================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Monday, June 29, 2026 - 6:05 AM EDT ================================================================ OpenAI's GPT-5.6 Sol pushes the offensive-AI frontier as Washington puts a $10 million bounty on Russia's messaging-app hackers and attackers poison npm, Go, and Edge supply chains. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] OpenAI's GPT-5.6 Sol debuts as its most advanced cybersecurity model even as Ben Thompson's Figma interview and Zitron's AI bubble notes counsel skepticism toward the AI rush. see: OpenAI Ships GPT-5.6 Sol Cybersecurity AI; An Interview with Figma CEO Dylan Field About Design and AI; Premium: Notes From The Bubble, Volume 1 * [TREND] Attackers weaponized developer tooling as JFrog flagged hijacked npm and Go packages dropping a Python infostealer while Microsoft pulled 119 StegoAd Edge extensions. see: Hijacked npm and Go Packages Deploy Python Infostealer; Microsoft Pulls 119 StegoAd Edge Extensions * [UPDATE (new)] The U.S. posted a $10 million bounty for the Russian state crews UNC5792 and UNC4221 behind phishing that has pivoted onto secure messaging apps. see: US Posts $10 Million Bounty for Russian Messaging-App Hackers * [UPDATE (new)] A public proof-of-concept dropped for the critical libssh2 client flaw CVE-2026-55200, while KDDI disclosed a breach exposing 14.2 million email logins across six Japanese ISPs. see: libssh2 Client Flaw Gets Public Exploit; KDDI Breach Exposes 14.2 Million ISP Email Logins * [UPDATE (new)] Locally, PennDOT closed Commercial Street for a bridge slide, Duquesne City Schools faced a state-ordered merger, and a third bison calf named Nova arrived at South Park. see: Commercial Street Closes for Bridge Slide; Duquesne City Schools Face Merger; Third Bison Calf Born at South Park SECURITY ---------------------------------------------------------------- 1. OPENAI SHIPS GPT-5.6 SOL CYBERSECURITY AI AI Security · [ai, llm] Latest developments: OpenAI on June 29 opened a limited preview of its GPT-5.6 series—Sol as flagship, Terra balanced, Luna fastest—calling Sol its most advanced cybersecurity model, matching Mythos Preview on benchmarks while spending a third of the output tokens, and coordinating the rollout with the U.S. government before reaching ChatGPT, Codex, and API users. OpenAI advances its cyber-capable model line months after GPT-5.5-Cyber and the Patch the Planet effort, escalating the capability race against Anthropic's Mythos. Defenders gain stronger tooling; the same models lower the bar for attackers. - SecurityWeek: https://www.securityweek.com/openai-unveils-gpt-5-6-sol-as-its-most-advanced-cybersecurity-ai/ - Help Net Security: https://www.helpnetsecurity.com/2026/06/29/openai-gpt-5-6-models-preview/ 2. US POSTS $10 MILLION BOUNTY FOR RUSSIAN MESSAGING-APP HACKERS Nation-State Activity · [apt, nation-state, phishing] Latest developments: The United States on June 29 offered a $10 million bounty for information on UNC5792 and UNC4221, naming the two Russian state crews behind the evolving secure-messaging phishing that earlier disclosures had tracked anonymously. UNC5792 and UNC4221 phish U.S. government officials, military leaders, and allied personnel by hijacking secure messaging apps such as Signal. The bounty seeks information to identify and locate the operators; targets should reject unsolicited device-linking and tech-support prompts. - SecurityWeek: https://www.securityweek.com/us-offers-10-million-bounty-for-russian-state-hackers-as-messaging-app-attacks-evolve/ 3. HIJACKED NPM AND GO PACKAGES DEPLOY PYTHON INFOSTEALER Vulnerabilities and Exploits · [supply-chain, infostealer] Latest developments: JFrog disclosed on June 29 two hijacked npm packages and a cluster of Go packages that abuse Visual Studio Code tasks—sidestepping npm lifecycle scripts and npm v12's security hardening—to drop a Python information stealer on Windows, Linux, and macOS hosts. Attackers compromised legitimate open-source packages to plant cross-platform credential theft inside developer environments. Teams should pin dependency versions, audit recently updated npm and Go packages, and inspect VS Code task definitions. - The Hacker News: https://thehackernews.com/2026/06/hijacked-npm-and-go-packages-use-vs.html 4. LIBSSH2 CLIENT FLAW GETS PUBLIC EXPLOIT Vulnerabilities and Exploits · [vulnerability, patch, rce] Latest developments: A public proof-of-concept landed June 29 for CVE-2026-55200, a critical libssh2 flaw rated CVSS 9.2 that lets a malicious or compromised SSH server corrupt memory on any connecting client—no credentials, no user interaction—across every release through 1.11.1, raising weaponization odds. libssh2 is a widely embedded client-side SSH library, so applications and devices that initiate SSH connections