Yandex Doubles Top Reward For Bug Hunters To 3 Million Rubles

Posted by By Dan Taylor 2 Min Read

Yandex has raised the stakes in its “Bug Hunt” program, doubling the maximum reward for ethical hackers. Participants can now earn up to 3 million rubles for uncovering critical vulnerabilities in Yandex services.

The largest payouts apply to Remote Code Execution (RCE) vulnerabilities found in Yandex Mail and Yandex ID. These types of issues allow remote attackers to run arbitrary code, posing significant security risks.

For Yandex Cloud, the top reward of 3 million rubles is reserved for vulnerabilities related to cloud infrastructure. This includes serious threats like Virtual Machine escape, which targets the core of cloud-based virtualization systems.

The company has also increased rewards for other types of bugs across its platforms. The specific amounts depend on the severity and impact of the issue.

Yandex says the goal of raising rewards is to attract skilled independent security researchers. By doing so, the company aims to further test and confirm the strength of its systems against cyber threats.

The Bug Hunt program covers a variety of Yandex services. Details on eligible systems and corresponding rewards can be found on the official program website.

This update follows Yandex 360’s recent certification under the ISO/IEC 27001:2022 standard. That certification confirms the company’s security management meets recognized international benchmarks.

Yandex’s move to boost its bug bounty reflects a growing trend in the tech industry to rely on ethical hackers to find security flaws before attackers do.

Source: Yandex Press Release
Dan Taylor
View More Posts
Dan Taylor is the founder and editor of International Search Insights (ISI), the publication behind ReadIsi, and a Partner and Head of Innovation (Search & AI) at SALT.agency. He has worked in search for more than a decade, in-house and agency-side, and is regarded as one of the West’s leading voices on search engines beyond Google, including Yandex, Baidu, Naver and Cốc Cốc. On ReadIsi, Dan covers the engines and AI answer platforms that English-language coverage tends to miss: Baidu and ERNIE, Yandex and Alice AI, Naver, Cốc Cốc, Shenma, Sogou, WeChat and Weibo search, plus DeepSeek and Alibaba’s Qwen. He also keeps dated records of documented changes, such as the Yandex, Baidu and Naver algorithm update histories and the DeepSeek, ERNIE and Qwen model update histories. His approach is to take learnings from global search engines and apply logic with a high evidence threshold. A claim needs a source, patterns seen in one market are treated as a hypothesis until they are checked in another, and where the evidence is thin he says so. For brands, that means advice built on what can be shown, with measurement that separates being cited from being chosen. Dan is credited with coining the term “edge SEO” and won the inaugural TechSEO Boost research competition in 2018 for his work on CDN and edge changes for SEO. In 2026 he was credited with coining “Infinite Tail” to describe how keyword research is changing with AI search. He is the author of AI Search Marketing For The Travel Sector, writes for Search Engine Journal, Search Engine Land and Travel Marketing Guy, and has advised technology, SaaS, travel and enterprise ecommerce brands, including Cloudflare, GitLab and Airbnb. He has given multiple talks and panels at the International Search Summit in Barcelona, and has also spoken at Optimization Moscow, brightonSEO, Google Search Central Live Deep Dive Asia in Bangkok, Athens SEO and the Asia SEO Virtual Summit 2026, where his talk looked at how Baidu, Naver, DeepSeek, Tencent, Cốc Cốc and Yandex built their own AI answers.
Founder & Editor