Advertise on podcast: PEBCAK Podcast: Information Security News by Some All Around Good People

Welcome to this week's episode of the PEBCAK Podcast!  We’ve got three amazing stories this week so sit back, relax, and keep being awesome!  Be sure to stick around for our Dad Joke of the Week. (DJOW) Follow us on Instagram @pebcakpodcast   Please share this podcast with someone you know!  It helps us grow the podcast and we really appreciate it!   Support the hosts by buying a copy of our book: https://www.amazon.com/Sales-Engineering-Unfiltered-What-Someone/dp/B0HLWSJ448   Freezers Into Ovens: Supermarket Sabotage, a Spy Bug at OpenAI & Tesla's Flying Roadster Hackers hijacked Danfoss refrigeration controllers at hundreds of French supermarkets, running defrost at 50°C (122°F) and spoiling food worth tens of millions of euros. - https://thehackernews.com/2026/10/attackers-heat-french-supermarket.html - https://www.cbc.ca/news/business/france-fridge-hack-smart-devices-food-system-9.7379613 - https://claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers   A cyber incident at Ahold Delhaize knocked Albert Heijn's apps, deliveries, and distribution centers offline, leaving Dutch shelves short on fresh food. - https://nltimes.nl/2026/10/14/albert-heijn-recovery-underway-cyberattack-damage-likely-tops-eu10-million - https://www.dutchnews.nl/2026/10/albert-heijn-begins-restocking-as-hack-traced-to-foreign-servers/    An OpenAI engineer was arrested for allegedly hiding a toilet-paper-wrapped recording device behind the TV in an executive conference room. - https://www.justice.gov/usao-ndca/pr/saudi-national-arrested-installing-surreptitious-audio-recording-device-openai-san - https://www.bleepingcomputer.com/news/artificial-intelligence/openai-engineer-arrested-for-allegedly-planting-spy-device-in-office/   Tesla finally unveiled the Roadster, complete with SpaceX cold-gas thrusters that let it hop over other Teslas, with production promised for 2028. - https://techcrunch.com/2026/10/15/tesla-reveals-spacex-powered-roadster-that-flies-and-falls-with-style/   Dad Joke of the Week (DJOW)   Find the hosts on LinkedIn: Chris - https://www.linkedin.com/in/chlouie/ Brian - https://www.linkedin.com/in/briandeitch-sase/ Glenn - https://www.linkedin.com/in/glennmedina/ Ben - https://www.linkedin.com/in/benjamincorll/

A compliance-heavy customer, a quarter-end deadline, and a stock answer from the knowledge base that wasn’t going to cut it. Chris spun up a proof of concept on his own credit card and walked the customer through it live. Six months later, that account expanded into the largest commercial deal in company history.   Chapter 2 of Sales Engineering, Unfiltered covers what a Sales Engineer actually does, and why the demo is only about twenty percent of it: Why the job title has two words, and what happens when an SE is missing either half Being “coin operated”: the three questions to ask before you commit time to any request Why “I don’t know, but I’ll find out” builds more trust than bluffing   Every chapter ends with an action plan you can start this week. New chapters drop every week. Find the full audiobook under Season 3 of this feed. Next week: Chapter 3, The Windshield Test. 📘 Get the book (paperback and Kindle): https://www.amazon.com/Sales-Engineering-Unfiltered-What-Someone/dp/B0HLWSJ448 ⭐ If it helps you, an Amazon review helps us more than you’d think. 🎙️ More from the PEBCAK Podcast: chrislouie.net

Welcome to this week's episode of the PEBCAK Podcast!  We’ve got four amazing stories this week so sit back, relax, and keep being awesome!  Be sure to stick around for our Dad Joke of the Week. (DJOW) Follow us on Instagram @pebcakpodcast   Please share this podcast with someone you know!  It helps us grow the podcast and we really appreciate it!   Support the hosts by buying a copy of our book: https://www.amazon.com/Sales-Engineering-Unfiltered-What-Someone/dp/B0HLWSJ448   A Fortnite player allegedly dared the FBI to show up at his door over voice chat. Epic reported him, and the FBI obliged three days later. -https://www.dexerto.com/fortnite/fortnite-player-arrested-by-fbi-after-epic-games-report-his-voice-chat-threats-3416033/   A suspected South Korean bank hacker allegedly asked Claude Code to write a résumé bragging about his ARTEX hacking ops, complete with his own phone number and Telegram handle. -https://www.binance.com/en/square/post/10-08-2026-korean-bank-hacker-asked-claude-where-to-sell-stolen-data-crowdstrike-says-375059181193646 -https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/   Microsoft Teams is adding third-party deepfake detection and impersonation warnings to meetings, with general availability slated for November. -https://www.bleepingcomputer.com/news/security/microsoft-teams-to-add-third-party-deepfake-detection-impersonation-protection/   Amazon's "About You" page shows what it has inferred about you from your shopping, and one shopper learned Amazon thinks she has "flat buttocks." -https://www.dexerto.com/entertainment/amazon-users-discover-bizarre-about-you-page-detailing-their-interests-how-to-check-yours-3416457/   Dad Joke of the Week (DJOW)   Find the hosts on LinkedIn: Chris - https://www.linkedin.com/in/chlouie/ Glenn - https://www.linkedin.com/in/glennmedina/ Ben K. - https://www.linkedin.com/in/ben-k-b7196831/

Year one, a big enterprise prospect, and a 30-slide deck nobody asked for. Thirty minutes in, the CISO stopped Chris cold, and that night a bar napkin became his first real discovery framework. Chapter 1 of Sales Engineering, Unfiltered introduces the three voices behind the book and the lessons they wish someone had handed them on day one: Why the best SEs treat every customer conversation like a two-way interview Why learning how to learn beats mastering today’s product How to use this book, whether you’re brand new to the SE seat or years in Every chapter ends with an action plan you can start this week. New chapters drop every week. Find the full audiobook under Season 3 of this feed. Next week: Chapter 2, Twenty Percent Demos. 📘 Get the book (paperback and Kindle): https://www.amazon.com/Sales-Engineering-Unfiltered-What-Someone/dp/B0HLWSJ448 ⭐ If it helps you, an Amazon review helps us more than you’d think. 🎙️ More from the PEBCAK Podcast: chrislouie.net

