A user claims that, while reviewing an iPhone backup with Claude Code, they found 145,763 images and videos in a PhotoData/Thumbnails directory, including items they had removed from both the camera roll and Recently Deleted. They say the files dated back to 2021 and included highly sensitive material such as passport and ID photos, bank-account screenshots, a crypto seed phrase, and private images. The user attributes the files’ persistence to an iOS Spotlight search cache, arguing that deleted photos may remain there indefinitely in compressed form. They warn that apps with Files and Folders access could potentially reach the material, report reducing that access from 23 apps to three, and offer a prompt for scanning a backup for lingering image files.
The post presents the discovery as evidence that deleting photos on an iPhone may not erase every copy, but its technical explanation and claims are disputed in the supplied discussion. One commenter argues that accessing such data would require a difficult jailbreak or security bypass, says Claude Code cannot access an iPhone directly, and characterizes the video as a jailbreak demonstration rather than proof of an ordinary iPhone backup exposing deleted photos. The central issue is therefore both privacy-related and technical: whether the files were actually recoverable deleted photos in a normal backup, or artifacts exposed through a modified device or other special access.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Attackers attempted to exploit critical GitLab vulnerability CVE-2026-97229 on Alpine Linux’s instance, crashing worker processes, but Alpine found no evidence of successful access or tampering. Alpine rebuilt the instance, reset passwords, and warns that self-managed GitLab deployments also need patched Ruby - not just a GitLab upgrade. (alpinelinux.org)
A leak of DHS records exposed personal and workplace details for more than 41,000 employees and contractors, including undercover ICE agents and information about surveillance programs. Distributed Denial of Secrets published the data, while Okta said it had no evidence its systems were breached. (wired.com)
Several PDF tools generate advertised AES-256 keys from weak randomness, making encrypted files vulnerable to passwordless decryption. MuPDF versions before 1.28.5 expose only 9 bits of random state in the key, while Foxit relies on predictable time-based randomness. (v12.sh)
Distributed Denial of Secrets published a searchable database with contact information for nearly 40,000 DHS employees, reportedly obtained through an Okta single sign-on leak. The group says the database highlights officials overseeing agency policies and operations, including immigration enforcement and covert programs. (techdirt.com)
Distributed Denial of Secrets released personal and job data on more than 40,000 DHS employees, including staff in surveillance, intelligence, and undercover roles. The group says the data came from a hack of DHS’s Okta sign-on service, but Reuters could not verify the full trove and Okta reported no evidence of a compromise. (reuters.com)
An Android user says Claude Code uncovered 14,219 front-camera and infrared face-unlock images in system and Google Play Services caches, many with timestamps and location data. The user says images kept appearing and recommends checking device backups, though the claim has not been independently verified. (twitter.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.