Ten years of HackerOne Security Research Reports. This one has the biggest number yet. Researchers earned $89 million through HackerOne bug bounty programs last year, an 18% increase from the year before. The attack surface is growing. So is the opportunity. Read on for the details: bit.ly/3TEbpum

🚨 Fixes are out for two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Security researchers: If you find affected assets within program scope, submit validated findings with clear evidence and impact. Details: bit.ly/4z1vVUX

In this clip from the latest episode of HackerOne's Exposed video series, Nahman Khayet, Co-founder and CEO of Alt Security, gives his advice to researchers 1. Learn the hardest vulnerabilities. Even if you are just starting, try to understand how you get to remote code execution by chaining five different vulnerabilities on a web application. 3. Build your own harness—the secret is not in the model; it’s in the harness: how you take your ideas and put them into a machine to make you more productive. Watch the full episode on YouTube: bit.ly/4e6ltDe

In the latest episode of HackerOne's Exposed video series, Nahman Khayet, Co-founder and CEO of Alt Security, explains what separates a “good” researcher from the “best” researcher. Vulnerability research requires pattern matching and intuition. The operational work of pattern matching can be easily automated by AI. What can’t be automated is the intuition: I look at a target; there are 200 endpoints, but I know the right direction to take, the right pattern to look for. That’s what the best researchers can do. The best researchers can use AI models to double down on that intuition. “Vulnerability research is changing and evolving, and it’s intuition that will separate good from best.” Watch the full episode on YouTube: bit.ly/4e6ltDe

We asked over 400 researchers how AI is changing their work. The answer might surprise you. 85% are actively upskilling in AI. And nearly 3 in 4 say it's directly increasing their valid findings. What does this tell us? The researchers adapting fastest are finding more. More on this bit.ly/3TEbpum

Here's what this year’s HackerOne Security Report data actually shows about AI and researchers: 68% have shifted toward higher-complexity, higher-bounty bugs as AI handles more of the routine work. The floor is rising, but so is the ceiling. The result? Researchers aren't getting replaced, they're setting a new bar. More on this: bit.ly/3TEbpum

The numbers are in. Organizations are sitting on more unresolved vulnerabilities than they realize, and AI discovery is making the backlog grow faster than security teams can close it. Our 10th annual Security Research Report drops next week, and there’s no denying the demand for ethical security researchers isn't slowing down..

You asked for it, so we built it. The HackerOne researcher community now has a home on Discord. Here’s what is waiting for you inside: 🏆 Celebrate your wins (first report, biggest bounty — we want to hear all about it!) 📣 Platform updates and HackerOne news, straight from the source 💬 Real conversation with the wider researcher community This started with your feedback, and where it goes is up to all of us. We'd love for you to be part of it. Join us here: discord.gg/F2xUbUnkuQ

And now Anthropic’s Claude Mythos will soon be available in select H1 Platform products. We’re making frontier cyber AI models and the creativity and adversarial expertise of our security researcher community available to defenders. Because staying ahead takes both. To reiterate: HackerOne does not use or permit use of confidential researcher submissions or customer vulnerability data to train, fine-tune, or otherwise improve generative AI models. Check out the latest announcement: bit.ly/4hnvJYL

A few thoughts from our co-founder Alex Rice on today’s @OpenAI announcement 👇