Sony awards $50,000 bounty for reporting a "critical" exploit

By Darth Saul

Sony’s bug bounty program pays researchers who privately disclose security flaws, giving the company time to investigate and address them.

A security researcher has received a $50,000 reward from PlayStation after reporting a critical vulnerability. He marked the occasion with a joke about finally being able to afford GTA 6.

The researcher, Jordy, is known as 2tonejordy on HackerOne. He celebrated the payout in a post on X, writing: “I can at least buy GTA 6 with this I think.”

The report described the vulnerability as critical, but the publicly available information did not specify the exploit.
PlayStation bounty follows PS5 hacking dispute. Jordy previously drew attention for reporting a PS5 hypervisor vulnerability to Sony, a move that led to a dispute with fellow researcher Andy “TheFlow” Nguyen.

In a September post, Jordy said Nguyen had asked him to delay reporting the flaw. Jordy initially agreed, but changed course after someone else found it. He said he worried that person might report it to claim the bounty.
Nguyen had been working to expand Linux support on the console. He wanted to postpone disclosure until after GTA 6 launched, so players could buy the game legally while keeping the option to run Linux.

After the disclosure, Nguyen said he would step away from PS5 development and stop his Linux work, including plans for PS5 Pro support in 2027. The earlier dispute, however, does not confirm that this vulnerability was the one behind Jordy’s newly publicized $50,000 reward.

Sony opened its bug bounty program to the public in June 2020, after previously working with researchers privately.

Darth Saul

98 posts

View Profile