daily plain-text briefing: security, markets, business, and pittsburgh
CISA gave federal agencies until Friday to patch a maximum-severity ColdFusion flaw and three other actively exploited bugs, as researchers exposed fresh data-leaking holes in Google's and GitHub's AI agent platforms.
Latest developments: CISA added four actively exploited flaws to its Known Exploited Vulnerabilities catalog on July 7—Adobe ColdFusion path-traversal bug CVE-2026-48282 rated 10.0, Langflow authorization-bypass CVE-2026-55255, and the Joomla page-builder flaws CVE-2026-48908 and CVE-2026-56290—and ordered agencies to patch by Friday, July 10, as researchers confirmed attackers exploiting Gitea flaw CVE-2026-20896.
ColdFusion runs web applications, Langflow builds AI agents, and the JoomShaper and Joomlack page builders power Joomla sites; attackers use all four for code execution or authentication bypass, and CISA requires every federal agency to apply the vendor fixes.
Sources: The Hacker News · BleepingComputer · BleepingComputer · SecurityWeek · ↑ top
Latest developments: Varonis disclosed a now-patched rogue-agent flaw in Google's Dialogflow CX that let anyone with edit rights on one Code Block agent hijack other agents in the same Google Cloud project to read live conversations and steal data, Noma Security showed a public GitHub issue can trick GitHub Agentic Workflows into leaking an organization's private repositories through a bug dubbed GitLost, and ESET counted more than 25,000 suspicious skills among nearly 900,000 it analyzed.
Enterprises wiring autonomous AI agents into Google Cloud, GitHub, and third-party skill marketplaces open new paths for data theft; defenders should audit agent permissions, restrict cross-repository read access, and vet installed skills.
Sources: Dark Reading · Dark Reading · The Hacker News · Help Net Security · ↑ top
Latest developments: Nebula Security disclosed GhostLock, CVE-2026-43499, a 15-year-old Linux kernel flaw that gives any logged-in user full root and container escape on essentially every mainstream distribution shipped since 2011, the same day Ubiquiti patched seven critical UniFi OS bugs including a maximum-severity command-injection flaw.
GhostLock needs no special permissions, unusual settings, or network access and affects default kernels dating to 2011; administrators should apply the kernel and UniFi OS updates without delay.
Sources: The Hacker News · BleepingComputer · ↑ top
Latest developments: Cisco Talos attributed new bespoke malware called LONGLEASH to the Chinese advanced persistent threat UAT-7810, which breaks into internet-facing networking gear, chiefly unpatched Ruckus routers, to expand LapDogs, the Operational Relay Box proxy network Talos first exposed in June 2025.
Operational Relay Box networks route espionage traffic through hijacked edge devices to hide the attacker's origin; UAT-7810 targets exposed Ruckus routers, so operators should patch or replace vulnerable networking hardware.
Sources: The Hacker News · BleepingComputer · ↑ top
Latest developments: Google sued Outsider Enterprise, a China-based crew that sells phishing-as-a-service over Telegram and coaches customers to use Google's Gemini AI to spin up fake Google, YouTube, and other login pages, as Dark Reading detailed a parallel campaign impersonating big brands in fake job offers to steal marketing professionals' Google credentials.
Criminals now lean on Gemini to mass-produce convincing phishing sites for non-technical buyers; the lawsuit and the jobs-scam research both center on credential theft aimed at Google accounts.
Sources: Schneier on Security · Dark Reading · ↑ top
Latest developments: Zimperium's zLabs uncovered RedWing, a new Android bank-fraud service rented over Telegram that hands low-skill criminals full takeover of a victim's phone to steal banking logins and intercept the one-time codes protecting accounts, and identified it as a fresh variant of the $300-a-month Oblivion rent-a-malware tool.
RedWing lowers the barrier to mobile bank fraud by packaging device takeover, credential theft, and one-time-code capture as a rental; Android users should avoid sideloaded apps and unexpected accessibility-permission requests.
Sources: The Hacker News · ↑ top
Latest developments: President Trump publicly said the June ceasefire with Iran is "over" after a fresh round of tit-for-tat strikes, driving Brent crude up 6% and pushing 10-year U.S., German, and U.K. bond yields to four-week highs.
The United States and Iran traded fresh strikes after attackers hit three merchant ships off Oman, and Trump said the interim peace deal he signed in mid-June has collapsed; oil jumped roughly 6%, the dollar turned higher, gold held above $4,100 an ounce, European gas prices climbed, and global stocks slumped.
Sources: WSJ World News · FT Home · WSJ Markets · ↑ top
Latest developments: UniCredit said it lifted its voting rights in Commerzbank to 48% after the tender period closed, moving to the brink of majority control of the German lender.
Italy's UniCredit has raised its stake in Frankfurt-based Commerzbank to 48%, closing in on the first majority takeover of a large German bank by a foreign rival, a cross-border consolidation Berlin has resisted.
Sources: FT Markets · WSJ Markets · ↑ top
Today: Areas Of Fog then Isolated Showers And Thunderstorms, high 89F.
Tonight: Mostly Cloudy then Patchy Fog, low 70F.
