Skip to content
ThreadOut

Harsh Jaiswal

@rootxharsh · view on X ↗

Co-founder and research @hacktronai | auditing at @cure53berlin | prev @zomato @vimeo @pdiscoveryio @httpvoid0x2f

  • 24.2K followers
  • 1 thread on ThreadOut

Unrolled threads

Every thread by Harsh Jaiswal that readers unrolled on ThreadOut.

Harsh Jaiswal@rootxharsh

We’re disclosing HEIF Heist, a months-long investigation into libheif that allowed us to hack OpenAI, Slack, Meta, GitHub Ent, Rails, Next.js, ImageMagick, and many more. It was literally xkcd #234,...

SummaryResearchers disclosed HEIF Heist, a months-long investigation revealing critical vulnerabilities in the libheif image library that could allow remote code execution and data theft across major tech companies including OpenAI, Slack, Meta, and GitHub. The vulnerability exploits an obscure C/C++ decoder beneath numerous applications and affects systems through indirect dependencies via ImageMagick and other libraries.Sep 18, 20265 tweets♥ 2.1K