Curl Bug Bounty Confirmation Rates Drop Below 5%

Curl maintainer Daniel Stenberg confirmed that vulnerability confirmation rates fell from above 15% in previous years to below 5% starting in 2025. During its lifetime, the curl bug bounty program helped uncover 87 confirmed vulnerabilities and paid researchers more than $100,000. Bug bounties allow learners to test skills on real software and help developers make it safer.

In April, Daniel Stenberg reported that submission quality improved and the share of confirmed vulnerabilities returned to roughly 15% to 16%. Bug bounty income depends on a finding being valid, eligible, and covered by the program's payment rules. Google paused its wider vulnerability rewards programs but kept supply chain submissions and outstanding reports unaffected. Google's wider vulnerability rewards programs paid researchers $17.1 million in 2025.

TryHackMe offers browser-based labs and guided learning paths for cybersecurity from beginner to advanced levels. Over 8 million learners have joined TryHackMe to start learning cybersecurity for free with no setup needed. The TryHackMe Cyber Security 101 learning path covers networking, Linux and Windows fundamentals, web application basics, and offensive and defensive security. AI can help explain unfamiliar errors, suggest investigation questions, or review the clarity of notes in cybersecurity learning. By the end of a four-week practice month, learners should have a record of their reasoning and a report they can improve.