daily plain-text briefing: security, markets, business, and pittsburgh
Researchers turned AI browsers from OpenAI, Perplexity, and Anthropic into credential thieves, and malicious AI-branded extensions and poisoned repositories spread the same playbook.
Latest developments: LayerX's BioShocking technique convinced six AI browsers and assistants—including OpenAI's ChatGPT Atlas, Perplexity's Comet, and Anthropic's Claude browser extension—that they were playing a game, then watched them copy a user's credentials to an attacker, while Microsoft pulled a Chrome extension spoofing Perplexity that logged every search and address-bar keystroke through an attacker server, and SecurityWeek demonstrated indirect prompts hidden in a repository spawning a reverse shell through Claude Code.
A wave of attacks weaponizes agentic AI tools against their own users, abusing browser assistants, fake AI-branded extensions, and developer agents to steal credentials and seize machines. Treat AI browser and extension permissions as privileged, vet extensions, and isolate coding agents from untrusted repositories.
Sources: The Hacker News · The Hacker News · Microsoft Security Blog · SecurityWeek · ↑ top
Latest developments: SecurityWeek reported June 30 that investigators have confirmed only a handful of the roughly 100 organizations swept up in the ShinyHunters Oracle PeopleSoft campaign, as Nissan detailed stolen current and former employee data, the National Association of Insurance Commissioners said the group took only public data, outdated logs, and configuration files despite claiming 3.1 terabytes, and Defused confirmed fresh exploitation of the separate E-Business Suite flaw CVE-2026-46817 in Oracle Payments.
The ShinyHunters extortion group exploited Oracle PeopleSoft and E-Business Suite zero-days to loot data from about 100 organizations, including Nissan and the NAIC. Oracle customers running PeopleSoft and EBS should patch and hunt for data-theft activity.
Sources: SecurityWeek · BleepingComputer · BleepingComputer · The Hacker News · ↑ top
Latest developments: Fresh analysis shows Djinn Stealer, delivered through SimpleHelp authentication-bypass flaw CVE-2026-48558, runs cross-platform across Windows, macOS, and Linux and zeroes in on cloud and AI credentials, SSH keys, cryptocurrency wallets, and developer tooling that links development and admin environments to wider enterprise systems.
Attackers exploit a critical SimpleHelp remote-support flaw to drop the previously undocumented Djinn Stealer and the TaskWeaver loader. Patch SimpleHelp immediately and rotate any credentials, keys, and wallets reachable from affected hosts.
Sources: SecurityWeek · BleepingComputer · Dark Reading · CISA Advisories · ↑ top
Latest developments: Progress disclosed CVE-2026-8037, a 9.8-severity flaw that lets an unauthenticated attacker run root commands on Kemp LoadMaster through its API, Apple patched over 30 iOS, macOS, and Safari flaws including four WebKit bugs found with Anthropic Claude and OpenAI Codex, researchers revealed AirDrop and Quick Share flaws affecting more than five billion Apple, Google, and Samsung devices, and CISA flagged three Daktronics controller flaws exposing highway signs and billboards to remote hacking.
A run of critical patches lands across network appliances, consumer devices, and roadside controllers, several reachable without authentication. Administrators should update Kemp LoadMaster, Apple devices, and Daktronics controllers now and watch for proximity-based AirDrop and Quick Share fixes.
Sources: The Hacker News · The Hacker News · Help Net Security · SecurityWeek · ↑ top
Latest developments: Acronis caught China-aligned Mustang Panda running two campaigns against the Indian government and hydropower targets using Zoho WorkDrive as a command channel, Kaspersky detailed ToddyCat's new Umbrij tool stealing Gmail OAuth tokens to read corporate email, ESET counted 35 Gamaredon spear-phishing campaigns against Ukraine through 2025, and Dark Reading reported Iran, Russia, and China breaching water systems through weak passwords and exposed PLCs.
