Platforms
Google Blog introduced OSS Rebuild, an open-source project that rebuilds packages from popular registries and publishes verifiable build metadata. The goal is to raise trust in open-source supply chains by comparing rebuilt artifacts to what users actually download, and by issuing SLSA provenance attestations that meet Build Level 3—without requiring any action from package publishers.
OSS Rebuild targets widely used ecosystems—PyPI, npm, and Crates.io—by deriving declarative build definitions, running instrumented builds, and normalizing expected instabilities before comparing results to upstream artifacts. The process is designed to surface issues such as missing or unsubmitted source code in published packages, compromised build environments, and stealthy backdoors that simple static checks can miss. When automation falls short, maintainers or users can supply manual build specifications.
Beyond detecting divergences, the project enriches existing software metadata. It can add build observability to SBOMs, help teams respond faster by enabling reproducible re-hosting or patched rebuilds, and retrofit historical packages with attestations to improve legacy trust. The announcement also notes experiments with AI to extract build and release guidance from human-facing documentation, aiming to expand automation coverage. Consumers can fetch attestations with a provided Go CLI or deploy their own instance using the published infrastructure, making the system suitable for integration into verification and vulnerability management workflows. The effort is positioned as a tool for security teams and consumers rather than a replacement for upstream maintainers, and contributions are invited via the project repository.
Policies
MSRC announced the return of Zero Day Quest, a public research challenge running 4 August to 4 October 2025 with up to $5 million in total bounty awards focused on cloud and AI security. The program is open to all researchers and builds on the prior year’s event.
Microsoft highlights targeted scenarios across Azure, Copilot, Dynamics 365 and Power Platform, Identity, and M365. A +50% bounty multiplier applies to Critical severity vulnerabilities and other high-impact findings that align with Microsoft’s bounty programs; when multiple multipliers might apply, only the highest value is used.
High-performing participants may qualify for an invite-only live hacking event at the Redmond campus in Spring 2026, working directly with product teams and MSRC engineers. Microsoft will offer training and recorded sessions from the AI Red Team, MSRC, and Dynamics teams to help researchers prepare. In line with Coordinated Vulnerability Disclosure and the Secure Future Initiative, Microsoft commits to transparently publish and assign CVEs for critical issues—even when no customer action is required—and to support public reporting once mitigations are in place. The initiative aims to strengthen cloud and AI security through collaboration and responsible disclosure.
Research
Talos detailed a collaboration with NetHope and Cisco Crisis Response to produce a tailored expansion deck for the Backdoors & Breaches tabletop exercise, focused on international humanitarian NGOs. The 2023 effort responds to a persistent cybersecurity “poverty line” in the sector, where limited resources and challenging operating conditions intersect with targeting by state actors, mercenary spyware groups, and other adversaries.
The NGO-centric deck models real incidents and conditions such as forced relocations, intermittent or low-bandwidth connectivity, and severely constrained technical resources. Presented at the 2023 NetHope Global Summit, the expansion generated practical discussions and hands-on learning; hundreds of physical copies were distributed and supporting materials were published online to broaden access.
Talos subsequently partnered with NGO-ISAC on a U.S. domestic edition tailored to civil society and distributed teams, including options to run sessions virtually from a simple local web server. The project emphasizes low barriers to entry and scalability so smaller organizations can rehearse worst-case scenarios without significant expense. By making sector-specific scenarios available, the initiative aims to strengthen preparedness, improve cross-team coordination, and reduce operational risks during humanitarian missions. Feedback from NGO participants has been positive, and Talos continues to distribute copies and support trainers as NGOs integrate the exercises into routine preparedness activities.