[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-researcher-nets-90k-bounty-for-google-rce-bug":10,"sections":34},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":24,"tags":25,"sources":29,"feedback":33,"feedback_at":22,"cost_usd":33,"total_tokens":33},11391,"researcher-nets-90k-bounty-for-google-rce-bug","Researcher Nets $90k Bounty for Google RCE Bug","A security researcher earned a $90,000 bounty after finding a remote code execution flaw tied to insecure pickle deserialization in Google's developer site.","A bug hunter just pocketed $90,000 for finding a way to run arbitrary code on one of Google's own servers.\n\nSecurity researcher Simon Koeck discovered a remote code execution vulnerability in Google's developer site infrastructure. The bug stemmed from how the backend handled Flask session cookies: instead of relying on the framework's default signed, tamper-proof serializer, the service deserialized session data using Python's pickle module. Pickle is explicitly documented as unsafe for untrusted input because unpickling a crafted object graph can execute arbitrary code. Koeck crafted a malicious session payload, got Google's server to deserialize it, and achieved code execution - a finding serious enough that Google's bug bounty program paid out $90,000.\n\nPickle-based deserialization bugs are one of the oldest tricks in the Python security playbook, yet they keep surfacing in production systems, even ones run by a company with Google's security resources. It's a reminder that bug classes don't retire just because they're well-documented - they retire when engineering teams stop reaching for convenient-but-dangerous defaults.\n\nChalk it up as another entry in the long, embarrassing list of 'don't pickle untrusted data' incidents - a rule that's been in Python's own docs for over a decade and still gets ignored.","[\"security\",\"google\",\"bug-bounty\",\"vulnerability\"]","2026-10-12T07:28:53.000Z","2026-10-12T15:28:37.925Z","2026-10-12T15:28:43.824Z","published",null,[],"security",[24,26,27,28],"google","bug-bounty","vulnerability",[30],{"name":31,"url":32},"Hacker News","https:\u002F\u002Fsimonkoeck.com\u002Fwriteups\u002Fgoogle-devsite-flask-session-pickle-rce",0,{"sections":35},[36,41,45,50,55,60,65,70,75,80,85,90,95,100],{"name":37,"slug":38,"count":39,"latest_published_at":40},"AI","ai",6967,"2026-10-12T15:20:00.000Z",{"name":42,"slug":24,"count":43,"latest_published_at":44},"Security",954,"2026-10-12T14:20:37.000Z",{"name":46,"slug":47,"count":48,"latest_published_at":49},"Policy","policy",496,"2026-10-11T20:06:43.000Z",{"name":51,"slug":52,"count":53,"latest_published_at":54},"Deals","deals",492,"2026-10-12T14:55:53.000Z",{"name":56,"slug":57,"count":58,"latest_published_at":59},"Hardware","hardware",237,"2026-10-12T13:24:45.000Z",{"name":61,"slug":62,"count":63,"latest_published_at":64},"Science","science",196,"2026-10-11T15:34:40.000Z",{"name":66,"slug":67,"count":68,"latest_published_at":69},"Consumer Tech","consumer-tech",192,"2026-10-12T14:07:13.000Z",{"name":71,"slug":72,"count":73,"latest_published_at":74},"Startups","startups",121,"2026-10-12T13:22:34.000Z",{"name":76,"slug":77,"count":78,"latest_published_at":79},"Software","software",115,"2026-10-11T07:34:45.000Z",{"name":81,"slug":82,"count":83,"latest_published_at":84},"Dev Tools","dev-tools",111,"2026-10-12T11:22:24.000Z",{"name":86,"slug":87,"count":88,"latest_published_at":89},"General","general",71,"2026-10-12T16:10:40.000Z",{"name":91,"slug":92,"count":93,"latest_published_at":94},"Gaming","gaming",59,"2026-10-09T11:43:43.000Z",{"name":96,"slug":97,"count":98,"latest_published_at":99},"Reviews","reviews",35,"2026-10-12T14:00:00.000Z",{"name":101,"slug":102,"count":103,"latest_published_at":104},"How-To","how-to",8,"2026-10-05T09:00:00.000Z"]