{"uuid": "f7ac7cac-79e9-4a91-a49f-363ff34273f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-vhm9-85gw-x335", "type": "seen", "source": "https://gist.github.com/jenaiho/800f787ae49ae9f3337a2b9f27171994", "content": "# OpenAI \u88ab\u5165\u4fb5\u4e8b\u4ef6\u6838\u67e5\uff1a\u4e00\u5f35 HEIC \u5716\u7247\u5982\u4f55\u8d70\u9032\u5167\u90e8\u4ee3\u78bc\u5eab\n> \u4f86\u6e90\uff1a[YouTube](https://youtu.be/iQGLI14p88Q) | Wes Roth | 15:07 | 2026-09-19\n> **\u5f15\u6587\u8aaa\u660e**\uff1a\u51e1\u9644\u3014MM:SS\u3015\u6642\u9593\u6233\u8005\uff0c\u5747\u70ba\u9010\u5b57\u7a3f\u539f\u6587\uff08\u5f71\u7247\u82f1\u6587\u81ea\u52d5\u5b57\u5e55\uff0c\u7d93\u8a5e\u7d1a\u91cd\u758a\u53bb\u91cd\u91cd\u5efa\uff0c\u4eba\u540d\u8207\u8853\u8a9e\u6216\u6709\u97f3\u8aa4\uff09\uff1b\u672a\u9644\u6642\u9593\u6233\u800c\u7f6e\u65bc\u300c\u300d\u5167\u8005\uff0c\u5c6c\u7de8\u8005\u6982\u62ec\u8a9e\uff0c\u6216\u672c\u6587\u6838\u67e5\u6240\u5f15\u4e00\u624b\u5831\u544a\uff0f\u5a92\u9ad4\u5831\u5c0e\u4e4b\u63aa\u8fad\uff0c\u975e\u5f71\u7247\u539f\u8a71\u3002\n\n## \u6838\u5fc3\u89c0\u9ede\n\n\u5b89\u5168\u7814\u7a76\u516c\u53f8 Hacktron AI \u62ab\u9732\u7684\u300cHEIF Heist\u300d\u4e8b\u4ef6\u986f\u793a\uff0c\u4eba\u5de5\u667a\u80fd\u4ee3\u7406\u628a\u591a\u500b\u539f\u672c\u4e0d\u76f8\u9023\u7684\u908a\u969b\u98a8\u96aa\u4e32\u6210\u5b8c\u6574\u653b\u64ca\u93c8\uff0c\u4ee4 OpenAI \u53ca\u591a\u5bb6\u5927\u578b\u8edf\u4ef6\u7528\u6236\u56e0\u70ba\u4e00\u500b\u672a\u7372 CVE \u6a19\u8a18\u7684 libheif \u4fee\u88dc\u7f3a\u53e3\uff0c\u66b4\u9732\u65bc\u5e33\u6236\u63a5\u7ba1\u8207\u5167\u90e8\u4ee3\u78bc\u5eab\u5b58\u53d6\u98a8\u96aa\u3002\n\n## \u5167\u5bb9\u5927\u7db1\n\n1. Hacktron AI \u4e09\u540d\u7814\u7a76\u8005\u4ee5 Claude Opus 4.8 \u53ca Claude Opus 5 \u7d93 Discourse \u8ad6\u58c7\u653b\u5165 OpenAI\uff0c\u7531\u6700\u521d\u767c\u73fe\u5230\u53d6\u5f97\u5167\u90e8 repo \u5b58\u53d6\u5c11\u65bc 72 \u5c0f\u6642\u3002\n2. \u653b\u64ca\u5165\u53e3\u662f HEIC\uff0fHEIF \u5716\u7247\u4e0a\u50b3\uff1aFastImage \u4e0d\u652f\u63f4 HEIF\uff0c\u5716\u7247\u88ab\u8f49\u4ea4 ImageMagick \u8abf\u7528 libheif \u89e3\u6790\u5668\u8655\u7406\u3002\n3. libheif \u89e3\u78bc\u5668\u7684\u5806\u7de9\u885d\u5340\u6ea2\u4f4d\u6f0f\u6d1e\uff0c\u56e0\u4e0a\u6e38\u4fee\u88dc\u672a\u88ab\u6a19\u8a18\u70ba\u5b89\u5168\u4fee\u88dc\u3001\u4ea6\u7121 CVE\uff0cDebian \u672a\u6709\u53ca\u6642 back-port\u3002\n4. Discourse \u7684 Docker \u6620\u50cf\u57fa\u65bc Debian 12\uff0c\u5167\u542b\u8106\u5f31\u7248\u672c libheif\uff0c\u4f7f community.openai.com \u6210\u70ba\u53ef\u88ab\u5229\u7528\u7684\u5be6\u4f8b\u3002\n5. 2026 \u5e74 7 \u6708 25 \u65e5\uff0c\u7814\u7a76\u8005\u53d6\u5f97\u8ad6\u58c7\u9060\u7aef\u4ee3\u78bc\u57f7\u884c\u5f8c\uff0c\u5229\u7528 OpenAI SSO \u8eab\u5206\u9a57\u8b49\u7f3a\u9677\u63a5\u7ba1\u591a\u540d\u54e1\u5de5\u7684 ChatGPT \u8207 Codex \u5e33\u865f\u3002\n6. \u7814\u7a76\u8005\u4ee5\u5176\u4e2d\u4e00\u540d\u54e1\u5de5\u7684 Codex \u5728 OpenAI \u5167\u90e8 monorepo \u958b\u51fa pull request \u4f5c\u5b58\u53d6\u8b49\u660e\uff0c\u672a\u8b80\u53d6\u6a5f\u5bc6\u5167\u5bb9\u3002\n7. OpenAI \u65bc 9 \u6708 1 \u65e5\u652f\u4ed8 6,500 \u7f8e\u5143\u8cde\u91d1\uff0c\u4f46\u6f84\u6e05\u8ad6\u58c7\u6e2c\u8a66\u672c\u8eab\u4e0d\u5728\u8cde\u91d1\u8a08\u5283\u7bc4\u570d\uff0c\u734e\u91d1\u662f\u80af\u5b9a\u300cOpenAI \u65b9\u9762\u7684\u767c\u73fe\u300d\u3002\n8. \u6574\u500b HEIF Heist \u7814\u7a76\u8a08\u5283\u70ba\u671f\u5169\u500b\u6708\u3001\u4ee3\u5e63\u7e3d\u6210\u672c\u5c11\u65bc 3,000 \u7f8e\u5143\u3001\u7531\u4e09\u540d\u7814\u7a76\u8005\u5b8c\u6210\uff1b\u628a\u6f0f\u6d1e\u9069\u914d\u81f3\u65b0\u516c\u53f8\u901a\u5e38\u53ea\u9700\u4e00\u81f3\u5169\u5929\u3002\n9. \u5831\u544a\u6307\u9664 Shopify \u5916\uff0c\u672a\u77e5\u9053\u6709\u4efb\u4f55\u516c\u53f8\u5bdf\u89ba\u60e1\u610f\u5716\u7247\u6d3b\u52d5\uff0c\u5373\u4f7f\u5716\u50cf\u8655\u7406\u5668\u53cd\u8986\u5d29\u6f70\u3002\n10. Discourse \u65bc 7 \u6708 28 \u65e5\u767c\u5e03 GHSA-vhm9-85gw-x335 \u5b89\u5168\u516c\u544a\uff1b\u81ea\u884c\u67b6\u8a2d\u8005\u9808\u91cd\u5efa\u5e95\u5c64\u6620\u50cf\uff0c\u800c\u975e\u50c5\u7d93\u7db2\u9801\u4ecb\u9762\u66f4\u65b0\u3002\n\n## \u4e94\u9ede\u6df1\u5ea6\u5206\u6790\n\n### \uff081\uff09\u653b\u64ca\u93c8\u7684\u5de5\u7a0b\u7d50\u69cb\uff1a\u55ae\u9ede\u4e0d\u81f4\u547d\uff0c\u4e32\u9023\u5373\u8d8a\u754c\n\nlibheif \u7684\u7de9\u885d\u5340\u6ea2\u4f4d\u672c\u8eab\u53ea\u662f\u500b\u5225\u89e3\u78bc\u5668\u7684\u8a18\u61b6\u9ad4\u932f\u8aa4\uff1bDebian \u672a back-port \u8b93\u8106\u5f31\u7248\u672c\u505c\u7559\u5728\u5e38\u898b Docker \u6620\u50cf\u5167\uff1bDiscourse \u7684\u5716\u7247\u4e0a\u50b3\u8a2d\u8a08\u628a