Hacker CTurt dropped a mini bomb on the scene by announcing he has received a $10k payment from Sony’s bug bounty on Hackerone. Rumors are spreading like wildfire that this could be an exploit for PS4’s latest firmware (8.52, excluding the ongoing 9.0 beta). The hacker hasn’t confirmed, or denied the rumors yet.

PlayStation have joined the hackerone bug bounty program a bit more than a year ago. The move has been bittersweet for the scene: while some of the major Jailbreaks of the past year came out of a full disclosure from the program (the recent 7.55 and 7.02 exploits were both based on submissions to the bounty program, both by TheFloW), the vast majority of reported exploits have been silently patched.

Is a PS4 8.52 Kernel Exploit incoming for the scene?

A $10k bounty on Sony’s platform is awarded for “high” to “critical” exploits. Knowing CTurt’s history with PS4 exploits, there’s no question that he could very well have found a new kernel exploit. CTurt is behind multiple kernel exploits on the PS4, that have led to Jailbreaks in the past (namely, the badIRET and dlclose exploits back in 2016).

In other words, the hacker was a driving force of the PS4 scene 5 years ago. But PlayStation wasn’t on the Hackerone bounty program then. This was then, and this is now. Independently of whether CTurt wants to disclose his exploit or not, being allowed full disclosure might not entirely be his choice.

Additionally, no details have emerged from this except the hacker himself saying he was approved for the bounty.

Just heard from PlayStation that I’ve been awarded a $10k bounty, thanks! 👀

— CTurt (@CTurtE) August 19, 2021

In particular, no information has surfaced on the HackerOne site about this vulnerability yet. People have jokingly stated that this could be a PS2 exploit (CTurt has “recently” released one), but the hacker mentioned older consoles are explicitly out of scope of the bounty program. So, this is definitely PS4 related (I’ll eat my shoe if this turn out to be PS5). But again, no hint of a release/disclosure.

CTurt’s profile on HackerOne. No bounty yet, but a “thank you” from PlayStation

Nonetheless, friendly neighborhood Zecoxao is advising people not to upgrade to the latest 9.0, and has been pushing the rumor a bit further into confirmation territory, by stating this is “probably” a 8.52 exploit. Zecoxao has close ties with most hackers on the scene, and might know something we don’t.

probably an exploit patched on 9.00 ps4. probably kernel. stay on 8.52 if you’re there! if you’re on 7.55 or below, DO NOT UPDATE!

— Nagatoro (@notzecoxao) August 19, 2021

Now, whether this is indeed a 8.52 exploit or not, it is important for people to stay calm. If confirmed to be a 8.52 vulnerability, there are a lot of things that would need to happen for this to turn into a release, in particular:

1. The exploit actually needs to be disclosed. Nobody has confirmed or denied whether this would happen at this point
2. The scene needs a user-level entry point, such as a webkit exploit, to be able to even launch the kernel vulnerability. We do not have that at the moment
3. All of this needs to be bundled in a user-friendly exploit. For the 7.55 exploit we’ve seen that this could sometimes take months, even when all the pieces are here.

So, take all of this with a huge bucket of salt for now, and stay tuned.