Claude Code just found proof that every app on your phone is listening to your conversations. TikTok, Instagram, Facebook, Snapchat. they're using what you say out loud to build your feed. i have the data to prove it. i've suspected this for months. last week i finally checked. i was on a call with a friend and told him i'm thinking about breaking up with my girlfriend. didn't text it, didn't search it, just said it out loud with my phone on the table. two hours later she's lying on the couch scrolling TikTok and her entire feed is breakups. "signs your relationship is over." "how to heal after a breakup." she looked at me and said "why is TikTok showing me this." i said i don't know. but i did know. that night i connected my iPhone to my MacBook and ran Claude Code. it scanned every app's background microphone activity for the last 90 days. apps that were only supposed to have photos or location were activating the microphone anyway. → TikTok activated the microphone 347 times while the app was closed → Instagram 211 → Facebook 189 → Snapchat 94 i just sat there staring at the screen. every activation lasted between 3 and 15 seconds, enough to catch a sentence. every one of them tagged a keyword and cached it locally with a timestamp. Claude Code pulled the keyword cache: → "breakup": tagged 4 hours before her feed changed → "pregnancy test": whispered it to my girlfriend in the bathroom, baby ads the next morning → "laid off": said it to my mom before i told anyone at work, job board ads within an hour → "lump": my dad told me about his doctor's appointment, cancer screening ads that night → "therapist": a call i made from my car, mental health app ads the same day TikTok had the most entries, Instagram was second. every keyword matched a conversation i had out loud near my phone. the "lump" one is the one i can't stop thinking about. my dad hasn't even told my mom yet. Claude Code checked my girlfriend's phone in the same room. same keywords, same timestamps. both phones were picking up the same conversation and tagging it on their own. i asked it how to shut it down. it mapped every app's microphone access. what i did: → revoked microphone access from every app that doesn't need it → disabled background app refresh for TikTok, Instagram, Facebook, Snapchat → turned off "Hey Siri" (apparently it keeps the mic listening 24/7) → revoked "nearby interaction" (no idea what it even does, Claude Code said to kill it) Claude Code confirmed all four apps lost background microphone access. did the same on her phone, about 3 minutes each. within 48 hours both our feeds went random. generic stuff, nothing from our conversations. full step by step and the prompt are in the first reply. save it so you don't lose it, and send it to anyone who's ever said "my phone is definitely listening to me." it is.

BREAKING: Claude Code found 12,847 photos of my face on my iPhone that I never took. It looked like the phone was taking them every time I picked it up. From the club. From home. At a red light while I was driving. Almost every time I took the phone in my hands there was a frame. They were sitting in a system cache with timestamps and location data. None of them were in Photos. I plugged the phone into my MacBook and asked Claude Code to scan for any front-camera files that weren’t in my Photos library or Recently Deleted. It flagged Private/var/mobile/Library/Caches/com.apple.faceid. Over 12,000 files. Mix of infrared frames and regular front-camera images. Each one had a timestamp and GPS coordinates attached. I started scrolling. Most were from the last 14 months. Then I saw one from four seconds ago. I was still looking at the folder. Apple says the TrueDepth system turns the capture into a mathematical model inside the Secure Enclave and discards the image. On this phone the raw frames were still in the cache. Several of the processes that wrote to the folder belonged to system diagnostics. A couple of old apps with camera permission also had access to the same directory. I turned off diagnostics sharing and revoked camera access from every app that didn’t need it. If you want to check your own phone, plug it in, run a backup, and ask Claude Code to look for front-camera files outside the Photos library. The folder path above is where mine were.

Claude Code found 214,856 photos and videos I permanently deleted from my Android. Three years of deleted photos and videos still sitting in a hidden cache. Any app with storage access can read them. After the iPhone post I plugged my Pixel into the MacBook and asked Claude Code to check for leftover deleted files. It immediately pointed at a folder I had never opened. DCIM/.thumbnails. Over 215,000 files. Photos, videos, screenshots. Every single one was something I deleted. Claude Code said most of them were not listed in the gallery trash or in MediaStore. Photos from 2022, 2023, 2024 and 2025. The ones I deleted the second after taking them. The ones I cleared from Trash. The ones I deleted three separate times because I wanted to be sure they were gone. All still there. Passport photo I took for a visa application in 2024. Screenshots of my bank app with full account numbers visible. Private photos I sent someone and immediately deleted after a breakup. Screenshot of my crypto seed phrase I took temporarily in 2023. Photo of my ID and credit card I took to remember the numbers and deleted 5 seconds later. Screenshots of my ex’s private stories I saved and permanently deleted in 2024. Most were compressed previews. A few dozen were close to full size. All organized by date going back to 2021. When you delete a photo on Android, the gallery removes it from your camera roll and Trash holds it for 30 days. It keeps a compressed copy in the thumbnail cache and MediaStore so your phone can show previews when you search or scroll. The system almost never cleans this folder. Files from 2022 were still sitting there. They told you it was permanently deleted. It wasn’t. I checked which apps on my phone had storage access. 27 apps. Weather apps. QR code scanners. PDF readers. A flashlight app I downloaded in 2021 that I forgot I even had. A calculator. Two of them still asked for full file access every time I opened them. Any one of them could have been reading every photo I ever deleted this entire time. Went from 27 apps to 5 in about two minutes. On iPhone the cache was harder to reach. On Android any app with storage permission can open this folder directly. Full step by step below. Takes 2 minutes. Save it so you don’t lose it and send it to anyone with an Android phone.

