================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Tuesday, June 30, 2026 - 12:05 PM EDT ================================================================ Ransomware gangs weaponized the BlueHammer zero-day in Microsoft Defender as critical flaws in AirDrop, Oracle's payment software, and AI browsers exposed data across billions of devices. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Attackers weaponized AI itself, as LayerX's BioShocking tricked six AI browsers into leaking credentials while a fake Perplexity Chrome extension and Silent Swap clipper hijacked searches and crypto wallets. see: AI Agents and Browsers Surrender Credentials; AI-Branded Extensions Hijack Searches and Wallets * [UPDATE (new)] CISA added the BlueHammer Microsoft Defender privilege-escalation flaw, CVE-2026-33825, to its Known Exploited Vulnerabilities catalog after ransomware gangs began actively exploiting it. see: BlueHammer Defender Flaw Fuels Ransomware * [UPDATE (new)] Fresh critical flaws landed, with a 9.8-severity Kemp LoadMaster root-command bug and six AirDrop and Quick Share defects exposing five billion devices to wireless crashes. see: Kemp LoadMaster Root Command Flaw; AirDrop and Quick Share Flaws Span Five Billion Devices * [UPDATE (new)] ShinyHunters' Oracle PeopleSoft breach at the insurance commissioners' group took only publicly available data, outdated logs, and configuration files, narrowing the damage. see: Oracle PeopleSoft and E-Business Suite Bleed Data * [TREND] Commentators weighed AI's payoff, with Zitron arguing the industry is losing on its own economics, Newport warning of productivity paradoxes, and Figma's Dylan Field calling AI a tailwind. see: The AI Industry Is Losing; Beware of Productivity Paradoxes; An Interview with Figma CEO Dylan Field About Design and AI * [UPDATE (new)] Around Pittsburgh, PennDOT poured $100 million into the coming Parkway East closure while PennWest University moved to cut more than 40 majors and minors. see: PennDOT Stacks $100 Million Into Parkway East Closure; PennWest University Cuts 40-Plus Programs SECURITY ---------------------------------------------------------------- 1. ORACLE PEOPLESOFT AND E-BUSINESS SUITE BLEED DATA Data Breaches · [breach, zero-day, exploitation] Latest developments: The National Association of Insurance Commissioners said June 30 that ShinyHunters took only publicly available data, outdated logs, and configuration files from its breached PeopleSoft server, narrowing the damage even as Defused confirmed in-the-wild exploitation of the separate Oracle Payments flaw CVE-2026-46817. CVE-2026-46817, a 9.8-severity authentication and privilege flaw in Oracle E-Business Suite's Payments module, lets unauthenticated attackers take over instances, while a parallel ShinyHunters campaign exploiting an Oracle PeopleSoft zero-day stole Nissan employee data among roughly 100 targeted organizations. Oracle customers should apply the May 2026 patches and audit PeopleSoft and EBS access. - SecurityWeek: https://www.securityweek.com/nissan-employee-data-breached-in-oracle-peoplesoft-hack/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/naic-says-public-data-stolen-in-shinyhunters-peoplesoft-breach/ - The Hacker News: https://thehackernews.com/2026/06/oracle-e-business-suite-flaw-cve-2026.html - Help Net Security: https://www.helpnetsecurity.com/2026/06/30/oracle-payments-cve-2026-46817-exploitation/ 2. AI AGENTS AND BROWSERS SURRENDER CREDENTIALS AI Security · [ai, credential-theft, supply-chain] Latest developments: LayerX detailed BioShocking, a technique that convinced six AI browsers and assistants—including OpenAI's ChatGPT Atlas, Perplexity's Comet, and Anthropic's Claude extension—they were playing a game and then handed over user login details, while researchers found 282 of 444 iOS AI chatbot apps leak paid model access through plaintext API keys and reusable tokens. A wave of research shows AI agents and browsers trusting hostile input: Adversa AI's GuardFall bypasses safeguards in ten of eleven open-source coding agents using decades-old Bash tricks, BioShocking extracts credentials from AI browsers, and hundreds of iOS apps expose backend AI accounts. Developers should sandbox agent commands, rotate exposed keys, and treat agent-fed content as untrusted. - The Hacker News: https://thehackernews.com/2026/06/guardfall-exposes-open-source-ai-coding.html - The Hacker News: https://thehackernews.com/2026/06/new-bioshocking-attack-tricks-ai.html - The Hacker News: https://thehackernews.com/2026/06/282-ios-apps-found-leaking-llm-api-keys.html - SecurityWeek: https://www.securityweek.com/decades-old-bash-tricks-expose-ai-coding-agents-to-supply-chain-attacks/ 3. AI-BRANDED EXTENSIONS HIJACK SEARCHES AND WALLETS Ransomware and Cybercrime · [malware, cryptocurrency, browser] Latest developments: Microsoft and BleepingComputer detailed a malicious Chromium extension spoofing the Perplexity AI answer engine to redirect browser search traffic through intermediary infrastructure, the same day McAfee Labs flagged Silent Swap, a crypto clipper delivered through a fake Google Notes extension that silently rewrites wallet addresses during transactions. Criminals are wrapping malware in AI branding to slip onto the Chrome Web Store, with the fake Perplexity extension tracking searches and the Silent Swap clipper—shipped in unsigned .NET and Golang installers—swapping cryptocurrency destination addresses. Users should install only verified extensions and confirm wallet addresses before sending funds. - Microsoft Security Blog: https://www.microsoft.com/en-us/security/blog/2026/06/29/chromium-extension-uses-airelated-branding-redirect-browser-search/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/fake-perplexity-extension-on-chrome-web-store-tracked-searches/ - The Hacker News: https://thehackernews.com/2026/06/silent-swap-crypto-clipper-uses-fake.html 4. BLUEHAMMER DEFENDER FLAW FUELS RANSOMWARE Vulnerabilities and Exploits · [zero-day, ransomware, patch] Latest developments: CISA confirmed Monday, June 30, that ransomware gangs now exploit CVE-2026-33825, the Microsoft Defender privilege-escalation flaw dubbed BlueHammer, and added it to the Known Exploited Vulnerabilities catalog. CVE-2026-33825 lets attackers escalate privileges through Microsoft Defender, and criminals abused it as a zero-day before Microsoft shipped a patch. Organizations should apply the Defender update immediately and hunt for post-exploitation activity. - SecurityWeek: https://www.securityweek.com/bluehammer-vulnerability-exploited-in-ransomware-attacks/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/cisa-windows-bluehammer-flaw-now-exploited-by-ransomware-gangs/ 5. AIRDROP AND QUICK SHARE FLAWS SPAN FIVE BILLION DEVICES Vulnerabilities and Exploits · [vulnerability, patch, mobile] Latest developments: Two researchers disclosed June 30 six flaws in Apple's AirDrop and the Google and Samsung Quick Share file-sharing services that let an attacker within wireless range crash the receiving service on a Mac or iPhone with no tap or prompt, as Apple began shipping fixes in its June iOS, iPadOS, macOS, and Safari updates. AirDrop and Quick Share run in privileged background services that wake and parse serialized data from unknown nearby devices, exposing more than five billion active phones and laptops to crashes and check bypasses. Users should install the latest Apple updates and restrict sharing to contacts only. - The Hacker News: https://thehackernews.com/2026/06/airdrop-and-quick-share-flaws-let.html - Help Net Security: https://www.helpnetsecurity.com/2026/06/30/apple-airdrop-google-samsung-quick-share-vulnerabilities/ 6. KEMP LOADMASTER ROOT COMMAND FLAW Vulnerabilities and Exploits · [vulnerability, patch, rce] Latest developments: Progress published an advisory June 30 for CVE-2026-8037, a 9.8-severity flaw that lets an unauthenticated attacker run arbitrary commands as root on a Kemp LoadMaster appliance by sending a crafted request to its API. CVE-2026-8037 hands full root control of LoadMaster load balancers to anyone who can reach the API, with no credentials required. Administrators running LoadMaster with the API enabled should apply the available patch immediately. - The Hacker News: https://thehackernews.com/2026/06/progress-kemp-loadmaster-flaw-could-let.html BUSINESS AND POLITICS ---------------------------------------------------------------- * Supreme Court Upholds Birthright Citizenship Latest developments: The Supreme Court ruled 6-3 on June 30, 2026, that President Trump's order ending birthright citizenship is unlawful, the marquee ruling of a mixed decision day that followed the prior day's decision letting Trump fire most independent-agency heads. In Trump v. Barbara the Supreme Court reaffirmed the more than century-old reading of the 14th Amendment that nearly everyone born on U.S. soil is a citizen, with Chief