LiveOverflow https://tube.ekaii.fr/c/liveoverflow/videos Fri, 02 Oct 2026 23:36:29 GMT https://validator.w3.org/feed/docs/rss2.html PeerTube - https://tube.ekaii.fr LiveOverflow https://tube.ekaii.fr/client/assets/images/icons/icon-1500x1500.png https://tube.ekaii.fr/c/liveoverflow/videos All rights reserved, unless otherwise specified in the terms specified at https://tube.ekaii.fr/about and potential licenses granted by each content's rightholder. https://tube.ekaii.fr/feeds/podcast/videos.xml?videoChannelId=24 <![CDATA[OpenAI Hacked with a 1-Year-Old Bug]]> https://tube.ekaii.fr/w/8L9f52UtG85nuFkeCsRuRP https://tube.ekaii.fr/w/8L9f52UtG85nuFkeCsRuRP Fri, 02 Oct 2026 15:25:23 GMT How could OpenAI be hacked with a vulnerability that had already been fixed for a year? Follow the dependency chain from Discourse through ImageMagick, libheif, and Debian to see why security fixes can take so long to reach the applications that depend on them.

SPONSOR
This video is sponsored by Hextree.io, our cybersecurity learning platform.

LEARN ON HEXTREE (ad)
Learn hacking on Hextree: https://www.hextree.io/
Join the Hextree Discord: https://discord.gg/xgQpCQCpvy

RESOURCES
Previous video, How OpenAI got hacked with an image: https://www.youtube.com/watch?v=gjHh9g7yo9Y
Harsh on X: https://x.com/rootxharsh
xkcd, Dependency: https://xkcd.com/2347/

CHAPTERS
00:00 - Identify Research Target
03:04 - Checking the Installed libheif Version
04:49 - Why the Fix Took So Long to Reach OpenAI
08:07 - How Discourse Inherited an Outdated libheif
09:03 - Pinning and Maintaining Security-Critical Dependencies

SUPPORT
Per video: https://www.patreon.com/join/liveoverflow
Per month: https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/join
Buy my handwriting font (ad): https://shop.liveoverflow.com/

WATCH, FOLLOW & READ
Second channel: https://www.youtube.com/LiveUnderflow
Twitch: https://twitch.tv/LiveOverflow/
Twitter: https://twitter.com/LiveOverflow/
Instagram: https://instagram.com/LiveOverflow/
TikTok: https://www.tiktok.com/@liveoverflow_
LiveOverflow blog: https://liveoverflow.com/
Hextree blog (ad): https://www.hextree.io/blog

#SupplyChain #ApplicationSecurity #LiveOverflow

(ad) LiveOverflow YouTube channel is supported by advertisement and product placement.

]]> LiveOverflow Education nonadult OpenAI Hacked with a 1-Year-Old Bug How could OpenAI be hacked with a vulnerability that had already been fixed for a year? Follow the dependency chain from Discourse through ImageMagick, libheif, and Debian to see why security fixes can take so long to reach the applications that d... <![CDATA[OpenAI has shifted threat models #shorts]]> https://tube.ekaii.fr/w/9H24HL9oJ4XzmM7fcDNtSX https://tube.ekaii.fr/w/9H24HL9oJ4XzmM7fcDNtSX Fri, 02 Oct 2026 10:20:17 GMT Securing organizations is complex, and oversimplification is dangerous. But we can't ignore that AI has shifted threat modedls.

🔗 Watch the full video: https://youtu.be/gjHh9g7yo9Y

#Cybersecurity #ThreatModeling

]]> LiveOverflow Education nonadult OpenAI has shifted threat models #shorts Securing organizations is complex, and oversimplification is dangerous. But we can't ignore that AI has shifted threat modedls. 🔗 Watch the full video: https://youtu.be/gjHh9g7yo9Y #Cybersecurity #ThreatModeling <![CDATA[Finding a vulnerability in libheif #shorts]]> https://tube.ekaii.fr/w/1ufP43drGMbLQyckqHmCg6 https://tube.ekaii.fr/w/1ufP43drGMbLQyckqHmCg6 Thu, 01 Oct 2026 00:00:00 GMT Harsh found a vulnerability in how Discourse handles HEIF images. They rely on older libraries like ImageMagick and libheif, which can be exploited to upload malicious files. We don't even need a zero-day; the outdated libheif version is enough.

