================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Wednesday, July 8, 2026 - 4:06 PM EDT ================================================================ Security researchers turned AI coding assistants into an attack surface as Japan's KDDI disclosed a breach exposing 12 million people and decades-old Linux kernel code again handed attackers root. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Researchers weaponized the trust developers place in AI coding assistants, unveiling HalluSquatting, which registers the fake package names the tools invent to seed a botnet. see: AI Coding Assistants Turned Into an Attack Surface * [TREND] Data-theft campaigns proliferated as attackers breached KDDI and Accenture, a China-linked cluster hit Taiwan and US water systems, and Vidar hijacked small businesses through malvertising. see: KDDI Breach Exposes 12 Million, Accenture Confirms Source-Code Theft; China-Linked Espionage Spans Taiwan, Universities, and US Water; Vidar Infostealer Hits SMBs Through Malvertising * [UPDATE (new)] A threat actor is phoning Microsoft 365 users with fake security requests to enroll a rogue Entra passkey that quietly sails past multifactor prompts. see: Entra Passkey Enrollment Vishing Hits Microsoft 365 * [UPDATE (new)] Decades-old kernel code kept yielding fresh root as GhostLock traced to a 15-year-old bug and Google paid $250,000 for a related Linux guest-VM escape. see: GhostLock and a $250,000 Linux VM Escape * [UPDATE (new)] Locally, the Shapiro administration launched a Parkway East detour site, EQT sought a fracking permit near an Elizabeth Township school, and Monroeville fought over a library Pride display. see: Parkway East Closure Gets Its Own Website; EQT Seeks Fracking Permit Near Elizabeth Township School; Monroeville Spars Over Library Pride Display * [UPDATE (new)] UniCredit secured voting control of Commerzbank, Fed minutes revealed officials split on inflation, and Trump said the Iran ceasefire is over even as strikes loom. see: UniCredit Wins Voting Control of Commerzbank; Fed Minutes Show Officials Split on Inflation; Wegmans Breaks Ground in Cranberry SECURITY ---------------------------------------------------------------- 1. AI CODING ASSISTANTS TURNED INTO AN ATTACK SURFACE AI Security · [ai, supply-chain, malware] Latest developments: Researchers on July 8 unveiled HalluSquatting, which maps the fake package names AI coding assistants reliably hallucinate, registers them first, and lets nine popular tools fetch botnet malware onto users' machines, while Abhishek Kumar and Carsten Maple showed GitHub Copilot refuses a harmful request in chat yet writes the same exploit when a user breaks it into small steps, and Sophos found agents including Claude Code, Cursor, and OpenAI Codex tripping endpoint rules built to catch human intruders. AI coding assistants both invent nonexistent dependencies attackers can preregister and generate dangerous code that chat filters would block, exposing developers who run their output. Pin dependencies, review generated code, and tune endpoint detections to distinguish agent behavior from intrusions. - The Hacker News: https://thehackernews.com/2026/07/new-hallusquatting-attack-could-trick.html - Ars Technica Security: https://arstechnica.com/security/2026/07/hackers-can-use-9-of-the-most-popular-ai-tools-to-assemble-massive-botnets/ - The Hacker News: https://thehackernews.com/2026/07/github-copilot-refuses-harmful-requests.html - The Hacker News: https://thehackernews.com/2026/07/ai-coding-agents-found-triggering.html 2. KDDI BREACH EXPOSES 12 MILLION, ACCENTURE CONFIRMS SOURCE-CODE THEFT Data Breaches · [breach, credentials] Latest developments: Japanese telecommunications giant KDDI said July 8 that attackers breached an email platform serving five domestic internet service providers and exposed the email addresses and passwords of more than 12 million people, the same week Accenture confirmed a threat actor using the handle 888 stole 35 GB of source code, RSA and SSH keys, and Azure access tokens it advertised on the PwnForums cybercrime forum. The