Security shaped by design, not disaster. Cyber • AI Safety • Data Protection — straight talk, no jargon.
United Kingdom / EU
Joined May 2021
- Tweets3.9K
- Following725
- Followers723
- Likes18.9K
Since 5 Feb 2026 the ICO can compel witnesses to attend interviews and demand reports from approved persons.
For Cookies and e-marketing, PECR fines now = £17.5m or 4% of global turnover, same ceiling as UK GDPR.
Cookies and e-marketing are no longer the cheap breach.
Is your consent evidence ready?
Sources (ICO):
Commencement statement, 5 Feb 2026: ico.org.uk/about-the-ico/med…
PECR changes summary: ico.org.uk/about-the-ico/wha…
Most DPIAs aren't skipped. They start too late.
From March 2023 the Met Police used Auror, a third party app, with no approval and no DPIA. In 2024 officers uploaded data on 179 people, 3 under 18.
Outcome: a reprimand and an enforcement notice.
Is yours done before go live?
Sources (ICO):
News release, 14 Oct 2026: ico.org.uk/about-the-ico/med…
Enforcement entry: ico.org.uk/action-weve-taken…
AI agents are next on the ICO's list.
On 8 Oct 2026 the ICO said 10 foundation model developers had made or committed to data protection changes. Its call for evidence on agentic AI closes 20 Nov.
Deploying agents? Can you say what data they touch and who signed off the DPIA?
Sources (ICO):
News release, 14 Oct 2026: ico.org.uk/about-the-ico/med…
Enforcement entry: ico.org.uk/action-weve-taken…
This is scary stuff and highlights the importance of taking security seriously.
Whilst it has traditionally being businesses that are targeted, the rise of AI has made this kind of thing much easier to do.
My recommendation is to vet every app your child has on their phone. Whilst not every parent will be able to do what Starmex did, the minimum I would suggest is set up a scheduled task for your AI to run a weekly check against the apps on your list, looking for any sign of security risk.
Claude Code found 17,342 of my daughter's photos on a server in Hangzhou. she's 16. she had her Hidden album locked with Face ID and thought nobody could see it. an app she downloaded from the App Store has been sending every photo on her phone to China for 10 months. i checked her two friends' phones the same night. same app. same server.
her phone was lagging so i connected it to my MacBook. Claude Code flagged an app called "GlowCam - Beauty Filter" with 4.2 million downloads. it was uploading her entire photo library every 6 hours between 1am and 5am while she was sleeping.
→ app → "GlowCam - Beauty Filter" (4.2M downloads, 4.7 stars)
→ server → 112.17.***.63
→ location → Hangzhou, China
→ total files uploaded → 17,342
→ active since → January 2026
→ permissions → camera, photos, microphone, location
every photo she ever took. every screenshot. every image anyone ever sent her. everything from her Hidden album that she locked with Face ID thinking it was safe. Face ID only stops a person who picks up the phone. an app with Full Access to Photos opens the Hidden album like any other folder. there's no green dot for that.
two of her friends were at our house that evening. i asked them to let me check their phones. both had GlowCam installed.
→ my daughter's iPhone 16 Pro Max → 17,342 files uploaded to Hangzhou
→ her friend's iPhone 15 → 9,740 files uploaded to the same server
→ her friend's iPhone 15 → 6,210 files uploaded since April
3 phones on my kitchen table all sending photos to the same folder in China.
i asked Claude Code to trace where the files went. it found photos from all 3 phones on a site that sells stolen photo libraries sorted by age and location.
→ www.le***dumpcc → their city listed, folders tagged "16-19"
→ tme/ph***vault_cn (41,000+ subscribers) → folder link shared 2 weeks ago
→ buyer access → $8 per library
someone paid $8 per library. 3 libraries from 3 teenage girls. Apple approved the app that made it possible.
then Claude Code scanned every other app on all 3 phones and found 2 more doing the same thing.
