daily plain-text briefing: security, markets, business, and pittsburgh
Researchers reconstructed FortiBleed's fully automated pipeline that scraped 110 million credentials, while OAuth tokens pilfered in the Klue breach surfaced inside LastPass.
Latest developments: Analysts at ZenoX and CloudSEK rebuilt the campaign's full automated pipeline from a server the operators left exposed, detailing how the custom sniffer harvests and validates authentication secrets on compromised firewalls.
A Russian initial access broker runs custom Golang sniffers on compromised FortiGate firewalls, capturing more than 110 million credentials since February 2026 across 430,000 devices. Organizations running FortiGate should rotate credentials, hunt for the sniffer, and harden management interfaces.
Sources: Help Net Security · Dark Reading · SecurityWeek · BleepingComputer · ↑ top
Latest developments: London Hydro, Xsolis, and Tata Electronics each disclosed intrusions today, with Xsolis exposing protected health data on 1.4 million people and Tata's leak including documents allegedly tied to Apple and Tesla.
Ontario utility London Hydro lost customer names, addresses, and account information; healthcare analytics firm Xsolis exposed personal and protected health data on 1.4 million individuals; and India's Tata Electronics confirmed a cyberattack a crime group used to post confidential files. Affected customers should watch for phishing and identity fraud.
Sources: SecurityWeek · SecurityWeek · The Record · ↑ top
Latest developments: A Cornell Tech study found that as few as 13 words in a Reddit comment can skew the cited reports of deep-research agents, and Microsoft published defenses for threat actors who poison the memory assistants carry between sessions.
Attackers now target the AI layer itself, planting tiny snippets of user-generated text to manipulate search agents and corrupting persistent assistant memory. Teams deploying agentic AI should validate sources, constrain memory writes, and monitor for poisoned context.
Sources: Help Net Security · Microsoft Security Blog · ↑ top
Latest developments: LastPass confirmed attackers reached its Salesforce environment and accessed customer data using OAuth tokens stolen in this month's Klue supply-chain attack, adding the password manager to the growing victim list.
The Klue compromise stole OAuth tokens that bridged into customers' Salesforce tenants, and the cascade has now reached LastPass. Firms linked to Klue should revoke tokens, audit Salesforce access logs, and watch for follow-on extortion.
Sources: BleepingComputer · ↑ top
Latest developments: President Trump signed an executive order requiring federal agencies to move high-value assets to post-quantum cryptography by the end of 2030 and high-impact systems by the end of 2031.
The order sets firm federal deadlines to adopt encryption resistant to future quantum computers capable of breaking today's algorithms. Agencies and their contractors must inventory cryptographic assets and plan the migration now.
Sources: SecurityWeek · ↑ top
Latest developments: Researchers at Calif.io disclosed Squidbleed, tracing a heap over-read to a 1997 FTP-parsing change that has lived in the Squid web proxy for 29 years and still ships in its default configuration.
Squidbleed leaks another user's cleartext HTTP request—credentials and session tokens included—to anyone allowed to send traffic through the same Squid proxy. Administrators running Squid should patch immediately, since the flaw is live by default.
Sources: The Hacker News · ↑ top
Latest developments: The rout entered another session led by chipmakers, dropping the Nasdaq 2.2% as Nvidia fell on bets the Federal Reserve will raise rates and gold sank toward $4,000 an ounce, its lowest since November.
A widening selloff in technology stocks, fueled by jitters over AI companies' heavy spending and looming Federal Reserve rate increases, pulled the Nasdaq lower and dragged Asian and European markets down, with SpaceX shares tumbling after their blockbuster market debut.
Sources: WSJ · FT · FT · ↑ top
Latest developments: President Trump agreed to release $6 billion in frozen Iranian funds held in Qatar to buy US medical supplies and crops, Vice President JD Vance returned from talks reporting a successful foundation to fully reopen the Strait of Hormuz, and Iran's president flew to Pakistan to help finalize a permanent accord.
Washington and Tehran are negotiating an end to their war, with the United States waiving sanctions on Iranian oil and clearing the Strait of Hormuz to reopen, moves that sent oil futures lower as more crude returns to the market.
Sources: FT · FT · WSJ · ↑ top
This Afternoon: Sunny, high 79F.
