Saturday Security: FBI & EPA Warn Attackers Targeting US Water Systems

 

This week's Saturday Security Story is a sobering reminder that America's water infrastructure remains a prime cyber target. The FBI and EPA are jointly warning that cyber attacks have now been reported at municipal water systems across at least seven states. Iran-linked hackers are the leading suspects in attacks affecting more than 30 Minnesota utilities — though the investigation remains ongoing. The attack method was straightforward but effective: attackers targeted internet-connected industrial control systems (ICS), changing passwords and locking operators out of remote monitoring. The good news — no evidence of drinking water contamination has been found. The bad news — that almost misses the point entirely. This week's big takeaway: Critical infrastructure doesn't have to be physically destroyed to cause serious disruption. Simply forcing utility operators into manual operations creates real-world consequences — slower response times, increased risk of human error, and cascading operational failures. If your OT (Operational Technology) systems are exposed to the internet right now, securing them cannot wait. https://www.nytimes.com/2026/07/30/us/politics/minnesota-water-cyberattack-iran.html https://www.nbcnews.com/tech/security/hackers-targeted-municipal-water-systems-7-states-week-fbi-says-rcna590210 🗓️ Week ending August 1st, 2026 — Welcome to August! 👤 Hosted by Peter 00:00:00 - Intro: America's Water Infrastructure Under Attack 00:00:27 - How the Attack Worked — Locked Out of Remote Monitoring 00:00:45 - No Contamination But Real Disruption 00:01:01 - Takeaway: Secure Your OT Systems Now 00:01:01 - Sign-Off & Welcome to August 2026

Saturday Security: Hugging Face Breached by Autonomous Agent

 

Hugging Face — the world's largest AI model repository — has disclosed that an autonomous AI agent breached its production environment. The attack unfolded by uploading a malicious dataset that exploited code execution flaws, stole credentials, and then moved laterally through internal systems — performing thousands of automated actions without any human attacker behind the keyboard. The good news: there was no evidence that public AI models were modified — which would have been a catastrophic supply chain scenario affecting potentially millions of downstream users. This week's big takeaway: When your platform is designed to execute user-supplied AI models or datasets, that execution environment becomes your attack surface. Every upload should be treated as potentially hostile. Isolate your credentials. Build your sandboxes like your business depends on them. Because it does. https://thehackernews.com/2026/07/worlds-largest-ai-model-repository.html 🗓️ Week ending July 25th, 2026 👤 Hosted by Peter 00:00:00 - Intro: When the Attacker Is Another AI 00:00:27 - How the Autonomous Agent Moved Through Systems 00:00:45 - Takeaway: Every Upload Is Hostile 00:00:59 - Sign-Off

Saturday Security: FIFA World Cup Scams Are Exploding

 

9,700 Fake Sites in One Month! The biggest sporting event in the world has officially become the biggest cyber target in the world. Last week we covered how an ethical hacker discovered that FIFA's World Cup systems could be accessed using nothing more than a simple account created through its football agent platform. This week, cybersecurity researchers report that scammers are now flooding the internet with fake World Cup ticket sites, bogus merchandise stores, and AI-powered phishing campaigns targeting fans. The numbers are staggering: more than 9,700 World Cup-related domains were registered in just one month — including hundreds of convincing copycat ticket websites designed specifically to steal money and personal information from unsuspecting fans. This week's big takeaway: Before buying tickets, merchandise, or streaming access, always verify you're on the official site, and be skeptical of any deal that seems too good to be true. Don't FAFO with FIFA content. https://www.csis.org/analysis/cyber-threat-2026-world-cup https://www.darkreading.com/cybersecurity-operations/2026-fifa-world-cup-faces-surge-cyber-threats 🗓️ Week ending June 27th, 2026 👤 Hosted by Peter 00:00:00 - Intro: World Cup Becomes the Biggest Cyber Target 00:00:31 - 9700 Fake Domains in One Month 00:01:05 - Takeaway: Verify Before You Buy 00:01:14 - Sign-Off

Saturday Security: FIFA Security Flaw Could Have Hijacked World Cup Broadcasts

 

