Hacker News

Top stories

Live mirror
30 storiesupdated just nowView source snapshot
  1. Cloudflare Quick Tunnels(cloudflare.com ↗)
    52comments
  2. An Empirical Study of Harness Design for Coding Agents(arxiv.org ↗)
    26comments
  3. North Korean nuclear test sets off years of earthquakes(science.org ↗)
    30comments
  4. OpenJev(openjev.com ↗)
    193comments
  5. Show HN: Rickub – The Smartest Git in the Universe(rickub.com ↗)
    4comments
  6. I don't like passkeys(hawksley.dev ↗)
    408comments
  7. Mathematicians Build Long-Awaited Graph Sandwich(quantamagazine.org ↗)
    discuss
  8. The Shadows Lurking in the Equations – Underwater Islands(gods.art ↗)
    8comments
  9. NATS publishes preliminary report on technical incident of 8 September(nats.aero ↗)
    13comments
  10. Bend 2 and the Vibe-Coding Trap(liampwll.com ↗)
    199comments
  11. GrassLobster: AI Agentic Generation of Parametric Geometry Workflows(miro.vision ↗)
    discuss
  12. Jemalloc 5.4.0(github.com/jemalloc ↗)
    67comments
  13. The scourge of x86 emulation(fex-emu.com ↗)
    63comments
  14. Cekura (YC F24) Is Hiring(ycombinator.com ↗)
    discuss
  15. Build Faster Feedback Loops Using Qualitative User Research(nseldeib.com ↗)
    discuss
  16. Warren Buffett Steps Down as Berkshire Chairman, Names Son to Replace Him(nytimes.com ↗)
    129comments
  17. Bonsai 2 27B: Near-Lossless Compression in a 9x Smaller Footprint(prismml.com ↗)
    172comments
  18. ZCode, the GLM coding agent, silently uploads your Git history(tokenstead.ai ↗)
    53comments
  19. Bend – A language that blocks AI mistakes via proof, on CPU and GPU(bend-lang.com ↗)
    287comments
  20. Qwen 3.8 Omni Flash(qwen.ai ↗)
    106comments
  21. Microsoft exec called AI scraping 'the largest theft of labor in human history'(techcrunch.com ↗)
    567comments
  22. BeanShell3 in Development(beanshell.github.io ↗)
    7comments
  23. Second Circuit Allows Government to Search Electronic Devices at the Border(knightcolumbia.org ↗)
    28comments
  24. How to Write with an LLM(sockpuppet.org ↗)
    175comments
  25. When the fractional part of a float fixes your shader(crocidb.com ↗)
    16comments
  26. Pre-Greek: The lost language hidden within Ancient Greek(linguisticdiscovery.com ↗)
    57comments
  27. AI is an elite crime spree(thebignewsletter.com ↗)
    1comments
  28. US Treasuries Have Become Unappetizing for Foreign Central Banks and Governments(wolfstreet.com ↗)
    1comments
  29. HEIF Heist: image parser RCE exploit(heif-heist.com ↗)
    2comments
  30. Replacing Pull Requests with Delta(zed.dev ↗)
    60comments

HEIF Heist: image parser RCE exploit

7 pointsby 2h agoheif-heist.com
2 comments
11m agoHN ↗

The one thing you'd expect on a website like this: how the exploit works, is missing.

The entire thing feels like marketing.

3m agoHN ↗

I mean, they kind of do? I assume they're hesitant to write a how-to on how to tailor the exploit image:

These are not out-of-the-box exploits. Exploitation requires fingerprinting the target version and tailoring the payload image(s). Some of our RCE attempts landed only after thousands of image uploads. That said, an AI agentic approach with a frontier model like GPT-5.6 Sol cut exploit development time down to roughly 1 to 3 days from initial probe to remote RCE. A motivated attacker can convert a vulnerable upload endpoint into RCE or an info leak.