🔗 Watch the full video: https://youtu.be/gjHh9g7yo9Y

#Cybersecurity #securityresearch

]]> LiveOverflow Education nonadult Finding a vulnerability in libheif #shorts Harsh found a vulnerability in how Discourse handles HEIF images. They rely on older libraries like ImageMagick and libheif, which can be exploited to upload malicious files. We don't even need a zero-day; the outdated libheif version is enough. ... <![CDATA[Why Old Threat Models Are Dead #shorts]]> https://tube.ekaii.fr/w/3su5fYb7gScnDNMQciDGYq https://tube.ekaii.fr/w/3su5fYb7gScnDNMQciDGYq Wed, 30 Sep 2026 00:00:00 GMT Threat models need to be redefined. AI has completely shifted the exploitation economics.

🔗 Watch the full video: https://youtu.be/gjHh9g7yo9Y

#Cybersecurity #ThreatModeling

]]> LiveOverflow Education nonadult Why Old Threat Models Are Dead #shorts Threat models need to be redefined. AI has completely shifted the exploitation economics. 🔗 Watch the full video: https://youtu.be/gjHh9g7yo9Y #Cybersecurity #ThreatModeling <![CDATA[Using Claude 5 to write an exploit against Discourse #shorts]]> https://tube.ekaii.fr/w/rQZNyr1uqUsCY3ZmfQrRjD https://tube.ekaii.fr/w/rQZNyr1uqUsCY3ZmfQrRjD Tue, 29 Sep 2026 00:00:00 GMT Using Claude 5 to write an exploit against Discourse to hack into OpenAI's community forum

🔗 Watch the full video: https://youtu.be/gjHh9g7yo9Y

#OpenAI #Claude #Codex

]]> LiveOverflow Education nonadult Using Claude 5 to write an exploit against Discourse #shorts Using Claude 5 to write an exploit against Discourse to hack into OpenAI's community forum 🔗 Watch the full video: https://youtu.be/gjHh9g7yo9Y #OpenAI #Claude #Codex <![CDATA[Gaining access to OpenAI's monorepo through ChatGPT #short]]> https://tube.ekaii.fr/w/uLP4L64vXpD6WJpywgmWNL https://tube.ekaii.fr/w/uLP4L64vXpD6WJpywgmWNL Sun, 27 Sep 2026 00:00:00 GMT Remote code execution on the OpenAI community forum allowed them to access OAuth and potentially take over any ChatGPT account logged in.

🔗 Watch the full video: https://youtu.be/gjHh9g7yo9Y

#OpenAI #bugbounty

]]> LiveOverflow Education nonadult Gaining access to OpenAI's monorepo through ChatGPT #short Remote code execution on the OpenAI community forum allowed them to access OAuth and potentially take over any ChatGPT account logged in. 🔗 Watch the full video: https://youtu.be/gjHh9g7yo9Y #OpenAI #bugbounty <![CDATA[OpenAI paid $6,500 for this bug! #shorts]]> https://tube.ekaii.fr/w/bsDrpefQN3M54nLG41tJY1 https://tube.ekaii.fr/w/bsDrpefQN3M54nLG41tJY1 Sun, 27 Sep 2026 00:00:00 GMT Hacktron hacked OpenAI and was paid $6,500 for escalating from Discourse to ChatGPT. Turns out discourse was out of scope, so no bounty for the initial exploit.

