Critical Rails Bug Threatens to Derail Vulnerable Servers
Rails Active Storage ImageMagick integration allows arbitrary file read and write.
60
Product
ImageMagick
- Mentions · 7d1
- Mentions · 30d5
- All mentions17
- First seenAug 12, 2026
- Last mentioned4d ago
Timeline
17 articles · newest firstGhostscript flaw lets hackers hijack servers via PDF uploads
Ghostscript heap overflow CVE-2026-39919 can enable remote code execution through crafted PDF uploads, with no exploitation seen yet.
68
Wordfence Argus Discovers Critical Vulnerability in Ghostscript, the Program That Turns Uploaded PDFs into Thumbnails on Your Server
Wordfence disclosed Ghostscript CVE-2026-39919, a CVSS 9.8 flaw fixed in 10.08.0, with lab PDF remote code execution.
68
Discourse ImageMagick Vulnerability Enables Arbitrary File Read Through Malicious Image Uploads
Researchers disclosed CVE-2026-55420, letting low-privilege Discourse users read server files via ImageMagick uploads.
58
Discourse Image Pipeline Exploit Chains JPEG Race, GhostScript and ImageMagick for File Read
Searchlight Cyber showed a patched Discourse upload chain letting basic users read server files via ImageMagick.
64
Malicious HEIC Images Can Trigger Remote Code Execution on WordPress Servers
Fortbridge showed authenticated WordPress HEIC uploads can exploit libheif and execute code in PHP-FPM.
64
Critical libheif Vulnerability Could Enable Remote Code Execution Through WordPress Image Uploads
A critical libheif heap overflow, fixed in 1.23.3, enabled authenticated WordPress RCE via crafted HEIC uploads.
66
USN-8859-1: ImageMagick vulnerabilities
Ubuntu patches ImageMagick flaws that could let attackers cause denial of service or leak information.
26
USN-8810-1: ImageMagick vulnerabilities
Ubuntu patched ImageMagick flaws that could cause denial of service or code execution.
34
Claude Opus 5 Helps Researchers Weaponize HEIF Image Flaw Into Remote Code Execution
Researchers used Claude Opus 5 to help weaponize a HEIF image processing flaw into a remote code execution exploit.
72
HEIF Heist Image Flaws Let Attackers Gain RCE Across Meta, Slack and GitHub Enterprise
Hacktron's "HEIF Heist" research shows memory-unsafe HEIF/AVIF parsers enable RCE and data leaks in Slack, Meta, GitHub Enterprise, and OpenAI.
78
HEIF Heist
Hacktron's HEIF Heist research reveals RCE and heap-leak vulnerabilities in libheif/libde265 HEIF/AVIF decoders, affecting Meta, OpenAI, GitHub Enterprise, Discourse, and Next.js.
82
Claude Opus 5 Helped Researchers Take Over OpenAI Staff Accounts via Chained Flaws
Hacktron researchers used Claude Opus 5 to chain a libheif flaw and OpenAI SSO weakness, taking over staff ChatGPT and Codex accounts; OpenAI paid $6,500.
62
Researchers used Claude to hack OpenAI employees' ChatGPT accounts
Researchers chained a libheif heap overflow with an SSO misconfiguration to take over OpenAI employee ChatGPT accounts, earning a $6,500 bounty.
75
Security researchers used Claude to help them hack into OpenAI
Three Hacktron researchers used Claude Opus to breach OpenAI employee accounts through a Discourse HEIF flaw, reaching the Monorepo within 72 hours.
66
USN-8739-1: ImageMagick vulnerabilities
Canonical released USN-8739-1 fixing five ImageMagick flaws that could cause denial of service or arbitrary code execution.
25
When a PNG Isn’t a PNG: WordPress Patches an Author-Level Imagick RCE
WordPress 7.0.4 patches an author-level RCE in how uploaded media is handed to ImageMagick.
68
Related CVEs
by mentions- Heap Buffer Overflow in Ghostscript JPEG 2000 Output Path Enables RCE
- CVE-2026-55420<1%8.1Discourse: 2026.5.1, 2026.4.2, and 2026.1.5, under certain non-default configurations, processing of PDF uploads could be exploited to…
- CVE-2026-19118<1%7.7Race Condition RCE in GitHub Enterprise Server
- CVE-2026-32882<1%7.1libheif is a HEIF and AVIF file format decoder and encoder
- CVE-2026-56371<1%6.9ImageMagick before 7.1.2-15 and 6.9.13-40 contains a memory leak in coders/txt.c when processing TXT files with texture attributes
- CVE-2026-56368<1%6.3ImageMagick before 7.1.2-15 contains a memory leak vulnerability in multiple coders that write raw pixel data where allocated objects are not properly freed
- CVE-2026-56370<1%4.8ImageMagick before 7.1.2-19 contains an out-of-bounds access vulnerability in ConnectedComponentsImage() when processing connected-components artifacts with…
- CVE-2026-56366<1%4.8ImageMagick before 7.1.2-18 contains a memory leak vulnerability in the META reader when processing APP1JPEG input paths
- CVE-2026-33536<1%4.7ImageMagick is free and open-source software used for editing and manipulating digital images
- ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a use-after-free vulnerability in the ImagesToBlob method, caused by a pointer that is not updated…
Appears with
- libheifproduct · 7
- Discoursevendor · 7
- Hacktronorganization · 6
- OpenAIvendor · 5
- Discourseproduct · 5
- WordPressproduct · 5
- Claude Opus 5ai model · 4
- Anthropicvendor · 4
- Ghostscriptproduct · 4
- OpenAIvictim · 4
- Wordfenceorganization · 3
- libde265product · 3
- Claude Opus 4.8ai model · 3
- GPT-5.6 Solai model · 3
- ChatGPTproduct · 3
- Anthropicorganization · 3
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.