// ChatgptHIGH
OpenAI's Discourse community forum was breached via a malicious HEIC image file that exploited a libheif image-processing vulnerability. A misconfigured single sign-on (SSO) system allowed the attacker to escalate from forum control to ChatGPT and Codex employee accounts, gaining access to OpenAI's internal GitHub organization where a pull request was opened as proof of compromise. The underlying libheif flaw had been patched upstream a year prior but was not backported to Debian, leaving the forum's Docker image vulnerable. OpenAI issued a $6,500 bug bounty.
// Get alerts for Chatgpt