State-backed groups increasingly hide command traffic inside legitimate cloud platforms like Zoho WorkDrive and Gmail while pressing attacks on governments, energy, and water utilities. Defenders should monitor cloud-service abuse, lock down OAuth tokens, and harden exposed industrial controllers.
Sources: The Hacker News · Securelist (Kaspersky) · The Hacker News · Dark Reading · ↑ top
Latest developments: CISA confirmed that ransomware gangs now exploit BlueHammer, a Microsoft Defender privilege-escalation vulnerability that attackers previously abused in zero-day attacks, marking its shift from targeted espionage to broad criminal use.
BlueHammer lets attackers escalate privileges through Microsoft Defender, and ransomware crews have folded it into their playbooks. Apply Microsoft's patch and prioritize the flaw under CISA's exploited-vulnerability directive.
Sources: BleepingComputer · ↑ top
Latest developments: The yen slid past ¥162 to its weakest against the dollar in 40 years on June 30, putting Tokyo on intervention watch as traders now expect the Federal Reserve to raise rates this year.
Japan's currency fell to a four-decade low after the Fed's hawkish shift, and Finance Minister Satsuki Katayama renewed her pledge to curb excessive yen volatility; gold tracked a 12% monthly loss on the same repricing.
Sources: WSJ Markets · FT Markets · WSJ Markets · ↑ top
Latest developments: The seven largest U.S. technology stocks have lost $2.3 trillion as investors rotate into chipmakers riding hyperscalers' AI spending, even as the Nasdaq tracks a 20% quarterly gain.
Wall Street is moving money out of megacaps like Nvidia's Magnificent Seven peers and into semiconductor makers that supply the AI buildout, reshaping market leadership as the S&P 500 sets up to close its best quarter since 2020.
Sources: FT World · WSJ Markets · ↑ top
Today: Mostly Sunny, high 94F.
Tonight: Partly Cloudy, low 76F.
Wednesday: Sunny, high 98F.
Latest developments: Residents gathered June 29 to oppose Switch's proposal for three data-center buildings on roughly 400 acres of the former Pitt Race motorsports property in Beaver County.
The data-center developer Switch wants to build a three-building campus on the old Pitt Race track in Beaver County, drawing organized opposition from neighbors worried about its scale and footprint.
Latest developments: The River Valley School District board approved a last-minute plan June 29 to repay a short-term loan one day before the payment came due.
River Valley School District lacked the funds to cover a short-term loan and its board passed an eleventh-hour repayment plan a day before the bill was due, exposing the district's financial strain.
Latest developments: An unprecedented power surge hit Pittsburgh International Airport, testing the microgrid the airport built to run independent of the regional grid.
Pittsburgh International Airport's microgrid, which it built to keep operating apart from the regional power grid, faced an unprecedented power surge that tested whether it works as planned.
Sources: Pittsburgh Post-Gazette · ↑ top
Latest developments: The National Weather Service heat advisory took effect at 11 a.m. June 30 and runs through 10 p.m. Friday, with 90-degree highs and heat-index readings near 100; towns moved trash pickup earlier and Duquesne Light added crews.
Western Pennsylvania's hottest stretch of 2026 brings 90-degree highs and 'feels-like' readings near 100 through Friday, prompting Pittsburgh-area communities to shift trash collection to cooler morning hours and Duquesne Light to boost staffing against possible outages.
Sources: KDKA · KDKA · KDKA · ↑ top
Latest developments: PublicSource reported June 30 that Pittsburgh's city government is racing to set guidelines for its workers' use of artificial intelligence, training staff before publishing rules it has yet to release.
Pittsburgh's city government is writing internal guidelines to govern how employees use AI, prioritizing getting staff up to speed over public release of the policy as it tries to keep pace with a fast-moving technology whose decisions could ripple for decades.
Sources: PublicSource · ↑ top
Latest developments: Hempfield Area officials and residents gathered June 29 to break ground on the long-awaited renovation of the district's high school in Westmoreland County.
Hempfield Area School District began its long-planned high school renovation in Westmoreland County, a project officials framed as building for an evolving education landscape.
