Head of Security @Magnific · Security researcher Breaking things to understand them. Securing things for a living. devploit.dev
Málaga, Spain
- Tweets 3,194
- Following 671
- Followers 3,157
- Likes 4,740
Pinned Tweet
working in cybersecurity nowadays:
> wake up
> read "new critical vuln just dropped"
> summon dev and SRE in the incident channel
> patch, scan, rotate secrets, redeploy
> check logs to make sure you are not already cooked
> take a deep breath and go to sleep
> wake up
> read "new critical vuln just dropped"...
WELCOME TO THE AI ERA
Introducing nginx-poolslip, a fresh RCE for the the latest nginx release 1.31.0.
nginx-rift has been patched, but our security agent Vega has found a new 0 day.
We will release the full technical writeup with ASLR bypass 30 days after the patch on nebusec.ai.
21
210
2,348
160,801
Sigo esperando a que en los aeropuertos pongan una cola para viajeros asiduos y otra para personas que nacieron ayer. Gracias.
1
282
El año pasado quedamos 29 de 34. Este año, 39 de 42.
Quizá va siendo hora de dejar de encargar el entrenamiento del equipo a macroempresas o al influencer de turno, y de empezar a elegir a los participantes con criterios claros y a preparar la competición en serio, no un mes antes. Si queréis buenos resultados, tenéis que dejar de depender del talento individual que os carrileó años atrás y empezar a competir de verdad. ¿No habéis aprendido nada de cómo lo hacen otros países?
Un poco de amor propio, por favor.
🏁 Finaliza la participación de la Selección Española en el #ECSC2026.
Gracias a los diez integrantes por su esfuerzo, dedicación y compromiso durante toda la competición, y por representar a España en #Bochum . 🇪🇸
9
24
102
4,849
Being technically great and being a great communicator rarely come together.
Most people are strong in one and weak in the other, which makes people who nail both genuinely rare.
2
1
362
That's why I rate @LiveOverflow and @NahamSec so much. Real depth, explained in a way that actually sticks. That combo is way harder to find than people think.
1
1
203
En español me ha quedado gratamente sorprendido con el contenido de @gorkaelbochi. Y sin duda, aunque no esté directamente relacionado con seguridad, no puedo dejar sin mencionar aquí a mi camarada @achetronic.
2
245
Daniel Púa retweeted
today we're releasing apex-flash-1, our first open-weights model for security research post-trained on real vulnerabilities we found and got paid for.
we are also releasing the abliterated variant for researchers who want fewer refusals in their own authorized workflows.
how we built it: cantina.security/apex-flash
91
168
1,507
291,851
"La ciberseguridad es uno de esos trabajos que solo se hacen visibles cuando algo falla".
Gracias a Manuel Collado y a La Vanguardia por la entrevista.
lavanguardia.com/neo/segurid…
1
11
500
🚨Cyber Alert ‼️
🇪🇸Spain - 𝗝𝘂𝗻𝘁𝗮 𝗱𝗲 𝗔𝗻𝗱𝗮𝗹𝘂𝗰í𝗮
Meduza Locker hacking group claims to have breached Junta de Andalucía. According to the threat actor, the compromised data includes client, confidential, financial, HR, legal, marketing and technical data.
Threat actor: Meduza Locker
Sector: Gov / Mil / LE
Data exposure (claimed): Not specified
Data type: Client, confidential, financial, HR, legal, marketing and technical data, and reports
Observed: Sep 28, 2026
Status: Pending verification
ESIX©: 5.58
Full details and impact assessment on HackRisk.io
1
292
With Opus 5.5, it looks like I'll finally be able to remove "don't use em-dashes" from CLAUDE.md instructions.
2
183
Daniel Púa retweeted
This finding takes 10 seconds to spot and can pay out hundreds of dollars.
An exposed Google Gemini API key. Used to be "informative, no impact." Not anymore.
The reason: that same key can run Gemini prompts on someone else's bill. It's not just exposed data anymore. It's free AI spend for whoever finds it. Programs are paying for that now.
4
1
46
3,100
geminiHunter in Intigriti's September Bug Bytes 🫡intigriti.com/researchers/bl…
1
190
0 days since the last "OpenAI dev shows you the RIGHT way to use a coding harness" thread. it's always 0 days.
1
2
209