Hacking contest kerfuffle over copied rules pits Wiz against ZDI
(2025/10/05)
- Reference: 1759653129
- News link: https://www.theregister.co.uk/2025/10/05/zdi_wiz_hacking_contest_kerfuffle/
- Source link:
A new hacking contest has caused a social media kerfuffle over allegations of rule copying and plagiarism.
Wiz, the cloud-security shop that [1]agreed to acquire for $32 billion (pending approvals), on Tuesday announced its new cloud-hacking competition called [2]Zero Day Cloud , with a $4.5 million prize pool. The competition is open to hackers who can find and exploit a 0-click remote code execution (RCE) or container escape vulnerability in any of the [3]20 open-source projects that power the major cloud platforms.
Contestants have until December 1 to submit their entries, and those accepted will be invited to demonstrate their exploits on stage in London on December 10 and 11. If a demo succeeds, Wiz validates and discloses to maintainers, and the researchers win a [4]payout ranging from $10,000 to $300,000 depending on the target.
[5]
And, according to Trend Micro's Zero Day Initiative, which [6]hosts Pwn2Own - one of the world's biggest hacking contests - Wiz's Zero Day Cloud [7]rules look eerily [8]similar to its own .
[9]
[10]
"Hey Wiz - congrats on starting your own contest," Dustin Childs, ZDI head of threat awareness, [11]posted on social media. "But uh ... did you have to cut/paste sections of the rules from Trend Zero Day Initiative? Seems like you should at least run that through ChatGPT to reword it. I guess imitation is the sincerest form of plagiarism."
In true infosec geek fashion, this was [12]met by memes , and [13]reposted by Trend, which invited Wiz to join the fun at Pwn2Own Ireland, which begins October 21 with a [14]$1 million bounty on the line for a 0-click WhatsApp RCE.
[15]
"Bring your best, but maybe don't copy our rules next time and we can help you judge the entries ;)," Trend snarked.
Wiz declined to answer The Register 's questions, including whether the contest organizers cut-and-pasted Pwn2Own's rules, and instead directed us to its [16]response posted Friday:
We're huge Pwn2Own fans -- it's really raised the bar for the entire security community and set a gold standard for hacking competitions. It's one of many amazing contests that inspired us. The rulebook is a trusted, mature framework by which we were inspired. Our goal is to spark innovation, not irritate.
Our competition has a particular focus on cloud. We specifically want to dig into core open-source software powering cloud and AI infrastructure and find zero-day gaps. Ultimately, the goals here are the same: empowering researchers and making the community safer. Great to be in this together.
The Register caught up with Childs on Friday to get his viewpoint on the new contest. When Wiz first announced the competition, Childs said he and the other ZDI threat hunters were "intrigued."
"We've been putting on Pwn2Own for so many years," and Wiz's Zero Day Cloud looked like an "interesting competition with some interesting targets," he said. "And then we read the rules, and they looked incredibly familiar to us because the rules were, in large part, we'll just say borrowed from Pwn2Own rules."
This includes giving each contestant up to three attempts to succeed, and each of the three attempts is limited to 10 minutes.
[17]
"Obviously, the ZDI has no exclusivity on writing a [18]hacking competition ," Childs said. "We make no claim on running a Pwn2Own-style competition either - anyone can do that."
[19]Pwn2Own contest concludes with nearly $1m paid out to ethical hackers
[20]ZDI shames Microsoft for – yet another – coordinated vulnerability disclosure snafu
[21]Bug bounties: The good, the bad, and the frankly ridiculous ways to do it
[22]Blame a leak for Microsoft SharePoint attacks, researcher insists
However, ZDI's rules were developed over the contest's 15-year history - the time limit, for example, was set after a competitor ran the same exploit for a couple of hours on stage - "and there's a story behind every rule," Childs said.
"So it was a little frustrating to see it used that way, especially coming from them. But I'm still intrigued by the contest, I still want to see the outcome, and who knows, maybe we will participate with some of our own researchers."
Other security researchers [23]weighed in online, and the general consensus seems to be " [24]it's better for everyone if there are more competitions."
Childs said he agrees with this sentiment. "Any hacking competition is a good idea. Hopefully it'll get bugs to vendors to be fixed before they're used in the wild. That's our goal. And competition drives innovation. So maybe they'll do something that we'll see and like, and say, hey, we can innovate like that too, or we can, or it'll push us to do more."
He's also looking forward to seeing how Zero Day Cloud's rules evolve between now and the December contest, and in years to come.