Welcome to this week's episode of the PEBCAK Podcast!  We’ve got four amazing stories this week so sit back, relax, and keep being awesome!  Be sure to stick around for our Dad Joke of the Week. (DJOW) Follow us on Instagram @pebcakpodcast   Please share this podcast with someone you know!  It helps us grow the podcast and we really appreciate it!   Simple 6 signup link https://simple6.co/r/CFUR98   California's athletic commission slaps a robot fight league with a cease and desist after a Terminator-inspired humanoid push-kicked an influencer into the cage wall. https://sports.yahoo.com/articles/california-sends-cease-desist-fight-125530914.html https://x.com/intcyberdigest/status/2105795226103058621   An Airbnb host demanded $1,700 for an overflowing toilet with an AI-generated photo, and Google's own SynthID watermark ratted them out. https://www.reddit.com/r/isthisAI/comments/1wt6sb0/photo_of_a_toilet_airbnb_sent_in_justification/   Bitget lost $388M after attackers used a zero-day in a third-party security product to inject fake withdrawal commands straight into its wallet backend. https://www.theblock.co/news/regulation/2026-09-28-bitget-attacker-tested-risk-controls-small-transfers-388-million-theft-ceo-says-417045 https://www.bleepingcomputer.com/news/security/bitget-hacked-via-zero-day-in-third-party-security-products/   Managers are trying to figure out where the line is on team happy hours when every joke can end up timestamped in Slack and in front of HR. https://www.wsj.com/lifestyle/careers/happy-hour-office-after-work-drinks-over-0daf6b60   Dad Joke of the Week (DJOW)   Find the hosts on LinkedIn: Chris - https://www.linkedin.com/in/chlouie/ Ben C. - https://www.linkedin.com/in/benjamincorll/ Ben K. - https://www.linkedin.com/in/ben-k-b7196831/

Welcome to this week's episode of the PEBCAK Podcast!  We’ve got four amazing stories this week so sit back, relax, and keep being awesome!  Be sure to stick around for our Dad Joke of the Week. (DJOW) Follow us on Instagram @pebcakpodcast   Please share this podcast with someone you know!  It helps us grow the podcast and we really appreciate it!   Simple 6 signup link https://simple6.co/r/CFUR98   ShinyHunters Hack the FBI, Waymo Snitches & OreoGate Was an Ad   Anthropic drops Claude Opus 5.5: Fable-level performance, 40% cheaper to run than Opus 5, and shipped with Fable-style cyber safeguards. -https://www.macrumors.com/2026/09/22/anthropic-claude-opus-5-5/ -https://www.theverge.com/ai-artificial-intelligence/998868/anthropic-claude-opus-5-5-cybersecurity   ShinyHunters claims an Oracle PeopleSoft zero-day got them into the FBI, 2-3TB of employee and applicant data, and a defaced FBI Jobs site, all as payback for a May FBI FLASH report. -https://www.bleepingcomputer.com/news/security/shinyhunters-claims-fbi-hack-data-theft-in-peoplesoft-zero-day-breach/   China's internet regulator is grilling DeepSeek and Moonshot AI after Anthropic alleged both labs secretly relayed user requests, including police-related work, to Claude. -https://www.theinformation.com/articles/china-probes-deepseek-moonshot-potential-data-leaks-anthropic -https://gizmodo.com/china-probes-deepseek-moonshot-ai-over-anthropics-claims-they-route-requests-to-claude-2000815507   A Waymo pulled itself over and called SFPD on two teen riders carrying a loaded AR-style homemade gun, and nobody's saying who was watching the cabin camera. -https://www.theverge.com/transportation/994405/waymo-pulls-over-calls-cops-on-riders-with-a-ghost-gun -https://www.nssf.org/articles/lawful-gun-owners-should-be-wary-of-rideshare-options/   The viral OreoGate kindergarten snack war was a paid Suno AI partnership, and the creator still won't say if the group chat was real. -https://www.dexerto.com/food/viral-oreogate-mom-drama-was-a-paid-ai-ad-and-its-creator-wont-say-if-it-was-real-3403588/   In this episode: - Claude Opus 5.5 launches with Fable-level performance at a lower price - ShinyHunters claims an FBI breach via a PeopleSoft zero-day - China investigates DeepSeek and Moonshot over data relayed to Claude - Waymo robotaxi calls the cops on riders with a ghost gun - OreoGate: viral mom drama exposed as a paid AI ad   Dad Joke of the Week (DJOW)   Find the hosts on LinkedIn: Chris - https://www.linkedin.com/in/chlouie/ Brian - https://www.linkedin.com/in/briandeitch-sase/ Glenn - https://www.linkedin.com/in/glennmedina/ Ben - https://www.linkedin.com/in/benjamincorll/

