Security1 hOctober 10, 2026, 05:25

Hackers gained access to OpenAI's repo via libheif flaw and SSO misconfiguration

Hacktron chained a heap buffer overflow in libheif with an SSO misconfiguration to gain access to OpenAI's internal monorepo within 72 hours, opening a PR via an employee's Codex. OpenAI paid a $6,500 bounty and fixed the issue in about 14 hours.

DEV Community

Open source

Hackers gained access to OpenAI's repo via libheif flaw and SSO misconfiguration

libheif 1.19.7 flaw in Discourse enabled RCE via HEIC image uploads
OpenAI SSO misconfiguration allowed takeover of ChatGPT and Codex accounts of forum members
Claude Opus 5 produced a working ARM64 exploit in three hours, then ported it to x86-64
OpenAI paid $6,500 via Bugcrowd; Discourse issued advisory GHSA-vhm9-85gw-x335

#OpenAI#Discourse#Libheif#Anthropic

Hackers spoof US HR platforms with fake desktop apps to gain remote access

Security

FBI: China-Linked Hackers Ran Portal Giving Access to Stolen Emails

Security

Chinese hacker-for-hire ZRON sells stolen foreign intelligence, uses AI for police access

Software

Hackers gained access to OpenAI's repo via libheif flaw and SSO misconfiguration

Hackers spoof US HR platforms with fake desktop apps to gain remote access

FBI: China-Linked Hackers Ran Portal Giving Access to Stolen Emails

Chinese hacker-for-hire ZRON sells stolen foreign intelligence, uses AI for police access

Googlebooks gain Quick Access file transfer and Files AI descriptions