Principal Vulnerability Researcher | Master of Pwn | Pwn2Own
Joined June 2020
- Tweets440
- Following258
- Followers4.2K
- Likes723
Pinned Tweet
The following multi-part blog series will cover how I developed the mast1c0re exploit on both the PlayStation 4 and PlayStation 5. Stay tuned for the remaining blog posts. mccaulay.co.uk/mast1c0re-int…
McCaulay retweeted
To teach a lesson,
After Wiz rushed to buy php2shell domain and use its marketing machine to steal the spotlight, I spotted "phpbleed" in a recent Calif tweet and bought phpbleed.com before wiz could pull the same stunt again.
A big budget can buy a domain. It shouldn't buy someone else's research credit.
If you have contacts at CISA or in the press, do the right thing: make sure the researchers who actually did the work get the recognition they deserve.
Hack the planet. Credit the researchers.
McCaulay retweeted
Let’s set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit. See his August 5 tweet: xitter.cf/lcfr_hax/status/208503…
His work convinced the PHP Foundation to invest in fixing this entire bug class. He then worked around the clock to review, test, and retest the patches.
McCaulay retweeted
Andy Nguyen (@theflow0) presents at #TheSAS2026 on how he hacked the PS5 hypervisor (twice, with two amazing bugs!) and got Linux running on the console, with Steam games playable on it!!! 🤯
McCaulay retweeted
We were all supposed to wait until Thursday at 11am ET.
Information has leaked wrt zero-day embargoed RCE vulns in PHP. We can confirm that they're real. CVE-2926-109618/619
We cannot share further information right now. Take this seriously and apply patches when available.
McCaulay retweeted
Bye bye bridge @_McCaulay exploited the Philips Hue Bridge Pro winning $5,000 and 2 Master of Pwn points with a 4 bug collision #Pwn2Own
Home Assistant Green falls again 🍀
Last year's #Pwn2Own go2shell chain is now public.
There's no place like 127.0.00.1 🏠
mccaulay.co.uk/go2shell-root…
@_McCaulay strikes again and down goes Home Assistant Green once again! With a 6 bug chain, including 1 collision and 5 zero-days, the net total winnings is $7k & 2.75 Master of Pwn points #Pwn2Own
McCaulay retweeted
Very groovy. @_McCaulay exploited the Canon imageFORCE 1643F in short order. He heads off to the disclosure room to explain himself. #Pwn2Own #P2OIreland
McCaulay retweeted
@_McCaulay strikes again and down goes Home Assistant Green once again! With a 6 bug chain, including 1 collision and 5 zero-days, the net total winnings is $7k & 2.75 Master of Pwn points #Pwn2Own
McCaulay retweeted
@_McCaulay climbs the leaderboard with his third target earning another 1.5 master of Pwn points and $6750 for his exploit of Garmin Index BPM with 1 collision and 1 unique bug. Another two entries from @_McCaulay to come, stay tuned! #Pwn2Own
McCaulay retweeted
Confirmed! @_McCaulay used 3 bugs (incl Hard-coded Credentials, Missing Authentication for Critical Function, Command Injection) to exploit the Canon imageFORCE 1643F. His 2nd round win nets him $10,000 and 2 Master of Pwn points. #Pwn2Own
McCaulay retweeted
Seriously Sweet! @_McCaulay got his reverse shell going on the #Sonos Era 300. If confirmed, it's worth $50K and 5 Master of Pwn points. He's off to the disclosure room to explain how he did it.
McCaulay retweeted
Excited to be speaking here next month! Look forward to being able to give more details on USB exploit engineering and the tooling we have been building.
The wait is over! 🚀 The talks for Hexacon 2026 are officially out, and the lineup is absolute fire 🔥
hexacon.fr/conference/speake…
