================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Tuesday, June 30, 2026 - 9:09 AM EDT ================================================================ Aflac's Japan unit lost data on 4.38 million policyholders as active exploitation of Oracle's E-Business Suite began and decades-old Bash tricks turned open-source AI coding agents into supply-chain weapons. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Japan dominates the day's attacks as Aflac's subsidiary leaks 4.38 million records, China-linked malware rides USB drives into the military, and Blackfield extorts Nidec. see: Aflac Japan Breach Hits 4.38 Million; China-Linked Malware Rides USB Drives Into Japanese Military; Blackfield Hits Nidec as Akira Chains Spread * [TREND] Decades-old Bash tricks are turning trusted open-source AI coding agents into silent supply-chain conduits, a fresh reminder the tools developers lean on are now attack vectors. see: AI Coding Agents Fall to Supply Chain Tricks * [UPDATE (new)] Active exploitation has begun against CVE-2026-46817, a 9.8-severity Oracle Payments flaw handing unauthenticated attackers full takeover of E-Business Suite instances. see: Oracle E-Business Suite Exploitation Begins * [UPDATE (new)] The U.S. Supreme Court ruled that the Fourth Amendment shields cellphone location histories, forcing police to get a warrant before requesting geofence data. see: Supreme Court Shields Cellphone Location Data * [TREND] This run's reading questions the AI boom, as Newport warns of productivity paradoxes, Zitron catalogs bubble signs, and Figma's Dylan Field counters that AI is a tailwind. see: Beware of Productivity Paradoxes; Premium: Notes From The Bubble, Volume 1; An Interview with Figma CEO Dylan Field About Design and AI * [UPDATE (new)] A heat advisory with feels-like readings near 100 will stretch into the July 4 weekend across Western Pennsylvania, just as WTAE rounds up the holiday fireworks displays. see: Heat Wave to Stretch Into July 4 Weekend; Where to Watch July 4 Fireworks in Western Pa. SECURITY ---------------------------------------------------------------- 1. ORACLE E-BUSINESS SUITE EXPLOITATION BEGINS Data Breaches · [vulnerability, exploit, breach] Latest developments: Defused confirmed active exploitation of CVE-2026-46817, a 9.8-severity authentication and privilege flaw in Oracle Payments that hands unauthenticated attackers full takeover of E-Business Suite instances, as the parallel ShinyHunters PeopleSoft campaign confirmed Nissan employee data among roughly 100 targeted organizations. The Oracle Payments flaw lets attackers seize E-Business Suite financial systems without credentials; Oracle has patched it. Administrators running EBS should apply the fix and hunt for web shells, while PeopleSoft customers track the ongoing ShinyHunters data theft. - SecurityWeek: https://www.securityweek.com/exploitation-of-recent-oracle-e-business-suite-vulnerability-begins/ - The Hacker News: https://thehackernews.com/2026/06/oracle-e-business-suite-flaw-cve-2026.html - BleepingComputer: https://www.bleepingcomputer.com/news/security/new-oracle-e-business-suite-flaw-now-exploited-in-attacks/ 2. AI CODING AGENTS FALL TO SUPPLY CHAIN TRICKS AI Security · [ai, supply-chain] Latest developments: SecurityWeek reported June 30 that decades-old Bash shell tricks slip past safeguards in most open-source AI coding agents, letting a malicious repository turn an agent into a supply-chain attack vector, while Dark Reading warned of unreviewable AI-generated automation and Sophos X-Ops published a working taxonomy of AI threats. Agentic coding tools that clone and run untrusted repositories execute hidden commands when old shell-escaping tricks defeat their guardrails. Teams adopting AI coding and automation should sandbox agent execution and review generated workflows before trusting them. - SecurityWeek: https://www.securityweek.com/decades-old-bash-tricks-expose-ai-coding-agents-to-supply-chain-attacks/ - Dark Reading: https://www.darkreading.com/cyber-risk/ai-generated-workflows-silent-security-disaster - Sophos News: https://www.sophos.com/en-us/blog/a-double-edged-bleeding-edge-classifying-ai-threats 3. CHINA-LINKED MALWARE RIDES USB DRIVES INTO JAPANESE MILITARY Nation-State Activity · [apt, espionage] Latest developments: Bitdefender detailed that USB drives carrying China-linked malware infected Japanese military networks for nearly a year, while Kaspersky's second ToddyCat report dissected the Umbrij tool stealing Gmail OAuth tokens to read corporate email and Acronis tracked Mustang Panda abusing Zoho WorkDrive as a command channel against the Indian government. Chinese espionage crews favor low-tech footholds and legitimate cloud services to breach governments and militaries across Asia. Defenders should restrict removable media, monitor OAuth token grants, and watch traffic to sanctioned cloud platforms. - Graham Cluley: https://www.bitdefender.com/en-us/blog/hotforsecurity/usb-drives-carrying-china-linked-malware-infected-japanese-military-networks-for-nearly-a-year - Securelist (Kaspersky): https://securelist.com/toddycat-apt-umbrij-tool-and-oauth/120251/ - The Hacker News: https://thehackernews.com/2026/06/mustang-panda-uses-zoho-workdrive-as.html 4. AFLAC JAPAN BREACH HITS 4.38 MILLION Data Breaches · [breach, data] Latest developments: Aflac disclosed June 30 that attackers reached the policyholder portal of its Japan subsidiary repeatedly between June 15 and June 25, exposing personal and bank-account data on 4.38 million people. Aflac, the Columbus, Georgia insurer, said hackers breached Aflac Japan systems and took policyholder names, addresses, and bank account information. Affected customers should monitor accounts and watch for notification. - SecurityWeek: https://www.securityweek.com/aflac-japan-data-breach-impacts-4-38-million/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/insurance-giant-aflac-discloses-data-breach-after-subsidiary-hack/ 5. SUPREME COURT SHIELDS CELLPHONE LOCATION DATA Policy and Regulation · [policy, privacy] Latest developments: The U.S. Supreme Court ruled June 29 that the Fourth Amendment protects cellphone location histories, forcing police to obtain a warrant before requesting geofence data, in the case of a bank robber whom investigators identified through a geofence warrant. The decision hands privacy advocates a win and reshapes how law enforcement gathers location records from carriers and platforms. Police seeking geofence data tying individual phones to a place now need a warrant. - SecurityWeek: https://www.securityweek.com/supreme-court-rules-constitutional-privacy-protections-apply-to-cellphone-users-location-history/ - The Record: https://therecord.media/supreme-court-geofencing-ruling-fourth-amendment 6. BLACKFIELD HITS NIDEC AS AKIRA CHAINS SPREAD Ransomware and Cybercrime · [ransomware] Latest developments: The Blackfield ransomware gang demanded $2 million from Nidec Corporation, the Japanese maker of automotive and computing electronic components, while The DFIR Report traced an intrusion that ran from a poisoned Bing search result through Bumblebee and the AdaptixC2 framework to Akira ransomware. Ransomware crews keep pairing extortion of large manufacturers with malvertising-led access chains. Organizations should harden search-driven downloads, monitor for Bumblebee and AdaptixC2 loaders, and segment networks against Akira. - BleepingComputer: https://www.bleepingcomputer.com/news/security/blackfield-ransomware-asks-nidec-corporation-for-2-million-ransom/ - The DFIR Report: https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/ BUSINESS AND POLITICS ---------------------------------------------------------------- * U.S. and Iran Send Delegations to Doha Latest developments: U.S. envoys arrived in Qatar on June 30 to negotiate terms of the interim