62K people saw "PHP 8.5.12 security patch is incomplete." Fewer read the bottom of his own screenshot: both PHP2Shell CVEs are genuinely fixed. The claim is about three other paths that may still work on 8.5.12. He says it needs validation, and PHP hasn't confirmed anything yet. It has happened before. In 2012 PHP had to ship a second fix after its first patch for a critical PHP-CGI bug didn't hold. So don't roll back. Patch now and watch for the next release.

THIS IS F*CKING INSANE: AI models from OpenAI and Google helped find PHP bugs that sat there for over a decade and let an attacker run code on a web server with one request and no login. PHP runs an estimated 75 to 80% of all websites. The bugs are CVE-2026-109618 and CVE-2026-109619, now known as PHP2Shell. Both are rated critical, CVSS 9.2, and the PHP team shipped fixes on October 21. How it leaked On the morning of October 20 a Hacker News post claimed two critical PHP vulnerabilities were about to go public. The post was deleted, but screenshots were already spreading. watchTowr confirmed the leak and said disclosure had been planned for Thursday at 11am ET. A few hours later the PHP security team moved the release up a day, to Wednesday 14:00 UTC, and said it could ship even earlier if details came out or attacks started. Patches landed around 9:30am ET on October 21. What the bugs do Both come from PHP leaving memory in a broken state when a request ends abnormally. One is in how PHP handles running out of memory while it sets up a request. The other lets state from one request survive into the next request on the same worker after its memory was freed. Either can end in code execution as the web server's worker account. Wiz says nearly every PHP version is affected, going back to PHP 5.4. Every PHP install that serves web requests is in scope: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP team calls mod_php the highest risk, because the attack can fire before any application code runs. Clean WordPress or Laravel code won't save you here. The AI part Wiz Research found the first bug on August 19 and reported both to the PHP team on August 24. Wiz says it used Gemini 4 Argon and GPT-5.6 Sol throughout, and credits Gemini with a big part of finding the flaws, building the exploit and validating the patch. OpenAI says GPT-5.6 Sol found one of the flaws as part of its Patch the Planet program. It coordinated the fix with PHP's maintainers, Wiz, Cloudflare and US agencies including CISA. Calif researchers are credited too. OpenAI calls this a "Defender's Window": AI seems to have found the bugs before attackers did. Wiz adds that frontier models cut the effort needed to chain bugs and adapt an exploit, so flaws that used to be impractical to exploit no longer are. OpenAI expects more findings like this in the coming months. OpenAI has published a PHP version checker on GitHub and committed $1 billion in subsidized access for defenders with limited resources. Is anyone exploiting it Cloudflare's CTO said they were already seeing early attacks on both flaws before the patches shipped. Huntress had not seen exploitation across its partners as of 10am ET on October 21. Kevin Beaumont called it one of the biggest vulnerabilities in years and expects a wave of incidents. VirusTotal estimates more than 5.1 million PHP hosts are exposed online. What governments said The UK's NCSC told organisations to find every PHP install, internet-facing ones first, and update. If that can't happen fast, take the system offline until it's fixed and check it for signs of compromise. Reuters reports that an EU agency also warned some websites may need to go offline. What to do today 1. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. For 7.4, 8.0 and 8.1 there are minimal source backports, but those branches no longer get regular updates, so plan the upgrade. 2. Check everything that bundles PHP: CMS hosting, cPanel and Plesk, vendor appliances. Apply their patches as they come out. 3. If you install from rpms.remirepo.net, it had no updated packages on release day. Use your distro's packages or build from source. 4. If you can't patch right now, PHP's advisory lists temporary mitigations, but a PHP core developer said none of them fully blocks the attack. Cloudflare pushed WAF rules to all customers, free plan included. 5. Watch for spikes in HTTP 500 errors, unexplained PHP worker restarts, workers spawning shells or download tools, and new files in the web root. The installs nobody remembers will be the hard part. Hal Pomeranz pointed out how many embedded PHP setups will never get patched at all. If you host anything on PHP, run php -v on every server today. Sources: Wiz, OpenAI, NCSC, Huntress, BleepingComputer, Help Net Security