Daniel Púa

working in cybersecurity nowadays: > wake up > read "new critical vuln just dropped" > summon dev and SRE in the incident channel > patch, scan, rotate secrets, redeploy > check logs to make sure you are not already cooked > take a deep breath and go to sleep > wake up > read "new critical vuln just dropped"... WELCOME TO THE AI ERA

CVEs published pocs, vulnerable versions and mitigations can be found on blog.devploit.dev/posts/five-cve…

Daniel Púa, jefe de seguridad en Magnific: "El usuario de a pie debería estar preocupado porque el phishing se está refinando con IA" xataka.com/seguridad/dani…

Daniel Púa, jefe de seguridad en @magnific : "El usuario de a pie debería estar preocupado porque el phishing se está refinando con IA" xataka.com/p/338394?utm_s… @xataka @devploit

really awesome project! pulled a 94 overall off my github. open source national team, where you at. get scouted → gitfut.com/devploit #GitFut

@Bugcrowd your triagers need android training. urgently. 1/ I report a real android bug 2/ triager closes it, doesn't understand the attack 3/ program reopens it, gets the impact instantly the researcher and the vendor agree. the middle layer doesn't. fix the middle layer.

how do you read android contacts without the contacts permission? you don't. you ask an app that already has it, and let it hand you the bytes. google messages did exactly that. writeup 👇

Thanks @GoogleVRP !

unpopular opinion: guardrails are a suggestion, not a firewall

the pentest used to be a week and a report now it's a process that never ends and never files paperwork you don't have a pentest window anymore you have a permanent guest

On the night of San Juan, we jump over the fire. We talk, we drink, we kiss, until it's just embers In this story, the creators went the other way. Back to the moment before everything turns gray. Even in the ashes, there's still warmth. And you will always remember how the fire started Candela is made by people, using Magnific. From the music, to the characters, to the story This is created by the team at Magnific Studios

What I don’t think people are understanding is that ALL AI will soon be Mythos-level. Mythos wasn’t some special spooky cyber model. It was just the next thing in the factory track. Gpt-5.5 was immediately pretty close. This is just natural progression. And within a few weeks or months the open models will catch up. We need to be thinking about what’s going to happen to cyber, bio, and tons of other threat domains when every new model is this good. And perhaps even more importantly, what happens to the economy when the government pulls the lever saying it’s all now illegal. POOF

you don't need a zero-day when the agent has a yes-day

jwt .io shows you the token. it won't tell you how to break it. so i built jwtforge. it audits JWTs for vulns (alg:none, algorithm confusion, kid/jwk injection) and forges working attack tokens with curl/burp/nuclei/jwt_tool ready to run. all in your browser. nothing leaves your tab. jwtforge.com

the future of bug bounty isn't picking better targets it's fuzzing 1,500 apis while you sleep and letting ai triage the hits $500k says he's right. essential read

a bugcrowd triager marked my report "not applicable" because the impact wasn't understood tesla's team took another look, followed the full attack chain, reopened the vuln and rewarded me this is how a bug bounty program is supposed to work kudos to @Tesla

3 submitted. 1 triaged. 1 accepted. at this point "submitted" is not a status, it's a lifestyle

POV: you're red teaming a system that rewrites its own code 52x faster than you can read the diff anthropic just said that system is closer than people think good luck with the pentest report

MITRE just assigned me 5 CVEs across 3 npm packages you've never thought about. 500M+ downloads a month. the scariest vulns aren't in your code. they're in your node_modules. names drop when the embargo lifts.