Bobby Gould

Sr. Vulnerability Researcher @thezdi

[TrendAI Zero Day Initiative @thezdi]

CVE-2026-35273: SSRF to RCE in Oracle PeopleSoft. ZDI's @bobbygould5 provides a deep dive into the bug(s) used in the recent PeopleSoft attacks. His analysis includes root cause and video demo. https://t.co/ibIEwrcWnp

[T. @trendytofu]

We are hiring for vulnerability researchers! If you are at @offensive_con, let’s chat!

https://t.co/uMZEPtfrLy

[Bobby Gould @bobbygould5]

Take Everything - 2025 Texas A&M Football Playoff Hype

[Bobby Gould @bobbygould5]

@stephenfewer @thezdi @rapid7 Great working with you this week, looking forward to seeing more research from you guys in the future!

[Stephen Fewer @stephenfewer]

As Pwn2Own Ireland draws to a close, a huge thank you to @thezdi for putting on another great contest! I reflected on why @rapid7 has taken part at #Pwn2Own over the last 2 years, & our success so far in the world of competitive zeroday exploit development https://t.co/nqNBWeHXAH

[Bobby Gould @bobbygould5]

@SinSinology @thezdi @TrendMicro Congrats guys, great work!

[TrendAI Zero Day Initiative @thezdi]

The Master of Pwn trophy for #Pwn2Own Ireland has arrived. Quoth this raven - hack some more. #P2OIreland

[Piotr Bazydło @chudyPB]

I joined Sonny and added quite nice pre-auth RCE chain, which contains argument injection -> auth bypass vuln 🫡

[Nir Ohfeld @nirohfeld]

We (+@ronenshh) hacked NVIDIA's Triton AI server by abusing a single error message🚨

The result is unauthenticated RCE allowing attackers to compromise the server and steal proprietary AI models🤯

For more details & mitigations check out our blog @wiz_io https://t.co/v5kpI1eedL

[Piotr Bazydło @chudyPB]

Btw, I described my SharePoint CVE-2024-38018 at a PL conference last year, and they've recently uploaded it.
I guess you don't know Polish, but slides are in English 😅 RCE part starts at 30:30
https://t.co/rejuy5i0EC

[TrendAI Zero Day Initiative @thezdi]

Announcing #Pwn2Own Ireland for 2025! We return to the Emerald Isle with our new partner @Meta and a $1,000,000 WhatsApp bounty. Yes - one million dollars. Plus new USB attack vectors on phones and more. Check out the details at https://t.co/dgHvL8QC2R

[Bobby Gould @bobbygould5]

I had the opportunity to share a technical write up for the critical vulnerability I found in Cisco ISE, which Cisco deemed as a 10/10 severity.

There are some great lessons to be learned, both for bug hunters searching for exploits and Java devs seeking to secure their own code

[TrendAI Zero Day Initiative @thezdi]

CVE-2025-20281: Cisco ISE API Unauthenticated Remote Code Execution Vulnerability: Trend ZDI analyst @bobbygould5 details this bug and another that may be a dupe. He also shows how it can be exploited. https://t.co/qZ2uBpq8yO

[Bobby Gould @bobbygould5]

@chudyPB I learned from the best!

[TrendAI Zero Day Initiative @thezdi]

CVE-2025-20281: Cisco ISE API Unauthenticated Remote Code Execution Vulnerability: Trend ZDI analyst @bobbygould5 details this bug and another that may be a dupe. He also shows how it can be exploited. https://t.co/qZ2uBpq8yO

[TheZDIBugs @TheZDIBugs]

[ZDI-25-609|CVE-2025-20281] Cisco Identity Services Engine invokeStrongSwanShellScript Command Injection Remote Code Execution Vulnerability (CVSS 9.8; Credit: Bobby Gould (@bobbygould5) of Trend Zero Day Initiative) https://t.co/6ejoxC3GWT