Principal Vulnerability Researcher | Master of Pwn | Pwn2Own
Joined June 2020
- Tweets435
- Following256
- Followers4.2K
- Likes712
Pinned Tweet
The following multi-part blog series will cover how I developed the mast1c0re exploit on both the PlayStation 4 and PlayStation 5. Stay tuned for the remaining blog posts. mccaulay.co.uk/mast1c0re-int…
McCaulay retweeted
Bye bye bridge @_McCaulay exploited the Philips Hue Bridge Pro winning $5,000 and 2 Master of Pwn points with a 4 bug collision #Pwn2Own
Home Assistant Green falls again 🍀
Last year's #Pwn2Own go2shell chain is now public.
There's no place like 127.0.00.1 🏠
mccaulay.co.uk/go2shell-root…
@_McCaulay strikes again and down goes Home Assistant Green once again! With a 6 bug chain, including 1 collision and 5 zero-days, the net total winnings is $7k & 2.75 Master of Pwn points #Pwn2Own
McCaulay retweeted
Very groovy. @_McCaulay exploited the Canon imageFORCE 1643F in short order. He heads off to the disclosure room to explain himself. #Pwn2Own #P2OIreland
McCaulay retweeted
@_McCaulay strikes again and down goes Home Assistant Green once again! With a 6 bug chain, including 1 collision and 5 zero-days, the net total winnings is $7k & 2.75 Master of Pwn points #Pwn2Own
McCaulay retweeted
@_McCaulay climbs the leaderboard with his third target earning another 1.5 master of Pwn points and $6750 for his exploit of Garmin Index BPM with 1 collision and 1 unique bug. Another two entries from @_McCaulay to come, stay tuned! #Pwn2Own
McCaulay retweeted
Confirmed! @_McCaulay used 3 bugs (incl Hard-coded Credentials, Missing Authentication for Critical Function, Command Injection) to exploit the Canon imageFORCE 1643F. His 2nd round win nets him $10,000 and 2 Master of Pwn points. #Pwn2Own
McCaulay retweeted
Seriously Sweet! @_McCaulay got his reverse shell going on the #Sonos Era 300. If confirmed, it's worth $50K and 5 Master of Pwn points. He's off to the disclosure room to explain how he did it.
McCaulay retweeted
Excited to be speaking here next month! Look forward to being able to give more details on USB exploit engineering and the tooling we have been building.
The wait is over! 🚀 The talks for Hexacon 2026 are officially out, and the lineup is absolute fire 🔥
hexacon.fr/conference/speake…
McCaulay retweeted
I'm so freakin sick of how Claude talks.
It's not just annoying, it's infuriating.
The honest evaluation: it's the precise mechanism driving my current headache.
It's the load-bearing root cause of my daily stress.
It's genuinely painful, and that matters.
McCaulay retweeted
Exciting news! I'm hiring experienced vulnerability researchers @theZDI.
Do you love VR, sharing your work, and want to run categories at Pwn2Own? Come work with us (remotely).
Apply here: trendmicro.wd3.myworkdayjobs…
Feel free to DM me if you have any questions.
IKE VPN Client: Can I skip authentication? Check Point: Sure!
Happy Friday!
We're back with our analysis of Check Point's friendly CVE-2026-50751, an Authentication Bypass in their.. security-boundary-enforced-by-authentication SSL VPN products...
Enjoy!
labs.watchtowr.com/marking-y…
McCaulay retweeted
When Your VPN Opens Your Private Network to the Public!
An auth bypass in Palo Alto PAN-OS CAS Auth (CVE-2026-0265) that lets an attacker connect to the company's GlobalProtect VPN.
Blog - hacktron.ai/blog/cve-2026-02…
McCaulay retweeted
CVE-2026-0265, the PAN-OS auth bypass (when Cloud Auth Services are enabled) was fun to reproduce and load into the watchTowr Platform.
Our friends @ @HacktronAI are publishing their analysis this week, so we won’t be publishing. Looking forward to it 🚀
RCEliteLLM - Chaining an Environment Variable Leak with Jinja2 SSTI for Remote Code Execution
mccaulay.co.uk/rcelitellm-li…
Looking for the POC/code? Look no further: github.com/McCaulay/RCEliteL…
Full technical details are at mccaulay.co.uk/rcelitellm-li…
