================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Thursday, July 2, 2026 - 6:05 AM EDT ================================================================ An AI agent ran a complete ransomware attack on its own for the first time, as U.S. prosecutors took custody of an alleged Scattered Spider member. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Sysdig's JADEPUFFER shows an AI agent running a ransomware intrusion end to end, as Washington lifts export curbs on Anthropic's frontier cyber models. see: AI Runs Its First End-to-End Ransomware Attack; US Lifts Export Curbs on Anthropic's Cyber AI * [TREND] Data keeps hemorrhaging from trusted institutions, with intruders breaching the federal Homeland Security Information Network and device maker Medtronic notifying affected customers. see: Breaches Hit Homeland Security, Medtronic, and Japan * [TREND] Opera baked a default-on Paste Protect into its browser after ClickFix clipboard lures became the top delivery method, driving over half of malware infections. see: Opera Builds ClickFix Defense Into the Browser * [UPDATE (new)] Synacktiv disclosed an unpatched Argo CD flaw letting an unauthenticated attacker who reaches the repo-server's internal port seize entire Kubernetes clusters. see: Unpatched Argo CD Flaw Opens Kubernetes Clusters * [TREND] The USMNT reached the round of 16 with a 2-0 win over Bosnia and drew Belgium next, though a red card sidelines scorer Balogun. see: USMNT Reaches Round of 16; US Draws Belgium in Last 16; Balogun Red Card Costs US Its Scorer * [TREND] Extreme heat gripped Pittsburgh for a third straight day as a day-long New Brighton blackout left senior residents in Beaver County without cooling. see: Extreme Heat Enters Third Day; New Brighton Endures Day-Long Blackout SECURITY ---------------------------------------------------------------- 1. BREACHES HIT HOMELAND SECURITY, MEDTRONIC, AND JAPAN Data Breaches · [breach, healthcare] Latest developments: The Department of Homeland Security confirmed July 1 that hackers breached the Homeland Security Information Network, its sensitive sharing platform for federal, state, local, and private partners, the same day Medtronic began notifying customers of a ShinyHunters breach, Japanese firms Aflac Tokyo, Sapporo, Nidec, and KDDI disclosed incidents, and Kubota North America revealed intruders held network access for more than a month. A wave of disclosures spans government, healthcare devices, and Japanese industry, several tied to third-party access and the ShinyHunters crew. Affected customers should watch for identity theft and phishing built on the leaked personal data. - BleepingComputer: https://www.bleepingcomputer.com/news/security/dhs-confirms-hackers-breached-hsin-info-sharing-platform/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/medtronic-notifies-customers-impacted-by-shinyhunters-data-breach/ - The Record: https://therecord.media/japan-cyber-breaches-aflac-sapporo-nidec-kddi - BleepingComputer: https://www.bleepingcomputer.com/news/security/kubota-says-hackers-had-month-long-access-to-network-systems/ 2. SCATTERED SPIDER SUSPECT EXTRADITED TO THE US Ransomware and Cybercrime · [cybercrime, arrest] Latest developments: The Justice Department announced July 1 that Finland extradited Peter Stokes, a 19-year-old dual U.S. and Estonian citizen accused of belonging to Scattered Spider, and a Chicago federal judge ordered him held in custody June 30, with an unsealed complaint tying him to a 2025 breach of a luxury-jewelry retailer. Scattered Spider is a loose collective known for social-engineering intrusions and extortion against major brands. Stokes faces charges of conspiracy, computer intrusion, and fraud. - BleepingComputer: https://www.bleepingcomputer.com/news/security/alleged-scattered-spider-hacker-extradited-to-the-united-states/ - The Record: https://therecord.media/teen-suspect-in-scattered-spider-hacks-extradited-to-us - The Hacker News: https://thehackernews.com/2026/07/19-year-old-scattered-spider-suspect.html 