================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Wednesday, July 8, 2026 - 6:06 AM EDT ================================================================ CISA gave federal agencies until Friday to patch a maximum-severity ColdFusion flaw and three other actively exploited bugs, as researchers exposed fresh data-leaking holes in Google's and GitHub's AI agent platforms. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Newly disclosed rogue-agent flaws in Google's Dialogflow CX let attackers hijack agents, while Google sued a Gemini-powered phishing crew, exposing enterprise AI platforms as a new attack surface. see: AI Agent Platforms Leak Private Data; Google Sues Gemini-Powered Phishing Service * [UPDATE (new)] CISA gave agencies until Friday to fix an actively exploited ColdFusion path-traversal bug rated 10.0, as researchers disclosed GhostLock, a 15-year-old Linux kernel flaw granting any user root. see: CISA Rushes ColdFusion, Langflow, and Joomla Patches; GhostLock Kernel Flaw and Ubiquiti UniFi Bugs * [TREND] Cisco Talos tied new LONGLEASH malware to Chinese threat actor UAT-7810, which hijacks unpatched Ruckus routers to expand its LapDogs relay-box network. see: China's UAT-7810 Grows LONGLEASH ORB Network * [UPDATE (new)] Zimperium uncovered RedWing, a Telegram-rented Android service handing low-skill criminals full phone takeover to steal banking logins and intercept the one-time codes protecting accounts. see: RedWing Rents Android Bank Fraud * [TREND] Trump declared the Iran ceasefire over, sending Brent crude up 6% and bond yields to four-week highs, as UniCredit neared majority control of Commerzbank. see: Trump Declares Iran Ceasefire Over as Oil Jumps; UniCredit Nears Control of Commerzbank * [UPDATE (new)] PennDOT urged Pittsburgh employees to work remotely before Friday's 25-day Parkway East closure to slide the new Commercial Street Bridge into place. see: Parkway East Closes Friday for Bridge Swap SECURITY ---------------------------------------------------------------- 1. CISA RUSHES COLDFUSION, LANGFLOW, AND JOOMLA PATCHES Vulnerabilities and Exploits · [patch, exploit, kev] Latest developments: CISA added four actively exploited flaws to its Known Exploited Vulnerabilities catalog on July 7—Adobe ColdFusion path-traversal bug CVE-2026-48282 rated 10.0, Langflow authorization-bypass CVE-2026-55255, and the Joomla page-builder flaws CVE-2026-48908 and CVE-2026-56290—and ordered agencies to patch by Friday, July 10, as researchers confirmed attackers exploiting Gitea flaw CVE-2026-20896. ColdFusion runs web applications, Langflow builds AI agents, and the JoomShaper and Joomlack page builders power Joomla sites; attackers use all four for code execution or authentication bypass, and CISA requires every federal agency to apply the vendor fixes. - The Hacker News: https://thehackernews.com/2026/07/cisa-adds-4-actively-exploited-adobe.html - BleepingComputer: https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-max-severity-coldfusion-flaw-by-friday/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-prioritize-patching-langflow-auth-bypass-flaw/ - SecurityWeek: https://www.securityweek.com/critical-gitea-flaw-under-active-exploitation-researchers-warn/ 2. AI AGENT PLATFORMS LEAK PRIVATE DATA AI Security · [ai, breach] Latest developments: Varonis disclosed a now-patched rogue-agent flaw in Google's Dialogflow CX that let anyone with edit rights on one Code Block agent hijack other agents in the same Google Cloud project to read live conversations and steal data, Noma Security showed a public GitHub issue can trick GitHub Agentic Workflows into leaking an organization's private repositories through a bug dubbed GitLost, and ESET counted more than 25,000 suspicious skills among nearly 900,000 it analyzed. Enterprises wiring autonomous AI agents into Google Cloud, GitHub, and third-party skill marketplaces open new paths for data theft; defenders should audit agent permissions, restrict cross-repository read access, and vet installed skills. - Dark Reading: https://www.darkreading.com/application-security/dialogflow-cx-rogue-agent-flaw-enabled-ai-chatbot-data-theft - Dark Reading: https://www.darkreading.com/cyber-risk/gitlost-leaks-private-data-github-agentic-workflows - The Hacker News: https://thehackernews.com/2026/07/public-github-issue-could-trick-github.html - Help Net Security: https://www.helpnetsecurity.com/2026/07/08/eset-ai-threat-trends-report/ 3. GHOSTLOCK KERNEL FLAW AND UBIQUITI UNIFI BUGS Vulnerabilities and Exploits · [patch, vulnerability] Latest developments: Nebula Security disclosed