#1 Hacker at BugCon LHE Mexico 2021 & 2022 | Top Ranked in H1 Mexico Leaderboard 2021, 2022, 2023, 2024 | Security Engineering Specialist | Co-Founder @ Ryft
127.0.0.1
Joined August 2021
- Tweets741
- Following226
- Followers8.6K
- Likes1.8K
Pinned Tweet
Yay, I was awarded a $16,300 bounty on @Hacker0x01! hackerone.com/moblig #TogetherWeHitHarder
🎉🎉🎉
Tip: Even if an asset asks for authentication, fuzz for endpoints using ffuf, I found an unauthenticated API that allowed me to retrieve sensitive information!
Moblig retweeted
We were all supposed to wait until Thursday at 11am ET.
Information has leaked wrt zero-day embargoed RCE vulns in PHP. We can confirm that they're real. CVE-2926-109618/619
We cannot share further information right now. Take this seriously and apply patches when available.
Moblig retweeted
You can now perform content discovery at 100k requests per second with h3fuzz on http/3 hosts (fork of ffuf with http/3 support).
Tool here: github.com/assetnote/h3fuzz
Research post here: slcyber.io/research/how-prac…
Moblig retweeted
We just received a $250,000 Chrome Full Chain bonus! 🎉
We've claimed the second Full Chain bonus of 2026. Only two remain!
Under the rules, every vulnerability had to be a non-duplicate 0-day, and the entire exploit chain had to be completed before any of them were patched.
Huge thanks to @nebusecurity for discovering a V8 vulnerability in just a single day! Also, a big thank you to @_deayzl for collaborating with me on the V8 Heap Sandbox research.
P.S. KVM escapes have been getting a lot of attention. I actually captured the Full VM Escape flag in KVMCTF about three months ago. Hopefully, I'll be able to share that research soon, too!
Has anyone else noticed that all programs in @intigriti are paused? Every single one- is it just me? Was I banned or something? I am verified in the platform
Moblig retweeted
How I Could've Accessed 17 Trillion Microsoft Records
blog.faav.net/how-i-couldve-… :)
Nowadays I see more news about suspended or paused programs than I receive invitations
Intel appears to have suspended its bug bounty program, which previously paid security researchers up to $100,000 for serious vulnerabilities.
The new program on Intigriti still lets researchers report security bugs, but there’s currently no money offered for them. Intel has not explained the reason for the change.
Intel hasn’t said why it made the change. The company’s old program covered everything from hardware and firmware to software and open-source projects..
One possible factor is the huge increase in security reports, with AI tools making it easier to find and submit bugs.
Moblig retweeted
Intel appears to have suspended its bug bounty program, which previously paid security researchers up to $100,000 for serious vulnerabilities.
The new program on Intigriti still lets researchers report security bugs, but there’s currently no money offered for them. Intel has not explained the reason for the change.
Intel hasn’t said why it made the change. The company’s old program covered everything from hardware and firmware to software and open-source projects..
One possible factor is the huge increase in security reports, with AI tools making it easier to find and submit bugs.
Moblig retweeted
if i got $6500 for responsibly hacking a company that half the GDP growth of the united states is riding on i'd become the joker
We reported the bug to Discourse and OpenAI. OpenAI fixed the SSO issue roughly 14 hours after our initial submission.
Discourse received our separate report Saturday, replied Sunday, and had a fix Monday.
OpenAI awarded us $6,500.
I fucking hate Medium posts that are Member gated, like you are gating knowledge for what? 20 bucks at most? 🙄
#bugbounty
Brutal week, expected payout for all these was 25k+
After duplicates, not all hope is lost, still a chance for 9k🤞🏻😂 Modern bug bounty ig🤷🏻
#bugbounty
Sat on this report for a while... I guess I am never doing that again🫠
#bugbounty
Moblig retweeted
Apple just paid $150,000 for a path traversal.
Not a jailbreak. Not a prompt injection.
A ' ../ ' in a boot process.
medium.com/@Aacle/how-a-30-y…
Moblig retweeted
after seeing the current state of HackerOne, I decided it was time to sit down and address the elephant in the room
blog.teknogeek.io/posts/what…
Moblig retweeted
Security researcher ily2 has just earned a staggering $3,000,000 from submitting a critical smart contract bug via Immunefi.
That's the largest single payout in web3 security in recent memory.
In total, he's submitted 3 reports. All 3 were paid. 100% accuracy.
His leaderboard update is coming soon, but you can pledge IMU to him now and earn when he finds the next one:
immunefi.com/pledge/ily2
