Discourse ImageMagick Vulnerability Enables Arbitrary File Read Through Malicious Image Uploads
Researchers disclosed CVE-2026-55420, letting low-privilege Discourse users read server files via ImageMagick uploads.
58
Vendor
Discourse
- Mentions · 7d0
- Mentions · 30d2
- All mentions15
- First seenSep 18, 2026
- Last mentioned28d ago
Timeline
15 articles · newest firstDiscourse Image Pipeline Exploit Chains JPEG Race, GhostScript and ImageMagick for File Read
Searchlight Cyber showed a patched Discourse upload chain letting basic users read server files via ImageMagick.
64
HEIF Heist Image Flaws Let Attackers Gain RCE Across Meta, Slack and GitHub Enterprise
Hacktron's "HEIF Heist" research shows memory-unsafe HEIF/AVIF parsers enable RCE and data leaks in Slack, Meta, GitHub Enterprise, and OpenAI.
78
HEIF Heist
Hacktron's HEIF Heist research reveals RCE and heap-leak vulnerabilities in libheif/libde265 HEIF/AVIF decoders, affecting Meta, OpenAI, GitHub Enterprise, Discourse, and Next.js.
82
AI Helps Hackers Hijack OpenAI Staff Accounts Through a Forum
Hacktron researchers used Claude Opus 5 to build a libheif exploit in hours, hijacking OpenAI staff accounts via a Discourse forum shared-SSO flaw.
72
Claude Opus 5 Helped Researchers Take Over OpenAI Staff Accounts via Chained Flaws
Hacktron researchers used Claude Opus 5 to chain a libheif flaw and OpenAI SSO weakness, taking over staff ChatGPT and Codex accounts; OpenAI paid $6,500.
62
Security researchers used Anthropic's Claude to hack OpenAI's internal systems in under 72 hours
Hacktron researchers used Claude Opus 5 to exploit libheif and an SSO flaw, taking over OpenAI employee ChatGPT and Codex accounts within 72 hours.
76
Researchers use AI to find widespread software decoder flaw
Hacktron researchers, aided by Claude and GPT-5.6 Sol, disclosed HEIF Heist, memory-corruption flaws in libheif/libde265 enabling RCE against major platforms.
78
Researchers used Claude to hack OpenAI employees' ChatGPT accounts
Researchers chained a libheif heap overflow with an SSO misconfiguration to take over OpenAI employee ChatGPT accounts, earning a $6,500 bounty.
75
Security researchers used Claude to help them hack into OpenAI
Three Hacktron researchers used Claude Opus to breach OpenAI employee accounts through a Discourse HEIF flaw, reaching the Monorepo within 72 hours.
66
Researchers used Anthropic’s Claude to hack into OpenAI
Researchers used Claude Opus 5 to chain libheif and Discourse flaws, hijacking OpenAI employee ChatGPT and Codex accounts via bug bounty.
70
Researchers used Claude to hack OpenAI
Researchers exploited a Discourse misconfiguration on OpenAI's community forum to reach internal sign-ons and an employee ChatGPT account with GitHub code access; OpenAI fixed it.
66
AI-Built Exploit and Sign-In Flaw Opened Path to Internal OpenAI Code
Researchers chained a libheif RCE in Discourse with an over-privileged OpenAI forum sign-in token flaw to take over ChatGPT and Codex accounts.
72
Researchers Use Claude Opus 5 to Hack OpenAI Forum and Reach Internal Repositories
Researchers used Claude Opus 5 to build a libheif exploit that compromised OpenAI's forum, hijacked employee ChatGPT/Codex accounts, and reached the internal monorepo.
70
A heap overflow and SSO misconfiguration to compromise OpenAI internal repos
Hacktron researchers chained a libheif heap overflow in Discourse with an OpenAI SSO flaw to take over employee ChatGPT/Codex accounts and access internal repositories.
78
Related CVEs
by mentions- CVE-2026-55420<1%8.1Discourse: 2026.5.1, 2026.4.2, and 2026.1.5, under certain non-default configurations, processing of PDF uploads could be exploited to…
- CVE-2026-19118<1%7.7Race Condition RCE in GitHub Enterprise Server
- CVE-2026-32882<1%7.1libheif is a HEIF and AVIF file format decoder and encoder
Appears with
- OpenAIvendor · 12
- OpenAIvictim · 12
- Hacktronorganization · 11
- Anthropicvendor · 10
- ChatGPTproduct · 10
- Claude Opus 5ai model · 10
- libheifproduct · 9
- Codexproduct · 9
- Claude Opus 4.8ai model · 9
- ImageMagickproduct · 7
- Claude Opus 5product · 6
- Claude Opus 4.8product · 5
- GPT-5.6 Solai model · 5
- OpenAIorganization · 5
- Discourseorganization · 5
- Discourseproduct · 5
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.