Cesar Chavez Martinez retweeted
BREAKING: Claude Code found 12,847 photos of my face on my iPhone that I never took.
It looked like the phone was taking them every time I picked it up. From the club. From home. At a red light while I was driving. Almost every time I took the phone in my hands there was a frame.
They were sitting in a system cache with timestamps and location data. None of them were in Photos.
I plugged the phone into my MacBook and asked Claude Code to scan for any front-camera files that weren’t in my Photos library or Recently Deleted. It flagged Private/var/mobile/Library/Caches/com.apple.faceid. Over 12,000 files. Mix of infrared frames and regular front-camera images. Each one had a timestamp and GPS coordinates attached.
I started scrolling. Most were from the last 14 months. Then I saw one from four seconds ago. I was still looking at the folder.
Apple says the TrueDepth system turns the capture into a mathematical model inside the Secure Enclave and discards the image. On this phone the raw frames were still in the cache. Several of the processes that wrote to the folder belonged to system diagnostics. A couple of old apps with camera permission also had access to the same directory.
I turned off diagnostics sharing and revoked camera access from every app that didn’t need it.
If you want to check your own phone, plug it in, run a backup, and ask Claude Code to look for front-camera files outside the Photos library. The folder path above is where mine were.
Claude Code found 145,763 photos I permanently deleted from my iPhone.
Three years of deleted photos and videos still sitting in a hidden cache. Any app with file access can read them.
I plugged my iPhone into my MacBook to run a backup. Claude Code was doing the security audit from my last post and flagged a directory I wasn't even looking for.
PhotoData/Thumbnails. Over 146,000 files. Photos, videos, screenshots. Every single one was something I deleted.
Photos from 2023, 2024 and 2025. The ones I deleted the second after taking them. The ones I cleared from Recently Deleted. The ones I deleted three separate times because I wanted to be sure they were gone. All still there.
Passport photo I took for a visa application in 2023.
Screenshots of my bank app with full account numbers visible.
Private photos I sent someone and immediately deleted after a breakup.
Screenshot of my crypto seed phrase I took temporarily in 2022.
Photo of my ID and credit card I took to remember the numbers and deleted 5 seconds later.
Screenshots of my ex's private Instagram stories I saved and permanently deleted in 2023.
Some were full resolution. All organized by date going back to 2021.
When you delete a photo on iPhone, iOS removes it from your camera roll and Recently Deleted. It keeps a compressed copy in a Spotlight search index cache so your phone can find things when you search. Apple never clears it. Not after 30 days. Not after a year. Never.
They told you it was permanently deleted. It wasn't.
I checked which apps on my phone had Files and Folders access. 23 apps. Weather apps. QR code scanners. PDF readers. A flashlight app I downloaded in 2022. Any one of them could have been reading every photo I ever deleted this entire time.
Went from 23 apps to 3 in about two minutes.
Full step by step below. Takes 2 minutes. Save it so you don't lose it and send it to anyone with an iPhone.
Cesar Chavez Martinez retweeted
🚨Cyber Alert ‼️
🇯🇵Japan - 𝗦𝗼𝗻𝘆 𝗡𝗲𝘁𝘄𝗼𝗿𝗸 𝗖𝗼𝗺𝗺𝘂𝗻𝗶𝗰𝗮𝘁𝗶𝗼𝗻𝘀
Sony Network Communications confirmed a data breach affecting 2,585,481 So-net and plala customer records following unauthorised access on October 19, 2026.
The exposed information included personal details, account credentials and banking information.
Threat actor: Not specified
Sector: Telco
Data exposure (claimed): 2,585,481 customer records, including 54,401 email addresses and passwords, 16 bank account records and 7 password-reset notification records
Data type: Personal details, contact information, account IDs, email addresses, passwords, bank account records, password-reset notification records
Observed: Oct 27, 2026
Status: Confirmed
ESIX©: 7.17
Full details and impact assessment on
HackRisk.io
Cesar Chavez Martinez retweeted
🚨 Virtualine: An offshore hosting provider offering bulletproof hosting services has reportedly been seized by the FBI. There is no press release at this time.
Cesar Chavez Martinez retweeted
PHP just issued security update to fix a 9.2 (Critical) vulnerability related to Brotli (CVE-2026-111497). This affects Windows systems only.
Update to these versions if you're on Windows:
- 8.5.12-1
- 8.4.27-1
- 8.3.36-1
- 8.2.35-1
php.net/archive/2026.php#202…
Cesar Chavez Martinez retweeted
❗️ Google's privacy policy no longer rules out ads based on your Gmail, Drive and Photos.