🔗 Watch the full video: https://youtu.be/gjHh9g7yo9Y

#OpenAI #BugBounty

]]> LiveOverflow Education nonadult OpenAI paid $6,500 for this bug! #shorts Hacktron hacked OpenAI and was paid $6,500 for escalating from Discourse to ChatGPT. Turns out discourse was out of scope, so no bounty for the initial exploit. 🔗 Watch the full video: https://youtu.be/gjHh9g7yo9Y #OpenAI #BugBounty <![CDATA[Hacking OpenAI shortly after the Hugging Face incident.]]> https://tube.ekaii.fr/w/vDRfNCYSbvrq45NFiJRdo2 https://tube.ekaii.fr/w/vDRfNCYSbvrq45NFiJRdo2 Sat, 26 Sep 2026 00:00:00 GMT Mohan and Harsh immediatly reported the vulnerability to OpenAI, likely causing internal panic shortly after the Hugging Face hack.

🔗 Watch the full video: https://youtu.be/gjHh9g7yo9Y

#bugbounty #OpenAI

]]> LiveOverflow Education nonadult Hacking OpenAI shortly after the Hugging Face incident. Mohan and Harsh immediatly reported the vulnerability to OpenAI, likely causing internal panic shortly after the Hugging Face hack. 🔗 Watch the full video: https://youtu.be/gjHh9g7yo9Y #bugbounty #OpenAI <![CDATA[OpenAI and Slack got hacked with the same vulnerability! #short]]> https://tube.ekaii.fr/w/r1fiSftsJQZ2J6KADXNja7 https://tube.ekaii.fr/w/r1fiSftsJQZ2J6KADXNja7 Fri, 25 Sep 2026 00:00:00 GMT The same vulnerability was used to hack into OpenAI, Slack and many more.

🔗 Watch the full video: https://youtu.be/gjHh9g7yo9Y

#Cybersecurity #OpenAI

]]> LiveOverflow Education nonadult OpenAI and Slack got hacked with the same vulnerability! #short The same vulnerability was used to hack into OpenAI, Slack and many more. 🔗 Watch the full video: https://youtu.be/gjHh9g7yo9Y #Cybersecurity #OpenAI <![CDATA[They Hacked OpenAI! #shorts]]> https://tube.ekaii.fr/w/bvnR7NnBnRj8zfBpLozvw8 https://tube.ekaii.fr/w/bvnR7NnBnRj8zfBpLozvw8 Thu, 24 Sep 2026 00:00:00 GMT Harsh and S1r1u5_ successfully infiltrated OpenAI and got access to their monorepo. To prove it, they submitted a pull request with a message.

🔗 Watch the full video: https://youtu.be/gjHh9g7yo9Y

#OpenAI #Cybersecurity #Hacking

]]> LiveOverflow Education nonadult They Hacked OpenAI! #shorts Harsh and S1r1u5_ successfully infiltrated OpenAI and got access to their monorepo. To prove it, they submitted a pull request with a message. 🔗 Watch the full video: https://youtu.be/gjHh9g7yo9Y #OpenAI #Cybersecurity #Hacking <![CDATA[How OpenAI got hacked with an image]]> https://tube.ekaii.fr/w/iSDorvkoWWbDRqXnLYt3d4 https://tube.ekaii.fr/w/iSDorvkoWWbDRqXnLYt3d4 Fri, 18 Sep 2026 00:00:00 GMT Two guys hacked OpenAI with a malicious HEIF image. They turned a one year old libheif heap overflow into a remote code execution on OpenAI's Discourse forum, took over an employee's ChatGPT account, and left a message in the internal monorepo. This story shows how AI changes the economics of exploit development and why security through complexity doesn't work anymore.

LEARN ON HEXTREE (ad)
Learn hacking on Hextree: https://www.hextree.io/
Learn more about AI on Hextree: https://app.hextree.io/map/artificial-intelligence
Join the Hextree Discord: https://discord.gg/xgQpCQCpvy

IMPORTANT FOR SELF-HOSTED DISCOURSE
Rebuild your Discourse installation to pull the current image-processing dependencies. Updating only through the web interface may not replace an older Libheif package.

