================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Monday, June 29, 2026 - 4:05 PM EDT ================================================================ Russian, Chinese, and Iranian state crews press espionage and water-system sabotage as a counterfeit AI browser extension and prompt-injection attacks deepen the AI-era threat to software and infrastructure. CONTENTS: Emerging Trends and Key Updates | Security | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Attackers are working the AI rush from both ends, with a fake Perplexity Chrome extension logging every search while indirect prompt injection turns GitHub repos into reverse shells against Claude Code. see: Fake Perplexity Extension Hijacks Browser Searches; Harmless-Looking Repos Hijack Claude Code * [TREND] Russia, China, and Iran are pressing espionage on every front as Mustang Panda and Gamaredon sharpen tooling against India and Ukraine while the trio probes drinking-water controls. see: Mustang Panda and Gamaredon Sharpen Espionage Tooling; Iran, Russia, and China Probe Water Systems * [UPDATE (new)] The U.S. Supreme Court extended Fourth Amendment protection to cellphone geofence data, requiring police to obtain a warrant before tying individual phones to a location. see: Supreme Court Shields Geofence Location Data * [UPDATE (new)] OpenAI opened a limited preview of its GPT-5.6 Sol, Terra, and Luna models, restricting access to approved customers at the Trump administration's request. see: OpenAI's GPT-5.6 Sol Gated by Trump Review * [TREND] Reading is questioning the hype as Newport revisits the productivity paradox, Zitron likens the boom to cargo culture, and Figma's Dylan Field still frames AI as a tailwind. see: Beware of Productivity Paradoxes; Cargo Culture; An Interview with Figma CEO Dylan Field About Design and AI * [UPDATE (new)] Local business shifted as U.S. Steel committed $475 million to its Alabama tubular plant and cannabis-robotics firm Vape Jet relocated to the Strip District. see: U.S. Steel Expands Alabama Tubular Plant; Vape Jet Moves to the Strip District SECURITY ---------------------------------------------------------------- 1. OPENAI'S GPT-5.6 SOL GATED BY TRUMP REVIEW AI Security · [ai, policy] Latest developments: OpenAI began a limited preview June 29 of its GPT-5.6 series—Sol, Terra, and Luna—coordinating the rollout with the U.S. government and, at the Trump administration's request, restricting the new models to approved customers during a cybersecurity review, with Anthropic imposing the same limits. OpenAI says the flagship Sol matches Anthropic's Mythos Preview on cyber tasks while spending a third of the output tokens; the government-gated release marks the first time Washington has throttled distribution of a frontier security model. - Help Net Security: https://www.helpnetsecurity.com/2026/06/29/openai-gpt-5-6-models-preview/ - SecurityWeek: https://www.securityweek.com/openai-unveils-gpt-5-6-sol-as-its-most-advanced-cybersecurity-ai/ - SecurityWeek: https://www.securityweek.com/openai-and-anthropic-limit-new-ai-models-to-trump-approved-customers-during-cybersecurity-review/ 2. MUSTANG PANDA AND GAMAREDON SHARPEN ESPIONAGE TOOLING Nation-State Activity · [apt, espionage, nation-state] Latest developments: Acronis Threat Research Unit reported June 29 that China-aligned Mustang Panda turned Zoho WorkDrive into a command channel against Indian government and hydropower networks, the same day ESET counted 35 spear-phishing campaigns Russia's FSB-run Gamaredon mounted against Ukraine across 2025 with fresh malware and cloud-service abuse. Mustang Panda compromised machines used by senior Indian administrative staff, while Gamaredon concentrated its bursts in the second half of the year; defenders should watch legitimate cloud services repurposed as covert command channels. - The Hacker News: https://thehackernews.com/2026/06/mustang-panda-uses-zoho-workdrive-as.html - The Hacker News: https://thehackernews.com/2026/06/gamaredon-expands-ukraine-attacks-with.html 