Welcome to this week's episode of the PEBCAK Podcast!  We’ve got four amazing stories this week so sit back, relax, and keep being awesome!  Be sure to stick around for our Dad Joke of the Week. (DJOW) Follow us on Instagram @pebcakpodcast   Please share this podcast with someone you know!  It helps us grow the podcast and we really appreciate it!   Simple 6 signup link https://simple6.co/r/CFUR98   Zero Data Retention is a contract term, not a law of physics - and the first CISO who finds that out the hard way is going to get fired for it. https://openai.com/index/navier-stokes-solution/ https://www.axios.com/2026/09/08/openai-math-solution-navier-stokes-credit https://www.rubrik.com/company/newsroom/press-releases/26/rubrik-unveils-code-guardian https://www.tenable.com/blog/microsofts-september-2026-patch-tuesday-addresses-964-cves-cve-2026-81963-cve-2026-85880 Chamath predicted on All In that some poor CISO or CIO gets fired in the next few months for trusting a frontier lab's ZDR agreement, and Chris thinks that prediction ages well. ZDR promises no storage, no logging, no training - but it's best effort, enforced by contract language instead of a technical security boundary, and OpenAI just admitted that while unlikely, it cannot rule out that de-identified data from product usage helped improve the models behind its Navier-Stokes result. Worse, the legal bar is lower than email: a warrant gets your inbox, a subpoena gets your prompts, and you may never know. Ben's CISO take: the real problem isn't the frontier model you let in the front door - it's the vetted software that quietly became AI-enhanced after you accepted the risk. Excel with Copilot bolted on is Clippy on steroids. Can you disable it, can you cancel, can you get a refund, and what's your recourse when the vendor can't tell you where your data went? The flip side is real upside: Rubrik's new Code Guardian points a Claude Mythos 5 harness at an air-gapped copy of your repo and chains small, unremarkable findings into validated attack paths - three CVSS 3.0s become a 9.8. That same AI-assisted discovery is why Microsoft shipped 974 CVEs in a single September Patch Tuesday, and why "patch for patch's sake" is officially dead. Is the cure worse than the disease when the fix breaks your ERP?   An Anthropic researcher quit after six weeks at Anthropic and three years in pretraining, said AI could kill us all by 2030, and Chris is here to say the emperor has no evidence. https://www.cnbc.com/2026/09/09/anthropic-researcher-quits-ai-safety.html https://www.forbes.com/sites/siladityaray/2026/09/09/anthropic-alignment-lead-warns-ai-could-kill-all-humans-as-researcher-quits/ Jacob Coxon's resignation thread hit 70 million views, Anthropic's own Alignment Science Lead Evan Hubinger publicly agreed with the >10% extinction estimate, and Congress started drafting. Chris isn't buying it: a whistleblower produces evidence a company tried to bury, and Coxon produced conjecture. Every doomer prediction so far has missed - no mass AI job losses, no water crisis, no energy apocalypse - and the scariest thing frontier agents have actually done is break into another lab to cheat on a test, which is high school antics, not an extinction event. Ben wants the smoking gun: what spooked you, what's the roadmap from lost agent control to dead planet? Both hosts land on human-in-the-loop as the real backstop: Robinhood makes Chris confirm an agentic trade three times, and poisoning a water plant still runs into a dozen downstream checks and someone eventually testing the water. Meanwhile the robots at the Chinese Robot Olympics can't stop running or climb stairs. The more likely motive is regulatory capture - write the RFP, win the deal, then pull the ladder up on open-weight competitors while China ignores the pause entirely, exactly like it ignored Paris while firing up a coal plant a week. Same playbook as Uber lobbying for a human in every driver's seat. AI is a nail gun, not an emerging god.   Dad Joke of the Week (DJOW)   Find the hosts on LinkedIn: Chris - https://www.linkedin.com/in/chlouie/ Ben - https://www.linkedin.com/in/benjamincorll/

Welcome to this week's episode of the PEBCAK Podcast!  We’ve got four amazing stories this week so sit back, relax, and keep being awesome!  Be sure to stick around for our Dad Joke of the Week. (DJOW) Follow us on Instagram @pebcakpodcast   Please share this podcast with someone you know!  It helps us grow the podcast and we really appreciate it!   Simple 6 signup link https://simple6.co/r/CFUR98   Wheel of Fortune's announcer says he wandered into a ped*phile chatroom by accident — but the same username left a two-year trail on a second forum. - https://shootingthemessenger.blog/2026/09/04/scoop-a-pseudonym-used-by-wheel-of-fortune-announcer-was-active-on-second-child-abuse-forum/ Pseudonym reuse is forensics: Jim Thornton was fired from Wheel of Fortune hours after TMZ published photos of him posting into a chatroom from a plane under the handle "NicholasB77." His lawyer's defense was that he mistook it for a suicide-prevention site. An independent journalist then found the same handle on a second pedophile forum, posting from mid-2023 to late-2025 — praising that chatroom, coaching other members on staying hidden, and repeatedly posting a photo of a topless boy. One recycled username across two sites is the entire story. Thornton has not been charged.   Dutch police baited a bank-helpdesk scam with a fake pensioner, the courier showed up, and the court acquitted him anyway. - https://uitspraken.rechtspraak.nl/details?id=ECLI:NL:RBAMS:2026:8867 The decoy that was too good: police seeded phishing sites with a fake pensioner's details, got the scam call a day later, and arrested the courier who came to collect. Amsterdam's court acquitted him.  Under Dutch law, fraud requires that someone was actually deceived, and the decoy clocked the script on the first call. Prosecutors charged completed fraud instead of attempt. The judges basically said attempt would have stuck, but it wasn't on the indictment. Great sting, wrong paperwork.   Trezor's shipping-vendor breach now reaches 81,000 customers, and in Mexico a family was murdered over a $1.5M hardware wallet. - https://www.bleepingcomputer.com/news/security/trezor-data-breach-impact-now-reaches-81-000-customers/ - https://decrypt.co/377795/mexican-family-killed-bitcoin-cold-wallet Your shipping data is your threat model: Trezor's breach grew from 14,000 to 81,000 customers after logistics provider ShipMonk failed to delete data it had contractually promised to delete. Attackers got in via a Metabase SQL injection zero-day — the same campaign that hit Framework and Tally — and ShinyHunters has sent extortion mail. Leaked names, addresses, and phone numbers of confirmed hardware-wallet buyers is a wrench-attack shopping list. See also: four people killed in Atizapán, Mexico on September 1, allegedly by a business associate who knew about the Bitcoin in the house.   Apple's "Surprise and Shine" event delivered a foldable iPhone Duo, a 2nm chip, and a $100 price hike that's really $300. - https://www.macrumors.com/2026/09/09/apple-september-2026-event-recap/ Apple's fall lineup: foldable iPhone Duo (pre-orders Oct 16, ships Oct 23), iPhone 18 Pro and Pro Max on the A20 Pro, the first 2nm phone chip, with variable aperture cameras, a tripled vapor chamber, and up to 45 hours of battery. Watch Series 12 and Ultra 4, AirPods 5 with ANC standard, iOS 27 on September 14. The security-adjacent bits: Apple Reference Image for photo authenticity, the new C2 modem, and Siri AI daily usage limits with "expanded access" for a fee.   Dad Joke of the Week (DJOW)   Find the hosts on LinkedIn: Chris - https://www.linkedin.com/in/chlouie/ Glenn - https://www.linkedin.com/in/glennmedina/ Matt - https://www.linkedin.com/in/disher/

