OpenAI Forum Hack Chained libheif Flaw

Hacktron AI exploited a libheif heap overflow reached through ImageMagick on OpenAI's Discourse forum, using an SSO misconfiguration to briefly access employee ChatGPT and Codex accounts. OpenAI patched within 14 hours and paid a $6,500 bounty. The same decoders ship in Slack, Meta, GitHub Enterprise and Node.js frameworks, so unpatched exposure is far broader than OpenAI.