→ "PhotoRoom — Background Eraser" → uploading to a server in Jakarta
→ "FaceTune Lite — Selfie Editor" → uploading to a server in Mumbai
what Claude Code did on all 3 phones:
→ killed every upload process and purged all caches
→ revoked Full Access from every photo app
→ switched everything to "Limited Access"
→ filed DMCA takedowns on the site and the telegram channel
→ turned on Advanced Data Protection for iCloud on all 3 accounts
the site took the photos down in 72 hours. the telegram channel is still up.
i called both their parents that night. i told all 3 girls the apps were slowing their phones and i deleted them. none of them know what i actually found.
if your kid has a beauty filter or photo editor on their phone right now there's a real chance it's doing exactly this. check Settings → Privacy & Security → Photos and count how many apps have "Full Access." every single one can read the Hidden album, the Recently Deleted folder, and every photo your kid has ever taken.
my daughter had 11 apps with Full Access. she needed 2.
the prompt is in the first reply. run it on every phone in your house tonight. takes 3 minutes. save it and send it to every parent you know.
Readers added context they thought people might want to know
OP's post is flagged as false and written by AI:
x.com/i/grok/share/a…
OP has a history of fake AI content:
Claiming Claude discovered spying about his "girlfriend":
x.com/starmexxx/stat…
Then, about his "wife's" videos:
x.com/starmexxx/stat…
"Spy camera" found in hotel room:
x.com/starmexxx/stat…
Spyware on "Friend's computer":
x.com/starmexxx/stat…
OP selling AI products: x.com/starmexxx/stat…
Such a beautiful video.
Take the time to appreciate the journey you are on. No one else's is the same as your's, and it really is special as tough as it can be at times.
Critical PHP security update needed.
Two serious security flaws have been found in PHP (the language that powers many websites and web apps). These issues (CVE-2026-109618 and CVE-2026-109619) could let attackers remotely run their own code on affected servers, which could lead to stolen data, full system compromise, or further attacks on your network.
What organisations should do right now:
Update PHP immediately
Upgrade to the fixed versions listed on php.net (8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 or later in those branches).
First, find every place PHP is running in your environment, especially public-facing websites and any products or appliances that include PHP. Prioritise those.
If you cannot update right away
Take the affected systems offline (or isolate them from the internet) until you can apply the fix. Partial configuration workarounds exist but are incomplete and not a substitute for patching.
Watch for signs of attack
Monitor web servers for unusual activity, such as PHP processes unexpectedly starting command shells, downloading files, or other suspicious behaviour. Make sure you have process and log monitoring in place.
If you suspect a compromise
Isolate the affected systems immediately, preserve web server and PHP logs, and report it to your local FBI field office or ic3.gov. These reports help investigators track the attackers and warn others.
For the latest details, check the official PHP announcement on php.net, CERT-EU Security Advisory 2026-018, and CISA’s Known Exploited Vulnerabilities catalog.
Always follow the official php.net guidance for the exact update steps that apply to your setup.
🤖 Made with AI
Katachi Labs retweeted
Je ne veux plus fréquenter les gens qui disent « À quoi ça sert ? ».
J’ai 50 piges sur mon passeport, 12 ans dans ma tête (et 18 ans dans mon slip, dirait ma femme).
Et je compte bien que ça dure.
Je ne supporte plus les pisse-vinaigre professionnels du scepticisme.
À quoi ça servait de vouloir voler ? De traverser les océans ? De marcher sur la Lune ?
À rien. Jusqu’au jour où quelqu’un l’a fait.
J’ai toujours eu une tendresse infinie pour les originaux. Les inadaptés. Les rebelles. Les emmerdeurs. Ceux qui ne rentrent pas dans les cases.
Ceux qui ont des idées absurdes, des ambitions démesurées, des projets improbables.
Parce que ce sont eux qui font avancer le monde.
Pas les gestionnaires du déclin.
