================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Tuesday, July 7, 2026 - 6:06 AM EDT ================================================================ Critical pre-authentication flaws in BeyondTrust remote-access software and a hidden backdoor in Tenda routers hand attackers control, while China-linked crews mine university webmail and build relay networks. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Attackers keep slipping past login screens as BeyondTrust patches pre-authentication CVE-2026-40138 while CERT/CC flags an undocumented backdoor in Tenda router firmware. see: BeyondTrust Remote Access Auth Bypass; Tenda Router Firmware Backdoor * [TREND] A suspected China-aligned cluster exploited Roundcube webmail flaw CVE-2024-42009 to steal credentials from U.S. and Canadian university physics departments, Cisco Talos reported. see: China-Nexus Espionage on Webmail and Relay Networks * [TREND] Microsoft's early preview of Execution Containers arrives as Elba Security warns of ungoverned AI agents roaming corporate systems, showing defenders rushing to constrain autonomy they already deployed. see: Constraining Rogue AI Agents * [UPDATE (updated)] Iran's Revolutionary Guard struck the Qatari gas tanker Al Rekayyat near the Strait of Hormuz, widening the attacks and pushing oil up more than 1.5 percent. see: Iran Strikes Qatari Tanker Near Hormuz * [UPDATE (new)] Samsung shares fell 10 percent despite a record profit, triggering a global selloff in AI-linked chip stocks and dragging South Korea toward bear territory. see: Samsung Selloff Rattles the AI Trade SECURITY ---------------------------------------------------------------- 1. CONSTRAINING ROGUE AI AGENTS AI Security · [ai, agents] Latest developments: Microsoft launched an early preview of Microsoft Execution Containers on July 7, a policy-driven runtime that enforces developer-defined constraints on AI agents across Windows and Windows Subsystem for Linux, as Elba Security mapped an ungoverned AI attack surface and Chinese Academy of Sciences researchers proposed a 'Cybersecurity AI Scientist.' Enterprises have connected AI tools and autonomous agents to sensitive systems faster than they can govern the resulting access, from standing OAuth grants to copilots inheriting human permissions. Microsoft's containers let Windows enforce isolation on agents at runtime, one early answer to autonomy already in production. - Help Net Security: https://www.helpnetsecurity.com/2026/07/07/microsoft-execution-containers-ai-agents-constraints/ - Help Net Security: https://www.helpnetsecurity.com/2026/07/07/ai-attack-surface-video/ - Help Net Security: https://www.helpnetsecurity.com/2026/07/07/cybersecurity-ai-scientist-research/ 2. BEYONDTRUST REMOTE ACCESS AUTH BYPASS Vulnerabilities and Exploits · [patch, vulnerability, remote-access] Latest developments: BeyondTrust on July 7 warned customers to patch two critical authentication-bypass flaws, including pre-authentication CVE-2026-40138 (CVSS 9.2), in its Remote Support and Privileged Remote Access products. The flaws let unauthenticated attackers bypass authentication and seize control of susceptible devices, a serious exposure given that both products broker privileged access into customer networks. Administrators should apply the fixed builds immediately. - The Hacker News: https://thehackernews.com/2026/07/beyondtrust-patches-critical-auth.html - BleepingComputer: https://www.bleepingcomputer.com/news/security/beyondtrust-warns-of-critical-flaws-in-remote-access-software/ 3. CHINA-NEXUS ESPIONAGE ON WEBMAIL AND RELAY NETWORKS Nation-State Activity · [apt, espionage, china] Latest developments: A suspected China-aligned cluster exploited patched Roundcube webmail flaw CVE-2024-42009 (CVSS 9.3) against physics and engineering departments at U.S. and Canadian universities to steal credentials, as Cisco Talos reported the actor it tracks as UAT-7810 keeps building operational relay box networks with fresh custom malware. Chinese state-aligned crews target academic research accounts and assemble proxy relay infrastructure to mask later operations. Universities running Roundcube should confirm they patched CVE-2024-42009 and hunt for credential theft. - The Hacker News: https://thehackernews.com/2026/07/suspected-china-aligned-hackers-exploit.html - Cisco Talos: https://blog.talosintelligence.com/uat-7810/ 4. TENDA ROUTER FIRMWARE BACKDOOR Vulnerabilities and Exploits · [backdoor, vulnerability, iot] Latest developments: The CERT Coordination Center warned July 7 that several Tenda router firmware versions