I received 37 CVE credits from MSRC this month. Neither the number of vulnerabilities patched nor multiple researchers sharing credit for the same bug is surprising. Luckily, almost all my reports were “no dup”—perhaps the greatest surprise for security researchers in the AI era.
#28 this period. And, it’s been an incredible two months working with my AI assistant: 80+ reports to MSRC with accurate PoCs across almost all vuln types. After the patches, I may share a series on how I collaborate with LLMs. Congrats again to everyone on the list!
Today, we're proud to recognize the Top 100 Microsoft 2026 Most Valuable Researchers (MVRs).
Security researchers play a critical role in helping protect customers by identifying and reporting vulnerabilities across Microsoft products and services. We're grateful for their partnership and the impact they have made over the past year.
Congratulations to this year's Top 10 MVRs:
🥇C46F3708A45EF0041BD0A49DDAEA0E25
🥈ShinHyuiq & Alan Pang
🥉cherrypick
4. Brad Schlintz (@nmdhkr)
5. wtm (@wtm_offensi)
6. Asaf Cohen (XBREACH.AI)
7. bccc95a61a3cc79d7b2c4423c808f744
8. Felix B.
9. 142a423e2574abf10d65eba46891ca5e
9. Anonymous
This year, we updated the MVR leaderboard to rank researchers based on total bounty awards, creating a clearer connection between recognition and security impact. We also introduced Special Mentions to recognize researchers who submitted valid vulnerability reports during the recognition period, regardless of leaderboard ranking.
See our blog for the complete list of the Top 100 MSRC 2026 Most Valuable Researchers and the top researchers by bounty program: microsoft.com/en-us/msrc/blo…
Thank you to every researcher who partnered with us this year to help protect customers worldwide.
ALT Microsoft 2026 Most Valuable Researchers (MVRs)
Migrated my blog and published a new post. It covers a common type confusion vulnerability pattern I found last year in RPC servers. I don’t think this is a new class of vulnerability, but I did find the same issue across multiple RPC services. whereisk0shl.top/post/From%2…
Cant wait
Pre-orders for Grand Theft Auto VI will officially begin on June 25 on digital storefronts and at other select retailers.
Check out the official cover art, also available as downloadable artwork at rockstargames.com/VI
k0shl retweeted
Update to the Windows Insider Preview bounty program: General Awards for Elevation of Privilege and Information Disclosure are now split by finishing privilege, with award ranges increasing to $1,000–$8,000.
This change is designed to better align rewards with the impact of reported vulnerabilities.
Learn more on the Windows Insider Preview bounty page: msft.it/6018v3QZI
ALT Windows Insider Preview Bounty Update
Have a lovely night connecting with MSRC team and MVRs, thanks @msftsecresponse for inviting me to attend Black Hat Asia and MSRC Researcher Celebration😊”trust me, we all love MSRC” — via Yuki Chen
Thank you to everyone who joined us for the MSRC Researcher Celebration at Black Hat Asia. It was great to connect with so many in the community and spend time sharing ideas and conversations.
We appreciate the collaboration that drives this work forward and look forward to what we’ll build together next.
This month MSRC fixed my Windows Defender info leak vulnerability CVE-2025-62468, but all acknowledgments are incorrect. First, I provided a working exploit, so it’s not “exploitable unlikely.”😅msrc.microsoft.com/update-gu…
Our slide is online: i.blackhat.com/BH-USA-25/Pre…
Glad to share our pre-auth DoS & RCE bug hunting research at #BHUSA! Thanks @BlackHatEvents for the pre-recording, as we couldn’t attend in person this time for personal reasons. Questions? DM us @vv474172261 @XiaoWei___ @edwardzpeng
k0shl retweeted
We released our Fuzzilli-based V8 Sandbox fuzzer: github.com/googleprojectzero…
It explores the heap to find interesting objects and corrupts them in a deterministic way using V8's memory corruption API. Happy fuzzing!
Well. Happy to be on the MVRs annual list again and again — twice in a year 😂! Ended up #11. Thanks @msftsecresponse and congrats all!
Our previously published Most Valuable Researchers (MVR) leaderboard contained inaccuracies due to technical issues on our end. We apologize for the error and have since resolved the issue. We’re now sharing a fully refreshed and accurate leaderboard.
The Microsoft Researcher Recognition Program offers public thanks and recognition to security researchers who help protect our customers by discovering and sharing security vulnerabilities under Coordinated Vulnerability Disclosure.
We are excited to recognize this year’s Most Valuable Researchers (MVRs), based on the total number of points earned for each valid report. Please join us in celebrating this year’s MVRs, including our top 10:
1. 🥇wkai
2. 🥈VictorV (@vv474172261)
3. 🥉Suresh Chelladurai
4. Anonymous
5. Brad Schlintz (@nmdhkr )
6. @0x140ce
7. Anonymous
8. Dhiral Patel (@dhiralpatel94)
9. Nan Wang (@eternalsakura13) and Ziling Chen
10. Adnan (@adnanthekhan)
See the full list of this year’s MVRs, in addition to our Azure, Office, Windows, and Dynamics 365 leaderboards: msft.it/6019sBjyU
#bugbounty
ALT MVR
k0shl retweeted
During #BHUSA Briefing "Diving into Windows HTTP: Unveiling Hidden Preauth Vulnerabilities in Windows HTTP Services," we will discuss the different architectures of Windows HTTP services and share multiple previously undisclosed vulnerability cases and attacks. We will also summarize these new vulnerability patterns and provide a comprehensive interpretation of the security threats within the realm of Windows HTTP services. Register now >> bit.ly/3GvK9rr
Happy to make list again! Thank you @msftsecresponse and congrats all!
The Microsoft Researcher Recognition Program offers public thanks and recognition to security researchers who help protect our customers by discovering and sharing security vulnerabilities under Coordinated Vulnerability Disclosure.
Today, we are excited to recognize this year’s 100 Most Valuable Researchers (MVRs), based on the total number of points earned for each valid report. Please join us in celebrating this year’s MVRs, including our top 10:
1. 🥇 VictorV (@vv474172261)
2. 🥈 wkai
3. 🥉 Suresh Chelladurai
4. Anonymous
5. Adnan (@adnanthekhan)
6. Dhiral Patel (@dhiralpatel94)
7. Nan Wang (@eternalsakura13) and Ziling Chen
8. Anonymous
9. @0x140ce
10. Azure Yang (@4zure9)
See the full list of this year’s 100 MVRs, in addition to our Azure, Office, Windows, and Dynamics 365 leaderboards: msft.it/6011s6KxU
#bugbounty
ALT MVR 2025 annual leaderboard
k0shl retweeted
In #BHUSA Briefings "Diving into Windows HTTP: Unveiling Hidden Preauth Vulnerabilities in Windows HTTP Services" where the speakers will discuss the different architectures of Windows HTTP services and share multiple previously undisclosed vulnerability cases and attacks. They will also summarize these new vulnerability patterns and provide a comprehensive interpretation of the security threats within the realm of Windows HTTP services. Learn more here >> bit.ly/3EWB3mI
Excited to announce our talk has been accepted by
@BlackHatEvents #BHUSA!🥳🥳🥳
In my part of presentation, I’ll cover logic-based pre-auth remote vulnerabilities uncovered via novel abuse of Windows native HTTP API.
Can't wait to see y'all in Las Vegas!
blackhat.com/us-25/briefings…