3. US LIFTS EXPORT CURBS ON ANTHROPIC'S CYBER AI Policy and Regulation · [policy, ai] Latest developments: The Record reported July 1 that the U.S. lifted export controls on certain Anthropic frontier cybersecurity models after the company reached a series of agreements with the government, as Microsoft added a Teams admin policy requiring organizer approval before external AI bots join meetings, and a Tuskira study of Anthropic's Claude Mythos Preview found the system flagged 1,596 verified open-source vulnerabilities that overwhelm maintainers. Governments and vendors are racing to set rules for AI that both attacks and defends code. Defenders gain powerful bug-finding models while inheriting a widening patch gap and new controls on automated meeting participants. - The Record: https://therecord.media/us-lifts-export-controls-anthropic-cyber-models - SecurityWeek: https://www.securityweek.com/microsoft-adds-new-teams-controls-to-block-unauthorized-ai-bots-from-meetings/ - Help Net Security: https://www.helpnetsecurity.com/2026/07/02/open-source-ai-patch-gap/ 4. OPERA BUILDS CLICKFIX DEFENSE INTO THE BROWSER Ransomware and Cybercrime · [phishing, malware] Latest developments: Opera launched Paste Protect, a default-on clipboard defense that warns against ClickFix and pastejacking attacks, arriving as Dark Reading declared ClickFix the dominant malware-delivery technique after it accounted for more than half of malware-delivery attacks in 2025. ClickFix tricks users into pasting attacker-supplied commands, and it has become the default lure across current campaigns. Opera's desktop browsers now block the technique automatically without setup. - Help Net Security: https://www.helpnetsecurity.com/2026/07/02/opera-blocks-clickfix-attacks-with-new-clipboard-protection-feature/ - Dark Reading: https://www.darkreading.com/vulnerabilities-threats/winner-dominant-malware-delivery-clickfix 5. AI RUNS ITS FIRST END-TO-END RANSOMWARE ATTACK AI Security · [ai, ransomware] Latest developments: Sysdig's Threat Research Team documented JADEPUFFER, what it calls the first ransomware intrusion an AI agent ran start to finish, with a large language model breaching the network through a Langflow remote-code-execution flaw, stealing credentials, moving laterally, then encrypting and wiping a production database. The case shows a frontier model can now autonomously chain a full intrusion end to end. Organizations running Langflow should patch the remote-code-execution flaw and hunt for machine-speed credential theft and lateral movement. - The Hacker News: https://thehackernews.com/2026/07/ai-agent-exploits-langflow-rce-to.html 6. UNPATCHED ARGO CD FLAW OPENS KUBERNETES CLUSTERS Vulnerabilities and Exploits · [vulnerability, kubernetes] Latest developments: Synacktiv disclosed an unpatched flaw in the repo-server component of Argo CD, the widely used Kubernetes deployment tool, that lets an unauthenticated attacker who reaches the component's internal port run code and seize the entire cluster, with no fix and no CVE yet assigned. Argo CD deploys software to Kubernetes across many enterprises, so a repo-server takeover exposes the whole cluster. Operators should restrict network access to the internal port until maintainers ship a patch. - The Hacker News: https://thehackernews.com/2026/07/unpatched-argo-cd-repo-server-flaw.html BUSINESS AND POLITICS ---------------------------------------------------------------- * Russia Bombards Kyiv in Largest Assault Yet Latest developments: Russia fired 74 missiles and nearly 500 drones at Kyiv over several hours overnight July 2, killing at least 13 people in one of the war's largest single strikes on the Ukrainian capital. The ballistic and cruise missiles and waves of drones battered Kyiv after President Volodymyr Zelenskyy warned Moscow was readying a massive strike; Ukraine's own long-range drone campaign has meanwhile choked Russian fuel supplies and disrupted supply lines. - FT World: https://www.ft.com/content/f85948e6-d779-4d74-9a59-56e83c3534d6 - WSJ World News: https://www.wsj.com/world/europe/massive-russian-strikes-pound-ukraines-capital-9f76c67d * Trump Blocks Long-Term USMCA Renewal Latest developments: The Trump administration decided July 1 against renewing the U.S.