embed an undocumented authentication backdoor, CVE-2026-11405, that bypasses password verification to grant administrative access to the web management interface. The hidden backdoor sits in firmware from Chinese network device maker Tenda and hands an attacker full admin control of affected routers. Owners of Tenda gear should isolate the management interface and watch for a vendor firmware fix. - The Hacker News: https://thehackernews.com/2026/07/certcc-warns-of-hidden-admin-backdoor.html 5. CANADA'S OFFENSIVE CYBER OPERATIONS Nation-State Activity · [policy, nation-state] Latest developments: Canada's Communications Security Establishment disclosed July 6 that it ran offensive cyber operations in 2025 against a ransomware-as-a-service gang, an online foreign extremist group, and drug traffickers. The signals-intelligence agency confirmed it hacked three separate criminal targets last year, a rare public accounting of a Western government using offensive cyber power against organized crime. The disclosure signals a widening willingness to strike back at ransomware crews directly. - The Record: https://therecord.media/canada-cse-2025-cyber-operations-ransomware-drugs-extremism 6. BONKDAO GOVERNANCE HEIST Ransomware and Cybercrime · [cryptocurrency, cybercrime] Latest developments: BonkDAO said July 6 that attackers holding a large stake of BONK cryptocurrency pushed through a malicious governance proposal, voting roughly $20 million in coins into their own wallets. The theft exploited on-chain voting itself: a holder with enough BONK leverage passed a proposal that transferred coins directly to the attackers. It underscores how decentralized-governance tokens turn concentrated holdings into a drain-the-treasury attack path. - The Record: https://therecord.media/attackers-vote-themselves-20-million-bonk-crypto BUSINESS AND POLITICS ---------------------------------------------------------------- * Iran Strikes Qatari Tanker Near Hormuz Latest developments: Iran's Revolutionary Guard struck the Qatari gas tanker Al Rekayyat off Oman's coast and set it ablaze, widening the Strait of Hormuz attacks that opened a day earlier and pushing oil up more than 1.5 percent. A projectile hit the Al Rekayyat in the Strait of Hormuz early Tuesday, the British military confirmed, the latest strike on commercial shipping in a chokepoint that carries much of the world's seaborne oil; the attacks complicate talks to end the U.S. war with Iran, lifting crude and sending gold lower. - WSJ World News: https://www.wsj.com/world/middle-east/irgc-fires-missiles-at-ships-in-strait-of-hormuz-c3fbadd0 - FT World: https://www.ft.com/content/0a1c6329-2be0-4d7a-b7ab-82f81511bde2 - WSJ Markets: https://www.wsj.com/finance/commodities-futures/oil-rises-on-possible-position-adjustments-before-expected-resumption-of-u-s-iran-talks-ead21cdc?mod=rss_markets_main * Samsung Selloff Rattles the AI Trade Latest developments: Samsung shares fell 10 percent despite a record quarterly profit, triggering a global selloff in AI-linked chip stocks and dragging South Korea's market toward bear territory. Investors dumped Samsung Electronics, the world's largest memory-chip maker, on fears its heavy AI build-out spending swamps booming chip earnings, pulling U.S. tech futures and Asian semiconductor shares lower Tuesday as doubts about the AI spending war spread across markets. - FT World: https://www.ft.com/content/db4f9501-046c-4683-b59c-03b5a5ebfafb - WSJ US Business: https://www.wsj.com/tech/samsung-forecasts-record-second-quarter-operating-profit-8b95a398?mod=pls_whats_news_us_business_f - WSJ Markets: https://www.wsj.com/finance/stocks/asian-equities-mostly-lower-as-ai-led-rally-takes-breather-cd0615b1?mod=rss_markets_main * Bank of England Flags Equity-Market Leverage Latest developments: The Bank of England's Financial Policy Committee warned Tuesday that rising leverage in equity markets heightens the threat to financial stability, and said it plans to ease bank capital rules to spur lending. In its twice-yearly report the committee said progress toward resolving the U.S.