Advisories
Google Pauses OSS Vulnerability Reward Program Amid Surge of Invalid Automated Submissions
Google has temporarily halted acceptance of product vulnerability reports in its Open Source Software Vulnerability Reward Program (OSS VRP) after a spike in automated, largely invalid submissions. The pause does not affect supply‑chain reports or existing submissions, and product vulnerabilities for Google Cloud may still be reported through the Cloud VRP.
What Happened
Google announced on X that it has suspended product‑level submissions to its OSS VRP as a result of a significant increase in automated, largely invalid reports.
Scope of the Pause
The restriction applies only to new product vulnerability reports. Supply‑chain findings and reports already in the queue remain unaffected. Existing submissions made before the pause are still valid.
Impact on Defenders
Security teams that rely on the OSS VRP to surface product flaws should temporarily shift focus to other channels, such as the Cloud VRP for Google Cloud repositories, or internal triage processes.
Next Steps
Monitor Google’s official channels for a re‑opening date. In the meantime, verify any automated findings before submitting to avoid contributing to the backlog. Keep an eye on the Cloud VRP for eligible Google Cloud product vulnerabilities.
“This pause is due to a significant rise in automated submissions, the vast majority of which are not valid,” said Google.
Related vulnerabilities
Google Pauses OSS VRP Due to AI-Generated Submissions
Google has temporarily paused submissions to its Open Source Vulnerability Reward Program (OSS VRP) due to a surge in low-quality, largely AI-generated vulnerability reports. This follows similar actions by other projects like curl and Intel, highlighting a growing challenge in vulnerability disclosure programs. Defenders should anticipate similar disruptions and prepare for increased triage demands.
Read briefing
Hacktivist‑Led DDoS and Defacement Surge Amid Middle East Conflict
During the first two weeks of the Middle East conflict, hacktivist groups launched coordinated DDoS and website defacement attacks targeting government, telecom, and financial sites. Defenders should harden ingress traffic, monitor for malicious payloads, and enforce strict web‑application controls.
Read briefing
React2Shell Exploitation Surge: Automated Scans Target Vulnerable React Server Components
Over the past 10 days the React2Shell campaign has flooded networks with automated probes against vulnerable React Server Components. Most traffic consists of 200‑500‑byte payloads, indicating scripted scanners, while a minority of 1,000‑byte payloads carry actual malicious code. Defenders should harden React deployments, monitor for these size patterns, and leverage GreyNoise blocklists.
Read briefing
Ivanti Connect Secure & Policy Secure Gateways Hit by Multi‑Vulnerability Surge – Patch Now
A wave of critical flaws—CVE‑2024‑22024, CVE‑2024‑21888, CVE‑2024‑21893, CVE‑2023‑46805, CVE‑2024‑21887—has been actively exploited against Ivanti Connect Secure and Policy Secure Gateways. The bugs enable unauthenticated privilege escalation, SSRF, and remote code execution, letting attackers hijack devices and steal credentials. Ivanti released patches for most affected versions in February, with additional fixes rolled out through March. Immediate patching, re‑authentication, and hardened configuration are essential to stop attackers from leveraging these weaknesses.
Read briefing