A 16 October update makes an exception if you let other Google services, like Search, access that data.
Search may process it to "personalize content, including ads", the policy now says.
Cesar Chavez Martinez retweeted
A developer left a PHP server vulnerable to the new PHP2Shell flaws and put a Bitcoin key on it, challenging hackers to steal the funds.
After around 19 hours, a researcher known as KillaBoi successfully exploited the vulnerability and extracted the private key.
The wallet contained around $2,000, but the key turned out to be linked to the wrong wallet, so the funds couldn’t actually be taken.
The dev still confirmed the exploit worked and paid the researcher the prize.
Cesar Chavez Martinez retweeted
UPDATE: UNIT 42 RETRACTS PHP2SHELL EXPLOITATION UPDATE
Unit 42 has retracted its Oct 23 update that tied a European government intrusion to PHP2Shell (CVE-2026-109618 / CVE-2026-109619). It says it is unable to confirm that initial access was associated with those CVEs.
The CVEs remain critical unauthenticated RCE (CVSS 9.2). Patching guidance and the ~22.6M exposed-instance figure still stand. Our Oct 24 “UNIT 42 CONFIRMS…” post is superseded by this correction.
unit42.paloaltonetworks.com/…
#DDW #PHP2Shell #Unit42 #CyberSecurity #ThreatIntelligence
Cesar Chavez Martinez retweeted
❗️ A bug in Microsoft Authenticator let an Android app with zero permissions pose as Teams and steal a user's work-account tokens.
In Enclave's tests, the tokens opened the victim's mailbox, files and calendar with no prompt.
Microsoft fixed it in July as CVE-2026-80097.
Cesar Chavez Martinez retweeted
Hay un tendal de personas que han perdido acceso a su WhatsApp. No es un "hackeo", mucho menos una "clonación", hasta hoy hallé 3 vectores:
1) SIM Swapping o transferencia fraudulenta de titularidad del chip de la víctima al victimario. Hablar con la telefónica, denuncia policial
Cesar Chavez Martinez retweeted
面白いサイトが現れた。
例のPHPの脆弱性「php2shell」、実際に完全なRCEまで辿り着いて悪用している例が少なすぎて「わざと脆弱なまま放置したよ！自由に乗っ取ってね、30万円分のBitcoinウォレットも置いときます」という挑発サイトが爆誕
stealmybitcoin.com/
Cesar Chavez Martinez retweeted
WATCH: Migrant Uber Eats delivery workers in France are using multiple phones to reject low-paying orders, forcing the app’s algorithm to raise delivery offers to €15 or more.
Cesar Chavez Martinez retweeted
Security Alert: U.S. Mission Saudi Arabia (October 25, 2026)
Effective October 23, 2026, the Department of State ordered non-emergency U.S. government employees and U.S. government employee family members to leave Saudi Arabia due to safety risks.
Iranian-supported Houthis have engaged in hostilities against Saudi Arabia, including attacks on civilian airports and other critical infrastructure resulting in civilian casualties and severe travel disruptions. The hostilities have the potential to escalate rapidly beyond that immediate area.
U.S. government employees working in Saudi Arabia require special authorization from Chief of Mission to use any airport in Saudi Arabia following recent missile and UAV attacks on airports in the Kingdom.
King Khalid International Airport (RUH) in Riyadh announced a partial reopening as of October 25 for domestic flights and some international flights operated by national carriers. A limited number of flights normally based at RUH are operating out of Qassim-based Prince Naif bin Abdulaziz International Airport (ELQ).
Operations at King Abdulaziz International Airport in Jeddah (JED) are operational with some delays and cancellations.
Operations at King Fahd International Airport in Dammam (DMM) are operational with some delays and cancellations.
U.S. citizens should be aware of potential attacks on airports, airspace closures, flight cancellations, and travel disruptions. Please take extreme caution if you choose to use airports in Saudi Arabia. We recommend checking your flight departure status directly with the airline and with the airport.
Read more: sa.usembassy.gov/security-al…
Cesar Chavez Martinez retweeted
Someone has created a vulnerable PHP website, loaded it with a Bitcoin wallet, and challenged the Internet to hack into it and they can keep the Bitcoin. It has a running timer to show if the PHP exploitability was over-hyped. stealmybitcoin.com/
Cesar Chavez Martinez retweeted
Php2shell-scanner Tool for scanning php2shell using 3 methods: via URL, localhost, SSH
github.com/aancw/php2shel
Cesar Chavez Martinez retweeted
Everything that's made on gob.pe is run by an obseletr php. Most SSL won't load on any other explorer that isn't edge since it's the only one that's still accepts them.