================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Saturday, June 27, 2026 - 12:06 PM EDT ================================================================ The FBI and CISA warned that Russian intelligence now phishes Signal Backup Recovery Keys to reopen victims' entire message histories, while attackers increasingly turn AI coding agents and fake OpenAI tenants into weapons. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Attackers keep weaponizing AI, driving coding agents to run hidden malware from clean GitHub repositories while Cisco buys Astrix and WideField to make non-human identity its control plane. see: AI Coding Agents Tricked Into Running Malware; Cisco Buys Astrix and WideField for Non-Human Identity * [UPDATE (new)] The FBI and CISA updated their warning that Russian intelligence now phishes Signal users into surrendering Backup Recovery Keys that reopen entire message histories. see: Russian Hackers Steal Signal Backup Recovery Keys * [UPDATE (new)] CISA gave federal agencies until June 28 to patch CVE-2026-20230, a server-side request forgery flaw in Cisco Unified Communications Manager now exploited in the wild. see: Cisco Unified CM Flaw Under Active Exploitation * [TREND] A new Open Source Sustainability Initiative tackles end-of-life components as third-party failures ripple out, from the Pentagon's Dialog data exposure to a cyberattack that froze insurance risk ratings. see: Initiative Targets End-of-Life Open Source Risk; Pentagon Probes Dialog Data Exposure; Insurance Rulemaker Suspends Risk Ratings After Cyberattack * [TREND] Commentators question AI's foundations, with Zitron calling the industry cargo-cult imitation, Newport decrying doom trolling, and Figma's Dylan Field framing AI as a design tailwind. see: Cargo Culture; Dear AI Companies: Stop the "Doom Trolling"; An Interview with Figma CEO Dylan Field About Design and AI * [TREND] Pittsburgh's summer ramps up as the South Side street fest adds metal detectors for its second weekend and Starfire preps the Fourth of July fireworks. see: South Side Street Fest Adds Security for Second Weekend; Starfire Powers Pittsburgh's July 4 Fireworks SECURITY ---------------------------------------------------------------- 1. AI CODING AGENTS TRICKED INTO RUNNING MALWARE AI Security · [ai, supply-chain, phishing] Latest developments: BleepingComputer reported on June 27 that a benign-looking GitHub repository can drive an agentic coding tool to execute a hidden payload that stays invisible to security scanners, the AI agent, and human reviewers, while separately threat actors spun up fraudulent OpenAI tenants impersonating real companies to lure employees into leaking sensitive data in chats and projects. As developers hand setup and research tasks to autonomous AI assistants, attackers weaponize the tools' trust, planting executable traps in repositories and faking OpenAI organization invites; teams should treat agent-run code and unsolicited tenant invites as untrusted. - BleepingComputer: https://www.bleepingcomputer.com/news/security/clean-github-repo-tricks-ai-coding-agents-into-running-malware/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/cybersecurity-firms-targeted-by-fraudulent-openai-organization-invites/ 2. RUSSIAN HACKERS STEAL SIGNAL BACKUP RECOVERY KEYS Nation-State Activity · [apt, phishing, nation-state] Latest developments: The FBI and CISA updated their March 2026 warning on June 26, revealing the Russian intelligence phishing campaign now coaxes Signal users into surrendering their Backup Recovery Key, which lets attackers restore the account's backup, read its full private and group history, and keep that access even after the victim notices. Operators tied to Russian intelligence services run targeted phishing against Signal accounts; once a victim hands over the recovery key it keeps working, so the FBI and CISA urge users to rotate keys and verify linked devices. - BleepingComputer: https://www.bleepingcomputer.com/news/security/fbi-russian-hackers-now-target-signal-backup-recovery-keys/ - The Hacker News: https://thehackernews.com/2026/06/fbi-warns-russian-intelligence-hackers.html 3. CISCO BUYS ASTRIX AND WIDEFIELD FOR NON-HUMAN IDENTITY AI Security · [identity, ai] Latest developments: Dark Reading reported that Cisco acquired Astrix and WideField to fold non-human identity into its security stack, betting that securing the agentic workforce means making identity the primary control plane. As autonomous agents and machine identities multiply, Cisco joins the vendors treating non-human identity as the core control; the Astrix and WideField deals aim to govern and secure those credentials. - Dark Reading: https://www.darkreading.com/identity-access-management-security/cisco-adds-nhi-security-stack-with-astrix-widefield 4. CISCO UNIFIED CM FLAW UNDER ACTIVE EXPLOITATION Vulnerabilities and Exploits · [patch, exploit, vulnerability] Latest developments: CISA on June 26 gave federal agencies until Sunday, June 28, to patch CVE-2026-20230, the server-side request forgery flaw in Cisco Unified Communications Manager that attackers are now exploiting in the wild. CVE-2026-20230 is a high-severity SSRF bug in