================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Tuesday, July 7, 2026 - 12:06 PM EDT ================================================================ Britain and the United States both wired frontier AI into national cyber defense as researchers showed the same agentic tools leaking private data across GitHub and enterprise platforms. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Frontier AI is cutting both ways as Britain's Cyber Shield and CISA harden defenses while GitHub Agentic Workflows can be tricked into leaking an organization's private repositories. see: Governments Deploy AI for Cyber Defense; AI Agents Leak Data Across the Supply Chain * [TREND] Authentication bypasses keep surfacing in network gear, with BeyondTrust patching pre-auth CVE-2026-40138 and CERT/CC flagging a hidden backdoor baked into Tenda router firmware. see: BeyondTrust and Tenda Authentication Bypass Flaws * [TREND] A China-aligned cluster is exploiting patched Roundcube flaw CVE-2024-42009 to steal credentials from U.S. and Canadian university physics departments while building ORB networks. see: China-Aligned Hackers Hit Universities and Build ORB Networks * [UPDATE (new)] On enforcement, Spain and Dutch police arrested pro-Russian hacktivists and card phishers, while BonkDAO holders exploited a malicious proposal to drain $20 million in BONK. see: Arrests Hit Hacktivists and Card Phishers; BonkDAO Governance Attack Nets $20 Million * [UPDATE (new)] Global risk rose as Iran struck tankers in the Strait of Hormuz while Trump pushed a Greenland takeover and a Europe troop pullout at the NATO summit. see: Iran Strikes Tankers in the Strait of Hormuz; Trump Threatens Europe Pullout, Revives Greenland Bid * [UPDATE (new)] Locally, Pittsburgh braces for the 25-day Parkway East closure starting Friday as a hazmat spill keeps the 62nd Street Bridge shut through the commute. see: Parkway East Closure Nears; Hazmat Spill Shuts 62nd Street Bridge SECURITY ---------------------------------------------------------------- 1. AI AGENTS LEAK DATA ACROSS THE SUPPLY CHAIN AI Security · [ai, supply-chain, vulnerability] Latest developments: Noma Security showed July 7 that one normal-looking issue opened on a public GitHub repository tricks GitHub Agentic Workflows into leaking an organization's private repositories with no credentials, while Sand Security disclosed WriteOut, a now-patched one-click flaw in the Writer enterprise AI platform that lets an outsider take over any tenant across the boundary. Enterprises grant AI coding agents broad read access and connect them to continuous-integration pipelines, and researchers keep finding the agents spill data on their own. Restrict agent repository scope, audit standing OAuth grants, and treat AI-written dependencies as unvetted supply chain. - The Hacker News: https://thehackernews.com/2026/07/public-github-issue-could-trick-github.html - The Hacker News: https://thehackernews.com/2026/07/writer-ai-flaw-could-let-agent-previews.html - BleepingComputer: https://www.bleepingcomputer.com/news/security/the-github-actions-attack-pattern-your-ci-security-scanners-miss/ - The Hacker News: https://thehackernews.com/2026/07/what-changes-when-your-software-supply.html 2. ARRESTS HIT HACKTIVISTS AND CARD PHISHERS Ransomware and Cybercrime · [arrest, hacktivism, phishing] Latest developments: Spain's National Police arrested a suspected member of the pro-Russian hacktivist groups CyberArmy of Russia Reborn and Z-Pentest, Dutch police arrested two young men running a credit-card phishing operation as the Netherlands earned the title of Europe's worst country for payment fraud, a newly unsealed U.S. complaint revealed a persistent Windows device ID that tied alleged Scattered Spider hacker Peter Stokes, 19, to the May 2025 luxury-jewelry-retailer intrusion, and Canada's Communications Security Establishment disclosed it ran offensive operations in 2025 against a ransomware-as-a-service gang, an extremist group, and drug traffickers. Law enforcement across Spain, the Netherlands, the United States, and Canada moved against hacktivists, fraudsters, and ransomware crews in a single day. The Stokes complaint shows a Microsoft-recorded device identifier can survive an intrusion long enough to unmask the operator. - BleepingComputer: https://www.bleepingcomputer.com/news/security/spain-arrests-suspected-member-of-pro-russian-hacktivist-groups/ - Graham Cluley: https://www.bitdefender.com/en-us/blog/hotforsecurity/two-arrested-credit-card-phishing-netherlands-europe-payment-fraud - The Hacker News: https://thehackernews.com/2026/07/court-filing-reveals-windows-device-id.html - The Record: https://therecord.media/canada-cse-2025-cyber-operations-ransomware-drugs-extremism 3. BEYONDTRUST AND TENDA AUTHENTICATION