Saturday Security: Cl0p Ransomware Hits 40+ Companies Through One Vulnerability

 

Your Software Is Your Attack Surface!

This week's Saturday Security Story highlights a growing supply-chain risk: the software your organization relies on can become an attacker’s pathway to your most valuable data.

The Cl0p ransomware group claims to have targeted more than 40 organizations by exploiting CVE-2026-12569, a critical vulnerability in PTC Windchill and FlexPLM product lifecycle management platforms.

The vulnerability reportedly allowed unauthenticated remote code execution and access to sensitive engineering data, with alleged victims including Shell, Philips, GE and Fiserv.

The bigger lesson? Attackers don't necessarily need to breach dozens of companies individually. One vulnerability in widely deployed enterprise software can potentially provide access to many organizations at once.

Third-party software isn't just vendor risk. It's part of your attack surface.

I'm Peter, and that's your Saturday Security Story. Like, subscribe and stay secure!

https://cybermagazine.com/news/plm-zero-day-flaw-exploited-by-clop-in-massive-data-breach

https://www.securityweek.com/cl0p-ransomware-group-names-over-40-victims-of-ptc-windchill-campaign/

Saturday Security: Evil Twin Attack at 30,000 Feet with Fake Wi-Fi on a Delta Flight

 

This week's Saturday Security Story takes us 30,000 feet in the air — and it's a fascinating one. A fake Wi-Fi network appeared on a Delta flight from Las Vegas to Atlanta — and not just any flight. This was a plane leaving the notorious Black Hat conference and DEF CON — two of the world's biggest cybersecurity events. If you're going to pull a stunt like this, that's quite an audience to pick. A passenger had created a network impersonating Delta's onboard Wi-Fi, prompting the airline to shut down legitimate onboard Wi-Fi for approximately 30 minutes while the situation was addressed. The good news: Delta confirmed no aircraft systems or flight safety systems were affected and there was no actual breach of Delta's own infrastructure. But here's why it matters — this is a classic Evil Twin Attack. A fake access point deliberately named to mimic a trusted network — designed to trick unsuspecting users into connecting and potentially exposing their passwords, browsing data, and personal information to whoever controls the rogue hotspot. This week's big takeaway: Never automatically trust the Wi-Fi name you see. Verify the network before you connect — especially in airports, hotels, conference centers, and yes — at 30,000 feet. https://www.theregister.com/security/2026/08/11/def-con-dingus-suspected-of-trying-to-take-over-delta-in-flight-wi-fi/5286331 🗓️ Week ending August 15th, 2026 👤 Hosted by Peter

Saturday Security: Brinks Breach May Be Just the Beginning

 

This week's Saturday Security Story is a reminder that sometimes the biggest threat after a breach is the attack that comes next. Brinks — yes, the iconic security company — has confirmed unauthorized access to part of its IT systems, saying it quickly activated its incident response process. The good news: alarm monitoring and security systems continued operating normally throughout the incident. The Shiny Hunters group — covered multiple times on this channel — has claimed responsibility, alleging they stole millions of customer and employee records. Brinks has not yet confirmed exactly what information was taken or who may be affected. That uncertainty is itself part of the problem. Brinks is now warning customers to watch for follow-up phishing emails, texts, and phone calls designed to exploit the breach — using stolen personal information to make fraudulent contact appear legitimate. This week's big takeaway: The breach doesn't end when the attackers leave. Stolen data becomes ammunition for the next attack — and the victims of the initial breach become the targets of everything that follows. Stay vigilant. https://brinkshome.com/cybersecurity-update https://www.safestate.com/post/brinks-home-data-breach-confirmed-as-shinyhunters-threatens-leak 🗓️ Week ending August 8th, 2026 👤 Hosted by Peter

Saturday Security: FBI & EPA Warn Attackers Targeting US Water Systems

 