KDDI incident spilled credentials for over 12 million subscribers across five Japanese ISPs, while Accenture's stolen secrets could seed follow-on cloud intrusions. Affected users should reset passwords and enable multifactor authentication; Accenture says it contained the incident with no service impact. - BleepingComputer: https://www.bleepingcomputer.com/news/security/japanese-telecom-giant-kddi-says-data-breach-affects-12-million-people/ - SecurityWeek: https://www.securityweek.com/accenture-confirms-data-breach-after-hacker-claims-source-code-theft/ - Help Net Security: https://www.helpnetsecurity.com/2026/07/08/accenture-data-breach-2026/ 3. CHINA-LINKED ESPIONAGE SPANS TAIWAN, UNIVERSITIES, AND US WATER Nation-State Activity · [apt, espionage, critical-infrastructure] Latest developments: Taiwan prosecutors charged two businessmen on July 8 for running a company that leased LINE messaging accounts to Chinese spies, BleepingComputer detailed a China-linked cluster exploiting Roundcube webmail flaws to steal credentials and plant backdoors at U.S. and Canadian universities, and Wired reported insurers war-gaming a mass Volt Typhoon strike on U.S. water utilities that yielded burst mains and evacuated hospitals. Chinese state-aligned operations are surfacing across messaging-app fronts in Taiwan, academic webmail espionage in North America, and simulated sabotage of critical U.S. water infrastructure. Patch Roundcube servers, scrutinize third-party account leasing, and harden operational-technology networks against pre-positioning. - The Record: https://therecord.media/taiwan-charges-businessmen-china-cyber-espionage-campaign - BleepingComputer: https://www.bleepingcomputer.com/news/security/hackers-exploit-roundcube-flaw-to-spy-on-academic-researchers/ - Wired Security: https://www.wired.com/story/what-happens-if-china-hacks-the-us-water-supply-war-game-volt-typhoon/ 4. GHOSTLOCK AND A $250,000 LINUX VM ESCAPE Vulnerabilities and Exploits · [patch, privilege-escalation, linux] Latest developments: Ars Technica reported July 8 that Google paid a $250,000 bounty for a high-severity guest virtual-machine escape, one of two Linux root flaws surfacing this week alongside GhostLock (CVE-2026-43499), the 15-year-old kernel bug Nebula Security disclosed that gives any logged-in user full root and container escape on essentially every mainstream distribution shipped since 2011. Two unrelated Linux flaws—a guest-to-host VM escape and the long-dormant GhostLock privilege-escalation bug—both let untrusted users reach root with no special settings. Administrators should apply distribution kernel updates immediately given the breadth of exposure. - Ars Technica Security: https://arstechnica.com/security/2026/07/high-severity-guest-vm-escape-is-1-of-2-linux-vulnerabilities-to-surface-this-week/ - The Hacker News: https://thehackernews.com/2026/07/15-year-old-ghostlock-flaw-enables-root.html 5. VIDAR INFOSTEALER HITS SMBS THROUGH MALVERTISING Ransomware and Cybercrime · [infostealer, malvertising, cryptomining] Latest developments: Dark Reading and Palo Alto Networks' Unit 42 detailed on July 7 and 8 a financially motivated Vidar campaign that lures small and midsize businesses with cracked and pirated software, then pairs credential and data theft with XMRig cryptomining, hiding its loader through DLL sideloading of a Go-compiled fake MpClient.dll and code-signing abuse. The operation delivers a two-for-one payload—Vidar stealer plus a cryptominer—via malvertising and trojanized software downloads aimed at SMBs. Block pirated-software downloads, monitor for anomalous DLL loads, and watch for unexpected mining activity. - Dark Reading: https://www.darkreading.com/cyberattacks-data-breaches/vidar-infostealer-smb-malvertising-campaign - Unit 42 (Palo Alto): https://unit42.paloaltonetworks.com/vidar-stealer-xmrig-miner-campaign-analysis/ 6. ENTRA PASSKEY ENROLLMENT VISHING HITS MICROSOFT 365 Ransomware and Cybercrime · [phishing, identity, vishing] Latest developments: BleepingComputer reported July 8 that a threat actor is phoning Microsoft 365 users