PixiePoint Security

A Cybersecurity Consultancy Boutique that Provides Niche & Bespoke Research Services

[PixiePoint Security @pixiepointsec]

If you like 0-day and N-day research, we'll love to hear from you! https://t.co/VM6ZiophSh

[PixiePoint Security @pixiepointsec]

9% into 2026 and look what @cloudlldb already have... :)

[PixiePoint Security @pixiepointsec]

What better way to get into x'mas vibes than @flyingpassword dropping a BFS n-day (CVE-2025-29970) blog post! (Santa would approve :)) Merry X-mas!
https://t.co/Skmuu5rsU1

[PixiePoint Security @pixiepointsec]

And... hot on the heels will be @voix44er attempting the Philips Hue Bridge this week! All the best and have fun!

[PixiePoint Security @pixiepointsec]

Looks like @__neverm0r_ and @b1thvn_ TyphoonPwn entry is patched this month as CVE-2025-55681... thanks @SecuriTeam_SSD for the fun experience!

[PixiePoint Security @pixiepointsec]

If u think that Windows research is all we do, think again! In our first IOT blog, @voix44er details the Wolfbox EV charger setup, attack surface, his #Pwn2Own Automotive 2025 bug, exploitation, and best of all, displaying our name on it (in styleee...)!
https://t.co/orDhcbZv6b

[PixiePoint Security @pixiepointsec]

Happy Friday! Our intern, @__neverm0r_ , discovered and reported a NPD due to race-condition in afd.sys. Wasn’t assigned a cve doesn’t mean it’s less interesting, right!?
https://t.co/m7HDVQd5pj

[PixiePoint Security @pixiepointsec]

Proud to see @_jaelkoh (with @saidelike) talking about undocumented internals of KTM, the bugs and exploits in 'Hunting for Overlooked Cookies in Windows 11 KTM and Baking Exploits for Them'. No ovens required for this recipe!

[offensivecon @offensive_con]

2025 agenda is out!

https://t.co/Ri8DNcP6Xd

[PixiePoint Security @pixiepointsec]

Unfortunate, but still a good showing! 🫡

[TrendAI Zero Day Initiative @thezdi]

Confirmed (with a collision)! Rafal Goryl of PixiePoint Security used a 2 bug chain to exploit the WOLFBOX Level 2 EV Charger, but one of the bugs was previously known. He earns himself $18,750 and 3.75 Master of Pwn points. #P2OAuto

[PixiePoint Security @pixiepointsec]

Annnddd... the odds ARE in your favor! Congrats @voix44er ! This result is just the cherry on the cake. Regardless of what it may be, what we don't see is the dedication and hard work put into the research.. 💪💪💪

[TrendAI Zero Day Initiative @thezdi]

Success! On his second attempt, Rafal Goryl of PixiePoint Security was able to exploit the WOLFBOX EV charger. He heads off the the disclosure room to provide us with all the details. #P2OAuto #Pwn2Own

[PixiePoint Security @pixiepointsec]

Hello world! First post in 2025;
@voix44er attempting to pwn WolfBox EV charger at #P2OAuto on Day 2. “May the odds be ever in your favor”!

[PixiePoint Security @pixiepointsec]

@b1thvn_ did this for fun… POC for CVE-2024-38106
https://t.co/MNQL1wg9N1

[PixiePoint Security @pixiepointsec]

Sometimes your past has a way of sneaking up/"garbage-collecting" on you.. Well done @b1thvn_, and thanks @TheZDIBugs for tracking these
https://t.co/nl6yONVKb3
https://t.co/WGFjeoxdbk

[PixiePoint Security @pixiepointsec]

Credit: Dewang Ahluwalia

[PixiePoint Security @pixiepointsec]

All shells are spawned equal, regardless of memory-corruption bugs or not!
CVE-2021-34462: Exploiting the Windows AppXSvc Service Logic-Error Vulnerability

https://t.co/QXgA780QPY

[PixiePoint Security @pixiepointsec]

Credit: Wei Lei

[PixiePoint Security @pixiepointsec]

New year, new blog post! CVE-2021-31985: Exploiting the Windows Defender AsProtect Heap Overflow Vulnerability
https://t.co/n5dtMOSge2

[PixiePoint Security @pixiepointsec]

Corrected url: https://t.co/6IIPsYWMZ9

[PixiePoint Security @pixiepointsec]

As it is confirmed to be the ITW CVE-2022-24521, we also contributed the content to GP0 for interested folks

https://t.co/BRTJBpOn2H

[PixiePoint Security @pixiepointsec]

RCA for 1 of the 2 CLFS bugs patched in April 2022. While we can't determine the CVE, we did managed to exploit it ;) ... credit: @b1thvn_

https://t.co/OBDKYVKfe6

[PixiePoint Security @pixiepointsec]

Props to @maddiestone for maintaining this ITW RCA program :)

[PixiePoint Security @pixiepointsec]

RCA for 1 of the 2 CLFS bugs patched in April 2022. While we can't determine the CVE, we did managed to exploit it ;) ... credit: @b1thvn_

https://t.co/OBDKYVKfe6