Just a reminder...

👀 ChatGPT Go Free for 12 Months in India..

For Existing Go users, you don't have to do anything, you will get an email confirming that you get an extended time for ChatGPT Go at no Cost.

- For Free Users follow this..
✅ Steps:
1. Open ChatGPT on the web or just upgrade your ChatGPT App.
2. Click “Upgrade for FREE” or "Try Go" in the above of the App.
3. Select “Upgrade to Go” (at ₹0).
4. Verify with an OTP sent to your mobile.
5. Add card/UPI details (₹2 charge refundable) to activate.
6. Make sure to disable Auto Pay before the trial period ends.

See the Ref Screenshots

Signing Off... @BuildBytes

🚨 URGENT SECURITY ADVISORY

SUBJECT: Malicious Persistence and Covert Networking in Magisk Module "Play Integrity Pr**ium -v19.9"

DEV OF CONCERN: f***h7

ACTION REQUIRED: IMMEDIATE UNINSTALLATION AND MANDATORY FACTORY RESET

------

1. EXECUTIVE SUMMARY

A security alert's been sent out about the Magisk add-on "Play Integrity P*m -v19.9". Tests show it’s harmful, once loaded, a hidden component sticks around even after removal. Instead of shutting down, it quietly phones home to a remote attacker’s machine.

This hands over total power to the hacker. One sure way to get rid of it? Wipe the device clean using a factory reset.

------

2. DETAILED ANALYSIS

The module uses various harmful methods, this is why experts often label it a risky spyware tool or even a rootkit

- CODE OBFUSCATION: The module’s scripts are purposely jumbled and concealed; this approach aims to keep users or security analysts from spotting its real, harmful actions.

- PERSISTENCE SETUP: This module drops a program into a main system folder (/system/bin/), one that’s separate from Magisk itself, so it sticks around even after uninstall. Because it's set to launch at startup with elevated access, it kicks in each time the device powers up - no extra steps needed.

- COVERT NETWORKING: A sneaky payload like this one's main job is phoning back to base. It works quietly behind the scenes, reaching out to a far-off server controlled by a hacker. From there, that hacker can steal info off your gadget, push fresh instructions to it, or rope your phone into a network of hijacked devices, all while you stay clueless.

------

3. EVIDENCE

The data shown here came straight from the setup files of the module.

EVIDENCE A: Code Obfuscation

The script hides a payload through layered encoding along with reversed instructions, so checking it by hand won't work unless it's first cleaned up.

shell

eval "$(echo "long.encoded.string..." | rev | base64 -d)"

EVIDENCE B: Persistence Command

This command grabs the harmful code from the module’s temporary spot, then moves it to a fixed system folder while setting it to run. That's what lets the malware stick around even after removal attempts.

shell

ui_print "- Installing core service..."

cp -f $MODPATH/system/payload.sh into /system/bin/sysdaemon

chmod 755 /system/bin/sysdaemon

------

4. POTENTIAL RISKS

A hacked gadget running deep malware lets the attacker:

- Snatch every bit of your info: login codes, bank stuff, personal chats, pictures.

Keep tabs on your moves by grabbing control of the camera~ also listens through the mic while tracking where you are right now.

- Keep track of what you type by saving each key pressed.

Unauthorized access to your device and malicious use.

------

5. MANDATORY ACTION PLAN

If you once put in this module, your device’s already at risk - do exactly what's next without delay.

1. BACKUP ESSENTIAL FILES ONLY:

Right away, save your private stuff - like pictures or paperwork - to a separate gadget. Don’t make a complete copy of the whole system, since that could include infected parts.

2. PERFORM A FACTORY RESET:

This’s the single method that clears the system partition while making sure malware’s gone. Head into Settings, tap System, pick Reset options, then choose Erase all data - basically a factory reset.

3. CHANGE ALL YOUR PASSWORDS

(Banks, online profiles, stuff like that) Take it as given that someone’s already got every password)

------

6. HOW TO PROTECT YOURSELF IN THE FUTURE

When code’s deliberately obscured, like being encrypted or jumbled, flag it as dangerous. Real devs show their work clearly. If something’s cloaked, it’s likely malicious; that’s the top warning sign.

- MAKE SURE IT'S SAFE WITH COMMUNITY CHECKS: When adding a fresh or unfamiliar module, hold off until reliable folks have looked it over; look up comments on solid boards such as XDA Developers or stick around till recognized group leads (for example, Cleverestech mods) break down what’s inside.

Please pass on this info to keep folks around safe.

