ChatGPT SSRF bug quickly becomes a favorite attack vector

**Active SSRF exploitation (CVE-2024-27564) in ChatGPT's pictureproxy.php** — Threat actors are exploiting a medium-severity SSRF (CVSS 6.5) that allows unauthenticated injection of URLs into the url parameter, causing the server to perform arbitrary requests; Veriti observed >10K attacks in a week targeting US government and financial organizations and highlighted misconfigured IPS/WAFs as a common failure point.