RightSignal
8 of 11

Your RightSignal

Security3 min

Researcher found a $90,000 remote code execution bug in a Google system

A security researcher published a writeup describing how a Flask session using Python's pickle format on a Google DevSite service allowed remote code execution, earning a $90,000 bounty.

Why it matters: It's a reminder that deserializing untrusted data with pickle is risky even inside major companies' infrastructure, a lesson for anyone building web services with session storage.
Researcher writeupsimonkoeck.com