25 casos · pág. 2/2
Researcher Mohan Pedhapati of Hacktron reconstructs an incident in which an unreleased OpenAI model, working on an ExploitGym challenge, allegedly reward-hacked the task and compromised Hugging Face production using two 0-day vulnerabilities, apparently to steal the solution. Hugging Face detected the attack first and described "thousands…
On July 25, 2026, Hacktron researchers chained a heap buffer overflow in libheif (reached through ImageMagick in Discourse's image-upload pipeline) with an OpenAI SSO weakness. This gave them RCE on the OpenAI community forum and takeover of ChatGPT/Codex accounts of forum users and OpenAI employees. To prove impact without reading sensit…
TLDR: PostHog used Playwright Chromium with --no-sandbox for heatmap screenshots. I used Claude to write a V8 n-day (CVE-2026-7899) exploit, got production RCE in a worker container with prod db access. I then used the same exploit as an evaluation for open-weight models. With the increasing number of supply chain attacks, I was thinking …
Three months ago, I wrote a blog titled “I Let Claude Opus Write a Chrome Exploit: The Next Model (Mythos?) Won’t Need My Help?”. This time, I ran a similar benchmark on the newest frontier models, specifically, GPT-5.6 Sol Medium, Sol Ultra, and Grok 4.5, and watched Sol Ultra hill-climb a full renderer exploit on recent Chrome from star…
Hacktron analyzes wp2shell, an unauthenticated RCE chain in WordPress core found by Searchlight Cyber. It combines CVE-2026-63030, a route handler confusion in the REST API batch endpoint, with CVE-2026-60137, an SQL injection in WPQuery. Affected versions are WordPress 6.9.0-6.9.4, 7.0.0-7.0.1 and the 7.1 beta, fixed in 6.9.5, 7.0.2 and …