Justice John Roberts joining Sonia Sotomayor, Elena Kagan, and Amy Coney Barrett to strike down the executive order, dealing President Trump's immigration agenda its sharpest defeat. - FT World: https://www.ft.com/content/8ee00f84-762c-48a5-ac21-774e216977fa PITTSBURGH ---------------------------------------------------------------- Weather: This Afternoon: Mostly Sunny, high 94F. Tonight: Partly Cloudy, low 76F. Wednesday: Sunny, high 98F. Business: * Pittsburgh Jobless Rate Beats State and Nation Latest developments: The Post-Gazette reported June 30 that the Pittsburgh metro area's unemployment rate is running below both Pennsylvania's and the national rate. The Pittsburgh region's jobless rate has come in lower than the statewide and U.S. unemployment rates, a sign of relative labor-market strength heading into the summer of 2026. - Pittsburgh Post-Gazette: https://www.post-gazette.com/business/career-workplace/2026/06/30/pittsburgh-jobless-rate-unemployment/stories/202606300024 * Incline Equity Buys West Physics Latest developments: WPXI reported June 30 that Pittsburgh private-equity firm Incline Equity Partners acquired medical-physics testing provider West Physics. Incline Equity Partners bought West Physics, a 24-year-old medical-physics and imaging testing firm whose founder and chief executive, Geoff West, said the deal will fund expansion of its services, in-house residency program, and physicist network. - WPXI: https://www.wpxi.com/news/local/incline-equity-partners-buys-medical-testing-provider/D6UO2I5FZVET5GQ5P3H4XNTYFY/ * EY Leads Pittsburgh Accounting July 4 Shutdown Latest developments: WPXI reported June 30 that large Pittsburgh accounting firms are giving staff the week off around the July 4 holiday. EY is handing all employees a week-long break around Independence Day for the ninth straight year, part of a pattern of Pittsburgh-area accounting firms pausing operations ahead of July 4, 2026. - WPXI: https://www.wpxi.com/news/local/large-pittsburgh-accounting-firms-are-taking-summer-breaks-ahead-july-4/KNVHY6EM2NHPXKBFFTV73U7EXU/ Around town: * PennDOT Stacks $100 Million Into Parkway East Closure Latest developments: WTAE reported June 30 that PennDOT will use the coming 25-day Parkway East shutdown to complete roughly $100 million in additional repairs, including repaving the Squirrel Hill Tunnel. Beyond the bridge work driving the 25-day Interstate 376 Parkway East closure, PennDOT plans Squirrel Hill Tunnel repaving, a fire drill, and other projects worth about $100 million while traffic is diverted, deepening detours for Swissvale-area businesses and commuters. - WTAE: https://www.wtae.com/article/parkway-east-closure-penndot-projects-pittsburgh/71780871 * PennWest University Cuts 40-Plus Programs Latest developments: The Post-Gazette reported June 30 that PennWest University will eliminate more than 40 majors and minors in an academic redesign. Pennsylvania Western University, the state-system school formed from the California, Clarion, and Edinboro campuses, will cut over 40 majors and minors, including arts and certificate programs, as it restructures its academic offerings. - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/education/2026/06/30/pennwest-program-cuts-california-arts-certificates/stories/202606290046 * Karen Dixon Named Police Assistant Chief Latest developments: TribLive reported June 30 that Pittsburgh public safety officials named bureau veteran Karen Dixon assistant chief of administration. The Pittsburgh Bureau of Police announced that veteran officer Karen Dixon will return to the force as assistant chief of administration, a top administrative post in the city's police command. - TribLive: https://triblive.com/local/karen-dixon-named-pittsburgh-police-bureaus-new-assistant-chief-of-administration/ Events: * Twelve Things to Do in Pittsburgh This July Latest developments: NEXTpittsburgh published its July 2026 guide June 29, spotlighting Picklesburgh, Goat Fest, and Anthrocon's Furry parade. NEXTpittsburgh's roundup of July outdoor festivals features Picklesburgh and its 800 quarts of pickle juice, Goat Fest, and the Anthrocon Fursuit Parade drawing some 18,000 attendees, alongside other Pittsburgh-region summer events running through the month. - NEXTpittsburgh Events: https://nextpittsburgh.com/events/12-iconic-pittsburgh-things-to-do-in-july-2026/ * 'French Moderns' Opens at the Frick Latest developments: The Post-Gazette previewed June 30 the Frick