IGN reported on October 26, 2026, that Sony paid researcher Jordy $50,000 after he privately submitted a PlayStation 5 hypervisor flaw through HackerOne. The flaw could enable kernel-code execution and Linux booting on firmware 13.60 through 14.00. Tom’s Hardware reported that Sony’s October 21 firmware 26.07-14.20.00 update patched it.
What the reported PS5 bounty covered
A hypervisor is software that manages how a system runs. IGN reported that Jordy used generative AI to find a flaw in the PS5 hypervisor and privately sent it to Sony. The flaw could allow code to run at the kernel level, the core of the operating system, and could provide a way to boot Linux.
The reported reward became part of a dispute over when to disclose the vulnerability. IGN said Jordy and PS5 Linux researcher Andy Nguyen had agreed to wait until after GTA VI launched before reporting it. Jordy said he submitted the flaw after learning other researchers had found it too, reasoning that AI-assisted discovery could make it easier for others to find.
Nguyen later said he had found the same flaw earlier and criticized Jordy’s decision to report it. On September 15, Nguyen had publicly said he was stepping away from the PS5 scene and stopping his PS5 Linux work.
On October 14, Jordy posted that the reward could at least buy GTA 6. The post was his comment on the reported payment.
In Reddit discussions about the case, some commenters defended running Linux on hardware they own. Others argued that a $50,000 payment outweighed informal community recognition, while critics objected to how Jordy handled the disclosure.
The Linux setup and the firmware tradeoff
PS5 Linux was described as a temporary software modification, or soft-mod, that boots Linux from an external USB drive. madwax0r, creator of the Kaishaku project, explained that rebooting the console returns it to the regular PS5 operating system.
IGN reported that playing GTA VI at launch would require the latest system firmware and signing into PSN. For a console relying on the reported flaw, installing that firmware would remove this route to Linux. The consequence applies to setups depending on the affected exploit.
Tom’s Hardware reported that firmware 26.07-14.20.00 patched the flaw. Blaze2K’s commentary discusses the update and Sony’s published notes alongside speculation about a security connection.
FULU’s separate bounty has its own rules
FULU’s published PS5 bounty terms require claimants to be based in the United States. A US-based claimant meets that location condition; it does not by itself establish eligibility under every term.
FULU says it will not pay someone for a solution used to participate in Sony’s bug-bounty program. A September 30, 2026 update also excludes a hypervisor exploit disclosed to Sony before it was made public or shown to FULU. Under those terms, the same solution cannot be used to claim both rewards.
