daily plain-text briefing: security, markets, business, and pittsburgh
An AI agent ran a complete ransomware attack on its own for the first time, as U.S. prosecutors took custody of an alleged Scattered Spider member.
Latest developments: The Department of Homeland Security confirmed July 1 that hackers breached the Homeland Security Information Network, its sensitive sharing platform for federal, state, local, and private partners, the same day Medtronic began notifying customers of a ShinyHunters breach, Japanese firms Aflac Tokyo, Sapporo, Nidec, and KDDI disclosed incidents, and Kubota North America revealed intruders held network access for more than a month.
A wave of disclosures spans government, healthcare devices, and Japanese industry, several tied to third-party access and the ShinyHunters crew. Affected customers should watch for identity theft and phishing built on the leaked personal data.
Sources: BleepingComputer · BleepingComputer · The Record · BleepingComputer · ↑ top
Latest developments: The Justice Department announced July 1 that Finland extradited Peter Stokes, a 19-year-old dual U.S. and Estonian citizen accused of belonging to Scattered Spider, and a Chicago federal judge ordered him held in custody June 30, with an unsealed complaint tying him to a 2025 breach of a luxury-jewelry retailer.
Scattered Spider is a loose collective known for social-engineering intrusions and extortion against major brands. Stokes faces charges of conspiracy, computer intrusion, and fraud.
Sources: BleepingComputer · The Record · The Hacker News · ↑ top
Latest developments: The Record reported July 1 that the U.S. lifted export controls on certain Anthropic frontier cybersecurity models after the company reached a series of agreements with the government, as Microsoft added a Teams admin policy requiring organizer approval before external AI bots join meetings, and a Tuskira study of Anthropic's Claude Mythos Preview found the system flagged 1,596 verified open-source vulnerabilities that overwhelm maintainers.
Governments and vendors are racing to set rules for AI that both attacks and defends code. Defenders gain powerful bug-finding models while inheriting a widening patch gap and new controls on automated meeting participants.
Sources: The Record · SecurityWeek · Help Net Security · ↑ top
Latest developments: Opera launched Paste Protect, a default-on clipboard defense that warns against ClickFix and pastejacking attacks, arriving as Dark Reading declared ClickFix the dominant malware-delivery technique after it accounted for more than half of malware-delivery attacks in 2025.
ClickFix tricks users into pasting attacker-supplied commands, and it has become the default lure across current campaigns. Opera's desktop browsers now block the technique automatically without setup.
Sources: Help Net Security · Dark Reading · ↑ top
Latest developments: Sysdig's Threat Research Team documented JADEPUFFER, what it calls the first ransomware intrusion an AI agent ran start to finish, with a large language model breaching the network through a Langflow remote-code-execution flaw, stealing credentials, moving laterally, then encrypting and wiping a production database.
The case shows a frontier model can now autonomously chain a full intrusion end to end. Organizations running Langflow should patch the remote-code-execution flaw and hunt for machine-speed credential theft and lateral movement.
Sources: The Hacker News · ↑ top
Latest developments: Synacktiv disclosed an unpatched flaw in the repo-server component of Argo CD, the widely used Kubernetes deployment tool, that lets an unauthenticated attacker who reaches the component's internal port run code and seize the entire cluster, with no fix and no CVE yet assigned.
Argo CD deploys software to Kubernetes across many enterprises, so a repo-server takeover exposes the whole cluster. Operators should restrict network access to the internal port until maintainers ship a patch.
Sources: The Hacker News · ↑ top
Latest developments: Russia fired 74 missiles and nearly 500 drones at Kyiv over several hours overnight July 2, killing at least 13 people in one of the war's largest single strikes on the Ukrainian capital.
The ballistic and cruise missiles and waves of drones battered Kyiv after President Volodymyr Zelenskyy warned Moscow was readying a massive strike; Ukraine's own long-range drone campaign has meanwhile choked Russian fuel supplies and disrupted supply lines.
Sources: FT World · WSJ World News · ↑ top
Latest developments: The Trump administration decided July 1 against renewing the U.S.-Mexico-Canada trade pact, switching instead to annual reviews of commerce with the two largest U.S. trading partners.
Washington will conduct rolling yearly reviews of the USMCA rather than extend it long term, adding uncertainty for companies that build goods across the North American supply chain.
Today: Sunny, high 97F.
Tonight: Mostly Clear, low 77F.
Friday: Sunny, high 98F.
Latest developments: Pittsburgh Mayor Corey O'Connor said July 1 his office is seeking a meeting with Kroger executives to understand their vision as Kroger's purchase of Giant Eagle nears.
Cincinnati grocer Kroger's pending acquisition of Giant Eagle, the region's dominant supermarket chain, has shoppers and the mayor's office questioning what changes lie ahead for local stores.
Latest developments: Heritage Valley Health System's hospitals in Beaver and Sewickley, along with multiple physician offices, officially became part of Allegheny Health Network on July 1.
The two hospitals and their affiliated doctors' offices now operate under Allegheny Health Network, extending the system's reach into Beaver County and Sewickley.
Latest developments: Chatham University leaders pushed back July 2 after the Shadyside school landed on a national list of colleges in 'dire straits financially,' arguing the ranking misses context.
Chatham University, the private institution in Pittsburgh's Shadyside neighborhood, contested its inclusion among financially troubled schools, with leaders saying there is more to its finances than the list conveys.
Sources: Pittsburgh Post-Gazette · ↑ top
Latest developments: Extreme heat warnings gripped the Pittsburgh area a third straight day July 2, with Thursday forecast as the week's hottest, feels-like temperatures topping 100 degrees, and storms possible into the Fourth of July weekend.
