kyber.today

daily cyber × ai intelligence

← threat actors

threat actor · not yet in the cluster map

hacktron

2 stories · 0 in the wild · September 19, 2026 – September 19, 2026

evidence: 1 disclosed · 1 demonstrated

sectors

  • technology 2 · Sep 19
  • ai labs 1 · Sep 19
  • developers 1 · Sep 19

techniques

  • rce 2 · Sep 19
  • account takeover 1 · Sep 19
  • heap disclosure 1 · Sep 19
  • privilege escalation 1 · Sep 19

attack phases seen

  • Execution 2 · Sep 19
  • Initial access 2 · Sep 19
  • Credential access 1 · Sep 19
  • Privilege escalation 1 · Sep 19

what we reported, newest first, grouped by story

September 19, 2026 · 2 reports

  • Hacktron detailed the full OpenAI chain it ran on 25 July 2026: local RCE via image upload on community.openai.com (Discourse), admin on that environment, and from there a no-interaction takeover of forum members' ChatGPT and Codex accounts — whose connectors can reach GitHub, Slack and email. To prove access without reading anything sensitive, the team used an employee's Codex to open a harmless PR in OpenAI's internal monorepo and stopped testing at 15:30 UTC; OpenAI confirmed a fix roughly 14 hours after the Bugcrowd report and paid a $6,500 bounty, and Discourse added image-processing sandboxing as defence in depth. Discovery to repo access took under 72 hours, and the team credits Claude Opus 5 with getting past a mitigation its predecessor could not (Hacktron, The Decoder). @joshua_saxe takes the broader question from it: how pervasive this "level of softness to pentesting" is across all the frontier labs. · Sep 19 · demonstrated · Offensive Research & Exploits
  • "HEIF Heist" generalises that bug into a class. Hacktron published a months-long investigation into native C/C++ decoders libheif and libde265, reached through ImageMagick, libvips, Sharp and distro/container base images — meaning it is language- and framework-agnostic. The site claims findings including authenticated RCE on Discourse, unauthenticated RCE in Next.js via AVIF image optimization, authenticated RCE on GitHub Enterprise (CVE-2026-19118), and heap disclosure of tokens and AWS credentials; upload endpoints can be probed with crafted .avif/.heic files to fingerprint the remote libheif version before firing a version-matched payload. Fix is libheif v1.23.2 or later plus current libde265 (HEIF Heist). Notably, Hacktron says only Shopify detected the probing, "even after thousands of images were sent and their image processors repeatedly crashed." · Sep 19 · disclosed · Offensive Research & Exploits