News Summary

• Google has officially suspended product vulnerability submissions to its Open Source Software Vulnerability Reward Program.
• The company encouraged participants to explore other VRP programs and committed to providing an update by the first quarter of 2027.
• Google said it may still accept reports covering product vulnerabilities through the Cloud VRP, “for some Google Cloud repos impacting Google Cloud products” The company did not officially confirm AI-generated reports as the reason for the move, but experts suspect this is the case.
• Earlier this month, Linux maintainers said they were “completely overwhelmed” by CVE finds after AI-powered bug hunters pushed the Linux kernel to a record 2,000 vulnerabilities per release.