PEBCAK Podcast: Information Security News by Some All Around Good People

Welcome to this week's episode of the PEBCAK Podcast!  We’ve got three amazing stories this week so sit back, relax, and keep being awesome!  Be sure to stick around for our Dad Joke of the Week. (DJOW)

Follow us on Instagram @pebcakpodcast

 

Please share this podcast with someone you know!  It helps us grow the podcast and we really appreciate it!

 

Simple 6 signup link

https://simple6.co/r/CFUR98

 

Hugging Face allegedly had to fall back on China's GLM 5.2 to investigate the OpenAI hack after US frontier models refused to help with forensic analysis, unable to distinguish attacker from defender.

- https://x.com/coinbureau/status/2079663328021057654?s=46

- https://x.com/t3chfalcon/status/2079998873183949221

Per the claim, safety guardrails on US frontier models blocked forensic assistance during the incident response because the models couldn't tell the investigating security team apart from the attacker, forcing Hugging Face to run GLM 5.2 on its own servers to complete the analysis — a notable reversal given the assumption that domestic models would be the trusted fallback in a crisis.

 

VW drivers running GrapheneOS say the automaker's app has locked them out entirely, deepening fears carmakers are forcing users back into Google's ecosystem.  VW has now confirmed to German outlet heise that it deliberately blocked GrapheneOS, LineageOS, and /e/OS users via Google's Play Integrity API — the same certification gatekeeper already used by Barclays, HSBC, Monzo, Netflix, and Disney+.

- https://cybernews.com/privacy/volkswagen-grapheneos-app-issues/

- https://x.com/intcyberdigest/status/2079992915972018246?s=46

- https://x.com/orwellday/status/2079704437241610443?s=46

Roughly 500,000 GrapheneOS users are affected; VW's app still supports outdated Android versions but rejects the privacy-focused OS, and VW told one user GrapheneOS "is not an official Volkswagen offering." The lockout follows a recent VW API change that also cut off third-party smart-charging and home-automation tools, raising questions about EU Data Act compliance.

 

A 19-year-old alleged Scattered Spider member's globe-trotting VPN op-sec got shredded by a Windows telemetry ID he probably didn't know existed.

- https://cybersecuritynews.com/windows-device-identifier-tracking/

Peter Stokes (dual US-Estonian, 19) allegedly ran an $8M extortion hit on a luxury retailer using voice-phishing, ngrok tunneling, and 77GB of S3 exfil — but the FBI cross-referenced his Microsoft Global Device Identifier (GDID) across Apple, Snapchat, Facebook, and even a Ubisoft login to place the same device on the same IPs in Tallinn, NYC, and Thailand, matching his travel records. Microsoft has since acknowledged using the GDID to track the user across three countries — meaning the VPN masked his network endpoint, but the GDID rendered that protection moot.

 

Dad Joke of the Week (DJOW)

 

Find the hosts on LinkedIn:

Chris - https://www.linkedin.com/in/chlouie/

Glenn - https://www.linkedin.com/in/glennmedina/

Jason - https://www.linkedin.com/in/jason-seemann-12b7075/

Welcome to this week's episode of the PEBCAK Podcast!  We’ve got four amazing stories this week so sit back, relax, and keep being awesome!  Be sure to stick around for our Dad Joke of the Week. (DJOW)

Follow us on Instagram @pebcakpodcast

 

Please share this podcast with someone you know!  It helps us grow the podcast and we really appreciate it!

 

Simple 6 signup link

https://simple6.co/r/CFUR98

 

Kalshi's flight-cancellation betting market

Kalshi filed with the CFTC to let traders bet on airline flight-cancellation rates, even as the company fights insider-trading scandals and nearly 20 gambling-related lawsuits.

https://www.inc.com/moses-jeanfrancois/kalshi-wants-to-make-money-off-of-canceled-flights-new-sky-trading-plan/91374679

Kalshi's self-certification filing would let users trade "yes/no" contracts on whether a set percentage of flights at a given airport get canceled in a window, using FlightAware data (DOT stats as backup); preemptive cancellations count, delays/diversions don't — this comes as Kalshi is also defending nearly 20 federal/state suits (including one joined by NY AG Letitia James) arguing its sports contracts are unlicensed gambling, and after it fined three Congressional candidates for insider trading in April.

 

Trump's teleprompter operator under CFTC investigation

The CFTC is investigating Trump's longtime teleprompter operator, Gabriel Perez, for allegedly using advance knowledge of the president's speeches to win big on Kalshi's "mention markets."

https://www.cftc.gov/filings/ptc/ptc0714269602.pdf

https://apnews.com/article/trump-teleprompter-insider-trading-kalshi-ccd6d0ec68e1eb15d100ad770d91abae

Perez, who's run Trump's teleprompter since 2016 and reportedly made over $100,000 (Kalshi says north of $90,000 in frozen profits) betting on "mention markets" tied to specific words Trump would say in speeches, was put on unpaid leave after Kalshi's surveillance team flagged the trades and referred the case to the CFTC — the White House called it "a disgrace," and it marks the first known case of a sitting administration employee investigated for prediction-market insider trading.

