Follow the latest coverage, related explainers and connected technology stories.
Simon Köck discovered an undocumented remote code execution vulnerability in Google DevSite’s architecture, caused by reusing an OAuth secret as a key to sign Flask sessions alongside unsafe deserialization of Python data. Google classified the vulnerability as S0 and paid a $90,000 bounty, but did not deploy the fix until two months after it was reported.