3. FAKE PERPLEXITY EXTENSION HIJACKS BROWSER SEARCHES Ransomware and Cybercrime · [browser, infostealer, malware] Latest developments: Microsoft disclosed June 29 a Chromium extension impersonating the Perplexity AI answer engine that logged every search query and every character typed into the address bar, routing them through attacker infrastructure before redirecting users to real results; Google removed it after Microsoft's disclosure. The extension abused Manifest V3 APIs and intermediary servers to spy on Chrome users who installed the AI-branded imposter; users should audit installed extensions and remove any unverified Perplexity clone. - The Hacker News: https://thehackernews.com/2026/06/malicious-perplexity-chrome-extension.html - Microsoft Security Blog: https://www.microsoft.com/en-us/security/blog/2026/06/29/chromium-extension-uses-airelated-branding-redirect-browser-search/ 4. HARMLESS-LOOKING REPOS HIJACK CLAUDE CODE AI Security · [ai, supply-chain, zero-day] Latest developments: Mozilla's Zero Day Investigative Network and a parallel SecurityWeek demonstration showed June 29 that a GitHub repository carrying no malicious code can use indirect prompt injection to make Claude Code spawn a reverse shell on a developer's machine. The proof-of-concept hides instructions an agentic coding tool reads and obeys while cloning and setting up a project, granting attackers remote access; developers should treat AI agents' file and shell actions as privileged and sandbox untrusted repositories. - SecurityWeek: https://www.securityweek.com/new-attack-abuses-claude-code-and-harmless-looking-repositories-to-hijack-developer-machines/ - Help Net Security: https://www.helpnetsecurity.com/2026/06/29/mozilla-warns-of-indirect-prompt-injection-risk-in-ai-coding-agents/ 5. IRAN, RUSSIA, AND CHINA PROBE WATER SYSTEMS Nation-State Activity · [ics, nation-state, critical-infrastructure] Latest developments: Dark Reading reported June 29 that Iranian, Russian, and Chinese state crews breach drinking-water systems through weak passwords, internet-exposed programmable logic controllers, and flat, unsegmented networks. The intrusions hit water utilities through basic hygiene gaps that demand no custom malware; operators should change default credentials, pull PLCs off the public internet, and segment operational technology from corporate networks. - Dark Reading: https://www.darkreading.com/ics-ot-security/iran-russia-china-target-water-systems-sabotage 6. SUPREME COURT SHIELDS GEOFENCE LOCATION DATA Policy and Regulation · [privacy, policy] Latest developments: The U.S. Supreme Court ruled June 29 that police must obtain a warrant before requesting geofence data tying individual cellphones to a location, extending Fourth Amendment protection to cellphone location histories. The decision hands privacy advocates a win by curbing warrantless dragnet requests for who was near a place at a given time; law enforcement and the data brokers that serve it must now meet the probable-cause standard. - The Record: https://therecord.media/supreme-court-geofencing-ruling-fourth-amendment PITTSBURGH ---------------------------------------------------------------- Weather: This Afternoon: Mostly Sunny, high 91F. Tonight: Mostly Clear, low 71F. Tuesday: Mostly Sunny, high 94F. Business: * U.S. Steel Expands Alabama Tubular Plant Latest developments: U.S. Steel said June 29 it will spend $475 million expanding its tubular-steel plant in Fairfield, Alabama, to meet oil and gas demand. Pittsburgh-based United States Steel Corp. plans a $475 million addition to its Fairfield, Alabama, tubular plant, one of several billion-dollar projects the company has announced in the year since Nippon Steel acquired it. - WPXI: https://www.wpxi.com/news/local/us-steel-spend-475m-alabama-plant-expansion-amid-oil-gas-demand/XA3DGU5NIZFZ7PH5YR7A2RK5LE/ * Pittsburgh Airport Extends American's Lease Latest developments: The Allegheny County Airport Authority board approved a six-month