As we reported recently, Robert Kugler, a 17-year-old student, who wanted to report a flaw in Paypal but was not allowed to report it via the Bug Bounty Program, due to his age, was acknowledged by Paypal in the form of offering to send the young researcher a "Letter of recognition" for his investigation. Paypal sent Kugler an email in which the company said: "the vulnerability you submitted was previously reported by another researcher", which suggests that the company knew of the problem for more than two weeks before moving to fix the issue.

On Wednesday night, payment processor PayPal closed the security hole in its portal that had been publicly known for five days. The hole was a critical one: it allowed attackers to inject arbitrary JavaScript code into the PayPal site, potentially enabling them to harvest users' access credentials.

When PayPal didn't allow Kugler to participate in the program because he wasn't yet 18, the student released the details of his discovery on the Full Disclosure security mailing list, but only after giving PayPal a week's period of grace, which the company allowed to pass.