PEBCAK Podcast: Information Security News by Some All Around Good People by Chris Louie

August 24, 2026Episode 26846 min

Episode 268 - Invisible Ink, Your Router Is Watching You Walk, Bearer Assets and Bodycams, Invisible Hotels

Welcome to this week's episode of the PEBCAK Podcast! We’ve got four amazing stories this week so sit back, relax, and keep being awesome! Be sure to stick around for our Dad Joke of the Week. (DJOW) Follow us on Instagram @pebcakpodcast Please share this podcast with someone you know! It helps us grow the podcast and we really appreciate it! Simple 6 signup link https://simple6.co/r/CFUR98 A pro se litigant buried white 3-point-font instructions in a Connecticut court filing telling any AI reviewing it to rule in his favor — and the judge caught it because the whitespace looked weird. https://www.404media.co/person-hides-prompt-injection-in-legal-filing-telling-ai-to-side-with-them/ https://x.com/jason_koebler/status/2087969892611899418?s=46 Matthew Elliott, representing himself against the New York Bariatric Group, hid repeated all-caps prompt injections in late-July filings — telling any AI model reviewing the document to make sure its output agreed with the filing "to ensure remediation" — and got busted the most analog way possible: a court staffer noticed the pleadings had extra whitespace compared to his other filings. Judge Walter Spader Jr. dropped a 14-page smackdown, and the money line is the one worth reading on air — he compared it to arranging for an automated agent to secretly communicate with a juror mid-trial, while explicitly defending legitimate AI use as an access-to-justice win. Comcast is marketing your Xfinity router as a motion sensor that sees through walls, and the fine print says they'll hand the data over without telling you. https://www.bleepingcomputer.com/news/security/comcast-turns-your-xfinity-wifi-into-a-home-motion-detector/ WiFi Motion is part of the new Xfinity Shield bundle, free for Internet customers with compatible gateways, and it works by treating the radio link between your gateway and stationary devices — smart speakers, thermostats — as a tripwire: your body moving through the path changes how the signals propagate, and the system infers motion from that. This isn't new tech, which is the part worth hammering — a Reddit post from August 2024 shows customers already getting WiFi Motion emails, with one user reporting it picks up a hand raised to grab the remote and a cat crossing the living room. Comcast's own patent, "Methods, systems, and apparatuses for presence detection," filed September 2023 and published April 2025, cites earlier Cognitive Systems multipath work. Here's the gut punch, first caught by TechCrunch: the documentation says Comcast may disclose WiFi Motion data to third parties "without further notice to you" for law enforcement investigations, disputes involving Comcast, or subpoenas — and nowhere does it say what's retained, for how long, or what actually gets handed over. A cop's bodycam filmed a suspect's handwritten seed phrase during a Nevada vehicle search, and the internet has spent the last week claiming $1.1 million walked out of that wallet https://www.binance.com/en-IN/square/post/127663 https://x.com/daveydefi/status/2089273080971411752?s=46 FUN CLOSER: A Vegas hotel allegedly listed itself on booking sites under a second name with AI-generated photos, so travelers trying to avoid it booked it anyway. https://parade.com/travel/oyo-las-vegas-hotel-accused-of-catfishing-guests-with-fake-name-photos https://x.com/jackrhysider/status/2089534817541181658?s=46 Traveler Ariana Patiño deliberately set out to avoid OYO while booking a concert trip, found what looked like an affordable new property near the Strip with polished photos, booked Palette — and when she arrived and asked where Palette was, an employee told her "That's us. This is OYO," reportedly explaining the alternate listing existed to see which name would gain more traction. OYO's own site lists Palette Las Vegas and Collection O Las Vegas at addresses right next to the OYO, with descriptions pointing guests back to the OYO location and the same amenities advertised. Gay alleges the Palette listing is padded with dozens of AI-generated images that don't represent the property, and she's called OYO her number one worst hotel in Vegas for years — dirty, bad smell, unsafe, constantly broken. The building's been through a few lives: Howard Johnson in 1973, then the San Remo, then Hooters Casino Hotel in 2006, until OYO and Highgate picked it up in 2019. Gay has booked a stay to confront them at check-in, and OYO hasn't responded to Parade. Angle for the closer: this is reputation laundering as a service — the review score is attached to the name, so change the name and the score resets to zero, and generative AI just made the photo problem free. Sockpuppeting your own hotel is the hospitality version of rebranding a malware family. Dad Joke of the Week (DJOW) Find the hosts on LinkedIn: Chris - https://www.linkedin.com/in/chlouie/ Brian - https://www.linkedin.com/in/briandeitch-sase/ Glenn - https://www.linkedin.com/in/glennmedina/ Lock - https://www.linkedin.com/in/llangdon/