The warning covers most of western Pennsylvania, and heat advisories run through Friday night in the higher elevations of Indiana, Westmoreland, and Fayette counties.
Latest developments: A roughly 24-hour power outage struck New Brighton in Beaver County during the heat wave, leaving hundreds—including residents of a senior apartment building—without cooling before crews restored power July 1.
The extended outage coincided with dangerous heat, stranding senior-apartment residents in New Brighton who searched for any escape until electricity returned.
Latest developments: The Reserve Volunteer Fire Department proposed July 1 that Reserve Township levy a 1-mill fire operations tax to fund its work.
The volunteer department serving Reserve Township in Allegheny County asked township officials to impose a dedicated fire tax to support operations.
Latest developments: Pittsburgh laid out its America 250 plans, promising the biggest fireworks show in city history spanning Downtown, the North Shore, and Mount Washington on Saturday, July 4.
The celebration, voted the nation's best by USA Today readers, marks America's 250th birthday across the three riverfront districts with line dancing, Ferris wheel rides, and a performance by the Plain White T's.
Sources: KDKA · Pittsburgh Post-Gazette · ↑ top
Latest developments: Anthrocon, one of the world's largest furry conventions, returns to the David L. Lawrence Convention Center Downtown for its milestone 20th anniversary, running Thursday, July 2 through Sunday, July 5.
The convention brings thousands of costumed attendees to Downtown Pittsburgh, with a public Fursuit Parade among the anniversary events.
Sources: Pittsburgh Post-Gazette · NEXTpittsburgh Events · ↑ top
Latest developments: The Pittsburgh Symphony Orchestra's budget climbed $7 million to $42 million, driven partly by live film-music performances, the Post-Gazette analyzed July 1.
The PSO's expanded budget reflects growth in playing film scores live and other programming at Heinz Hall Downtown.
Sources: Post-Gazette Music · ↑ top
Latest developments: Spit Vision tops a seven-band bill at the Mr. Roboto Project in Garfield on Thursday, July 2.
Spit Vision, Hey! TV Boy!, Nothing, Darling, Arrf, Short Fictions, and Trace Remains play the Mr. Roboto Project at 5106 Penn Avenue in Garfield at 7 p.m., doors at 6:30 p.m., with $12 tickets available through therobotoproject.com.
Sources: Pittsburgh City Paper · ↑ top
Pirates (43-44)
Wed Jul 1 · Pirates 6 · Phillies 10 · Final
Phillies beat Paul Skenes and the Pirates 10-6 as Turner hits a 3-run homer
Up Next · Pirates @ Phillies · Thu Jul 2, 12:35 PM
Latest developments: The Pirates placed pitcher Seth Hernandez and outfielder Edward Florentino on the MLB All-Star Futures Game roster, the Post-Gazette reported July 1.
Top pitching prospect Seth Hernandez, recently the first minor leaguer this season to reach 100 strikeouts, and Edward Florentino will represent Pittsburgh in the annual showcase of the game's best prospects.
Sources: Post-Gazette Pirates · ↑ top
Latest developments: On the July 1 SNR Drive, Matt Williamson and Wes Uhler worked through ESPN writer Seth Walder's 2026 offseason grades for all 32 NFL teams, weighing Pittsburgh's moves.
The Steelers' team-produced show combed through ESPN's franchise-by-franchise report card and noted the videocast pauses during training camp, now a month away.
Sources: Pittsburgh Steelers (YouTube) · ↑ top
Latest developments: Post-Gazette columnist Noah Hiles argued July 2 that rookie Esmerlyn Valdez can become the middle-of-the-order bat the Pirates hoped to get from Marcell Ozuna.
Hiles wrote that Valdez, who has homered in several straight games, could give general manager Ben Cherington's Pirates the designated-hitter production Ozuna has failed to deliver.
Sources: Post-Gazette Pirates · ↑ top
Latest developments: The United States beat Bosnia and Herzegovina 2-0 in the World Cup round of 32 on Wednesday, July 1, its first knockout-round win since 2002, and advanced to the round of 16.
Folarin Balogun scored just before halftime and Malik Tillman converted a free kick as the co-host Americans, a man down for much of the second half, moved on at the tournament staged across the United States, Canada, and Mexico.
Sources: ESPN Soccer · Guardian World Cup 2026 · ↑ top
Latest developments: Folarin Balogun drew a controversial second-half red card against Bosnia and Herzegovina and will miss the round-of-16 match, with ESPN reporting officials misapplied VAR protocols in ejecting him.
Referees sent Balogun off for a collision with Bosnia's Tarik Muharemović, leaving coach Mauricio Pochettino incredulous and the United States without its top scorer for the next round.
Sources: ESPN Soccer · Guardian World Cup 2026 · ↑ top
Latest developments: The United States will face Belgium in the round of 16 after Belgium rallied from 2-0 down to beat Senegal 3-2 on a Youri Tielemans penalty deep in extra time.
Belgium's veteran side completed a comeback capped by the latest goal of the tournament, setting up a knockout meeting with the U.S., who must manage without the suspended Balogun.
Sources: ESPN Soccer · Guardian World Cup 2026 · ↑ top
S&P 500 7,426.91 = +0.0% Dow 52,120.78 ▲ +0.9% Nasdaq 25,746.02 ▼ -0.8% WTI crude 70.00 ▼ -5.9% EUR/USD 1.1387 ▼ -0.5% GBP/USD 1.3211 ▼ -0.2% USD/JPY 161.98 ▲ +0.4%