This week's story proves that cyber risk isn't always a sophisticated nation-state attack — sometimes it's a simple security mistake hiding in plain sight. Ethical hacker 'BobDaHacker' discovered that FIFA's World Cup systems could be accessed using nothing more than a simple account created through its football agent platform. Because access controls were properly enforced on the front-end website but not on the back end, the researcher reportedly gained access to World Cup broadcast systems, match management platforms, and other critical operational infrastructure. In theory, an attacker exploiting this same flaw could have: * Interrupted live matches * Altered real-time game information * Replaced broadcasts entirely with different video content The good news — the issue was reportedly disclosed responsibly and quickly fixed. This week's big takeaway: If your security only checks permissions in the user interface, you don't actually have access control — you have a suggestion. Real security has to be enforced on the server side, every single time. https://www.darkreading.com/application-security/fifa-bug-world-cup-streams-remote-takeover 🗓️ Week ending June 20th, 2026 👤 Hosted by Peter 00:00:00 - Intro: A Simple Mistake, Not a Sophisticated Attack 00:00:37 - What an Attacker Could Have Done 00:01:00 - Takeaway: UI Permissions Are Not Access Control 00:01:05 - Sign-Off

Saturday Security: CISA's New 72-Hour Patch Rule

 

For years the mantra in IT security has been simple — patch everything. But in the age of AI that's no longer realistic. And this week CISA made it official with a new approach that changes the game for federal agencies and sets a precedent for the entire industry. CISA's new risk-based patching framework requires federal agencies to patch the most dangerous vulnerabilities within just 72 hours. The reason? AI is now helping attackers discover and exploit software flaws faster than ever — making the old "patch everything eventually" approach dangerously outdated. Under the new rules, priorities are clear: Top priority — Internet-facing vulnerabilities that are actively being exploited AND can be automated Everything else — Ranked and addressed based on actual risk level This week's big takeaway: Cybersecurity isn't about patching everything anymore — it's about patching smarter. When attackers can use AI to scale their efforts at machine speed, defenders have to laser-focus on what matters most and move fast. Speed now beats volume. https://www.cisa.gov/news-events/news/patch-smarter-not-harder https://www.cisa.gov/news-events/news/cisa-issues-new-directive-improving-how-federal-agencies-prioritize-mitigation-cyber-vulnerabilities 🗓️ Week ending June 13th, 2026 👤 Hosted by Peter 00:00:00 - Intro: The End of Patch Everything 00:00:35 - CISA's New 72-Hour Rule Explained 00:00:50 - How AI Is Accelerating Attacks 00:00:58 - Takeaway: Speed Beats Volume 00:01:02 - Sign-Off

Saturday Security: Threat Actors Are Targeting Fuel Tank Gauges

 

This week's story is a reminder that any connected device can become a cyber target — even something as unglamorous as a fuel gauge. CISA, the FBI, and the NSA are all warning that attackers are actively targeting internet-exposed automatic tank gauges — the systems used to monitor fuel and chemical storage tanks at gas stations, airports, military installations, and industrial facilities. If compromised, attackers could manipulate fuel readings, disable safety alerts, or interfere with critical safety systems — with potentially dangerous real-world consequences. The good news? Exposed devices have dropped significantly — from nearly 6,000 a decade ago to just under 1,000 today. Progress, but still too many. This week's big takeaway: If it doesn't need to be on the internet — don't put it there. We've been saying this for 25 years and it still needs repeating. Sometimes the biggest cyber risks are hiding in the equipment nobody thinks about. 🗓️ Week ending June 6th, 2026 👤 Hosted by Peter https://www.darkreading.com/cyberattacks-data-breaches/exposed-fuel-tank-gauges-attack-us

Saturday Security: FBI Warns Breaches Are Showing Up In Person

 

Not every breach starts with malware — and this week's story is a reminder of that in a big way. The FBI is warning that Silent Ransom Group — also known as Luna Moth and Chatty Spider — is actively targeting U.S. law firms and other industries using a surprisingly low-tech playbook. This group impersonates IT support through phone calls, phishing emails, and in some cases physically showing up in person posing as technicians. No ransomware. No encryption. Instead they use legitimate tools to quietly steal data — then demand millions in ransom, threatening to leak sensitive client information if they don't get paid. Law firms are a prime target because of the weight of confidential client data and the enormous pressure to protect attorney-client privilege. One breach can be catastrophic. This week's big takeaway: IT security isn't just about firewalls anymore. Verify IT requests. Authenticate visitors. Trust but verify. It's essentially zero trust applied to the physical world. https://www.ic3.gov/CSA/2026/260526.pdf 🗓️ Saturday Security for the Week ending May 30th, 2026 👤 Hosted by Peter