OpenAI Monorepo Breached via Unpatched Library and SSO Flaw, Not AI Exploit

·314 views

Three white-hat researchers — Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini — gained access to OpenAI's internal code repository in July 2025 through a chain of two ordinary software vulnerabilities. The breach exploited a missing Debian security backport in the libheif image-decoding library used by Discourse, the software powering OpenAI's community forum, combined with an SSO misconfiguration that granted excessive trust to that forum. The researchers used a Claude AI model to assist in crafting the exploit, but the AI reduced effort rather than introducing a novel attack category. After reaching the private monorepo, the team opened a single harmless pull request to prove access, read no sensitive code, and promptly reported the findings via OpenAI's Bugcrowd bug bounty program. OpenAI confirmed a fix within roughly 14 hours of the submission, Discourse published a security advisory, and the researchers were awarded $6,500 for the OpenAI-side finding.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

ElevenLabs and Murf.ai Compared for Enterprise Voice AI in 2026

An engineering analysis compares ElevenLabs, a research-driven platform focused on neural audio synthesis, low-latency streaming, and voice cloning, with Murf.ai, a studio-style tool built for voiceover production and localization. The review examines each platform's architecture, pricing structure, learning curve, API capabilities, integrations, and security certifications. ElevenLabs is presented as better suited to real-time conversational agents, developer-driven pipelines, and very low-latency streaming, while Murf.ai is positioned for corporate video, e-learning, and marketing content managed by non-technical teams. Both platforms are reported to hold SOC 2 Type II and GDPR compliance, though their approaches to commercial indemnification and voice watermarking differ. The author frames the choice as depending on whether a team prioritizes API throughput and latency or a timeline-based editing workflow.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Solo-Developed Megabonk Sells Over One Million Copies in Two Weeks Using Unity

Megabonk, a 3D survivors-style game built by solo developer Vedinad in Unity, launched on Windows and Linux in September 2025. The title reportedly sold over one million copies within two weeks and peaked at 117,336 concurrent players on Steam. The article argues that Unity suited the game's 3D movement, procedurally generated maps, and large volume of characters and items. Compared with Vampire Survivors, which had to be ported to Unity later, Megabonk started on the engine, avoiding a costly rewrite. The developer also withdrew the game from a Game Awards nomination, though the article notes that rough visuals drew some early criticism.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Automating Breach Notifications to Meet Fixed Regulatory Deadlines

Breach notification is framed as a race against a statutory clock, with Singapore PDPA guidance and GDPR Article 33 both requiring assessment and regulator notice within a set window. The article argues that automation only succeeds if the pipeline is built before an incident, since the clock begins at discovery rather than when a team convenes. It recommends that each case be created automatically from a monitoring alert, with the deadline calculated from the discovery timestamp and stored directly in the case record. The pipeline moves through four stages, from capturing the discovery event to scoping, dossier assembly, and dispatch, with human decisions limited to binary gates that fall back to predefined defaults when a time limit expires. Each stage is meant to produce signed, timestamped artifacts so that notification timelines can be verified during audits, and the author recommends tracking latency, gate timeouts, regulator rejections, and rework while running quarterly drills.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Two Sum: Why a Hash Map Turns an O(n²) Interview Problem Into O(n)

Two Sum asks for the indexes of two numbers in a list that add up to a given target, and it is one of the most frequently asked coding interview questions. The obvious brute-force approach checks every pair, which scales quadratically and becomes very slow on large inputs. A faster method reframes the problem: for each number, it checks whether the complement it needs has already been seen, using a dictionary for constant-time lookups. Storing each value only after checking for its complement prevents a number from pairing with itself. The author reports that this single-pass version ran roughly 1,800 times faster than brute force on a test input, and the advantage grows as the list gets longer.

0 comments Read more at DEV Community