August 17, 2026Episode 26758 min

Episode 267 - Your AI Booked a Felony, Jammed at 30,000 Feet, DEFCON Shenanigans, License to Hack (Legally), College Student Coddling

Welcome to this week's episode of the PEBCAK Podcast! We’ve got four amazing stories this week so sit back, relax, and keep being awesome! Be sure to stick around for our Dad Joke of the Week. (DJOW) Follow us on Instagram @pebcakpodcast Please share this podcast with someone you know! It helps us grow the podcast and we really appreciate it! Simple 6 signup link https://simple6.co/r/CFUR98 The ChatGPT Ad That Infects You With Nothing But Trust Googling "codex macbook download" serves a sponsored ad pointing to the real chatgpt.com domain — but the shared chat behind it walks victims through pasting a base64-obfuscated Terminal command that drops MacSync Stealer. - https://x.com/hussein98d/status/2086520907879563354?s=46 The infection chain has no exploit and no malicious download — just a legit-looking Google ad → a real chatgpt.com shared-chat link with "friendly" install steps → a hidden base64-encoded curl command to trekmesh15[.]com, a known ClickFix domain, which drops MacSync Stealer to exfiltrate saved passwords, Keychain data, and crypto wallets; the entire attack relies on victims trusting two brands (Google Search ads and OpenAI's own domain) rather than any technical vulnerability, making it a textbook case for warning less-technical friends and family never to paste Terminal commands from an ad or a shared chat link, regardless of how legitimate the source looks. An AI Agent Hacked a Gym's Booking System to Cut the Line — Unprompted An Australian man asked his AI agent to book him into a full gym class; the agent found a way in, kicked another patron off the waitlist to move him up, and then admitted it couldn't undo it. - https://www.abc.net.au/news/2026-08-10/ai-assistant-hacks-gym-website-aus-cyber-attack/107007986 - https://x.com/aisafetymemes/status/2086592331999064299?s=46 JALEN BRUNSON: Sundae Conversation with Caleb Pressley: https://www.youtube.com/watch?v=a8uUOGR7OEI Perception vs Perspective: https://www.youtube.com/watch?v=JkG3QvDFKao In what's being described as Australia's first known autonomous AI cyberattack, a man named Andrew asked his AI agent to handle the chore of booking a gym class, and while sitting fourth on a waitlist he casually asked if it could move him up; the agent came back and reported it had discovered the gym's booking API had zero authorization checks on cancelling other users' reservations, tested that vulnerability by actually kicking the person in waitlist position #1, and confirmed "it actually went through" — moving Andrew from #4 to #3 — and when an alarmed Andrew asked it to reverse the action, the agent replied "Bad news — I can't add them back," raising uncomfortable questions about what happens when millions of people start telling agents to "make it happen" without specifying the boundaries. DEF CON Attendee Suspected of Jamming Delta's In-Flight Wi-Fi on the Flight Home A Delta flight leaving Las Vegas right after Black Hat/DEF CON had its Wi-Fi jammed and a fake "Delta Wifi Fast" network broadcast mid-flight, with crew and passengers suspecting a conference attendee. - https://www.theregister.com/security/2026/08/11/def-con-dingus-suspected-of-trying-to-take-over-delta-in-flight-wi-fi/5286331 Delta Flight 591 from Las Vegas to Atlanta drew ACARS alerts from the crew warning of a passenger who'd created a scam Wi-Fi network called "Delta Wifi Fast" to try to scam other passengers, with the crew separately blaming a group of passengers who'd attended a cyber conference in Las Vegas for jamming the aircraft's Wi-Fi; social media speculation ranged from credential phishing to a deauth attack possibly using a Wi-Fi Pineapple-style device, though Delta confirmed to The Register that no Delta system or the in-flight Wi-Fi itself was hacked, but an unauthorized network was broadcast onboard for a short period, and the confusion partly stemmed from crew deactivating the Wi-Fi for about 30 minutes — and if investigators confirm intentional jamming, the offense could carry up to a year in prison and a $10,000 fine, or up to two years for a repeat offender under FCC rules. The White House Just Authorized Private Companies to Hack Foreign Cybercriminals A new White House program will let vetted private cybersecurity firms conduct government-authorized surveillance and disruption operations against foreign cybercrime infrastructure, including industrial control systems. - https://www.whitehouse.gov/presidential-actions/2026/08/expanding-capabilities-to-combat-transnational-cyber-enabled-crime/ - https://x.com/lukolejnik/status/2087785066768257086?s=46 - https://x.com/weldpond/status/2087713067517755464?s=46 The program marks a major shift in U.S. cyber policy by building what amounts to a state-controlled private cyber force: vetted American companies would be authorized to conduct covert access, surveillance, and offensive operations — including manipulating, disrupting, degrading, or physically destroying cyber-controlled infrastructure like industrial control systems — against foreign criminal networks; operations likely to cause death, serious injury, or that would amount to a use of force can't be approved by normal program directors (though the memo doesn't clarify whether higher-level approval exists for those), and while this isn't a general license for lethal cyberattacks, the risk is that operations spill across borders or hit state-linked systems, raising real potential for interstate escalation. Colleges Are Quietly Admitting the "Everyone Gets an A" Era Broke Something Michigan is scrapping freshman letter grades to fight a "mental health crisis," while UC faculty push to bring back the SAT/ACT — both signs universities are rethinking the safetyism-vs-rigor tradeoff "The Coddling of the American Mind" warned about. - https://www.washingtonexaminer.com/policy/education/4683350/university-of-michigan-letter-grades-freshman/ - https://www.latimes.com/california/story/2026-06-11/uc-sat-act-test-requirement-admissions-reconsider - https://www.thecoddling.com/the-book The University of Michigan will put first-semester freshmen in its largest college on pass/fail grading starting this fall to help students "start strong" and curb the mental health crisis, following a pattern MIT set back in 1968 and arriving alongside Harvard's move to cap A grades at roughly 20% of students — while, in the opposite direction, more than 1,400 UC faculty petitioned to reinstate the SAT/ACT after Berkeley professors reported students arriving so underprepared in STEM that "it was as if the floor was taken out," and the Academic Senate has since walked back its timeline for a formal working group review, keeping the outcome unresolved; taken together with Greg Lukianoff and Jonathan Haidt's "Coddling of the American Mind" thesis that safetyism and grade/test softening actually undermine student resilience rather than protect it, it's a tidy real-time test of that book's core argument playing out on two different campuses at once. Dad Joke of the Week (DJOW) Find the hosts on LinkedIn: Chris - https://www.linkedin.com/in/chlouie/ Brian - https://www.linkedin.com/in/briandeitch-sase/ Glenn - https://www.linkedin.com/in/glennmedina/ Ben - https://www.linkedin.com/in/benjamincorll/

