A researcher known as Jordy reportedly received a $50,000 Sony bounty after privately reporting a PS5 hypervisor vulnerability he says he found with generative AI. The report sparked backlash because researchers and homebrew users wanted to preserve a possible route to running Linux on the console. But public reporting does not conclusively establish that Jordy’s rewarded flaw was the exact vulnerability behind the Linux project—or that it alone caused the reported project shutdown.
2
5
8
What Jordy reported—and what the vulnerability could do
Reports say the vulnerability affected PS5 firmware versions 13.60 through 14.00. Jordy said generative AI helped him find it, and that he submitted it privately to Sony through HackerOne, receiving a $50,000 bounty. The flaw was described as enabling kernel-level code execution, a capability researchers could use to run Linux on the console.
2
5
7
That Linux possibility is central to the backlash. For homebrew users, a vulnerability can be more than a security weakness: it may also provide a way to experiment with software Sony does not officially support. Critics objected that a private report could lead Sony to fix the flaw before that community work was ready.
3
5
Why Jordy reported it before the planned delay
Jordy said Google security engineer Andy Nguyen, known in the PS5 scene as theflow0, had independently found the same vulnerability earlier. According to reports of Jordy’s account, the two initially agreed to keep it private, with the hope of delaying disclosure until after the launch of Grand Theft Auto VI.
2
5
8
Jordy later changed course after hearing that another researcher had also found the flaw. He said he worried someone else might report it first and claim the bounty; the competing discovery also made him question how long secrecy could last.
10
39
The disagreement was therefore about more than accepting money. Sony’s bounty rewarded a private security report, while the homebrew community had an interest in keeping the vulnerability undisclosed long enough to continue developing a Linux option. Reports quoting Kaishaku creator madwax0r said users hoped to play the game on current firmware while retaining the possibility of running Linux.
8
44
Jordy also reportedly said the money would give him more time with his family, including his terminally ill mother. That is his stated personal reason for valuing the reward; it does not resolve the separate dispute over the consequences of disclosure.
10
34
The reported patch and the limits of what is confirmed
Several reports say Sony released firmware 14.20 on October 21, 2026, and patched a flaw. But the sources available here do not include a Sony advisory identifying the vulnerability, and reporting on the firmware’s patch notes says they mention usability changes rather than naming the flaw. The exact connection between the bounty report and the update is therefore not publicly confirmed in the material available.
1
11
The same caution applies to the Linux project. Reports associate Nguyen’s work with the hypervisor vulnerability and say he later quit the PS5 scene and halted Linux development, including planned PS5 Pro support. That reported sequence does not, by itself, establish that Jordy’s report was definitively the vulnerability used by the project or the sole cause of its end.
2
8
13
The clearest account is a clash between responsible private disclosure and the homebrew community’s wish to preserve an exploit for Linux development. Jordy says he acted after the flaw was independently found again; critics focus on the possibility that reporting it early closed off a path they hoped to keep. The technical link between the report, the reported patch and the project’s fate remains incompletely verified.
8
10
11