Head of Security @Magnific · Security researcher Breaking things to understand them. Securing things for a living. devploit.dev
Málaga, Spain
- Tweets 3,198
- Following 673
- Followers 3,165
- Likes 4,743
🚨Cyber Alert ‼️
🇪🇸Spain - 𝗝𝘂𝗻𝘁𝗮 𝗱𝗲 𝗔𝗻𝗱𝗮𝗹𝘂𝗰í𝗮
Meduza Locker hacking group claims to have breached Junta de Andalucía. According to the threat actor, the compromised data includes client, confidential, financial, HR, legal, marketing and technical data.
Threat actor: Meduza Locker
Sector: Gov / Mil / LE
Data exposure (claimed): Not specified
Data type: Client, confidential, financial, HR, legal, marketing and technical data, and reports
Observed: Sep 28, 2026
Status: Pending verification
ESIX©: 5.58
Full details and impact assessment on HackRisk.io
1
292
0 days since the last "OpenAI dev shows you the RIGHT way to use a coding harness" thread. it's always 0 days.
1
2
209
Innovation vs Regulation in one image.
Some data we recently assembled on entrepreneurship/compute in Europe: eudata.vercel.app.
We hope that one of the useful roles that Stripe can play is in collecting and publishing empirical data pertaining to entrepreneurship and industry in Europe. There's growing appetite to get Europe on a better footing, and cross-sectional comparisons can often shine light on where opportunities lie. If you're interested in this kind of thing, we publish more at stripeeconomics.substack.com.
3
3
504
Nice growth, but following 2.4k back to get 2.4k followers is basically follow-for-follow. That's a different game than growing off content.
44
The rules:
> Same prompt for both, fresh each move (board, move history, legal moves).
> Effort set to low to avoid overthinking.
> 50 games, each model White in 25.
> 3 illegal answers in one turn = loss.
Here are the stats from the matchup.
1
1
178
Anthropic and OpenAI both dropped their latest models on the same day, so I put them in a chess battle.
Opus 5.5 vs GPT-6 Sol. Who do you think won?
1
2
6
848
Cloudflare shipped their own version of ngrok to expose localhost to the internet.
The problem: those tunnels are getting indexed by Google.
Anyone with site:trycloudflare.com can browse random people's exposed local dev servers right now, no login, no tunnel URL needed.
4
2
5
575
Every time I download a new game on my phone, this @LiveOverflow video pops into my head. If you haven't watched it yet, do yourself a favor.
piped.video/watch?v=AMMOErxt…
181
This finding takes 10 seconds to spot and can pay out hundreds of dollars.
An exposed Google Gemini API key. Used to be "informative, no impact." Not anymore.
The reason: that same key can run Gemini prompts on someone else's bill. It's not just exposed data anymore. It's free AI spend for whoever finds it. Programs are paying for that now.
4
1
46
3,101
I built this tool so you don't have to spend your time or money.
Everything the "who unfollowed me" apps charge for, without paying the API.
> who doesn't follow you back
> who unfollowed you
> bot detection on your followers
> best posting times
> engagement report of your tweets
Paste a snippet in your browser console. It runs locally. Nothing hits a server.
Free.
3
2
8
3,230
We're live!🐋
onlywhales.lol
No ads. No login. No fiat.
Just outbid the whale above you in BTC, ETH or SOL to rank #1. Every payment public, tx hash included
1
3
5
8,317
Introducing XSS2Shell ⛓️: WordPress Core preauth XSS→RCE vulnerability affecting 43% of the internet, discovered autonomously by pwn (using open-source models), affecting all WordPress versions.
pwn.ai/blog/xss2shell
Please patch CVE-2026-64638 as soon as possible!
2
262
a bugcrowd triager marked my report "not applicable" because the impact wasn't understood
tesla's team took another look, followed the full attack chain, reopened the vuln and rewarded me
this is how a bug bounty program is supposed to work
kudos to @Tesla
1
190
3 submitted. 1 triaged. 1 accepted.
at this point "submitted" is not a status, it's a lifestyle
2
393
MITRE just assigned me 5 CVEs
across 3 npm packages you've never thought about. 500M+ downloads a month.
the scariest vulns aren't in your code. they're in your node_modules.
names drop when the embargo lifts.
2
639
🚨 New Next.js CVE: CVE-2026-44578.
High-severity SSRF via WebSocket Upgrade handling in self-hosted Next.js apps using the built-in Node.js server.
Unauthenticated. Network-reachable. CVSS 8.6 High.
Vercel-hosted deployments are not affected.
If you run Next.js on your own infra, read on 🧵
2
7
39
4,063
Mitigation if you can't patch yet: switch unnamed captures ($1) to named ones (?<name>...). Sidesteps the buggy path entirely.
Quick audit: grep -RnE 'rewrite[[:space:]].*\$[0-9].*\?' /etc/nginx
github.com/DepthFirstDisclos…
nvd.nist.gov/vuln/detail/CVE…
344
🚨 New nginx CVE: CVE-2026-42945, aka "NGINX Rift."
Heap buffer overflow in ngx_http_rewrite_module. ~18-year-old bug. Unauthenticated. One crafted HTTP request. CVSS 9.2 Critical.
If you run nginx in front of PHP / WordPress / API gateways, read on 🧵
1
6
25
3,811
Proud moment at @rootedcon 🚀
A few of us from @freepik just landed on the leaderboard of the @intigriti Live Hacking Event — and even got an extra bonus for making it there!
Always fun to push skills together with the team.
@alvarodh5 @Julioxus @bertrandlorente
4
3
27
1,271
UPDATE 🚀 nomore403 v1.1.0 is out! Including new features and updates to tackle those annoying 403 errors easier than ever.
Check out the full release notes and download now 👇github.com/devploit/nomore40…
4
10
890
Chupito cada vez que me aparece en LinkedIn un post con el vídeo de WORK FROM THE OFFICE vs WORK FROM HOME 🤦🏻♂️
1
7
Thanks for the book @GoogleVRP!
13