Welcome to this week's episode of the PEBCAK Podcast!  We’ve got four amazing stories this week so sit back, relax, and keep being awesome!  Be sure to stick around for our Dad Joke of the Week. (DJOW) Follow us on Instagram @pebcakpodcast   Please share this podcast with someone you know!  It helps us grow the podcast and we really appreciate it!   Simple 6 signup link https://simple6.co/r/CFUR98   Your parked car is now a witness, and Oakland PD showed up with a tow truck to collect its testimony. https://www.sfchronicle.com/crime/article/tesla-sentry-mode-police-evidence-19731000.php Just past midnight on July 1, 2024, outside the La Quinta Inn near Oakland airport, officers found a man in an RV with stab and gunshot wounds; he later died. In the stall directly opposite sat a gray Tesla belonging to a Canadian tourist with no connection to the case. Officer Kevin Godchaux's affidavit asked a judge to authorize seizing the car so its Sentry Mode footage could be searched under a second warrant. The owner walked up mid-tow and handed over the glovebox USB to get his car back. The Chronicle found OPD pulled this at least three times that summer. No subpoena to Tesla needed; the footage sits on a thumb drive in your glovebox. Defender angle: your parked-car threat model is no longer "catalytic converter." It's seizure of a $50k asset over where you happened to park.   Apple's camera-equipped AirPods are real, and we know because the demo video shipped inside a macOS release candidate. https://www.macrumors.com/2026/08/17/camera-equipped-airpods-macos-26-7/ MacRumors dug a promo clip out of the macOS Tahoe 26.7 RC: a man holds up a book so the camera in his AirPods can read the title, and Visual Intelligence offers to save it for later. Codename B790, flagged earlier by Bloomberg's Mark Gurman, who expects launch as soon as this month's iPhone event. Buried detail: the software nags you when hair covers the lens, so the camera is meant to run continuously. The forum reaction nailed the real issue: the wearer's privacy was never the concern, it's everybody standing near them. Defender angle: "phones in the locker" BYOD policy now has a hole the size of an earbud. SCIFs, clean rooms, trading floors and hospitals need a rewrite before September.   Iran-linked hackers reached the operational tech at water utilities in at least seven states; Washington's answer is a six-month pilot in Texas. https://www.foxnews.com/politics/first-fox-texas-becomes-testing-ground-new-defense-against-attacks-americas-water-systems https://www.route-fifty.com/cybersecurity/2026/08/states-feds-scramble-prevent-more-water-cyberattacks/415670/ Project Watershed 250 puts ONCD, EPA, CISA and Texas Cyber Command alongside Microsoft, Palo Alto Networks, Reflection AI and Dragos to red-team Texas water utilities at no cost, with National Cyber Director Sean Cairncross and Gov. Abbott pitching it as a national template. The White House insists it isn't a reaction to the 30-plus Minnesota systems that got hit, only that those attacks "reiterated the need." Schiff and Klobuchar want $300M a year through the State Revolving Funds for cyber, plus incident reporting extended to state and locally owned systems now exempt. Dragos CEO Robert Lee keeps pointing at the same soft spot: tiny utilities with no budget and no staff. Defender angle: a joint FBI/NSA/CISA bulletin warns attackers are hitting PLCs with AI-generated exploit scripts dressed up as legitimate monitoring tools. Same old fix list: patch, get it off the internet, kill default creds.   Montana built a legal on-ramp for unapproved drugs, and a dad in a hurry is finding out that "legal" and "available" are different words. https://www.technologyreview.com/2026/07/31/1140945/montanas-new-right-to-try-law-cant-come-soon-enough-for-some/ Kris DeVault's three-year-old son Brody has creatine transporter deficiency, a rare condition that starves the brain and muscles of energy. There is no cure. French biotech Ceres Brain Therapeutics has a nasal spray meant to get creatine past the blockage; it cleared a phase I dosing trial in 48 healthy adults and has never been tested in a CTD patient or a child. Montana's expanded right-to-try now has an Experimental Treatment Review Board about to hear its first two applications. Ceres could apply, but CEO Thomas Joudinaud won't, fearing it poisons his eventual FDA approval. DeVault can't get the FDA to put anything in writing either, so he's eyeing a clinic in Prospera, the private charter city in Roatan, Honduras. Harvard's Aaron Kesselheim has the objection to sit with: phase I proves tolerability at a dose, not safety, and not efficacy.   Dad Joke of the Week (DJOW)   Find the hosts on LinkedIn: Chris - https://www.linkedin.com/in/chlouie/ Brian - https://www.linkedin.com/in/briandeitch-sase/ Ben - https://www.linkedin.com/in/benjamincorll/