GhostLock, CVE-2026-43499, a 15-year-old Linux kernel flaw that gives any logged-in user full root and container escape on essentially every mainstream distribution shipped since 2011, the same day Ubiquiti patched seven critical UniFi OS bugs including a maximum-severity command-injection flaw. GhostLock needs no special permissions, unusual settings, or network access and affects default kernels dating to 2011; administrators should apply the kernel and UniFi OS updates without delay. - The Hacker News: https://thehackernews.com/2026/07/15-year-old-ghostlock-flaw-enables-root.html - BleepingComputer: https://www.bleepingcomputer.com/news/security/ubiquiti-warns-of-new-max-severity-unifi-os-vulnerability/ 4. CHINA'S UAT-7810 GROWS LONGLEASH ORB NETWORK Nation-State Activity · [apt, malware] Latest developments: Cisco Talos attributed new bespoke malware called LONGLEASH to the Chinese advanced persistent threat UAT-7810, which breaks into internet-facing networking gear, chiefly unpatched Ruckus routers, to expand LapDogs, the Operational Relay Box proxy network Talos first exposed in June 2025. Operational Relay Box networks route espionage traffic through hijacked edge devices to hide the attacker's origin; UAT-7810 targets exposed Ruckus routers, so operators should patch or replace vulnerable networking hardware. - The Hacker News: https://thehackernews.com/2026/07/china-linked-uat-7810-expands-orb.html - BleepingComputer: https://www.bleepingcomputer.com/news/security/chinese-hackers-develop-longleash-malware-to-expand-orb-network/ 5. GOOGLE SUES GEMINI-POWERED PHISHING SERVICE Ransomware and Cybercrime · [phishing, ai] Latest developments: Google sued Outsider Enterprise, a China-based crew that sells phishing-as-a-service over Telegram and coaches customers to use Google's Gemini AI to spin up fake Google, YouTube, and other login pages, as Dark Reading detailed a parallel campaign impersonating big brands in fake job offers to steal marketing professionals' Google credentials. Criminals now lean on Gemini to mass-produce convincing phishing sites for non-technical buyers; the lawsuit and the jobs-scam research both center on credential theft aimed at Google accounts. - Schneier on Security: https://www.schneier.com/blog/archives/2026/07/google-is-suing-chinese-scammers-who-are-using-gemini.html - Dark Reading: https://www.darkreading.com/cyberattacks-data-breaches/big-brand-jobs-scam-marketing-pros-google-accounts 6. REDWING RENTS ANDROID BANK FRAUD Ransomware and Cybercrime · [malware, fraud] Latest developments: Zimperium's zLabs uncovered RedWing, a new Android bank-fraud service rented over Telegram that hands low-skill criminals full takeover of a victim's phone to steal banking logins and intercept the one-time codes protecting accounts, and identified it as a fresh variant of the $300-a-month Oblivion rent-a-malware tool. RedWing lowers the barrier to mobile bank fraud by packaging device takeover, credential theft, and one-time-code capture as a rental; Android users should avoid sideloaded apps and unexpected accessibility-permission requests. - The Hacker News: https://thehackernews.com/2026/07/redwing-maas-packages-android-bank.html BUSINESS AND POLITICS ---------------------------------------------------------------- * Trump Declares Iran Ceasefire Over as Oil Jumps Latest developments: President Trump publicly said the June ceasefire with Iran is "over" after a fresh round of tit-for-tat strikes, driving Brent crude up 6% and pushing 10-year U.S., German, and U.K. bond yields to four-week highs. The United States and Iran traded fresh strikes after attackers hit three merchant ships off Oman, and Trump said the interim peace deal he signed in mid-June has collapsed; oil jumped roughly 6%, the dollar turned higher, gold held above $4,100 an ounce, European gas prices climbed, and global stocks slumped. - WSJ World News: https://www.wsj.com/world/trump-says-ceasefire-with-iran-is-over-6cf9675e - FT Home: https://www.ft.com/content/c7dac217-4a77-4640-9aa4-17ae7b0d5c0c - WSJ Markets: https://www.wsj.com/finance/investing/u-s-european-government-bond-yields-rise-as-middle-east-tensions-escalate-9bec3733?mod=rss_markets_main * UniCredit Nears Control of Commerzbank Latest developments: UniCredit said it lifted its voting rights in Commerzbank to 48% after the tender period closed, moving to the brink of majority control of the German lender. Italy's UniCredit has raised its stake in Frankfurt-based Commerzbank to 48%, closing in on the first majority takeover of a large German bank by a foreign rival, a cross-border consolidation Berlin has