The security landscape is changing. There's been on and off talk about bounties for security vulnerabilities and some firms already buy vulnerabilities (SecuriTeam, ZDI). This also causes me to re-evaluate the value of a vulnerability.

Suppose I've recently found an arbitrary code execution vulnerability that could very likely be exploited on a large fraction of 400K+ Drupal sites.

What do you think I should do with it?

For the comments: What's your opinion on a security vulnerability bounty program?

Update: I've reported the vulnerability via SecuriTeam. It has been fixed with the release of Drupal 7.16. See SA-CORE-2012-003 for details.

Report to the Drupal security team

91% (78 votes)

Wait for a bug-bounty program, then report

5% (4 votes)

Sell to the highest bidder

3% (3 votes)

Other (please comment)

1% (1 vote)

Total votes: 86

• Drupal
• Security
• Planet Drupal