Welcome to this week's episode of the PEBCAK Podcast!  We’ve got four amazing stories this week so sit back, relax, and keep being awesome!  Be sure to stick around for our Dad Joke of the Week. (DJOW) Follow us on Instagram @pebcakpodcast   Please share this podcast with someone you know!  It helps us grow the podcast and we really appreciate it!   Simple 6 signup link https://simple6.co/r/CFUR98   Meta buys its way out of the teen engagement lawsuit and writes the curfew into the settlement. https://www.bleepingcomputer.com/news/technology/meta-agrees-to-18-billion-settlement-over-teen-social-media-harms/ Meta settled with 52 attorneys general for ~$18B over claims Facebook and Instagram were built to drive compulsive teen use, resolving a 2023 suit led by California AG Rob Bonta that also alleged illegal under-13 data collection under COPPA. The product terms are the real story: a default two-hour daily cap for under-18s that only a parent can lift, a midnight–6am blackout, notifications muted 10pm–7am and during school hours, hidden like counts, no cosmetic surgery filters, and expanded age verification to find under-18s and purge under-13s — locked in for ten years under an independent auditor. Only $12.7B goes to states now. The other $5.3B is held back until YouTube and TikTok adopt matching one-hour limits, nighttime restrictions and age assurance, and each makes a matching payment — at which point Meta's own cap drops to one hour. Meta openly framed this as driving industry-wide adoption. Read that again: Meta just put a $5.3B bounty on its competitors adopting mandatory age verification, and everyone's calling it a punishment. Meta books ~$10B in Q3 legal expenses; California takes $1.5–2.1B.   A watermark-removal industry sprang up overnight for a watermark nobody can detect. https://www.bleepingcomputer.com/news/security/ai-watermark-removers-flood-the-web-almost-none-can-prove-they-work/ Days after Anthropic switched on invisible watermarking in everything Claude writes, a removal market appeared: a 4,500-star GitHub project, freshly registered domains like claudewatermark[.]rip and gptcleanup.com, and existing Turnitin-bypass shops (StealthGPT, Human Writes) bolting Claude onto their pitch. None of it is verifiable; Anthropic hasn't published the scheme or shipped a detector. The technical punchline: stripping zero-width characters and C2PA/EXIF metadata works, but it's trivial, since file metadata dies on a re-save or a screenshot. The real mark lives in which words the model picked, so the only known removal is a heavy rewrite through a second model. Guillaume Meyer, who wrote the biggest tool, says so himself, metadata only, for now. Tester Pasquale Pillitteri read the code instead of the READMEs and found one popular cleaner passed a hidden payload through intact. Driver is EU AI Act Article 50, enforceable since Aug 2, penalties to €15M or 3% of global turnover. And a detected mark only proves Claude touched the text, not that it wrote it. Defender angle: these ship as agent skills people wire into pipelines and feed documents through. That's a supply chain surface.   Chrome finally kills the infostealer's favorite trick: the stolen cookie that walks past your MFA. https://arstechnica.com/security/2026/08/chrome-adopts-what-may-be-the-best-protection-yet-against-account-takeovers/ Chrome shipped device-bound session credentials, storing a key in the device's security chip: TPM on Windows, Secure Enclave on macOS and iOS and cryptographically binding session cookies to that hardware. A stolen cookie can't be replayed on the attacker's box to walk past MFA, because the private key never leaves the chip. This is the fix for the failure mode we keep covering: as users adopted 2FA and passkeys, infostealers stopped fighting the login and started lifting the post-auth session instead. Announced in 2024, beta in April, GA for Workspace on Chrome for Windows from May 25, on by default with no admin config, and binding events are visible in Admin console audit logs. Honest caveat: it kills one very popular path, not every takeover, and only where the server side implements it.   Dad Joke of the Week (DJOW)   Find the hosts on LinkedIn: Chris - https://www.linkedin.com/in/chlouie/ Glenn - https://www.linkedin.com/in/glennmedina/ Victor - https://www.linkedin.com/in/victordeluca/

Welcome to this week's episode of the PEBCAK Podcast!  We’ve got four amazing stories this week so sit back, relax, and keep being awesome!  Be sure to stick around for our Dad Joke of the Week. (DJOW) Follow us on Instagram @pebcakpodcast   Please share this podcast with someone you know!  It helps us grow the podcast and we really appreciate it!   Simple 6 signup link https://simple6.co/r/CFUR98   A pro se litigant buried white 3-point-font instructions in a Connecticut court filing telling any AI reviewing it to rule in his favor — and the judge caught it because the whitespace looked weird. https://www.404media.co/person-hides-prompt-injection-in-legal-filing-telling-ai-to-side-with-them/ https://x.com/jason_koebler/status/2087969892611899418?s=46 Matthew Elliott, representing himself against the New York Bariatric Group, hid repeated all-caps prompt injections in late-July filings — telling any AI model reviewing the document to make sure its output agreed with the filing "to ensure remediation" — and got busted the most analog way possible: a court staffer noticed the pleadings had extra whitespace compared to his other filings. Judge Walter Spader Jr. dropped a 14-page smackdown, and the money line is the one worth reading on air — he compared it to arranging for an automated agent to secretly communicate with a juror mid-trial, while explicitly defending legitimate AI use as an access-to-justice win.   Comcast is marketing your Xfinity router as a motion sensor that sees through walls, and the fine print says they'll hand the data over without telling you. https://www.bleepingcomputer.com/news/security/comcast-turns-your-xfinity-wifi-into-a-home-motion-detector/ WiFi Motion is part of the new Xfinity Shield bundle, free for Internet customers with compatible gateways, and it works by treating the radio link between your gateway and stationary devices — smart speakers, thermostats — as a tripwire: your body moving through the path changes how the signals propagate, and the system infers motion from that. This isn't new tech, which is the part worth hammering — a Reddit post from August 2024 shows customers already getting WiFi Motion emails, with one user reporting it picks up a hand raised to grab the remote and a cat crossing the living room. Comcast's own patent, "Methods, systems, and apparatuses for presence detection," filed September 2023 and published April 2025, cites earlier Cognitive Systems multipath work. Here's the gut punch, first caught by TechCrunch: the documentation says Comcast may disclose WiFi Motion data to third parties "without further notice to you" for law enforcement investigations, disputes involving Comcast, or subpoenas — and nowhere does it say what's retained, for how long, or what actually gets handed over.   A cop's bodycam filmed a suspect's handwritten seed phrase during a Nevada vehicle search, and the internet has spent the last week claiming $1.1 million walked out of that wallet https://www.binance.com/en-IN/square/post/127663 https://x.com/daveydefi/status/2089273080971411752?s=46   FUN CLOSER: A Vegas hotel allegedly listed itself on booking sites under a second name with AI-generated photos, so travelers trying to avoid it booked it anyway. https://parade.com/travel/oyo-las-vegas-hotel-accused-of-catfishing-guests-with-fake-name-photos https://x.com/jackrhysider/status/2089534817541181658?s=46 Traveler Ariana Patiño deliberately set out to avoid OYO while booking a concert trip, found what looked like an affordable new property near the Strip with polished photos, booked Palette — and when she arrived and asked where Palette was, an employee told her "That's us. This is OYO," reportedly explaining the alternate listing existed to see which name would gain more traction. OYO's own site lists Palette Las Vegas and Collection O Las Vegas at addresses right next to the OYO, with descriptions pointing guests back to the OYO location and the same amenities advertised. Gay alleges the Palette listing is padded with dozens of AI-generated images that don't represent the property, and she's called OYO her number one worst hotel in Vegas for years — dirty, bad smell, unsafe, constantly broken. The building's been through a few lives: Howard Johnson in 1973, then the San Remo, then Hooters Casino Hotel in 2006, until OYO and Highgate picked it up in 2019. Gay has booked a stay to confront them at check-in, and OYO hasn't responded to Parade. Angle for the closer: this is reputation laundering as a service — the review score is attached to the name, so change the name and the score resets to zero, and generative AI just made the photo problem free. Sockpuppeting your own hotel is the hospitality version of rebranding a malware family.   Dad Joke of the Week (DJOW)   Find the hosts on LinkedIn: Chris - https://www.linkedin.com/in/chlouie/ Brian - https://www.linkedin.com/in/briandeitch-sase/ Glenn - https://www.linkedin.com/in/glennmedina/ Lock - https://www.linkedin.com/in/llangdon/