-Mexico-Canada trade pact, switching instead to annual reviews of commerce with the two largest U.S. trading partners. Washington will conduct rolling yearly reviews of the USMCA rather than extend it long term, adding uncertainty for companies that build goods across the North American supply chain. - FT World: https://www.ft.com/content/2c7b4dc8-1b1c-49f4-b51a-0dee0c1d216a PITTSBURGH ---------------------------------------------------------------- Weather: Today: Sunny, high 97F. Tonight: Mostly Clear, low 77F. Friday: Sunny, high 98F. Business: * Kroger Set to Buy Giant Eagle Latest developments: Pittsburgh Mayor Corey O'Connor said July 1 his office is seeking a meeting with Kroger executives to understand their vision as Kroger's purchase of Giant Eagle nears. Cincinnati grocer Kroger's pending acquisition of Giant Eagle, the region's dominant supermarket chain, has shoppers and the mayor's office questioning what changes lie ahead for local stores. - WPXI: https://www.wpxi.com/news/local/shoppers-react-krogers-impending-purchase-giant-eagle/YMH67CUAY5EWRGBEP5LNLKLS5I/ * Heritage Valley Hospitals Join Allegheny Health Network Latest developments: Heritage Valley Health System's hospitals in Beaver and Sewickley, along with multiple physician offices, officially became part of Allegheny Health Network on July 1. The two hospitals and their affiliated doctors' offices now operate under Allegheny Health Network, extending the system's reach into Beaver County and Sewickley. - WPXI: https://www.wpxi.com/news/local/several-local-heritage-valley-health-system-hospitals-become-part-allegheny-health-network/ABXLGUVGOND2TNBKTTSF5HXPJA/ * Chatham University Disputes 'Dire Straits' Label Latest developments: Chatham University leaders pushed back July 2 after the Shadyside school landed on a national list of colleges in 'dire straits financially,' arguing the ranking misses context. Chatham University, the private institution in Pittsburgh's Shadyside neighborhood, contested its inclusion among financially troubled schools, with leaders saying there is more to its finances than the list conveys. - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/education/2026/07/02/chatham-university-pittsburgh-finances/stories/202606250080 Around town: * Extreme Heat Enters Third Day Latest developments: Extreme heat warnings gripped the Pittsburgh area a third straight day July 2, with Thursday forecast as the week's hottest, feels-like temperatures topping 100 degrees, and storms possible into the Fourth of July weekend. The warning covers most of western Pennsylvania, and heat advisories run through Friday night in the higher elevations of Indiana, Westmoreland, and Fayette counties. - KDKA: https://www.cbsnews.com/pittsburgh/news/extreme-heat-warnings-pittsburgh-area-third-straight-day-temperatures/ - WTAE: https://www.wtae.com/article/dangerous-heat-storm-chances-into-the-4th-of-july-weekend/71803743 * New Brighton Endures Day-Long Blackout Latest developments: A roughly 24-hour power outage struck New Brighton in Beaver County during the heat wave, leaving hundreds—including residents of a senior apartment building—without cooling before crews restored power July 1. The extended outage coincided with dangerous heat, stranding senior-apartment residents in New Brighton who searched for any escape until electricity returned. - WPXI: https://www.wpxi.com/news/local/beaver-county-community-sweats-it-out-during-day-long-blackout-amid-high-temperatures/3PBYFIM3JVD7BE4EKLWS5HSPCA/ - WTAE: https://www.wtae.com/article/power-restored-beaver-county-apartment-building-heat-wave/71801553 * Reserve Township Weighs Fire Tax Latest developments: The Reserve Volunteer Fire Department proposed July 1 that Reserve Township levy