Apple now offers $2 million for zero-click RCE vulnerabilities

Apple unveiled a revamped bug bounty program with maximum rewards doubled to $2 million—and over $5 million with bonuses—for zero-click RCE and other high-impact findings, alongside expanded categories (e.g., wireless proximity, iCloud, WebKit) and clearer payout structures. The company will distribute secured iPhone 17 devices to high-risk civil society groups, feed its Security Research Device Program, and continue bolstering defenses like Lockdown Mode and Memory Integrity Enforcement to deter sophisticated spyware operations.