-Iran conflict eased some stability threats while leaving others in place, as the bank separately moved to loosen a capital rule to boost lending and cushion markets in a crisis. - WSJ World News: https://www.wsj.com/pro/central-banking/boe-sees-heightened-threat-to-financial-stability-as-leverage-in-equity-markets-rises-173d0d7e - FT World: https://www.ft.com/content/5a335f32-e123-4239-934d-bacd876a03d5 PITTSBURGH ---------------------------------------------------------------- Weather: Today: Areas Of Fog then Scattered Showers And Thunderstorms, high 86F. Tonight: Scattered Showers And Thunderstorms then Areas Of Fog, low 69F. Wednesday: Areas Of Fog then Isolated Showers And Thunderstorms, high 87F. Business: * Refugee Youth Camp Faces Federal Cuts Latest developments: ARYSE said federal grants for two programs, including its PRYSE Academy summer camp, end October 1 after the U.S. Office of Refugee Resettlement discontinued them indefinitely. The Pittsburgh nonprofit ARYSE, which serves refugee and immigrant youth, draws a quarter of its $1.1 million budget from the government and now works to weather the loss as the Office of Refugee Resettlement pulls key grants. - PublicSource: https://www.publicsource.org/pittsburgh-refugee-youth-camp-funding-cut/ * Hey Babe Reopens Renovated Dining Room Latest developments: Hey Babe unveiled a renovated dining area at the Maverick Hotel in East Liberty, nearly a year after opening. Pittsburgh City Paper's food roundup reports Hey Babe, at 120 S. Whitfield St. in East Liberty, finished renovating the throwback-lounge dining room it opened last year inside the Maverick Hotel, part of a briefing that also previews the coming Picklesburgh festival. - Pittsburgh City Paper: https://www.pghcitypaper.com/food-drink/a-picklesburgh-preview-a-major-supermarket-deal-and-more-pittsburgh-food-news/ Around town: * Parkway East Detour Prep Before Closure Latest developments: With the shutdown four days off, PennDOT crews are clearing construction material from detour routes and coordinating traffic signals to keep traffic flowing when the Parkway East closes July 10. PennDOT will close the Parkway East between the Squirrel Hill Tunnel and the Edgewood/Swissvale exit for 25 days starting July 10 to replace the aging Commercial Street Bridge, rerouting a corridor that carries roughly 100,000 vehicles a day through Regent Square and Swissvale streets. - KDKA: https://www.cbsnews.com/pittsburgh/news/penndot-parkway-east-closure-traffic-obstacles-detour-routes/ * Mars and Adams Township Merger Heads to Ballot Latest developments: Mars Borough Council voted 6-1 Monday to adopt a joint merger agreement with Adams Township, sending the question to voters in both Butler County communities on the November ballot. The proposal would fold Mars Borough into Adams Township as one municipality, dropping Mars residents to Adams's 3.75-mill tax rate while keeping mailing addresses unchanged; Adams supervisors already approved the ordinance last month. - KDKA: https://www.cbsnews.com/pittsburgh/news/mars-adams-possible-merger-update/ - WPXI: https://www.wpxi.com/news/local/proposal-merge-adams-township-mars-borough-will-appear-upcoming-ballot/DC4NYDXOCVFDPOO6SQILQHUSBU/ * Hazmat Spill Closes 62nd Street Bridge Latest developments: An overturned truck leaked corrosive liquid onto the 62nd Street Bridge late Monday, closing the span both directions through the Tuesday morning commute. The Senator Robert D. Fleming (62nd Street) Bridge, linking Pittsburgh with Sharpsburg and Etna near Route 28, stayed shut as the Cherry City Volunteer Fire Company, Allegheny County Emergency Services, and the city Bureau of Fire spent hours containing the spill. - KDKA: https://www.cbsnews.com/pittsburgh/news/overturned-truck-62nd-street-bridge-hazardous-materials-spill/ - WPXI: https://www.wpxi.com/news/local/semi-truck-rolls-over-bridge-allegheny-county-begins-leaking-corrosive-liquid-sources-say/VTIFCRWX4ZCU3ARBIBBKYYMAGM/ Events: * Union Pacific Big Boy Visits Leetsdale Latest developments: The Union Pacific Big Boy locomotive, on a coast-to-coast tour for America's 250th, will stop in Leetsdale on Saturday, July 11, after a hoax briefly sparked confusion that the visit was canceled. The historic steam locomotive rolls through Western Pennsylvania this weekend as part of the nationwide America250 commemoration, with organizers confirming the Leetsdale stop for Saturday. - WPXI: https://www.wpxi.com/news/local/big-boy-tour-is-not-canceled-will-visit-leetsdale-saturday/355K74DQ5FCOHLVIVRDHD7UZCA/ SPORTS ---------------------------------------------------------------- Pirates (46-45) Up Next · Braves @ Pirates · Tue Jul 7, 6:40 PM https://plaintextsports.com/mlb/2026-07-07/atl-pit Around the Teams: * McCarthy's Quarterback Craft and First-Down Passing Latest developments: Two Post-Gazette pieces examine Mike McCarthy's approach to teaching quarterbacks and his reliance on first-down passing as the Steelers sort how Aaron Rodgers, Drew Allar, and Will Howard fit. One analysis shows how heavy first-down passing drives McCarthy's philosophy and the NFL's best offenses; a companion profile casts McCarthy, who never played the position, as a rare quarterback teacher shaping the Steelers' passers. