‘Train the basics’ – Bug bounty hunter ‘Xel’ on forging a lucrative career in ethical hacking

Summary: Raphaël Arrouas, a Switzerland-based researcher who hacks as 'Xel' and ranks in the top 10 on YesWeHack's all-time leaderboard, started bug hunting in early 2019 and joined the Paris-based platform in October 2019 after three years as a penetration tester. He reports earning CHF32,000 ($35,000) in one weekend from a series of zero-day remote code execution vulnerabilities on the same product, with his highest single-bug payout at CHF10,000 ($11,000), and cites an unauthenticated RCE in the firewall orchestrator Tufin SecureChange as his biggest-impact find.
What you should know: An unauthenticated remote code execution flaw in a firewall orchestrator is the kind of finding that sits upstream of every control a security team has deployed, and it surfaced through a crowdsourced program rather than the vendor's own testing. Arrouas also notes that Swiss law is narrow on good-faith hacking, so the safe harbor terms attached to a bounty program are doing real legal work for the researchers probing your scope.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026