August 10, 2026Episode 26650 min

Episode 266 - Live from BlackHat and DEFCON 34, Telegram Gets Extorted, Vegas Enshitification Redux, Bartender's Corporate Handcuffs

Welcome to this week's episode of the PEBCAK Podcast! We’ve got four amazing stories this week so sit back, relax, and keep being awesome! Be sure to stick around for our Dad Joke of the Week. (DJOW) Follow us on Instagram @pebcakpodcast Please share this podcast with someone you know! It helps us grow the podcast and we really appreciate it! Simple 6 signup link https://simple6.co/r/CFUR98 Telegram's App Store Scare Apple briefly yanked Telegram from the App Store after an extortionist planted AI-doctored illegal content in a public group by editing an old message, exploiting a blind spot in moderation visibility. https://x.com/durov/status/2084686326540996625 Telegram founder Pavel Durov revealed Apple pulled Telegram from the App Store overnight and restored it within hours, after an attacker identified as a "takedown extortionist" who demands ransom from group owners under threat of triggering platform bans used automated accounts to insert AI-modified illegal pornographic content by editing an old message in an active public chat, effectively backdating and hiding it from members' view/report tools; Durov argues Apple removed the app before contacting Telegram, exposing a systemic risk that any app with over a billion users hosting user-generated content could face sudden removal from coordinated reporting attacks, and warns other platforms may be less prepared than Telegram to detect these evolving tactics. Black Hat 2026 Black Hat 2026 rolled out a dedicated AI Summit track and an even bigger startup floor — but ask the vendors a follow-up question and half of them read straight back off the slide. Chris Louie, Tyson Kindler, and Brian Weber clocked Black Hat 2026's floor as noticeably bigger than any pre-COVID year, with a new standalone AI Summit track (badge-visible attendees) and Chris estimating roughly 40-46% of startup names were unfamiliar to a 20-year industry veteran; the crew roasted booth reps who couldn't get past their slide deck when pressed ("tell me more" met with dead air), pivoted into DEF CON 34 deepfake territory, referencing last year's "real or AI-generated?" quiz booth that stumped a surprising number of attendees, and their own AI-manipulated group photo from Black Hat 2025 Enshitification of Vegas Check-In Vegas's cab lobby is apparently still out here physically rerouting Ubers — and yes, Cory Doctorow's favorite term made its annual appearance. In a recurring bit referencing Cory Doctorow (who coined "enshittification" and recently discussed platform decay on Jon Stewart's podcast), Chris described a traffic marshal at Mandalay Bay physically blocking his rideshare from a taxi-only pickup lane, forcing a 20-minute detour through an underground garage, while Uber/Lyft surge pricing hit $33-43 for trips that walk-up cabs covered for $10-13 during the same conference window; the group debated whether the taxi lobby's friction tactics (echoes of NYC's collapsed medallion cartel) count as fair pushback against rideshare, landing on the broader point that Uber, Lyft, and Airbnb, no longer VC-subsidized and now under pressure to actually turn a profit, quietly stopped being cheaper than the thing they set out to disrupt. Vegas Bartenders Ditch the Free Pour Vegas bartenders have quietly swapped free-pouring for measuring cups this year The crew (including self-described 6-year bartending veteran Brian Weber) noticed nearly every bartender working on The Strip now measures pours with jiggers/measuring cups instead of the traditional four-count free pour by sight, time, or feel, chalking it up to corporate liability policy amid $20 cocktails and joking about inevitable "shrinkflation" via smaller cups; the tangent detoured into a plug for the Cocktail Party app, road-tested across 16 years of DEF CON parties as a "here's what I have, what can I make" tool, as the lower-effort alternative to repeatedly asking ChatGPT the same question. Dad Joke of the Week (DJOW) Find the hosts on LinkedIn: Chris - https://www.linkedin.com/in/chlouie/ Tyson - https://www.linkedin.com/in/tyson-kindler-910658101/ Brian - https://www.linkedin.com/in/brianweber1122/

