Microsoft MVP 14 | Sr. Manager Technical Support, Americas @Telerik @Sitefinity - Product Security, AI Development X history moved to Bluesky (at)https://teapawt.net/t.co/pd7dusnf9X
Boston, MA
Joined December 2010
- Tweets586
- Following801
- Followers4.5K
- Likes4.9K
Lance McCarthy retweeted
🚨 PSA for anyone running a Linux server, node, or relay
CVE-2026-98432 is a critical Linux kernel bug (CVSS 9.8). Someone on the internet can send crafted TCP packets and take over your machine. No login needed.
Ubuntu and Red Hat haven't shipped a fixed kernel yet. Debian, SUSE, Oracle and Amazon have.
What to do today:
1. Check your kernel: uname -r
Fixed versions: 6.1.190+, 6.6.159+, 6.12.113+, 6.18.56+, 7.2.10+ or 7.3+. Below that, you're exposed.
2. If your distro has a fix, update and reboot.
3. If not, block the attack. It needs TCP packets with "IP options," which normal traffic never uses. One nftables rule drops them. Log what gets dropped so you can see if someone's probing you.
4. Turn off MPTCP unless you need it:
sysctl -w net.mptcp.enabled=0
Programs built with Go 1.24+ use MPTCP automatically, and that's how the known exploit gets in.
5. Make it survive a reboot, and check it still works after one.
If you run a Bitcoin node, a Lightning node or a Nostr relay, your machine is on the internet by design. Do this today.
Self-hosting is freedom. Patching is part of the job. 🛡️
Lance McCarthy retweeted
In lieu of flowers, memorial contributions may be made to:
Johns Hopkins Alzheimer’s Disease Research Center Fund
alzresearch.org/giving/
Alzheimer’s Foundation of America Caregiver Resources
alzfdn.org/donate/
Photo Credit: Tommy Garcia
Want to disappear from the world for a while in a #wikihole? en.wikipedia.org/wiki/Regist…
Lance McCarthy retweeted
BREAKING: Claude Code found 14,219 photos of my face on my Android that I never took. Phone was secretly taking them almost every time I picked it up. Even when I was just lying in bed. Even at home.
Not screenshots. Real frames from the front camera. On the train. In the car. At home. When I just grabbed it to check the time.
They were just sitting in a system cache. Timestamps and GPS on them. Nothing in Gallery. Nothing in Recently Deleted.
Plugged the phone into my laptop, made a full backup, told Claude Code to look for any front-camera files that weren’t in my photos. It pulled /data/system/users/0/faceunlock/cache and another folder inside Google Play Services. Over 14 thousand files. Normal ones and infrared from Face Unlock. Every single one had time and location.
Started scrolling. Almost everything from the last 15 months. Then I saw a file created 2 seconds ago. I was still looking at the folder. Phone kept taking photos while I was reading this.
Google and the phone makers say Face Unlock turns everything into a mathematical model and deletes the image right away. On this phone the raw frames were just sitting there. Some of the processes writing to that folder were from system diagnostics. Couple of old apps that still had camera permission could also get in.
Turned off diagnostics, revoked camera access from everything that doesn’t need it, cleared the cache. But how many of these frames already went somewhere else, I don’t know.
If you want to check yours, plug it in, make a full backup or use ADB, and ask Claude to look for front-camera files outside your Gallery. Path above is where mine were.
Claude Code found 145,763 photos I permanently deleted from my iPhone.
Three years of deleted photos and videos still sitting in a hidden cache. Any app with file access can read them.
I plugged my iPhone into my MacBook to run a backup. Claude Code was doing the security audit from my last post and flagged a directory I wasn't even looking for.
PhotoData/Thumbnails. Over 146,000 files. Photos, videos, screenshots. Every single one was something I deleted.
Photos from 2023, 2024 and 2025. The ones I deleted the second after taking them. The ones I cleared from Recently Deleted. The ones I deleted three separate times because I wanted to be sure they were gone. All still there.