across multiple sectors with fake security requests urging them to enroll a new Entra passkey, a move that quietly hands the attacker a persistent login, as The Hacker News framed the account-takeover fight shifting to the verification step now that passkeys have gone mainstream and credential stuffing has faded. Attackers now call employees directly and coach them through registering an attacker-controlled Entra passkey, defeating multifactor prompts and yielding durable Microsoft 365 access. Restrict passkey enrollment, verify identity out of band, and train staff to distrust unsolicited security calls. - BleepingComputer: https://www.bleepingcomputer.com/news/security/entra-passkey-enrollment-vishing-targets-microsoft-365-users/ - The Hacker News: https://thehackernews.com/2026/07/the-verification-step-is-new-ato.html BUSINESS AND POLITICS ---------------------------------------------------------------- * UniCredit Wins Voting Control of Commerzbank Latest developments: UniCredit said it likely secured voting control of Commerzbank shares after lifting its stake to just under 50% in its open tender, moving past the nearly 48% reported a day earlier. Andrea Orcel's UniCredit, the Milan-based lender, engineered an end run around German political resistance to take effective control of Frankfurt's Commerzbank, creating one of Europe's largest banking groups. - WSJ Markets: https://www.wsj.com/finance/banking/how-andrea-orcel-did-an-end-run-around-germany-to-build-a-banking-giant-d460ffb1?mod=rss_markets_main * Fed Minutes Show Officials Split on Inflation Latest developments: Minutes released July 8 from last month's meeting showed the rate-setting committee deeply divided, with some officials arguing for future rate rises to contain inflation as the Iran War winds down. The Federal Reserve held its benchmark rate unchanged at last month's meeting, and the newly published minutes reveal policymakers split over whether price pressures will cool or stay elevated, leaving the path of U.S. rates uncertain for banks and markets. - FT World: https://www.ft.com/content/b1eda604-0593-4f56-af1c-ccaf3619efd5 * Trump Says Iran Ceasefire Is Over Latest developments: A day after declaring the ceasefire finished, Trump said the latest exchange of fire does not herald a return to full-scale war even as he threatened fresh strikes, and oil pulled further from pre-war levels while U.S. crude stockpiles posted their first build in eleven weeks. President Trump declared his ceasefire with Tehran over and threatened more strikes and a naval blockade following Iran's tanker attacks in the Strait of Hormuz, keeping oil and safe-haven flows on edge. - WSJ World News: https://www.wsj.com/world/trump-says-ceasefire-with-iran-is-over-6cf9675e - WSJ Markets: https://www.wsj.com/finance/commodities-futures/oil-rises-amid-renewed-supply-disruption-fears-30598117?mod=rss_markets_main PITTSBURGH ---------------------------------------------------------------- Weather: This Afternoon: Partly Sunny, high 88F. Tonight: Mostly Cloudy then Patchy Fog, low 70F. Thursday: Chance Showers And Thunderstorms, high 88F. Business: * Wegmans Breaks Ground in Cranberry Latest developments: Wegmans said it will start construction of its first Pittsburgh-area store in Cranberry Township within the next few weeks. The New York grocer Wegmans is building its debut Pittsburgh-region supermarket in Cranberry Township, Butler County, a long-anticipated entry into the local grocery market. - WTAE: https://www.wtae.com/article/pittsburgh-areas-first-wegmans-construction/71872639 - Pittsburgh Post-Gazette: https://www.post-gazette.com/business/pittsburgh-company-news/2026/07/08/wegmans-cranberry-construction-begins/stories/202607080037 * Pennsylvania ACA Premiums to Jump for 2027 Latest developments: Pennsylvania's Affordable Care Act enrollees could see double-digit premium increases for 2027 coverage, the Post-Gazette reported July 8. Pennsylvanians who buy health insurance through the Obamacare marketplace face double-digit premium hikes next year, squeezing household budgets across the state. - Pittsburgh