The Frontier · Tags

#libheif

3 published articles

• Security · Field Notes

  Field notes: rebuild Discourse after the HEIF advisory

  Defensive checklist for self-hosters from GHSA-vhm9-85gw-x335 and Hacktron's patch notice. No exploit content.

• Security · The Record

  Record: Discourse GHSA-vhm9-85gw-x335 (HEIF RCE)

  Advisory card for the Discourse image-upload RCE that sat under Hacktron's OpenAI forum chain. Rebuild guidance included.

• Security · Investigation

  Forum to SSO to Codex: where OpenAI's identity boundary broke

  Hacktron's July 2026 chain turned a Discourse image-upload bug into ChatGPT and Codex session access. The advisory and the bounty note separate the forum RCE from the SSO finding.