Discourse ImageMagick Vulnerability Enables Arbitrary File Read Through Malicious Image Uploads
Researchers disclosed CVE-2026-55420, letting low-privilege Discourse users read server files via ImageMagick uploads.
7
Stories per day · 30 days
3 RSS
13 stories, newest first · one card per story
Stories tagged #discourse
Discourse Image Pipeline Exploit Chains JPEG Race, GhostScript and ImageMagick for File Read
Searchlight Cyber showed a patched Discourse upload chain letting basic users read server files via ImageMagick.
5
Researchers used Claude to hack OpenAI
Researchers used Claude to chain a libheif vulnerability in Discourse with an OpenAI SSO flaw, gaining access to an internal GitHub repository.
2
HEIF Heist
Hacktron's HEIF Heist research reveals RCE and heap-leak vulnerabilities in libheif/libde265 HEIF/AVIF decoders, affecting Meta, OpenAI, GitHub Enterprise, Discourse, and Next.js.
AI Helps Hackers Hijack OpenAI Staff Accounts Through a Forum
Hacktron researchers used Claude Opus 5 to build a libheif exploit in hours, hijacking OpenAI staff accounts via a Discourse forum shared-SSO flaw.
3
Claude Opus 5 Helped Researchers Take Over OpenAI Staff Accounts via Chained Flaws
Hacktron researchers used Claude Opus 5 to chain a libheif flaw and OpenAI SSO weakness, taking over staff ChatGPT and Codex accounts; OpenAI paid $6,500.
2
Researchers used Claude to hack OpenAI employees' ChatGPT accounts
Researchers chained a libheif heap overflow with an SSO misconfiguration to take over OpenAI employee ChatGPT accounts, earning a $6,500 bounty.
5
Security researchers used Claude to help them hack into OpenAI
Three Hacktron researchers used Claude Opus to breach OpenAI employee accounts through a Discourse HEIF flaw, reaching the Monorepo within 72 hours.
1
Researchers used Anthropic’s Claude to hack into OpenAI
Researchers used Claude Opus 5 to chain libheif and Discourse flaws, hijacking OpenAI employee ChatGPT and Codex accounts via bug bounty.
3
Researchers used Claude to hack OpenAI
Researchers exploited a Discourse misconfiguration on OpenAI's community forum to reach internal sign-ons and an employee ChatGPT account with GitHub code access; OpenAI fixed it.
AI-Built Exploit and Sign-In Flaw Opened Path to Internal OpenAI Code
Researchers chained a libheif RCE in Discourse with an over-privileged OpenAI forum sign-in token flaw to take over ChatGPT and Codex accounts.
3
Researchers Use Claude Opus 5 to Hack OpenAI Forum and Reach Internal Repositories
Researchers used Claude Opus 5 to build a libheif exploit that compromised OpenAI's forum, hijacked employee ChatGPT/Codex accounts, and reached the internal monorepo.
4
A heap overflow and SSO misconfiguration to compromise OpenAI internal repos
Hacktron researchers chained a libheif heap overflow in Discourse with an OpenAI SSO flaw to take over employee ChatGPT/Codex accounts and access internal repositories.
3