================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Sunday, July 5, 2026 - 6:05 AM EDT ================================================================ Artificial intelligence crossed a line as the JadePuffer agent ran an entire ransomware attack on its own, while North Korea flooded open-source registries with 108 malicious packages. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Attackers are weaponizing AI end to end, as JadePuffer autonomously drove a full ransomware breach while North Korea's PolinRider crew flooded npm and Chrome with 108 malicious packages. see: JadePuffer AI Agent Runs Full Ransomware Attack; PolinRider Floods Open-Source Registries * [TREND] Rushed AI features are piling up security debt, with LLM-introduced flaws ranking high-risk more often and lingering unpatched longer than other vulnerabilities. see: AI Features Pile Up Security Debt * [UPDATE (new)] Ukraine's intensified drone strikes on Russian refineries and pipelines have triggered what the Financial Times calls Russia's worst fuel crisis in decades. see: Ukraine Drone Strikes Ignite Russian Fuel Crisis * [TREND] The Reading list keeps interrogating AI's payoff, as Zitron argues the industry is losing, Newport warns of productivity paradoxes, and Figma's Dylan Field calls it a tailwind. see: The AI Industry Is Losing; Beware of Productivity Paradoxes; An Interview with Figma CEO Dylan Field About Design and AI * [UPDATE (new)] Apple's Hide My Email, the iCloud+ relay feature, fails to conceal users' real addresses in some cases, Wired reported. see: Apple Hide My Email Leaks Real Addresses * [UPDATE (new)] Around town, PennDOT's 25-day Parkway East closure begins July 10 while lingering storms follow the broken heat wave that cut power to thousands. see: Parkway East Closure Begins This Week; Heat Wave Breaks, Storms Linger SECURITY ---------------------------------------------------------------- 1. AI FEATURES PILE UP SECURITY DEBT AI Security · [ai, vulnerability] Latest developments: Help Net Security's July 5 week-in-review flagged a hardening pattern: the vulnerabilities that AI and LLM features introduce rank high-risk far more often than other flaws and take longer to fix. As vendors bolt AI capabilities onto existing products, the resulting flaws skew severe and linger; security teams should fold AI features into the same threat models and patch cadence as core code. - Help Net Security: https://www.helpnetsecurity.com/2026/07/05/week-in-review-simplehelp-vulnerability-exploited-oracle-ebs-payments-flaw-under-attack/ 2. POLINRIDER FLOODS OPEN-SOURCE REGISTRIES Nation-State Activity · [apt, supply-chain] Latest developments: North Korea's Contagious Interview actors published 108 malicious packages and browser extensions across npm, Packagist, Go, and Chrome under the PolinRider label on July 4, and JFrog flagged two of them, rollup-packages-polyfill-core and rollup-runtime-polyfill-core, that impersonate the legitimate rollup-plugin-polyfill-node to plant remote access and steal developer secrets. The Contagious Interview operation, tied to North Korea, poisons software supply chains by publishing counterfeit developer packages that mimic real tooling down to their metadata; developers should verify provenance and lock dependencies. The campaign stays active as attackers keep compromising maintainer accounts. - The Hacker News: https://thehackernews.com/2026/07/north-korean-hackers-publish-108.html - The Hacker News: https://thehackernews.com/2026/07/north-korea-linked-npm-packages-mimic.html 3. JADEPUFFER AI AGENT RUNS FULL RANSOMWARE ATTACK AI Security · [ransomware, ai] Latest developments: BleepingComputer and SecurityWeek this week detailed how the JadePuffer agent chained a Langflow remote-code-execution exploit with real-time reasoning to steal credentials, move laterally, and encrypt and wipe a production database, the first ransomware intrusion a large language model ran start to finish. JadePuffer shows an AI agent can plan and carry out a multistage ransomware attack on its own; organizations running Langflow should patch the remote-code-execution flaw and restrict what network reach they grant AI tools. - BleepingComputer: https://www.bleepingcomputer.com/news/security/jadepuffer-ransomware-used-ai-agent-to-automate-entire-attack/ - SecurityWeek: https://www.securityweek.com/agentic-ai-used-to-conduct-ransomware-attack-via-langflow/ 4. APPLE HIDE MY EMAIL LEAKS REAL ADDRESSES Surveillance and Privacy · [privacy, breach] Latest developments: Wired's July 4 security roundup reported that Apple's Hide My Email, the iCloud+ feature that hands users disposable relay addresses, fails to conceal their real address in some cases. Hide My Email sells as an iCloud+ privacy tool that masks a subscriber's true address behind random relays; the reported failure means users should stop treating the relay as guaranteed anonymity. - Wired Security: https://www.wired.com/story/security-roundup-apples-hide-my-email-service-fails-to-hide-your-email/ BUSINESS AND POLITICS ---------------------------------------------------------------- * Ukraine Drone Strikes Ignite Russian Fuel Crisis Latest developments: Kyiv has intensified its drone campaign against Russian refineries and pipelines to an unprecedented rate, driving what the Financial Times calls Russia's worst fuel crisis in decades. Ukraine's escalating strikes on Russian energy infrastructure have choked domestic fuel supplies