
Head of Security @Magnific · Security researcher Breaking things to understand them. Securing things for a living. https://xitter.cf/t.co/CHFZzyZSN2
Málaga, Spain
Joined April 2016
- Tweets3.2K
- Following674
- Followers3.2K
- Likes4.7K
Daniel Púa retweeted
PHP2Shell: toolkit de investigación para CVE-2026-109618/109619. RCE pre-auth en session.upload_progress de PHP (mod_php).
5 builds verificados · 13 perfiles · labs · calibración · detección.
Solo testing autorizado.
github.com/devploit/php2shel…
Daniel Púa retweeted
today we're releasing apex-flash-1, our first open-weights model for security research post-trained on real vulnerabilities we found and got paid for.
we are also releasing the abliterated variant for researchers who want fewer refusals in their own authorized workflows.
how we built it: cantina.security/apex-flash
Daniel Púa retweeted
This finding takes 10 seconds to spot and can pay out hundreds of dollars.
An exposed Google Gemini API key. Used to be "informative, no impact." Not anymore.
The reason: that same key can run Gemini prompts on someone else's bill. It's not just exposed data anymore. It's free AI spend for whoever finds it. Programs are paying for that now.
Daniel Púa retweeted
If anybody in the office sees this, we might get in trouble
We asked Opus 5.5 to apply the same effect to people's pictures on Slack. Even the CEO was a victim of this
Our exact prompt so you can recreate it is below
Daniel Púa retweeted
bueno, pues ya estamos todos
🤔¿Eres de la IA o eres de ay ay ay...?
👉Encuentra respuestas a la situación actual en este vídeo de nuestro director general #IA #IAsegura #IAresponsable
Antidbg: A stealthy, fully syscalled C/C++ userland anti-debugging library for Windows, designed to protect software from reverse engineering. It contains 43 anti debug techniques.
Github:- github.com/NotRequiem/antidb…
Daniel Púa retweeted
Did you know that some exposed Google Maps API keys also have access to Gemini Models? 👀
geminiHunter by @devploit is a new tool that finds and validates exposed Google Gemini API keys across web assets, source maps, Wayback snapshots, and even Android APKs. It deduplicates findings, checks if keys are actually valid, and even attempts bypass variations on restricted ones! 🤠
Check it out! 👇
github.com/devploit/geminiHu…
reverse engineering in 2026 be like: /goal make sure no sub_* remains, everything needs to have a CORRECT name also recover all types and signatures and TRIPLE CHECK make no mistakes or you and your entire family will fucking die
then walk the dog and come back to 💯👍 IDB('s)
Daniel Púa retweeted
millennial midlife crisis be like
maybe i should reinstall world of warcraft – at Burbank, CA
Daniel Púa retweeted
Oh! The fix for the bug I used in this n-day exploit was finally shipped.
[542403045] High CVE-2026-85046: Type confusion in V8. Reported by Salvatore Gulizia (nickname: Serotav) on 2026-08-04
chromereleases.googleblog.co…
Daniel Púa retweeted
La malagueña Magnific, antes Freepik, única empresa española y de la Unión Europea en el top 10 de compañías de IA 'más fiables' del mundo laopiniondemalaga.es/malaga/…
Daniel Púa retweeted
Top 10 most trustworthy AI companies of 2026: the only one from Spain
Cybernews scored Magnific on what you can't see in a render:
→ 100/100 on security
→ 100/100 on data privacy
→ 100/100 on transparency
Thanks to a dedicated team that treats this as part of doing the work well, not just paperwork
Daniel Púa retweeted
Este post es el mayor facto que he visto.
Sobre derecho y ADE poco puedo decir pero en informáticas si quieres esas salidas excepcionales que te dicen que hay, tienes que hacer un esfuerzo exceptional también.
Nadie te va a dar un trabajo remoto de 100K en una empresa americana porque tengas un título.
Si lo único que haces es sacarte el título en España solo puedes aspirar a consultoras españolas donde vas a cobrar 20K.
Es más, el título es lo que menos influye cuando te mueves en este ámbito un poco fuera de serie.
En la startup donde trabajo el verano pasado contratamos un intern que con 16 años programaba compiladores en Rust, ni siquiera estaba en "ingeniería informática" sino telecos y no había terminado la carrera.
Este verano metimos a otro que nos hizo un SDK de Swift en nuestro repo open source, 19 años en primero de informática.
Hay gente que sale de 4° sin saber usar Git y se creen que están al mismo nivel.
Eso es lo que no te cuentan, que el título de por sí no vale una mierda.
Si quieres salidas excepcionales, demuestra que eres excepcional.
Si no pues las salidas son mediocres, al menos en España.
Daniel Púa retweeted

JS0N Haddix@JhaddixAug 30
United States
United StatesConnected via United States App StoreAccount-level information, not a live location or per-post device.
Replying to @intigriti @BRuteLogic
Love @BRuteLogic but gonna stick with the full featured github.com/devploit/nomore40… we have slightly modified 🫶
Daniel Púa retweeted
If you're looking for some more advanced reading, @garethheyes figured out how to use CSS in emails to steal passwords. This is what platinum tier security research looks like.
portswigger.net/research/css…


























