The PS5 homebrew story I have been quietly following for the last year just hit a wall, and it is worth writing down because it is a preview of how every future locked-down-hardware project is going to play out. Andy Nguyen, the researcher who got a stock PS5 booting a working Linux desktop with Steam and emulators back in April 2026, announced he is done. The PS5 Pro port he was targeting for 2027 is not happening. The code is still public on GitHub, the repositories are not archived, and a new lead could pick it up tomorrow or could let it rot for a decade.
Why he quit is the more interesting part, and it has nothing to do with Sony.
What Andy actually built before all this
In April 2026, Andy Nguyen demonstrated a working Linux build running Steam and several emulators on unmodified retail PlayStation 5 consoles. Not a hackathon demo, not a controlled capture. A real install path that worked across the original PS5 and the PS5 Slim, and on firmware versions from 3.00 through 7.61. That span matters. Any user with an unpatched console could follow the published instructions and reproduce the result.
He was also mid-way through a port to the PS5 Pro, with his own stated target of 2027. That work has now stopped. No commits, no archive notice, no public statement beyond the announcement. Just a quiet end to a public project.
Why the project ended in public
The proximate cause was a single hypervisor bug. Andy had been holding the bug privately so people could keep buying and playing PS5 games without fear of bricking anything. That kind of coordinated hold is the slow lane of security disclosure, and it works as long as nobody else finds the same bug while you wait.
Someone else found it. Within the same window. According to the public account from the second researcher, who goes by Jordy, he ran an AI assisted search and located the same flaw in hours, with no contact with Andy. He says he agreed to coordinate, then changed his mind when a third researcher appeared to be closing in on the same finding. He posted to HackerOne (a third party platform where researchers sell vulnerability reports to companies). Sony now knows. A public patch is a matter of when, not if.
That is the version both sides have put on the record. Andy responded by walking away.
The disclosure system worked exactly the way it was designed to
If you have ever reported a vulnerability to a large hardware vendor through a bounty program, none of this is new. The cycle is the same every time.
- Researchers race to be first, because the bounty only pays once.
- Vendors patch as fast as their QA (quality assurance) cycle allows.
- Anything that depended on the unpatched behavior has until the patch ships to keep working.
- Coordination is possible in theory and almost impossible once a third party enters the picture.
In 2026, AI tooling is the new variable. Discovery that used to take a week of careful reverse engineering (picking apart compiled code to understand how it works) now takes hours. Researchers who would have independently found the same bug months apart are arriving at the same finding in the same week. Disclosure timelines are no longer paced by humans. They are paced by inference latency on somebody’s GPU cluster.
That is not a Sony specific problem. It is the next decade of every coordinated disclosure plan that involves closed source consumer hardware.
Why this is bigger than one project
PS5 Linux was always a small project, but the principle generalizes fast.
- Every homebrew ecosystem for locked down consumer hardware rests on at least one unpatched vendor bug.
- Once that bug is known, the timeline is set by the vendor’s patch cadence, not by the homebrew project’s plans.
- AI assisted discovery is shortening the average time between a vendor leaving a bug live and a third party finding it.
- Slow coordinated disclosure is now mostly a courtesy the researchers grant each other, with no enforcement.
If you care about running your own software on hardware you bought, expect more of these. The interesting homebrew work for the rest of this decade is going to be the projects that figured out how to live within weeks of public disclosure instead of months.
The code is still on GitHub, and that is the part that matters most
Andy has not pulled any of the repositories. The PS5 Linux project is still live, the issues tab is still readable, and the fork button still works.
- The current code path targets the original PS5 and PS5 Slim on firmware 3.00 through 7.61.
- PS5 Pro support never made it to the repo, so a Pro port would start from a blank tree.
- Contributing is straightforward for anyone with homebrew or hypervisor background and access to a test console on a supported firmware.
- The maintainer seat is open, and that is rarer than it sounds.
For a community that has watched larger projects get archived mid stride, having working code that a new maintainer can pick up is not nothing. It is the entire handoff.
What you should actually do this week
Three short suggestions, depending on who you are.
Console owners on firmware 3.00 through 7.61 who have ever wanted to try the Linux build should stop updating today. There is no public patch yet, but the moment Sony ships one, your window closes. There is no warning ahead of time.
Developers with homebrew or hypervisor background have a more direct path. The PS5 Linux repositories are waiting for a new lead. Fork, read the open issues, look at the recent commit history, and decide whether you want to be the person who picks this up.
Spectators from the outside have a simpler takeaway. AI tooling has changed the speed at which secrets stay secret, and the next ten years of homebrew work on locked down consumer hardware will be shaped by that fact. Take it seriously.
Trade-offs
Anyone thinking about coordinating their own disclosure in 2026 should look closely at the cost of the slow lane. Assume the bug you found yesterday is also being found by someone else’s AI tooling right now. The old 90 day default no longer protects you. Coordinate accordingly, with a much shorter window than feels reasonable.
The maintainer side of this story is worth saying out loud. Andy worked on a project for years, in public, and got nothing for it except the work and the abuse. When the upside disappeared, walking away was the right call. There is no shame in that. The cost is borne by the rest of us, who lose a maintainer for a project nobody else is signed up to run.
Everyone watching from the sidelines gets a quieter reminder. Open hardware work on locked down consumer platforms runs on a tiny number of people deciding the project is worth their time. The next maintainer to quit will not make the news. Send one of them a thank you this week, while they are still doing it.
If you want to keep following the homebrew side of this story, set a watch on the repository. The next commit will tell you whether the project has a future or has quietly joined the long list of archived homebrew trees that nobody ever revived.