HEIF Heist: one libheif image-parser bug hit OpenAI, Slack, Meta, GitHub Enterprise and more
anshulkundaje · x · 2026-09-19
Hacktron AI's "HEIF Heist" disclosure reveals the libheif image-parsing bug behind the OpenAI hack affected far more than OpenAI: Slack, Meta, GitHub Enterprise, Rails, Next.js, ImageMagick and many other apps were vulnerable — literal xkcd #234, one obscure image library beneath a huge number of apps. Affected versions and patches are documented in the team's writeup.
Related event: HEIF Heist: Image Parser Bugs Expose OpenAI, Meta, GitHub to RCE(8 posts)→
More from Safety
- North Korea stole $6.3B from Binance via fake job interview that compromised engineers — aakashgupta · 2026-11-04
- OffsecCyber dataset combines HackerOne reports and CVEs to train pentesting LLMs — AccBalanced · 2026-11-04
- Abliterated GLM-5.3 pulls off red-team exploit in 3:41 for $0.02, stock model refuses — bratton · 2026-11-04
- AI industry bet on both parties: $55M+ spent this election cycle via dual PACs — ChrisGPT · 2026-11-04
- Valid tokens, allowed actions, zero intent checks: the agent security gap nobody solves — Cytersmyz · 2026-11-04
- Princeton paper: harsher penalties can make AI auditors inspect less — Few-Decision6287 · 2026-11-04