daily plain-text briefing: security, markets, business, and pittsburgh
CISA ordered federal agencies to patch actively exploited ColdFusion and Langflow flaws by July 10 as China's UAT-7810 expanded its router-based relay network and a 15-year-old Linux kernel bug handed attackers instant root.
Latest developments: CISA added four flaws to its Known Exploited Vulnerabilities catalog on July 7—Adobe ColdFusion path-traversal CVE-2026-48282 rated 10.0, Langflow auth-bypass CVE-2026-55255, and two Joomla extension flaws—and gave federal agencies until July 10 to patch.
ColdFusion powers commercial web apps and Langflow builds AI agents; attackers exploit both to run code and harvest credentials, the Langflow flaw feeding the JADEPUFFER ransomware operation Sysdig tracked. Patch immediately.
Sources: The Hacker News · SecurityWeek · BleepingComputer · BleepingComputer · ↑ top
Latest developments: Varonis disclosed the Rogue Agent flaw in Google's Dialogflow CX on July 7, letting an attacker with edit rights on one Code Block agent hijack every agent in the same Google Cloud project to read live conversations and steal data, while separate researchers showed a crafted public GitHub Issue can trick AI-powered agentic workflows into leaking private-repository data without authentication.
Both flaws exploit the trust enterprises place in AI agents wired into their infrastructure. Google has fixed Dialogflow CX; teams running agentic GitHub workflows should audit their prompt-injection exposure.
Sources: SecurityWeek · Dark Reading · The Hacker News · SecurityWeek · ↑ top
Latest developments: Nebula Security disclosed GhostLock (CVE-2026-43499) on July 8, a 15-year-old Linux kernel flaw that gives any logged-in user full root and container escape on essentially every mainstream distribution since 2011, the same day Ubiquiti patched seven critical UniFi flaws including CVE-2026-50746 rated 10.0.
GhostLock needs no special permission, unusual settings, or network access; Ubiquiti's flaws span UniFi Connect, Talk, Access, Protect, and OS and enable privilege escalation and arbitrary command execution. Patch both now.
Sources: The Hacker News · The Hacker News · BleepingComputer · ↑ top
Latest developments: Cisco Talos revealed on July 7 and 8 that China-linked UAT-7810 expanded its LapDogs relay network with three new backdoors—LongLeash, DogLeash, and JarLeash—by breaking into internet-facing devices, chiefly unpatched Ruckus routers.
UAT-7810 maintains LapDogs, an operational relay box network of hijacked small-office routers that hides Chinese espionage traffic, first surfacing in June 2025. The new malware widens the pool of compromised edge devices.
Sources: SecurityWeek · The Hacker News · BleepingComputer · ↑ top
Latest developments: A fresh EvilTokens 'ghost phishing' campaign hides its malicious page until it decrypts inside the victim's browser to slip past URL checks and steal Microsoft 365 access, as Elastic Security Labs tracked REF6045 dropping the SCMBANKER PowerShell toolkit on Mexican bank customers through fake CAPTCHA ClickFix lures, and Zimperium found RedWing, an Android bank-fraud service renting on Telegram for phone takeover and one-time-code theft.
Each campaign packages account theft for low-skill criminals across the United States, Europe, and Mexico. Harden email verification, block ClickFix clipboard commands, and watch for Android overlay fraud.
Sources: The Hacker News · The Hacker News · The Hacker News · ↑ top
Latest developments: The U.S. Supreme Court on July 7 let the Texas App Store Accountability Act take effect, requiring app-store age verification, while the European Commission adopted a communication in Strasbourg the same day to cut the bloc's reliance on foreign AI systems and scale European cyber capabilities.
Texas now forces Apple and Google to verify user ages after a student advocacy group and a tech trade group failed to stay the law; the EU plan rests on three pillars to make frontier AI safe, accessible, and deployable for European cybersecurity. Both reshape compliance for platforms and vendors.
Sources: The Record · The Record · ↑ top
Latest developments: President Trump said his ceasefire with Tehran is finished, warned of fresh strikes as soon as Wednesday night, and threatened to reimpose a naval blockade, sending Brent crude up more than 7% and Treasury yields higher as U.S. stocks fell.
The United States and Iran resumed tit-for-tat bombing after three merchant ships came under fire off Oman, and President Trump's declaration that diplomacy has collapsed drove oil above a 7% gain, lifted global bond yields, and strengthened the dollar as investors fled to safe havens.
Sources: Wall Street Journal · Wall Street Journal · Financial Times · Wall Street Journal · ↑ top
Latest developments: UniCredit lifted its stake in Commerzbank to nearly 48% after the tender period closed, putting the Italian bank within reach of majority control of the German lender.
Italy's UniCredit raised its holding in Commerzbank, Germany's second-largest listed bank, to about 48% following a takeover push that Berlin and the lender's management have long resisted, moving European banking toward its biggest cross-border consolidation in years.
Sources: Financial Times · Wall Street Journal · ↑ top
Latest developments: In his warmest meeting yet with Volodymyr Zelensky, Trump agreed to let Kyiv produce its own PAC-3 Patriot interceptors and said he supports Ukrainian long-range strikes deep inside Russia.
