daily plain-text briefing: security, markets, business, and pittsburgh
SonicWall and SharePoint zero-days draw active exploitation as enterprises digest a record Patch Tuesday, while AI now builds botnets and hunts zero-days on both sides of the fight.
Latest developments: SonicWall confirmed attackers are exploiting SMA1000 zero-days CVE-2026-15409 and CVE-2026-15410 and shipped fixes, while CISA issued a fresh warning that three vulnerabilities, two of them zero-days, are hitting internet-exposed on-premises SharePoint Server.
SonicWall's SMA1000 secure-access appliances carry two actively exploited flaws: CVE-2026-15409, a 10.0-rated server-side request forgery, and CVE-2026-15410, which enables arbitrary administrator commands. On-premises SharePoint Server users face three separate exploited bugs. Patch both product lines immediately.
Sources: The Hacker News · BleepingComputer · SecurityWeek · BleepingComputer · ↑ top
Latest developments: Researchers at OX Security, SafeDep, Socket, and StepSecurity flagged compromised @asyncapi npm packages delivering a multi-stage botnet loader and info-stealing RAT, while Arctic Wolf uncovered a single financially motivated actor running roughly 292 brand-impersonating GitHub repositories that push smash-and-grab infostealers.
Open-source repositories doubled as malware channels. Attackers slipped a botnet loader and credential stealer into malicious @asyncapi npm versions, and one actor built about 292 fake GitHub repositories impersonating security, fintech, and cryptocurrency brands to spread infostealers. Audit dependencies and download sources.
Sources: BleepingComputer · The Hacker News · Help Net Security · BleepingComputer · ↑ top
Latest developments: Mozilla shipped Firefox 152 to close two critical flaws, CVE-2026-15718 in WebAssembly and CVE-2026-15719 in DOM navigation, both with public exploit code; Chrome 150, Adobe, and VMware landed their own critical fixes; and Microsoft blocked this month's Windows 11 updates on some Dell devices that were shutting down.
Browser and enterprise vendors rushed critical patches days after Microsoft's record Patch Tuesday. Firefox, Chrome, Adobe, and VMware users should update now, since public exploit code already targets the Firefox flaws. Dell owners hitting shutdowns from the Windows updates should expect a re-release.
Sources: The Hacker News · SecurityWeek · BleepingComputer · ↑ top
Latest developments: Palo Alto Networks' Unit 42 dissected TuxBot v3, an IoT botnet framework whose operators leaned on LLMs to build cross-compiled binaries and C2 code; Intruder revealed an AI vulnerability vending machine that discovered a previously unknown WordPress plugin zero-day; and Dark Reading detailed the patched Claude PromptFiction flaw that automatically feeds malicious prompts to AI agents.
Large language models now sit on both sides of the fight, writing and cross-compiling malware for attackers and surfacing bugs at machine speed for defenders. Treat AI-accelerated exploitation as the new baseline when setting patch timelines.
Sources: Unit 42 (Palo Alto) · BleepingComputer · Dark Reading · ↑ top
Latest developments: Sophos published its State of Ransomware 2026, reporting that ransom payments fell over the past year while the share of attacks that reached successful data encryption climbed.
Sophos surveyed 2,158 IT and cybersecurity leaders across 17 countries whose organizations suffered ransomware in the past year. Fewer victims paid, but attackers succeeded more often at encrypting data. Prioritize tested backups and rapid containment.
Sources: Sophos News · ↑ top
Latest developments: Dutch authorities announced on July 15, 2026 the takedown of a global crypto investment fraud operation and the arrest of its alleged mastermind.
Dutch police dismantled a crypto investment scam that had operated like a legitimate multinational since at least 2021, running about two dozen call centers across several countries and employing more than 700 people who posed as professional financial advisers.
Sources: The Record · ↑ top
Latest developments: Oil traders now warn that the crude and product stockpiles that absorbed the war's first shock have run low as Iran shut the Strait of Hormuz again, and a reviving China could soon pull away another cushion by resuming crude purchases.
The renewed U.S.-Iran war has closed the Strait of Hormuz, the chokepoint for roughly a fifth of the world's seaborne oil, and the International Monetary Fund says the global economy holds a thinner buffer against a supply cut as crude climbs toward $80 a barrel.
Sources: Financial Times · WSJ · WSJ · ↑ top
This Afternoon: Sunny, high 97F.