Cisco's enterprise call-management server; with active exploitation and a binding CISA deadline, administrators should apply Cisco's fix immediately. - BleepingComputer: https://www.bleepingcomputer.com/news/security/cisa-sets-urgent-deadline-to-fix-cisco-flaw-exploited-in-attacks/ 5. PENTAGON PROBES DIALOG DATA EXPOSURE Data Breaches · [breach, exposure] Latest developments: Wired reported on June 26 that the Pentagon is investigating a Dialog data exposure whose leaked records unmasked a senior White House intelligence official and an active-duty special operations officer. Exposed records from the private Dialog group included personal information on national security personnel; the Defense Department is examining how the leak could unmask officials who depend on protected identities. - Wired Security: https://www.wired.com/story/the-pentagon-is-looking-into-the-dialog-data-exposure-for-unmasking-national-security-officials/ 6. INITIATIVE TARGETS END-OF-LIFE OPEN SOURCE RISK Application Security · [open-source, supply-chain] Latest developments: Dark Reading detailed the new Open Source Sustainability Initiative, whose goal is to help enterprises manage and secure aging, end-of-life open source projects while staying compliant with regulations. Abandoned open source components keep running deep inside enterprise software; the Open Source Sustainability Initiative aims to give companies a way to track and secure those aging dependencies. - Dark Reading: https://www.darkreading.com/application-security/initiative-tackles-security-end-of-life-open-source BUSINESS AND POLITICS ---------------------------------------------------------------- * Insurance Rulemaker Suspends Risk Ratings After Cyberattack Latest developments: The National Association of Insurance Commissioners suspended its investment risk designations on June 27 after a cyberattack disabled the system. The National Association of Insurance Commissioners assigns the risk ratings that decide how much capital U.S. life and property insurers must hold against their bond and asset portfolios; the suspension leaves carriers and their regulators without that benchmark while the association investigates the intrusion. - FT World: https://www.ft.com/content/1b397558-117e-463b-914d-9a62e4484605 PITTSBURGH ---------------------------------------------------------------- Weather: This Afternoon: Showers And Thunderstorms, high 79F. Tonight: Showers And Thunderstorms Likely then Patchy Fog, low 66F. Sunday: Partly Sunny then Chance Showers And Thunderstorms, high 85F. Business: * Highmark Wholecare Hands Out Free Produce Latest developments: Highmark Wholecare gave away 8,000 pounds of produce at a free farmers market June 27, with the next event set for July 8. Highmark Wholecare distributed 8,000 pounds of produce to families at a free farmers market and will hold the next one July 8 from noon to 3 p.m. at Duquesne City School, part of a summer series across the region. - WPXI: https://www.wpxi.com/news/local/highmark-wholecare-gives-out-8000-pounds-produce-families-free-farmers-market/3ER236BIRFAMZJ7H5SOJ6PKWWM/ * SanaView Farms Winery Draws Visitors to Laurel Highlands Latest developments: TribLive profiled SanaView Farms Winery & Cafe on June 27 as word of its all-natural wines spreads. SanaView Farms Winery & Cafe, a rural farm operation in the Laurel Highlands, pours all-natural wines and serves Italian fare, drawing visitors such as Tom and Evonne Cunningham who sought out the buzz. - TribLive: https://triblive.com/local/westmoreland/sanaview-farms-winery-cafe-boasts-natural-wines-italian-fare/ Around town: * Lawsuit Says Trump Title X Rule Threatens Pa. Family Planning Latest developments: A suit against the U.S. Department of Health and Human Services, reported June 27, says a new Title X application step could delay or deny funding for tens of thousands of Pennsylvanians. The Family Health Council of Central Pennsylvania, based in Cumberland County, joined a lawsuit alleging that a step the Department of Health and Human Services added to Title X grant applications this year jeopardizes federally funded reproductive and family-planning care for about 160,000 Pennsylvania patients. - KDKA: https://www.cbsnews.com/pittsburgh/news/trump-admin-rule-puts-reproductive-health-care-for-160k-pa-patients-at-risk-lawsuit-says/ * South Side Street Fest Adds Security for Second Weekend Latest developments: Organizers added metal detectors, ID scanners, and a separate locals' line for the festival's second weekend after long lines marred opening night. The South Side Street Fest returned for a second weekend with extra metal detectors, ID scanners, and a dedicated line for locals to speed entry; an organizer said Saturday's larger crowds would be the real test of the changes. - KDKA: https://www.cbsnews.com/pittsburgh/news/south-side-street-fest-information-second-weekend/ Events: * Noah Kahan, Benson Boone, Dave Matthews Lead July Concerts Latest developments: TribLive's July concert preview, published June 27, leads with a sold-out Noah Kahan show at PNC Park. Pittsburgh's July concert calendar features a sold-out Noah Kahan date at PNC Park, a near-capacity arena show by Benson