HEIC \u4ea4\u7d66 ImageMagick \u8abf\u7528 libheif\uff1bSSO \u628a\u8ad6\u58c7\u767b\u5165\u8eab\u5206\u63a5\u56de OpenAI\uff1bGitHub \u6574\u5408\u518d\u628a\u54e1\u5de5 Codex \u6b0a\u9650\u653e\u5927\u81f3\u5167\u90e8 repo\u3002\u6bcf\u4e00\u500b\u74b0\u7bc0\u5b64\u7acb\u770b\u90fd\u4e0d\u662f\u7a00\u4e16\u6b0a\u9650\uff0c\u4f46\u9023\u5728\u4e00\u8d77\u5c31\u5f62\u6210\u5f9e\u533f\u540d\u5716\u7247\u4e0a\u50b3\u5230\u5167\u90e8\u4ee3\u78bc\u5eab\u7684\u76f4\u63a5\u8def\u5f91\u3002\u9019\u6b63\u662f\u73fe\u4ee3\u4f9b\u61c9\u93c8\u8207\u9ad8\u4fe1\u4efb\u6574\u5408\u7684\u8907\u5408\u98a8\u96aa\uff1a\u7cfb\u7d71\u5b89\u5168\u4e0d\u518d\u53d6\u6c7a\u65bc\u6700\u5f37\u74b0\u7bc0\uff0c\u800c\u53d6\u6c7a\u65bc\u6700\u5f31\u4e00\u74b0\u3002\u9ed1\u5ba2\u4e0d\u9700\u8981\u6253\u7a7f\u6838\u5fc3\u57fa\u5efa\uff0c\u53ea\u9700\u5728\u908a\u7de3\u670d\u52d9\u627e\u5230\u4e00\u689d\u53ef\u88ab\u9010\u6b65\u653e\u5927\u7684\u4fe1\u4efb\u93c8\u3002\n\n### \uff082\uff09\u4eba\u5de5\u667a\u80fd\u6539\u8b8a\u6f0f\u6d1e\u5229\u7528\u7d93\u6fdf\u5b78\n\n\u5831\u544a\u986f\u793a\uff0c\u6574\u500b\u8a08\u5283\u4ee3\u5e63\u6210\u672c\u5c11\u65bc 3,000 \u7f8e\u5143\u3001\u4e09\u4eba\u3001\u5169\u500b\u6708\uff0c\u5373\u53ef\u5b8c\u6210\u5c0d OpenAI \u53ca\u591a\u5bb6\u5927\u578b\u8edf\u4ef6\u7528\u6236\u7684\u6f0f\u6d1e\u9069\u914d\u3002\u66f4\u5177\u9ad4\u7684\u8e8d\u9032\u662f\uff1aClaude Opus 4.8 \u53ea\u80fd\u505a\u51fa\u5728\u95dc\u9589 ASLR \u4e0b\u904b\u4f5c\u7684 exploit\uff0c\u7121\u6cd5\u5728 Discourse \u9810\u8a2d\u7684 ASLR \u74b0\u5883\u7a69\u5b9a\u57f7\u884c\uff1bClaude Opus 5 \u767c\u5e03\u5f8c\uff0c\u65b0 session \u5148\u5728\u4e09\u5c0f\u6642\u5167\u5b8c\u6210\u672c\u6a5f Mac \u7684 ARM64 exploit\uff0c\u518d\u79fb\u690d\u81f3\u76ee\u6a19\u6240\u7528\u7684 x86-64 \u74b0\u5883\u3002\u9019\u8aaa\u660e\u6a21\u578b\u4ee3\u969b\u63d0\u5347\u53ef\u76f4\u63a5\u58d3\u7e2e\u5f9e\u6f0f\u6d1e\u5230\u53ef\u7528 exploit \u7684\u6642\u9593\u3002\u904e\u53bb\u300c\u6f0f\u6d1e\u516c\u958b\u4e0d\u7b49\u65bc\u6703\u88ab\u5229\u7528\u300d\u7684\u5047\u8a2d\u6b63\u5728\u88ab\u4fb5\u8755\uff0c\u7a00\u7f3a\u7684\u9006\u5411\u5de5\u7a0b\u5c08\u696d\u6b63\u88ab\u8f49\u5316\u70ba\u53ef\u8cfc\u8cb7\u7684\u7b97\u529b\u3002\u5831\u544a\u4ea6\u63d0\u9192\uff0c\u9019\u4e26\u975e\u5b8c\u5168\u81ea\u4e3b\uff0c\u719f\u7df4\u7684\u4eba\u985e\u5f15\u5c0e\u4ecd\u7136\u91cd\u8981\uff0c\u4f46\u5c0f\u5718\u968a\u53ef\u5b8c\u6210\u7684\u5de5\u4f5c\u91cf\u5df2\u7d93\u5927\u5e45\u589e\u52a0\u3002\n\n### \uff083\uff09\u4f9b\u61c9\u93c8\u8207\u767c\u5e03\u6d41\u7a0b\u7684\u96b1\u5f62\u7f3a\u53e3\n\n\u4e8b\u4ef6\u6839\u6e90\u4e4b\u4e00\uff0c\u662f\u4e0a\u6e38\u4fee\u6b63\u65e9\u5df2\u5b58\u5728\uff0c\u4f46\u672a\u88ab\u6a19\u8a18\u70ba\u5b89\u5168\u4fee\u88dc\u3001\u4ea6\u6c92\u6709 CVE\uff0c\u56e0\u6b64 Debian 12\uff0f13 \u672a\u80fd\u53ca\u6642 back-port\u3002\u9019\u4ee4 libheif 1.19.7 \u8207 1.19.8 \u7684\u8106\u5f31\u72c0\u614b\u6301\u7e8c\u5b58\u5728\uff0cDiscourse \u7684 Docker \u6620\u50cf\u4ea6\u56e0\u6b64\u53d7\u5230\u5f71\u97ff\u3002\u8edf\u4ef6\u751f\u614b\u9577\u671f\u4f9d\u8cf4\u7dad\u8b77\u8005\u8207\u767c\u884c\u7248\u5c0d\u300c\u5b89\u5168\u4fee\u6b63\u300d\u7684\u5224\u65b7\uff1b\u4e00\u65e6\u5b89\u5168\u4fee\u6b63\u88ab\u7576\u6210\u666e\u901a\u932f\u8aa4\u4fee\u6b63\uff0c\u4e0b\u6e38\u5c31\u4e0d\u6703\u4ee5\u5b89\u5168\u66f4\u65b0\u8655\u7406\u3002\u6b64\u6b21\u4e8b\u4ef6\u986f\u793a\uff0c\u55ae\u4e00\u6a19\u8a18\u7f3a\u5931\u53ef\u4ee5\u4ee4\u6f0f\u6d1e\u5728\u4e3b\u6d41\u958b\u6e90\u4f9b\u61c9\u93c8\u4e2d\u5b58\u6d3b\u591a\u6642\uff0c\u76f4\u81f3\u6709\u4eba\u7528 AI \u628a\u5b83\u8b8a\u6210\u53ef\u7528 exploit\u3002\u4f9b\u61c9\u93c8\u5b89\u5168\u4e0d\u80fd\u53ea\u4f9d\u8cf4 CVE\uff0c\u7dad\u8b77\u8005\u7684\u5224\u65b7\u8207\u4e0a\u6e38\u8b8a\u66f4\u5206\u985e\u540c\u6a23\u662f\u95dc\u9375\u74b0\u7bc0\u3002\n\n### \uff084\uff09SSO \u8207\u8eab\u5206\u8a2d\u8a08\u7684\u653e\u5927\u6548\u61c9\n\n\u8ad6\u58c7\u88ab\u653b\u9677\u4e4b\u6240\u4ee5\u80fd\u8b8a\u6210\u5e33\u6236\u63a5\u7ba1\uff0c\u5728\u65bc community.openai.com \u4f7f\u7528 OpenAI SSO\uff0c\u800c\u54e1\u5de5\u53ef\u7528\u540c\u4e00\u8eab\u5206\u767b\u5165\u8ad6\u58c7\u3002\u653b\u64ca\u8005\u63a7\u5236\u8ad6\u58c7\u4f3a\u670d\u5668\u5f8c\uff0c\u4fbf\u80fd\u6feb\u7528\u8eab\u5206\u63d0\u4f9b\u65b9\u8207\u4f9d\u8cf4\u670d\u52d9\u4e4b\u9593\u7684\u4fe1\u4efb\uff0c\u53d6\u5f97\u54e1\u5de5 ChatGPT \u8207 Codex \u5e33\u865f\u3002Codex \u5df2\u9023\u63a5\u7684 GitHub \u6574\u5408\u9032\u4e00\u6b65\u628a\u6b0a\u9650\u5ef6\u4f38\u81f3\u5167\u90e8 monorepo\u3002\u9019\u8aaa\u660e SSO \u5728\u964d\u4f4e\u6469\u64e6\u7684\u540c\u6642\uff0c\u4e5f\u628a\u5b89\u5168\u908a\u754c\u58d3\u7e2e\u5230\u6bcf\u4e00\u500b\u63a5\u5165\u670d\u52d9\uff0c\u4efb\u4f55\u9644\u5c6c\u5165\u53e3\u5931\u5b88\u90fd\u53ef\u80fd\u53cd\u5411\u4fb5\u8755\u4f01\u696d\u8eab\u5206\u3002\u5c0d\u9ad8\u654f\u611f\u4ee3\u78bc\u5eab\u800c\u8a00\uff0cAI \u52a9\u624b\u8207 GitHub \u7684\u6574\u5408\u9700\u8981\u984d\u5916\u6388\u6b0a\u3001\u77ed\u671f\u4ee4\u724c\u8207\u7570\u5e38\u884c\u70ba\u76e3\u6e2c\uff0c\u800c\u4e0d\u662f\u50c5\u4f9d\u8cf4\u4e3b\u5e33\u865f\u5b89\u5168\u3002\n\n### \uff085\uff09\u5075\u6e2c\u843d\u5dee\uff1a\u5d29\u6f70\u4e0d\u7b49\u65bc\u8b66\u5831\n\n\u5831\u544a\u6307\u9664 Shopify \u5916\uff0c\u672a\u77e5\u9053\u6709\u4efb\u4f55\u516c\u53f8\u5bdf\u89ba\u5230\u60e1\u610f\u6d3b\u52d5\uff0c\u5373\u4f7f\u5df2\u9001\u51fa\u6578\u5343\u5f35\u5716\u7247\u3001\u5c0d\u65b9\u5716\u50cf\u8655\u7406\u5668\u53cd\u8986\u5d29\u6f70\u3002\u9019\u986f\u793a\u50b3\u7d71\u5b89\u5168\u76e3\u63a7\u5c0d\u908a\u7de3\u670d\u52d9\u7684\u7570\u5e38\u4fe1\u865f\u6975\u4e0d\u654f\u611f\uff0c\u5716\u50cf\u8655\u7406\u5668\u5d29\u6f70\u5f80\u5f80\u88ab\u8996\u70ba\u4e00\u822c\u670d\u52d9\u964d\u7d1a\uff0c\u800c\u975e\u653b\u64ca\u524d\u7f6e\u6d3b\u52d5\u3002\u653b\u64ca\u8005\u53ef\u5229\u7528\u9019\u7a2e\u4f4e\u4fe1\u566a\u6bd4\u7684\u74b0\u5883\uff0c\u53cd\u8986\u6e2c\u8a66\u4e26\u8abf\u6574 exploit\u3002\u82e5\u60e1\u610f\u884c\u70ba\u8005\u8907\u88fd\u624b\u6cd5\uff0c\u53ef\u80fd\u5728\u4f01\u696d\u5b8c\u5168\u4e0d\u77e5\u60c5\u4e0b\u5b8c\u6210\u5075\u5bdf\u8207\u6f0f\u6d1e\u5229\u7528\u3002\u5f71\u50cf\u8655\u7406\u670d\u52d9\u7684\u7570\u5e38\u5d29\u6f70\u3001\u5927\u91cf\u975e\u5178\u578b\u5716\u7247\u4e0a\u50b3\uff0c\u61c9\u8a72\u88ab\u7d0d\u5165\u81ea\u52d5\u5316\u544a\u8b66\u8207\u5a01\u8105\u72e9\u7375\u7684\u7bc4\u570d\uff0c\u800c\u4e0d\u662f\u7559\u5f85\u4eba\u624b\u5076\u7136\u767c\u73fe\u3002\n\n## \u7bc0\u76ee\u8072\u7a31 vs \u53ef\u6838\u5be6\u4e8b\u5be6\n\n| \u7bc0\u76ee\u8072\u7a31 | \u6027\u8cea | \u5099\u8a3b |\n| --- | --- | --- |\n| \u300cOpenAI just got hacked or at least were just beginning to find out about it\u300d | \u4e8b\u5b9e\uff08\u6709\u51fa\u5165\uff09 | OpenAI \u8ad6\u58c7\u53ca\u54e1\u5de5\u5e33\u865f\u78ba\u906d\u672a\u7d93\u6388\u6b0a\u6e2c\u8a66\uff0c\u4f46\u5c6c\u5b89\u5168\u7814\u7a76\u8005\u5728\u62ab\u9732\u6846\u67b6\u4e0b\u9032\u884c\uff0c\u4e26\u7d93 OpenAI \u78ba\u8a8d\u4fee\u5fa9\uff1b\u5f71\u7247\u6a19\u984c\u8a9e\u5883\u6613\u88ab\u8b80\u6210\u60e1\u610f\u5165\u4fb5\u3002 |\n| \u300cIt took the hacking group less than 72 hours to hack OpenAI\u300d | \u4e8b\u5b9e | \u5831\u544a\u7a31\u7531\u6700\u521d\u767c\u73fe\u5230\u53d6\u5f97 repo \u5b58\u53d6\u5c11\u65bc 72 \u5c0f\u6642\uff1b\u60df\u7814\u7a76\u8005\u70ba Hacktron AI \u5b89\u5168\u7814\u7a76\u4eba\u54e1\uff0c\u4e26\u975e\u4e00\u822c\u9ed1\u5ba2\u7d44\u7e54\u3002 |\n| \u300cThey used Claude Claude Enthropics model\u300d | \u4e8b\u5b9e | \u5831\u544a\u78ba\u8a8d\u4f7f\u7528 Claude Opus 4.8 \u8207 5\uff1b\u5f71\u7247\u672a\u5340\u5206\u7248\u672c\u53ca\u5176\u80fd\u529b\u8e8d\u9032\u3002 |\n| \u300cIt was image magic as was foretold\u300d | \u4e8b\u5b9e\uff08\u6709\u51fa\u5165\uff09 | \u5f71\u7247\u6b78\u56e0\u65bc ImageMagick\uff1b\u5831\u544a\u6307\u6f0f\u6d1e\u5b58\u5728\u65bc libheif \u89e3\u78bc\u5668\uff0c\u7d93 ImageMagick \u8abf\u7528\u800c\u66b4\u9732\u3002ImageMagick \u662f\u547c\u53eb\u8005\uff0c\u4e0d\u662f\u6f0f\u6d1e\u672c\u8eab\u3002 |\n| \u300cOpenAI even coughed up a $6,500 bounty for their efforts\u300d | \u4e8b\u5b9e | OpenAI \u65bc 2026 \u5e74 9 \u6708 1 \u65e5\u652f\u4ed8 6,500 \u7f8e\u5143\uff1b\u4f46\u6f84\u6e05\u8a72\u8cde\u91d1\u91dd\u5c0d\u300cOpenAI \u65b9\u9762\u7684\u767c\u73fe\u300d\uff0ccommunity.openai.com \u7684 Discourse \u6e2c\u8a66\u672c\u8eab\u4e0d\u5728\u8cde\u91d1\u7bc4\u570d\u3002 |\n| \u300cThe entire research project ... cost less than $3,000 in tokens in total\u300d | \u4e8b\u5b9e | Hacktron \u5831\u544a\u539f\u6587\u76f8\u540c\uff0c\u6307\u6574\u500b HEIF Heist \u7814\u7a76\u8a08\u5283\u4ee3\u5e63\u6210\u672c\u5c11\u65bc 3,000 \u7f8e\u5143\u3002 |\n| \u300cThey said, 'We are not aware of any company that detected the activity except Shopify'\u300d | \u4e8b\u5b9e | \u5831\u544a\u78ba\u6709\u6b64\u8868\u8ff0\uff0c\u4f46\u672a\u516c\u5e03\u9664 Shopify \u4ee5\u5916\u7684\u516c\u53f8\u540d\u7a31\u3002 |\n| \u300cShopify ... is 165 billion\u300d | \u4e8b\u5b9e\uff08\u6709\u51fa\u5165\uff09 | 2026 \u5e74 9 \u6708 Shopify \u5e02\u503c\u7d04 1,730 \u5104\u7f8e\u5143\uff0c\u5f71\u7247\u6240\u8ff0 1,650 \u5104\u7f8e\u5143\u7565\u4f4e\u3002 |\n| \u300cBobby Tables ... was used in that whole hugging face hack incident\u300d | \u672a\u7d93\u6838\u5be6 | \u5f71\u7247\u672a\u63d0\u4f9b\u4f86\u6e90\uff1b\u4e00\u624b\u8cc7\u6599\u4ea6\u7121\u6b64\u4f9d\u64da\uff0c\u7121\u6cd5\u78ba\u8a8d\u5169\u8005\u95dc\u806f\u3002 |\n| \u300cAI models ... chaining zeroday exploits or using an exploit chain\u300d | \u89c2\u70b9 | \u5831\u544a\u672a\u5c07\u6b64\u6f0f\u6d1e\u5b9a\u6027\u70ba\u96f6\u65e5\uff1b\u6f0f\u6d1e\u5df2\u6709\u4e0a\u6e38\u4fee\u6b63\u4f46\u672a\u6a19\u8a18\u5b89\u5168\u3001\u7121 CVE\uff0c\u662f\u5426\u7a31\u70ba\u96f6\u65e5\u53d6\u6c7a\u65bc\u5b9a\u7fa9\uff0c\u5c6c\u5f71\u7247\u4f5c\u8005\u8a55\u8ad6\u3002 |\n| \u300cThe models also helped with privilege escalation, lateral movement, and bypassing existing defenses\u300d | \u4e8b\u5b9e | \u5831\u544a\u539f\u6587\u76f8\u540c\uff1b\u60df\u9808\u4e00\u4f75\u7406\u89e3\u5831\u544a\u6240\u6307\u300c\u4e26\u975e\u5b8c\u5168\u81ea\u4e3b\uff0c\u719f\u7df4\u7684\u4eba\u985e\u5f15\u5c0e\u4ecd\u7136\u91cd\u8981\u300d\u3002 |\n\n## \u653b\u64ca\u93c8\u901f\u67e5\n\n| \u74b0\u7bc0 | \u89d2\u8272 |\n| --- | --- |\n| libheif \u5f71\u50cf\u89e3\u78bc\u5668 | \u6f0f\u6d1e\u6240\u5728\uff1aHEIC\uff0fHEIF \u89e3\u78bc\u6642\u5806\u7de9\u885d\u5340\u6ea2\u4f4d\uff0c\u53ef\u8b80\u5beb\u8d8a\u754c |\n| Debian \u7f3a\u5c11\u5b89\u5168 back-port | \u4e0a\u6e38\u4fee\u88dc\u672a\u6a19\u8a18\u5b89\u5168\u3001\u7121 CVE\uff0c\u767c\u884c\u7248\u672a\u53ca\u5411\u5f8c\u79fb\u690d\uff0cDiscourse Docker \u6620\u50cf\u4fdd\u7559\u8106\u5f31\u7248\u672c |\n| ImageMagick\uff08\u4f7f\u7528 libheif\uff09 | \u88ab Discourse \u7528\u4f5c HEIF \u8f49\u63db\u5de5\u5177\uff0c\u628a\u653b\u64ca\u8005\u63a7\u5236\u7684\u6a94\u6848\u50b3\u7d66 libheif \u89e3\u6790\u5668\uff0c\u672c\u8eab\u975e\u6f0f\u6d1e\u6839\u6e90 |\n| Discourse \u5716\u7247\u4e0a\u50b3 | FastImage \u4e0d\u652f\u63f4 HEIF\uff0c\u5c07 HEIC\uff0fHEIF \u4e0a\u50b3\u8f49\u4ea4 ImageMagick \u8655\u7406\uff0c\u5f62\u6210\u653b\u64ca\u5165\u53e3 |\n| OpenAI \u8ad6\u58c7 community.openai.com | \u9762\u5411\u4e92\u806f\u7db2\u7684 Discourse \u5be6\u4f8b\uff0c\u4ee5 SSO \u63a5\u99c1 OpenAI \u5e33\u865f |\n| OpenAI SSO \u8eab\u5206\u9a57\u8b49\u7f3a\u9677 | \u8ad6\u58c7\u88ab\u63a7\u5236\u5f8c\u53ef\u52ab\u6301\u5df2\u767b\u5165\u7684 OpenAI \u54e1\u5de5 ChatGPT\uff0fCodex \u5e33\u865f |\n| \u5df2\u9023\u63a5\u7684 GitHub \u6574\u5408 | \u54e1\u5de5 Codex \u6240\u9023\u63a5\u7684 GitHub \u6b0a\u9650\u88ab\u6feb\u7528\uff0c\u653e\u5927\u81f3\u5167\u90e8\u4ee3\u78bc\u5eab |\n| OpenAI \u5167\u90e8 repo | \u5728 `openai/openai` monorepo \u958b PR \u4f5c\u5b58\u53d6\u8b49\u660e\uff0c\u672a\u8b80\u53d6\u6a5f\u5bc6\u5167\u5bb9 |\n\n## \u5f71\u7247\u672a\u63d0\u5230\u7684\u95dc\u9375\u7d30\u7bc0\n\n1. \u5f71\u7247\u628a\u300chelp forum\u300d\u8aa4\u4f5c\u300chealth forum\u300d\uff1b\u5be6\u969b\u662f\u958b\u767c\u8005\u4e92\u52a9\u8ad6\u58c7 community.openai.com\u3002\n2. \u5f71\u7247\u672a\u9ede\u540d\u6838\u5fc3\u6f0f\u6d1e\u5728 libheif\uff0c\u4ea6\u672a\u8aaa\u660e Debian back-port \u7f3a\u5931\u3001\u7248\u672c\u865f\uff08libheif 1.19.7\uff0f1.19.8\uff09\u53ca Discourse \u516c\u544a GHSA-vhm9-85gw-x335\u3002\n3. \u5f71\u7247\u672a\u63d0 OpenAI \u5c0d\u8cde\u91d1\u7bc4\u570d\u7684\u6f84\u6e05\uff1a\u6e2c\u8a66 community.openai.com \u672c\u8eab\u4e0d\u5728 OpenAI \u8cde\u91d1\u8a08\u5283\u7bc4\u570d\uff0c6,500 \u7f8e\u5143\u662f\u80af\u5b9a\u300cOpenAI \u65b9\u9762\u7684\u767c\u73fe\u300d\u3002\n4. \u5f71\u7247\u672a\u63d0\u5831\u544a\u4e2d Claude Opus 5 \u66fe\u5728 3 \u5c0f\u6642\u5167\u5b8c\u6210\u672c\u6a5f Mac ARM64 exploit \u7684\u7d30\u7bc0\uff0c\u4e5f\u672a\u63d0 GPT-5.6 Sol \u5176\u5f8c\u5728\u6e2c\u8a66\u4e2d\u7684\u660e\u986f\u8e8d\u9032\u3002\n5. \u5f71\u7247\u96d6\u7a31\u300c\u4e26\u975e\u5b8c\u5168\u81ea\u4e3b\u300d\uff0c\u4f46\u672a\u5f37\u8abf\u5831\u544a\u7684\u5b8c\u6574\u7d50\u8ad6\u2014\u2014\u719f\u7df4\u7684\u4eba\u985e\u5f15\u5c0e\u4ecd\u7136\u91cd\u8981\uff0c\u4e26\u975e\u5168\u81ea\u52d5\u653b\u64ca\u3002\n6. \u5f71\u7247\u672a\u63d0\u7814\u7a76\u8005\u56e0\u6a21\u578b\u62d2\u7d55\u70ba\u9060\u7aef\u5be6\u4f8b\u64b0\u5beb exploit\uff0c\u800c\u628a\u81ea\u5bb6 Discourse Cloud \u5be6\u4f8b\u5047\u626e\u6210 CTF \u76ee\u6a19\u4f86\u5f15\u5c0e\u6a21\u578b\u5b8c\u6210\u5229\u7528\u3002\n7. \u5f71\u7247\u7a31 XKCD\u300cBobby Tables\u300d\u66fe\u7528\u65bc Hugging Face \u4e8b\u4ef6\uff0c\u672a\u7d93\u4e00\u624b\u4f86\u6e90\u6838\u5be6\u3002\n8. \u5f71\u7247\u5c07 Shopify \u5e02\u503c\u8aaa\u6210\u7d04 1,650 \u5104\u7f8e\u5143\uff0c\u7565\u4f4e\u65bc 2026 \u5e74 9 \u6708\u7d04 1,730 \u5104\u7f8e\u5143\u7684\u5e02\u5834\u6578\u64da\u3002\n\n## \u7522\u696d\u555f\u793a\n\n\u81ea\u884c\u67b6\u8a2d Discourse \u7684\u6a5f\u69cb\u61c9\u6309\u5b89\u5168\u516c\u544a\u6307\u793a\uff0c\u4ee5 `git pull` \u5f8c `./launcher rebuild app` \u65b9\u5f0f\u91cd\u5efa\u5e95\u5c64\u6620\u50cf\uff1b\u50c5\u7d93\u7db2\u9801\u4ecb\u9762\u66f4\u65b0\u4e0d\u6703\u66f4\u63db\u5e95\u5c64\u4f5c\u696d\u7cfb\u7d71\u6620\u50cf\uff0c\u6f0f\u6d1e\u53ef\u80fd\u4ecd\u7136\u5b58\u5728\u3002\u4efb\u4f55\u63a5\u53d7 HEIC\u3001HEIF\u3001AVIF \u7b49\u683c\u5f0f\u4e0a\u50b3\u3001\u4e26\u7d93 ImageMagick \u6216 libheif \u8655\u7406\u7684\u670d\u52d9\uff0c\u90fd\u61c9\u5047\u8a2d\u53ef\u80fd\u53d7\u5f71\u97ff\uff0c\u5be9\u67e5\u8f49\u6a94\u8def\u5f91\u3001\u6c99\u7bb1\u9694\u96e2\u8207\u8a18\u61b6\u9ad4\u5b89\u5168\u66f4\u65b0\u3002\n\n\u4e8b\u4ef6\u540c\u6642\u986f\u793a\uff0cSSO \u8207\u7b2c\u4e09\u65b9\u6574\u5408\u628a\u908a\u754c\u5b89\u5168\u58d3\u7e2e\u5230\u6700\u5f31\u7684\u9644\u5c6c\u670d\u52d9\u3002\u4f01\u696d\u61c9\u91cd\u65b0\u5be9\u8996\u8ad6\u58c7\u3001\u652f\u63f4\u5165\u53e3\u7b49\u4f4e\u4fe1\u4efb\u7cfb\u7d71\u63a5\u5165\u4e3b\u8eab\u5206\u7cfb\u7d71\u7684\u98a8\u96aa\uff0c\u4e26\u5c0d\u9ad8\u654f\u611f\u4ee3\u78bc\u5eab\u7684 GitHub \u6574\u5408\u3001AI \u52a9\u624b\u9023\u63a5\u52a0\u5165\u984d\u5916\u6388\u6b0a\u3001\u77ed\u671f\u4ee4\u724c\u53ca\u7570\u5e38\u884c\u70ba\u76e3\u6e2c\u3002\u5c07\u54e1\u5de5\u8eab\u5206\u8207\u5916\u90e8\u8ad6\u58c7\u7d81\u5b9a\uff0c\u5be6\u969b\u4e0a\u7b49\u65bc\u628a\u5167\u90e8\u5b89\u5168\u908a\u754c\u5916\u5305\u7d66\u6bcf\u4e00\u500b\u524d\u7aef\u7cfb\u7d71\u3002\n\n\u8cde\u91d1\u8207\u62ab\u9732\u6d41\u7a0b\u4ecd\u6709\u5176\u50f9\u503c\u3002OpenAI \u5728\u7d04 14 \u5c0f\u6642\u5167\u78ba\u8a8d\u4fee\u5fa9\uff0cDiscourse \u65bc\u6578\u65e5\u5167\u767c\u5e03\u516c\u544a\uff0c\u7814\u7a76\u8005\u7684\u5be6\u9a57\u4ea6\u516c\u958b\u4e86\u653b\u64ca\u93c8\uff1b\u9019\u6bd4\u6f0f\u6d1e\u5728\u9ed1\u5e02\u4e2d\u88ab\u5229\u7528\u66f4\u6709\u5229\u9632\u79a6\u3002\u4f46\u4f01\u696d\u4e0d\u80fd\u53ea\u4f9d\u8cf4\u8cde\u91d1\u8a08\u5283\u3002\u5831\u544a\u6240\u8ff0\u9664 Shopify \u5916\u7121\u516c\u53f8\u5bdf\u89ba\uff0c\u53cd\u6620\u8a31\u591a\u5916\u570d\u7570\u5e38\u672a\u6709\u9032\u5165\u5b89\u5168\u904b\u7dad\u8996\u91ce\u3002\u5c0d\u5716\u50cf\u8655\u7406\u5d29\u6f70\u3001\u5927\u91cf\u975e\u5178\u578b\u4e0a\u50b3\u7b49\u4fe1\u865f\u5efa\u7acb\u81ea\u52d5\u544a\u8b66\uff0c\u6216\u8a31\u662f\u6b64\u6b21\u4e8b\u4ef6\u6700\u4f4e\u6210\u672c\u3001\u6700\u76f4\u63a5\u7684\u9632\u79a6\u6539\u5584\u3002\n\n## \u91d1\u53e5\n\n\u4ee5\u4e0b\u6642\u9593\u6a19\u793a\u5747\u4f9d\u539f\u9010\u5b57\u7a3f\u6a19\u793a\uff0c\u539f\u7a3f\u50c5\u6a19\u301400:00\u3015\u3002\n\n1. \"OpenAI just got hacked or at least were just beginning to find out about it.\"\u301400:00\u3015\n2. \"It took the hacking group less than 72 hours to hack OpenAI.\"\u301400:00\u3015\n3. \"It was image magic as was foretold.\"\u301400:00\u3015\n4. \"OpenAI even coughed up a $6,500 bounty for their efforts.\"\u301400:00\u3015\n5. \"what used to require like rare expertise now is really changing.\"\u301400:00\u3015\n\n## \u539f\u6587\u9010\u5b57\u7a3f\n\n\n\u9ede\u64ca\u5c55\u958b\u5b8c\u6574\u9010\u5b57\u7a3f\uff08\u82f1\u6587\u81ea\u52d5\u5b57\u5e55\u91cd\u5efa\uff0c\u9644\u6642\u9593\u6233\uff09\n\n[00:00] OpenAI just got hacked or at least were just beginning to find out about it. It took the hacking group less than 72 hours to hack OpenAI. They got access to employees Chad GBT and Codex accounts. They even got access to OpenAI's internal mono repo where all the data, all the code is stored. How did they do it? They used Claude Claude Enthropics model. So they took Enthropics model and they hacked open AI with it. Also, there's this comic book that's been online for since the dawn of the internet, I think, called XKCD that just repeatedly almost predicts all these AI hacking attempts like how it's going to do it.\n\n[00:00] You might have seen this image before. All modern digital infrastructure is like relying on this tiny little project that some random person in Nebraska has been thanklessly maintaining since 2003. And if you hover over the image, it says, [clears throat] \"Someday image magic will finally break for good and we'll have a long period of scrambling as we try to reassemble civilization from the rubble.\" Can you guess what part the AI used to accomplish this whole thing? It was image magic as was foretold. The whole thing about Bobby Tables that this comic book wrote about, that was used in that whole hugging face hack incident. Like I think at this point the AI agents are just like browsing through this looking for ideas. So, what's crazy is if the hackers got to OpenAI's mono repo, it's basically this one big repository where they keep all the code. And we don't know what's in there necessarily.