Ledger's Donjon security research team says it bypassed the secure debug lock on Raspberry Pi's RP2350 microcontroller using a laser.
The team published the work on its blog on September 18, 2026, describing a technique it calls photon-emission-guided laser fault injection. Photon emission analysis maps the faint light transistors give off as they switch, which can help pinpoint exactly where on a chip to aim a laser. Combining that mapping with a precisely timed laser pulse, the researchers say they disrupted the RP2350's debug-lock circuitry enough to force it open. Fault injection itself isn't new: voltage glitching and electromagnetic pulses have been standard tools in hardware security labs for years, but using photon emission to guide the laser turns a fairly blunt process into something closer to targeted surgery.
The RP2350 is the chip inside the Raspberry Pi Pico 2, a board that shows up in classrooms, hobbyist projects, and plenty of low-cost embedded products. Raspberry Pi has pitched the chip's secure debug lock as protection against attackers who get physical access to a device and try to read out or reflash its firmware. A working bypass, even one that needs lab-grade optics, undercuts that pitch and fits a familiar pattern: silicon vendors keep promising tamper resistance, and well-funded attackers keep finding the seams.
None of this makes your RP2350 project newly vulnerable to a random attacker with a laser pointer. Photon-emission-guided rigs are specialized and expensive. But 'secure debug' claims are only as strong as the threat model behind them, and this one just got a little smaller.