And yet, almost always, infiltrating large organisations like this for whatever purpose (e.g. state level actors, corporate espionage, whatever) involves multip

And yet, almost always, infiltrating large organisations like this for whatever purpose (e.g. state level actors, corporate espionage, whatever) involves multiple chains of vulnerability. The type of vulnerability that the OP reported is the initial entry door, and as such, extremely valuable. Also, about “code reviews”: here’s a story from last year about how a massive refactoring of some webkit code in 2016 resurrected a massive exploit that was actually fixed in 2013, but went unnoticed. It was only discovered and patched in 2022, as it was being exploited in the wild by, among others, the NSO group. https://www.theregister.com/2022/06/21/apple-safari-zombie-exploit/ https://www.theregister.com/2022/06/21/apple-safari-zombie-e...