Cooler

BREAKING: Claude Code found 14,219 photos of my face on my Android that I never took. Phone was secretly taking them almost every time I picked it up. Even when I was just lying in bed. Even at home. Not screenshots. Real frames from the front camera. On the train. In the car. At home. When I just grabbed it to check the time. They were just sitting in a system cache. Timestamps and GPS on them. Nothing in Gallery. Nothing in Recently Deleted. Plugged the phone into my laptop, made a full backup, told Claude Code to look for any front-camera files that weren’t in my photos. It pulled /data/system/users/0/faceunlock/cache and another folder inside Google Play Services. Over 14 thousand files. Normal ones and infrared from Face Unlock. Every single one had time and location. Started scrolling. Almost everything from the last 15 months. Then I saw a file created 2 seconds ago. I was still looking at the folder. Phone kept taking photos while I was reading this. Google and the phone makers say Face Unlock turns everything into a mathematical model and deletes the image right away. On this phone the raw frames were just sitting there. Some of the processes writing to that folder were from system diagnostics. Couple of old apps that still had camera permission could also get in. Turned off diagnostics, revoked camera access from everything that doesn’t need it, cleared the cache. But how many of these frames already went somewhere else, I don’t know. If you want to check yours, plug it in, make a full backup or use ADB, and ask Claude to look for front-camera files outside your Gallery. Path above is where mine were.

Claude Code just found proof that every app on your phone is listening to your conversations. TikTok, Instagram, Facebook, Snapchat. they're using what you say out loud to build your feed. i have the data to prove it. i've suspected this for months. last week i finally checked. i was on a call with a friend and told him i'm thinking about breaking up with my girlfriend. didn't text it, didn't search it, just said it out loud with my phone on the table. two hours later she's lying on the couch scrolling TikTok and her entire feed is breakups. "signs your relationship is over." "how to heal after a breakup." she looked at me and said "why is TikTok showing me this." i said i don't know. but i did know. that night i connected my iPhone to my MacBook and ran Claude Code. it scanned every app's background microphone activity for the last 90 days. apps that were only supposed to have photos or location were activating the microphone anyway. → TikTok activated the microphone 347 times while the app was closed → Instagram 211 → Facebook 189 → Snapchat 94 i just sat there staring at the screen. every activation lasted between 3 and 15 seconds, enough to catch a sentence. every one of them tagged a keyword and cached it locally with a timestamp. Claude Code pulled the keyword cache: → "breakup": tagged 4 hours before her feed changed → "pregnancy test": whispered it to my girlfriend in the bathroom, baby ads the next morning → "laid off": said it to my mom before i told anyone at work, job board ads within an hour → "lump": my dad told me about his doctor's appointment, cancer screening ads that night → "therapist": a call i made from my car, mental health app ads the same day TikTok had the most entries, Instagram was second. every keyword matched a conversation i had out loud near my phone. the "lump" one is the one i can't stop thinking about. my dad hasn't even told my mom yet. Claude Code checked my girlfriend's phone in the same room. same keywords, same timestamps. both phones were picking up the same conversation and tagging it on their own. i asked it how to shut it down. it mapped every app's microphone access. what i did: → revoked microphone access from every app that doesn't need it → disabled background app refresh for TikTok, Instagram, Facebook, Snapchat → turned off "Hey Siri" (apparently it keeps the mic listening 24/7) → revoked "nearby interaction" (no idea what it even does, Claude Code said to kill it) Claude Code confirmed all four apps lost background microphone access. did the same on her phone, about 3 minutes each. within 48 hours both our feeds went random. generic stuff, nothing from our conversations. full step by step and the prompt are in the first reply. save it so you don't lose it, and send it to anyone who's ever said "my phone is definitely listening to me." it is.

BREAKING: Claude Code found 12,847 photos of my face on my iPhone that I never took. It looked like the phone was taking them every time I picked it up. From the club. From home. At a red light while I was driving. Almost every time I took the phone in my hands there was a frame. They were sitting in a system cache with timestamps and location data. None of them were in Photos. I plugged the phone into my MacBook and asked Claude Code to scan for any front-camera files that weren’t in my Photos library or Recently Deleted. It flagged Private/var/mobile/Library/Caches/com.apple.faceid. Over 12,000 files. Mix of infrared frames and regular front-camera images. Each one had a timestamp and GPS coordinates attached. I started scrolling. Most were from the last 14 months. Then I saw one from four seconds ago. I was still looking at the folder. Apple says the TrueDepth system turns the capture into a mathematical model inside the Secure Enclave and discards the image. On this phone the raw frames were still in the cache. Several of the processes that wrote to the folder belonged to system diagnostics. A couple of old apps with camera permission also had access to the same directory. I turned off diagnostics sharing and revoked camera access from every app that didn’t need it. If you want to check your own phone, plug it in, run a backup, and ask Claude Code to look for front-camera files outside the Photos library. The folder path above is where mine were.