BYPASS FLAWS Vulnerabilities and Exploits · [patch, vulnerability, backdoor] Latest developments: BeyondTrust patched two critical flaws in its Remote Support and Privileged Remote Access products, including pre-authentication bug CVE-2026-40138 (CVSS 9.2) that lets unauthenticated attackers seize control of a device, while CERT/CC warned of CVE-2026-11405, an undocumented admin backdoor embedded in several Tenda router firmware versions that skips the password check entirely. Two vendors that sit at the network edge—one guarding privileged remote access, one shipping consumer and small-office routers—both let attackers walk past authentication. Apply BeyondTrust's updates immediately and pull affected Tenda firmware off internet-facing management interfaces. - The Hacker News: https://thehackernews.com/2026/07/beyondtrust-patches-critical-auth.html - BleepingComputer: https://www.bleepingcomputer.com/news/security/beyondtrust-warns-of-critical-flaws-in-remote-access-software/ - The Hacker News: https://thehackernews.com/2026/07/certcc-warns-of-hidden-admin-backdoor.html 4. GOVERNMENTS DEPLOY AI FOR CYBER DEFENSE AI Security · [ai, policy, government] Latest developments: Britain's National Cyber Security Centre unveiled Cyber Shield, an autonomous AI capability built to counter attackers who 'move at machine speed and greater scale,' the same day SecurityWeek reported that CISA's Attack Surface Evaluation team is running Anthropic's Mythos model to scan U.S. government software for flaws. Both governments now field frontier AI to speed vulnerability discovery and defensive response as adversaries weaponize new CVEs within hours of disclosure. The moves signal a shift from manual review to machine-paced auditing across public-sector systems. - The Record: https://therecord.media/britain-plans-autonomous-ai-cyber-shield - SecurityWeek: https://www.securityweek.com/cisa-reportedly-using-anthropics-mythos-to-scan-government-software-for-flaws/ 5. CHINA-ALIGNED HACKERS HIT UNIVERSITIES AND BUILD ORB NETWORKS Nation-State Activity · [apt, espionage] Latest developments: A suspected China-aligned cluster is exploiting patched Roundcube webmail flaws such as CVE-2024-42009 (CVSS 9.3) to steal credentials from physics and engineering departments at U.S. and Canadian universities, while Cisco Talos reported that the actor it tracks as UAT-7810 keeps developing custom malware to grow operational relay box networks. Espionage crews are pairing open-source webmail exploitation against academic research targets with proxy infrastructure that launders their traffic through compromised hosts. Universities running Roundcube should confirm the patches landed and hunt for credential theft in physics and engineering mailboxes. - The Hacker News: https://thehackernews.com/2026/07/suspected-china-aligned-hackers-exploit.html - Cisco Talos: https://blog.talosintelligence.com/uat-7810/ 6. BONKDAO GOVERNANCE ATTACK NETS $20 MILLION Ransomware and Cybercrime · [cryptocurrency, fraud] Latest developments: BonkDAO said holders of a large quantity of BONK exploited a malicious governance proposal to vote roughly $20 million worth of the cryptocurrency into their own wallets. A decentralized autonomous organization lost $20 million when attackers used their own token holdings to pass a proposal that minted more coins to themselves, a purely on-chain theft that needed no code exploit. Token-governed projects should cap voting concentration and add timelocks on treasury-moving proposals. - The Record: https://therecord.media/attackers-vote-themselves-20-million-bonk-crypto BUSINESS AND POLITICS ---------------------------------------------------------------- * Iran Strikes Tankers in the Strait of Hormuz Latest developments: The British military reported July 7 that Iranian projectiles hit tankers in fresh attacks on vessels crossing the Strait of Hormuz, lifting oil futures and pushing Treasury yields higher. Iran's Revolutionary Guard has kept attacking commercial ships in the Strait of Hormuz, the waterway carrying about a fifth of the world's oil, as Tehran fights to preserve leverage over the route after its war with Israel and the United States; the strikes rattled energy and bond markets worldwide. - WSJ US Business: https://www.wsj.com/finance/commodities-futures/oil-rises-on-possible-position-adjustments-before-expected-resumption-of-u-s-iran-talks-ead21cdc?mod=pls_whats_news_us_business_f - WSJ Markets: https://www.wsj.com/finance/jgbs-mixed-ahead-of-30-year-auction-2661524b?mod=rss_markets_main - WSJ World News: https://www.wsj.com/world/middle-east/irans-attacks-on-ships-betray-its-concern-over-losing-its-grip-on-hormuz-a7da2da0 * Trump Threatens Europe Pullout, Revives Greenland Bid Latest developments: At the NATO summit in Turkey on July 