"Maybe they'll learn something that's really good," Childs said. "And we could borrow that for our rules, too." ®
Get our [25]Tech Resources
[1] https://www.theregister.com/2025/04/09/google_enterprise_security_ambitions/
[2] https://www.zeroday.cloud/
[3] https://github.com/wiz-sec-public/zeroday-cloud-2025
[4] https://www.zeroday.cloud/#prizes
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/cybersecuritymonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aOJBtWXtXeMO1FOuk7C0hgAAAA4&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[6] https://www.theregister.com/2022/12/13/pwn2own_wraps/
[7] https://www.zeroday.cloud/rules
[8] https://www.zerodayinitiative.com/Pwn2OwnIreland2025Rules.html
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/cybersecuritymonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aOJBtWXtXeMO1FOuk7C0hgAAAA4&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/cybersecuritymonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aOJBtWXtXeMO1FOuk7C0hgAAAA4&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[11] https://bsky.app/profile/dustinchilds.bsky.social/post/3m25th7wv3k2p
[12] https://x.com/gothburz/status/1973518895190515784
[13] https://www.linkedin.com/posts/trend-micro_zeroday-cloud-cloud-security-hacking-competition-activity-7379280371676479488-q3bB?utm_source=share&utm_medium=member_desktop&rcm=ACoAAAX3rawBPm6RIM1LZlSs7tFoRQis8-XnEUo
[14] https://www.zerodayinitiative.com/blog/2025/7/30/pwn2own-returns-to-ireland-with-a-one-million-dollar-whatsapp-target
[15] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/cybersecuritymonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aOJBtWXtXeMO1FOuk7C0hgAAAA4&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[16] https://www.linkedin.com/feed/update/urn:li:activity:7379280371676479488?commentUrn=urn%3Ali%3Acomment%3A%28activity%3A7379280371676479488%2C7379865144635310080%29&dashCommentUrn=urn%3Ali%3Afsd_comment%3A%287379865144635310080%2Curn%3Ali%3Aactivity%3A7379280371676479488%29
[17] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/cybersecuritymonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aOJBtWXtXeMO1FOuk7C0hgAAAA4&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[18] https://www.theregister.com/2025/08/24/bug_bounty_advice/
[19] https://www.theregister.com/2022/12/13/pwn2own_wraps/
[20] https://www.theregister.com/2024/07/15/zdi_microsoft_vulnerability/
[21] https://www.theregister.com/2025/08/24/bug_bounty_advice/
[22] https://www.theregister.com/2025/07/26/microsoft_sharepoint_attacks_leak/
[23] https://x.com/steventseeley/status/1973539745507713253
[24] https://x.com/FuzzySec/status/1973662725105721567
[25] https://whitepapers.theregister.com/
Wiz, the cloud-security shop that [1]agreed to acquire for $32 billion (pending approvals), on Tuesday announced its new cloud-hacking competition called [2]Zero Day Cloud , with a $4.5 million prize pool. The competition is open to hackers who can find and exploit a 0-click remote code execution (RCE) or container escape vulnerability in any of the [3]20 open-source projects that power the major cloud platforms.
Contestants have until December 1 to submit their entries, and those accepted will be invited to demonstrate their exploits on stage in London on December 10 and 11. If a demo succeeds, Wiz validates and discloses to maintainers, and the researchers win a [4]payout ranging from $10,000 to $300,000 depending on the target.
[5]
And, according to Trend Micro's Zero Day Initiative, which [6]hosts Pwn2Own - one of the world's biggest hacking contests - Wiz's Zero Day Cloud [7]rules look eerily [8]similar to its own .
[9]
[10]
"Hey Wiz - congrats on starting your own contest," Dustin Childs, ZDI head of threat awareness, [11]posted on social media. "But uh ... did you have to cut/paste sections of the rules from Trend Zero Day Initiative? Seems like you should at least run that through ChatGPT to reword it. I guess imitation is the sincerest form of plagiarism."
In true infosec geek fashion, this was [12]met by memes , and [13]reposted by Trend, which invited Wiz to join the fun at Pwn2Own Ireland, which begins October 21 with a [14]$1 million bounty on the line for a 0-click WhatsApp RCE.
[15]
"Bring your best, but maybe don't copy our rules next time and we can help you judge the entries ;)," Trend snarked.
Wiz declined to answer The Register 's questions, including whether the contest organizers cut-and-pasted Pwn2Own's rules, and instead directed us to its [16]response posted Friday:
We're huge Pwn2Own fans -- it's really raised the bar for the entire security community and set a gold standard for hacking competitions. It's one of many amazing contests that inspired us. The rulebook is a trusted, mature framework by which we were inspired. Our goal is to spark innovation, not irritate.
Our competition has a particular focus on cloud. We specifically want to dig into core open-source software powering cloud and AI infrastructure and find zero-day gaps. Ultimately, the goals here are the same: empowering researchers and making the community safer. Great to be in this together.
The Register caught up with Childs on Friday to get his viewpoint on the new contest. When Wiz first announced the competition, Childs said he and the other ZDI threat hunters were "intrigued."
"We've been putting on Pwn2Own for so many years," and Wiz's Zero Day Cloud looked like an "interesting competition with some interesting targets," he said. "And then we read the rules, and they looked incredibly familiar to us because the rules were, in large part, we'll just say borrowed from Pwn2Own rules."
