Zero Day Initiative

Yeah.

Trend Micro's Zero Day Initiative, or ZDI, orchestrates this to uncover critical flaws before malicious actors can weaponize them.

And the mandate is strict.

Like how strict?

The collisions.

Yes, the collisions.

The S26 was hacked seven times during the event, but six of those winning entries involved what ZDI calls a collision, meaning the bug used to break into the phone was already known to the vendor before the contest even started.

That's right.

Thoughts and prayers.

Um, and so I think, uh, so ZDI used to ha-...

Zero Day Initiative, which, um, the organization that runs Pwn2Own, they used to have a strict 90-day-

Mm-hmm

I think right now it's, there's an asymmetry.

Um, I think that there's, there needs to be some smart people that step up and help the other side, uh, because yeah, it seems like they're drowning.

I also, uh, to clarify, I think because they've gotten this slack from boun- bug bounty, and like programs like ZDI, where they kind of can ensure that the researcher, you know, the researchers gets paid and-

Right

Uh, their own advisory notes that reliable triggering depends on the server already being under sustained low memory pressure.

So that isn't typical day to day, but ZDI's Dustin Childs still ranked it ahead of the confirmed zero-days in priority.

The same release patched roughly 20 separately wormable unauthenticated RCE bugs spanning DNS, DHCP, NetLogon, Kerberos, and message queuing.

Foundational identity and network services that are usually reachable without really interacting, touching a, a user at all.