DEVCORE

DEVCORE (戴夫寇爾) is a Taipei, Taiwan-based cybersecurity company founded in 2012 by a team of six co-founders — 翁浩正, 賴韋廝, 許復凱, 徐念恩, 岑志豪, and 王鶶雄 — according to the company's Chinese Wikipedia entry. It is described as the first Taiwanese firm to offer dedicated "red team exercise" services, and today provides red teaming, penetration testing, active product security research, security consulting, and training to clients across government, finance, e-commerce, semiconductor, and healthcare sectors, per its own site (devco.re).

Beyond Orange Tsai: a research bench

DEVCORE is frequently identified in the press with a single name, Orange Tsai (who has a standalone biography elsewhere in this encyclopedia), but the firm's public output shows a broader roster of named researchers publishing under the DEVCORE banner. Recent company blog posts credit researchers including Angelboy (Windows kernel and streaming-driver research; named to Microsoft's MSRC 2024 Top 100 Most Valuable Security Researchers list, #33 overall and #9 in the Windows category, per DEVCORE's own site), Terrynini (Windows exploitation training and half-day vulnerability research), and Pumpkin (Linux/Ubuntu sandbox and namespace-restriction research). DEVCORE also runs a multi-year internship program and hosts recurring public events (e.g., a "/dev/meet" red-team AMA held in 2026), indicating an active, continuing research organization rather than a vehicle for one individual.

ProxyLogon and ProxyShell

In early 2021, DEVCORE reported a Microsoft Exchange Server vulnerability to Microsoft on January 5, 2021 (confirmed received by Microsoft on January 8), which became part of the exploit chain later named ProxyLogon, per the English Wikipedia article on ProxyLogon. Chinese Wikipedia's DEVCORE entry describes this as part of a broader set of eight Microsoft Exchange Server vulnerabilities the firm found that year, spanning the ProxyLogon, ProxyOracle, and ProxyShell exploit chains. The underlying research was showcased at Pwn2Own Vancouver 2021 (April 6–8), where the DEVCORE Research Team successfully exploited Microsoft Exchange Server and shared the Master of Pwn title in a three-way tie, per English Wikipedia's Pwn2Own article; the ProxyShell chain was publicly detailed later that year following responsible disclosure.

Pwn2Own track record

DEVCORE has repeated Pwn2Own results beyond 2021: at Pwn2Own Toronto 2022 (December 6–9) the team compromised a MikroTik RouterBoard device (SOHO Smash-up, $100K), an HP Color LaserJet Pro M479fdw printer, and a Sonos One smart speaker, per Wikipedia's Pwn2Own article. DEVCORE's own site states its team also compromised Windows 11 at Pwn2Own Vancouver 2024 using CVE-2024-35250 and CVE-2024-30084. The company additionally reports (via its own site, unverified by a third party in this pass) more than 400 disclosed vulnerabilities and over 50 enterprise bug-bounty rewards across its history.

Other disclosures

Per DEVCORE's Chinese Wikipedia entry, the firm's disclosure history also includes an Accellion File Transfer Appliance weakness (2016); a GitHub Enterprise remote code execution flaw and Exim mail-server issues (2017); vulnerabilities in Palo Alto Networks GlobalProtect, Fortinet FortiGate SSL VPN, Jenkins, and Pulse Secure SSL VPN (2019); Microsoft IIS, Windows Kernel, and Linux ksmbd flaws (2022); and a MikroTik RouterOS remote code execution bug (2023). These claims trace to a single tertiary source and are flagged here as such pending independent corroboration of each individual CVE.

Note: this entry treats DEVCORE as an organizational/group subject. For Orange Tsai's individual biography, credentials, and talks, see the separate Orange Tsai entry in this encyclopedia.

Timeline

• 2012DEVCORE founded in Taipei, Taiwan, by six co-founders, described as the first Taiwanese company to offer red-team exercise services.
• 2016Disclosed a weakness in the Accellion File Transfer Appliance (per DEVCORE's Chinese Wikipedia entry).
• 2017Disclosed a GitHub Enterprise remote code execution flaw and Exim mail-server vulnerabilities (per DEVCORE's Chinese Wikipedia entry).
• 2019Disclosed vulnerabilities in Palo Alto Networks GlobalProtect, Fortinet FortiGate SSL VPN, Jenkins, and Pulse Secure SSL VPN (per DEVCORE's Chinese Wikipedia entry).
• 2021-01-05DEVCORE reported a Microsoft Exchange Server vulnerability to Microsoft, later part of the ProxyLogon exploit chain; Microsoft confirmed receipt on January 8, 2021.
• 2021-04-06Pwn2Own Vancouver 2021: DEVCORE Research Team exploited Microsoft Exchange Server and shared the Master of Pwn title in a three-way tie.
• 2021-08ProxyShell attack chain against Microsoft Exchange Server publicly detailed following responsible disclosure, building on the Pwn2Own 2021 research; DEVCORE's broader 2021 Exchange research is described as encompassing eight vulnerabilities across the ProxyLogon, ProxyOracle, and ProxyShell chains.
• 2022-12-06Pwn2Own Toronto 2022: DEVCORE compromised a MikroTik RouterBoard device (SOHO Smash-up, $100K award), an HP Color LaserJet Pro M479fdw printer, and a Sonos One smart speaker.
• 2023Disclosed a MikroTik RouterOS remote code execution vulnerability (per DEVCORE's Chinese Wikipedia entry).
• 2024Researcher Angelboy named to Microsoft's MSRC 2024 Most Valuable Security Researchers list (#33 overall, #9 in the Windows category), per DEVCORE's own site.
• 2024-03Pwn2Own Vancouver 2024: DEVCORE reported compromising Windows 11 via CVE-2024-35250 and CVE-2024-30084 (per DEVCORE's own site).
• 2026DEVCORE continues public activity, including a 2026 '/dev/meet' Red Team AMA and an ongoing internship program noted on its own blog.