Pittsburgh's 'French Moderns' exhibition of early modern French art. The Frick Pittsburgh in Point Breeze is showing 'French Moderns,' an exhibition tracing an era of artistic freedom in French painting and the question of what it meant to be modern. - Post-Gazette Arts & Entertainment: https://www.post-gazette.com/ae/art-architecture/2026/06/30/french-moderns-frick-pittsburgh/stories/202606290023 * Polar World Closing at Carnegie Museum Latest developments: The Post-Gazette reported June 27 that the Carnegie Museum of Natural History will retire its Polar World exhibit after 43 years. Carnegie Museum of Natural History in Oakland is closing Polar World, its long-running Arctic and Antarctic display, after 43 years, leaving visitors a final window to see it. - Post-Gazette Arts & Entertainment: https://www.post-gazette.com/ae/art-architecture/2026/06/27/polar-world-carnegie-museum-of-natural-history-closure/stories/202606280064 SPORTS ---------------------------------------------------------------- Pirates (43-42) Mon Jun 29 · Pirates 11 · Phillies 7 · Final Valdez, Triolo and Rodriguez homer for Pirates in 11-7 win over Phillies https://plaintextsports.com/mlb/2026-06-29/pit-phi Up Next · Pirates @ Phillies · Tue Jun 30, 6:40 PM https://plaintextsports.com/mlb/2026-06-30/pit-phi Around the Teams: * Sizing Up the Steelers' Reshaped Offense Latest developments: A Post-Gazette breakdown June 30 ran through how the Steelers' offense shapes up around quarterback Aaron Rodgers and his skill players as training camp nears. The Post-Gazette's fantasy-football preview of the 2026 Steelers offense weighed quarterback Aaron Rodgers, receivers DK Metcalf and Pittman, running backs Jaylen Warren and Dowdle, and tight end Pat Freiermuth, gauging who carries the most value in the new-look attack. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/06/30/fantasy-football-metcalf-pittman-rodgers-warren-dowdle-freiermuth/stories/202606300030 * Seth Hernandez First to 100 Minor-League Strikeouts Latest developments: The Post-Gazette's MiLB Monday noted June 29 that Pirates top pitching prospect Seth Hernandez became the first pitcher in the minor leagues to reach 100 strikeouts this season. Seth Hernandez, the Pittsburgh Pirates' top prospect, led all of minor-league baseball to 100 strikeouts in 2026, a marker of the young right-hander's dominance in the farm system. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/06/29/milb-prospects-hernandez-reinold-navarro-estuar-suero/stories/202606280113 Team USA: * Malik Tillman Shines for USMNT Latest developments: ESPN reported June 30 that U.S. men's national team midfielder Malik Tillman has emerged as a standout of the 2026 World Cup. Malik Tillman, shifted into an unfamiliar central-midfield role after a disappointing club season at Bayer Leverkusen, has flourished for the United States at the home World Cup as the team readies for its round-of-32 match against Bosnia and Herzegovina on July 1, 2026. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49214102/tillman-having-great-world-cup-usmnt-never-tell-himself READING ---------------------------------------------------------------- * Ed Zitron -- The AI Industry Is Losing Zitron argues the AI industry is losing on its own terms, with revenues falling far short of the enormous capital pouring in and the economics failing to cohere into a sustainable business. https://www.wheresyoured.at/the-ai-industry-is-losing/ * Cal Newport -- Beware of Productivity Paradoxes Newport revisits how the personal computer, seemingly a productivity slam dunk, took years to pay off, warning that promised gains from new tools like AI can lag or fail to materialize as advertised. https://calnewport.com/beware-of-productivity-paradoxes/ * Stratechery -- An Interview with Figma CEO Dylan Field About Design and AI Ben Thompson interviews Figma chief executive Dylan Field on how the company was built and why Field believes AI works as a tailwind rather than a threat to design software. https://stratechery.com/2026/an-interview-with-figma-ceo-dylan-field-about-design-and-ai/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,375.12 ▼ -1.6% Dow 51,899.04 ▲ +0.4% Nasdaq 25,508.01 ▼ -3.2% WTI crude 71.09 ▼ -7.7% EUR/USD 1.1382 ▼ -1.3% GBP/USD 1.3200 ▼ -0.8% USD/JPY 161.70 ▲ +0.6% ================================================================ Generated 2026-06-30 12:05 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================