This includes giving each contestant up to three attempts to succeed, and each of the three attempts is limited to 10 minutes.
[17]
"Obviously, the ZDI has no exclusivity on writing a [18]hacking competition ," Childs said. "We make no claim on running a Pwn2Own-style competition either - anyone can do that."
[19]Pwn2Own contest concludes with nearly $1m paid out to ethical hackers
[20]ZDI shames Microsoft for – yet another – coordinated vulnerability disclosure snafu
[21]Bug bounties: The good, the bad, and the frankly ridiculous ways to do it
[22]Blame a leak for Microsoft SharePoint attacks, researcher insists
However, ZDI's rules were developed over the contest's 15-year history - the time limit, for example, was set after a competitor ran the same exploit for a couple of hours on stage - "and there's a story behind every rule," Childs said.
"So it was a little frustrating to see it used that way, especially coming from them. But I'm still intrigued by the contest, I still want to see the outcome, and who knows, maybe we will participate with some of our own researchers."
Other security researchers [23]weighed in online, and the general consensus seems to be " [24]it's better for everyone if there are more competitions."
Childs said he agrees with this sentiment. "Any hacking competition is a good idea. Hopefully it'll get bugs to vendors to be fixed before they're used in the wild. That's our goal. And competition drives innovation. So maybe they'll do something that we'll see and like, and say, hey, we can innovate like that too, or we can, or it'll push us to do more."
He's also looking forward to seeing how Zero Day Cloud's rules evolve between now and the December contest, and in years to come.
"Maybe they'll learn something that's really good," Childs said. "And we could borrow that for our rules, too." ®
Get our [25]Tech Resources
[1] https://www.theregister.com/2025/04/09/google_enterprise_security_ambitions/
[2] https://www.zeroday.cloud/
[3] https://github.com/wiz-sec-public/zeroday-cloud-2025
[4] https://www.zeroday.cloud/#prizes
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/cybersecuritymonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aOJBtWXtXeMO1FOuk7C0hgAAAA4&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[6] https://www.theregister.com/2022/12/13/pwn2own_wraps/
[7] https://www.zeroday.cloud/rules
[8] https://www.zerodayinitiative.com/Pwn2OwnIreland2025Rules.html
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/cybersecuritymonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aOJBtWXtXeMO1FOuk7C0hgAAAA4&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/cybersecuritymonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aOJBtWXtXeMO1FOuk7C0hgAAAA4&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[11] https://bsky.app/profile/dustinchilds.bsky.social/post/3m25th7wv3k2p
[12] https://x.com/gothburz/status/1973518895190515784
[13] https://www.linkedin.com/posts/trend-micro_zeroday-cloud-cloud-security-hacking-competition-activity-7379280371676479488-q3bB?utm_source=share&utm_medium=member_desktop&rcm=ACoAAAX3rawBPm6RIM1LZlSs7tFoRQis8-XnEUo
[14] https://www.zerodayinitiative.com/blog/2025/7/30/pwn2own-returns-to-ireland-with-a-one-million-dollar-whatsapp-target
[15] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/cybersecuritymonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aOJBtWXtXeMO1FOuk7C0hgAAAA4&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[16] https://www.linkedin.com/feed/update/urn:li:activity:7379280371676479488?commentUrn=urn%3Ali%3Acomment%3A%28activity%3A7379280371676479488%2C7379865144635310080%29&dashCommentUrn=urn%3Ali%3Afsd_comment%3A%287379865144635310080%2Curn%3Ali%3Aactivity%3A7379280371676479488%29
[17] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/cybersecuritymonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aOJBtWXtXeMO1FOuk7C0hgAAAA4&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[18] https://www.theregister.com/2025/08/24/bug_bounty_advice/
[19] https://www.theregister.com/2022/12/13/pwn2own_wraps/
[20] https://www.theregister.com/2024/07/15/zdi_microsoft_vulnerability/
[21] https://www.theregister.com/2025/08/24/bug_bounty_advice/
[22] https://www.theregister.com/2025/07/26/microsoft_sharepoint_attacks_leak/
[23] https://x.com/steventseeley/status/1973539745507713253
[24] https://x.com/FuzzySec/status/1973662725105721567
[25] https://whitepapers.theregister.com/
Bad form on both their parts.
jake
The one shouldn't use without asking (didn't we all learn that sometime before we turned 5?), and the other should have been the bigger party and asked behind the scenes if they would mind awfully admitting where they stole the rules from ... Going public like that is childish.
It's good to have more competitions
david 12
.... but more competitions are of limited added value if it's just the same competition with the same rules and the same contestants.
Two Points
1. Why should PWN2OWN even care whether someone, or someones else, copy their rules, verbatim or not?! This is not a homework assignment. It is not a patent application.
2. Why (besides greed and/or ego) would any logically-thinking person submit their PII to an organisation which most-likely will store that PII on a cloud platform which the submitter either believes, or knows for a fact, to be compromised or compromisable?