Researcher nets major reward for finding Facebook bug able to unlock the gates to its internal systems

• A security flaw found in Facebook's ad platform has been fixed by Meta
• The researcher who discovered the flaw was awarded a $100,000 bug bounty
• The flaw allowed the researcher to effectively take control of a Facebook server

Meta has awarded cybersecurity researcher Ben Sadeghipour a bug bounty of $100,000 after he discovered a security vulnerability on Facebook’s ad platform in October 2024.

The flaw allowed Sadeghipour to run commands on the internal Facebook server which housed the platform, giving him control of the server.

According to Sadeghipour, the unpatched bug allowed him to hijack the server using a headless Chrome browser, which is a version of the browser users run from the computer’s terminal, to interact with Facebook’s internal servers directly.

Part of wider researcher

The flaw in the platform was connected to a server that Facebook used ...