Latest developments: NEXTpittsburgh's July guide, posted June 29, rounds up the month's signature events, from Picklesburgh to Goat Fest to Anthrocon's furry parade.
Pittsburgh's July calendar fills with outdoor staples: Picklesburgh downtown, Goat Fest, and Anthrocon, whose roughly 18,000 attendees stage a furry parade; NEXTpittsburgh's roundup also points to the North Side Music Festival in its Summer Concert Guide.
Sources: NEXTpittsburgh Events · ↑ top
Latest developments: The Post-Gazette on June 30 spotlighted 'French Moderns,' the exhibition now at The Frick Pittsburgh surveying an era of artistic freedom.
The Frick Pittsburgh, in Point Breeze, is showing 'French Moderns,' an exhibition of modern French painting and sculpture exploring what it meant to be modern.
Sources: Post-Gazette Arts & Entertainment · ↑ top
Latest developments: The Carnegie Museum of Natural History is retiring its 'Polar World' exhibit after 43 years, the Post-Gazette reported, giving visitors a last chance to see it.
After 43 years, the Carnegie Museum of Natural History in Oakland is closing 'Polar World,' its long-running Arctic and Antarctic exhibit.
Sources: Post-Gazette Arts & Entertainment · ↑ top
Pirates (43-42)
Mon Jun 29 · Pirates 11 · Phillies 7 · Final
Valdez, Triolo and Rodriguez homer for Pirates in 11-7 win over Phillies
Up Next · Pirates @ Phillies · Tue Jun 30, 6:40 PM
Latest developments: The Post-Gazette's MiLB Monday on June 29 noted Pirates top prospect Seth Hernandez became the first pitcher in the minor leagues to reach 100 strikeouts this season.
Seth Hernandez, the Pirates' top pitching prospect, leads all of the minor leagues with 100 strikeouts, a milestone the Post-Gazette's MiLB Monday column highlighted.
Sources: Post-Gazette Pirates · ↑ top
Latest developments: A Post-Gazette feature broke down the physics behind why only seven home runs have cleared into the Allegheny River on the fly since PNC Park opened.
In a quarter-century at PNC Park, only seven home runs—including O'Neil Cruz's blasts—have reached the Allegheny River on the fly, and a Post-Gazette piece explained the physics that makes the feat so rare.
Sources: Post-Gazette Pirates · ↑ top
Latest developments: The Steelers' SNR Drive show, in a June 26 episode the team posted June 29, had hosts Matt Williamson and Wes Uhler assemble their all-time Steelers fantasy-football team.
On the team-produced SNR Drive, Matt Williamson and Wes Uhler drafted an all-time Steelers fantasy-football roster, debating the franchise's greatest players to fill the offseason lull.
Sources: Pittsburgh Steelers (YouTube) · ↑ top
Latest developments: Ahead of Wednesday's round-of-32 match, captain Tim Ream said he feels no added pressure as the United States braces for surprises from Bosnia and Herzegovina, the Guardian reported June 29.
The United States men's team, winners of Group D as co-host, plays Bosnia and Herzegovina on Wednesday, July 1, in the World Cup round of 32, with captain Tim Ream playing down knockout-round tension.
Sources: Guardian World Cup 2026 · ↑ top
Latest developments: ESPN profiled Malik Tillman on June 30, noting he has flourished in an unfamiliar U.S. midfield role after a disappointing club season at Bayer Leverkusen.
Malik Tillman, shuffled into a new central-midfield spot for the United States, has become one of the team's standouts at the World Cup despite a down year with Bayer Leverkusen.
Sources: ESPN Soccer · ↑ top
S&P 500 7,375.12 ▼ -1.6% Dow 51,899.04 ▲ +0.4% Nasdaq 25,508.01 ▼ -3.2% WTI crude 71.09 ▼ -7.7% EUR/USD 1.1382 ▼ -1.3% GBP/USD 1.3200 ▼ -0.8% USD/JPY 161.70 ▲ +0.6%