daily plain-text briefing: security, markets, business, and pittsburgh
CISA rushed to catalog freshly exploited SonicWall, SharePoint, and Active Directory zero-days atop Microsoft's record 570-flaw Patch Tuesday as the U.S. sanctioned and indicted the infrastructure behind ransomware.
Latest developments: CISA on July 14, 2026 added four exploited flaws to its Known Exploited Vulnerabilities catalog—SonicWall SMA1000 bugs CVE-2026-15409 and CVE-2026-15410, Microsoft Active Directory Federation Services flaw CVE-2026-56155, and SharePoint Server flaw CVE-2026-56164—and issued separate hardening guidance after finding attackers chaining CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164 for remote code execution on on-premises SharePoint.
Microsoft's July Patch Tuesday closed a record 570 flaws by its own count, 622 with Chromium, including two zero-days exploited in the wild; the SonicWall bugs hit Secure Mobile Access 1000 Series VPN appliances. Patch immediately and hunt every affected system for compromise.
Sources: CISA Advisories · CISA Advisories · Dark Reading · BleepingComputer · ↑ top
Latest developments: OFAC sanctioned First VPN Service (1VPNS), its 45-year-old Ukrainian operator, and a malware cryptor seller on July 14, 2026 for arming ransomware crews—the first VPN provider it has ever designated—while U.S. prosecutors unsealed an indictment against the Russian operators of St. Petersburg bulletproof host Media Land and its sister firm ML Cloud.
The actions target the infrastructure that lets ransomware gangs operate: anonymizing VPNs, malware-encryption services, and hosts that ignore abuse complaints. Both moves aim to raise the cost of the cybercrime supply chain.
Sources: BleepingComputer · The Hacker News · The Record · ↑ top
Latest developments: Dutch military intelligence, the MIVD, disclosed July 14, 2026 that a Russian intelligence agency compromised internet-connected cameras across Europe to surveil NATO military logistics and Ukrainian personnel movements, as U.S. and allied agencies reiterated warnings that Russian state APTs are commandeering poorly secured critical-infrastructure routers.
The campaign turns exposed IP cameras and edge devices into a passive espionage network trained on wartime supply lines. Organizations near sensitive sites should lock down or remove internet-facing cameras and routers.
Sources: The Record · SecurityWeek · ↑ top
Latest developments: The Hacker News detailed July 14, 2026 a novel OAuth client ID spoofing technique that at least two threat actors use to enumerate accounts and validate stolen Microsoft Entra ID credentials without ever generating a sign-in event, while Microsoft mapped three Salesforce attack paths tied to a year of ShinyHunters OAuth abuse that never touched a platform flaw.
Attackers increasingly exploit the trust baked into OAuth connections to slip past login telemetry and reach cloud data. Audit OAuth grants and third-party app connections across Entra and Salesforce now.
Sources: The Hacker News · The Hacker News · ↑ top
Latest developments: Microsoft said July 14, 2026 that passkeys become the default authentication experience for Entra ID in the public cloud on September 1, 2026, auto-enabling tenants that use SMS or voice, and that from February 1, 2027 it will require those users to register a passkey before they can sign in.
The change pushes enterprises off phishable SMS and voice codes toward FIDO2 passkeys across Microsoft 365 and Azure. Plan passkey enrollment and update conditional-access and MFA policies ahead of the deadlines.
Sources: BleepingComputer · Help Net Security · ↑ top
Latest developments: JFrog found 148 npm packages posing as student web proxies that quietly conscripted visitors' browsers into a DDoS botnet for roughly two weeks in May 2026, and a separate threat actor poisoned multiple Jscrambler npm package versions to drop a cross-platform credential stealer.
Criminals keep abusing the npm registry both as free malware hosting and as a foothold into developer machines. Pin dependencies, vet package provenance, and monitor for hijacked publisher accounts.
Sources: The Hacker News · SecurityWeek · ↑ top
Latest developments: Trump abandoned the 20% Strait of Hormuz cargo fee he had announced a day earlier, reimposed a full naval blockade of Iran's ports, and the U.S. military launched a seventh wave of strikes as U.S. crude neared $80 a barrel.
The United States and Iran remain at open war over the Strait of Hormuz, where Iranian forces are firing on oil tankers and the U.S. Navy is blockading Iranian ports; roughly a fifth of the world's oil moves through the strait, so each escalation lifts global crude prices and tightens fuel supply.
Sources: FT World · WSJ World News · ↑ top
Tonight: Mostly Clear, low 73F.
Wednesday: Sunny, high 96F.
Wednesday Night: Partly Cloudy then Haze, low 75F.
Latest developments: Arnold Palmer Regional Airport officials got no firm answers July 14 on when Transportation Security Administration screeners might return, and the absence of agents sparked a heated exchange at the airport authority meeting.