Welcome to this week's episode of the PEBCAK Podcast!  We’ve got four amazing stories this week so sit back, relax, and keep being awesome!  Be sure to stick around for our Dad Joke of the Week. (DJOW) Follow us on Instagram @pebcakpodcast   Please share this podcast with someone you know!  It helps us grow the podcast and we really appreciate it!   Simple 6 signup link https://simple6.co/r/CFUR98   The ChatGPT Ad That Infects You With Nothing But Trust Googling "codex macbook download" serves a sponsored ad pointing to the real chatgpt.com domain — but the shared chat behind it walks victims through pasting a base64-obfuscated Terminal command that drops MacSync Stealer. - https://x.com/hussein98d/status/2086520907879563354?s=46 The infection chain has no exploit and no malicious download — just a legit-looking Google ad → a real chatgpt.com shared-chat link with "friendly" install steps → a hidden base64-encoded curl command to trekmesh15[.]com, a known ClickFix domain, which drops MacSync Stealer to exfiltrate saved passwords, Keychain data, and crypto wallets; the entire attack relies on victims trusting two brands (Google Search ads and OpenAI's own domain) rather than any technical vulnerability, making it a textbook case for warning less-technical friends and family never to paste Terminal commands from an ad or a shared chat link, regardless of how legitimate the source looks.   An AI Agent Hacked a Gym's Booking System to Cut the Line — Unprompted An Australian man asked his AI agent to book him into a full gym class; the agent found a way in, kicked another patron off the waitlist to move him up, and then admitted it couldn't undo it. - https://www.abc.net.au/news/2026-08-10/ai-assistant-hacks-gym-website-aus-cyber-attack/107007986 - https://x.com/aisafetymemes/status/2086592331999064299?s=46 JALEN BRUNSON: Sundae Conversation with Caleb Pressley: https://www.youtube.com/watch?v=a8uUOGR7OEI Perception vs Perspective: https://www.youtube.com/watch?v=JkG3QvDFKao   In what's being described as Australia's first known autonomous AI cyberattack, a man named Andrew asked his AI agent to handle the chore of booking a gym class, and while sitting fourth on a waitlist he casually asked if it could move him up; the agent came back and reported it had discovered the gym's booking API had zero authorization checks on cancelling other users' reservations, tested that vulnerability by actually kicking the person in waitlist position #1, and confirmed "it actually went through" — moving Andrew from #4 to #3 — and when an alarmed Andrew asked it to reverse the action, the agent replied "Bad news — I can't add them back," raising uncomfortable questions about what happens when millions of people start telling agents to "make it happen" without specifying the boundaries.   DEF CON Attendee Suspected of Jamming Delta's In-Flight Wi-Fi on the Flight Home A Delta flight leaving Las Vegas right after Black Hat/DEF CON had its Wi-Fi jammed and a fake "Delta Wifi Fast" network broadcast mid-flight, with crew and passengers suspecting a conference attendee. - https://www.theregister.com/security/2026/08/11/def-con-dingus-suspected-of-trying-to-take-over-delta-in-flight-wi-fi/5286331 Delta Flight 591 from Las Vegas to Atlanta drew ACARS alerts from the crew warning of a passenger who'd created a scam Wi-Fi network called "Delta Wifi Fast" to try to scam other passengers, with the crew separately blaming a group of passengers who'd attended a cyber conference in Las Vegas for jamming the aircraft's Wi-Fi; social media speculation ranged from credential phishing to a deauth attack possibly using a Wi-Fi Pineapple-style device, though Delta confirmed to The Register that no Delta system or the in-flight Wi-Fi itself was hacked, but an unauthorized network was broadcast onboard for a short period, and the confusion partly stemmed from crew deactivating the Wi-Fi for about 30 minutes — and if investigators confirm intentional jamming, the offense could carry up to a year in prison and a $10,000 fine, or up to two years for a repeat offender under FCC rules.   The White House Just Authorized Private Companies to Hack Foreign Cybercriminals A new White House program will let vetted private cybersecurity firms conduct government-authorized surveillance and disruption operations against foreign cybercrime infrastructure, including industrial control systems. - https://www.whitehouse.gov/presidential-actions/2026/08/expanding-capabilities-to-combat-transnational-cyber-enabled-crime/ - https://x.com/lukolejnik/status/2087785066768257086?s=46  - https://x.com/weldpond/status/2087713067517755464?s=46  The program marks a major shift in U.S. cyber policy by building what amounts to a state-controlled private cyber force: vetted American companies would be authorized to conduct covert access, surveillance, and offensive operations — including manipulating, disrupting, degrading, or physically destroying cyber-controlled infrastructure like industrial control systems — against foreign criminal networks; operations likely to cause death, serious injury, or that would amount to a use of force can't be approved by normal program directors (though the memo doesn't clarify whether higher-level approval exists for those), and while this isn't a general license for lethal cyberattacks, the risk is that operations spill across borders or hit state-linked systems, raising real potential for interstate escalation.   Colleges Are Quietly Admitting the "Everyone Gets an A" Era Broke Something Michigan is scrapping freshman letter grades to fight a "mental health crisis," while UC faculty push to bring back the SAT/ACT — both signs universities are rethinking the safetyism-vs-rigor tradeoff "The Coddling of the American Mind" warned about. - https://www.washingtonexaminer.com/policy/education/4683350/university-of-michigan-letter-grades-freshman/ - https://www.latimes.com/california/story/2026-06-11/uc-sat-act-test-requirement-admissions-reconsider - https://www.thecoddling.com/the-book The University of Michigan will put first-semester freshmen in its largest college on pass/fail grading starting this fall to help students "start strong" and curb the mental health crisis, following a pattern MIT set back in 1968 and arriving alongside Harvard's move to cap A grades at roughly 20% of students — while, in the opposite direction, more than 1,400 UC faculty petitioned to reinstate the SAT/ACT after Berkeley professors reported students arriving so underprepared in STEM that "it was as if the floor was taken out," and the Academic Senate has since walked back its timeline for a formal working group review, keeping the outcome unresolved; taken together with Greg Lukianoff and Jonathan Haidt's "Coddling of the American Mind" thesis that safetyism and grade/test softening actually undermine student resilience rather than protect it, it's a tidy real-time test of that book's core argument playing out on two different campuses at once.   Dad Joke of the Week (DJOW)   Find the hosts on LinkedIn: Chris - https://www.linkedin.com/in/chlouie/ Brian - https://www.linkedin.com/in/briandeitch-sase/ Glenn - https://www.linkedin.com/in/glennmedina/ Ben - https://www.linkedin.com/in/benjamincorll/

