Lots of organizations are excited about what AI can do to streamline their processes, save money, and juice margins. But AI's capabilities are founded on the data that AI accesses, and for many organizations that foundation is little more than sand. Pramod Sadalage and Prem Chandrasekaran write about how to build a reliable foundation of data that can be accurate and trusted.
A bug that could have allowed us to
HEIF Heist is Hacktron's name for a class of remote attack paths targeting services that decode attacker-controlled HEIF, HEIC, or AVIF images. By exploiting underlying native libraries, these vulnerabilities allow an attacker to bypass application-level defenses and trigger memory corruption, data exposure, or remote code execution (RCE).
The vulnerable attack surface lives below the application layer inside native C/C++ decoders such as libheif and libde265. These parsers typically enter production environments indirectly bundled via higher-level wrappers like ImageMagick, libvips, or Sharp, standard distro packages, and prebuilt container base images.
By probing upload endpoints with crafted .avif or .heic files, an attacker can fingerprint the remote libheif version family in use. Once identified, they can fire an exact version-matched n-day or 0-day payload to trigger memory corruption, data exfiltration, or remote code execution.
Everything up top is resting on something underneath.HEIF Heist began as part of the Hacktron research team's broader security research into frontier labs. After discovering and reporting a libheif RCE in Discourse, we asked a larger question: how many other applications depend on the same image-processing stack?
Past vulnerabilities such as ImageTragick, ForcedEntry, and the libwebp flaw have demonstrated the reach of an image processor or parser vulnerability. An image parser might generate an operating-system thumbnail or process a web upload, giving it an enormous blast radius.
That initial finding grew into a multi-month investigation tracing libheif across communication platforms, cloud services, enterprise products, and popular web frameworks.
Hacktron brings together top CTF researchers, experienced red teamers, and offensive security researchers. We use AI to accelerate security research, finding and eliminating vulnerabilities in widely trusted software before malicious actors do. We're continuing our research across frontier labs and other internet-critical systems. If you're responsible for securing one of them, we'd like to work with you.
Now with JSON output for coding agents
One command turns the server on your laptop into a public, encrypted URL on Cloudflare's edge. No account. No DNS. No open ports.
$
cloudflared tunnel --url <a href="http://localhost:8000" rel="nofollow">http://localhost:8000</a>
335+ CITIES~3S TO URL0 PORTS OPENEDFREE
cloudflared opens an outbound-only connection to the nearest edge location. Traffic to your tunnel URL rides Cloudflare's network back to your machine — encrypted, DDoS-filtered, and never touching an inbound port.
01 · YOUR MACHINE localhost:8000 Any framework, any port. Nothing inbound.
02 · CLOUDFLARE EDGE <a href="http://quiet-marble-otter-canyon.trycloudflare.com" rel="nofollow">quiet-marble-otter-canyon.trycloudflare.com</a>
TLS DDoS filter Anycast 335+ cities
03 · ANYONE, ANYWHERE Teammates & agents Browsers, webhooks, eval harnesses.
~3s Instant setup
No sign-up, no config file, no waiting on DNS. The URL prints before your coffee cools.
0 Ports opened
Outbound-only. Automatic HTTPS and edge DDoS mitigation come with every tunnel.
335+ Cities on the edge
A reviewer in Tokyo and a webhook in Frankfurt both hit the edge nearest them.
BUILT FOR THE AGENT ERA
Coding agents build, test, and review in loops. A Quick Tunnel gives every loop a real, reachable address — for a screenshot service, a webhook, an eval harness, or a human who wants to click around.
01
Structured outputHostname, edge, and health as JSON on stdout — no regex on logs.
02
Webhook-readyPoint Stripe, GitHub, or your own callbacks at a live URL instead of fixtures.
03
Ephemeral by designThe tunnel dies with the process. Nothing to revoke, nothing to clean up.
$ cloudflared tunnel --url <a href="http://localhost:8000" rel="nofollow">http://localhost:8000</a> --output json
{"level":"info","message":"Requesting new quick Tunnel on trycloudflare.com...","time":"18:22:23Z"}
{"level":"info","message":"Your quick Tunnel has been created! Visit it at:","time":"18:22:30Z"}
{"level":"info","message":"https://quiet-marble-otter-canyon.trycloudflare.com","time":"18:22:30Z"}
{"level":"info","message":"Initial protocol quic","time":"18:22:30Z"}
{"level":"info","message":"Tunnel connection curve preferences: [X25519MLKEM768 CurveP256]","time":"18:22:30Z"}
02 Run your app
Any web server, any port, any stack you already use.
npm run dev
03 Open the tunnel
Certificates, routing, and DDoS protection are handled for you.
cloudflared tunnel --url <a href="http://localhost:8000" rel="nofollow">http://localhost:8000</a>
04 Share the link
Send it to a teammate, a webhook, or an agent.
<a href="https://quiet-marble-otter-canyon.trycloudflare.com" rel="nofollow">https://quiet-marble-otter-canyon.trycloudflare.com</a>
A handy guide for tomorrow’s Talk Like A Pirate Day!
Log in
