We’re updating the Microsoft 365 Bounty Program to make program scope clearer for researchers.
One of the biggest changes: we’re shifting from domains to services, making it easier to understand which Microsoft 365 services are included in the program and how eligible research
- Security researchers play an essential role in helping Microsoft protect customers, and we appreciate the time and expertise that goes into every vulnerability report. Many researchers already provide the detailed, actionable reports our teams need to reproduce and assess
- Security updates for October 2026 are now available. Details are here: msrc.microsoft.com/update-guide/ As security update packages address more CVEs, prioritization can become more complex. In a new blog, we explore risk cohorts, an approach to grouping CVEs around shared deployment,
- Server-Side Request Forgery (SSRF) remains one of the most impactful vulnerability classes in cloud environments, where network reachability, identity, and trust boundaries intersect. In our latest blog, we explore how SSRF works, why cloud-hosted environments amplify its
- For more than three years, Artem Shymshyrian (@Xtytia0922) pursued bug bounties without receiving one. Instead of giving up, he made a promise to himself: keep going until he earned his first bounty, even if it was only one dollar. That persistence eventually helped Artem become



