Zeroday Cloud Competition Awards $320,000 for 11 Critical Vulnerabilities
- Securityish
- Threats & Incidents
Quick Summary
The Zeroday Cloud hacking competition in London awarded $320,000 for demonstrating 11 zero-day vulnerabilities in cloud infrastructure components. Hosted by Wiz Research with partners Amazon Web Services, Microsoft, and Google Cloud, the event saw researchers successfully exploit vulnerabilities in systems like Redis and PostgreSQL. This event highlights significant risks in cloud security, particularly concerning the isolation of cloud tenants and the protection of sensitive data.
The Securityish Brief
The Zeroday Cloud hacking competition took place in London, where researchers showcased critical remote code execution vulnerabilities in cloud infrastructure components. Hosted by Wiz Research in collaboration with Amazon Web Services, Microsoft, and Google Cloud, the event awarded a total of $320,000 for successful exploits across 13 hacking sessions. Researchers demonstrated 11 zero-day vulnerabilities, achieving an impressive success rate of 85%.
On the first day, $200,000 was awarded for successful exploits in Redis, PostgreSQL, Grafana, and the Linux kernel. The second day saw an additional $120,000 awarded for vulnerabilities in Redis, PostgreSQL, and MariaDB, which are widely used databases for storing sensitive information in cloud systems.
One notable vulnerability involved a container escape flaw in the Linux kernel, which compromised the isolation between cloud tenants, a critical aspect of cloud security. Researchers from Zellic and DEVCORE were recognized for their contributions, receiving $40,000 for their successful exploits.
Artificial Intelligence was also a focus, with attempts to exploit the vLLM and Ollama models, which could have exposed private AI models and datasets. However, these attempts were unsuccessful due to time constraints.
Team Xint Code emerged as the champion of the competition, earning $90,000 for successfully exploiting vulnerabilities in Redis, MariaDB, and PostgreSQL. Despite the significant awards, this amount represents only a small fraction of the total prize pool of $4.5 million available for researchers.
The competition revealed that several eligible categories, including AI technologies and various web servers, did not see any successful exploits, indicating areas where vulnerabilities may still exist.
Key Takeaways
- Stay informed about vulnerabilities in cloud infrastructure by following updates from security research competitions.
- Regularly review and update your cloud security configurations to protect sensitive data stored in databases.
- Consider implementing additional security measures, such as container isolation, to mitigate risks from vulnerabilities.
- Monitor for announcements regarding zero-day vulnerabilities and apply patches promptly to safeguard your systems.
- Educate your team about the importance of cybersecurity practices, especially in cloud environments.
Key Terms & Concepts
- Zero-Day Vulnerability: In this article, a zero-day vulnerability refers to a security flaw that is exploited before the vendor is aware of it.
- Remote Code Execution: Remote code execution is a type of vulnerability that allows an attacker to run arbitrary code on a remote system.
- Container Escape: Container escape is a security breach where an attacker breaks out of a container to access the host system.
Read the original article here: https://www.bleepingcomputer.com/news/security/zeroday-cloud-hacking-event-awards-320-0000-for-11-zero-days/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