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/07/07/analysis-passing-mccarthy-rodgers-allar-howard/stories/202607030012 - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/07/06/mccarthy-coach-quarterback-favre-rodgers-allar-gannon/stories/202606260069 * Rodgers and the Old-Quarterback Question Latest developments: A Post-Gazette video asks whether Steelers quarterback Aaron Rodgers can follow Tom Brady and Peyton Manning as an older Super Bowl winner. The Post-Gazette weighs Rodgers's late-career title odds against the precedents of Brady and Manning, both of whom won championships well past their primes. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/07/06/nfl-news-rumors-aaron-rodgers-tom-brady-peyton-manning/stories/202607060023 * Skenes Faces His Biggest Week Latest developments: Post-Gazette columnist Noah Hiles frames the coming week—the All-Star break amid a rough stretch—as the biggest of Paul Skenes's young career. Skenes, the Pirates ace and lone All-Star, heads into the break trying to steady his mechanics after several rough outings, with Hiles laying out the stakes for both the pitcher and a struggling club. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/07/06/pirates-skenes-allstar-playoffs-mlb-postseason/stories/202607060021 Team USA: * Belgium Ousts the U.S. in the Round of 16 Latest developments: Belgium beat the United States 4-1 in Seattle on Monday to reach the quarterfinals, as Charles De Ketelaere scored twice and set up another goal and Christian Pulisic left with a second-half ankle injury. The defeat ended the host nation's World Cup run at the round of 16 once again, its defensive lapses exposed even with reinstated striker Folarin Balogun back in the lineup; the United States last reached a quarterfinal 24 years ago. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49291529/usa-belgium-20206-fifa-world-cup - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49291866/christian-pulisic-injury-usa-belgium-2026-world-cup * Pochettino Noncommittal on U.S. Future Latest developments: Mauricio Pochettino declined after the Belgium loss to say whether he wants to stay on as U.S. men's coach, urging fans to keep faith. Pochettino, who took over the United States program ahead of the home World Cup, left his future open following the round-of-16 exit in Seattle. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49292813/mauricio-pochettino-usa-coach-future-2026-world-cup-belgium * FIFA and UEFA Trade Blows Over Balogun Reversal Latest developments: FIFA accused UEFA of hypocrisy Tuesday, its disciplinary chair Mohammad Al Kamali arguing that overturning red cards is common, after UEFA said FIFA crossed 'a red line' by lifting Folarin Balogun's suspension. The clash followed FIFA's reinstatement of the U.S. striker's red card before the Belgium match, a decision UEFA called incomprehensible and unjustifiable and that critics tied to a phone call from President Trump. - Guardian World Cup 2026: https://www.theguardian.com/football/2026/jul/07/fifa-accuses-uefa-hypocrisy-folarin-balogun-world-cup-decision-red-card READING ---------------------------------------------------------------- * Stratechery -- A Script for Mark Zuckerberg Ben Thompson writes the earnings-call script he thinks Mark Zuckerberg should deliver, laying out how Meta should explain its AI investments and vast compute spending to investors. https://stratechery.com/2026/a-script-for-mark-zuckerberg/ * Ed Zitron -- Premium: The Hater's Guide To SoftBank Zitron dissects SoftBank's 46th annual shareholder meeting and Masayoshi Son's AI-drenched presentation, arguing Son's all-in bet on artificial intelligence rests on hype rather than substance. https://www.wheresyoured.at/premium-the-haters-guide-to-softbank/ * Cal Newport -- Beware of Productivity Paradoxes Newport argues that transformative-seeming technologies like the personal computer often fail to deliver the productivity gains they promise, a cautionary lens he applies to today's AI enthusiasm. https://calnewport.com/beware-of-productivity-paradoxes/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,488.74 ▲ +1.5% Dow 52,552.63 ▲ +1.4% Nasdaq 26,005.54 ▲ +1.7% WTI crude 69.21 ▼ -3.7% EUR/USD 1.1415 ▲ +0.3% GBP/USD 1.3295 ▲ +0.7% USD/JPY 162.00 ▲ +0.2% ================================================================ Generated 2026-07-07 06:06 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================