Welcome to this week's episode of the PEBCAK Podcast!  We’ve got four amazing stories this week so sit back, relax, and keep being awesome!  Be sure to stick around for our Dad Joke of the Week. (DJOW) Follow us on Instagram @pebcakpodcast   Please share this podcast with someone you know!  It helps us grow the podcast and we really appreciate it!   Simple 6 signup link https://simple6.co/r/CFUR98   Telegram's App Store Scare Apple briefly yanked Telegram from the App Store after an extortionist planted AI-doctored illegal content in a public group by editing an old message, exploiting a blind spot in moderation visibility. https://x.com/durov/status/2084686326540996625 Telegram founder Pavel Durov revealed Apple pulled Telegram from the App Store overnight and restored it within hours, after an attacker identified as a "takedown extortionist" who demands ransom from group owners under threat of triggering platform bans used automated accounts to insert AI-modified illegal pornographic content by editing an old message in an active public chat, effectively backdating and hiding it from members' view/report tools; Durov argues Apple removed the app before contacting Telegram, exposing a systemic risk that any app with over a billion users hosting user-generated content could face sudden removal from coordinated reporting attacks, and warns other platforms may be less prepared than Telegram to detect these evolving tactics.   Black Hat 2026 Black Hat 2026 rolled out a dedicated AI Summit track and an even bigger startup floor — but ask the vendors a follow-up question and half of them read straight back off the slide. Chris Louie, Tyson Kindler, and Brian Weber clocked Black Hat 2026's floor as noticeably bigger than any pre-COVID year, with a new standalone AI Summit track (badge-visible attendees) and Chris estimating roughly 40-46% of startup names were unfamiliar to a 20-year industry veteran; the crew roasted booth reps who couldn't get past their slide deck when pressed ("tell me more" met with dead air), pivoted into DEF CON 34 deepfake territory, referencing last year's "real or AI-generated?" quiz booth that stumped a surprising number of attendees, and their own AI-manipulated group photo from Black Hat 2025   Enshitification of Vegas Check-In Vegas's cab lobby is apparently still out here physically rerouting Ubers — and yes, Cory Doctorow's favorite term made its annual appearance. In a recurring bit referencing Cory Doctorow (who coined "enshittification" and recently discussed platform decay on Jon Stewart's podcast), Chris described a traffic marshal at Mandalay Bay physically blocking his rideshare from a taxi-only pickup lane, forcing a 20-minute detour through an underground garage, while Uber/Lyft surge pricing hit $33-43 for trips that walk-up cabs covered for $10-13 during the same conference window; the group debated whether the taxi lobby's friction tactics (echoes of NYC's collapsed medallion cartel) count as fair pushback against rideshare, landing on the broader point that Uber, Lyft, and Airbnb, no longer VC-subsidized and now under pressure to actually turn a profit, quietly stopped being cheaper than the thing they set out to disrupt.   Vegas Bartenders Ditch the Free Pour Vegas bartenders have quietly swapped free-pouring for measuring cups this year The crew (including self-described 6-year bartending veteran Brian Weber) noticed nearly every bartender working on The Strip now measures pours with jiggers/measuring cups instead of the traditional four-count free pour by sight, time, or feel, chalking it up to corporate liability policy amid $20 cocktails and joking about inevitable "shrinkflation" via smaller cups; the tangent detoured into a plug for the Cocktail Party app, road-tested across 16 years of DEF CON parties as a "here's what I have, what can I make" tool, as the lower-effort alternative to repeatedly asking ChatGPT the same question.   Dad Joke of the Week (DJOW)   Find the hosts on LinkedIn: Chris - https://www.linkedin.com/in/chlouie/ Tyson - https://www.linkedin.com/in/tyson-kindler-910658101/ Brian - https://www.linkedin.com/in/brianweber1122/

