daily plain-text briefing: security, markets, business, and pittsburgh
Critical pre-authentication flaws in BeyondTrust remote-access software and a hidden backdoor in Tenda routers hand attackers control, while China-linked crews mine university webmail and build relay networks.
Latest developments: Microsoft launched an early preview of Microsoft Execution Containers on July 7, a policy-driven runtime that enforces developer-defined constraints on AI agents across Windows and Windows Subsystem for Linux, as Elba Security mapped an ungoverned AI attack surface and Chinese Academy of Sciences researchers proposed a 'Cybersecurity AI Scientist.'
Enterprises have connected AI tools and autonomous agents to sensitive systems faster than they can govern the resulting access, from standing OAuth grants to copilots inheriting human permissions. Microsoft's containers let Windows enforce isolation on agents at runtime, one early answer to autonomy already in production.
Sources: Help Net Security · Help Net Security · Help Net Security · ↑ top
Latest developments: BeyondTrust on July 7 warned customers to patch two critical authentication-bypass flaws, including pre-authentication CVE-2026-40138 (CVSS 9.2), in its Remote Support and Privileged Remote Access products.
The flaws let unauthenticated attackers bypass authentication and seize control of susceptible devices, a serious exposure given that both products broker privileged access into customer networks. Administrators should apply the fixed builds immediately.
Sources: The Hacker News · BleepingComputer · ↑ top
Latest developments: A suspected China-aligned cluster exploited patched Roundcube webmail flaw CVE-2024-42009 (CVSS 9.3) against physics and engineering departments at U.S. and Canadian universities to steal credentials, as Cisco Talos reported the actor it tracks as UAT-7810 keeps building operational relay box networks with fresh custom malware.
Chinese state-aligned crews target academic research accounts and assemble proxy relay infrastructure to mask later operations. Universities running Roundcube should confirm they patched CVE-2024-42009 and hunt for credential theft.
Sources: The Hacker News · Cisco Talos · ↑ top
Latest developments: The CERT Coordination Center warned July 7 that several Tenda router firmware versions embed an undocumented authentication backdoor, CVE-2026-11405, that bypasses password verification to grant administrative access to the web management interface.
The hidden backdoor sits in firmware from Chinese network device maker Tenda and hands an attacker full admin control of affected routers. Owners of Tenda gear should isolate the management interface and watch for a vendor firmware fix.
Sources: The Hacker News · ↑ top
Latest developments: Canada's Communications Security Establishment disclosed July 6 that it ran offensive cyber operations in 2025 against a ransomware-as-a-service gang, an online foreign extremist group, and drug traffickers.
The signals-intelligence agency confirmed it hacked three separate criminal targets last year, a rare public accounting of a Western government using offensive cyber power against organized crime. The disclosure signals a widening willingness to strike back at ransomware crews directly.
Sources: The Record · ↑ top
Latest developments: BonkDAO said July 6 that attackers holding a large stake of BONK cryptocurrency pushed through a malicious governance proposal, voting roughly $20 million in coins into their own wallets.
The theft exploited on-chain voting itself: a holder with enough BONK leverage passed a proposal that transferred coins directly to the attackers. It underscores how decentralized-governance tokens turn concentrated holdings into a drain-the-treasury attack path.
Sources: The Record · ↑ top
Latest developments: Iran's Revolutionary Guard struck the Qatari gas tanker Al Rekayyat off Oman's coast and set it ablaze, widening the Strait of Hormuz attacks that opened a day earlier and pushing oil up more than 1.5 percent.
A projectile hit the Al Rekayyat in the Strait of Hormuz early Tuesday, the British military confirmed, the latest strike on commercial shipping in a chokepoint that carries much of the world's seaborne oil; the attacks complicate talks to end the U.S. war with Iran, lifting crude and sending gold lower.
Sources: WSJ World News · FT World · WSJ Markets · ↑ top
Latest developments: Samsung shares fell 10 percent despite a record quarterly profit, triggering a global selloff in AI-linked chip stocks and dragging South Korea's market toward bear territory.
Investors dumped Samsung Electronics, the world's largest memory-chip maker, on fears its heavy AI build-out spending swamps booming chip earnings, pulling U.S. tech futures and Asian semiconductor shares lower Tuesday as doubts about the AI spending war spread across markets.
Sources: FT World · WSJ US Business · WSJ Markets · ↑ top
Latest developments: The Bank of England's Financial Policy Committee warned Tuesday that rising leverage in equity markets heightens the threat to financial stability, and said it plans to ease bank capital rules to spur lending.
In its twice-yearly report the committee said progress toward resolving the U.S.-Iran conflict eased some stability threats while leaving others in place, as the bank separately moved to loosen a capital rule to boost lending and cushion markets in a crisis.
Sources: WSJ World News · FT World · ↑ top
Today: Areas Of Fog then Scattered Showers And Thunderstorms, high 86F.
Tonight: Scattered Showers And Thunderstorms then Areas Of Fog, low 69F.
Wednesday: Areas Of Fog then Isolated Showers And Thunderstorms, high 87F.
Latest developments: ARYSE said federal grants for two programs, including its PRYSE Academy summer camp, end October 1 after the U.S. Office of Refugee Resettlement discontinued them indefinitely.
