Libheif - GoKawiil

Hacktron discloses HEIF Heist, a remote code execution flaw in HEIC/AVIF image parsers

Security researchers at Hacktron identified a class of vulnerabilities, dubbed HEIF Heist, affecting native decoders like libheif and libde265 that process HEIF, HEIC, and AVIF image formats. These libraries are widely bundled inside popular tools such as ImageMagick, libvips, and Sharp, meaning the flaw can reach production systems through indirect dependencies rather than direct use.

heif-heist.com · 2026-09-18

Researchers chained two bugs to hijack OpenAI staff ChatGPT and Codex accounts

Security researchers at HacktronAI combined a flaw in the libheif image decoder used by ImageMagick with an SSO identity issue on OpenAI's Discourse-based community forum to gain remote code execution and admin access on community.openai.com. Using that foothold, they took over multiple OpenAI employees' ChatGPT and Codex accounts and, to prove access without touching sensitive data, opened a pull request in OpenAI's internal monorepo. The whole process from discovery to internal repo access took under 72 hours.

hacktron.ai · 2026-09-18