Google fixed major DevSite RCE flaw after two months
Google took two months to fix a critical vulnerability in its developer documentation platform, DevSite, after a researcher discovered an unauthenticated remote code execution (RCE) flaw in its session handling. The bug, caused by a reused OAuth secret in session cookies, allowed anyone to potentially run Python code on servers without an account. Google awarded a $90,000 bounty, rating the issue as its highest severity tier.
- Unauthenticated RCE flaw found in Google's DevSite
- Bug due to improperly reused OAuth client secret
- Researcher could run code on three confirmed hosts
- All seven affected domains accepted forged sessions
- Google rated severity at its highest level, paid $90,000
Sources covering this
In this story
More in Cybersecurity
Cyberattack disrupts refrigeration at French supermarkets
A cyberattack hit refrigeration systems at hundreds of French supermarkets, including Intermarché, Leclerc, and Coopérative U, after…
UK to tighten cyber defences as AI risks escalate
The UK's AI minister called for tougher safety standards from leading AI firms as the government plans to enhance national cyber…
Researchers find Windows malware using Tox for control
Security researchers have identified AvisLoader, a new Windows malware loader that uses the encrypted Tox peer-to-peer messaging network…
GitLab patches critical flaw allowing remote code execution
GitLab has issued patches for a critical vulnerability (CVE-2026-97229) that could let unauthenticated remote attackers execute…