7, President Trump renewed his demand that the United States take over Danish-owned Greenland and threatened to withdraw all U.S. troops from Europe. President Trump pressed NATO allies for loyalty and higher defense spending while reviving his push to control Greenland, deepening a transatlantic rupture that has European governments racing to plug the security gaps the United States plans to abandon. - FT Home: https://www.ft.com/content/a23fcb67-9ef9-4a07-b645-e4f6d1474334 - WSJ Politics: https://www.wsj.com/politics/national-security/europe-races-to-plug-security-holes-after-u-s-nato-pullback-97b2e9a8 PITTSBURGH ---------------------------------------------------------------- Weather: This Afternoon: Scattered Showers And Thunderstorms, high 86F. Tonight: Scattered Showers And Thunderstorms then Areas Of Fog, low 69F. Wednesday: Areas Of Fog then Isolated Showers And Thunderstorms, high 87F. Business: * Curtiss-Wright to Expand in Cheswick Latest developments: Curtiss-Wright will invest $80 million to expand in Cheswick and add 150 jobs, aided by a $1.2 million state PA SITES grant, Pennsylvania's Department of Community and Economic Development said July 7. Manufacturer Curtiss-Wright plans to grow its operations in Cheswick, Allegheny County, in a project the state's Department of Community and Economic Development is backing through its PA SITES site-development program. - WPXI: https://www.wpxi.com/news/local/manufacturer-invest-80m-expansion-cheswick-add-150-jobs/PECM3UDJ3ZFLZOUPRVXALMS6OA/ * CMU Plans Fall Startup Showcase Latest developments: Carnegie Mellon's Swartz Center for Entrepreneurship will launch a weeklong innovation showcase this fall to draw venture investors to Pittsburgh, overlapping other local tech events. Carnegie Mellon University's Swartz Center for Entrepreneurship is creating a new fall event to spotlight campus startups and lure investors, timed to coincide with a cluster of technology gatherings in the city. - WPXI: https://www.wpxi.com/news/local/carnegie-mellon-university-launching-startup-showcase-aiming-lure-investors-pittsburgh/UNU7HEKEXVBA7G2OVWSEVX6KIY/ Around town: * Parkway East Closure Nears Latest developments: With the 25-day closure starting Friday, July 10, PennDOT urged employers to let workers stay home and worked to clear detour routes of construction material and retime traffic signals. PennDOT will close the Parkway East between the Squirrel Hill Tunnel and the Edgewood/Swissvale exit for 25 days beginning July 10 to replace the aging Commercial Street Bridge, rerouting a highway that carries roughly 100,000 vehicles a day. - WTAE: https://www.wtae.com/article/penndot-encouraging-businesses-let-employees-work-home-closure/71850997 - KDKA: https://www.cbsnews.com/pittsburgh/news/penndot-parkway-east-closure-traffic-obstacles-detour-routes/ * Hazmat Spill Shuts 62nd Street Bridge Latest developments: An overturned tractor-trailer spilled hazardous materials on the 62nd Street Bridge late July 6, closing the span in both directions through the Tuesday commute as crews cleaned up. The Senator Robert D. Fleming Bridge, better known as the 62nd Street Bridge and linking Pittsburgh with Sharpsburg and Etna near Route 28, shut down after a truck rolled onto its side; Cherry City Volunteer Fire Company, Allegheny County Emergency Services, and Pittsburgh's Bureau of Fire ran a large-scale hazmat response. - KDKA: https://www.cbsnews.com/pittsburgh/news/overturned-truck-62nd-street-bridge-hazardous-materials-spill/ - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/transportation/2026/07/07/pittsburgh-hazmat-incident-62nd-street-bridge/stories/202607070027 * AGH Performs Region's First Robotic Kidney Transplant Latest developments: A surgical team at AHN Allegheny General Hospital completed the Pittsburgh region's first robotic-assisted kidney transplant, the network said. Surgeons at Allegheny Health Network's Allegheny General Hospital on Pittsburgh's North Side used a robotic-assisted approach to transplant a kidney for the first time in the region, a technique meant to shrink incisions and speed recovery. - WPXI: https://www.wpxi.com/news/local/pittsburgh-regions-first-robotic-assisted-kidney-transplant-performed-allegheny-general-hospital/T74SOOWJGRA4BN3RXJNVKMTFCE/ Events: * Northside Music Festival Latest developments: The free Northside Music Festival runs Friday through Sunday, July 10-12, across Pittsburgh's Northside. Northside Music Festival, a free three-day outdoor celebration of live music, local food, and the arts, returns July 10-12 in Pittsburgh's Northside, mixing emerging local acts with regional headliners; Friday's opening overlaps with other neighborhood happenings. - Pittsburgh Magazine: https://www.pittsburghmagazine.com/things-to-do-this-weekend-in-pittsburgh/ SPORTS ---------------------------------------------------------------- Pirates (46-45) Up Next · Braves @ Pirates · Tue Jul 7, 6:40 PM https://plaintextsports.com/mlb/2026-07-07/atl-pit Around the Teams: * McCarthy's Passing Philosophy Shapes the Steelers Latest developments: Two Post-Gazette pieces examined Mike McCarthy—one on how his emphasis on first-down passing mirrors the NFL's best offenses, another profiling his knack for developing quarterbacks. Post-Gazette analysis explained how Mike McCarthy, a coach who never played the position yet tutored Brett Favre and Aaron Rodgers, builds his Steelers offense around first-down passing, the trait the league's top-scoring units share. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/07/07/analysis-passing-mccarthy-rodgers-allar-howard/stories/202607030012 - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/07/06/mccarthy-coach-quarterback-favre-rodgers-allar-gannon/stories/202606260069 * Can Rodgers Win Late Like Brady and Manning Latest developments: A July 6 Post-Gazette video asked whether Steelers quarterback Aaron Rodgers can join Tom Brady and Peyton Manning as passers who captured a Super Bowl late in their careers. The Post-Gazette weighed Aaron Rodgers' odds of a late-career title in Pittsburgh, measuring his situation against Tom Brady and Peyton Manning, who won championships in their late thirties and forties. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/07/06/nfl-news-rumors-aaron-rodgers-tom-brady-peyton-manning/stories/202607060023 * Hiles Calls It Skenes' Biggest Week Latest developments: Post-Gazette columnist Noah Hiles framed the coming days as the biggest week of Paul Skenes' young career as the Pirates ace heads into the All-Star break off a rough stretch. Noah Hiles argued that Pirates ace Paul Skenes, again the club's lone All-Star pick, faces a pivotal run to steady his mechanics and reassert his form before the break. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/07/06/pirates-skenes-allstar-playoffs-mlb-postseason/stories/202607060021 Team USA: * USMNT Crashes Out to Belgium Latest developments: Belgium beat the United States 4-1 in Seattle on July 6, again eliminating the World Cup hosts in the round of 16; Christian Pulisic left with an ankle injury and reinstated striker Folarin Balogun could not spark a rally. The United States men's national team, coached by Mauricio Pochettino, exited its home World Cup in the round of 16 for another cycle, dismantled 4-1 by Belgium despite a favorable draw and Balogun's cleared suspension; captain Christian Pulisic hobbled off hurt as Belgium's players trolled the loss. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49291529/usa-belgium-20206-fifa-world-cup - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49291866/christian-pulisic-injury-usa-belgium-2026-world-cup - Guardian World Cup 2026: https://www.theguardian.com/football/2026/jul/07/usmnt-world-cup-belgium * Pochettino Noncommittal on U.S. Future Latest developments: Pochettino declined July 7 to say whether he wants to stay as U.S. coach after the exit, urging fans to keep faith in the program. Following the loss to Belgium, Mauricio Pochettino sidestepped questions about his future leading the United States men's national team, telling supporters to keep believing ahead of the next cycle. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49292813/mauricio-pochettino-usa-coach-future-2026-world-cup-belgium READING ---------------------------------------------------------------- * Stratechery -- A Script for Mark Zuckerberg Ben Thompson drafts the remarks he thinks Mark Zuckerberg should deliver on Meta's next earnings call, laying out how the company should frame its heavy AI spending and strategy for investors. https://stratechery.com/2026/a-script-for-mark-zuckerberg/ * Ed Zitron -- Premium: The Hater's Guide To SoftBank Zitron dissects SoftBank and Masayoshi Son after the group's 46th annual shareholder meeting, mocking the presentation and questioning the durability of its AI-driven investment thesis. https://www.wheresyoured.at/premium-the-haters-guide-to-softbank/ * Cal Newport -- Beware of Productivity Paradoxes Newport uses the personal computer's underwhelming early productivity record to warn that powerful new tools, AI included, often fail to deliver the efficiency leaps their boosters promise. https://calnewport.com/beware-of-productivity-paradoxes/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,488.74 ▲ +1.5% Dow 52,552.63 ▲ +1.4% Nasdaq 26,005.54 ▲ +1.7% WTI crude 69.21 ▼ -3.7% EUR/USD 1.1415 ▲ +0.3% GBP/USD 1.3295 ▲ +0.7% USD/JPY 162.00 ▲ +0.2% ================================================================ Generated 2026-07-07 12:06 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================