Malicious HEIC Images Can Trigger Remote Code Execution on WordPress Servers
Fortbridge showed authenticated WordPress HEIC uploads can exploit libheif and execute code in PHP-FPM.
64
Product
libheif
- Mentions · 7d0
- Mentions · 30d2
- All mentions20
- First seenAug 27, 2026
- Last mentioned25d ago
Timeline
20 articles · newest firstCritical libheif Vulnerability Could Enable Remote Code Execution Through WordPress Image Uploads
A critical libheif heap overflow, fixed in 1.23.3, enabled authenticated WordPress RCE via crafted HEIC uploads.
66
Re: Vulnerabilities in libheif and libde265
libheif 1.23.5 ships security fixes as the underfunded libheif and libde265 project cites 61 advisories.
46
Researchers used Claude to hack OpenAI
Researchers used Claude to chain a libheif vulnerability in Discourse with an OpenAI SSO flaw, gaining access to an internal GitHub repository.
75
Claude Opus 5 Helps Researchers Weaponize HEIF Image Flaw Into Remote Code Execution
Researchers used Claude Opus 5 to help weaponize a HEIF image processing flaw into a remote code execution exploit.
72
HEIF Heist Image Flaws Let Attackers Gain RCE Across Meta, Slack and GitHub Enterprise
Hacktron's "HEIF Heist" research shows memory-unsafe HEIF/AVIF parsers enable RCE and data leaks in Slack, Meta, GitHub Enterprise, and OpenAI.
78
HEIF Heist
Hacktron's HEIF Heist research reveals RCE and heap-leak vulnerabilities in libheif/libde265 HEIF/AVIF decoders, affecting Meta, OpenAI, GitHub Enterprise, Discourse, and Next.js.
82
Re: Vulnerabilities in libheif and libde265
Hanno Böck flags a security-relevant libheif fix (GHSA-v8qw-hwjv-44hw) rejecting oversized in-band coded image sizes, absent from release 1.23.4.
22
Claude Opus 5 Helped Researchers Take Over OpenAI Staff Accounts via Chained Flaws
Hacktron researchers used Claude Opus 5 to chain a libheif flaw and OpenAI SSO weakness, taking over staff ChatGPT and Codex accounts; OpenAI paid $6,500.
62
Vulnerabilities in libheif and libde265
Multiple new security advisories affect the libheif and libde265 codecs; users should verify versions against the published fixes.
52
Virginia governor creates an AI task force and moves to restrain data centers
Virginia Gov. Spanberger's Executive Order 22 creates an AI task force, bans data center NDAs, and moves to curb data center approvals.
45
Wordfence Argus Discovers Critical Vulnerability in libheif, the Library That Opens iPhone Photos on Your Server
Wordfence Argus disclosed a critical CVSS 9.8 flaw in libheif enabling protected-file disclosure and code execution on vulnerable server deployments.
58
Security researchers used Anthropic's Claude to hack OpenAI's internal systems in under 72 hours
Hacktron researchers used Claude Opus 5 to exploit libheif and an SSO flaw, taking over OpenAI employee ChatGPT and Codex accounts within 72 hours.
76
Researchers use AI to find widespread software decoder flaw
Hacktron researchers, aided by Claude and GPT-5.6 Sol, disclosed HEIF Heist, memory-corruption flaws in libheif/libde265 enabling RCE against major platforms.
78
Researchers used Claude to hack OpenAI employees' ChatGPT accounts
Researchers chained a libheif heap overflow with an SSO misconfiguration to take over OpenAI employee ChatGPT accounts, earning a $6,500 bounty.
75
AI-Built Exploit and Sign-In Flaw Opened Path to Internal OpenAI Code
Researchers chained a libheif RCE in Discourse with an over-privileged OpenAI forum sign-in token flaw to take over ChatGPT and Codex accounts.
72
Researchers Use Claude Opus 5 to Hack OpenAI Forum and Reach Internal Repositories
Researchers used Claude Opus 5 to build a libheif exploit that compromised OpenAI's forum, hijacked employee ChatGPT/Codex accounts, and reached the internal monorepo.
70
A heap overflow and SSO misconfiguration to compromise OpenAI internal repos
Hacktron researchers chained a libheif heap overflow in Discourse with an OpenAI SSO flaw to take over employee ChatGPT/Codex accounts and access internal repositories.
78
USN-8774-1: libheif vulnerabilities
Ubuntu patches libheif image-parsing flaws allowing denial of service or arbitrary code execution (CVE-2026-62291, CVE-2026-62377).
28
Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE
Vercel patches two critical Next.js unauthenticated RCE flaws: a libheif AVIF heap overflow (CVSS 9.5) and a Windows path traversal (CVE-2026-75604).
68
Related CVEs
by mentions- CVE-2026-19118<1%7.7Race Condition RCE in GitHub Enterprise Server
- CVE-2026-32882<1%7.1libheif is a HEIF and AVIF file format decoder and encoder
- CVE-2026-756042%9.0Unauthenticated RCE in Next.js on Windows-hosted servers
- CVE-2026-62291<1%5.3Heap out-of-bounds write/read in libheif image sequence decode and re-encode (≤ 1.23.0)
- CVE-2026-62377<1%4.3Reachable assertion / empty-map crash (DoS) in libheif HEIF sequence handling
Appears with
- Hacktronorganization · 12
- OpenAIvendor · 9
- Discoursevendor · 9
- OpenAIvictim · 9
- Claude Opus 5ai model · 8
- ChatGPTproduct · 8
- Codexproduct · 7
- ImageMagickproduct · 7
- Anthropicvendor · 7
- libde265product · 7
- OpenAIorganization · 6
- Claude Opus 4.8ai model · 6
- Claude Opus 5product · 6
- Discourseproduct · 5
- Claude Opus 4.8product · 5
- Discourseorganization · 5
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.