Tonight: Mostly Clear, low 55F.
Wednesday: Sunny, high 81F.
Latest developments: Kraft Heinz announced a reorganization into three global regions, the latest step in Chief Executive Cahillane's six-month revival that earlier paused the company's planned breakup.
Kraft Heinz, the food conglomerate co-headquartered in Pittsburgh, is restructuring its operations into three global regions after shelving the corporate separation it had planned for this year.
Latest developments: Allegheny General Hospital completed a $19 million expansion and renovation of its cardiac labs.
The North Side hospital's project enlarges the Mario Lemieux Center for Heart Rhythm Care within Allegheny Health Network's Allegheny General, adding space for electrophysiology and heart-rhythm treatment.
Latest developments: Pittsburgh-area gas prices began falling this week, though slower than elsewhere in Pennsylvania and the country.
GasBuddy petroleum analyst Patrick De Haan credits the United States-Iran agreement for easing prices, saying the local drop lags what drivers in other parts of the state are seeing.
Latest developments: The Calvin Anderson Schoolhouse Apartments at St. Coleman opened Monday in Turtle Creek.
Developers converted the historic St. Coleman school into 24 two-bedroom affordable apartments for young adults aging out of foster care, a new affordable-housing community in the Allegheny County borough.
Latest developments: A Post-Gazette report found Pennsylvania's bipartisan election board languishing because Governor Josh Shapiro has not appointed new members.
The vacancies leave the panel that helps oversee election administration unable to function as the state heads toward another election cycle.
Sources: Pittsburgh Post-Gazette · ↑ top
Latest developments: President Trump traveled Tuesday to a Mack Trucks facility in a Pennsylvania battleground district, his fifth visit to the state in his second term.
The stop at the truck maker continues the administration's courtship of Pennsylvania industrial workers in a swing region.
Latest developments: Organizers set the America250PA concert for Saturday, June 27, and Point State Park downtown will close temporarily to stage it.
Rapper Nelly and the band Third Eye Blind headline the free America250PA concert at Point State Park downtown on Saturday, June 27, under the theme "Celebrating Educators and Innovators," part of a statewide series of free shows.
Sources: Pittsburgh Magazine · WPXI · ↑ top
Latest developments: The Andy Warhol Bridge marks its 100th anniversary this weekend with a centennial celebration.
The yellow span over the Allegheny River, linking downtown Pittsburgh to the North Shore, reaches its centennial, and the city is throwing a birthday bash to mark it.
Latest developments: The Pittsburgh Symphony Orchestra laid out a summer series built around film scores.
The orchestra is devoting its summer programming to movie music, performing scores from the screen for Pittsburgh audiences.
Sources: Pittsburgh Post-Gazette · ↑ top
Pirates (39-39)
Up Next · Mariners @ Pirates · Tue Jun 23, 6:40 PM
Latest developments: A June 22 Post-Gazette podcast weighed how much more DK Metcalf can give the Steelers in his second season with the team.
The discussion gauged the ceiling for receiver DK Metcalf as he enters a full second year in Pittsburgh's offense.
Sources: Post-Gazette Steelers · ↑ top
Latest developments: The Post-Gazette's MiLB Monday highlighted Pirates prospect Connor Wietgrefe's scoreless streak at Double-A Altoona.
The pitcher is turning heads in the Pirates' minor-league system with a run of scoreless outings for the Altoona Curve.
Sources: Post-Gazette Pirates · ↑ top
Latest developments: Having clinched a knockout spot by topping Group D, the United States men's national team debates whether to rotate its lineup for Thursday's group finale against Türkiye, with Christian Pulisic back in full training.
Coach Mauricio Pochettino's side, riding good vibes as World Cup co-host, must decide between resting starters and keeping its winning eleven, while Pulisic has recovered from the left calf injury that sidelined him since June 11.
S&P 500 7,491.82 ▲ +1.6% Dow 51,688.13 ▲ +1.9% Nasdaq 26,353.29 ▲ +2.6% WTI crude 77.00 ▼ -12.9% EUR/USD 1.1527 ▼ -0.3% GBP/USD 1.3311 ▼ -0.6% USD/JPY 160.79 ▲ +0.3%