This week's Saturday Security Story is a sobering reminder that America's water infrastructure remains a prime cyber target. The FBI and EPA are jointly warning that cyber attacks have now been reported at municipal water systems across at least seven states. Iran-linked hackers are the leading suspects in attacks affecting more than 30 Minnesota utilities — though the investigation remains ongoing. The attack method was straightforward but effective: attackers targeted internet-connected industrial control systems (ICS), changing passwords and locking operators out of remote monitoring. The good news — no evidence of drinking water contamination has been found. The bad news — that almost misses the point entirely. This week's big takeaway: Critical infrastructure doesn't have to be physically destroyed to cause serious disruption. Simply forcing utility operators into manual operations creates real-world consequences — slower response times, increased risk of human error, and cascading operational failures. If your OT (Operational Technology) systems are exposed to the internet right now, securing them cannot wait. https://www.nytimes.com/2026/07/30/us/politics/minnesota-water-cyberattack-iran.html https://www.nbcnews.com/tech/security/hackers-targeted-municipal-water-systems-7-states-week-fbi-says-rcna590210 🗓️ Week ending August 1st, 2026 — Welcome to August! 👤 Hosted by Peter 00:00:00 - Intro: America's Water Infrastructure Under Attack 00:00:27 - How the Attack Worked — Locked Out of Remote Monitoring 00:00:45 - No Contamination But Real Disruption 00:01:01 - Takeaway: Secure Your OT Systems Now 00:01:01 - Sign-Off & Welcome to August 2026

Saturday Security: Hugging Face Breached by Autonomous Agent

 

Hugging Face — the world's largest AI model repository — has disclosed that an autonomous AI agent breached its production environment. The attack unfolded by uploading a malicious dataset that exploited code execution flaws, stole credentials, and then moved laterally through internal systems — performing thousands of automated actions without any human attacker behind the keyboard. The good news: there was no evidence that public AI models were modified — which would have been a catastrophic supply chain scenario affecting potentially millions of downstream users. This week's big takeaway: When your platform is designed to execute user-supplied AI models or datasets, that execution environment becomes your attack surface. Every upload should be treated as potentially hostile. Isolate your credentials. Build your sandboxes like your business depends on them. Because it does. https://thehackernews.com/2026/07/worlds-largest-ai-model-repository.html 🗓️ Week ending July 25th, 2026 👤 Hosted by Peter 00:00:00 - Intro: When the Attacker Is Another AI 00:00:27 - How the Autonomous Agent Moved Through Systems 00:00:45 - Takeaway: Every Upload Is Hostile 00:00:59 - Sign-Off

Saturday Security: FIFA World Cup Scams Are Exploding

 

9,700 Fake Sites in One Month! The biggest sporting event in the world has officially become the biggest cyber target in the world. Last week we covered how an ethical hacker discovered that FIFA's World Cup systems could be accessed using nothing more than a simple account created through its football agent platform. This week, cybersecurity researchers report that scammers are now flooding the internet with fake World Cup ticket sites, bogus merchandise stores, and AI-powered phishing campaigns targeting fans. The numbers are staggering: more than 9,700 World Cup-related domains were registered in just one month — including hundreds of convincing copycat ticket websites designed specifically to steal money and personal information from unsuspecting fans. This week's big takeaway: Before buying tickets, merchandise, or streaming access, always verify you're on the official site, and be skeptical of any deal that seems too good to be true. Don't FAFO with FIFA content. https://www.csis.org/analysis/cyber-threat-2026-world-cup https://www.darkreading.com/cybersecurity-operations/2026-fifa-world-cup-faces-surge-cyber-threats 🗓️ Week ending June 27th, 2026 👤 Hosted by Peter 00:00:00 - Intro: World Cup Becomes the Biggest Cyber Target 00:00:31 - 9700 Fake Domains in One Month 00:01:05 - Takeaway: Verify Before You Buy 00:01:14 - Sign-Off

Saturday Security: FIFA Security Flaw Could Have Hijacked World Cup Broadcasts

 

This week's story proves that cyber risk isn't always a sophisticated nation-state attack — sometimes it's a simple security mistake hiding in plain sight. Ethical hacker 'BobDaHacker' discovered that FIFA's World Cup systems could be accessed using nothing more than a simple account created through its football agent platform. Because access controls were properly enforced on the front-end website but not on the back end, the researcher reportedly gained access to World Cup broadcast systems, match management platforms, and other critical operational infrastructure. In theory, an attacker exploiting this same flaw could have: * Interrupted live matches * Altered real-time game information * Replaced broadcasts entirely with different video content The good news — the issue was reportedly disclosed responsibly and quickly fixed. This week's big takeaway: If your security only checks permissions in the user interface, you don't actually have access control — you have a suggestion. Real security has to be enforced on the server side, every single time. https://www.darkreading.com/application-security/fifa-bug-world-cup-streams-remote-takeover 🗓️ Week ending June 20th, 2026 👤 Hosted by Peter 00:00:00 - Intro: A Simple Mistake, Not a Sophisticated Attack 00:00:37 - What an Attacker Could Have Done 00:01:00 - Takeaway: UI Permissions Are Not Access Control 00:01:05 - Sign-Off