Boone, and the return of summer staple Dave Matthews Band. - TribLive: https://triblive.com/aande/music/top-july-concerts-for-pittsburgh-noah-kahan-benson-boone-dave-matthews-band/ * Starfire Powers Pittsburgh's July 4 Fireworks Latest developments: The Post-Gazette detailed June 27 how Cambria County's Starfire will stage Pittsburgh's Fourth of July fireworks. Pittsburgh's July 4 fireworks come from Starfire, a Cambria County pyrotechnics company the Post-Gazette profiled for the artistry behind the city's self-described 'very noisy' Independence Day show. - Pittsburgh Post-Gazette: https://www.post-gazette.com/local/city/2026/06/27/fireworks-fourth-of-july-starfire/stories/202606260049 SPORTS ---------------------------------------------------------------- Pirates (41-41) Fri Jun 26 · Reds 6 · Pirates 4 · Final Marte's tiebreaking homer in 8th after 4-run inning against Skenes helps Reds beat Pirates 6-4 https://plaintextsports.com/mlb/2026-06-26/cin-pit Up Next · Reds @ Pirates · Sat Jun 27, 4:05 PM https://plaintextsports.com/mlb/2026-06-27/cin-pit Around the Teams: * Pirates Activate Konnor Griffin From the IL Latest developments: The Pirates activated top prospect Konnor Griffin from the injured list June 26, days after his rehab work at Double-A Altoona. The Pittsburgh Pirates brought infield prospect Konnor Griffin back from the injured list, adding reinforcements to a roster thinned by injuries; he homered leading off in his return, the Post-Gazette reported. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/06/26/konnor-griffin-injury-il-activate-brannigan/stories/202606260067 * Pirates Prospects Enter Baseball's Labor Fight Latest developments: A Post-Gazette 'Off The Bat' column June 27 argued the players' union can cite Konnor Griffin and Endy Rodriguez in collective-bargaining disputes. The Post-Gazette's 'Off The Bat' contends the Major League Baseball Players Association can point to the Pirates' handling of Konnor Griffin, Endy Rodriguez, and ace Paul Skenes as evidence in service-time and pay fights heading into the next collective bargaining agreement. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/06/27/mlb-labor-situation-endy-rodriguez-konnor-griffin-paul-skenes/stories/202606270013 * Eric Ebron Talks Retirement on 'Not Just Football' Latest developments: On Cam Heyward's 'Not Just Football,' former Steelers tight end Eric Ebron discussed retiring at 28 and the 2020 11-0 Steelers team. Former tight end Eric Ebron joined Cam Heyward's 'Not Just Football' podcast to walk through his NFL run across Detroit, Indianapolis, and Pittsburgh, his retirement at 28, and Bill Belichick's move to coach North Carolina. - Not Just Football with Cam Heyward: https://www.youtube.com/watch?v=KgmEBua4Rog Team USA: * U.S. Eyes a Knockout Path Through Europe's Best Latest developments: With the group stage closing June 27, analysts mapped a U.S. title path that could require beating Spain, France, and England. Mauricio Pochettino's United States won Group D and enters the round of 32 as a World Cup co-host; the Guardian projected that a run to the title could pit the Americans against Spain, France, and England, three of the tournament's strongest sides. - Guardian World Cup 2026: https://www.theguardian.com/football/2026/jun/27/usa-bracket-world-cup-path-to-final * Ranch Dressing Becomes a U.S. World Cup Calling Card Latest developments: ESPN documented June 27 how visiting fans embraced Weston McKennie's love of ranch dressing as a U.S. World Cup motif. American midfielder Weston McKennie's fondness for ranch dressing, once mocked, has spread among international visitors at the U.S.-hosted World Cup, turning the condiment into a viral emblem of the home side. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49190854/world-cup-fans-vindicate-usmnt-weston-mckennie-love-ranch-american-dressing READING ---------------------------------------------------------------- * Ed Zitron -- Cargo Culture Zitron argues that much of today's AI industry runs on cargo-cult imitation, copying the rituals and rhetoric of past tech successes without the underlying economics to sustain the spending. https://www.wheresyoured.at/cargo-culture/ * Stratechery -- An Interview with Figma CEO Dylan Field About Design and AI Ben Thompson interviews Figma chief executive Dylan Field on building the company and why Field sees AI as a tailwind for design software rather than a threat. https://stratechery.com/2026/an-interview-with-figma-ceo-dylan-field-about-design-and-ai/ * Cal Newport -- Dear AI Companies: Stop the "Doom Trolling" Newport argues AI companies erode trust by loudly warning that their own products are dangerously powerful, likening the tactic to a carmaker fear-mongering about its own trucks to sell them. https://calnewport.com/dear-ai-companies-stop-the-doom-trolling/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,381.60 ▼ -1.4% Dow 51,805.04 ▲ +0.4% Nasdaq 25,577.30 ▼ -2.7% WTI crude 71.90 ▼ -9.0% EUR/USD 1.1382 ▼ -1.3% GBP/USD 1.3200 ▼ -0.8% USD/JPY 161.63 ▲ +0.7% ================================================================ Generated 2026-06-27 12:06 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================