Hacktron's security team published HEIF Heist, the fuller account of the libheif research that first surfaced two days ago in an OpenAI account takeover chain. The new disclosure shows the same class of memory corruption, information disclosure, and RCE bugs reaching well beyond OpenAI: Slack, Meta, GitHub Enterprise, Rails, Next.js, and ImageMagick all pull in libheif indirectly, through common intermediaries like libvips, Sharp, Linux distro packages, and container base images, not as a direct dependency. That indirection is the real risk: a team can carry the bug without libheif ever appearing in its own manifest. Hacktron says it will publish per-platform technical write-ups over the coming weeks rather than all at once, so the scope of confirmed impact will likely keep growing. The research is credited to three named Hacktron researchers.