Meta Expands WhatsApp Security Research with New Proxy Tool and $4M in Bounties This Year

Summary: Meta released a WhatsApp Research Proxy tool to long-time bug bounty researchers and set up a pilot inviting research teams to focus on platform abuse, saying it awarded more than $4 million this year across almost 800 valid reports out of roughly 13,000 submissions. Meta also patched CVE-2025-59489 (CVSS 8.4), a flaw that could have let malicious apps on Quest devices manipulate Unity applications into arbitrary code execution, and added anti-scraping protections to WhatsApp after a University of Vienna study enumerated accounts across 245 countries by abusing the contact discovery feature.
Bottom line: The scraping study mapped WhatsApp users worldwide, including 2.3 million registered numbers in China and 1.6 million in Myanmar where the service is officially banned, by turning a legitimate contact discovery feature into effectively unlimited requests from a single source. With about 3.5 billion active users, the same enumeration path is a ready-made target list for the state-sponsored actors and spyware vendors Meta names as the platform's attackers.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2025-59489
Related: ⚡ Weekly Recap: WhatsApp Worm, Critical CVEs, Oracle 0-Day, Ransomware Cartel & More Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026