RESOURCES
Hacktron research: https://www.hacktron.ai/blog
Harsh on X: https://x.com/rootxharsh
Mohan on X: https://x.com/S1r1u5_

CHAPTERS
00:00 - Introduction
01:37 - Chapter 1: Vulnerability Research
05:39 - Chapter 2: The Vulnerability in Libheif
08:49 - Chapter 3: Hacking into OpenAI
11:32 - Chapter 4: Disclosure
13:17 - Chapter 5: Hack the Planet
17:19 - Outro

SUPPORT
Per video: https://www.patreon.com/join/liveoverflow
Per month: https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/join
Buy my handwriting font (ad): https://shop.liveoverflow.com/

WATCH, FOLLOW & READ
Second channel: https://www.youtube.com/LiveUnderflow
Twitch: https://twitch.tv/LiveOverflow/
Twitter: https://twitter.com/LiveOverflow/
Instagram: https://instagram.com/LiveOverflow/
TikTok: https://www.tiktok.com/@liveoverflow_
LiveOverflow blog: https://liveoverflow.com/
Hextree blog (ad): https://www.hextree.io/blog

#OpenAI #ChatGPT #LiveOverflow

(ad) LiveOverflow YouTube channel is supported by advertisement and product placement.

]]> LiveOverflow Education nonadult How OpenAI got hacked with an image Two guys hacked OpenAI with a malicious HEIF image. They turned a one year old libheif heap overflow into a remote code execution on OpenAI's Discourse forum, took over an employee's ChatGPT account, and left a message in the internal monorepo. Th... <![CDATA[Discourse Vulnerability: Urgent Warning for Self-Hosters! #shorts]]> https://tube.ekaii.fr/w/fuQ566xaUDeJ4eV9c3ebY3 https://tube.ekaii.fr/w/fuQ566xaUDeJ4eV9c3ebY3 Fri, 18 Sep 2026 00:00:00 GMT PSA: If you self-host Discourse. For standard Docker installs, run 'rebuild app'. But if you run it directly, like on Debian, make sure to at least update libhive. We had to rebuild our installation. #Discourse #SecurityUpdate #WebSecurity #ServerAdmin

]]> LiveOverflow Education nonadult Discourse Vulnerability: Urgent Warning for Self-Hosters! #shorts PSA: If you self-host Discourse. For standard Docker installs, run 'rebuild app'. But if you run it directly, like on Debian, make sure to at least update libhive. We had to rebuild our installation. #Discourse #SecurityUpdate #WebSecurity #Server... <![CDATA[Our Booth at DEF CON! #shorts]]> https://tube.ekaii.fr/w/iCx31CG9jHq7NcY2QRWJ5Q https://tube.ekaii.fr/w/iCx31CG9jHq7NcY2QRWJ5Q Mon, 14 Sep 2026 00:00:00 GMT We're at DEF CON in the Embedded Systems Village. Come visit us and learn more about fault injection! #DEFCON

]]> LiveOverflow Education nonadult Our Booth at DEF CON! #shorts We're at DEF CON in the Embedded Systems Village. Come visit us and learn more about fault injection! #DEFCON <![CDATA[Met Cosmodium Cybersecurity at DEF CON! #shorts]]> https://tube.ekaii.fr/w/hRtzvQTSSxBqXHTiwUuP3R https://tube.ekaii.fr/w/hRtzvQTSSxBqXHTiwUuP3R Sun, 13 Sep 2026 00:00:00 GMT Met Cosmo from Cosmo Cybersecurity at our booth! Definitely check him out. #Cybersecurity #DEFCON #CosmoCybersecurity

]]> LiveOverflow Education nonadult Met Cosmodium Cybersecurity at DEF CON! #shorts Met Cosmo from Cosmo Cybersecurity at our booth! Definitely check him out. #Cybersecurity #DEFCON #CosmoCybersecurity <![CDATA[Meeting Laurie Wired at Black Hat #shorts]]> https://tube.ekaii.fr/w/aeyXyTcpmhwo6LWpYx49e6 https://tube.ekaii.fr/w/aeyXyTcpmhwo6LWpYx49e6 Sat, 12 Sep 2026 00:00:00 GMT Laurie Wired came by our hextree.io booth! #DEFCON #HardwareHacking #ReverseEngineering

