A PlayStation 5 security researcher has received a $50,000 bounty through Sony’s vulnerability disclosure program, reigniting a dispute over a hypervisor exploit used in PS5 Linux development. The researcher, known online as Jordy, says he reported the vulnerability despite an earlier agreement to delay disclosure until after Grand Theft Auto VI launched.
The payment is publicly listed on Jordy’s HackerOne profile under PlayStation, confirming the $50,000 reward. However, the public bounty record does not identify the vulnerability’s technical details, meaning its connection to the disputed hypervisor exploit rests on the researcher’s account rather than a detailed disclosure from Sony.
Jordy, who uses the HackerOne username 2tonejordy and the X account couldbeautism, publicly acknowledged the payout on October 14, 2026. The announcement attracted criticism from PlayStation homebrew enthusiasts who believed the vulnerability should have remained undisclosed to preserve Linux compatibility on newer PS5 firmware.
The disagreement involves security researcher Andy Nguyen, also known as TheFlow, who had been developing methods to run Linux on Sony’s console. Nguyen previously demonstrated Linux running on PS5 hardware and had plans to expand support to newer systems, including PS5 Pro.
According to statements from the researchers, Nguyen had discovered the hypervisor vulnerability earlier and wanted to postpone reporting it to Sony. His intention was to preserve the possibility of running Linux while allowing players to purchase and play GTA VI when it launched.
Jordy subsequently discovered the same vulnerability using AI-assisted research. In comments obtained by IGN, he explained that he initially agreed to delay disclosure but reconsidered after another researcher independently identified the flaw using similar tools.
Jordy argued that once multiple researchers had independently discovered the vulnerability, somebody else could report it first. He ultimately submitted the issue through Sony’s vulnerability reporting program.
The decision prompted a public response from Nguyen on September 15. He announced that he was stepping away from PS5 security research and discontinuing his work on PS5 Linux, including plans to complete PS5 Pro support for a 2027 release.
Nguyen also criticized the growing use of large language models by researchers who identify vulnerabilities without necessarily understanding the underlying systems. His comments reflected a broader disagreement over AI-assisted security research and whether potentially useful exploits should be reported immediately or retained for homebrew development.
The controversy has direct implications for PS5 Linux compatibility across newer firmware and PS5 Pro hardware. The PS5 Linux loader project lists support for firmware versions extending to 13.60, allowing compatible consoles to run Linux through vulnerabilities in Sony’s software.
Sony released PS5 system software version 14.20 on October 21, 2026. Reports indicate that the newer firmware addresses the relevant exploit, although Sony has not publicly identified the specific vulnerability associated with Jordy’s bounty or provided a detailed account of the patch’s coverage.
For owners experimenting with Linux, firmware compatibility remains important. Updating a console can close vulnerabilities required by existing installation methods, while retaining older firmware may restrict access to games or services that require newer system software.
That creates a potential conflict ahead of GTA VI. Players using firmware-dependent Linux modifications may need to choose between maintaining their existing setup and installing updates required for newer releases. Whether GTA VI specifically requires firmware that blocks the exploit has not been independently established.
The dispute also highlights the expanding range of unofficial PS5 software projects. Beyond Linux installation, developers have experimented with running Steam PC games on modified PS5 consoles and emulating original Xbox games on jailbroken PS5 hardware.
Sony’s official bug bounty program provides financial rewards to researchers who responsibly disclose security vulnerabilities. Jordy’s $50,000 payment demonstrates the potential value of such discoveries, while the response from the homebrew community illustrates the competing priorities between vulnerability disclosure and preserving access to unofficial console functionality.
The Linux project remains available for compatible systems, but Nguyen’s withdrawal leaves the future of his planned PS5 Pro development uncertain. Other researchers may continue exploring the platform, although no publicly verified replacement for the disputed hypervisor vulnerability has been established.
