TITLE: Apple Doubles Maximum Bug Bounty to $2 Million
Apple’s Enhanced Security Bounty Program
Apple has significantly upgraded its Security Bounty program, now offering some of the most substantial rewards in the cybersecurity industry. The company has doubled its top payout from $1 million to $2 million for researchers who discover sophisticated exploit chains that mimic advanced mercenary spyware attacks without requiring any user interaction. Even more impressive, the maximum potential reward can exceed $5 million for critical vulnerabilities found in beta software or Lockdown Mode bypasses.
Expanded Reward Categories
The enhanced program includes substantial increases across multiple vulnerability categories. Discoveries of exploit chains requiring just one-click user interaction now qualify for rewards up to $1 million, a significant increase from the previous $250,000 maximum. Similarly, attacks requiring physical proximity to devices can now earn researchers up to $1 million, while vulnerabilities needing physical access to locked devices have seen their maximum reward doubled to $500,000.
Additionally, security researchers who demonstrate the ability to chain WebContent code execution with sandbox escape techniques can receive up to $300,000 in rewards. According to reports from security monitoring sources, Apple has distributed over $35 million to more than 800 security researchers since expanding the program in recent years.
Addressing Sophisticated Threats
Apple’s announcement emphasized that the only system-level iOS attacks observed in real-world scenarios have originated from mercenary spyware, which is typically associated with state actors and used to target specific individuals. The company’s advanced security features, including Lockdown Mode and Memory Integrity Enforcement, are designed to combat these sophisticated threats by addressing memory corruption vulnerabilities and making mercenary attacks more difficult to execute.
Despite these security enhancements, Apple recognizes that threat actors continue to evolve their techniques. The substantial increases in bounty rewards aim to encourage advanced research on the company’s most critical attack surfaces, acknowledging the growing complexity of modern cybersecurity challenges. While top-dollar payouts remain relatively rare, Apple has made multiple $500,000 payments to security researchers, demonstrating its commitment to securing its platforms through collaborative security research.
