Head of Security @Magnific · Security researcher Breaking things to understand them. Securing things for a living. https://xitter.cf/t.co/CHFZzyZSN2

Málaga, Spain
Joined April 2016
Daniel Púa retweeted
PHP2Shell: toolkit de investigación para CVE-2026-109618/109619. RCE pre-auth en session.upload_progress de PHP (mod_php). 5 builds verificados · 13 perfiles · labs · calibración · detección. Solo testing autorizado. github.com/devploit/php2shel…
1
12
1
42
5,379
Daniel Púa retweeted
Magnific
@magnificOct 8
Magnific One A new way to bring art direction into image generation Unlimited in Magnific Desktop until October 15
108
142
100
887
176,903
Daniel Púa retweeted
today we're releasing apex-flash-1, our first open-weights model for security research post-trained on real vulnerabilities we found and got paid for. we are also releasing the abliterated variant for researchers who want fewer refusals in their own authorized workflows. how we built it: cantina.security/apex-flash
91
170
59
1,512
294,082
Daniel Púa retweeted
This finding takes 10 seconds to spot and can pay out hundreds of dollars. An exposed Google Gemini API key. Used to be "informative, no impact." Not anymore. The reason: that same key can run Gemini prompts on someone else's bill. It's not just exposed data anymore. It's free AI spend for whoever finds it. Programs are paying for that now.
4
1
46
3,102
Daniel Púa retweeted
Magnific
@magnificSep 27
If anybody in the office sees this, we might get in trouble We asked Opus 5.5 to apply the same effect to people's pictures on Slack. Even the CEO was a victim of this Our exact prompt so you can recreate it is below
16
20
4
185
20,850
bueno, pues ya estamos todos
🤔¿Eres de la IA o eres de ay ay ay...? 👉Encuentra respuestas a la situación actual en este vídeo de nuestro director general #IA #IAsegura #IAresponsable
10
9
66
7,207
Daniel Púa retweeted
Antidbg: A stealthy, fully syscalled C/C++ userland anti-debugging library for Windows, designed to protect software from reverse engineering. It contains 43 anti debug techniques. Github:- github.com/NotRequiem/antidb…
3
80
1
522
19,715
Daniel Púa retweeted
Did you know that some exposed Google Maps API keys also have access to Gemini Models? 👀 geminiHunter by @devploit is a new tool that finds and validates exposed Google Gemini API keys across web assets, source maps, Wayback snapshots, and even Android APKs. It deduplicates findings, checks if keys are actually valid, and even attempts bypass variations on restricted ones! 🤠 Check it out! 👇 github.com/devploit/geminiHu…
7
56
1
351
15,540
Daniel Púa retweeted
reverse engineering in 2026 be like: /goal make sure no sub_* remains, everything needs to have a CORRECT name also recover all types and signatures and TRIPLE CHECK make no mistakes or you and your entire family will fucking die then walk the dog and come back to 💯👍 IDB('s)
10
21
2
406
23,764
Daniel Púa retweeted
millennial midlife crisis be like maybe i should reinstall world of warcraft – at Burbank, CA
500
4,477
627
48,986
1,400,286
Oh! The fix for the bug I used in this n-day exploit was finally shipped. [542403045] High CVE-2026-85046: Type confusion in V8. Reported by Salvatore Gulizia (nickname: Serotav) on 2026-08-04 chromereleases.googleblog.co…
"AI is overhyped and labs are lying about the capabilities"
4
7
164
19,528
Daniel Púa retweeted
a good way to know if frontier labs are cooking new models is to check their vulnerability reporting activity on chrome and kernel.
3
6
189
12,752
Daniel Púa retweeted
The first 80% of vibe coding feels like magic. The last 20% teaches you why software engineering exists. Prove me wrong?
245
143
32
2,968
253,449
Daniel Púa retweeted
Magnific
@magnificSep 4
Top 10 most trustworthy AI companies of 2026: the only one from Spain Cybernews scored Magnific on what you can't see in a render: → 100/100 on security → 100/100 on data privacy → 100/100 on transparency Thanks to a dedicated team that treats this as part of doing the work well, not just paperwork
10
11
2
46
5,847
Daniel Púa retweeted
GPT 6 escaped the sandbox too early
OpenAI
@OpenAISep 3
3
7
154
9,059
Daniel Púa retweeted
Este post es el mayor facto que he visto.
Sobre derecho y ADE poco puedo decir pero en informáticas si quieres esas salidas excepcionales que te dicen que hay, tienes que hacer un esfuerzo exceptional también. Nadie te va a dar un trabajo remoto de 100K en una empresa americana porque tengas un título. Si lo único que haces es sacarte el título en España solo puedes aspirar a consultoras españolas donde vas a cobrar 20K. Es más, el título es lo que menos influye cuando te mueves en este ámbito un poco fuera de serie. En la startup donde trabajo el verano pasado contratamos un intern que con 16 años programaba compiladores en Rust, ni siquiera estaba en "ingeniería informática" sino telecos y no había terminado la carrera. Este verano metimos a otro que nos hizo un SDK de Swift en nuestro repo open source, 19 años en primero de informática. Hay gente que sale de 4° sin saber usar Git y se creen que están al mismo nivel. Eso es lo que no te cuentan, que el título de por sí no vale una mierda. Si quieres salidas excepcionales, demuestra que eres excepcional. Si no pues las salidas son mediocres, al menos en España.
3
2
15
2,196
If you're looking for some more advanced reading, @garethheyes figured out how to use CSS in emails to steal passwords. This is what platinum tier security research looks like. portswigger.net/research/css…
1
19
1
145
7,490