daily plain-text briefing: security, markets, business, and pittsburgh
Britain and the United States both wired frontier AI into national cyber defense as researchers showed the same agentic tools leaking private data across GitHub and enterprise platforms.
Latest developments: Noma Security showed July 7 that one normal-looking issue opened on a public GitHub repository tricks GitHub Agentic Workflows into leaking an organization's private repositories with no credentials, while Sand Security disclosed WriteOut, a now-patched one-click flaw in the Writer enterprise AI platform that lets an outsider take over any tenant across the boundary.
Enterprises grant AI coding agents broad read access and connect them to continuous-integration pipelines, and researchers keep finding the agents spill data on their own. Restrict agent repository scope, audit standing OAuth grants, and treat AI-written dependencies as unvetted supply chain.
Sources: The Hacker News · The Hacker News · BleepingComputer · The Hacker News · ↑ top
Latest developments: Spain's National Police arrested a suspected member of the pro-Russian hacktivist groups CyberArmy of Russia Reborn and Z-Pentest, Dutch police arrested two young men running a credit-card phishing operation as the Netherlands earned the title of Europe's worst country for payment fraud, a newly unsealed U.S. complaint revealed a persistent Windows device ID that tied alleged Scattered Spider hacker Peter Stokes, 19, to the May 2025 luxury-jewelry-retailer intrusion, and Canada's Communications Security Establishment disclosed it ran offensive operations in 2025 against a ransomware-as-a-service gang, an extremist group, and drug traffickers.
Law enforcement across Spain, the Netherlands, the United States, and Canada moved against hacktivists, fraudsters, and ransomware crews in a single day. The Stokes complaint shows a Microsoft-recorded device identifier can survive an intrusion long enough to unmask the operator.
Sources: BleepingComputer · Graham Cluley · The Hacker News · The Record · ↑ top
Latest developments: BeyondTrust patched two critical flaws in its Remote Support and Privileged Remote Access products, including pre-authentication bug CVE-2026-40138 (CVSS 9.2) that lets unauthenticated attackers seize control of a device, while CERT/CC warned of CVE-2026-11405, an undocumented admin backdoor embedded in several Tenda router firmware versions that skips the password check entirely.
Two vendors that sit at the network edge—one guarding privileged remote access, one shipping consumer and small-office routers—both let attackers walk past authentication. Apply BeyondTrust's updates immediately and pull affected Tenda firmware off internet-facing management interfaces.
Sources: The Hacker News · BleepingComputer · The Hacker News · ↑ top
Latest developments: Britain's National Cyber Security Centre unveiled Cyber Shield, an autonomous AI capability built to counter attackers who 'move at machine speed and greater scale,' the same day SecurityWeek reported that CISA's Attack Surface Evaluation team is running Anthropic's Mythos model to scan U.S. government software for flaws.
Both governments now field frontier AI to speed vulnerability discovery and defensive response as adversaries weaponize new CVEs within hours of disclosure. The moves signal a shift from manual review to machine-paced auditing across public-sector systems.
Sources: The Record · SecurityWeek · ↑ top
Latest developments: A suspected China-aligned cluster is exploiting patched Roundcube webmail flaws such as CVE-2024-42009 (CVSS 9.3) to steal credentials from physics and engineering departments at U.S. and Canadian universities, while Cisco Talos reported that the actor it tracks as UAT-7810 keeps developing custom malware to grow operational relay box networks.
Espionage crews are pairing open-source webmail exploitation against academic research targets with proxy infrastructure that launders their traffic through compromised hosts. Universities running Roundcube should confirm the patches landed and hunt for credential theft in physics and engineering mailboxes.
Sources: The Hacker News · Cisco Talos · ↑ top
Latest developments: BonkDAO said holders of a large quantity of BONK exploited a malicious governance proposal to vote roughly $20 million worth of the cryptocurrency into their own wallets.
A decentralized autonomous organization lost $20 million when attackers used their own token holdings to pass a proposal that minted more coins to themselves, a purely on-chain theft that needed no code exploit. Token-governed projects should cap voting concentration and add timelocks on treasury-moving proposals.
Sources: The Record · ↑ top
Latest developments: The British military reported July 7 that Iranian projectiles hit tankers in fresh attacks on vessels crossing the Strait of Hormuz, lifting oil futures and pushing Treasury yields higher.
Iran's Revolutionary Guard has kept attacking commercial ships in the Strait of Hormuz, the waterway carrying about a fifth of the world's oil, as Tehran fights to preserve leverage over the route after its war with Israel and the United States; the strikes rattled energy and bond markets worldwide.
Sources: WSJ US Business · WSJ Markets · WSJ World News · ↑ top
Latest developments: At the NATO summit in Turkey on July 7, President Trump renewed his demand that the United States take over Danish-owned Greenland and threatened to withdraw all U.S. troops from Europe.
President Trump pressed NATO allies for loyalty and higher defense spending while reviving his push to control Greenland, deepening a transatlantic rupture that has European governments racing to plug the security gaps the United States plans to abandon.
Sources: FT Home · WSJ Politics · ↑ top
This Afternoon: Scattered Showers And Thunderstorms, high 86F.
Tonight: Scattered Showers And Thunderstorms then Areas Of Fog, low 69F.
