Update: Facebook awards $50K Internet Defense Prize for Work on Securing Web Apps

Facebook awarded two researchers a $50,000 Internet Defense Prize for a static analysis method that detects "second-order" web application vulnerabilities. The tool audits tainted writes to persistent stores and, when applied to six PHP applications (including OpenConf, HotCRP, osCommerce), the authors reported 159 previously unknown second-order vulnerabilities, including remote code execution in some apps; the article frames this as defensive research rather than an active attack.