daily plain-text briefing: security, markets, business, and pittsburgh
North Korea floods open-source package registries with credential-stealing malware even as Cisco's ClamAV races to patch scanner flaws two decades old.
Latest developments: Cisco's Talos group shipped ClamAV 1.5.3 and 1.4.5 on July 5, fixing seven security flaws—most sitting in the code that unpacks and parses executable formats—some dating back two decades.
ClamAV, the open-source scanning engine that runs inside mail gateways, file-upload checks, and endpoint tooling at organizations of every size, released the two patch versions with extra hardening. Administrators should upgrade both branches now.
Sources: Help Net Security · ↑ top
Latest developments: Help Net Security's July 5 week-in-review flagged a pattern: companies bolt AI and large language model features onto products, and the resulting vulnerabilities rate high risk far more often than any other class and get fixed slower.
The finding marks a mounting security debt as vendors rush generative-AI features into shipping software. Security teams should treat new AI features as elevated-risk surfaces and press vendors on remediation timelines.
Sources: Help Net Security · ↑ top
Latest developments: BleepingComputer reported July 5 that Flipper Devices will keep developing the Flipper Zero firmware with a smaller internal team and heavier reliance on community contributions.
The Flipper Zero, a pocket multi-tool that penetration testers and hobbyists use to probe RFID, sub-GHz radio, and other protocols, moves to a leaner maintenance model. Users should expect a slower, community-driven release cadence.
Sources: BleepingComputer · ↑ top
Latest developments: The Hacker News reported July 4 that North Korea's Contagious Interview crew published 108 malicious packages and browser extensions across npm, Packagist, Go, and the Chrome Web Store in a campaign researchers call PolinRider.
The Contagious Interview operation compromises maintainer accounts and seeds developer registries with credential-stealing code, and the campaign stays active, so new packages keep appearing. Developers should audit dependencies and lock trusted versions.
Sources: The Hacker News · ↑ top
Latest developments: Wired reported July 4 that Apple's Hide My Email—the iCloud+ feature that mints random relay addresses to mask a user's true address—fails to keep that real address hidden.
Hide My Email underpins Apple's privacy pitch across Sign in with Apple and iCloud+, so any leak exposes the very addresses users pay to conceal. Anyone relying on the relays for anonymity should assume their real address can surface.
Sources: Wired Security · ↑ top
Latest developments: NATO's leaders convened in Ankara on July 5, where chief Mark Rutte said arms makers are straining to keep pace with member spending, as a Wall Street Journal account detailed how President Trump's tariffs and Greenland threats pushed Europe's leaders toward an open break with Washington.
The alliance's heads of state met in Ankara to weigh whether pledged spending increases can produce actual munitions, with a signaled U.S. troop drawdown from Europe stoking fears that Washington's retreat emboldens Russia's Vladimir Putin.
Sources: WSJ World News · WSJ World News · FT World · ↑ top
Latest developments: The Financial Times reported July 5 that Kyiv has ramped drone strikes on Russian refineries and energy sites to an unprecedented rate, tipping Russia into its worst fuel crisis in decades.
Ukraine's intensified drone campaign against Russian oil refineries and fuel depots has driven gasoline and diesel shortages across Russia, squeezing a war-strained economy and one of the world's largest energy exporters.
Tonight: Chance Showers And Thunderstorms, low 70F.
Monday: Patchy Fog, high 84F.
Monday Night: Showers And Thunderstorms then Showers And Thunderstorms Likely, low 68F.
Latest developments: Slippery Rock Borough Mayor Jondavid Longo signed a disaster-emergency declaration Sunday, July 5, after flash flooding left numerous streets impassable, ordering all residents to stay home.
Intense Sunday-afternoon rain triggered dangerous flash flooding in Slippery Rock Borough in Butler County, prompting Mayor Jondavid Longo to declare a disaster emergency and first responders to close impassable streets.
Latest developments: Storms dumped 1.97 inches of rain at Pittsburgh International Airport through 7 p.m. Sunday, July 5, breaking the daily record of 1.89 inches set in 2005, as flood warnings covered much of Allegheny County.
A third straight day of heavy thunderstorms brought localized flash flooding across western Pennsylvania on July 5, with the National Weather Service placing much of the region under flood watches and warnings as cooler, humid air replaced the multi-day heat wave.
Sources: KDKA · TribLive · ↑ top
Pirates (46-45)
Sat Jul 4 · Pirates 7 · Nationals 1 · Final
Ashcraft wins 4th straight start as Pirates topple Nationals 7-1
Sun Jul 5 · Pirates 11 · Nationals 5 · Final
Griffin's big day leads the Pirates to an 11-5 win over the Nationals
Up Next · Braves @ Pirates · Tue Jul 7, 6:40 PM
Latest developments: The Post-Gazette's July 4 'Off The Bat' feature charted how young hitter Esmerlyn Valdez has 'arrived' and become 'a dude' for the Pirates, days after columnist Noah Hiles argued he can become what the club once hoped Marcell Ozuna would be.
Esmerlyn Valdez, the Pirates' young designated hitter, has become the team's most productive bat during a grim stretch, and Post-Gazette writers now frame him as a genuine middle-of-the-order threat for a lineup starved of offense.
Sources: Post-Gazette Pirates · Post-Gazette Pirates · ↑ top
Latest developments: Belgium reacted with fury to Balogun's reinstatement, coach Rudi Garcia calling it an 'April Fool' joke, while U.S. coach Mauricio Pochettino said his team was 'punished enough' and the Guardian reported Trump made three calls to secure the reversal.
FIFA's disciplinary committee suspended U.S. striker Folarin Balogun's red-card ban on July 5, freeing him to face Belgium in Seattle on July 6 after President Trump lobbied FIFA president Gianni Infantino, a reversal Belgium's federation called astonishing.
Sources: ESPN Soccer · ESPN Soccer · Guardian World Cup 2026 · ↑ top
Latest developments: American teenager Tate Taylor won the 200 meters at the Prefontaine Classic on July 5, beating a field that included Olympic 200 champion Letsile Tebogo of Botswana.
Tate Taylor, a U.S. teenage sprinter, upset the 200-meter field at the Prefontaine Classic in Eugene, Oregon, outrunning Olympic gold medalist Letsile Tebogo in a breakout result.
Sources: ESPN Olympics · ↑ top
S&P 500 7,452.06 ▲ +0.6% Dow 52,316.67 ▲ +1.1% Nasdaq 25,840.84 ▲ +0.1% WTI crude 69.35 ▼ -5.5% EUR/USD 1.1404 ▲ +0.1% GBP/USD 1.3264 ▲ +0.5% USD/JPY 162.07 ▲ +0.3%