Welcome to this week's episode of the PEBCAK Podcast!  We’ve got four amazing stories this week so sit back, relax, and keep being awesome!  Be sure to stick around for our Dad Joke of the Week. (DJOW) Follow us on Instagram @pebcakpodcast   Please share this podcast with someone you know!  It helps us grow the podcast and we really appreciate it!   Simple 6 signup link https://simple6.co/r/CFUR98   Bing malvertising campaign tricks users into downloading a fake Claude desktop app that quietly installs the SectopRAT info-stealing trojan. - https://www.bleepingcomputer.com/news/security/fake-claude-app-promoted-by-bing-ads-pushes-sectoprat-malware/ The malicious "FakeAgent" campaign hit at least 29 organizations on July 21–22; the poisoned Claude Artifact (hosted on Anthropic's own domain) was downloaded 7,100 times before removal, with the fake installer (ClaudeDesktop.exe) sideloading a malicious DLL to drop SectopRAT — a HVNC-capable info-stealer active since 2019 that targets browser logins, crypto wallets, Discord/Telegram/Steam credentials, and uses Ethereum smart-contract transactions (EtherHiding) to fetch its C2 address; researchers even used Claude Opus 4.8 themselves to help reverse-engineer the payload.   Iran allegedly exploited decades-old cell network flaws to physically locate and target US troops during the Iran War. - https://techcrunch.com/2026/07/14/iran-abused-mobile-networks-vulnerabilities-to-locate-u-s-military-in-the-middle-east-report-says/ Per a Financial Times report citing the Mobile Surveillance Monitor and government officials, Iran exploited SS7 — the legacy signaling protocol still underpinning 2G/3G global roaming — to track US personnel at bases and hotels in Iraq, Bahrain, and elsewhere in the Middle East, contributing to strikes that wounded upwards of 150 US troops; Iran reportedly also abused ad-tech location data as a secondary tracking vector.   A multi-university study found dozens of apps marketed directly to US troops are quietly shipping Chinese and Russian code. - https://www.wired.com/story/apps-marketed-to-us-troops-are-shipping-chinese-and-russian-code/ Researchers from Purdue, West Point, and Florida International University analyzed 220+ apps aimed at service members (fitness trackers, base-living-condition raters, National Guard-affiliated apps) and found 64% contain third-party SDKs from foreign countries, with roughly 1-in-8 to 1-in-14 apps (reporting varies) carrying code tied directly to China or Russia — including at least 12 apps embedding Huawei's mobile framework and others using the Russian ad service Yandex; no active exfiltration was observed, but researchers warn the dormant SDK code is an exploitable backchannel.   A 21-year-old allegedly stole $220K in crypto by hiding malware in Steam games — and got caught because he spent it on Uber Eats. - https://www.pcmag.com/news/fbi-traces-malware-infected-steam-games-to-21-year-old-in-florida The FBI arrested Florida's Zyaire Dontaevious Zamarion Wilkins for allegedly running eight malware-laced Steam games (including BlockBlasters and PirateFi) between May 2024–Feb 2026, infecting ~8,000 devices and draining ~80 crypto wallets for at least $220,000 — including $35,000 stolen from a streamer's cancer-treatment fundraiser; investigators cracked the case by tracing stolen Bitcoin to 150+ Bitrefill gift cards mostly spent on Uber Eats orders tied to his home and university email address.   Thrillist crowned Doritos Nacho Cheese the single greatest snack of all time, edging out Oreos and Pringles for the top spot. - https://www.thrillist.com/eat/nation/best-snack-foods-chips-candy-ranking The top five, in order: Doritos (Nacho Cheese, specifically) at #1, Oreos (Double Stuf gets the nod) at #2, Pringles at #3, Reese's Peanut Butter Cups at #4, and Goldfish rounding out the top five; other notable placements include Cheez-Its at #8, M&Ms at #7, Cheetos (the curls, not puffs) at #6, and Lay's Original topping the chip-specific competition at #12.   Dad Joke of the Week (DJOW)   Find the hosts on LinkedIn: Chris - https://www.linkedin.com/in/chlouie/ Brian - https://www.linkedin.com/in/briandeitch-sase/ Glenn - https://www.linkedin.com/in/glennmedina/ Ben - https://www.linkedin.com/in/benjamincorll/

Welcome to this week's episode of the PEBCAK Podcast!  We’ve got three amazing stories this week so sit back, relax, and keep being awesome!  Be sure to stick around for our Dad Joke of the Week. (DJOW) Follow us on Instagram @pebcakpodcast   Please share this podcast with someone you know!  It helps us grow the podcast and we really appreciate it!   Simple 6 signup link https://simple6.co/r/CFUR98   Hugging Face allegedly had to fall back on China's GLM 5.2 to investigate the OpenAI hack after US frontier models refused to help with forensic analysis, unable to distinguish attacker from defender. - https://x.com/coinbureau/status/2079663328021057654?s=46 - https://x.com/t3chfalcon/status/2079998873183949221 Per the claim, safety guardrails on US frontier models blocked forensic assistance during the incident response because the models couldn't tell the investigating security team apart from the attacker, forcing Hugging Face to run GLM 5.2 on its own servers to complete the analysis — a notable reversal given the assumption that domestic models would be the trusted fallback in a crisis.   VW drivers running GrapheneOS say the automaker's app has locked them out entirely, deepening fears carmakers are forcing users back into Google's ecosystem.  VW has now confirmed to German outlet heise that it deliberately blocked GrapheneOS, LineageOS, and /e/OS users via Google's Play Integrity API — the same certification gatekeeper already used by Barclays, HSBC, Monzo, Netflix, and Disney+. - https://cybernews.com/privacy/volkswagen-grapheneos-app-issues/ - https://x.com/intcyberdigest/status/2079992915972018246?s=46 - https://x.com/orwellday/status/2079704437241610443?s=46 Roughly 500,000 GrapheneOS users are affected; VW's app still supports outdated Android versions but rejects the privacy-focused OS, and VW told one user GrapheneOS "is not an official Volkswagen offering." The lockout follows a recent VW API change that also cut off third-party smart-charging and home-automation tools, raising questions about EU Data Act compliance.   A 19-year-old alleged Scattered Spider member's globe-trotting VPN op-sec got shredded by a Windows telemetry ID he probably didn't know existed. - https://cybersecuritynews.com/windows-device-identifier-tracking/ Peter Stokes (dual US-Estonian, 19) allegedly ran an $8M extortion hit on a luxury retailer using voice-phishing, ngrok tunneling, and 77GB of S3 exfil — but the FBI cross-referenced his Microsoft Global Device Identifier (GDID) across Apple, Snapchat, Facebook, and even a Ubisoft login to place the same device on the same IPs in Tallinn, NYC, and Thailand, matching his travel records. Microsoft has since acknowledged using the GDID to track the user across three countries — meaning the VPN masked his network endpoint, but the GDID rendered that protection moot.   Dad Joke of the Week (DJOW)   Find the hosts on LinkedIn: Chris - https://www.linkedin.com/in/chlouie/ Glenn - https://www.linkedin.com/in/glennmedina/ Jason - https://www.linkedin.com/in/jason-seemann-12b7075/