Memorandum
- From
- Caroline Mercer via IGN Articles
- Date
- Filed
- Culture·5 min to read
- Re
Hacker Jordy Earns $50,000 From Sony for Reporting PS5 Exploit
ReHacker Jordy Earns $50,000 From Sony for Reporting PS5 Exploit
A hacker known as Jordy received a $50,000 bounty from Sony for reporting a PS5 hypervisor bug he found with AI, angering members of the PlayStation homebrew community who had hoped to keep the exploit secret until after GTA 6 launched.
A hacker known as Jordy has collected a $50,000 bounty from Sony for privately reporting a PlayStation 5 vulnerability, a move that has triggered an uproar within the console's homebrew community. Jordy found the flaw with the help of generative AI and submitted it through HackerOne, a platform that connects companies with security researchers who look for weaknesses in their products.
The bug is a hypervisor flaw affecting PS5 firmware from version 13.60 up to 14.00. A hypervisor bug is a fault in the core software or firmware layer that can allow an attacker to execute kernel code, for example to boot Linux on a machine not designed to run it. Sony's bug bounty model pays researchers to disclose such issues and then holds them back from publishing details until the company has patched the vulnerability.
What made the report controversial is the history behind the exploit. Andy Nguyen, a Google security engineer known online as theflow0, had been working for months to get Linux running on the PS5. He showed the results of that work in March, and according to Jordy, he had also discovered the same hypervisor bug in 2025 and kept it secret. Jordy said that when he announced his own discovery, theflow0 reached out to ask whether it was the same flaw. The two initially agreed not to report it to HackerOne.
Jordy said another researcher quickly found the same bug, and he decided to report it because, in his words, if he and another person could find it with a large language model, someone else could as well. The report closed the window for him to claim the bounty. theflow0 could not be reached for comment.
Members of the homebrew scene reacted sharply. theflow0 had reportedly wanted researchers to hold the bug until after November 19, the release date of GTA 6, so the launch-day firmware would still contain the unpatched flaw. Players could then update their consoles, buy the game legally, and still use the exploit to boot Linux on the same machine. madwax0r, creator of the PS5 emulator tracker and scam blacklist Kaishaku, told IGN that the goal had been to let players buy and play GTA 6 on the standard PS5 operating system without losing the ability to dual-boot Linux. He described the PS5 Linux project as a temporary soft-mod that reverts to a normal PS5 whenever the console is rebooted.
Jordy's report means Sony now has the opportunity to patch the exploit before GTA 6 arrives. Modders who want to run Linux are left with a choice: keep their console offline to retain the exploit, or install the latest firmware required to play GTA 6 and lose access to Linux. Jordy, whose mother is terminally ill, said he had decided to take the payout. Jordy himself has said he was affected by heavy personal pressure, and madwax0r said the financial certainty played a role in his decision.
Jordy's critics say the episode reflects a broader shift in the homebrew scene. madwax0r argued that hypervisor bugs were once rare enough that a researcher could hold one for a year, but that running console code through large language models now means several people can find the same flaw at once. theflow0 has announced he is stepping away from the PS5 scene and stopping all work on PS5 Linux, while Jordy has described the scene as having become a group of inexperienced users relying on AI tools. Some online commentators have said Sony deserved the exploit disclosure because of its plan to end physical discs by 2028, and madwax0r noted that some in the community may use such exploits to pirate games, including GTA 6.
Information security experts have labeled October as "Black October" because of several high-profile security incidents and vulnerability disclosures tied to the growing use of artificial intelligence in research. Jordy's report fits that pattern, and it has left the PS5 homebrew community divided over whether responsible disclosure or shared secrecy should guide the handling of exploits discovered with AI tools.
2
