ES
Menu
Skip the intro

David Fernández Morilla

Builder · Operator · Researcher

I build products, operate their infrastructure and break WordPress for fun.

Independent developer based in Riotorto (Lugo), Spain. Production platforms running on self-managed infra (VPS, K3s, Docker) and bug bounty hunting under the NyxSec handle.

See work Get in touch
Published advisories
7
Years operating own infra
5+

Selected projects.

I build products —for clients and for myself— from optimized WordPress platforms to FastAPI services managing electronic music festivals. That is the first layer.

Curated cases, not exhaustive lists. Each one represents one of the layers of the stack.

  1. — present

    security · ai-agents

    NyxSec — Bug bounty operation with an autonomous agent

    Vulnerability hunting platform targeting WordPress plugins. An AI agent runs 24/7 on a dedicated VPS, communicates via Telegram and follows an in-house E2E validation protocol. Seven assigned CVEs on plugins with install bases ranging from hundreds of thousands to millions of sites.

    Role
    Lead researcher · Agent design

    Repository

    • interface Telegram Bot API
    • application PythonSemgrep
    • AI Claude APIMCP servers
    • infrastructure DockerVPS

  2. — present

    product · wpo · devops

    WordPress platform — Aggressive WPO and full observability

    WordPress platform with aggressive WPO: load time reduced from 8.2 s to 1.76 s and page weight from 3.09 MB to 1.55 MB. Self-hosted stack on own infrastructure with full observability.

    Role
    Developer and maintainer
    • application WordPressPHPWP Super Cache
    • data Elasticsearch
    • infrastructure DockerTraefikfail2banGrafana

  3. — present

    product · devops

    gofestivals — Electronic music festivals platform

    Two domains under one brand identity (.es for Spain, .eu international) dedicated to the electronic music festival ecosystem, with catalog, listings and discovery.

    Role
    Owner · Full-stack · Product

    Live site

    • interface Next.js
    • application FastAPI
    • data PostgreSQLPostGISRedis
    • infrastructure Docker

  4. — present

    product · devops

    radio.gofestivals — Electronic music online radio platform

    Online radio platform with 1300+ curated stations, personalized recommendations, hybrid user accounts and its own admin panel. In production.

    Role
    Owner · Full-stack · Product

    RepositoryLive site

    • interface Next.js
    • application TypeScriptFastAPIPython
    • data PostgreSQLPostGISRedis
    • infrastructure DockerTraefik

  5. — present

    ai-agents · devops

    Multi-agent ecosystem — Nyx, OpenClaw and others

    A set of specialized AI agents —security, web dev, home automation— running on self-hosted infrastructure, communicating via MCP and reporting through Telegram. Experimental by design, productive by method.

    Role
    Design and operation
    • application PythonFastAPIHome Assistant
    • AI Claude APIMCPOllama
    • infrastructure DockerRaspberry Pi 5

  6. — present

    ai-agents · product

    AI Media Agents — Autonomous media platform with 9 AI agents

    Autonomous platform that discovers news, detects trends, writes SEO-optimized articles and publishes them without human intervention. Nine specialized agents communicate via event bus, with a Chief Editor as quality gatekeeper and LLM cost telemetry per pipeline run.

    Role
    Design and development · Owner

    RepositoryLive site

    • interface Next.js
    • application PythonFastAPI
    • AI OpenAIAnthropic
    • data PostgreSQLRedisQdrant
    • infrastructure Docker

  7. — present

    ai-agents · product

    kaleido — Unified multi-channel conversational platform

    Unified multi-channel conversational platform (WhatsApp Cloud API, Twilio, web chat) with multi-provider AI (Claude + GPT) and automatic human handoff. Built with Clean Architecture, 80% test coverage and a Next.js dashboard for real-time management.

    Role
    Design and development

    Live site

    • interface Next.jsTwilio
    • application Node.jsTypeScriptExpressPrisma
    • AI AnthropicOpenAI
    • data PostgreSQLRedis
    • infrastructure Docker

  8. — present

    product · devops

    Wedding platform — Multi-tenant SaaS for wedding websites

    Multi-tenant SaaS for creating wedding websites. Three subscription tiers with per-plan limits, Stripe for recurring payments and gifts, customizable templates and planned AI features for text generation and automatic color palettes. Deployed with Traefik and wildcard DNS.

    Role
    Owner · Full-stack

    Live site

    • interface Next.js
    • application Node.jsExpressPrismaStripe
    • AI OpenAI
    • data PostgreSQL
    • infrastructure DockerTraefik

I operate their infrastructure.

On top of every product runs an infrastructure I also operate myself: VPS and cloud servers, Docker containers orchestrated with K3s or Compose, Traefik in front, observability with Grafana, Prometheus and ELK, deployments via GitLab CI/CD. That is the second layer.

WordPress platform · WPO

Load time
before8.2 s after1.76 s
Page weight
before3.09 MB after1.55 MB

Published advisories.

And from operating so much WordPress I ended up hunting vulnerabilities on my own. Under the NyxSec handle I publish advisories on Wordfence and Patchstack: 7 assigned CVEs so far on plugins like Elementor, WPForms or Masteriyo LMS, with install bases ranging from hundreds of thousands to millions. That is the third layer.