Les gens suffisamment fous pour croire qu’ils peuvent changer le monde sont précisément ceux qui finissent par le changer.
Et ce qui me terrifie aujourd’hui c’est l’état d’esprit que nous transmettons à nos enfants.
On les élève dans une atmosphère de fin du monde permanente. Entre malthusianisme, injonctions à la décroissance, culpabilité écologique et anxiété organisée.
Quelle terrible inversion des valeurs !
L’écologie devrait être un formidable défi lancé à l’intelligence humaine, pas une pédagogie de la résignation.
Je ne veux pas d’une génération qui s’excuse d’exister au point de ne plus faire d’enfants
Je veux une génération qui brûle d’envie de découvrir, de créer, de baiser, de comprendre !
l’optimisme n’est pas de la naïveté mais le courage de croire en notre capacité à tout affronter.
Le progrès n’est pas une fatalité mais une conquête.
C’est mon ode aux rêveurs, aux inventeurs, aux enthousiastes, aux insoumis, aux doux dingues et aux emmerdeurs magnifiques.
À tous ceux qui disent « t’es cap ? » plutôt que « À quoi ça sert ? ».
J’ai 50 ans, et je refuse de devenir vieux dans ma tête.
Aux fous qui veulent changer le monde !
A lot of people are confused or dismissive of the new Tesla Roadster, struggling to see its purpose.
This isn’t about practical road use, any more than a street-legal 200+ mph car is.
It’s a pure demonstration of capability. A statement that Tesla builds the most profitable and popular EVs, and no one else can match the technology.
Okay, WTAF did I just watch!
What is this even!
NO FREAKING WAY!!!!
@elonmusk Roadster just FLEW up and off the road and SUCCESSFULLY landed !!
WOW!!! 🤯
Does anyone else think that Windows is just the worst these days?
Constant updates
Bloatware
Intrusive applications
Resource heavy (most annoying)
Just sick of it. I want to move everything over to Linux but I am so tied into the whole windows centric work style and space now it feels like it will be very painful.
If anyone has any ideas or knows of an easy way to do it, please let me know 🙏
Love the beat! But seriously... the quality is improving almost by the day!
Remember when people were saying AI will never be able to make music or art?
This is just the beginning.
Now on to a serious point. If people can prompt SI to make this, what do you think the criminals are making. Secure your stuff folks.
i was talking 4 days with Claude for this song
Berlin rave meets opera.
Human-made Slopcore.
Unpromptable.
55,000 lines of code
282 clips generated.
99 chosen.
Music? Art? A cultural movement?
We wil find out eventually...
I'M YOUR SLOP (I'M YOUR ART) 🎨
btw, thanks for all the messages. im not use have notifications. bit overwhelmed 💀
Ai is getting crazy good! Check out this music vid.
Now think about what the bad guys are going to do with the new tools at their disposal. You cannot afford to allow your security team to run things like the good ol days. They need to be red teaming all the time.
In case you want to watch this on YouTube, or share with friends who don't use X.
youtu.be/BZvz3Lki9mQ?is=RPVM…
Katachi Labs retweeted
It's not the lack of intelligence, it's the lack of focus that is stopping you.
Unverified, but multiple Claude users are reporting the same thing: Anthropic force-signing them out and removing the saved card from their account.
Per the notification users have shared, this isn't a breach of Anthropic. Infostealers on people's own machines lifted live Claude session cookies, and someone started picking those sessions out of the logs and burning the usage.
Families named in the email: Vidar, Lumma (LummaC2), StealC, RedLine and Acreed on Windows. Atomic Stealer on a small number of Macs.
No public advisory from Anthropic at time of posting. Treat accordingly.
The lesson holds either way. A stolen session token doesn't care about your password or your MFA. Revoking the session kills the attacker's copy. It does not kill the malware that took it.
If you got the email: clean the machine first. Then rotate the email account password and enable 2FA. Then re-add the card. In that order
Source:
