Cloudflare Offers $3,000 Bounty for Unique PHO2SHELL Bypasses

Summary

The video describes Cloudflare's $3,000-per-unique-bypass challenge and reports that two researchers said they found a bypass but did not want to submit it through HackerOne.

Key points

• The video says Cloudflare is offering $3,000 for each unique way to bypass the PHO2SHELL firewall.
• The challenge uses a deliberately vulnerable PHP server behind a web application firewall; participants must bypass it, run code, and recover a flag.
• To qualify for the bounty, researchers must verify the flag and submit a report through HackerOne.
• Two researchers reportedly said they found a bypass but would not submit it through HackerOne; the video says neither explained their reason.
• The speaker argues that researchers' trust in the reporting route matters to whether a vulnerability disclosure process works.