across Russia, a deepening shortage that feeds into global crude markets already jittery after the Iran war. - FT World: https://www.ft.com/content/13687b48-9e54-44a1-bd4d-600bbc052baf PITTSBURGH ---------------------------------------------------------------- Weather: Today: Showers And Thunderstorms Likely, high 87F. Tonight: Showers And Thunderstorms Likely, low 70F. Monday: Patchy Fog then Chance Showers And Thunderstorms, high 85F. Business: * Sojourner House Wins $150K Grant Latest developments: The Pittsburgh nonprofit Sojourner House landed a $150,000 grant to keep supporting mothers through substance-use treatment. Sojourner House, a Pittsburgh nonprofit that lets mothers stay with their children during recovery, will use the $150,000 grant to sustain its substance-use treatment programs. - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/health/2026/07/05/pittsburgh-sojourner-house/stories/202607050016 Around town: * Parkway East Closure Begins This Week Latest developments: PennDOT's 25-day full closure of the Parkway East begins this week, on July 10, to replace the Commercial Street Bridge. PennDOT will shut the Parkway East between the Squirrel Hill Tunnel and the Edgewood/Swissvale exit for 25 days to replace the aging Commercial Street Bridge near Frick Park, forcing detours on thousands of daily commuters. - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/transportation/2026/07/05/parkway-east-closure-commercial-street-bridge-replacement/stories/202607050050 * Heat Wave Breaks, Storms Linger Latest developments: The heat wave ended over the weekend, but Sunday, July 5, brings more rain and storms after Saturday's severe weather knocked out power to thousands across the region. Saturday's storms downed trees and wires and cut power to thousands of customers around Pittsburgh, and forecasters flagged Sunday, July 5, as another impact day with heavy downpours and gusty winds even as temperatures and humidity eased. - WTAE: https://www.wtae.com/article/impact-day-more-rain-and-storms-for-western-pa/71825222 - WPXI: https://www.wpxi.com/news/local/thousands-without-power-following-strong-storms-pittsburgh-region/NC5R3AKQF5CBRL5YLZU56O434I/ SPORTS ---------------------------------------------------------------- Pirates (45-45) Sat Jul 4 · Pirates 7 · Nationals 1 · Final Ashcraft wins 4th straight start as Pirates topple Nationals 7-1 https://plaintextsports.com/mlb/2026-07-04/pit-wsh Up Next · Pirates @ Nationals · Sun Jul 5, 1:00 PM https://plaintextsports.com/mlb/2026-07-05/pit-wsh Around the Teams: * Valdez Emerges as Pirates' Run Producer Latest developments: The Post-Gazette's Off The Bat detailed how rookie Esmerlyn Valdez has arrived as a middle-of-the-order force for the Pirates. Post-Gazette writers chronicled Esmerlyn Valdez's breakout as the Pirates' designated hitter, arguing the young slugger has become the kind of run producer the club once hoped Marcell Ozuna would be. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/07/04/esmerlyn-valdez-paul-skenes-pirates-all-star-1/stories/202607040021 Team USA: * US Teen Tate Taylor Wins Prefontaine 200 Latest developments: American teenager Tate Taylor upset a field that included Olympic 200-meter champion Letsile Tebogo to win the 200 at the Prefontaine Classic. At the Prefontaine Classic, U.S. teenager Tate Taylor stunned a loaded 200-meter field, beating Botswana's Olympic gold medalist Letsile Tebogo in a signal performance for a rising American sprinter. - ESPN Olympics: https://www.espn.com/olympics/trackandfield/story/_/id/49273834/us-teen-tate-taylor-stuns-prefontaine-classic-field-win-200-race * USMNT Meets Belgium Monday Without Balogun Latest developments: With the round-of-16 match against Belgium now a day away, set for Monday, July 6, in Seattle, ESPN weighed how the United States replaces suspended striker Folarin Balogun. The United States men's team faces Belgium on Monday, July 6, in Seattle without suspended striker Folarin Balogun, weighing Ricardo Pepi and Haji Wright up front before an expected raucous pro-U.S. crowd. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49256530/how-usmnt-cope-red-card-striker-folarin-balogun-world-cup-round-16-belgium READING ---------------------------------------------------------------- * Ed Zitron -- The AI Industry Is Losing Zitron argues the AI industry is losing, contending the economics of the build-out do not add up and the sector's promoters are running short of ways to disguise it. https://www.wheresyoured.at/the-ai-industry-is-losing/ * Cal Newport -- Beware of Productivity Paradoxes Newport traces how the personal computer, seemingly a productivity slam dunk, took years to pay off, and warns that AI may follow the same paradoxical path. https://calnewport.com/beware-of-productivity-paradoxes/ * Stratechery -- An Interview with Figma CEO Dylan Field About Design and AI Field discusses how he built Figma and why he sees AI as a tailwind that strengthens the design company rather than a threat to it. https://stratechery.com/2026/an-interview-with-figma-ceo-dylan-field-about-design-and-ai/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,452.06 ▲ +0.6% Dow 52,316.67 ▲ +1.1% Nasdaq 25,840.84 ▲ +0.1% WTI crude 69.26 ▼ -3.7% EUR/USD 1.1415 ▲ +0.3% GBP/USD 1.3295 ▲ +0.7% USD/JPY 161.98 ▲ +0.2% ================================================================ Generated 2026-07-05 06:05 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================