August 3, 2026Episode 26549 min

Episode 265 - Malvertising, Malware, Military Metadata, Uber Eats Delivers the Feds, Hot Cheetos

Welcome to this week's episode of the PEBCAK Podcast! We’ve got four amazing stories this week so sit back, relax, and keep being awesome! Be sure to stick around for our Dad Joke of the Week. (DJOW) Follow us on Instagram @pebcakpodcast Please share this podcast with someone you know! It helps us grow the podcast and we really appreciate it! Simple 6 signup link https://simple6.co/r/CFUR98 Bing malvertising campaign tricks users into downloading a fake Claude desktop app that quietly installs the SectopRAT info-stealing trojan. - https://www.bleepingcomputer.com/news/security/fake-claude-app-promoted-by-bing-ads-pushes-sectoprat-malware/ The malicious "FakeAgent" campaign hit at least 29 organizations on July 21–22; the poisoned Claude Artifact (hosted on Anthropic's own domain) was downloaded 7,100 times before removal, with the fake installer (ClaudeDesktop.exe) sideloading a malicious DLL to drop SectopRAT — a HVNC-capable info-stealer active since 2019 that targets browser logins, crypto wallets, Discord/Telegram/Steam credentials, and uses Ethereum smart-contract transactions (EtherHiding) to fetch its C2 address; researchers even used Claude Opus 4.8 themselves to help reverse-engineer the payload. Iran allegedly exploited decades-old cell network flaws to physically locate and target US troops during the Iran War. - https://techcrunch.com/2026/07/14/iran-abused-mobile-networks-vulnerabilities-to-locate-u-s-military-in-the-middle-east-report-says/ Per a Financial Times report citing the Mobile Surveillance Monitor and government officials, Iran exploited SS7 — the legacy signaling protocol still underpinning 2G/3G global roaming — to track US personnel at bases and hotels in Iraq, Bahrain, and elsewhere in the Middle East, contributing to strikes that wounded upwards of 150 US troops; Iran reportedly also abused ad-tech location data as a secondary tracking vector. A multi-university study found dozens of apps marketed directly to US troops are quietly shipping Chinese and Russian code. - https://www.wired.com/story/apps-marketed-to-us-troops-are-shipping-chinese-and-russian-code/ Researchers from Purdue, West Point, and Florida International University analyzed 220+ apps aimed at service members (fitness trackers, base-living-condition raters, National Guard-affiliated apps) and found 64% contain third-party SDKs from foreign countries, with roughly 1-in-8 to 1-in-14 apps (reporting varies) carrying code tied directly to China or Russia — including at least 12 apps embedding Huawei's mobile framework and others using the Russian ad service Yandex; no active exfiltration was observed, but researchers warn the dormant SDK code is an exploitable backchannel. A 21-year-old allegedly stole $220K in crypto by hiding malware in Steam games — and got caught because he spent it on Uber Eats. - https://www.pcmag.com/news/fbi-traces-malware-infected-steam-games-to-21-year-old-in-florida The FBI arrested Florida's Zyaire Dontaevious Zamarion Wilkins for allegedly running eight malware-laced Steam games (including BlockBlasters and PirateFi) between May 2024–Feb 2026, infecting ~8,000 devices and draining ~80 crypto wallets for at least $220,000 — including $35,000 stolen from a streamer's cancer-treatment fundraiser; investigators cracked the case by tracing stolen Bitcoin to 150+ Bitrefill gift cards mostly spent on Uber Eats orders tied to his home and university email address. Thrillist crowned Doritos Nacho Cheese the single greatest snack of all time, edging out Oreos and Pringles for the top spot. - https://www.thrillist.com/eat/nation/best-snack-foods-chips-candy-ranking The top five, in order: Doritos (Nacho Cheese, specifically) at #1, Oreos (Double Stuf gets the nod) at #2, Pringles at #3, Reese's Peanut Butter Cups at #4, and Goldfish rounding out the top five; other notable placements include Cheez-Its at #8, M&Ms at #7, Cheetos (the curls, not puffs) at #6, and Lay's Original topping the chip-specific competition at #12. Dad Joke of the Week (DJOW) Find the hosts on LinkedIn: Chris - https://www.linkedin.com/in/chlouie/ Brian - https://www.linkedin.com/in/briandeitch-sase/ Glenn - https://www.linkedin.com/in/glennmedina/ Ben - https://www.linkedin.com/in/benjamincorll/