Bug bounty hunting on WordPress plugins. Submissions to Wordfence and Patchstack following an in-house protocol: full E2E verification, framework defense check, no carrion (third-party discovered patches). Handle: NyxSec

  1. 5.3Medium

    CVE-2026-9188

    Appointment Bookings for Zoom GoogleMeet and more – Wappointment ≤ 2.7.6 — Unauthenticated Insecure Direct Object Reference via Predictable 'edit_key' / 'appointmentkey' Parameter

    Unauthenticated insecure direct object reference in the appointment cancellation and rescheduling endpoints. The edit_key that authorizes the action is a predictable, unsalted MD5 of client_id, start_at and staff_id, so an attacker can compute another user's key and cancel or reschedule their appointments. Requires cancellation or rescheduling to be enabled.

    plugin
    Appointment Bookings for Zoom GoogleMeet and more – Wappointment
    cwe
    CWE-639

    View advisory

    1. access unauthenticated
    2. entry edit_key · appointmentkey
    3. control appointment key predictable
    4. effect cancel or reschedule other users' appointments

  2. 7.5High

    CVE-2026-39524

    Masteriyo - LMS ≤ 2.1.5 — Payment Bypass

    Unauthenticated broken access control (missing authorization) that allows a payment bypass. Affects versions up to 2.1.5.

    plugin
    Masteriyo LMS – Online Course Builder for eLearning, LMS & Education
    cwe
    CWE-862

    View advisory

    1. access unauthenticated
    2. control authorization missing
    3. effect bypass payment

  3. 7.5High

    CVE-2026-40780

    BookIt < 2.5.4.1 — Broken Authentication

    Authentication bypass using an alternate path or channel: an unauthenticated attacker can exploit the password recovery flow. Affects versions before 2.5.4.1.

    plugin
    BookIt — Booking & Appointment Calendar
    cwe
    CWE-288

    View advisory

    1. access unauthenticated
    2. entry password recovery
    3. control authentication bypassable
    4. effect bypass authentication

  4. 4.3Medium

    CVE-2026-8689

    Visualizer: Tables and Charts Manager for WordPress ≤ 3.11.14 — Missing Authorization to Authenticated (Subscriber+) Arbitrary Chart Creation and Modification via renderChartPages() and uploadData() Functions

    Missing authorization check in the renderChartPages and uploadData functions, reachable by authenticated users with subscriber privileges. Allows creating and modifying arbitrary charts without the required capabilities.

    plugin
    Visualizer: Tables and Charts Manager for WordPress
    cwe
    CWE-862

    View advisory

    1. access subscriber
    2. entry renderChartPages · uploadData
    3. control authorization missing
    4. effect create and modify charts

  5. 5.3Medium

    CVE-2026-6498

    Five Star Restaurant Reservations ≤ 2.7.16 — Unauthenticated Payment Bypass via PHP Type Juggling in 'payment_id' Parameter

    Unauthenticated payment bypass via PHP type juggling in the 'payment_id' parameter. The loose comparison (==) lets an attacker skip payment verification by sending values that coerce to the expected type but do not match the real value.

    plugin
    Five Star Restaurant Reservations
    cwe
    CWE-345

    View advisory

    1. access unauthenticated
    2. entry payment_id
    3. control == comparison lax
    4. effect bypass payment verification

  6. 2.7Low

    CVE-2026-32445

    Elementor Website Builder ≤ 3.35.5 — Broken Access Control

    Missing authorization that allows exploiting incorrectly configured access control levels. Requires high privileges; the impact is limited modification.

    plugin
    Elementor Website Builder
    cwe
    CWE-862

    View advisory

    1. access high privileges
    2. control authorization missing
    3. effect limited modification

  7. 4.3Medium

    CVE-2026-32446

    Contact Form by WPForms ≤ 1.9.9.3 — Broken Access Control

    Missing authorization, reachable by authenticated users with low privileges, that allows exploiting incorrectly configured access control levels. The impact is limited information exposure.

    plugin
    Contact Form by WPForms
    cwe
    CWE-862

    View advisory

    1. access low privileges
    2. control authorization missing
    3. effect limited data exposure

These are not three parallel jobs: it is the same stack viewed from three altitudes. Operating teaches you to code better, coding teaches you to break things, breaking teaches you to operate.

What I touch every day.

No fake percentage bars. Just what I actually use in production.

Frontend

  • TypeScript
  • React
  • Next.js
  • Astro
  • Vue
  • Nuxt
  • Tailwind CSS

Backend

  • Python
  • FastAPI
  • PHP
  • Symfony
  • Laravel
  • Node.js
  • WordPress
  • PostgreSQL
  • MySQL
  • Redis
  • MongoDB

AI & Agents

  • Claude API
  • MCP servers
  • LLM agents
  • Multi-agent orchestration
  • Ollama

Infrastructure

  • Docker
  • Kubernetes (K3s)
  • Traefik
  • Nginx
  • GitLab CI/CD
  • AWS
  • Linux servers

Observability

  • Grafana
  • Prometheus
  • Elasticsearch
  • Kibana
  • Logstash
  • fail2ban

Security

  • WordPress vuln research
  • Semgrep custom rules
  • CVE/CVSS scoring
  • Wordfence/Patchstack
  • OWASP Top 10

Let's work together.

For projects, collaborations or just curiosity. I reply during CET working hours.

Or directly:

location
Riotorto (Lugo), Galicia
timezone
CET / CEST
status
Available for projects