\n\n[00:00] Well, I guess the hackers do, but it could be Chad GPT backend code. It could be a lot of like the training materials, the training infrastructure that they use to train the models, research tools, safety systems, probably tons of their internal infrastructure, like a bunch of stuff that's kind of important. Like the models themselves are not on there, but I I would assume that a lot of the other stuff is. So, some good news first. Open got hacked by the good guys. They got hacked by Hacktron. So, Hackron is a San Francisco based, you know, they're cyber security experts, researchers, but mainly a cyber security company, and they're really going hard on this autonomous AI agents, you know, hacking, penetration, testing, beefing up security, eliminating vulnerabilities, you know, cyber security with AI agents. So first and foremost, as I say here, until two months ago, any user or OpenAI employee logging into OpenAI's own health forum could have had their Chad GPT and Codex accounts taken over.\n\n[00:00] So a lot of this had to do with that single sign on SSO, right? You know how you sometimes can get a link, you click, you sign on or with Google, for example, if you use Google accounts, you can use that to log into a lot of different stuff as kind of from your Google account. So there's no password involved. You're logged into Google and through Google you log into that thing. Open AI even coughed up a $6,500 bounty for their efforts. By the way, the fact that this was, you know, until 2 months ago, people could have hacked and and stolen information. This was just open. That's an important point to understand because a lot of companies are realizing that now with AI, a lot of the stuff that we thought secure, we realize it's really really not.\n\n[00:00] It's like if you build the house and you could look around and you're like, I don't see any holes in the walls or in the ceiling. Like we we seal this thing pretty tight. Then AI takes a look at it, crawls all over it, and it's like, here's a billion holes that I found. And they they point at one. We're like, oh yeah, I get it. By the way, they're saying they're not stopping at OpenAI. Apparently, there's this h heist. I'm not going to go too deep into the technical cyber details, whatever.\n\n[00:00] Just wait for the fire ship video, I guess. But the point you need to understand is that there is this one little library or one little set of tools that a lot of the stuff that we use kind of re relies upon. It depends on it. So Slack, Meta, GitHub Enterprise, Ruby on Rails, Node.js, as they say here, a surprising amount of widely used software depends on this one image processing library. And exhibit A is the XKCD comic. So they noticed that OpenAI uses Discourse for their forum. So it's another software that OpenAI has used for the help forums where developers could go and chat and talk and help each other and discuss things. And they realized that this forum it could compromise a lot more than the form.\n\n[00:00] So if they're able to crack that discourse software, they could potentially create a path into broader OpenAI services through this identity flow. But the discourse app is not an easy target. And this is going to be one of the things that we've seen with the the hugging face incident and we're going to be seeing here and probably a lot more that a lot of these hacks happen because these AI models, they're chaining zeroday exploits or using an exploit chain, whatever you call it. Basically, they're finding multiple errors, multiple holes, and they're kind of lining them all up and they're able to shoot through to to wherever it is they're going. So it's not like it found one thing and through that one thing it was able to just get into the OpenAI servers. It found vulnerabilities from a lot of different things that a lot of us rely on that OpenAI relies on and was able to use the flaws in all those systems to get into OpenAI. So they found that this course uses one sort of image processing software. So if you're uploading an image from your phone or screenshot or whatever, usually it's processed through fast image.\n\n[00:00] You don't need to be familiar with exactly what this is. Basically, for image processing, it used one piece of software, but for some small percentages of images that needed this hy thing, it would pass those to image magic. Again, image magic is is is this here. And they realized that they were able to do this to expose the underlying parser directly to attack controlled files. This basically means that this little workaround allowed the server to basically read and process files uploaded by anyone. So here's where it gets a lot more interesting and here's where AI is coming in. So they started with Opus 4.8 working on this thing to see how they can hack it if they can find some vulnerability. So this was shortly before Opus 5 was released.