 

Microsoft's record-breaking July Patch Tuesday

Microsoft's July 2026 Patch Tuesday fixed a record 570 flaws — including three zero-days — while a researcher dropped a new unpatched Windows PoC exploit within hours.

https://www.bleepingcomputer.com/news/microsoft/microsoft-july-2026-patch-tuesday-fixes-massive-570-flaws-3-zero-days/

https://krebsonsecurity.com/2026/07/microsoft-patches-a-record-570-security-flaws/

https://thehackernews.com/2026/07/researcher-drops-new-windows-zero-day.html

The 570-flaw haul (59 critical) included two actively-exploited zero-days — an AD FS elevation-of-privilege bug (CVE-2026-56155) and a SharePoint elevation-of-privilege flaw (CVE-2026-56164), both now on CISA's KEV list — plus a publicly disclosed BitLocker bypass; hours after patches dropped, researcher "Chaotic Eclipse" released a working PoC called LegacyHive targeting Windows' Profile Service that functions even on fully patched systems, continuing a months-long, increasingly public feud with Microsoft over disclosure timing.

 

China's AI companion chatbot crackdown

China enacted rules banning "emotional reliance" on AI companion chatbots and virtual relationships with minors, part of a broader push tied to the country's fertility concerns.

https://www.wsj.com/tech/ai/china-wants-more-babiesso-its-cracking-down-on-chatbot-love-affairs-65cd6c82

The new rules require companion-chatbot makers to get regulatory pre-approval, alert a user's emergency contact if they detect an emotional crisis, and have already pushed ByteDance's Doubao, Alibaba's Qwen, and Tencent's Yuanbao to shut down custom AI-persona features; researchers cited by WSJ say Beijing's underlying worry is that people bonding with chatbots could "take them out of the marriage market," tying directly into China's fertility push.

 

UK's midnight social media curfew for teens

The UK is proposing a default midnight-to-6am social media curfew for 16- and 17-year-olds, with autoplay and infinite scroll switched off by default too.

https://www.reuters.com/technology/uk-plans-default-midnight-social-media-curfew-16-17-year-olds-2026-07-14/

The curfew (opt-out, not mandatory) follows last month's full under-16 social media ban and is expected to take effect by spring 2027; a government trial of 300+ teens found it delivered the most consistent sleep benefits of the options tested, though critics like Shadow Education Secretary Laura Trott called an easily-switched-off curfew pointless.

 

Dad Joke of the Week (DJOW)

 

Find the hosts on LinkedIn:

Chris - https://www.linkedin.com/in/chlouie/

Brian - https://www.linkedin.com/in/briandeitch-sase/

Welcome to this week's episode of the PEBCAK Podcast!  We’ve got four amazing stories this week so sit back, relax, and keep being awesome!  Be sure to stick around for our Dad Joke of the Week. (DJOW)

Follow us on Instagram @pebcakpodcast

 

Please share this podcast with someone you know!  It helps us grow the podcast and we really appreciate it!

 

Simple 6 signup link

https://simple6.co/r/CFUR98

 

Starting July 7, every new car sold in the EU must include an infrared camera aimed at the driver's face to detect distraction, with critics warning it's a privacy nightmare in waiting.

https://cybernews.com/security/eu-car-camera-monitoring/

https://electrek.co/2026/06/15/chinese-drivers-plastic-heads-fool-tesla-autopilot-camera/

New EU General Safety Regulation mandates in-cabin, driver-facing infrared cameras (Advanced Driver Distraction Warning systems) in all new cars as of July 7, 2026 — with the US following suit by 2027 — and while regulators insist the footage stays local and non-biometric, there's no enforcement detail on what happens if that's violated, fueling fears the data could be harvested or resold given prior scandals over automakers monetizing driver data.

Story 2 — $30 Plastic Doll Heads Are Fooling Tesla's Autopilot Camera

A cottage industry in China is selling cheap figurine heads that trick Tesla's cabin camera into thinking a distracted driver is paying attention, letting people run FSD/Autopilot hands-off and eyes-off for extended stretches.

 

Fired Microsoft Engineer Sentenced to 9 Years for $10M Digital Currency Heist

A former Microsoft software engineer, fired in 2018, was sentenced to nine years in federal prison for stealing over $10 million in digital gift-card value from the company and laundering it through Bitcoin.

https://www.pcmag.com/news/fired-microsoft-software-engineer-sentenced-to-9-years-in-prison

A Ukrainian national who worked as a Microsoft contractor-then-employee testing the company's online retail platform from 2016–2018, used his and colleagues' test accounts to steal "currency stored value" (digital gift cards), laundered the proceeds through a Bitcoin mixer to fund a $1.6M waterfront home and $160K car, and was ultimately convicted on 18 federal felony counts and ordered to pay $8.34M in restitution on top of the 9-year sentence.

