# SemiAnalysis 借 HEIF Heist 漏洞事件谈 Neocloud 设计中的单点故障

- 来源：SemiAnalysis (@SemiAnalysis_)
- 发布时间：2026-09-19 11:15
- AIHOT 分数：57
- AIHOT 链接：https://aihot.news/items/cmu7ud5rm0qxorograrzn1a7a
- 原文链接：https://x.com/SemiAnalysis_/status/2101148029474550074

## AI 摘要

SemiAnalysis 转发 @rootxharsh 披露的 HEIF Heist 调查，称研究者通过 libheif 图像库漏洞攻破了 OpenAI、Slack、Meta、GitHub Ent、Rails、Next.js、ImageMagick 等众多应用，形如 xkcd #234 描述的依赖链条。SemiAnalysis 借此指出单点故障不限于冷门图像库，并在推文串中表示 Neocloud 上存在大量糟糕设计。

## 正文

Single points of failure are not limited to obscure image libraries. We see plenty of bad designs on Neoclouds. (1/5)🧵
https://x.com/rootxharsh/status/2100801820960620574?s=20

### 引用推文

> Harsh Jaiswal：We’re disclosing HEIF Heist, a months-long investigation into libheif that allowed us to hack OpenAI, Slack, Meta, GitHub Ent, Rails, Next.js, ImageMagick, and ...