Head of Security @Magnific · Security researcher Breaking things to understand them. Securing things for a living. https://xitter.cf/t.co/CHFZzyZSN2

Málaga, Spain
Joined April 2016
me uno a los que reescriben autofirma. Aquí tenéis una versión en línea de comandos. Especialmente útil si lo usas como skill en Claude / Chatgpt, solo le tienes que dar el pdf y le pides que te lo firme. Encuentra dónde poner la firma visible automáticamente github.com/e98cuenc/firma-cl…
8
10
1
124
7,188
Daniel Púa retweeted
PHP2Shell: toolkit de investigación para CVE-2026-109618/109619. RCE pre-auth en session.upload_progress de PHP (mod_php). 5 builds verificados · 13 perfiles · labs · calibración · detección. Solo testing autorizado. github.com/devploit/php2shel…
1
12
1
42
5,507
Daniel Púa retweeted
Magnific One A new way to bring art direction into image generation Unlimited in Magnific Desktop until October 15
108
141
100
889
178,190
Daniel Púa retweeted
today we're releasing apex-flash-1, our first open-weights model for security research post-trained on real vulnerabilities we found and got paid for. we are also releasing the abliterated variant for researchers who want fewer refusals in their own authorized workflows. how we built it: cantina.security/apex-flash
91
170
59
1,512
294,682
Daniel Púa retweeted
This finding takes 10 seconds to spot and can pay out hundreds of dollars. An exposed Google Gemini API key. Used to be "informative, no impact." Not anymore. The reason: that same key can run Gemini prompts on someone else's bill. It's not just exposed data anymore. It's free AI spend for whoever finds it. Programs are paying for that now.
4
1
46
3,102
Daniel Púa retweeted
If anybody in the office sees this, we might get in trouble We asked Opus 5.5 to apply the same effect to people's pictures on Slack. Even the CEO was a victim of this Our exact prompt so you can recreate it is below
16
20
4
185
20,863
bueno, pues ya estamos todos
🤔¿Eres de la IA o eres de ay ay ay...? 👉Encuentra respuestas a la situación actual en este vídeo de nuestro director general #IA #IAsegura #IAresponsable
10
9
66
7,210
Daniel Púa retweeted
Antidbg: A stealthy, fully syscalled C/C++ userland anti-debugging library for Windows, designed to protect software from reverse engineering. It contains 43 anti debug techniques. Github:- github.com/NotRequiem/antidb…
3
79
1
522
19,735
Daniel Púa retweeted
Did you know that some exposed Google Maps API keys also have access to Gemini Models? 👀 geminiHunter by @devploit is a new tool that finds and validates exposed Google Gemini API keys across web assets, source maps, Wayback snapshots, and even Android APKs. It deduplicates findings, checks if keys are actually valid, and even attempts bypass variations on restricted ones! 🤠 Check it out! 👇 github.com/devploit/geminiHu…
7
56
1
351
15,563
Daniel Púa retweeted
reverse engineering in 2026 be like: /goal make sure no sub_* remains, everything needs to have a CORRECT name also recover all types and signatures and TRIPLE CHECK make no mistakes or you and your entire family will fucking die then walk the dog and come back to 💯👍 IDB('s)
10
21
2
405
23,767
Daniel Púa retweeted
millennial midlife crisis be like maybe i should reinstall world of warcraft – at Burbank, CA
499
4,476
627
48,966
1,400,727
Oh! The fix for the bug I used in this n-day exploit was finally shipped. [542403045] High CVE-2026-85046: Type confusion in V8. Reported by Salvatore Gulizia (nickname: Serotav) on 2026-08-04 chromereleases.googleblog.co…
"AI is overhyped and labs are lying about the capabilities"
4
7
164
19,534
Daniel Púa retweeted
a good way to know if frontier labs are cooking new models is to check their vulnerability reporting activity on chrome and kernel.
3
6
189
12,752
Daniel Púa retweeted
The first 80% of vibe coding feels like magic. The last 20% teaches you why software engineering exists. Prove me wrong?
244
143
32
2,966
253,465
Daniel Púa retweeted
Top 10 most trustworthy AI companies of 2026: the only one from Spain Cybernews scored Magnific on what you can't see in a render: → 100/100 on security → 100/100 on data privacy → 100/100 on transparency Thanks to a dedicated team that treats this as part of doing the work well, not just paperwork
10
11
2
46
5,850
Daniel Púa retweeted
GPT 6 escaped the sandbox too early
3
7
154
9,059
Daniel Púa retweeted
Este post es el mayor facto que he visto.
Sobre derecho y ADE poco puedo decir pero en informáticas si quieres esas salidas excepcionales que te dicen que hay, tienes que hacer un esfuerzo exceptional también. Nadie te va a dar un trabajo remoto de 100K en una empresa americana porque tengas un título. Si lo único que haces es sacarte el título en España solo puedes aspirar a consultoras españolas donde vas a cobrar 20K. Es más, el título es lo que menos influye cuando te mueves en este ámbito un poco fuera de serie. En la startup donde trabajo el verano pasado contratamos un intern que con 16 años programaba compiladores en Rust, ni siquiera estaba en "ingeniería informática" sino telecos y no había terminado la carrera. Este verano metimos a otro que nos hizo un SDK de Swift en nuestro repo open source, 19 años en primero de informática. Hay gente que sale de 4° sin saber usar Git y se creen que están al mismo nivel. Eso es lo que no te cuentan, que el título de por sí no vale una mierda. Si quieres salidas excepcionales, demuestra que eres excepcional. Si no pues las salidas son mediocres, al menos en España.
3
2
15
2,196