#1 Hacker at BugCon LHE Mexico 2021 & 2022 | Top Ranked in H1 Mexico Leaderboard 2021, 2022, 2023, 2024 | Security Engineering Specialist | Co-Founder @ Ryft
127.0.0.1
Joined August 2021
- Tweets746
- Following226
- Followers8.6K
- Likes1.9K
Pinned Tweet
Yay, I was awarded a $16,300 bounty on @Hacker0x01! hackerone.com/moblig #TogetherWeHitHarder
🎉🎉🎉
Tip: Even if an asset asks for authentication, fuzz for endpoints using ffuf, I found an unauthenticated API that allowed me to retrieve sensitive information!
Moblig retweeted
Today we announce 1Password for Agents platform, building with companies @Muse, SpaceX Super Intelligence Grok @Bot, @AnthropicAI’s @Claudeai, @OpenAI, @TownAI, @Browserbase, @Browser_use, @heydana_ai, Instinct, @usekernel, @Perplexity_ai, @tryramp, @Tomo, and @wajo_ai, with more integrations on the way. 🎉
We've heard from so many of our customers who want to use these new personal AI agents to help them get more done, but want more control over what the agent can access with the same trust and ease of use they get when using 1Password directly.
1Password for Agents gives your agents access without giving up your passwords. When an agent reaches a sign-in form, it requests a credential from your vault. If you approve the request, 1Password directly auto-fills the credential in the destination site so the agent can’t see or take possession of the credentials.
The agent gets the task done, but it doesn’t get your passwords..
You stay in control. 1Password for Agents free and optional for personal and family accounts. Unless you opt-in to an agent connector, agents cannot touch your vault.
➡️Learn more: bit.ly/487da6J
Moblig retweeted
To teach a lesson,
After Wiz rushed to buy php2shell domain and use its marketing machine to steal the spotlight, I spotted "phpbleed" in a recent Calif tweet and bought phpbleed.com before wiz could pull the same stunt again.
A big budget can buy a domain. It shouldn't buy someone else's research credit.
If you have contacts at CISA or in the press, do the right thing: make sure the researchers who actually did the work get the recognition they deserve.
Hack the planet. Credit the researchers.
Moblig retweeted
🚨 JFrog Security Research has identified a supply-chain attack involving malicious code in the LiteLLM 1.107.0 PyPI release. Avoid this version and investigate environments where it was installed or executed. More details will be shared soon in our blog post.
Moblig retweeted
We were all supposed to wait until Thursday at 11am ET.
Information has leaked wrt zero-day embargoed RCE vulns in PHP. We can confirm that they're real. CVE-2926-109618/619
We cannot share further information right now. Take this seriously and apply patches when available.
Moblig retweeted
You can now perform content discovery at 100k requests per second with h3fuzz on http/3 hosts (fork of ffuf with http/3 support).
Tool here: github.com/assetnote/h3fuzz
Research post here: slcyber.io/research/how-prac…
Moblig retweeted
We just received a $250,000 Chrome Full Chain bonus! 🎉
We've claimed the second Full Chain bonus of 2026. Only two remain!
Under the rules, every vulnerability had to be a non-duplicate 0-day, and the entire exploit chain had to be completed before any of them were patched.
Huge thanks to @nebusecurity for discovering a V8 vulnerability in just a single day! Also, a big thank you to @_deayzl for collaborating with me on the V8 Heap Sandbox research.
P.S. KVM escapes have been getting a lot of attention. I actually captured the Full VM Escape flag in KVMCTF about three months ago. Hopefully, I'll be able to share that research soon, too!
Has anyone else noticed that all programs in @intigriti are paused? Every single one- is it just me? Was I banned or something? I am verified in the platform
Moblig retweeted
How I Could've Accessed 17 Trillion Microsoft Records
blog.faav.net/how-i-couldve-… :)
Nowadays I see more news about suspended or paused programs than I receive invitations
Intel appears to have suspended its bug bounty program, which previously paid security researchers up to $100,000 for serious vulnerabilities.
The new program on Intigriti still lets researchers report security bugs, but there’s currently no money offered for them. Intel has not explained the reason for the change.
Intel hasn’t said why it made the change. The company’s old program covered everything from hardware and firmware to software and open-source projects..
One possible factor is the huge increase in security reports, with AI tools making it easier to find and submit bugs.
Moblig retweeted
Intel appears to have suspended its bug bounty program, which previously paid security researchers up to $100,000 for serious vulnerabilities.
The new program on Intigriti still lets researchers report security bugs, but there’s currently no money offered for them. Intel has not explained the reason for the change.
Intel hasn’t said why it made the change. The company’s old program covered everything from hardware and firmware to software and open-source projects..
One possible factor is the huge increase in security reports, with AI tools making it easier to find and submit bugs.
Moblig retweeted
if i got $6500 for responsibly hacking a company that half the GDP growth of the united states is riding on i'd become the joker
I fucking hate Medium posts that are Member gated, like you are gating knowledge for what? 20 bucks at most? 🙄
#bugbounty
Brutal week, expected payout for all these was 25k+
After duplicates, not all hope is lost, still a chance for 9k🤞🏻😂 Modern bug bounty ig🤷🏻
#bugbounty