President Trump granted Ukraine a license to manufacture Patriot air-defense interceptors to counter Russian ballistic-missile attacks, meeting a longstanding demand from President Zelensky and signaling deeper U.S. backing as Kyiv intensifies strikes on Russian ships and refineries.
Sources: Wall Street Journal · Financial Times · ↑ top
This Afternoon: Isolated Showers And Thunderstorms, high 89F.
Tonight: Mostly Cloudy then Patchy Fog, low 70F.
Thursday: Scattered Showers And Thunderstorms, high 88F.
Latest developments: Spotlight PA laid out where the two candidates for Pennsylvania governor stand as Republican Stacy Garrity works to distinguish herself from Governor Josh Shapiro on the projects' grid strain and public cost.
With data-center proposals multiplying across Pennsylvania, development of the power-hungry facilities has become a defining issue in the 2026 governor's race between incumbent Josh Shapiro and Republican challenger Stacy Garrity.
Sources: NEXTpittsburgh · ↑ top
Latest developments: The Post-Gazette reported that a new entertainment venue called Mic Drop, built around karaoke and dueling pianos, is headed to Pittsburgh's North Shore.
Mic Drop, a nightlife venue centered on karaoke and dueling pianos, will open on Pittsburgh's North Shore, adding to the entertainment district around the ballpark and stadium.
Sources: Pittsburgh Post-Gazette · ↑ top
Latest developments: Sheetz will hand out a free bag of french fries with any food or drink purchase on Friday, July 10, for National French Fry Day.
Sheetz, the Altoona-based gas-and-convenience chain, will give a free bag of fries with any food or drink order on National French Fry Day, Friday, July 10, the same day PennDOT closes I-376 for the Commercial Street Bridge swap.
Sources: Pittsburgh Magazine · ↑ top
Latest developments: Two days out, PennDOT set new traffic patterns along South Braddock Avenue in Edgewood and Swissvale and said Pittsburgh workers built the new 22-million-pound Commercial Street Bridge, though its steel came from outside the region.
PennDOT will close the Parkway East between the Squirrel Hill Tunnel and the Edgewood/Swissvale exit at 9 p.m. Friday, July 10, for 25 days to slide in the new Commercial Street Bridge, rerouting a highway that carries about 100,000 vehicles a day; the Dutch heavy-lift firm Mammoet will move the span into place.
Latest developments: The Kamin Science Center opened voting through July 31 for the public to choose which Pittsburgh bridge to add to its miniature-railroad display.
The Kamin Science Center on Pittsburgh's North Shore is letting the public vote through July 31 on which city bridge to add to its miniature model display, one of the venue's signature exhibits.
Pirates (47-45)
Tue Jul 7 · Braves 4 · Pirates 12 · Final
O'Hearn sets Pirates franchise record with 10 RBIs, Skenes snaps out of funk in 12-4 win over Braves
Up Next · Braves @ Pirates · Wed Jul 8, 6:40 PM
Latest developments: Beat writers reported rookie shortstop Konnor Griffin tore a tendon in his left ring finger and will likely miss until September, at least two months, with Jack Brannigan and Jared Triolo covering.
Pittsburgh Pirates rookie phenom Konnor Griffin will miss at least two months with a torn tendon in his left ring finger, a blow that tests the club's bid to stay in playoff contention; second baseman Brandon Lowe counseled his young double-play partner on the recovery.
Sources: Pittsburgh Post-Gazette · ↑ top
Latest developments: Post-Gazette analysts weighed whether Mike McCarthy will bring new aggression on early downs, tying his first-down passing philosophy to the NFL's best offenses and quarterback Aaron Rodgers.
The Post-Gazette broke down how Mike McCarthy's preference for throwing on first down could sharpen the Steelers' 2026 offense under quarterback Aaron Rodgers, a philosophy that has fueled the league's top attacks.
Sources: Pittsburgh Post-Gazette · Pittsburgh Post-Gazette · ↑ top
Latest developments: U.S. Soccer will divide the $16 million FIFA awarded the men's team for reaching the round of 16 equally between its men's and women's national teams under their equal-pay agreement.
The United States men's run to the round of 16 at the home World Cup, capped by a 4-1 loss to Belgium in Seattle, earned U.S. Soccer $16 million in FIFA prize money, which the federation will split evenly between the men's and women's national teams.
Latest developments: FIFA barred two U.S. men's national team staff members from the round-of-16 loss to Belgium and gave no reason for the suspensions.
FIFA suspended two staff members of the United States men's national team from the July 6 World Cup round-of-16 game against Belgium in Seattle, declining to explain the move amid the tournament's disputes over U.S. officiating decisions.
Latest developments: Paris Saint-Germain, Tottenham Hotspur, and Chelsea are all vying to sign U.S. striker Folarin Balogun after the World Cup.
USMNT and Monaco striker Folarin Balogun, whose contested red card became a World Cup flashpoint, has become a summer transfer target for Paris Saint-Germain, Tottenham Hotspur, and Chelsea.
S&P 500 7,501.42 ▲ +1.7% Dow 52,701.11 ▲ +1.5% Nasdaq 26,005.25 ▲ +1.9% WTI crude 69.15 ▼ -2.7% EUR/USD 1.1419 ▲ +0.3% GBP/USD 1.3324 ▲ +0.9% USD/JPY 162.03 ▲ +0.2%