Thursday: Scattered Showers And Thunderstorms, high 88F.
Latest developments: At a Butler County listening session, Republican gubernatorial nominee Stacy Garrity explicitly called for a pause on Pennsylvania data-center development, hardening a stance she had earlier treaded carefully around.
Stacy Garrity, the Republican nominee for Pennsylvania governor, told a Butler County audience she wants a moratorium on new data centers over concerns about local input and protections for electricity ratepayers, and she accused Governor Josh Shapiro of lacking a firm position on the projects.
Latest developments: The nonprofit Food21 will start construction converting the defunct Larimer School's auditorium and gym into a community venue called Celebration Hall.
Food21 is beginning construction to transform the shuttered Larimer School auditorium and gymnasium into Celebration Hall, an event space, food hall, and demonstration kitchen meant to support local culinary entrepreneurs in Pittsburgh's Larimer neighborhood.
Sources: PublicSource · ↑ top
Latest developments: Days before the 25-day closure starts at 9 p.m. Friday, July 10, PennDOT recommended Pittsburgh-area employees work remotely and detailed how contractors will slide the new Commercial Street Bridge into place.
PennDOT will shut the Parkway East (Interstate 376) between the Squirrel Hill Tunnel and the Edgewood/Swissvale interchange for 25 days beginning 9 p.m. Friday, July 10, to demolish and replace the Commercial Street Bridge, rerouting a corridor that carries roughly 100,000 vehicles a day.
Latest developments: Residents packed the July 7 Monroeville council meeting after the Monroeville Public Library removed a Pride Month book display from its children's section following objections from borough officials.
The Monroeville Public Library took down a Pride Month book display in its children's section early after borough officials objected, and residents crowded the July 7 council meeting to argue both sides of the removal.
Sources: TribLive · KDKA · ↑ top
Latest developments: Homeowners in Fayette County's Washington Township said the weekend's heavy rain sent sewage and stormwater through their homes, reviving frustration from a similar 2018 flood.
Residents of Washington Township in Fayette County said heavy weekend rain backed sewage and stormwater into their homes, destroying belongings and echoing a 2018 flood as they press for a lasting fix to the sewer system.
Latest developments: The Pittsburgh Passion women's tackle-football team reaches its conference championship game Saturday, July 11, at Chartiers Valley Stadium, chasing a fourth national title.
The Pittsburgh Passion, a women's tackle-football team, play their conference final Saturday, July 11, at Chartiers Valley Stadium in Bridgeville, one win from a shot at a fourth national championship.
Sources: Pittsburgh City Paper · ↑ top
Pirates (47-45)
Tue Jul 7 · Braves 4 · Pirates 12 · Final
O'Hearn sets Pirates franchise record with 10 RBIs, Skenes snaps out of funk in 12-4 win over Braves
Up Next · Braves @ Pirates · Wed Jul 8, 6:40 PM
Latest developments: The Post-Gazette reported that Pirates rookie phenom Konnor Griffin will likely stay out until September, forcing Jack Brannigan and Jared Triolo to cover.
The Pittsburgh Post-Gazette reported that Pirates rookie Konnor Griffin, one of baseball's top prospects, will probably miss until September, a blow to a reeling club now leaning on Jack Brannigan and Jared Triolo.
Sources: Post-Gazette Pirates · ↑ top
Latest developments: A Post-Gazette draft preview asks whether the Pirates will again spend the No. 5 overall pick on a high schooler, spotlighting prospect Kevan Graves.
Ahead of the MLB Draft, the Post-Gazette weighed whether the Pirates will use the No. 5 overall pick on another high schooler, highlighting prep prospect Kevan Graves.
Sources: Post-Gazette Pirates · ↑ top
Latest developments: A Post-Gazette analysis broke down how Mike McCarthy builds his offense around passing on first down.
The Post-Gazette detailed how Mike McCarthy structures his offense around passing on first down, tying the approach to Aaron Rodgers and the NFL's most productive attacks as the Steelers shape their 2026 plans.
Sources: Post-Gazette Steelers · ↑ top
Latest developments: U.S. Soccer will divide the $16 million in FIFA prize money from the men's round-of-16 run equally between the men's and women's national teams.
U.S. Soccer earned $16 million from FIFA for the men's national team reaching the round of 16 at the 2026 World Cup, where Belgium beat the Americans 4-1, and the federation will split that prize equally between its men's and women's teams.
Sources: ESPN Soccer · ↑ top
Latest developments: Paris Saint-Germain, Tottenham Hotspur, and Chelsea are all competing to sign U.S. striker Folarin Balogun from Monaco this summer.
Paris Saint-Germain, Tottenham Hotspur, and Chelsea are vying to sign United States men's national team striker Folarin Balogun, who plays for Monaco, in the open summer transfer window.
Sources: ESPN Soccer · ↑ top
S&P 500 7,501.42 ▲ +1.7% Dow 52,701.11 ▲ +1.5% Nasdaq 26,005.25 ▲ +1.9% WTI crude 69.15 ▼ -2.7% EUR/USD 1.1419 ▲ +0.3% GBP/USD 1.3324 ▲ +0.9% USD/JPY 162.03 ▲ +0.2%