deal, sending oil prices lower, though Washington and Tehran still disagree over next steps as the Strait of Hormuz ceasefire holds. The United States and Iran each dispatched delegations to Doha this week after days of fighting around the Strait of Hormuz; Shell warned that continued disruption over the rest of the year could force a rare annual contraction in global liquefied-natural-gas supply. - WSJ Markets: https://www.wsj.com/finance/commodities-futures/oil-falls-on-possible-position-adjustments-before-expected-u-s-iran-talks-f5581ebd?mod=rss_markets_main - WSJ Markets: https://www.wsj.com/finance/commodities-futures/shell-warns-global-lng-supply-could-contract-if-strait-of-hormuz-disruption-continues-10681c7f?mod=rss_markets_main * Hawkish Fed Bets Sink Gold, Pummel the Yen Latest developments: Quarter-end repricing toward a 2026 Federal Reserve rate increase drove gold toward a 12% monthly loss, its worst quarter in more than a decade, and pushed the dollar to ¥162, a 40-year high that left Tokyo poised to intervene as soon as Friday. Traders now expect the Fed to raise rates this year, reversing the safe-haven trade: gold heads for its steepest quarterly drop in over a decade even amid the Iran war, while the yen's slide to a 40-year low put Japanese Finance Minister Satsuki Katayama on intervention watch. - WSJ Markets: https://www.wsj.com/finance/currencies/yen-falls-to-40-year-low-versus-dollar-traders-alert-for-potential-fx-intervention-ad9b6d9f?mod=rss_markets_main - WSJ Markets: https://www.wsj.com/finance/commodities-futures/gold-declines-likely-weighed-by-hawkish-dollar-repricing-7eba8c34?mod=rss_markets_main PITTSBURGH ---------------------------------------------------------------- Weather: Today: Mostly Sunny, high 94F. Tonight: Partly Cloudy, low 76F. Wednesday: Sunny, high 98F. Business: * Jeni's Debuts Summer Flavors, Free Scoops Latest developments: Jeni's will give away free ice cream and roll out three new flavors on Thursday, July 2, at its Pittsburgh-area shops. Jeni's Splendid Ice Creams adds three flavors—Campfire S'mores and Strawberry Pretzel Pie among them—and hands out free scoops July 2 across its area locations; details run at jenis.com. - Pittsburgh City Paper: https://www.pghcitypaper.com/food-drink/a-berry-good-cider-a-pizza/ * PETA Launches Pennsylvania 'Nice Cream Trail' Latest developments: PETA unveiled a statewide 'Nice Cream Trail' on June 30 steering dessert-seekers to shops serving vegan frozen treats. PETA rolled out a Pennsylvania 'Nice Cream Trail' that maps shops across the state offering dairy-free frozen desserts, part of the animal-rights group's push to promote vegan eating during the summer. - Pittsburgh Post-Gazette: https://www.post-gazette.com/life/food/2026/06/30/vegan-nice-cream-pa-trail/stories/202607050007 Around town: * Heat Wave to Stretch Into July 4 Weekend Latest developments: The National Weather Service heat advisory took hold at 11 a.m. June 30 and now forecasts the heat lasting into the July 4 holiday weekend, with feels-like readings near 100 degrees across Western Pennsylvania. The hottest stretch of 2026 settles over the Pittsburgh region this week and into Independence Day weekend, pushing temperatures into the 90s with heat-index values near 100; Duquesne Light added crews against a demand surge, and several communities moved trash pickup earlier. - WTAE: https://www.wtae.com/article/pennsylvania-4th-of-july-heat-wave-forecast/71768943 - KDKA: https://www.cbsnews.com/pittsburgh/news/heat-advisory-pittsburgh-area-heat-wave-national-weather-service-high-temperatures/ * Dump Truck Falls Into Mt. Washington Repair Site Latest developments: A dump truck dropped into a hole at the site of water-main-break repair work in Pittsburgh's Mt. Washington neighborhood on June 30. Crews repairing a water main break in Mt. Washington watched a dump truck sink into the excavation, snarling the worksite in one of the city's