daily plain-text briefing: security, markets, business, and pittsburgh
North Korea floods open-source registries with 108 malicious packages as ransomware crews escalate their exploitation of Citrix and Fortinet appliances.
Latest developments: North Korea's Contagious Interview crew published 108 malicious packages and browser extensions across npm, Packagist, Go, and the Chrome Web Store in a campaign researchers named PolinRider, dwarfing the two rollup polyfill packages disclosed a day earlier.
The actors compromise maintainer accounts to plant remote-access code and harvest developer secrets, and the campaign stays active with fresh packages likely to keep appearing. Developers should audit dependencies and pin trusted versions.
Sources: The Hacker News · ↑ top
Latest developments: The FBI seized hundreds of NetNut domains, and Krebs identified the operator as publicly traded Israeli firm Alarum Technologies (NASDAQ: ALAR), naming the underlying Popa botnet of at least 2 million compromised devices, including smart TVs and streaming boxes.
NetNut rented access to millions of hijacked home devices, letting cybercriminals and nation-state actors mask their traffic. Google, Lumen, and the FBI cut the usable device pool by millions.
Sources: Krebs on Security · The Hacker News · SecurityWeek · ↑ top
Latest developments: Prosecutors named the extradited suspect as 19-year-old Peter Stokes, an alleged Scattered Spider member tied to a group linked to more than 100 network intrusions and over $100 million in ransom payments.
Stokes faces U.S. charges over attacks including a luxury jewelry retailer breach that drove an $8 million cryptocurrency ransom demand. The retailer expelled the intruders before paying, absorbing at least $2 million in disruption losses.
Sources: SecurityWeek · Help Net Security · ↑ top
Latest developments: Anubis ransomware affiliates began exploiting Citrix Bleed 2 (CVE-2025-5777) for initial access, attackers weaponized a freshly disclosed NetScaler memory-disclosure flaw within hours of its public proof-of-concept, and FortiBleed operators added a Nextcloud zero-day to their Fortinet foothold while monetizing through the Inc and Lynx gangs.
Ransomware crews chain edge-appliance flaws, bring-your-own-vulnerable-driver tricks, and stolen supply-chain credentials to break into networks. Administrators should patch NetScaler and Fortinet devices and hunt for remote-management tool abuse.
Sources: The Hacker News · SecurityWeek · Dark Reading · ↑ top
Latest developments: Apple abandoned its long-standing patch cadence for compressed emergency cycles, citing attackers who use artificial intelligence to shorten the gap between disclosure and exploitation.
The shift signals faster, more frequent Apple security updates across iOS and macOS as AI accelerates exploit development. Organizations should expect and deploy out-of-band fixes sooner.
Sources: Dark Reading · ↑ top
Latest developments: Max Schrems' privacy group noyb told European officials it will sue to invalidate the EU-U.S. Data Privacy Framework after a U.S. Supreme Court decision undercut the legal basis for transatlantic data transfers.
A successful challenge would strand personal-data flows from the EU to thousands of U.S. companies, echoing the earlier collapse of Safe Harbor and Privacy Shield. Firms relying on the framework should prepare alternative transfer mechanisms.
Sources: The Record · ↑ top
Independence Day: Mostly Sunny then Chance Showers And Thunderstorms, high 95F.
Tonight: Showers And Thunderstorms Likely then Chance Showers And Thunderstorms, low 71F.
Sunday: Slight Chance Showers And Thunderstorms then Chance Showers And Thunderstorms, high 88F.
Latest developments: TribLive reported July 4 that residents still cannot get answers about the project's long-term plan.
A proposed data center in Upper Burrell Township, Westmoreland County, has drawn resident frustration, with Lisa Scherf and neighbors saying local officials have offered little clarity about the development's scale and future.
Latest developments: Pittsburgh Public Safety said July 3 the casino threat appears to be a swatting hoax.
A reported threat at Rivers Casino on Pittsburgh's North Shore Friday night drew a large response from Pittsburgh and Pennsylvania state police, who now investigate it as a swatting incident.
Latest developments: WPXI reported July 4 that the man is home after a surprise release.
A Butler County man returned home after months in U.S. Immigration and Customs Enforcement detention ended with an unexpected release, closing what his family called an extremely difficult ordeal.
Latest developments: The National Weather Service's extreme heat warning expires at 8 p.m. Saturday, July 4, capping a fifth straight day near or above 90 degrees.
Temperatures across Allegheny, Washington, Greene, Westmoreland, and Fayette counties surged near 100 degrees on July 4 as the region's heat wave peaked, with scattered afternoon thunderstorms threatening evening fireworks before warnings lift at 8 p.m.
Latest developments: NEXTpittsburgh's July guide, published June 29, maps the month's festival calendar.
Pittsburgh's summer festival season runs through July, headlined by Picklesburgh downtown and the Goat Fest, per NEXTpittsburgh's monthly roundup of things to do across the region.
Sources: NEXTpittsburgh Events · ↑ top
Pirates (44-45)
Fri Jul 3 · Pirates 5 · Nationals 9 · Final
García and Lile each homer twice as the Nationals rout the Pirates 9-5
Up Next · Pirates @ Nationals · Sat Jul 4, 11:05 AM
Latest developments: Post-Gazette beat writer Christopher Carter took reader questions in a July 2 live chat.
In a July 2 reader chat, Post-Gazette Steelers writer Christopher Carter addressed the offseason additions of quarterback Aaron Rodgers and receiver DK Metcalf, along with cornerback Joey Porter Jr.'s situation, ahead of training camp.
Sources: Post-Gazette Steelers · ↑ top
Latest developments: A Post-Gazette feature July 3 detailed how Pirates players endure games in the extreme heat.
The Post-Gazette reported July 3 that Pirates players described themselves as 'just trying to survive' games in triple-digit temperatures, laying out the cooling methods they lean on during the region's heat wave.
Sources: Post-Gazette Pirates · ↑ top
Latest developments: With the World Cup field cutting from 32 to 16 on July 4, the United States now awaits Belgium and must cover for suspended striker Folarin Balogun.
The United States reached the World Cup round of 16 and will play Belgium without Folarin Balogun, whose one-match ban for his red card against Bosnia and Herzegovina stands, leaving coach Mauricio Pochettino to choose between Ricardo Pepi and Haji Wright up front.
Sources: ESPN Soccer · ↑ top
Latest developments: ESPN noted July 4 that U.S. coach Mauricio Pochettino threw a ceremonial first pitch at a Major League Baseball game.
United States men's national team coach Mauricio Pochettino became the latest World Cup figure to throw out a ceremonial first pitch at an MLB game during the tournament's stay in America.
Sources: ESPN Soccer · ↑ top
S&P 500 7,452.06 ▲ +0.6% Dow 52,316.67 ▲ +1.1% Nasdaq 25,840.84 ▲ +0.1% WTI crude 69.26 ▼ -3.7% EUR/USD 1.1415 ▲ +0.3% GBP/USD 1.3264 ▲ +0.5% USD/JPY 161.98 ▲ +0.2%