Wednesday: Areas Of Fog then Isolated Showers And Thunderstorms, high 87F.
Latest developments: Curtiss-Wright will invest $80 million to expand in Cheswick and add 150 jobs, aided by a $1.2 million state PA SITES grant, Pennsylvania's Department of Community and Economic Development said July 7.
Manufacturer Curtiss-Wright plans to grow its operations in Cheswick, Allegheny County, in a project the state's Department of Community and Economic Development is backing through its PA SITES site-development program.
Latest developments: Carnegie Mellon's Swartz Center for Entrepreneurship will launch a weeklong innovation showcase this fall to draw venture investors to Pittsburgh, overlapping other local tech events.
Carnegie Mellon University's Swartz Center for Entrepreneurship is creating a new fall event to spotlight campus startups and lure investors, timed to coincide with a cluster of technology gatherings in the city.
Latest developments: With the 25-day closure starting Friday, July 10, PennDOT urged employers to let workers stay home and worked to clear detour routes of construction material and retime traffic signals.
PennDOT will close the Parkway East between the Squirrel Hill Tunnel and the Edgewood/Swissvale exit for 25 days beginning July 10 to replace the aging Commercial Street Bridge, rerouting a highway that carries roughly 100,000 vehicles a day.
Latest developments: An overturned tractor-trailer spilled hazardous materials on the 62nd Street Bridge late July 6, closing the span in both directions through the Tuesday commute as crews cleaned up.
The Senator Robert D. Fleming Bridge, better known as the 62nd Street Bridge and linking Pittsburgh with Sharpsburg and Etna near Route 28, shut down after a truck rolled onto its side; Cherry City Volunteer Fire Company, Allegheny County Emergency Services, and Pittsburgh's Bureau of Fire ran a large-scale hazmat response.
Sources: KDKA · Pittsburgh Post-Gazette · ↑ top
Latest developments: A surgical team at AHN Allegheny General Hospital completed the Pittsburgh region's first robotic-assisted kidney transplant, the network said.
Surgeons at Allegheny Health Network's Allegheny General Hospital on Pittsburgh's North Side used a robotic-assisted approach to transplant a kidney for the first time in the region, a technique meant to shrink incisions and speed recovery.
Latest developments: The free Northside Music Festival runs Friday through Sunday, July 10-12, across Pittsburgh's Northside.
Northside Music Festival, a free three-day outdoor celebration of live music, local food, and the arts, returns July 10-12 in Pittsburgh's Northside, mixing emerging local acts with regional headliners; Friday's opening overlaps with other neighborhood happenings.
Sources: Pittsburgh Magazine · ↑ top
Pirates (46-45)
Up Next · Braves @ Pirates · Tue Jul 7, 6:40 PM
Latest developments: Two Post-Gazette pieces examined Mike McCarthy—one on how his emphasis on first-down passing mirrors the NFL's best offenses, another profiling his knack for developing quarterbacks.
Post-Gazette analysis explained how Mike McCarthy, a coach who never played the position yet tutored Brett Favre and Aaron Rodgers, builds his Steelers offense around first-down passing, the trait the league's top-scoring units share.
Sources: Post-Gazette Steelers · Post-Gazette Steelers · ↑ top
Latest developments: A July 6 Post-Gazette video asked whether Steelers quarterback Aaron Rodgers can join Tom Brady and Peyton Manning as passers who captured a Super Bowl late in their careers.
The Post-Gazette weighed Aaron Rodgers' odds of a late-career title in Pittsburgh, measuring his situation against Tom Brady and Peyton Manning, who won championships in their late thirties and forties.
Sources: Post-Gazette Steelers · ↑ top
Latest developments: Post-Gazette columnist Noah Hiles framed the coming days as the biggest week of Paul Skenes' young career as the Pirates ace heads into the All-Star break off a rough stretch.
Noah Hiles argued that Pirates ace Paul Skenes, again the club's lone All-Star pick, faces a pivotal run to steady his mechanics and reassert his form before the break.
Sources: Post-Gazette Pirates · ↑ top
Latest developments: Belgium beat the United States 4-1 in Seattle on July 6, again eliminating the World Cup hosts in the round of 16; Christian Pulisic left with an ankle injury and reinstated striker Folarin Balogun could not spark a rally.
The United States men's national team, coached by Mauricio Pochettino, exited its home World Cup in the round of 16 for another cycle, dismantled 4-1 by Belgium despite a favorable draw and Balogun's cleared suspension; captain Christian Pulisic hobbled off hurt as Belgium's players trolled the loss.
Sources: ESPN Soccer · ESPN Soccer · Guardian World Cup 2026 · ↑ top
Latest developments: Pochettino declined July 7 to say whether he wants to stay as U.S. coach after the exit, urging fans to keep faith in the program.
Following the loss to Belgium, Mauricio Pochettino sidestepped questions about his future leading the United States men's national team, telling supporters to keep believing ahead of the next cycle.
Sources: ESPN Soccer · ↑ top
S&P 500 7,488.74 ▲ +1.5% Dow 52,552.63 ▲ +1.4% Nasdaq 26,005.54 ▲ +1.7% WTI crude 69.21 ▼ -3.7% EUR/USD 1.1415 ▲ +0.3% GBP/USD 1.3295 ▲ +0.7% USD/JPY 162.00 ▲ +0.2%