Rafał Goryl

Breaking stuff, Security researcher @pixiepointsec | Pwn2Own Toronto 2023, Tokyo 2025, Ireland 2025

[Rafał Goryl @voix44er]

@thezdi @FuzzingLabs Congrats Julien! 👏

[kiddo @kiddo_pwn]

My very first blog post is live: https://t.co/tQgJZpuDos

During research, I've run into and documented a simple universal SQLite Injection RCE trick. Enjoy!

N-day Analysis about Synology Beestation RCE (CVE-2024-50629~50631) by legendary DEVCORE 🎃 🍊

Thanks to @u1f383 @orange_8361 for original finding and allowing to post, and to @the_emmons for the invaluable references 🔥

Enjoy the Demo!

PoC: https://t.co/rM1CEfhkjr

[Josh @boredpentester]

All of us the last 3 months of Pwn2own or just me?

[TrendAI Zero Day Initiative @thezdi]

Another successful collision: @_voix44er from PixiePoint Security succeeded in exploiting the Phillips Hue Bridge, but the bugs he used were collisions with a previous entry. He still earns $10,000 and 2 Master of Pwn points. #Pwn2Own

[TrendAI Zero Day Initiative @thezdi]

Boom! Rafal Goryl (@voix44er) of PixiePoint Security needed two attempts but was able to get his exploit of the Phillips Hue Bridge working. He heads off to the disclosure room to provide all the details. #Pwn2Own

[PixiePoint Security @pixiepointsec]

And... hot on the heels will be @voix44er attempting the Philips Hue Bridge this week! All the best and have fun!

[PixiePoint Security @pixiepointsec]

If u think that Windows research is all we do, think again! In our first IOT blog, @voix44er details the Wolfbox EV charger setup, attack surface, his #Pwn2Own Automotive 2025 bug, exploitation, and best of all, displaying our name on it (in styleee...)!
https://t.co/orDhcbZv6b

[TheZDIBugs @TheZDIBugs]

[ZDI-25-329|CVE-2025-5750] (0Day) (Pwn2Own) WOLFBOX Level 2 EV Charger tuya_svc_devos_activate_result_parse Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 8.8; Credit: Rafal Goryl of PixiePoint Security) https://t.co/DXMnVKe0G0

[TrendAI Zero Day Initiative @thezdi]

How China Is Building an Army of Hackers. With commentary from ZDI's Dustin Childs and footage from #Pwn2Own Automotive https://t.co/TEgOlhddhD via @YouTube

[PixiePoint Security @pixiepointsec]

Proud to see @_jaelkoh (with @saidelike) talking about undocumented internals of KTM, the bugs and exploits in 'Hunting for Overlooked Cookies in Windows 11 KTM and Baking Exploits for Them'. No ovens required for this recipe!

[lcamtuf @lcamtuf]

A novel way to implement loops:
https://t.co/Rn1yAQk2Y9

[lcamtuf @lcamtuf]

I've been working in cybersecurity for over 25 years. Here are my key insights.

[TrendAI Zero Day Initiative @thezdi]

Confirmed (with a collision)! Rafal Goryl of PixiePoint Security used a 2 bug chain to exploit the WOLFBOX Level 2 EV Charger, but one of the bugs was previously known. He earns himself $18,750 and 3.75 Master of Pwn points. #P2OAuto

[Rafał Goryl @voix44er]

@thezdi @Synacktiv @SinSinology @SummoningTeam Congratz @SinSinology !

[PixiePoint Security @pixiepointsec]

Annnddd... the odds ARE in your favor! Congrats @voix44er ! This result is just the cherry on the cake. Regardless of what it may be, what we don't see is the dedication and hard work put into the research.. 💪💪💪

[PixiePoint Security @pixiepointsec]

Hello world! First post in 2025;
@voix44er attempting to pwn WolfBox EV charger at #P2OAuto on Day 2. “May the odds be ever in your favor”!

[Rafał Goryl @voix44er]

@thezdi @dustin_childs Hey @thezdi is it still possible to register entry for Pwn2Own? As I can't get any confirmation for entry registration these past few days over email.

[PagedOut @pagedout_zine]

Paged Out! Issue #5 is out now!
https://t.co/kVmdLe0l7s
Happy reading!

Please RT and tell your friends! :)

[TheZDIBugs @TheZDIBugs]

[ZDI-24-839|CVE-2024-6248] (Pwn2Own) Wyze Cam v3 Cloud Infrastructure Improper Authentication Remote Code Execution Vulnerability (CVSS 7.5; Credit: Rafal Goryl) https://t.co/JNjpficQln

[Tavis Ormandy @taviso]

The libarchive e8 vulnerability is actually really cool, but the ZDI advisory doesn't explain why it's so wild lol. For some reason, I know about RAR filters, so let me provide the background. 🧵 1/n