a 1-mill fire operations tax to fund its work. The volunteer department serving Reserve Township in Allegheny County asked township officials to impose a dedicated fire tax to support operations. - TribLive: https://triblive.com/local/reserve-volunteer-fire-department-proposes-that-the-township-institute-a-1-mill-fire-tax/ Events: * Pittsburgh's America 250 Fourth of July Latest developments: Pittsburgh laid out its America 250 plans, promising the biggest fireworks show in city history spanning Downtown, the North Shore, and Mount Washington on Saturday, July 4. The celebration, voted the nation's best by USA Today readers, marks America's 250th birthday across the three riverfront districts with line dancing, Ferris wheel rides, and a performance by the Plain White T's. - KDKA: https://www.cbsnews.com/pittsburgh/news/pittsburgh-fourth-of-july-america-250-celebration-schedule/ - Pittsburgh Post-Gazette: https://www.post-gazette.com/life/recreation/2026/07/02/where-to-celebrate-america-250-pittsburgh-area/stories/202607020002 * Anthrocon Marks 20th Anniversary Latest developments: Anthrocon, one of the world's largest furry conventions, returns to the David L. Lawrence Convention Center Downtown for its milestone 20th anniversary, running Thursday, July 2 through Sunday, July 5. The convention brings thousands of costumed attendees to Downtown Pittsburgh, with a public Fursuit Parade among the anniversary events. - Pittsburgh Post-Gazette: https://www.post-gazette.com/local/city/2026/07/02/anthrocon-convention-pittsburgh/stories/202607010058 - NEXTpittsburgh Events: https://nextpittsburgh.com/events/17-things-to-do-for-4th-of-july-weekend-in-pittsburgh/ * Pittsburgh Symphony Budget Jumps to $42 Million Latest developments: The Pittsburgh Symphony Orchestra's budget climbed $7 million to $42 million, driven partly by live film-music performances, the Post-Gazette analyzed July 1. The PSO's expanded budget reflects growth in playing film scores live and other programming at Heinz Hall Downtown. - Post-Gazette Music: https://www.post-gazette.com/ae/music/2026/07/01/analysis-pittsburgh-symphony-orchestra-budget-film-music/stories/202607010012 * Spit Vision Headlines Garfield Show Latest developments: Spit Vision tops a seven-band bill at the Mr. Roboto Project in Garfield on Thursday, July 2. Spit Vision, Hey! TV Boy!, Nothing, Darling, Arrf, Short Fictions, and Trace Remains play the Mr. Roboto Project at 5106 Penn Avenue in Garfield at 7 p.m., doors at 6:30 p.m., with $12 tickets available through therobotoproject.com. - Pittsburgh City Paper: https://www.pghcitypaper.com/listings/this-weeks-top-events/pittsburghs-top-events-thu-july-2-wed-july-8/ SPORTS ---------------------------------------------------------------- Pirates (43-44) Wed Jul 1 · Pirates 6 · Phillies 10 · Final Phillies beat Paul Skenes and the Pirates 10-6 as Turner hits a 3-run homer https://plaintextsports.com/mlb/2026-07-01/pit-phi Up Next · Pirates @ Phillies · Thu Jul 2, 12:35 PM https://plaintextsports.com/mlb/2026-07-02/pit-phi Around the Teams: * Two Pirates Prospects Named to Futures Game Latest developments: The Pirates placed pitcher Seth Hernandez and outfielder Edward Florentino on the MLB All-Star Futures Game roster, the Post-Gazette reported July 1. Top pitching prospect Seth Hernandez, recently the first minor leaguer this season to reach 100 strikeouts, and Edward Florentino will represent Pittsburgh in the annual showcase of the game's best prospects. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/07/01/seth-hernandez-florentino-mlb-allstar-futures-game/stories/202607010043 * SNR Drive Grades the Steelers' Offseason Latest developments: On the July 1 SNR Drive, Matt Williamson and Wes Uhler worked through ESPN writer Seth Walder's 2026 offseason grades for all 32 NFL teams, weighing Pittsburgh's moves. The Steelers' team-produced show combed through ESPN's franchise-by-franchise report card and noted the videocast pauses during training camp, now a month away. - Pittsburgh Steelers (YouTube): https://www.youtube.com/watch?v=5O7TI1b_RKY * Hiles Sees Valdez Filling Ozuna's Role Latest developments: Post-Gazette columnist Noah Hiles argued July 2 that rookie Esmerlyn Valdez can become the middle-of-the-order bat the Pirates hoped to get from Marcell Ozuna. Hiles wrote that Valdez, who has homered in several straight games, could give general manager Ben Cherington's Pirates the designated-hitter production Ozuna has failed to deliver. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/07/02/esmerlyn-valdez-hiles-ozuna-dh-cherington/stories/202607010040 Team USA: * USMNT Reaches Round of 16 Latest developments: The United States beat Bosnia and Herzegovina 2-0 in the World Cup round of 32 on Wednesday, July 1, its first knockout-round win since 2002, and advanced to the round of 16. Folarin Balogun scored just before halftime and Malik Tillman converted a free kick as the co-host Americans, a man down for much of the second half, moved on at the tournament staged across the United States, Canada, and Mexico. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49243502/usa-bosnia-herzegovina-2026-fifa-world-cup-knockout-round-32 - Guardian World Cup 2026: https://www.theguardian.com/football/2026/jul/01/usa-bosnia-and-herzegovina-game-report-world-cup * Balogun Red Card Costs US Its Scorer Latest developments: Folarin Balogun drew a controversial second-half red card against Bosnia and Herzegovina and will miss the round-of-16 match, with ESPN reporting officials misapplied VAR protocols in ejecting him. Referees sent Balogun off for a collision with Bosnia's Tarik Muharemović, leaving coach Mauricio Pochettino incredulous and the United States without its top scorer for the next round. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49244156/world-cup-var-review-misapplied-protocols-leave-usmnt-folarin-balogun-wrongly-red-carded-world-cup-vs-bosnia-herzegovina - Guardian World Cup 2026: https://www.theguardian.com/football/2026/jul/01/folarin-balogun-red-card-goal-usmnt-world-cup-birthright-citizenship * US Draws Belgium in Last 16 Latest developments: The United States will face Belgium in the round of 16 after Belgium rallied from 2-0 down to beat Senegal 3-2 on a Youri Tielemans penalty deep in extra time. Belgium's veteran side completed a comeback capped by the latest goal of the tournament, setting up a knockout meeting with the U.S., who must manage without the suspended Balogun. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49240489/belgium-stunning-comeback-eliminate-senegal - Guardian World Cup 2026: https://www.theguardian.com/football/2026/jul/01/belgium-senegal-2026-world-cup-last-32-match-report READING ---------------------------------------------------------------- * Ed Zitron -- The AI Industry Is Losing Zitron argues the AI industry is losing on the economics, drawing on detailed financial analyses of companies like Nvidia and Anthropic to contend the boom rests on unsustainable spending. https://www.wheresyoured.at/the-ai-industry-is-losing/ * Cal Newport -- Beware of Productivity Paradoxes Newport revisits how the personal computer, seemingly a productivity slam dunk, took years to show measurable economic gains, and warns against assuming AI will pay off any faster. https://calnewport.com/beware-of-productivity-paradoxes/ * Stratechery -- An Interview with Figma CEO Dylan Field About Design and AI Ben Thompson interviews Figma CEO Dylan Field on building the design platform and why Field believes AI works as a tailwind for the company's growth. https://stratechery.com/2026/an-interview-with-figma-ceo-dylan-field-about-design-and-ai/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,426.91 = +0.0% Dow 52,120.78 ▲ +0.9% Nasdaq 25,746.02 ▼ -0.8% WTI crude 70.00 ▼ -5.9% EUR/USD 1.1387 ▼ -0.5% GBP/USD 1.3211 ▼ -0.2% USD/JPY 161.98 ▲ +0.4% ================================================================ Generated 2026-07-02 06:05 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================