\n\n[00:00] So they're using the best available model to to find these vulnerabilities. But Opus 4.8 well it found some security issues that should have been patched but weren't. Basically, you have this whole database, the CVE, common vulnerabilities and exposure. So, this keeps track of all of these sort of these little hacks and vulnerabilities. So, when somebody discovers it, they log it, it gets reported, and then it gets logged and put into this database, this catalog of known hacks. And even though some of these software companies, they knew about the hack, it was reported to them, most likely. They did patch some of their stuff, but they did not document it as a security fix, and it wasn't kind of put into that catalog of hacks, the big book of hacks, if you will. So, that likely allowed a lot of different softwares to still have that vulnerability even though it should have been patched across the entire ecosystem.\n\n[00:00] So, the point is they figured out on July 5th, so one day, right, they were able to figure out with Opus 4.8 create this magic code execution exploit and specifically it was a heap buffer overflow. So you can think of that as like let's say the waiter comes up and he starts taking your order. He's got his little notepad where he wrote down everyone's orders and you say oh I have my order here and this little sticky note here's uh the sticky note or whatever like a little folded up crumpled piece of paper. You tell them just go ahead and unfold it and that will have my order. So the waiter starts unfolding it, but that note is just getting bigger and bigger bigger bigger than his little notepad. So basically that's what a buffer overflow is, is is writing so much that it overflows the memory. So you can imagine that little piece of paper, that note just taking over the entire notepad. I think that analogy works.\n\n[00:00] I'm going to stick with it. So the point is you're able to write whatever you want on the waiter's notepad. You're able to like take it over and write over it. So then Opus 5 gets released. Now up to this point, Opus 4.8 8 it couldn't crack it. So it it did help find that vulnerability but they couldn't use that to crack open discourse that community forum software but Opus 5 gets released and guess what happens? Opus 5 could do it. So that was the evening of July 24th.\n\n[00:00] By 6:00 a.m. on July 25th they got everything going and by you know same day 10:00 a.m. they managed to do remote code execution on OpenAI's instance. So remote code execution, basically taking control, being able to run whatever they want on OpenAI's, you know, infrastructure on their servers. How did they trick Opus 5 into doing it? Well, they made it look like the capture the flag target. So they made it look like an exercise and as soon as they confirmed it, they sent the report to OpenAI. Then they took over an OpenAI's employee account who had their codecs connected to OpenAI's GitHub.\n\n[00:00] Right? Right. So this is an employee probably doing development on whatever OpenI is working on on their infrastructure, their testing, Chad GBT, backend code, whatever. It's connected to their repository. So they use the fact that employee was logged into the form to then see if they can start doing whatever they want to the codebase that OpenAI has. And so basically just to prove that they can do it, they made some edit to something that was supposed to be for OpenAI employees only. opening asked them not to reveal that screenshot. So this is kind of a mockup, but it looks like, you know, they probably just replaced whatever it was or add a new file and said Hacktron AI team.\n\n[00:00] And now, of course, they reported to everyone that was involved so that everybody could, you know, patch everything up. And they're warning that this might be an issue, the single sign on for for codecs that might be connected to your GitHub. the fact that it's also something that you're using to sign into other places that could have these vulnerabilities. They're saying this could happen again. This wasn't discourse specific. So, they they went through one back door, but they're saying there could be a lot more. And so, this hack took a few days for an agent and just a few hours of human time. The entire research project kind of leading up to this, you know, it took more than two months and cost less than $3,000 in tokens in total.