face possible code execution from a hostile server. Operators should upgrade past 1.11.1 once a fix ships and avoid connecting to untrusted servers. - The Hacker News: https://thehackernews.com/2026/06/public-poc-released-for-critical.html 5. MICROSOFT PULLS 119 STEGOAD EDGE EXTENSIONS Ransomware and Cybercrime · [malware, adware, credential-theft] Latest developments: Microsoft on June 29 removed 119 Edge Add-ons extensions tied to a single actor active since at least 2021, an operation it calls StegoAd that hid payloads inside ordinary image and font files, then woke days after install to steal credentials and run ad fraud. The campaign used steganography to slip past store review and lay dormant before activating. Edge users should audit installed extensions, remove unfamiliar ones, and rotate credentials entered while suspect add-ons were present. - The Hacker News: https://thehackernews.com/2026/06/microsoft-removes-119-edge-extensions.html 6. KDDI BREACH EXPOSES 14.2 MILLION ISP EMAIL LOGINS Data Breaches · [breach, credential-theft] Latest developments: KDDI Corporation disclosed that attackers breached one of its email systems shared with five other Japanese internet service providers, exposing up to 14.2 million email logins across the six ISPs. The Japanese telecom operator runs email infrastructure for several smaller providers, so a single intrusion reached subscribers well beyond KDDI's own base. Affected customers should reset email passwords and watch for credential-stuffing and phishing. - BleepingComputer: https://www.bleepingcomputer.com/news/security/data-breach-exposes-up-to-142-million-email-logins-at-six-isps/ BUSINESS AND POLITICS ---------------------------------------------------------------- * U.S.-Iran Truce Holds as Markets Steady Latest developments: Markets reacted June 29—U.S. stock futures rose, oil slipped back from its weekend highs, and gold fell—while Tehran had yet to confirm the halt. Washington said it agreed with Iran late June 28 to stop the tit-for-tat strikes over the Strait of Hormuz and resume talks toward a long-term deal restraining Tehran's nuclear program, ending days of fighting that included Iranian attacks on Bahrain and Kuwait. - FT World: https://www.ft.com/content/a1dc9209-ec77-415c-baae-e3ddab5c0eb1 - WSJ World News: https://www.wsj.com/world/middle-east/iran-asserts-sole-control-of-hormuz-warns-challenges-will-bring-more-violence-5abea3c7 - WSJ Markets: https://www.wsj.com/finance/stocks/u-s-stock-futures-higher-as-u-s-iran-return-to-peace-talks-bbb510a5?mod=rss_markets_main PITTSBURGH ---------------------------------------------------------------- Weather: Today: Areas Of Fog then Mostly Sunny, high 90F. Tonight: Partly Cloudy, low 71F. Tuesday: Mostly Sunny, high 94F. Business: * Western Pa. Luxury Home Sales Set Records Latest developments: The Post-Gazette reported June 29 that sales of homes priced above $1 million are breaking records across western Pennsylvania this year. A buying frenzy has pushed million-dollar home sales to record levels across the Pittsburgh region, the Post-Gazette found. - Pittsburgh Post-Gazette: https://www.post-gazette.com/business/money/2026/06/29/luxury-homes-pittsburgh-breaking-records/stories/202606280049 * Pittsburgh Weighs Its Robotics Future Latest developments: A PublicSource analysis published June 29 warned that Pittsburgh needs new business-building infrastructure to extend its robotics success through 2076. Oakland-born robotics has turned sites from the North Shore to Hazelwood Green into Pittsburgh tech hubs, and PublicSource reports that sustaining that momentum over the next 50 years will demand fresh investment in turning research into companies. - PublicSource: https://www.publicsource.org/robotics-tech-hub-future-pittsurgh-250/ * PNC Sees Consumer Spending Cooling Latest developments: PNC chief economist Gus Faucher wrote June 29 that growth in consumer spending will slow in the near term. In his Post-Gazette "Economist's View" column, PNC Financial Services Group chief economist Gus Faucher forecast a near-term cooling in U.S. consumer spending growth. - Pittsburgh Post-Gazette: https://www.post-gazette.com/business/money/2026/06/29/economists-view-consumer-spending-pnc-gus-faucher/stories/202606280050 Around town: * Commercial Street Closes for Bridge Slide Latest developments: PennDOT began the next phase June 29, closing Commercial Street along with parts of Forward Avenue and the Nine Mile Run Trail. PennDOT closed Commercial Street under the Parkway East near the Squirrel Hill Tunnel, plus sections of Forward Avenue and the Nine Mile Run Trail, to advance its sliding replacement of the Commercial Street Bridge ahead of an upcoming Parkway East closure. - KDKA: https://www.cbsnews.com/pittsburgh/news/commercial-street-thursday-penndot-parkway-east-bridge-testing/ * Duquesne City Schools Face Merger Latest developments: PublicSource reported June 29 that the financially struggling Duquesne City School District will be consolidated, with state officials deciding by June 30. Pennsylvania officials will rule by June 30 on merging the Duquesne City School District, long troubled financially and trailing academically, with a neighboring district. - PublicSource: https://www.publicsource.org/duquesne-city-school-district-possible-merger/ * Third Bison Calf Born at South Park Latest developments: The Friends of the South Park Buffalo Preserve announced June 28 the birth of Nova, the preserve's third bison calf of 2026. At the South Park Game Preserve in Allegheny County, a five-year-old bison named Crimson, daughter of Violet, gave birth to her first calf, named Nova after a butterfly landed on a grieving member of the watch group during a public feeding. - KDKA: https://www.cbsnews.com/pittsburgh/news/south-park-game-preserve-baby-bison-nova/ Events: * Polar World Closes at Carnegie Museum Latest developments: The Post-Gazette reported June 27 that the Carnegie Museum of Natural History is retiring its Polar World exhibit after 43 years. Polar World, a fixture of the Carnegie Museum of Natural History in Oakland for 43 years, is closing, giving visitors a last chance to see the long-running exhibit. - Post-Gazette Arts & Entertainment: https://www.post-gazette.com/ae/art-architecture/2026/06/27/polar-world-carnegie-museum-of-natural-history-closure/stories/202606280064 * Pittsburgh Summer Food Festivals Guide Latest developments: NEXTpittsburgh published a calendar of 16 Pittsburgh summer food festivals to plan around. NEXTpittsburgh rounded up 16 summer food festivals across Pittsburgh featuring ethnic menus, barbecue, ice cream, and pickles, billing this year's slate as the biggest yet. - NEXTpittsburgh Events: https://nextpittsburgh.com/eatdrink/14-pittsburgh-summer-food-festivals-to-satisfy-your-every-craving/ SPORTS ---------------------------------------------------------------- Pirates (42-42) Sun Jun 28 · Reds 4 · Pirates 9 · Final Ryan O'Hearn homers twice, helps Pirates avoid sweep with 9-4 win over Reds https://plaintextsports.com/mlb/2026-06-28/cin-pit Up Next · Pirates @ Phillies · Mon Jun 29, 6:40 PM https://plaintextsports.com/mlb/2026-06-29/pit-phi Around the Teams: * Hiles: Pirates Should Look Inside for Bullpen Help Latest developments: In his June 29 Post-Gazette column, Noah Hiles argued in-house arms can aid the Pirates' bullpen more than any trade-deadline deal. Post-Gazette columnist Noah Hiles wrote that relievers already on hand, such as Dennis Santana and Isaac Mattson, offer the Pirates more realistic bullpen help than a move at the trade deadline. - Post-Gazette Pirates: https://www.post-gazette.com/sports/columns/2026/06/29/mlb-pirates-dennis-santana-isaac-mattson/stories/202606280071 Team USA: * Outsiders Tip USMNT for Deep World Cup Run Latest developments: ESPN assembled a panel of coaches and analysts June 29 to weigh whether the United States can become the surprise package of the 2026 World Cup. After a strong group stage as co-hosts, the U.S. men's national team has drawn belief from outside coaches and analysts that it can make a deep run, ESPN reported, ahead of its round-of-32 meeting with Bosnia and Herzegovina on July 1. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49213271/why-outsiders-believe-usmnt-make-deep-world-cup-run READING ---------------------------------------------------------------- * Cal Newport -- Beware of Productivity Paradoxes Newport argues that technologies seemingly destined to boost output, the personal computer chief among them, often fail to deliver the gains expected, and he urges skepticism toward any tool billed as a productivity slam dunk. https://calnewport.com/beware-of-productivity-paradoxes/ * Stratechery -- An Interview with Figma CEO Dylan Field About Design and AI Ben Thompson interviews Figma chief executive Dylan Field on how he built the company and why he believes AI gives Figma a tailwind in design software. https://stratechery.com/2026/an-interview-with-figma-ceo-dylan-field-about-design-and-ai/ * Ed Zitron -- Premium: Notes From The Bubble, Volume 1 Zitron launches an ongoing series of running observations on what he sees as the overheated AI and tech investment bubble. https://www.wheresyoured.at/premium-notes-from-the-bubble-volume-1/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,381.60 ▼ -1.4% Dow 51,805.04 ▲ +0.4% Nasdaq 25,577.30 ▼ -2.7% WTI crude 71.90 ▼ -9.0% EUR/USD 1.1397 ▼ -1.4% GBP/USD 1.3202 ▼ -1.2% USD/JPY 161.63 ▲ +0.7% ================================================================ Generated 2026-06-29 06:05 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================