HHVM

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Minimum award, where Meta pays a bounty at all │ $500 │ $625 Maximum: discretionary, no published ceiling for open source │ not published │ not published Submit a vulnerability CVE history 0 Last 12 months 43 Lifetime Memory safety 55 % Code execution 20 % Denial of service 15 % Info disclosure 5 % Latest advisories Loading the feed Overview HHVM is Meta's virtual machine for Hack, a just-in-time compiling runtime that grew out of the PHP world and still carries inherited Zend Engine code alongside its own: the repository ships LICENSE.PHP and LICENSE.ZEND rather than a single unified licence. It has 43 lifetime CVEs, the most of any project in Meta's open-source niche by a wide margin, and the distribution is over half memory safety with another fifth code execution, which is the shape you would expect from a JIT and an interpreter. The honest counterweight is deployment: HHVM dropped PHP support entirely to become a Hack-only VM and Wikipedia migrated off it in 2019, so the external footprint today is Meta plus a small tail, with the newest CVE dating to 2022. Treat it as a rich hunting ground with a small blast radius. Meta pays cash for a report with a published minimum of $500, determines severity itself, and publishes no payout guideline covering open source, so no maximum is stated in advance. sorona.xyz adds 1.25× on top of whatever Meta awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope Meta declares its open-source scope as GitHub organisation prefixes. The scope table's Open source row lists https://github.com/facebook/ and https://github.com/facebookincubator/ as eligible code repos, and facebook/hhvm sits under the first, so the repository is in scope in full. HHVM additionally carries its own SECURITY.md naming the same programme. The row sets no severity cap and Meta publishes no payout guideline covering open source The runtime in full: the bytecode interpreter, the JIT and its optimisation passes, and the object, array and string representations underneath both The Hack compiler front end and its parser, along with the bytecode it emits The built-in library, meaning every native function that operates on strings, arrays, collections and objects whose size and contents came from a request The inherited engine code the repository still carries under LICENSE.ZEND, alongside the HHVM-specific sources under LICENSE.PHP The server side: the built-in web server, the FastCGI and Proxygen-based server implementations, the request lifecycle and the request-isolation boundary in a long-lived process Serialization and deserialization of runtime values, the extension surface, and the async and awaitable machinery The admin interface, the debugger, and the tooling the repository ships, the type checker and its client included Out of scope Repositories outside those two prefixes. The same scope row names https://github.com/facebookarchive/ as ineligible, and neither facebookresearch/ nor the react/ org that React and React Native moved into appears on the eligible list Extremely low-risk issues, which Meta states may not qualify for a bounty at all Findings with no demonstrated impact on Meta users or systems, since that is what Meta scores a report on Duplicates. Meta pays the first reporter only Awards that sanctions screening blocks: Meta verifies every bounty is permitted under US trade sanctions and economic restrictions Behaviour differences from PHP. HHVM dropped PHP support entirely to become a Hack-only VM, so incompatibility is a design decision rather than a vulnerability Defects in an application written in Hack rather than in the runtime that executes it Third-party libraries HHVM builds against, which belong to their own projects Most-valued findings Memory corruption in the JIT or the interpreter reachable from data a request supplied, landing as native code execution in the VM process. That is the class the 55% memory-safety weighting is made of A defect in the inherited Zend-lineage engine code HHVM still carries, where the original project's fix history never reached this fork Native library functions that mishandle attacker-shaped strings or arrays, the classic route from a scripting-language surface into memory corruption Cross-request state leakage in a long-lived server process, which turns a single-request bug into an information-disclosure problem for every other tenant of that process Anything above against a current build. The forty-three CVEs on record are weighted to 2018 through 2020 and stop at CVE-2022-36937, so most of that series is already fixed and the remaining value is in newer code Weigh the blast radius before committing weeks. Wikipedia moved off HHVM in 2019 and the external footprint today is Meta plus a small tail, so an impact argument has to be about Meta's own fleet Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. File through the report form at bugbounty.meta.com; Meta asks that you not contact its staff directly or through any other channel about a report Awards are entirely at Meta's discretion and Meta determines severity: no published payout guideline covers open source, so there is no list price to argue against Do not size your effort against the $150,000 figure that circulates for Meta: it is derived from the mobile remote-code-execution guideline, which requires a proof of concept on a recent Android or a currently supported iOS version and therefore cannot be met by a server-side runtime Duplicates pay only the first reporter Meta scores a report on impact to Meta users and systems, so show the defect reaching something that matters rather than stopping at an assertion failure Awards are subject to sanctions screening; Meta verifies that every bounty is permitted under US trade sanctions and economic restrictions Disclosure Coordinated with Meta, on Meta's clock. Its terms ask for reasonable time to investigate and mitigate before you disclose publicly or share the report with others, Meta alone judges what is reasonable, and Meta reserves the right to publish reports and their updates itself. Because that clause reaches private transfer as well as publication, file with Meta directly first. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability