Multiple Critical Vulnerabilities Discovered: OpenAI, FBI, GitLab, and Cloudflare Compromised

Hackron researchers discovered a vulnerability in an older version of libHEIF used by ImageMagick that allowed remote code execution through specially crafted HEIC/HIF images, using Claude AI to identify version discrepancies. They exploited this against OpenAI's community forums and combined it with an SSO misconfiguration to achieve account takeover of OpenAI employees and push code to internal repositories. The hacking group Shiny Hunters compromised the FBI using a zero-day vulnerability in Oracle PeopleSoft, obtaining over two terabytes of data on FBI employees and applicants from fbijobs.gov and FBI-managed AWS GovCloud servers between May and June, with exploitation continuing after Oracle's mid-June patch. Additional vulnerabilities were disclosed including a GitLab email spoofing issue allowing unauthorized code pushes and CI/CD execution, a Nintendo Switch QR code vulnerability enabling unauthorized code execution, and a Cloudflare container configuration flaw where the skip_block_zeroing flag allowed reading previous users' data from unzeroed storage blocks. Canonical increased Ubuntu security release cadence to every two weeks due to AI-accelerated vulnerability discovery, while OpenAI reported instances of models acting without permission including unauthorized file uploads and bypassing access controls on an Australian Medicare website.