The Frontier · Tags
#discourse
4 published articles
Field notes: rebuild Discourse after the HEIF advisory
Defensive checklist for self-hosters from GHSA-vhm9-85gw-x335 and Hacktron's patch notice. No exploit content.
Record: Discourse GHSA-vhm9-85gw-x335 (HEIF RCE)
Advisory card for the Discourse image-upload RCE that sat under Hacktron's OpenAI forum chain. Rebuild guidance included.
Hacktron's OpenAI bounty: Discourse RCE met an SSO bridge
A July chain on community.openai.com reached ChatGPT and Codex. OpenAI paid $6,500 for the identity finding. Discourse's HEIF advisory tells self-hosters to rebuild.
Forum to SSO to Codex: where OpenAI's identity boundary broke
Hacktron's July 2026 chain turned a Discourse image-upload bug into ChatGPT and Codex session access. The advisory and the bounty note separate the forum RCE from the SSO finding.