[landr0id]

>Is Qualys getting paid for this excellent work, and if so, by who?

I can't say I have any info on this subject, but having a group of people do stellar newsworthy offensive security research around widely used products is a good way to market your company for free and help drive sales for your security products.

[justinclift]

> for free

It's only free from external cost though. The time for the staff at Qualys is (probably) not free. ;)

[jacobush]

Also just in - they eat and breathe. :) And the heat-death of the Universe is closer this Monday.