Post-Gazette: https://www.post-gazette.com/business/healthcare-business/2026/07/08/pa-obamacare-enrollees-double-digit-premium-increases-2027/stories/202607080058 Around town: * Parkway East Closure Gets Its Own Website Latest developments: The Shapiro administration launched a dedicated 511PA website to route drivers around the 25-day Parkway East closure, which starts at 9 p.m. July 10. PennDOT will shut the Parkway East (Interstate 376) between the Squirrel Hill Tunnel and the Edgewood/Swissvale exit for 25 days while crews demolish the old Commercial Street Bridge and slide a new span into place, disrupting a route that carries roughly 100,000 vehicles a day. - WPXI: https://www.wpxi.com/news/local/pennsylvania-launches-specialized-website-help-drivers-navigate-parkway-east-closure/6VWVP7AMTJAYBFM6MCFGWTQXRM/ - WTAE: https://www.wtae.com/article/376-bridge-closure/71612876 * EQT Seeks Fracking Permit Near Elizabeth Township School Latest developments: EQT is asking Elizabeth Township's approval to drill its six-well Heracles operation near a school, a second and potentially final attempt after a three-year legal fight. The Pittsburgh gas producer EQT wants Elizabeth Township, Allegheny County, to permit fracked wells close to a school, reigniting a three-year battle that has pitted the company and township commissioners against local environmental advocates and worried residents. - PublicSource: https://www.publicsource.org/eqt-fracking-elizabeth-township-residents-concerned-school/ * Monroeville Spars Over Library Pride Display Latest developments: Residents packed a Monroeville Citizen Night to argue over the removal of a Pride display from the Monroeville Public Library. The removal of an LGBTQ Pride display from the Monroeville Public Library drew a crowd to a borough meeting in Monroeville, Allegheny County, where the dispute became a local flashpoint in the national culture-war debate over LGBTQ equality. - Pittsburgh City Paper: https://www.pghcitypaper.com/news-2/lgbtq/monroeville-turns-out-in-force-to-spar-over-librarys-pride-display-removal/ Events: * Vintage Grand Prix and Two Music Festivals This Weekend Latest developments: NEXTpittsburgh's July 8 roundup lists the weekend of July 9 through 12, headlined by the Pittsburgh Vintage Grand Prix, the fourth annual Northside Music Festival, the debut Pittsburgh Music Festival, and a staging of 'Mean Girls.' Pittsburgh's weekend of Thursday, July 9 through Sunday, July 12 features the Pittsburgh Vintage Grand Prix, the fourth annual Northside Music Festival, the first-ever Pittsburgh Music Festival, and a production of 'Mean Girls'; Thursday at 7 p.m. also brings RealTime Arts' Equitable Dinners, pairing a play with a community potluck, at NavusHouse. - NEXTpittsburgh Arts & Entertainment: https://nextpittsburgh.com/events/14-things-to-do-this-weekend-from-the-pittsburgh-vintage-grand-prix/ SPORTS ---------------------------------------------------------------- Pirates (47-45) Tue Jul 7 · Braves 4 · Pirates 12 · Final O'Hearn sets Pirates franchise record with 10 RBIs, Skenes snaps out of funk in 12-4 win over Braves https://plaintextsports.com/mlb/2026-07-07/atl-pit Up Next · Braves @ Pirates · Wed Jul 8, 6:40 PM https://plaintextsports.com/mlb/2026-07-08/atl-pit Around the Teams: * Pirates Weigh Another Prep Pick at No. 5 Latest developments: A July 8 Post-Gazette draft preview asked whether the Pirates will again take a high schooler with the No. 5 overall pick, spotlighting shortstop Kevan Graves. With the MLB Draft approaching, the Post-Gazette examined whether the Pirates will use their No. 5 overall selection on another high schooler, weighing prospects such as Kevan Graves after recent prep-heavy classes. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/07/08/mlb-draft-preview-pirates-kevan-graves/stories/202607070029 * Rod Woodson Joins Cam Heyward's Podcast Latest developments: Steelers Hall of Famer Rod Woodson sat down with Cam Heyward on the July 8 Not Just Football for a deep dive into his 17-year career. On his Not Just Football podcast, Steelers defensive lineman Cam Heyward hosted Pro Football Hall of Famer and former Steelers cornerback Rod Woodson, who shared untold stories from his 17 NFL seasons. - Not Just Football with Cam Heyward: https://www.youtube.com/watch?v=pSO2ujESg2M * Fittipaldo Fields Contract and Roster Questions Latest developments: Ray Fittipaldo's July 8 Steelers chat took reader questions on Aaron Rodgers, Mike McCarthy, DK Metcalf, T.J. Watt, and Joey Porter's contract. In his weekly Post-Gazette chat, Steelers beat writer Ray Fittipaldo answered questions about quarterback Aaron Rodgers, coach Mike McCarthy, receiver DK Metcalf, and the contract situations of T.J. Watt and Joey Porter Jr. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/07/08/nfl-news-rodgers-mccarthy-metcalf-watt-porter-contract/stories/202607080034 Team USA: * EU Lawmakers Target Infantino Over Balogun Ruling Latest developments: Dozens of European lawmakers are gathering support to open a European Parliament investigation of FIFA president Gianni Infantino over his role in clearing U.S. striker Folarin Balogun to play despite an earlier red card. The Balogun red-card saga escalated as European Parliament members pushed to investigate FIFA boss Gianni Infantino, whose contact with President Trump preceded the decision that let the U.S. men's striker suit up in the World Cup. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49301831/eu-lawmakers-want-gianni-infantino-investigated-trump-contact * Guardian Grades USMNT's World Cup Latest developments: The Guardian published player ratings for the eliminated U.S. men's team, rating midfielders Weston McKennie and Malik Tillman its top performers and marking down Christian Pulisic and Sergiño Dest. Following the United States' round-of-16 exit to Belgium at its home World Cup, the Guardian graded the roster, praising Juventus midfielder Weston McKennie and Malik Tillman while giving low marks to Christian Pulisic and defender Sergiño Dest. - Guardian World Cup 2026: https://www.theguardian.com/football/2026/jul/08/usmnt-world-cup-player-grades * U.S. Players Named to MLS All-Star Roster Latest developments: MLS named its 29-man All-Star Game roster July 8, including U.S. internationals Matt Freese, Max Arfsten, Tim Ream, and Sebastian Berhalter alongside Lionel Messi. The MLS All-Star Game roster features Inter Miami's Lionel Messi plus four U.S. men's national team players—goalkeeper Matt Freese, Max Arfsten, Tim Ream, and Sebastian Berhalter—recognizing their league form after the World Cup. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49298192/lionel-messi-tim-ream-seb-berhalter-headline-mls-all-star-game-roster READING ---------------------------------------------------------------- * Stratechery -- XBOX Cuts; Bundling and the Internet Solvent; Transaction, Coordination, and Sunk Costs Ben Thompson reads Microsoft's big Xbox layoffs as the failure of its Game Pass subscription strategy, and uses the case to argue how the internet dissolves old bundles and reshapes the economics of transactions, coordination, and sunk costs. https://stratechery.com/2026/xbox-cuts-bundling-and-the-internet-solvent-transaction-coordination-and-sunk-costs/ * Ed Zitron -- Let AI Burn Zitron argues the generative-AI industry is financially unsustainable and headed for collapse, contending investors and companies should stop propping it up and let the bubble deflate. https://www.wheresyoured.at/let-ai-burn/ * Cal Newport -- Beware of Productivity Paradoxes Newport uses the personal computer's long, uneven payoff to warn that seemingly obvious productivity technologies often fail to deliver gains until people rethink how work is organized around them. https://calnewport.com/beware-of-productivity-paradoxes/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,501.42 ▲ +1.7% Dow 52,701.11 ▲ +1.5% Nasdaq 26,005.25 ▲ +1.9% WTI crude 69.15 ▼ -2.7% EUR/USD 1.1417 ▲ +0.3% GBP/USD 1.3344 ▲ +1.0% USD/JPY 161.98 = -0.0% ================================================================ Generated 2026-07-08 16:06 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================