daily plain-text briefing: security, markets, business, and pittsburgh
Researchers exposed a new modular ransomware framework and a North Korea-linked npm supply-chain attack as capable Chinese AI models widened the gap between attackers and defenders.
Latest developments: Dark Reading warned July 3 that two new Chinese-built large language models now rival top US frontier models, widening the gap attackers exploit, a day after SecurityWeek detailed an LLM agent running a full ransomware intrusion through a Langflow remote-code-execution flaw.
Cheaper, capable Chinese models lower the bar for AI-assisted offense while agentic tooling automates multi-stage intrusions; defenders should assume adversaries now chain exploitation with real-time AI reasoning.
Sources: Dark Reading · SecurityWeek · ↑ top
Latest developments: Researchers disclosed July 3 Avalon, a previously undocumented modular malware framework that a multi-stage phishing chain delivers while slipping past traditional controls, bundling CrownX ransomware alongside credential theft, lateral movement, and recovery disruption in one kit.
Avalon unifies credential collection, remote access, lateral movement, backup disruption, and file encryption under a single framework, letting one operator run an intrusion end to end; defenders should harden phishing defenses and watch for backup-tampering behavior.
Sources: The Hacker News · ↑ top
Latest developments: Kaspersky named July 3 Armored Likho, a previously undocumented threat actor striking government agencies and the electric power sector across Russia, Brazil, and Kazakhstan with the new BusySnake stealer, blending financial theft against individuals with espionage against organizations.
Armored Likho pairs financially motivated attacks on individuals with cyber espionage aimed at government and power-sector organizations, deploying the BusySnake stealer; affected sectors should hunt for the malware and tighten access controls.
Sources: The Hacker News · ↑ top
Latest developments: JFrog attributed July 3 two malicious npm packages, rollup-packages-polyfill-core and rollup-runtime-polyfill-core, to North Korea-linked actors who cloned the legitimate rollup-plugin-polyfill-node down to its description and repository metadata to plant remote access and steal developer secrets.
The packages masquerade as Rollup polyfill tooling to compromise developer machines and exfiltrate credentials and secrets; teams should audit npm dependencies and remove the two named packages.
Sources: The Hacker News · ↑ top
Latest developments: Bruce Schneier highlighted July 3 a 2024 Flock Safety presentation showing its Vehicle Fingerprint feature lets police search cars by decals, bumper stickers, roof and rear racks, and temporary state tags even when no license plate is visible.
Flock Safety's automated license-plate reader network expands surveillance to identify vehicles by physical features, letting law enforcement track cars that lack readable plates and raising mass-surveillance and privacy concerns.
Sources: Schneier on Security · ↑ top
Latest developments: Iran opened six days of funeral ceremonies for supreme leader Ayatollah Ali Khamenei on July 4, staging the mourning as a show of defiance toward the United States and predicting 20 million attendees.
An airstrike killed Ayatollah Ali Khamenei, Iran's supreme leader of 36 years, at the start of the recent war with Israel and the United States; dignitaries from more than 100 nations gathered in Tehran under tight security as the Islamic Republic sought to project strength and stability through the 86-year-old cleric's funeral.
Sources: WSJ World News · FT World · ↑ top
Independence Day: Mostly Sunny then Chance Showers And Thunderstorms, high 95F.
Tonight: Showers And Thunderstorms Likely then Chance Showers And Thunderstorms, low 71F.
Sunday: Slight Chance Showers And Thunderstorms then Chance Showers And Thunderstorms, high 88F.
Latest developments: A Post-Gazette analysis published July 4 gauges how Pennsylvanians feel the effects of President Trump's second-term tax law a year after enactment, and how polling on it shapes the 2026 midterm fight.
One year after President Trump signed his signature tax law, Pennsylvania voters are sorting its winners and losers, a divide both parties aim to turn to advantage in the state's 2026 midterm elections.
Sources: Pittsburgh Post-Gazette · ↑ top
Latest developments: The federal Trump Accounts program went live Saturday, July 4, opening $1,000 stock-market investment accounts for babies born during President Trump's second term.
The White House seeds $1,000 into a stock-market investment account for each qualifying newborn during President Trump's second term, money families across western Pennsylvania can grow over the child's life.
Latest developments: A Post-Gazette report July 4 finds Charleroi, the Washington County borough remade by Haitian immigrants, facing an uncertain future after a Supreme Court ruling left the fate of Temporary Protected Status recipients unresolved.
Charleroi, a Mon Valley borough whose population and storefronts Haitian immigrants holding Temporary Protected Status revived, confronts economic and civic uncertainty as a Supreme Court decision leaves those residents' legal standing in doubt.
