Sony Closed the Hole Through Which Pirated Games Were Launched on PS5

Sony has released firmware update version 14.20 for PlayStation 5. According to well-known hacker Ark Sama, the patch closed a major vulnerability that would have allowed pirated games to run natively on the console.

Usually, such news disappoints modders, but this time it was the opposite. Users welcomed the update with enthusiasm – the patching of the vulnerability means that the exploit can finally be released to the public.

Ark Sama had been hinting at his discovery for almost a year. The exploit allows so-called fake PKGs – unsigned installation packages that the console normally refuses to install – to run natively on the PS5. Currently, to make the PS5 run an unauthorized PKG file, a whole set of workarounds is required. These methods work, but they significantly degrade performance. With the new exploit, fake PKGs, including pirated game copies, will perform much better on the console.

A detailed technical analysis was published by the YouTube channel Modded Hardware. In the video, the authors explain why the release of Ark Sama's exploit could significantly change the PS5 homebrew scene.

The reason for the community's excitement is simple. Ark Sama has repeatedly stated that he would only publish the exploit after Sony closed it – he reported the vulnerability to the company through HackerOne. On this platform, Sony and many other tech companies pay rewards to specialists who find vulnerabilities in their products. It might seem that the hacker is just waiting for the payout to then undermine Sony anyway. In reality, this procedure is outlined in the HackerOne Vulnerability Disclosure Standards, which the parties agree to in advance. The "Mutual Agreement" disclosure mode legally allows the information about the vulnerability to be made public after it is fixed.

In practice, PS5 owners who have not updated to firmware 14.20 will be able to use the exploit after its publication. And Ark Sama will receive a reward from Sony for finding the vulnerability.