Sony pays a researcher $50,000 for a critical PlayStation flaw

Security researcher Jordy (2tonejordy on HackerOne) confirmed on X that he received $50,000 from Sony, the maximum reward under the PlayStation bug bounty program, for discovering a critical vulnerability. Sony and the researcher haven't disclosed any technical details about the flaw itself, for security reasons. According to HackerOne's payout history, this is only the second time in three years a researcher has received this top-tier amount.

A payout following the PS5 hypervisor controversy

Jordy had already been in the spotlight since September 2026 over an issue tied to a PS5 hypervisor vulnerability, which Andy "TheFlow" Nguyen had used to run Linux on the console. Nguyen had asked several people to delay disclosing that flaw until GTA 6's release, to extend the window for Linux support. Jordy says he reported the flaw to Sony out of concern that someone else, who had found the same bug independently, might claim the bounty instead. The articles reviewed don't confirm whether this is the same flaw that earned the $50,000, or a separate discovery. Following the disclosure, Nguyen announced he was stepping away from PS5 development and his Linux work.

How Sony's program works

Sony opened its bug bounty program to the public in June 2020, after first working privately with researchers. It covers PS4 and PS5 consoles as well as PlayStation Network-related services, with rewards varying by severity: low-severity PSN flaws pay roughly $100 to $3,000, while the maximum $50,000 tier is reserved for issues deemed critical on the hardware and system software.

"At least buy GTA 6"

On X, Jordy joked about what he plans to do with the money: enough to "at least buy GTA 6." A PlayStation Store-focused account commented that the payout suggests "something huge" was fixed, though that hasn't been confirmed by Sony.

Sources

• Dexerto: PlayStation pays user $50,000 bounty for reporting critical exploit
• dev.ua: PlayStation paid a researcher $50,000 for finding a critical vulnerability

The bottom line

Sony paid out the maximum reward under its HackerOne program, $50,000, to a researcher for a critical PlayStation flaw, without revealing its exact nature. The story follows in the wake of the PS5 hypervisor Linux-hacking controversy, though it isn't certain whether it's the same vulnerability.