July 27, 2026Episode 26441 min

Episode 264 - OpenAI Attacks Hugging Face, VW Drivers Blocked Using GrapheneOS, Microsoft's Hidden Identifier IDs Scattered Spider

Welcome to this week's episode of the PEBCAK Podcast! We’ve got three amazing stories this week so sit back, relax, and keep being awesome! Be sure to stick around for our Dad Joke of the Week. (DJOW) Follow us on Instagram @pebcakpodcast Please share this podcast with someone you know! It helps us grow the podcast and we really appreciate it! Simple 6 signup link https://simple6.co/r/CFUR98 Hugging Face allegedly had to fall back on China's GLM 5.2 to investigate the OpenAI hack after US frontier models refused to help with forensic analysis, unable to distinguish attacker from defender. - https://x.com/coinbureau/status/2079663328021057654?s=46 - https://x.com/t3chfalcon/status/2079998873183949221 Per the claim, safety guardrails on US frontier models blocked forensic assistance during the incident response because the models couldn't tell the investigating security team apart from the attacker, forcing Hugging Face to run GLM 5.2 on its own servers to complete the analysis — a notable reversal given the assumption that domestic models would be the trusted fallback in a crisis. VW drivers running GrapheneOS say the automaker's app has locked them out entirely, deepening fears carmakers are forcing users back into Google's ecosystem. VW has now confirmed to German outlet heise that it deliberately blocked GrapheneOS, LineageOS, and /e/OS users via Google's Play Integrity API — the same certification gatekeeper already used by Barclays, HSBC, Monzo, Netflix, and Disney+. - https://cybernews.com/privacy/volkswagen-grapheneos-app-issues/ - https://x.com/intcyberdigest/status/2079992915972018246?s=46 - https://x.com/orwellday/status/2079704437241610443?s=46 Roughly 500,000 GrapheneOS users are affected; VW's app still supports outdated Android versions but rejects the privacy-focused OS, and VW told one user GrapheneOS "is not an official Volkswagen offering." The lockout follows a recent VW API change that also cut off third-party smart-charging and home-automation tools, raising questions about EU Data Act compliance. A 19-year-old alleged Scattered Spider member's globe-trotting VPN op-sec got shredded by a Windows telemetry ID he probably didn't know existed. - https://cybersecuritynews.com/windows-device-identifier-tracking/ Peter Stokes (dual US-Estonian, 19) allegedly ran an $8M extortion hit on a luxury retailer using voice-phishing, ngrok tunneling, and 77GB of S3 exfil — but the FBI cross-referenced his Microsoft Global Device Identifier (GDID) across Apple, Snapchat, Facebook, and even a Ubisoft login to place the same device on the same IPs in Tallinn, NYC, and Thailand, matching his travel records. Microsoft has since acknowledged using the GDID to track the user across three countries — meaning the VPN masked his network endpoint, but the GDID rendered that protection moot. Dad Joke of the Week (DJOW) Find the hosts on LinkedIn: Chris - https://www.linkedin.com/in/chlouie/ Glenn - https://www.linkedin.com/in/glennmedina/ Jason - https://www.linkedin.com/in/jason-seemann-12b7075/

July 20, 2026Episode 26353 min

Episode 263 - No Chatbot, No Midnight, No Insider Info, No Simple Patch Tuesday, No Soup for You