The Pittsburgh nonprofit ARYSE, which serves refugee and immigrant youth, draws a quarter of its $1.1 million budget from the government and now works to weather the loss as the Office of Refugee Resettlement pulls key grants.
Sources: PublicSource · ↑ top
Latest developments: Hey Babe unveiled a renovated dining area at the Maverick Hotel in East Liberty, nearly a year after opening.
Pittsburgh City Paper's food roundup reports Hey Babe, at 120 S. Whitfield St. in East Liberty, finished renovating the throwback-lounge dining room it opened last year inside the Maverick Hotel, part of a briefing that also previews the coming Picklesburgh festival.
Sources: Pittsburgh City Paper · ↑ top
Latest developments: With the shutdown four days off, PennDOT crews are clearing construction material from detour routes and coordinating traffic signals to keep traffic flowing when the Parkway East closes July 10.
PennDOT will close the Parkway East between the Squirrel Hill Tunnel and the Edgewood/Swissvale exit for 25 days starting July 10 to replace the aging Commercial Street Bridge, rerouting a corridor that carries roughly 100,000 vehicles a day through Regent Square and Swissvale streets.
Latest developments: Mars Borough Council voted 6-1 Monday to adopt a joint merger agreement with Adams Township, sending the question to voters in both Butler County communities on the November ballot.
The proposal would fold Mars Borough into Adams Township as one municipality, dropping Mars residents to Adams's 3.75-mill tax rate while keeping mailing addresses unchanged; Adams supervisors already approved the ordinance last month.
Latest developments: An overturned truck leaked corrosive liquid onto the 62nd Street Bridge late Monday, closing the span both directions through the Tuesday morning commute.
The Senator Robert D. Fleming (62nd Street) Bridge, linking Pittsburgh with Sharpsburg and Etna near Route 28, stayed shut as the Cherry City Volunteer Fire Company, Allegheny County Emergency Services, and the city Bureau of Fire spent hours containing the spill.
Latest developments: The Union Pacific Big Boy locomotive, on a coast-to-coast tour for America's 250th, will stop in Leetsdale on Saturday, July 11, after a hoax briefly sparked confusion that the visit was canceled.
The historic steam locomotive rolls through Western Pennsylvania this weekend as part of the nationwide America250 commemoration, with organizers confirming the Leetsdale stop for Saturday.
Pirates (46-45)
Up Next · Braves @ Pirates · Tue Jul 7, 6:40 PM
Latest developments: Two Post-Gazette pieces examine Mike McCarthy's approach to teaching quarterbacks and his reliance on first-down passing as the Steelers sort how Aaron Rodgers, Drew Allar, and Will Howard fit.
One analysis shows how heavy first-down passing drives McCarthy's philosophy and the NFL's best offenses; a companion profile casts McCarthy, who never played the position, as a rare quarterback teacher shaping the Steelers' passers.
Sources: Post-Gazette Steelers · Post-Gazette Steelers · ↑ top
Latest developments: A Post-Gazette video asks whether Steelers quarterback Aaron Rodgers can follow Tom Brady and Peyton Manning as an older Super Bowl winner.
The Post-Gazette weighs Rodgers's late-career title odds against the precedents of Brady and Manning, both of whom won championships well past their primes.
Sources: Post-Gazette Steelers · ↑ top
Latest developments: Post-Gazette columnist Noah Hiles frames the coming week—the All-Star break amid a rough stretch—as the biggest of Paul Skenes's young career.
Skenes, the Pirates ace and lone All-Star, heads into the break trying to steady his mechanics after several rough outings, with Hiles laying out the stakes for both the pitcher and a struggling club.
Sources: Post-Gazette Pirates · ↑ top
Latest developments: Belgium beat the United States 4-1 in Seattle on Monday to reach the quarterfinals, as Charles De Ketelaere scored twice and set up another goal and Christian Pulisic left with a second-half ankle injury.
The defeat ended the host nation's World Cup run at the round of 16 once again, its defensive lapses exposed even with reinstated striker Folarin Balogun back in the lineup; the United States last reached a quarterfinal 24 years ago.
Sources: ESPN Soccer · ESPN Soccer · ↑ top
Latest developments: Mauricio Pochettino declined after the Belgium loss to say whether he wants to stay on as U.S. men's coach, urging fans to keep faith.
Pochettino, who took over the United States program ahead of the home World Cup, left his future open following the round-of-16 exit in Seattle.
Sources: ESPN Soccer · ↑ top
Latest developments: FIFA accused UEFA of hypocrisy Tuesday, its disciplinary chair Mohammad Al Kamali arguing that overturning red cards is common, after UEFA said FIFA crossed 'a red line' by lifting Folarin Balogun's suspension.
The clash followed FIFA's reinstatement of the U.S. striker's red card before the Belgium match, a decision UEFA called incomprehensible and unjustifiable and that critics tied to a phone call from President Trump.
Sources: Guardian World Cup 2026 · ↑ top
S&P 500 7,488.74 ▲ +1.5% Dow 52,552.63 ▲ +1.4% Nasdaq 26,005.54 ▲ +1.7% WTI crude 69.21 ▼ -3.7% EUR/USD 1.1415 ▲ +0.3% GBP/USD 1.3295 ▲ +0.7% USD/JPY 162.00 ▲ +0.2%