Claude Code found 214,856 photos and videos I permanently deleted from my Android. Three years of deleted photos and videos still sitting in a hidden cache. Any app with storage access can read them. After the iPhone post I plugged my Pixel into the MacBook and asked Claude Code to check for leftover deleted files. It immediately pointed at a folder I had never opened. DCIM/.thumbnails. Over 215,000 files. Photos, videos, screenshots. Every single one was something I deleted. Claude Code said most of them were not listed in the gallery trash or in MediaStore. Photos from 2022, 2023, 2024 and 2025. The ones I deleted the second after taking them. The ones I cleared from Trash. The ones I deleted three separate times because I wanted to be sure they were gone. All still there. Passport photo I took for a visa application in 2024. Screenshots of my bank app with full account numbers visible. Private photos I sent someone and immediately deleted after a breakup. Screenshot of my crypto seed phrase I took temporarily in 2023. Photo of my ID and credit card I took to remember the numbers and deleted 5 seconds later. Screenshots of my ex’s private stories I saved and permanently deleted in 2024. Most were compressed previews. A few dozen were close to full size. All organized by date going back to 2021. When you delete a photo on Android, the gallery removes it from your camera roll and Trash holds it for 30 days. It keeps a compressed copy in the thumbnail cache and MediaStore so your phone can show previews when you search or scroll. The system almost never cleans this folder. Files from 2022 were still sitting there. They told you it was permanently deleted. It wasn’t. I checked which apps on my phone had storage access. 27 apps. Weather apps. QR code scanners. PDF readers. A flashlight app I downloaded in 2021 that I forgot I even had. A calculator. Two of them still asked for full file access every time I opened them. Any one of them could have been reading every photo I ever deleted this entire time. Went from 27 apps to 5 in about two minutes. On iPhone the cache was harder to reach. On Android any app with storage permission can open this folder directly. Full step by step below. Takes 2 minutes. Save it so you don’t lose it and send it to anyone with an Android phone.

Claude Code found 145,763 photos I permanently deleted from my iPhone. Three years of deleted photos and videos still sitting in a hidden cache. Any app with file access can read them. I plugged my iPhone into my MacBook to run a backup. Claude Code was doing the security audit from my last post and flagged a directory I wasn't even looking for. PhotoData/Thumbnails. Over 146,000 files. Photos, videos, screenshots. Every single one was something I deleted. Photos from 2023, 2024 and 2025. The ones I deleted the second after taking them. The ones I cleared from Recently Deleted. The ones I deleted three separate times because I wanted to be sure they were gone. All still there. Passport photo I took for a visa application in 2023. Screenshots of my bank app with full account numbers visible. Private photos I sent someone and immediately deleted after a breakup. Screenshot of my crypto seed phrase I took temporarily in 2022. Photo of my ID and credit card I took to remember the numbers and deleted 5 seconds later. Screenshots of my ex's private Instagram stories I saved and permanently deleted in 2023. Some were full resolution. All organized by date going back to 2021. When you delete a photo on iPhone, iOS removes it from your camera roll and Recently Deleted. It keeps a compressed copy in a Spotlight search index cache so your phone can find things when you search. Apple never clears it. Not after 30 days. Not after a year. Never. They told you it was permanently deleted. It wasn't. I checked which apps on my phone had Files and Folders access. 23 apps. Weather apps. QR code scanners. PDF readers. A flashlight app I downloaded in 2022. Any one of them could have been reading every photo I ever deleted this entire time. Went from 23 apps to 3 in about two minutes. Full step by step below. Takes 2 minutes. Save it so you don't lose it and send it to anyone with an iPhone.

JUST IN: A new unpatched PHP RCE dropped today. Don't panic. It only works if four things go wrong at once. CVE-2026-115560 is separate from PHP2Shell, and the Oct 21 patches don't fix it. To be exposed, an app must: → set an unusual session serializer → switch it at runtime via ini_set() → do it before session_start() → still have upload progress on PHP calls it unlikely. No emergency patch. No exploitation reported. Already set session.upload_progress.enabled=0 per the Oct 21 advice? You're covered. Keep the PHP2Shell patch. Watch the next release.

THE FIREWALLS THAT ARE SUPPOSED TO STOP PHP2SHELL RUN PHP TOO. Palo Alto says every version of PAN-OS and Panorama is affected, and there's no fixed release yet. The exposure is the management interface, so for now the fix is keeping it reachable only from trusted internal IPs. It's not just Palo Alto. Germany's BSI lists the open source firewalls pfSense and OPNsense among the PHP-based systems likely affected. Cisco is checking 18 products and 13 cloud services, Webex and ISE among them, and says there are no workarounds. Fortinet is checking 12 products. FortiOS is in the clear. Meanwhile Wikipedia took some of its PHP systems offline as a precaution, and government and school sites went offline in the Netherlands, Finland, Germany, France and Denmark. Still no confirmed successful break-in anywhere. Lots of attempts, nobody has shown a real compromise yet. If you run a firewall with a web admin page, check who can reach it today.

I FACT-CHECKED THIS LIST. EVERYTHING I CHECKED HOLDS UP. Japan's PM Takaichi really did post on X asking for urgent PHP patching. Onamae really shut down Desktop Cloud with up to 26,739 servers hit. One eMudhra CA key really was the number 4, and Mozilla, Google and Apple are now blocking those certificates. Two details worth adding. Amazon saw the first PHP2Shell attempt on its honeypots on October 17, before the bugs were public. And in the AI hacking story, 1,200+ was the number of sites attempted. More than 100 companies were actually breached, Deere and Cummins among them. The fix for the PHP part is still the same: 8.5.12, 8.4.27, 8.3.36 or 8.2.35.

62K people saw "PHP 8.5.12 security patch is incomplete." Fewer read the bottom of his own screenshot: both PHP2Shell CVEs are genuinely fixed. The claim is about three other paths that may still work on 8.5.12. He says it needs validation, and PHP hasn't confirmed anything yet. It has happened before. In 2012 PHP had to ship a second fix after its first patch for a critical PHP-CGI bug didn't hold. So don't roll back. Patch now and watch for the next release.

Wiz: wiz.io/blog/php2shell-php-rc… OpenAI: openai.com/index/coordinated…