‼️Breaking - Debian APT Flaw Lets Hackers Hijack Software Updates and Execute Code as Root Details: cybersecuritynews.com/debian… A newly disclosed bug in APT, the package manager behind Debian and Ubuntu, can let a network spy swap a trusted software package for a bad one. The flaw is tracked as CVE-2026-109518 and can end in code running with root rights, the highest level of control on a Linux system. APT checks each package against signed data before it installs anything. This flaw lets an attacker get around that check. According to Debian, APT can merge two different package downloads after an HTTP redirect gives them the same address. When APT resumes an interrupted download, it handles the file badly, and that opens a short window to replace the package after it has been verified. #CybersecurityNews

Image from Cyber Security News (@The_Cyber_News)

170

597

39,572

s4zero · Nov 5, 2026 · 12:08 AM UTC

s4zero@windows_updateNov 5

これがプロンプトか…

goldtooth.exe

@0xGoldToothOct 30

Replying to @0xGoldTooth

Here is exactly what I asked Claude Code. Plug the iPhone into a Mac with a cable, unlock it, tap "Trust", open Claude Code and paste this: "My iPhone is connected to this Mac. Check it read-only and change nothing. List every app with Full Access to Photos, when each one last opened the photo library, and which addresses it sent data to between midnight and 6 am. Flag any app that reads the Hidden album or sends data to a domain younger than 90 days, and tell me in plain words what to switch off first."

s4zero · Nov 5, 2026 · 12:00 AM UTC

s4zero@windows_updateNov 5

マジかい

goldtooth.exe

@0xGoldToothNov 4

Holy sh*t. Claude Code just found a hidden chip inside my Chinese power bank from Guangzhou. Every time I charged my iPhone, it quietly copied the whole phone… It also read our saved Wi-Fi password off my iPhone, got onto our home network and sent everything to a server. I bought it for $19 at an airport kiosk there 3 weeks ago. No brand, 30,000 mAh on the label, and it felt heavy. The first time I plugged in, the screen asked "Trust This Computer?". I tapped Trust without thinking and went on with my day. That one tap gave it access to everything. This morning I finally set up Claude Code to warn me when any device starts reading my files. An hour later, 10 seconds into charging, the screen filled with yellow warnings, then red ones: data was moving when it should only be charging. I asked Claude Code what was going on. My phone saw the power bank as a small computer with 64 GB of storage and its own internet connection. A USB cable has wires for power and wires for data, and a normal charger only uses the power ones. This one used both, and it had already copied all of this: → /device → IMEI and serial number → /contacts → 1,206 numbers → /apps → every app I have, including my 2 bank apps → /photos → 3,912 pictures, my passport among them → /wifi → our network name and its key → /wife's iPhone → her photos too, she charged from it twice and tapped Trust too Each time we plugged in, it used that key to get online and send out the new files: sends to → 47.***.***.12 uploads → 19 in 3 weeks last one → last night at 2:14, while we slept I pulled the cable right away. Then Claude Code blocked that address on our router and walked me through changing the Wi-Fi password and the logins for my bank apps. I had it opened at a repair shop, and what was inside is in the first comment. A 30-second check for your own is in the second one. Save this and test every power bank in your house today.