extension on June 26 to American Airlines' maintenance-base lease at Pittsburgh International Airport while the two sides negotiate a longer deal. The Allegheny County Airport Authority Board of Directors granted American Airlines a six-month extension on its maintenance-base lease at Pittsburgh International Airport, buying time as the airline and the authority work toward longer terms. - WPXI: https://www.wpxi.com/news/local/pittsburgh-international-airport-extends-american-airlines-lease-parties-negotiate/3DHOCWAFSVBC7HSTBKBJMVPQHE/ * Vape Jet Moves to the Strip District Latest developments: WPXI reported June 29 that Vape Jet, a cannabis robotics company, is relocating its headquarters to Pittsburgh's Strip District. Vape Jet, a robotics-focused cannabis manufacturing company, is moving its headquarters into Pittsburgh's Strip District. - WPXI: https://www.wpxi.com/news/local/cannabis-robotics-company-vape-jet-moves-headquarters-strip-district/RVJLO3GZQBCPJBX5M2J6RDAH7Q/ Around town: * Penn Hills Road Closes for Bridge Work Latest developments: The Allegheny County Department of Public Works announced part of Universal Road near Hershey Road in Penn Hills will close at 9 a.m. July 13 for railroad-bridge work. Allegheny County will shut a stretch of Universal Road near Hershey Road in Penn Hills starting the morning of July 13 to allow work on the railroad bridge there. - WPXI: https://www.wpxi.com/news/local/part-penn-hills-road-close-railroad-bridge-work/ABCHKZVCUJCRFAVOBA67JRWRZ4/ * State Pay Database Undercounts Top Earners Latest developments: The Post-Gazette reported June 29 that Pennsylvania's public salary database understates compensation, even as more than 1,000 state workers earned at least $200,000. Pennsylvania publishes a database of state-employee pay, but Post-Gazette reporting found it leaves out enough compensation to undercount earnings; over 1,000 workers still cleared $200,000. - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/politics-state/2026/06/29/pennsylvania-public-database-compensation-state-employees-officials/stories/202606290039 - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/state/2026/06/29/pennsylvania-state-workers-200k-salaries/stories/202606290037 * Tech Council Urges Pause on Data-Center Rules Latest developments: The Pittsburgh Technology Council asked Governor Josh Shapiro and Pennsylvania legislators on June 29 to hold off on new data-center regulations. Pittsburgh's technology community, led by the Pittsburgh Technology Council, pressed Governor Josh Shapiro and state lawmakers to wait before writing rules on data centers, pushing back against legislative efforts to cap the projects and their tax breaks. - Pittsburgh Post-Gazette: https://www.post-gazette.com/business/tech-news/2026/06/29/pittsburgh-technology-council-data-centers-shapiro/stories/202606290036 Events: * July Festivals: Picklesburgh, Anthrocon, Goat Fest Latest developments: NEXTpittsburgh's July guide, posted June 29, previews the month's signature outdoor festivals across the region. Pittsburgh's July calendar features Picklesburgh, the downtown pickle festival pouring some 800 quarts of pickle juice, the Anthrocon furry convention and parade drawing roughly 18,000 attendees, and Goat Fest; NEXTpittsburgh lays out dates and details for all twelve. - NEXTpittsburgh Events: https://nextpittsburgh.com/events/12-iconic-pittsburgh-things-to-do-in-july-2026/ * Night in the Tropics at the National Aviary Latest developments: Pittsburgh Magazine reported June 29 that the National Aviary's 21-and-over fundraiser returns Friday, July 17, with a Sunset Riviera theme. The National Aviary on Pittsburgh's North Side holds its signature 21-and-over fundraiser, Night in the Tropics presented by UPMC Health Plan, on Friday, July 17, 2026, a Mediterranean-inspired Sunset Riviera evening with live music from No Bad JuJu and unlimited small plates. - Pittsburgh Magazine: https://www.pittsburghmagazine.com/eat-drink-and-party-with-the-birds-at-the-national-aviary/ SPORTS ---------------------------------------------------------------- Pirates (42-42) Sun Jun 28 · Reds 4 · Pirates 9 · Final Ryan O'Hearn homers twice, helps Pirates avoid sweep with 9-4 win over Reds https://plaintextsports.com/mlb/2026-06-28/cin-pit Up Next · Pirates @ Phillies · Mon Jun 29, 6:40 PM https://plaintextsports.com/mlb/2026-06-29/pit-phi Around the Teams: * Hernandez First to 100 Minor-League Strikeouts Latest developments: The Post-Gazette's MiLB Monday reported June 29 that Pirates top prospect Seth Hernandez became the first pitcher in the minor leagues to reach 100 strikeouts this season. Pittsburgh Pirates top pitching prospect Seth Hernandez leads all of the minor leagues with 100 strikeouts, a milestone the Post-Gazette's MiLB Monday flagged alongside updates on other farmhands. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/06/29/milb-prospects-hernandez-reinold-navarro-estuar-suero/stories/202606280113 * SNR Drive Builds All-Time Steelers Team Latest developments: The Steelers' channel posted the June 26 SNR Drive on June 29, with hosts assembling an all-time franchise fantasy roster. On the Steelers' SNR Drive show, hosts Matt Williamson and Wes Uhler drafted their all-time Pittsburgh Steelers fantasy-football team, a lighter offseason segment from the team channel. - Pittsburgh Steelers (YouTube): https://www.youtube.com/watch?v=ugV5BReiPng * Few PNC Park Homers Reach the River Latest developments: A Post-Gazette feature June 29 dug into the physics behind why only seven home runs at PNC Park have ever landed in the Allegheny River on the fly. Since PNC Park opened, just seven home runs have cleared the right-field stands and reached the Allegheny River without a bounce; the Post-Gazette, spotlighting O'Neil Cruz's power, broke down why the feat is so rare. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/06/29/homerun-allegheny-river-science-physics-oneil-cruz/stories/202606260054 Team USA: * USMNT Meets Bosnia in Round of 32 Latest developments: Captain Tim Ream said June 29 the United States must 'expect the unexpected' against Bosnia and Herzegovina in its World Cup round-of-32 match Wednesday, July 1. The United States men's national team, Group D winners as co-host, face Bosnia and Herzegovina on Wednesday, July 1, in the World Cup round of 32; captain Tim Ream waved off added knockout pressure and warned his side to brace for surprises. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49217786/united-states-tim-ream-do-advance-vs-bosnia-herzegovina - Guardian World Cup 2026: https://www.theguardian.com/sport/2026/jun/29/usmnt-bosnia-herzegovina-world-cup-round-of-32-preview READING ---------------------------------------------------------------- * Cal Newport -- Beware of Productivity Paradoxes Newport argues that technologies seemingly destined to be productivity slam dunks, like the personal computer, often fail to deliver clean gains, a paradox worth remembering amid today's expectations for AI. https://calnewport.com/beware-of-productivity-paradoxes/ * Stratechery -- An Interview with Figma CEO Dylan Field About Design and AI Ben Thompson interviews Figma chief executive Dylan Field about how he built the design company and why he believes AI works as a tailwind rather than a threat to its business. https://stratechery.com/2026/an-interview-with-figma-ceo-dylan-field-about-design-and-ai/ * Ed Zitron -- Cargo Culture Zitron contends that much of the tech industry mimics the surface rituals of successful companies without the underlying substance, a cargo-cult pattern he ties to the current AI boom. https://www.wheresyoured.at/cargo-culture/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,381.60 ▼ -1.4% Dow 51,805.04 ▲ +0.4% Nasdaq 25,577.30 ▼ -2.7% WTI crude 71.90 ▼ -9.0% EUR/USD 1.1397 ▼ -1.4% GBP/USD 1.3202 ▼ -1.2% USD/JPY 161.63 ▲ +0.7% ================================================================ Generated 2026-06-29 16:05 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================