html ): > If more than one contestant registers for a given category, the order of the contestants will be drawn at random. Based on the contestant order, the first contestant will be given an opportunity to attempt to compromise the selected target. If unsuccessful, the next randomly drawn contestant will be given an opportunity. Thi…
Comment linking /Pwn2Own2019Rules.html
on “Pwn2Own Vancouver 2019: Tesla, VMWare, Microsoft, and more”Submitted 0day Android Privilege Escalation Vulnerability as a story · 2 points
HN discussionI found the tesla rules: you need to exploit as many systems as possible as hard as possible: https://static1.squarespace.com/static/5894c269e4fcb5e65a1ed... via https://www.zerodayinitiative.com/blog/2019/1/14/pwn2own-van...
Comment linking /blog/2019/1/14/pwn2own-vancouver-2019-tesla-vmware-microsoft-and-more
on “Pwn2Own Vancouver 2019: Tesla, VMWare, Microsoft, and more”Submitted The Left Branch Less Travelled: A Story of a Mozilla Firefox UAF Vulnerability as a story · 2 points
HN discussionNot widespread, but they do exist. https://www.zerodayinitiative.com/blog/2017/3/16/pwn2own-201...
Comment linking /blog/2017/3/16/pwn2own-2017-day-three-schedule-and-results
on “Reverse Engineering Malware 101”Submitted CVE-2019-0708: A Comprehensive Analysis of a Remote Desktop Services Vuln as a story · 2 points
HN discussion