]]> LiveOverflow Education nonadult Meeting Laurie Wired at Black Hat #shorts Laurie Wired came by our hextree.io booth! #DEFCON #HardwareHacking #ReverseEngineering <![CDATA[Google Bug Hunter Event at Caesars Palace! 🕵️‍♂️ #shorts]]> https://tube.ekaii.fr/w/6BauBm8Zx37D4Jk9ZwTrFt https://tube.ekaii.fr/w/6BauBm8Zx37D4Jk9ZwTrFt Fri, 11 Sep 2026 00:00:00 GMT I attended Google's bug hunter event, 0x0G. While I usually enjoy these, this year's format had closed sessions and limited hanging out. #BugHunter #GoogleEvents #DEFCON #BlackHat

]]> LiveOverflow Education nonadult Google Bug Hunter Event at Caesars Palace! 🕵️‍♂️ #shorts I attended Google's bug hunter event, 0x0G. While I usually enjoy these, this year's format had closed sessions and limited hanging out. #BugHunter #GoogleEvents #DEFCON #BlackHat <![CDATA[Exhausted But Thrilled: Teaching Fault Injection at DEF CON! #shorts]]> https://tube.ekaii.fr/w/9nK9Y9t5BCSj2LLv5uLtED https://tube.ekaii.fr/w/9nK9Y9t5BCSj2LLv5uLtED Thu, 10 Sep 2026 00:00:00 GMT We had a very busy and successful trip teaching many people about fault injection. Seeing everyone engage with our lab made the hassle completely worth it. Thank you to everyone who stopped by! #Cybersecurity #FaultInjection #TechEducation #Infosec

]]> LiveOverflow Education nonadult Exhausted But Thrilled: Teaching Fault Injection at DEF CON! #shorts We had a very busy and successful trip teaching many people about fault injection. Seeing everyone engage with our lab made the hassle completely worth it. Thank you to everyone who stopped by! #Cybersecurity #FaultInjection #TechEducation #Infosec <![CDATA[Black Hat VIP Party! #shorts]]> https://tube.ekaii.fr/w/ukrbTic2a3MA9atTmaR9Tn https://tube.ekaii.fr/w/ukrbTic2a3MA9atTmaR9Tn Wed, 09 Sep 2026 00:00:00 GMT The Black Hat conference vendor hall is open. I saw massive crowds today, like a zombie horde, and then headed to the VIP party. #BlackHat #Cybersecurity

]]> LiveOverflow Education nonadult Black Hat VIP Party! #shorts The Black Hat conference vendor hall is open. I saw massive crowds today, like a zombie horde, and then headed to the VIP party. #BlackHat #Cybersecurity <![CDATA[Defcon Day 1! #shorts]]> https://tube.ekaii.fr/w/emWvpddEv5K39ZW1DTfbMY https://tube.ekaii.fr/w/emWvpddEv5K39ZW1DTfbMY Tue, 08 Sep 2026 00:00:00 GMT Defcon Day 1 done. We're now packing up and heading to a post-event dinner. #Defcon

]]> LiveOverflow Education nonadult Defcon Day 1! #shorts Defcon Day 1 done. We're now packing up and heading to a post-event dinner. #Defcon <![CDATA[Glitching Old Trezor Wallets! #shorts]]> https://tube.ekaii.fr/w/pJSGkAD4qWHBB9xH69ipwq https://tube.ekaii.fr/w/pJSGkAD4qWHBB9xH69ipwq Mon, 07 Sep 2026 00:00:00 GMT We use a vulnerable older Trezor model susceptible to teach how fault injection can be used to recovery the seed phrases. #HardwareWallet #Trezor #FaultInjection

]]> LiveOverflow Education nonadult Glitching Old Trezor Wallets! #shorts We use a vulnerable older Trezor model susceptible to teach how fault injection can be used to recovery the seed phrases. #HardwareWallet #Trezor #FaultInjection