Hacktron Flags Active Astro Server Vulnerability, Urges Upgrade to 7.2.8

Hacktron's tweet urges anyone running an Astro server to upgrade to version 7.2.8, saying the vulnerability is 'all over the internet' but declining to publish its own proof-of-concept code. The alert points to an underlying critical remote code execution flaw in libheif, the library Astro's default Sharp-based image service uses to decode AVIF images; a malicious AVIF file processed through that pipeline can trigger the bug.

This is the same libheif decoder that Hacktron's own researchers separately investigated in a months-long project called HEIF Heist, which traced related bugs in the library across Node.js frameworks including Astro, along with Slack, Meta, and GitHub Enterprise. That broader research explains why Hacktron would already know the technical details of an Astro-specific bug without needing to publish a separate proof of concept here.