Passport photo I took for a visa application in 2023.
Screenshots of my bank app with full account numbers visible.
Private photos I sent someone and immediately deleted after a breakup.
Screenshot of my crypto seed phrase I took temporarily in 2022.
Photo of my ID and credit card I took to remember the numbers and deleted 5 seconds later.
Screenshots of my ex's private Instagram stories I saved and permanently deleted in 2023.
Some were full resolution. All organized by date going back to 2021.
When you delete a photo on iPhone, iOS removes it from your camera roll and Recently Deleted. It keeps a compressed copy in a Spotlight search index cache so your phone can find things when you search. Apple never clears it. Not after 30 days. Not after a year. Never.
They told you it was permanently deleted. It wasn't.
I checked which apps on my phone had Files and Folders access. 23 apps. Weather apps. QR code scanners. PDF readers. A flashlight app I downloaded in 2022. Any one of them could have been reading every photo I ever deleted this entire time.
Went from 23 apps to 3 in about two minutes.
Full step by step below. Takes 2 minutes. Save it so you don't lose it and send it to anyone with an iPhone.
Readers added context they thought people might want to know
The video is an old, misappropriated clip from 2023, and the accompanying claims are fabricated.
x.com/HarshithLucky3…
Who would have thought circular funding would lead to this... /s
msn.com/en-us/news/news/cont…
Oh man, I wanted this so badly. @bioware theres got to be a way to get alternate funding, and let you fly.
youtu.be/HhKBFn4DNtA?is=KlLK…
I'm not surprised wsj.com/world/ukraine-starli…
I'm taking a break from X
O.M.G.
Im tempted to setup Jellyfin just give my family this 😎
This is amazing. This developer created a "game" where it's like the inside of a BlockBuster video.
... but the videos are from your personal Jellyfin server, so you can recreate the experience in the 90s of picking out a movie to watch.
Link to wishlist on Steam:
store.steampowered.com/app/5…
What a HUGE difference it has been on the internet being here in Ireland for less than 24 hours. Websites are being honest, actually letting you manage cookies, and so much more.
Even twitter (cough X) is falling in line...
I love my password purgatory C# fork, still running it and still get hillarious telemetry every month.
Lance McCarthy retweeted
Updated to Xcode 27? Your .NET MAUI iOS app may now crash at launch on every iOS 27 device. No managed exception, no build warning. Apple now requires the UIScene lifecycle; most MAUI projects lack it. Two files fix it:
dev.to/danardelean/your-net-…
#dotnetmaui #dotnet #iOS #Xcode
So, hey @surface, you happen you have any Copilot+ PC just gathering dust you wanna send me?
I can give them a meaningful afterlife 😅
Only $5k is a disgrace. @msftsecurity do better.
‼️ BREAKING: A 16-year-old hacker broke into an internal Microsoft analytics service with a forged, unsigned login token and ran SQL as admin, reaching databases that held over 17 trillion rows, including Bing search analytics and 17,990 employee email records.
The service, called Titan, checked every field on the token except its signature, so just claiming to be "admin" got him in, writes the researcher, who goes by Faav.
He says he only pulled metadata and two single rows of Bing data, never touched customer data, and reported the flaw to Microsoft the same night.
Microsoft locked the endpoint four days later, paid him $5,000, and had editorial control over his write-up, cutting sections and figures and reshaping how the impact was described before it went public.
Started playing #ControlResonant tonight, they weren't kidding thats it's a bit difficult at first... but so worth it, such a gorgeous game (and easier once you get the mechanics down).
Just finished printing a 5-disc addon for the @MVPAward main crystal, perfect place to put the blue discs.
I can share the STL, but small blog post soon on how I used Copilot CLI to get the perfect fit.
Michael Blumenthal (MVP, not on X) created the original but it had some layout issues. He hopped into @betsyweber's 3D printing team chat, I only took it across the finish line.