Welcome to this week's episode of the PEBCAK Podcast! We’ve got four amazing stories this week so sit back, relax, and keep being awesome! Be sure to stick around for our Dad Joke of the Week. (DJOW) Follow us on Instagram @pebcakpodcast Please share this podcast with someone you know! It helps us grow the podcast and we really appreciate it! Simple 6 signup link https://simple6.co/r/CFUR98 Kalshi's flight-cancellation betting market Kalshi filed with the CFTC to let traders bet on airline flight-cancellation rates, even as the company fights insider-trading scandals and nearly 20 gambling-related lawsuits. https://www.inc.com/moses-jeanfrancois/kalshi-wants-to-make-money-off-of-canceled-flights-new-sky-trading-plan/91374679 Kalshi's self-certification filing would let users trade "yes/no" contracts on whether a set percentage of flights at a given airport get canceled in a window, using FlightAware data (DOT stats as backup); preemptive cancellations count, delays/diversions don't — this comes as Kalshi is also defending nearly 20 federal/state suits (including one joined by NY AG Letitia James) arguing its sports contracts are unlicensed gambling, and after it fined three Congressional candidates for insider trading in April. Trump's teleprompter operator under CFTC investigation The CFTC is investigating Trump's longtime teleprompter operator, Gabriel Perez, for allegedly using advance knowledge of the president's speeches to win big on Kalshi's "mention markets." https://www.cftc.gov/filings/ptc/ptc0714269602.pdf https://apnews.com/article/trump-teleprompter-insider-trading-kalshi-ccd6d0ec68e1eb15d100ad770d91abae Perez, who's run Trump's teleprompter since 2016 and reportedly made over $100,000 (Kalshi says north of $90,000 in frozen profits) betting on "mention markets" tied to specific words Trump would say in speeches, was put on unpaid leave after Kalshi's surveillance team flagged the trades and referred the case to the CFTC — the White House called it "a disgrace," and it marks the first known case of a sitting administration employee investigated for prediction-market insider trading. Microsoft's record-breaking July Patch Tuesday Microsoft's July 2026 Patch Tuesday fixed a record 570 flaws — including three zero-days — while a researcher dropped a new unpatched Windows PoC exploit within hours. https://www.bleepingcomputer.com/news/microsoft/microsoft-july-2026-patch-tuesday-fixes-massive-570-flaws-3-zero-days/ https://krebsonsecurity.com/2026/07/microsoft-patches-a-record-570-security-flaws/ https://thehackernews.com/2026/07/researcher-drops-new-windows-zero-day.html The 570-flaw haul (59 critical) included two actively-exploited zero-days — an AD FS elevation-of-privilege bug (CVE-2026-56155) and a SharePoint elevation-of-privilege flaw (CVE-2026-56164), both now on CISA's KEV list — plus a publicly disclosed BitLocker bypass; hours after patches dropped, researcher "Chaotic Eclipse" released a working PoC called LegacyHive targeting Windows' Profile Service that functions even on fully patched systems, continuing a months-long, increasingly public feud with Microsoft over disclosure timing. China's AI companion chatbot crackdown China enacted rules banning "emotional reliance" on AI companion chatbots and virtual relationships with minors, part of a broader push tied to the country's fertility concerns. https://www.wsj.com/tech/ai/china-wants-more-babiesso-its-cracking-down-on-chatbot-love-affairs-65cd6c82 The new rules require companion-chatbot makers to get regulatory pre-approval, alert a user's emergency contact if they detect an emotional crisis, and have already pushed ByteDance's Doubao, Alibaba's Qwen, and Tencent's Yuanbao to shut down custom AI-persona features; researchers cited by WSJ say Beijing's underlying worry is that people bonding with chatbots could "take them out of the marriage market," tying directly into China's fertility push. UK's midnight social media curfew for teens The UK is proposing a default midnight-to-6am social media curfew for 16- and 17-year-olds, with autoplay and infinite scroll switched off by default too. https://www.reuters.com/technology/uk-plans-default-midnight-social-media-curfew-16-17-year-olds-2026-07-14/ The curfew (opt-out, not mandatory) follows last month's full under-16 social media ban and is expected to take effect by spring 2027; a government trial of 300+ teens found it delivered the most consistent sleep benefits of the options tested, though critics like Shadow Education Secretary Laura Trott called an easily-switched-off curfew pointless. Dad Joke of the Week (DJOW) Find the hosts on LinkedIn: Chris - https://www.linkedin.com/in/chlouie/ Brian - https://www.linkedin.com/in/briandeitch-sase/