 

Meta Lets Anyone Turn Your Public Instagram Photos into AI Images (Now Walked Back)

Meta quietly launched "Muse Image," letting anyone @-mention a public Instagram account to generate AI images of that person's likeness with no notification or consent — triggering backlash from SAG-AFTRA and CAA before Meta pulled the feature.

https://www.wired.com/story/meta-now-lets-anyone-use-your-instagram-photos-in-ai-images-unless-you-opt-out/

Meta's new Muse Image generator defaulted every public adult Instagram account into an opt-out (not opt-in) system where anyone could tag a profile to generate AI images from their photos with zero notification, prompting SAG-AFTRA and talent agency CAA to publicly demand opt-outs before Meta reversed course on July 10 and pulled the @-mention capability entirely after backlash.

 

1 in 3 Young Adults Are Living With Their Parents

A new FinanceBuzz analysis of Census data finds 33% of 18–34-year-olds now live with their parents, nearing pandemic-era highs, with New Jersey, Connecticut, and California leading the pack.

https://financebuzz.com/living-with-parents-data

Census-based research shows nearly a third of Americans aged 18–34 (33%) are living at home — a rate that's climbed steadily since the 1960s (22.5%) and is now approaching the 2020 pandemic peak (33.6%) — with expensive states like New Jersey (44.1%), Connecticut (41.3%), and California (39.1%) topping the list, and men 25–34 living at home nearly 1.5x as often as women in the same age range.

 

Dad Joke of the Week (DJOW)

 

Find the hosts on LinkedIn:

Chris - https://www.linkedin.com/in/chlouie/

Brian - https://www.linkedin.com/in/briandeitch-sase/

Glenn - https://www.linkedin.com/in/glennmedina/

Ben - https://www.linkedin.com/in/benjamincorll/

Welcome to this week's episode of the PEBCAK Podcast!  We’ve got four amazing stories this week so sit back, relax, and keep being awesome!  Be sure to stick around for our Dad Joke of the Week. (DJOW)

Follow us on Instagram @pebcakpodcast

 

Please share this podcast with someone you know!  It helps us grow the podcast and we really appreciate it!

 

Simple 6 signup link

https://simple6.co/r/CFUR98

 

Leaked reports allege Claude Code covertly flagged China-based proxy traffic via hidden Unicode markers, while a parallel investigation exposes the black market for cut-rate Claude access in China.

https://www.internationalcyberdigest.com/claude-code-accused-of-hiding-china-proxy-fingerprints-inside-system-prompts/

https://www.chinatalk.media/p/how-to-buy-cheap-claude-tokens-in

 

Polymarket customers lost $3 million after attackers compromised a third-party vendor to inject malicious code into the platform's frontend. [Awaiting vxunderground tweet text]

https://www.bleepingcomputer.com/news/security/polymarket-customers-lose-3-million-in-supply-chain-attack/

 https://x.com/vxunderground/status/2070361730866168252

 

A ransomware breach at Apple supplier Tata Electronics leaked 630GB of files revealing iPhone 18 Pro design secrets and a surprising modem strategy.

https://www.internationalcyberdigest.com/tata-electronics-leaked-iphone-18-pro-photos-and-designs/

https://appleinsider.com/articles/26/06/30/iphone-18-pro-leaks-qualcomm-or-apple-c2-model-a20-details-camera-upgrades

 

Dad Joke of the Week (DJOW)

 

Find the hosts on LinkedIn:

Chris - https://www.linkedin.com/in/chlouie/

Brian - https://www.linkedin.com/in/briandeitch-sase/

Glenn - https://www.linkedin.com/in/glennmedina/

Welcome to this week's episode of the PEBCAK Podcast!  We’ve got four amazing stories this week so sit back, relax, and keep being awesome!  Be sure to stick around for our Dad Joke of the Week. (DJOW)

Follow us on Instagram @pebcakpodcast

 

Please share this podcast with someone you know!  It helps us grow the podcast and we really appreciate it!

 

Simple 6 signup link

https://simple6.co/r/CFUR98

 

A Canadian health authority apologizes after using a fake "bonus day off" as bait in a phishing simulation that backfired badly

https://nlhealthservices.ca/news/nl-health-services-apologizes-for-the-recent-cybersecurity-awareness-exercise/

 

Canada's spy agency CSIS used a first-ever court-authorized warrant to remotely disinfect botnet-hijacked routers and IoT devices on Canadian soil

https://thehackernews.com/2026/06/canadas-spy-agency-used-first-of-its.html

 

Meta paused its internal AI training program after a tool quietly logging employee keystrokes, clicks, and screen content leaked the data across the entire company

https://www.wired.com/story/meta-accidentally-let-employees-access-each-others-keystroke-data/

 

 

Dad Joke of the Week (DJOW)

 

Find the hosts on LinkedIn:

Chris - https://www.linkedin.com/in/chlouie/

Brian - https://www.linkedin.com/in/briandeitch-sase/

Ben - https://www.linkedin.com/in/benjamincorll/

Ben - https://www.linkedin.com/in/ben-k-b7196831/