hilltop neighborhoods. - WPXI: https://www.wpxi.com/news/local/dump-truck-falls-into-hole-site-water-main-break-work-mt-washington/OWG4Q33NWVA3TPSTJOGPTIA6ME/ Events: * Where to Watch July 4 Fireworks in Western Pa. Latest developments: WTAE published its roundup of Independence Day fireworks displays across Western Pennsylvania communities ahead of the July 4 holiday. WTAE compiled a guide to where Western Pennsylvania towns will set off fireworks for the Fourth of July, gathering display schedules across the region as communities finalize their celebrations. - WTAE: https://www.wtae.com/article/western-pennsylvania-july-4-fireworks-displays/71761936 SPORTS ---------------------------------------------------------------- Pirates (43-42) Mon Jun 29 · Pirates 11 · Phillies 7 · Final Valdez, Triolo and Rodriguez homer for Pirates in 11-7 win over Phillies https://plaintextsports.com/mlb/2026-06-29/pit-phi Up Next · Pirates @ Phillies · Tue Jun 30, 6:40 PM https://plaintextsports.com/mlb/2026-06-30/pit-phi Around the Teams: * Heyward's Show Debates Best NFL Draft Class Latest developments: On the June 29 'Not Just Football' short, Cam Heyward and his co-host argued over which NFL draft class ranks as the greatest of all time. Steelers defensive captain Cam Heyward used his 'Not Just Football' show to debate the greatest draft class ever, weighing groups that produced stars such as Odell Beckham Jr. and Aaron Donald. - Not Just Football with Cam Heyward: https://www.youtube.com/shorts/1G-jDTXpWLU * Steelers Mark One Month to Training Camp Latest developments: The Steelers' team channel noted June 29 that training camp opens in about a month, putting late July on the calendar for the start of camp. Pittsburgh's official channel flagged the one-month countdown to training camp, the first on-field gathering of the 2026 season as the offseason winds down. - Pittsburgh Steelers (YouTube): https://www.youtube.com/shorts/cNICuFRNOJ8 Team USA: * USMNT Meets Bosnia's American-Raised Threat Latest developments: Ahead of the round-of-32 match against the United States on Wednesday, July 1, the Guardian profiled Bosnia midfielder Esmir Bajraktarević, who came up entirely through the U.S. system before choosing his parents' homeland. Esmir Bajraktarević, born in Appleton, Wisconsin and developed through the Chicago Fire academy, the New England Revolution, and U.S. youth national teams, now lines up for Bosnia and Herzegovina against the United States in the World Cup knockout round. - Guardian World Cup 2026: https://www.theguardian.com/football/2026/jun/30/esmir-bajraktarevic-bosnia-and-herzegovina-usmnt READING ---------------------------------------------------------------- * Cal Newport -- Beware of Productivity Paradoxes Newport argues that technologies sold as obvious productivity wins—the personal computer being the classic case—often fail to deliver the gains they promise, urging skepticism as the same hype now surrounds AI. https://calnewport.com/beware-of-productivity-paradoxes/ * Stratechery -- An Interview with Figma CEO Dylan Field About Design and AI Field discusses how he built Figma and why he sees AI as a tailwind for the design company rather than a threat to its business. https://stratechery.com/2026/an-interview-with-figma-ceo-dylan-field-about-design-and-ai/ * Ed Zitron -- Premium: Notes From The Bubble, Volume 1 Zitron launches an ongoing series cataloguing the evidence he reads as signs of an inflating, unsustainable AI investment bubble. https://www.wheresyoured.at/premium-notes-from-the-bubble-volume-1/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,375.12 ▼ -1.6% Dow 51,899.04 ▲ +0.4% Nasdaq 25,508.01 ▼ -3.2% WTI crude 71.09 ▼ -7.7% EUR/USD 1.1382 ▼ -1.3% GBP/USD 1.3200 ▼ -0.8% USD/JPY 161.70 ▲ +0.6% ================================================================ Generated 2026-06-30 09:09 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================