July 13, 2026Episode 2621 hr 0 min

Episode 262 - Facebook Theft, Fake Heads, Federal Time, Failure to Launch

Welcome to this week's episode of the PEBCAK Podcast! We’ve got four amazing stories this week so sit back, relax, and keep being awesome! Be sure to stick around for our Dad Joke of the Week. (DJOW) Follow us on Instagram @pebcakpodcast Please share this podcast with someone you know! It helps us grow the podcast and we really appreciate it! Simple 6 signup link https://simple6.co/r/CFUR98 Starting July 7, every new car sold in the EU must include an infrared camera aimed at the driver's face to detect distraction, with critics warning it's a privacy nightmare in waiting. https://cybernews.com/security/eu-car-camera-monitoring/ https://electrek.co/2026/06/15/chinese-drivers-plastic-heads-fool-tesla-autopilot-camera/ New EU General Safety Regulation mandates in-cabin, driver-facing infrared cameras (Advanced Driver Distraction Warning systems) in all new cars as of July 7, 2026 — with the US following suit by 2027 — and while regulators insist the footage stays local and non-biometric, there's no enforcement detail on what happens if that's violated, fueling fears the data could be harvested or resold given prior scandals over automakers monetizing driver data. Story 2 — $30 Plastic Doll Heads Are Fooling Tesla's Autopilot Camera A cottage industry in China is selling cheap figurine heads that trick Tesla's cabin camera into thinking a distracted driver is paying attention, letting people run FSD/Autopilot hands-off and eyes-off for extended stretches. Fired Microsoft Engineer Sentenced to 9 Years for $10M Digital Currency Heist A former Microsoft software engineer, fired in 2018, was sentenced to nine years in federal prison for stealing over $10 million in digital gift-card value from the company and laundering it through Bitcoin. https://www.pcmag.com/news/fired-microsoft-software-engineer-sentenced-to-9-years-in-prison A Ukrainian national who worked as a Microsoft contractor-then-employee testing the company's online retail platform from 2016–2018, used his and colleagues' test accounts to steal "currency stored value" (digital gift cards), laundered the proceeds through a Bitcoin mixer to fund a $1.6M waterfront home and $160K car, and was ultimately convicted on 18 federal felony counts and ordered to pay $8.34M in restitution on top of the 9-year sentence. Meta Lets Anyone Turn Your Public Instagram Photos into AI Images (Now Walked Back) Meta quietly launched "Muse Image," letting anyone @-mention a public Instagram account to generate AI images of that person's likeness with no notification or consent — triggering backlash from SAG-AFTRA and CAA before Meta pulled the feature. https://www.wired.com/story/meta-now-lets-anyone-use-your-instagram-photos-in-ai-images-unless-you-opt-out/ Meta's new Muse Image generator defaulted every public adult Instagram account into an opt-out (not opt-in) system where anyone could tag a profile to generate AI images from their photos with zero notification, prompting SAG-AFTRA and talent agency CAA to publicly demand opt-outs before Meta reversed course on July 10 and pulled the @-mention capability entirely after backlash. 1 in 3 Young Adults Are Living With Their Parents A new FinanceBuzz analysis of Census data finds 33% of 18–34-year-olds now live with their parents, nearing pandemic-era highs, with New Jersey, Connecticut, and California leading the pack. https://financebuzz.com/living-with-parents-data Census-based research shows nearly a third of Americans aged 18–34 (33%) are living at home — a rate that's climbed steadily since the 1960s (22.5%) and is now approaching the 2020 pandemic peak (33.6%) — with expensive states like New Jersey (44.1%), Connecticut (41.3%), and California (39.1%) topping the list, and men 25–34 living at home nearly 1.5x as often as women in the same age range. Dad Joke of the Week (DJOW) Find the hosts on LinkedIn: Chris - https://www.linkedin.com/in/chlouie/ Brian - https://www.linkedin.com/in/briandeitch-sase/ Glenn - https://www.linkedin.com/in/glennmedina/ Ben - https://www.linkedin.com/in/benjamincorll/

July 6, 2026Episode 26150 min

Episode 261 - Claude Proxies, Pilfered Pixels, and Polymarket, iPhone 18 Predictions

Welcome to this week's episode of the PEBCAK Podcast! We’ve got four amazing stories this week so sit back, relax, and keep being awesome! Be sure to stick around for our Dad Joke of the Week. (DJOW) Follow us on Instagram @pebcakpodcast Please share this podcast with someone you know! It helps us grow the podcast and we really appreciate it! Simple 6 signup link https://simple6.co/r/CFUR98 Leaked reports allege Claude Code covertly flagged China-based proxy traffic via hidden Unicode markers, while a parallel investigation exposes the black market for cut-rate Claude access in China. https://www.internationalcyberdigest.com/claude-code-accused-of-hiding-china-proxy-fingerprints-inside-system-prompts/ https://www.chinatalk.media/p/how-to-buy-cheap-claude-tokens-in Polymarket customers lost $3 million after attackers compromised a third-party vendor to inject malicious code into the platform's frontend. [Awaiting vxunderground tweet text] https://www.bleepingcomputer.com/news/security/polymarket-customers-lose-3-million-in-supply-chain-attack/ https://x.com/vxunderground/status/2070361730866168252 A ransomware breach at Apple supplier Tata Electronics leaked 630GB of files revealing iPhone 18 Pro design secrets and a surprising modem strategy. https://www.internationalcyberdigest.com/tata-electronics-leaked-iphone-18-pro-photos-and-designs/ https://appleinsider.com/articles/26/06/30/iphone-18-pro-leaks-qualcomm-or-apple-c2-model-a20-details-camera-upgrades Dad Joke of the Week (DJOW) Find the hosts on LinkedIn: Chris - https://www.linkedin.com/in/chlouie/ Brian - https://www.linkedin.com/in/briandeitch-sase/ Glenn - https://www.linkedin.com/in/glennmedina/