Arnold Palmer Regional Airport in Westmoreland County, outside Latrobe, has been operating without TSA screeners, a gap that clouds the future of commercial passenger service there.
Latest developments: A proposal for 23 new townhouses, before Pittsburgh's Planning Commission on July 14, adds to a wave of residential construction remaking the Strip District.
The Strip District, once a wholesale-produce and warehouse corridor along the Allegheny River northeast of Downtown Pittsburgh, is filling with new housing as developers convert its industrial blocks into townhomes and apartments.
Sources: Pittsburgh Post-Gazette · ↑ top
Latest developments: Allegheny County Executive Sara Innamorato announced July 14 that she is pregnant with her first child, a son, and renewed her push for a paid parental leave policy for county employees.
Sara Innamorato, in her third quarterly address of the year, said she will be the first Allegheny County executive to give birth in office and wants to offer paid parental leave to county workers as she does.
Sources: Pittsburgh Post-Gazette · WTAE · ↑ top
Latest developments: Pittsburgh Regional Transit's University Line construction shifts traffic on Fifth Avenue starting Wednesday, July 15, and on Forbes Avenue starting Thursday, July 16, forcing drivers through Oakland to change routes.
PRT is building the University Line, a bus-rapid-transit corridor serving Oakland and Downtown; the latest phase reroutes traffic along Fifth and Forbes avenues through the university district.
Latest developments: The Allegheny County Health Department said July 14 that 11 people have confirmed cyclosporiasis and is working with state and federal partners to find the source amid a multistate CDC outbreak spanning 31 states.
Cyclospora is a parasite spread through contaminated food or water, not from person to person; it causes weeks of watery diarrhea, and Pennsylvania is among the states the CDC is tracking in the current outbreak.
Latest developments: Pittsburgh crews are setting up for Picklesburgh 2026, and a 'Taste of Picklesburgh' preview is showcasing what vendors will serve.
Picklesburgh is Pittsburgh's annual downtown street festival built around pickles and local food vendors; preparations for the 2026 edition are underway.
Latest developments: ScareHouse and the Plaza at North Shore announced Halloween Hangout, a new fall destination pairing daytime family activities with late-night scares on Pittsburgh's North Shore.
ScareHouse, Pittsburgh's long-running haunted attraction, is teaming with the Plaza at North Shore to open Halloween Hangout this fall, adding a Halloween-season venue on the North Shore.
Pirates (50-47)
Up Next · Pirates @ Guardians · Fri Jul 17, 7:10 PM
Latest developments: The Post-Gazette reported July 14 that commissioner Rob Manfred and MLBPA lead negotiator Bruce Meyer keep sparring over a salary cap, with a wide gulf still between the sides.
Major League Baseball's owners are pushing for a salary cap, and the players' union under Bruce Meyer is resisting one, a fight that could bring a lockout when the labor deal expires and that shapes how much a small-market club like the Pirates can spend.
Sources: Post-Gazette Pirates · ↑ top
Latest developments: In his July 14 live chat, Post-Gazette beat writer Ray Fittipaldo fielded reader questions on quarterback Aaron Rodgers, coach Mike McCarthy, and the approach of NFL training camp.
Ray Fittipaldo covers the Steelers for the Post-Gazette and holds regular live chats; the July 14 session centered on how Aaron Rodgers and Mike McCarthy fit together heading into the 2026 season.
Sources: Post-Gazette Steelers · ↑ top
Latest developments: Suni Lee announced on Instagram July 14 that she is returning to gymnastics and will chase a third Olympics at the 2028 Los Angeles Games.
Suni Lee, the American gymnast who won the all-around gold at the Tokyo Olympics, is coming back to the sport roughly two years before the Los Angeles 2028 Games open.
Sources: ESPN Olympics · ↑ top
Latest developments: U.S. goalkeeper Matt Freese said the criticism after the Americans' 4-1 round-of-16 loss to Belgium 'hurts my heart.'
Matt Freese started in goal for the U.S. men's national team at the home World Cup and spoke out about the fan and media backlash that followed the round-of-16 elimination.
Sources: ESPN Soccer · ↑ top
Latest developments: An ESPN analysis pushed back on the rush to overhaul U.S. youth soccer, arguing the men's team may be progressing and that bad luck, more than a broken pipeline, drove the World Cup exit.
After the U.S. men's national team crashed out of its home World Cup in the round of 16, ESPN questioned the popular calls to rebuild American youth development from scratch.
Sources: ESPN Soccer · ↑ top
S&P 500 7,532.13 ▲ +0.4% Dow 52,495.94 ▼ -0.4% Nasdaq 26,067.87 ▲ +0.2% WTI crude 73.12 ▲ +5.6% EUR/USD 1.1410 ▼ -0.1% GBP/USD 1.3379 ▲ +0.4% USD/JPY 162.31 ▲ +0.2%