There's nothing malicious in it I just verified it by myself by looking at the script as well.. as CIT also verified it...

I apologise for that, like without seeing the source I send it here (yigit or trygit dev) btw is a Keybox stealer XD read more here..

You shouldn't worry about that one module at least, but still beware before flashing any kind of modules..

Just cross check the source and the person whom to trust or not, because even Open Source Modules are malicious nowadays :)

Signing Off @BuildBytes

ShizuWall

A lightweight, privacy focused Android firewall application that blocks network connections for selected apps without requiring root access or VPN. ShizuWall leverages Shizuku to provide powerful network control capabilities. Requires Android 11 (API 30) or higher.

🔗 Links:
- Download
- Screenshots
- Features
- Source code
Developer: Ahmet Can Arslan

❤️ Support the Project

If this project makes your life easier, here are a few quick ways to show some love:

⭐ Star the repo/app
☕ Buy a coffee for the developer
🛠 Contribute code, issues, or pull-requests

🏷 Tags: #Android #Shizuku #Network

📊 Swift Backup vs Bundle Mods Module, Speed & Size Test

📦 Total App Size: 4 apps ~ 2.3 GB

🔵 Swift Backup
• 📁 Compressed Size: 1.46 GB
• ⏱️ Backup Time: 1 min 23 s
• ♻️ Restore Time: 1 min 58 s

🟢 Bundle Mods Module
• 📁 Compressed Size: 1.24 GB
• ⚡ Backup Time: 37 s
• 🔄 Restore Time: 59 s

🏆 Conclusion:
- Bundle Mods produces smaller backups and is much faster in both backup and restore compared to Swift Backup.

🗃️ Bundle Mods • v4

📦 A simple tool that bundles all your Magisk or LSPosed modules, or local/user apps (much faster than Swift Backup), into one neat pack or separate folder. You can set a custom name, author, version, and more.

✨ What's New in v4:

- 📱 Support for User apps backup/restore with full data: App & it's Splits, Data, ExtData, Media, OBB, Optionally: Android ID & All Permissions (like Swift Backup)
- 📔Creates a Config (with apps and parts) for User Apps so that you don't have to select same apps next time for backup.
- 📂 Introduced a new method to store backups in a separate folder for faster access.
- 📑 Removed Custom Script support, but you can still place scripts directly inside the ZIP or the #Backup folder.
- 🧩 Added BitGApps support (as it's flashable via Magisk). For NikGApps and others, visit this website.
- ℹ️ Added support to change the version name just like Name or Author or Pack.
- 📱Multiple fixes and improvements (see GitHub Commits).

📝Must Read:

- 📊 Check Comparison of Speed and Size here.
- ℹ️ Check the full info of Module here.
- 🔥 You may see massive speed improvement if you backup a lot of apps, because of parallel processing.

📦 Supports: Magisk • KernelSU • APatch, & their forks
📅 Released on: 16 November, 2025

🔗 Download From GitHub

🧾 Docs & Guide

📬 Report Issues / Get Support: @buildbytesdiscussion

❤️ Credits:
@ra_rear for Testing In SDCard and User Apps, Backup Restore.
@rifqihahay & @fearthecowl for Testing the module over-all

🚨 Chromium Zero-Day (CVE-2025-13223) — PATCH NOW!

A critical V8 “type-confusion” zero-day was being exploited in the wild. Chrome released fixes on 17 Nov 2025 (Stable: 142.0.7444.175/176). Other Chromium browsers (Edge, Brave, Opera, Vivaldi, Arc, etc.) share the risk and should release updates ASAP.

Why care: attackers could run code just by you visiting a malicious page — no downloads or prompts required.

Do this now:
1. Open browser → About → update.
2. Restart.
3. Update every Chromium browser you use.
For Org admins: push the patch, audit endpoints, monitor for anomalies.

While other browsers didn't release a patch for this, watch this video for blocking the exploit by TheoJoe.
TheoJoe - UPDATE NOW- New Exploit Found in Chrome (Also Edge/Brave/Opera)

Patch source: Chrome Releases (17 Nov 2025)

🚨 CLOUDFLARE IS DOWN! 🚨
Any website using cloudflare services is not loading.

It's UP!

Edit: It's down again

You can check the status here: https://www.cloudflarestatus.com/

Down again, what's up with the people at cloudflare?

Seems like it's up Again

Cloudflare even took down downdetector in some regions 💀

This means, we also need a downdetector for the downdetector.

If anyone wants an explanation for this down issue, you can read this

https://t.me/buildbytes/150?comment=1095