================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Sunday, July 5, 2026 - 9:07 PM EDT ================================================================ North Korea floods open-source package registries with credential-stealing malware even as Cisco's ClamAV races to patch scanner flaws two decades old. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] North Korea's Contagious Interview crew seeded npm, Packagist, and Go with 108 malicious packages in the PolinRider campaign, forcing maintainers to hunt their dependency trees. see: North Korea Floods Registries With 108 Malicious Packages * [TREND] Freshly bolted-on AI features rate high-risk more than any class as essayists argue the industry is losing money and its productivity gains stay elusive. see: Bolted-On AI Features Rate High-Risk and Patch Slow; The AI Industry Is Losing; Beware of Productivity Paradoxes * [TREND] Apple's Hide My Email, sold to mask a user's true address, instead leaks the very real address it promises to hide. see: Apple's Hide My Email Leaks the Real Address * [UPDATE (new)] Cisco's Talos shipped ClamAV 1.5.3 fixing seven flaws some two decades old, while Flipper Zero firmware shifts to community hands under a smaller team. see: ClamAV Patches Seven Flaws Two Decades Old; Flipper Zero Firmware Shifts to Community Hands * [UPDATE (new)] A NATO summit opened in Ankara amid Trump-tariff rupture as Ukrainian drone strikes on refineries tipped Russia into its worst fuel crisis in decades. see: NATO Summit Opens Amid Transatlantic Rupture; Ukrainian Drones Trigger Russia's Worst Fuel Crisis in Decades * [UPDATE (new)] Slippery Rock declared a disaster emergency as flash flooding closed streets and record rain at Pittsburgh's airport ended the region's heat wave. see: Slippery Rock Declares Disaster Emergency; Storms Break Rainfall Record as Heat Wave Ends SECURITY ---------------------------------------------------------------- 1. CLAMAV PATCHES SEVEN FLAWS TWO DECADES OLD Vulnerabilities and Exploits · [patch, open-source, vulnerability] Latest developments: Cisco's Talos group shipped ClamAV 1.5.3 and 1.4.5 on July 5, fixing seven security flaws—most sitting in the code that unpacks and parses executable formats—some dating back two decades. ClamAV, the open-source scanning engine that runs inside mail gateways, file-upload checks, and endpoint tooling at organizations of every size, released the two patch versions with extra hardening. Administrators should upgrade both branches now. - Help Net Security: https://www.helpnetsecurity.com/2026/07/06/clamav-security-patch-versions/ 2. BOLTED-ON AI FEATURES RATE HIGH-RISK AND PATCH SLOW AI Security · [ai, vulnerability] Latest developments: Help Net Security's July 5 week-in-review flagged a pattern: companies bolt AI and large language model features onto products, and the resulting vulnerabilities rate high risk far more often than any other class and get fixed slower. The finding marks a mounting security debt as vendors rush generative-AI features into shipping software. Security teams should treat new AI features as elevated-risk surfaces and press vendors on remediation timelines. - Help Net Security: https://www.helpnetsecurity.com/2026/07/05/week-in-review-simplehelp-vulnerability-exploited-oracle-ebs-payments-flaw-under-attack/ 3. FLIPPER ZERO FIRMWARE SHIFTS TO COMMUNITY HANDS Security Tools · [tools] Latest developments: BleepingComputer reported July 5 that Flipper Devices will keep developing the Flipper Zero firmware with a smaller internal team and heavier reliance on community contributions. The Flipper Zero, a pocket multi-tool that penetration testers and hobbyists use to probe RFID, sub-GHz radio, and other protocols, moves to a leaner maintenance model. Users should expect a slower, community-driven release cadence. - BleepingComputer: https://www.bleepingcomputer.com/news/security/flipper-zero-firmware-development-continues-with-community-help/ 4. NORTH KOREA FLOODS REGISTRIES WITH 108 MALICIOUS PACKAGES Nation-State Activity · [apt, supply-chain, nation-state] Latest developments: The Hacker News reported July 4 that North Korea's Contagious Interview crew published 108 malicious packages and browser extensions across npm, Packagist, Go, and