Sources: Pittsburgh Post-Gazette · ↑ top
Latest developments: The National Weather Service extended its extreme heat warning through 8 p.m. Saturday, July 4—a fourth straight day in the mid-90s across Allegheny, Washington, Greene, Westmoreland, and Fayette counties—while forecasters flagged scattered thunderstorms that could disrupt evening fireworks.
A prolonged heat wave pushed feels-like temperatures near 100 degrees across western Pennsylvania through the Independence Day holiday, straining residents and threatening the region's outdoor celebrations with afternoon storms.
Latest developments: Pittsburgh stages its Fourth of July celebration Saturday night, July 4, with the city's largest-ever fireworks show proceeding under an extreme heat warning and a threat of scattered evening thunderstorms.
Pittsburgh's Independence Day program—voted the nation's best by USA Today readers—spans downtown, the North Shore, and Mount Washington on Saturday, July 4, featuring line dancing, Ferris wheel rides, a Plain White T's performance, and the biggest fireworks display in city history.
Latest developments: Anthrocon scrapped its signature 2026 Fursuit Parade and Block Party, set for Saturday, July 4, citing the extreme heat and severe-weather forecast, and moved to indoor activities.
Anthrocon, one of the world's largest furry conventions, runs through Sunday, July 5, at the David L. Lawrence Convention Center downtown for its 20th anniversary, though organizers dropped Saturday's iconic outdoor parade over the dangerous heat.
Pirates (44-45)
Fri Jul 3 · Pirates 5 · Nationals 9 · Final
García and Lile each homer twice as the Nationals rout the Pirates 9-5
Up Next · Pirates @ Nationals · Sat Jul 4, 11:05 AM
Latest developments: A July 4 Post-Gazette 'Off The Bat' details how rookie Esmerlyn Valdez has become, in teammates' words, 'a dude,' pushing into the middle of the order as an All-Star candidate.
Pirates rookie Esmerlyn Valdez, whom Post-Gazette writers compare to what the club hoped for from the departed Marcell Ozuna, has forced his way into Pittsburgh's lineup as a run producer amid a season of teamwide pitching struggles.
Sources: Post-Gazette Pirates · ↑ top
Latest developments: Post-Gazette columnist Noah Hiles published a July 3 deep dive spreading blame for ace Paul Skenes' struggles across the pitching coaches and catchers after Skenes surrendered a career-high eight runs to the Phillies.
Pirates ace Paul Skenes, the face of the franchise, has labored through a string of rough starts, and the Post-Gazette weighs how the coaching staff and battery share responsibility for his mechanical breakdown.
Sources: Post-Gazette Pirates · ↑ top
Latest developments: On the July 1 SNR Drive, Steelers analysts Matt Williamson and Wes Uhler broke down ESPN writer Seth Walder's offseason report card for the team, assessing additions like quarterback Aaron Rodgers and receiver DK Metcalf ahead of training camp.
The Steelers' team channel weighed ESPN's grade on Pittsburgh's roster overhaul—headlined by the arrivals of Aaron Rodgers and DK Metcalf—as the club heads toward camp.
Sources: Pittsburgh Steelers (YouTube) · ↑ top
Latest developments: With the World Cup round of 16 opening July 4, the United States prepares to meet Belgium missing suspended striker Folarin Balogun, who called the aftermath of his red card 'surreal,' confirmed his one-match ban will hold, and leaves Ricardo Pepi and Haji Wright as replacement options.
The United States, co-hosting the 2026 World Cup, reached the round of 16 by beating Bosnia and Herzegovina and sits one win from matching its best modern-era run, though it must attack Belgium without leading scorer Folarin Balogun, ejected on a red card.
Sources: Guardian World Cup 2026 · ESPN Soccer · ↑ top
Latest developments: United States forward Trinity Rodman marked her NWSL return July 3 with two goals, including a stoppage-time winner, lifting the Washington Spirit past the Houston Dash 2-1.
Trinity Rodman, a United States women's national team forward, returned to the field for the Washington Spirit and scored twice—capping the 2-1 win over the Houston Dash in stoppage time.
Sources: ESPN Soccer · ↑ top
S&P 500 7,452.06 ▲ +0.6% Dow 52,316.67 ▲ +1.1% Nasdaq 25,840.84 ▲ +0.1% WTI crude 69.26 ▼ -3.7% EUR/USD 1.1415 ▲ +0.3% GBP/USD 1.3264 ▲ +0.5% USD/JPY 161.98 ▲ +0.2%