resisted. - FT Markets: https://www.ft.com/content/aa19cfe8-92a8-46f6-9395-60bb3ec66927 - WSJ Markets: https://www.wsj.com/business/unicredit-nearly-secures-majority-control-in-commerzbank-d76b290c?mod=rss_markets_main PITTSBURGH ---------------------------------------------------------------- Weather: Today: Areas Of Fog then Isolated Showers And Thunderstorms, high 89F. Tonight: Mostly Cloudy then Patchy Fog, low 70F. Thursday: Scattered Showers And Thunderstorms, high 88F. Business: * Garrity Calls for Pause on Data Centers Latest developments: At a Butler County listening session, Republican gubernatorial nominee Stacy Garrity explicitly called for a pause on Pennsylvania data-center development, hardening a stance she had earlier treaded carefully around. Stacy Garrity, the Republican nominee for Pennsylvania governor, told a Butler County audience she wants a moratorium on new data centers over concerns about local input and protections for electricity ratepayers, and she accused Governor Josh Shapiro of lacking a firm position on the projects. - WTAE: https://www.wtae.com/article/pennsylvania-data-centers-stacy-garrity/71858004 - WPXI: https://www.wpxi.com/news/local/stacy-garrity-bashes-gov-shapiro-data-center-development-policies-during-event-butler-county/JZETJ5MP7BB6NN7KIUDZSV5VG4/ * Larimer's Celebration Hall Breaks Ground Latest developments: The nonprofit Food21 will start construction converting the defunct Larimer School's auditorium and gym into a community venue called Celebration Hall. Food21 is beginning construction to transform the shuttered Larimer School auditorium and gymnasium into Celebration Hall, an event space, food hall, and demonstration kitchen meant to support local culinary entrepreneurs in Pittsburgh's Larimer neighborhood. - PublicSource: https://www.publicsource.org/larimer-builds-community-spaces/ Around town: * Parkway East Closes Friday for Bridge Swap Latest developments: Days before the 25-day closure starts at 9 p.m. Friday, July 10, PennDOT recommended Pittsburgh-area employees work remotely and detailed how contractors will slide the new Commercial Street Bridge into place. PennDOT will shut the Parkway East (Interstate 376) between the Squirrel Hill Tunnel and the Edgewood/Swissvale interchange for 25 days beginning 9 p.m. Friday, July 10, to demolish and replace the Commercial Street Bridge, rerouting a corridor that carries roughly 100,000 vehicles a day. - KDKA: https://www.cbsnews.com/pittsburgh/news/penndot-remote-work-parkway-east-pittsburgh-employees/ - KDKA: https://www.cbsnews.com/pittsburgh/news/penndot-heres-how-moving-commercial-street-bridge-parkway-east/ * Monroeville Library Pride Display Sparks Clash Latest developments: Residents packed the July 7 Monroeville council meeting after the Monroeville Public Library removed a Pride Month book display from its children's section following objections from borough officials. The Monroeville Public Library took down a Pride Month book display in its children's section early after borough officials objected, and residents crowded the July 7 council meeting to argue both sides of the removal. - TribLive: https://triblive.com/local/monroeville/residents-pack-monroeville-council-chambers-in-response-to-controversy-over-pride-month-display-at-library/ - KDKA: https://www.cbsnews.com/pittsburgh/video/heated-discussion-in-monroeville-over-pride-display-in-childrens-section-of-library/ * Sewage Floods Washington Township Homes Latest developments: Homeowners in Fayette County's Washington Township said the weekend's heavy rain sent sewage and stormwater through their homes, reviving frustration from a similar 2018 flood. Residents of Washington Township in Fayette County said heavy weekend rain backed sewage and stormwater into their homes, destroying belongings and echoing a 2018 flood as they press for a lasting fix to the sewer system. - WTAE: https://www.wtae.com/article/pennsylvania-flooding-fayette-county-washington-township/71858084 - WPXI: https://www.wpxi.com/news/local/sewage-stormwaters-flood-washington-township-homes-residents-look-solutions/2EQDCV2EEJHYFF7LZUYCCE52G4/ Events: * Pittsburgh Passion Play for Conference Title Latest developments: The Pittsburgh Passion women's tackle-football team reaches its conference championship game Saturday, July 11, at Chartiers Valley Stadium, chasing a fourth national title. The Pittsburgh Passion, a women's tackle-football team, play their conference final Saturday, July 11, at Chartiers Valley Stadium in Bridgeville, one win from a shot at a fourth national championship. - Pittsburgh City Paper: https://www.pghcitypaper.com/arts-entertainment-2/sports/pittsburgh-passion-womens-tackle-football-could-win-fourth-national-title/ SPORTS ---------------------------------------------------------------- Pirates (47-45) Tue Jul 7 · Braves 4 · Pirates 12 · Final O'Hearn sets Pirates franchise record with 10 RBIs, Skenes snaps out of funk in 12-4 win over Braves https://plaintextsports.com/mlb/2026-07-07/atl-pit Up Next · Braves @ Pirates · Wed Jul 8, 6:40 PM https://plaintextsports.com/mlb/2026-07-08/atl-pit Around the Teams: * Griffin Sidelined Until September Latest developments: The Post-Gazette reported that Pirates rookie phenom Konnor Griffin will likely stay out until September, forcing Jack Brannigan and Jared Triolo to cover. The Pittsburgh Post-Gazette reported that Pirates rookie Konnor Griffin, one of baseball's top prospects, will probably miss until September, a blow to a reeling club now leaning on Jack Brannigan and Jared Triolo. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/07/07/mlb-news-konnor-griffin-injury-jack-brannigan-jared-triolo/stories/202607070035 * Pirates Weigh Another Prep Pick at No. 5 Latest developments: A Post-Gazette draft preview asks whether the Pirates will again spend the No. 5 overall pick on a high schooler, spotlighting prospect Kevan Graves. Ahead of the MLB Draft, the Post-Gazette weighed whether the Pirates will use the No. 5 overall pick on another high schooler, highlighting prep prospect Kevan Graves. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/07/08/mlb-draft-preview-pirates-kevan-graves/stories/202607070029 * McCarthy Leans on First-Down Passing Latest developments: A Post-Gazette analysis broke down how Mike McCarthy builds his offense around passing on first down. The Post-Gazette detailed how Mike McCarthy structures his offense around passing on first down, tying the approach to Aaron Rodgers and the NFL's most productive attacks as the Steelers shape their 2026 plans. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/07/07/analysis-passing-mccarthy-rodgers-allar-howard/stories/202607030012 Team USA: * U.S. Soccer Splits $16M Prize Equally Latest developments: U.S. Soccer will divide the $16 million in FIFA prize money from the men's round-of-16 run equally between the men's and women's national teams. U.S. Soccer earned $16 million from FIFA for the men's national team reaching the round of 16 at the 2026 World Cup, where Belgium beat the Americans 4-1, and the federation will split that prize equally between its men's and women's teams. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49301582/us-men-women-get-equal-split-16m-world-cup-prize * PSG, Spurs, Chelsea Chase Balogun Latest developments: Paris Saint-Germain, Tottenham Hotspur, and Chelsea are all competing to sign U.S. striker Folarin Balogun from Monaco this summer. Paris Saint-Germain, Tottenham Hotspur, and Chelsea are vying to sign United States men's national team striker Folarin Balogun, who plays for Monaco, in the open summer transfer window. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49304151/transfer-rumors-news-psg-spurs-chelsea-eye-usmnt-monaco-striker-folarin-balogun READING ---------------------------------------------------------------- * Stratechery -- XBOX Cuts; Bundling and the Internet Solvent; Transaction, Coordination, and Sunk Costs Reads Microsoft's big Xbox layoffs as the failure of its Game Pass bundling strategy, then argues the internet acts as a solvent on bundles and uses transaction, coordination, and sunk costs to explain which business models hold together. https://stratechery.com/2026/xbox-cuts-bundling-and-the-internet-solvent-transaction-coordination-and-sunk-costs/ * Ed Zitron -- Let AI Burn Argues the AI industry's mounting losses and shaky economics do not justify the capital pouring into companies like Nvidia and Anthropic, and that the buildout should be left to collapse rather than propped up. https://www.wheresyoured.at/let-ai-burn/ * Cal Newport -- Beware of Productivity Paradoxes Warns that technologies promising obvious productivity gains, like the personal computer, often fail to deliver them, and urges skepticism toward similar claims made for new tools. https://calnewport.com/beware-of-productivity-paradoxes/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,501.42 ▲ +1.7% Dow 52,701.11 ▲ +1.5% Nasdaq 26,005.25 ▲ +1.9% WTI crude 69.15 ▼ -2.7% EUR/USD 1.1419 ▲ +0.3% GBP/USD 1.3324 ▲ +0.9% USD/JPY 162.03 ▲ +0.2% ================================================================ Generated 2026-07-08 06:06 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================