This isn't new, and it certainly isn't specific to JPGs. It's quite frequent for people to embed malicious code into files masquerading as images. There has als

This isn't new, and it certainly isn't specific to JPGs. It's quite frequent for people to embed malicious code into files masquerading as images. There has also been instances where hacked WordPress instances[1] hide code inside images so they aren't so obviously found ready for execution at a later date The most common way to exploit this however is by uploading an image with a valid magic number (e.g. GIF89a) which will any mime type checks and then finding a way to rename that file to one with an executable extension, or finding a way to include it through an LFI vuln. A simple solution is to simply load the image up in ImageMagick (or GraphicsMagick, GD) and re-write the image to disk. Disclaimer: Former lead developer of an image hosting service [1] https://media.blackhat.com/bh-eu-12/Be'ery/bh-eu-12-Be'ery-FYI_you_got_LFI-WP.pdf https://media.blackhat.com/bh-eu-12/Be'ery/bh-eu-12-Be'ery-F...