Company
Bug bounty and vulnerability disclosure platform connecting client organisations with external security researchers.
Progress Software published 31 MarkLogic Server flaws on October 12, five of them critical. The 11.3.6 and 12.0.3 releases that fixed August's 10 flaws are affected. Fixes are in 11.3.7 and 12.1.0.
Reality
Hacktron chained an image-library bug in OpenAI's Discourse forum to a single sign-on misconfiguration, reached employee ChatGPT and Codex accounts inside 72 hours, and the repair OpenAI describes is a narrowing of token permissions.
Perspective Coverage
9 publishersReality
Hacktron AI chained a Discourse image-library flaw to a weakness in OpenAI's single sign-on and into the Codex environment in under 72 hours, after swapping Claude Opus 4.8 for Opus 5 to get a working exploit.
Perspective Coverage
4 publishersReality
Hacktron chained a heap overflow in libheif to an OpenAI SSO flaw and opened a pull request in OpenAI's internal monorepo in under 72 hours. The bug had been fixed upstream a year earlier, but the fix never reached Debian's packages.
Reality
The libheif bug was fixed upstream a year earlier without a security label or a CVE, so a Discourse image check that ignored HEIC left it reachable, and forum sign-in tokens carried full API access to the accounts behind them.
Perspective Coverage
6 publishersReality
CrowdStrike says the npm stealer's author has been active since November 2022, claims bounties from at least nine companies, and that none of the stolen logs have turned up for sale. It assesses with high confidence that an LLM wrote the code.
Reality
An IANS and Artico survey puts AI at about 3 percent of the average security budget, and 24 percent of organizations have given it a line of its own. Bugcrowd's CEO says the rest comes out of what was already bought.
Reality
Hacktron's path into OpenAI's internal repos ran through a libheif bug Debian had not backported and a single sign-on flow that trusted community.openai.com. The dev.to breakdown says the model changed what the attack cost. The category of attack was the same either way.
Reality