\n\n[00:00] Then they took AI models and they told them to go after a whole bunch of other companies with that exploit. As they say here, the AI started almost blind and adapted the exploit for each company within one or two days. So once they had the exploit, they could just like replicate these autonomous AI agents and within a day or two, they were able to adapt it to go after, you know, they don't say who, they only name one name. They said, \"We are not aware of any company that detected the activity except Shopify.\" Even after thousands of images were sent and their image processors repeatedly crashed. So, congratulations to Shopify, Toby Ludke, who's the founder and, you know, CEO at this point. He's kind of into AI. He's talking about quite a bit. So, maybe they they're like getting ready for this.\n\n[00:00] But the fact that you can have an army of autonomous agents just like hacking everybody, adapting these strategies to to hack different companies and that no one's the wiser is kind of scary. And they're saying when code execution landed inside a sandbox or restricted environment, the models also helped with privilege escalation, lateral movement, and bypassing existing defenses. So the point is once the models were in they could do a lot more damage g gain a lot more control over whatever environment they were in and humans had to guide them. This is not completely autonomous not yet at least but the point that they make is that with AI the amount of damage that can be done greatly greatly increases strictly because one human can now oversee many different agents kind of guide them along but the amount of work getting done increased dramatically. So the big point here and this is the point that they're making is that what used to require like rare expertise now is really changing. AI is compressing how much work needs to be done to be able to do this effectively. So kind of a wild tale and also makes you think like what's happening behind the scenes because I mean this company is doing everything ethically and legally. This is their job.\n\n[00:00] But of course, we also assume that there's a lot of other people that are trying to do this, but for nefarious ends. And they're of course not disclosing whatever they're doing. And if they hack and are able to copy data over, no one might know. As Hackon here said, most of the companies they went after, they had no idea. Even though that image processing software kept rashing, they've like purposely, it seemed like it triggered the alarm to go off repeatedly and no one came to investigate what what that was, which is kind of scary. They they don't publish the names of the companies, but I'm curious kind of like what level because I mean Shopify is one of them, but are we talking about companies like Shopify? Shopify, if you're not aware, is a massively public traded company. It's 165 billion.\n\n[00:00] They do a big chunk of the online e-commerce. A lot of the smaller shops that you see on the web that that aren't part of like Amazon, but a lot of them run on Shopify. So, if you've shopped online, you've likely used Shopify or stores that run on Shopify without even knowing it. But, are they saying that they were trying to hack companies of this level? And those companies had just no idea this was happening because that would be kind of scary. And looks like Hackron, they're not stopping and they're going to go after just everybody. Apparently, the Hive thing is something that's used for iPhone images or or Mac images that are produced. And they're saying that they've uncovered attack paths that affect OpenI, Slack, Meta, GitHub, Enterprise, Rails, Nex.js, Image Magic, and others.\n\n[00:00] So again, this is I got to say great news if you look at it from a certain perspective because these people are working hard to find these back doors, these vulnerabilities and talk about them and publish them. So hopefully a lot of the software that we rely on, a lot of the companies that we use, hopefully they'll be able to patch things up before things get kind of bad. But that's kind of the race that we're in right now. And the fact that OpenAI got hacked, that is the most crazy thing to hear. That's quite a headline because it's one of the most important AI labs in the world. You don't expect to see stuff like this happening. So, let me know what you thought about all of this. If you made it this far, thank you so much for watching.\n\n[00:00] My name is Wes Roth and I'll see you in the next\n\n\n", "creation_timestamp": "2026-09-19T12:16:56.791964Z"}