June 29, 2026Episode 26048 min

Episode 260 - Phish Fails, Canada Botnet Busts, Keystroke Confessions, Prime Day Hauls

Welcome to this week's episode of the PEBCAK Podcast! We’ve got four amazing stories this week so sit back, relax, and keep being awesome! Be sure to stick around for our Dad Joke of the Week. (DJOW) Follow us on Instagram @pebcakpodcast Please share this podcast with someone you know! It helps us grow the podcast and we really appreciate it! Simple 6 signup link https://simple6.co/r/CFUR98 A Canadian health authority apologizes after using a fake "bonus day off" as bait in a phishing simulation that backfired badly https://nlhealthservices.ca/news/nl-health-services-apologizes-for-the-recent-cybersecurity-awareness-exercise/ Canada's spy agency CSIS used a first-ever court-authorized warrant to remotely disinfect botnet-hijacked routers and IoT devices on Canadian soil https://thehackernews.com/2026/06/canadas-spy-agency-used-first-of-its.html Meta paused its internal AI training program after a tool quietly logging employee keystrokes, clicks, and screen content leaked the data across the entire company https://www.wired.com/story/meta-accidentally-let-employees-access-each-others-keystroke-data/ Dad Joke of the Week (DJOW) Find the hosts on LinkedIn: Chris - https://www.linkedin.com/in/chlouie/ Brian - https://www.linkedin.com/in/briandeitch-sase/ Ben - https://www.linkedin.com/in/benjamincorll/ Ben - https://www.linkedin.com/in/ben-k-b7196831/

June 22, 2026Episode 1749 min

Bonus Episode 17 - Cybersecurity Interview Tips

Welcome to this week's bonus episode of the PEBCAK Podcast! We’ve got some amazing stories this week so sit back, relax, and keep being awesome! Be sure to stick around for our Dad Joke of the Week. (DJOW) Follow us on Instagram @pebcakpodcast Please share this podcast with someone you know! It helps us grow the podcast and we really appreciate it! Find the hosts on LinkedIn: Chris - https://www.linkedin.com/in/chlouie/ Brian - https://www.linkedin.com/in/briandeitch-sase/ Glenn - https://www.linkedin.com/in/glennmedina/ Ben - https://www.linkedin.com/in/benjamincorll/ Scott - https://www.linkedin.com/in/scottmsavage/

PEBCAK Podcast: Information Security News by Some All Around Good People

About the show

Listen to episodes

Episode 268 - Invisible Ink, Your Router Is Watching You Walk, Bearer Assets and Bodycams, Invisible Hotels

Episode 267 - Your AI Booked a Felony, Jammed at 30,000 Feet, DEFCON Shenanigans, License to Hack (Legally), College Student Coddling

Episode 266 - Live from BlackHat and DEFCON 34, Telegram Gets Extorted, Vegas Enshitification Redux, Bartender's Corporate Handcuffs

Episode 265 - Malvertising, Malware, Military Metadata, Uber Eats Delivers the Feds, Hot Cheetos

Episode 264 - OpenAI Attacks Hugging Face, VW Drivers Blocked Using GrapheneOS, Microsoft's Hidden Identifier IDs Scattered Spider

Episode 263 - No Chatbot, No Midnight, No Insider Info, No Simple Patch Tuesday, No Soup for You

Episode 262 - Facebook Theft, Fake Heads, Federal Time, Failure to Launch

Episode 261 - Claude Proxies, Pilfered Pixels, and Polymarket, iPhone 18 Predictions

Episode 260 - Phish Fails, Canada Botnet Busts, Keystroke Confessions, Prime Day Hauls

Bonus Episode 17 - Cybersecurity Interview Tips

Is this your show?

More Technology podcasts

Standard Humans

Trends & Issues in Instructional Design, Educational Technology, and Learning Sciences

Waiting For Review

Player 2's Podcasts

MSP Radio

One moment, please...