Tonight: Partly Cloudy then Patchy Smoke, low 75F.
Thursday: Areas Of Smoke, high 95F.
Latest developments: An investor group led by private-equity firm Warburg Pincus agreed to acquire a controlling interest in the specialty pharmacy PANTHERx Rare.
PANTHERx Rare, the Pittsburgh-area specialty-drug pharmacy that dispenses treatments for rare diseases, will pass to majority control of a Warburg Pincus-led group of investors under the announced agreement.
Latest developments: The University of Pittsburgh signed a research agreement with biotech firm MitoSense Inc. to study mitochondria in space and long Covid.
The University of Pittsburgh will work with MitoSense Inc. to research how mitochondria behave in space and their role in long Covid, extending the university's push into space biomedicine.
Latest developments: DuBois Regional Airport could lose its air link to Pittsburgh International Airport as carriers bid for the federal air-service contract.
DuBois Regional Airport may lose its flights to Pittsburgh International Airport, the latest threat to short-haul service within Pennsylvania as airlines compete for the federal subsidy that funds the route.
Latest developments: The Pennsylvania House and Senate have each passed bell-to-bell cell phone ban legislation, and two area districts adopted their own policies ahead of a final statewide rule.
Pennsylvania lawmakers moved closer to requiring every school in the commonwealth to bar student cell phone use from the first bell to the last, though no statewide policy has yet taken effect.
Latest developments: Smoke from distant wildfires drifted into Western Pennsylvania on Wednesday, July 15, hazing skies and degrading air quality as a heat advisory ran through the night.
Hazy skies from wildfire smoke settled over Pittsburgh with highs near 91 degrees, and forecasters held a heat advisory across the region through Wednesday night as smoke exposed millions across the Midwest and Northeast to poor air.
Latest developments: Picklesburgh runs Thursday, July 16, through Sunday, July 19, in Downtown Pittsburgh, with dates and hours now set.
Picklesburgh, Pittsburgh's pickle-themed street festival, fills Downtown from Thursday, July 16, through Sunday, July 19, with hours running noon to 10 p.m. and noon to 6 p.m. and dozens of vendors serving sour, sweet, and spicy fare.
Sources: NEXTpittsburgh · ↑ top
Pirates (50-47)
Up Next · Pirates @ Guardians · Fri Jul 17, 7:10 PM
Latest developments: A Post-Gazette training-camp countdown makes the case that rookie receiver Germie Bernard will be a key piece of the Steelers offense.
The Post-Gazette's camp preview cast rookie wide receiver Germie Bernard as a likely contributor alongside DK Metcalf in an offense led by quarterback Aaron Rodgers, with the Steelers set to open camp at Saint Vincent College in Latrobe.
Sources: Post-Gazette · ↑ top
Latest developments: The full Jon Gruden episode of Cam Heyward's 'Not Just Football' posted, with Gruden opening up on Antonio Brown, coaching Brett Favre, and his two biggest coaching regrets.
Super Bowl-winning coach Jon Gruden joined Steelers defensive lineman Cam Heyward and co-host Hayden for stories from his Green Bay, Raiders, and Tampa Bay years.
Sources: Not Just Football with Cam Heyward · ↑ top
Latest developments: Braxton Ashcraft made his first All-Star selection in Philadelphia, and Paul Skenes admitted an All-Star Game with no Pirates taking the field felt 'a little weird.'
Pirates pitcher Braxton Ashcraft, who reached the majors after switching from football and fighting through injuries, walked the red carpet as an All-Star in Philadelphia alongside ace Paul Skenes, the team's only two selections.
Sources: Post-Gazette · Post-Gazette · ↑ top
Latest developments: With the U.S. men's World Cup run over and Mauricio Pochettino's contract complete, ESPN laid out 11 candidates U.S. Soccer could pursue as its next head coach.
Mauricio Pochettino's deal as U.S. men's national team coach ran out after the Americans' round-of-16 loss at the home World Cup, leaving U.S. Soccer to weigh a replacement ahead of the next cycle.
S&P 500 7,532.13 ▲ +0.4% Nasdaq 26,067.87 ▲ +0.2% WTI crude 74.90 ▲ +8.3% EUR/USD 1.1410 ▼ -0.1% GBP/USD 1.3379 ▲ +0.4% USD/JPY 162.31 ▲ +0.2%