the Chrome Web Store in a campaign researchers call PolinRider. The Contagious Interview operation compromises maintainer accounts and seeds developer registries with credential-stealing code, and the campaign stays active, so new packages keep appearing. Developers should audit dependencies and lock trusted versions. - The Hacker News: https://thehackernews.com/2026/07/north-korean-hackers-publish-108.html 5. APPLE'S HIDE MY EMAIL LEAKS THE REAL ADDRESS Surveillance and Privacy · [privacy, breach] Latest developments: Wired reported July 4 that Apple's Hide My Email—the iCloud+ feature that mints random relay addresses to mask a user's true address—fails to keep that real address hidden. Hide My Email underpins Apple's privacy pitch across Sign in with Apple and iCloud+, so any leak exposes the very addresses users pay to conceal. Anyone relying on the relays for anonymity should assume their real address can surface. - Wired Security: https://www.wired.com/story/security-roundup-apples-hide-my-email-service-fails-to-hide-your-email/ BUSINESS AND POLITICS ---------------------------------------------------------------- * NATO Summit Opens Amid Transatlantic Rupture Latest developments: NATO's leaders convened in Ankara on July 5, where chief Mark Rutte said arms makers are straining to keep pace with member spending, as a Wall Street Journal account detailed how President Trump's tariffs and Greenland threats pushed Europe's leaders toward an open break with Washington. The alliance's heads of state met in Ankara to weigh whether pledged spending increases can produce actual munitions, with a signaled U.S. troop drawdown from Europe stoking fears that Washington's retreat emboldens Russia's Vladimir Putin. - WSJ World News: https://www.wsj.com/world/nato-is-fixing-its-cash-flow-problem-now-it-needs-to-turn-money-into-munitions-1440bd35 - WSJ World News: https://www.wsj.com/world/europe/european-rupture-with-america-e3a9bb3c - FT World: https://www.ft.com/content/81d702fd-28d4-4b46-aec3-60e71b53786a * Ukrainian Drones Trigger Russia's Worst Fuel Crisis in Decades Latest developments: The Financial Times reported July 5 that Kyiv has ramped drone strikes on Russian refineries and energy sites to an unprecedented rate, tipping Russia into its worst fuel crisis in decades. Ukraine's intensified drone campaign against Russian oil refineries and fuel depots has driven gasoline and diesel shortages across Russia, squeezing a war-strained economy and one of the world's largest energy exporters. - FT World: https://www.ft.com/content/13687b48-9e54-44a1-bd4d-600bbc052baf PITTSBURGH ---------------------------------------------------------------- Weather: Tonight: Chance Showers And Thunderstorms, low 70F. Monday: Patchy Fog, high 84F. Monday Night: Showers And Thunderstorms then Showers And Thunderstorms Likely, low 68F. Around town: * Slippery Rock Declares Disaster Emergency Latest developments: Slippery Rock Borough Mayor Jondavid Longo signed a disaster-emergency declaration Sunday, July 5, after flash flooding left numerous streets impassable, ordering all residents to stay home. Intense Sunday-afternoon rain triggered dangerous flash flooding in Slippery Rock Borough in Butler County, prompting Mayor Jondavid Longo to declare a disaster emergency and first responders to close impassable streets. - KDKA: https://www.cbsnews.com/pittsburgh/news/slippery-rock-disaster-emergency-rainfall-flooding/ - WPXI: https://www.wpxi.com/news/local/slippery-rock-mayor-signs-declaration-disaster-emergency-borough-deals-with-storms-flooding/IJL4JZRS4VGM3PLSPC6NPMGZGI/ * Storms Break Rainfall Record as Heat Wave Ends Latest developments: Storms dumped 1.97 inches of rain at Pittsburgh International Airport through 7 p.m. Sunday, July 5, breaking the daily record of 1.89 inches set in 2005, as flood warnings covered much of Allegheny County. A third straight day of heavy thunderstorms brought localized flash flooding across western Pennsylvania on July 5, with the National Weather Service placing much of the region under flood watches and warnings as cooler, humid air replaced the multi-day heat wave. - KDKA: https://www.cbsnews.com/pittsburgh/news/pittsburghs-hot-weather-turns-into-cool-humid-and-rainy-conditions-this-week/ - TribLive: https://triblive.com/local/regional/flood-watch-starts-at-3-p-m-as-thunderstorms-forecast-for-region/ SPORTS ---------------------------------------------------------------- Pirates (46-45) Sat Jul 4 · Pirates 7 · Nationals 1 · Final Ashcraft wins 4th straight start as Pirates topple Nationals 7-1 https://plaintextsports.com/mlb/2026-07-04/pit-wsh Sun Jul 5 · Pirates 11 · Nationals 5 · Final Griffin's big day leads the Pirates to an 11-5 win over the Nationals https://plaintextsports.com/mlb/2026-07-05/pit-wsh Up Next · Braves @ Pirates · Tue Jul 7, 6:40 PM https://plaintextsports.com/mlb/2026-07-07/atl-pit Around the Teams: * Valdez Emerges as Pirates' Brightest Bat Latest developments: The Post-Gazette's July 4 'Off The Bat' feature charted how young hitter Esmerlyn Valdez has 'arrived' and become 'a dude' for the Pirates, days after columnist Noah Hiles argued he can become what the club once hoped Marcell Ozuna would be. Esmerlyn Valdez, the Pirates' young designated hitter, has become the team's most productive bat during a grim stretch, and Post-Gazette writers now frame him as a genuine middle-of-the-order threat for a lineup starved of offense. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/07/04/esmerlyn-valdez-paul-skenes-pirates-all-star-1/stories/202607040021 - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/07/02/esmerlyn-valdez-hiles-ozuna-dh-cherington/stories/202607010040 Team USA: * Belgium Fumes as FIFA Clears Balogun Latest developments: Belgium reacted with fury to Balogun's reinstatement, coach Rudi Garcia calling it an 'April Fool' joke, while U.S. coach Mauricio Pochettino said his team was 'punished enough' and the Guardian reported Trump made three calls to secure the reversal. FIFA's disciplinary committee suspended U.S. striker Folarin Balogun's red-card ban on July 5, freeing him to face Belgium in Seattle on July 6 after President Trump lobbied FIFA president Gianni Infantino, a reversal Belgium's federation called astonishing. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49279471/belgium-usa-folarin-balogun-ban-suspended-fifa-world-cup-2026 - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49277378/usmnt-folarin-balogun-red-card-suspended-belgium - Guardian World Cup 2026: https://www.theguardian.com/football/2026/jul/05/folarin-balogun-red-card-suspension-lifted-usmnt-belgium-world-cup * U.S. Teen Taylor Stuns Prefontaine 200 Latest developments: American teenager Tate Taylor won the 200 meters at the Prefontaine Classic on July 5, beating a field that included Olympic 200 champion Letsile Tebogo of Botswana. Tate Taylor, a U.S. teenage sprinter, upset the 200-meter field at the Prefontaine Classic in Eugene, Oregon, outrunning Olympic gold medalist Letsile Tebogo in a breakout result. - ESPN Olympics: https://www.espn.com/olympics/trackandfield/story/_/id/49273834/us-teen-tate-taylor-stuns-prefontaine-classic-field-win-200-race READING ---------------------------------------------------------------- * Ed Zitron -- The AI Industry Is Losing Zitron argues the AI industry is fundamentally losing money and momentum, its enormous build-out failing to yield the profits or products that would justify the spending. https://www.wheresyoured.at/the-ai-industry-is-losing/ * Cal Newport -- Beware of Productivity Paradoxes Newport warns that technologies seemingly destined to boost output, from the personal computer to today's AI tools, often fail to deliver the productivity gains their promise implies. https://calnewport.com/beware-of-productivity-paradoxes/ * Stratechery -- An Interview with Figma CEO Dylan Field About Design and AI Ben Thompson interviews Figma chief executive Dylan Field on building the design company and why he believes AI acts as a tailwind rather than a threat. https://stratechery.com/2026/an-interview-with-figma-ceo-dylan-field-about-design-and-ai/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,452.06 ▲ +0.6% Dow 52,316.67 ▲ +1.1% Nasdaq 25,840.84 ▲ +0.1% WTI crude 69.35 ▼ -5.5% EUR/USD 1.1404 ▲ +0.1% GBP/USD 1.3264 ▲ +0.5% USD/JPY 162.07 ▲ +0.3% ================================================================ Generated 2026-07-05 21:07 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================