daily plain-text briefing: security, markets, business, and pittsburgh
Federal agencies race a Friday deadline to patch exploited ColdFusion and Langflow flaws as autonomous AI agents tear open fresh attack surface across cloud and code.
Latest developments: CISA added four actively exploited flaws to its Known Exploited Vulnerabilities catalog on July 7 and gave federal agencies until July 10 to patch, naming Adobe ColdFusion path-traversal bug CVE-2026-48282 rated 10.0, Langflow authentication-bypass CVE-2026-55255 that the JadePuffer ransomware crew rode, and two Joomla extension flaws.
ColdFusion powers web applications and Langflow builds AI agents; both draw live exploitation, so administrators should patch these systems immediately.
Sources: The Hacker News · SecurityWeek · BleepingComputer · BleepingComputer · ↑ top
Latest developments: SecurityWeek disclosed July 8 the Rogue Agent flaw in Google Dialogflow CX that let attackers hijack and exfiltrate data from every AI agent in a Cloud project, plus a critical prompt-injection hole in GitHub's agentic workflows that a crafted public issue triggers, as Dark Reading detailed a lone attacker who chained AI, cloud weaknesses, and stolen credentials to breach and extort an AWS customer in seventy-two hours.
Companies wire AI agents into cloud pipelines and code repositories; flaws in those agents leak private data and speed intrusions, so teams should treat every agent input as untrusted.
Sources: SecurityWeek · SecurityWeek · Dark Reading · ↑ top
Latest developments: The Hacker News detailed July 8 an EvilTokens ghost-phishing wave that keeps its malicious page encrypted until it renders inside the victim's browser and slips past URL scanners to grab Microsoft 365 access, while BleepingComputer found fake Paysafe, Skrill, and Neteller SDKs on npm and PyPI stealing credentials and Elastic tracked SCMBANKER using ClickFix CAPTCHA lures against Mexican bank customers.
These campaigns chase money through phishing that evades link checks and through poisoned developer packages; verify SDK sources and inspect OAuth and CAPTCHA prompts before acting.
Sources: The Hacker News · BleepingComputer · The Hacker News · ↑ top
Latest developments: Ubiquiti shipped updates July 8 fixing seven critical UniFi flaws, topped by CVE-2026-50746 rated 10.0, an improper-access-control bug in the UniFi Connect Application, spanning UniFi Talk, Access, Protect, and UniFi OS and enabling privilege escalation and arbitrary command execution.
UniFi gear runs networks, cameras, phones, and door access for businesses worldwide; unpatched devices let attackers run commands, so operators should update now.
Sources: The Hacker News · BleepingComputer · ↑ top
Latest developments: Cisco Talos reported July 8 that Chinese APT UAT-7810 expanded its LapDogs Operational Relay Box network with three new backdoors—LongLeash, DogLeash, and JarLeash—by breaking into internet-facing routers and small-office devices.
Operational Relay Box networks route espionage traffic through hijacked home and small-office routers to mask attackers; the LapDogs mesh first surfaced in June 2025 and now runs custom malware.
Sources: SecurityWeek · The Hacker News · ↑ top
Latest developments: The Record reported July 8 that Greek victims filed a lawsuit against Intellexa over its Predator spyware, found on dozens of phones since 2022 in a scandal that already forced out Greece's intelligence chief and the prime minister's chief of staff.
Intellexa's Predator spyware infects phones for covert surveillance; the Greek 'Predatorgate' case now moves into civil court against the vendor.
Sources: The Record · ↑ top
Latest developments: The U.S. military launched a second night of strikes on Iranian targets late July 8 after Trump declared the ceasefire 'over,' and global oil posted its steepest climb since May while Treasury yields jumped on revived inflation fears.
President Trump, speaking at the NATO summit in Ankara, scrapped the interim ceasefire he signed two weeks earlier and warned the strikes 'will get much worse' if Iran keeps attacking commercial ships in the Strait of Hormuz; the Dow fell, crude pulled further from pre-war levels, and the administration canceled its waiver allowing sales of Iranian oil.
Sources: WSJ World News · WSJ Markets · FT Markets · ↑ top
Tonight: Partly Cloudy then Patchy Fog, low 70F.
Thursday: Chance Showers And Thunderstorms, high 88F.
Thursday Night: Chance Showers And Thunderstorms then Showers And Thunderstorms Likely, low 70F.
Latest developments: Namdar Realty Group struck a deal for Gateway Center, its first move into Downtown Pittsburgh's office market.
Namdar Realty Group, a New York commercial landlord known for buying troubled real estate, reached a deal for the Gateway Center office complex near Point State Park, entering a Downtown Pittsburgh office market weighed down by high vacancies.
Sources: Pittsburgh Post-Gazette · ↑ top
Latest developments: Rostraver Township resident Angela Carson launched a petition to ban data centers amid project speculation, gathering more than 1,000 signatures in two days.
Speculation that a data center could come to Rostraver Township in Westmoreland County has stirred resident opposition, with Angela Carson's ban petition topping 1,000 signatures as neighbors say they have been left without answers—the latest flashpoint in southwestern Pennsylvania's fight over the power-hungry projects.
Latest developments: With the 25-day closure set to begin at 9 p.m. Friday, July 10, PennDOT says it is 'ready to go,' and drivers expect Route 28 to absorb much of the diverted traffic.
PennDOT will close the Parkway East (I-376) between the Squirrel Hill Tunnel and the Edgewood/Swissvale exit for 25 days starting July 10 to replace the aging Commercial Street Bridge, rerouting a corridor that carries roughly 100,000 vehicles a day onto Route 28 and surface streets.
Sources: Pittsburgh Post-Gazette · WPXI · ↑ top
Pirates (47-45)
Tue Jul 7 · Braves 4 · Pirates 12 · Final
Pirates' Jared Jones perfect through 6 innings against NL East-leading Braves
Wed Jul 8 · Braves 3 · Pirates 0 · Final
Up Next · Braves @ Pirates · Thu Jul 9, 12:35 PM
Latest developments: General manager Ben Cherington said mounting injuries have not changed 'the opportunity in front of us,' while rookie shortstop Konnor Griffin, who jammed his left ring finger diving Sunday, is likely out until September.
The Pirates are managing injuries to pitchers Braxton Ashcraft and Carmen Mlodzinski and now to rookie phenom Konnor Griffin, whose latest setback could keep him out until September; Cherington told the Post-Gazette the club still sees a chance to contend.
Sources: Post-Gazette Pirates · Post-Gazette Pirates · ↑ top
Latest developments: Ben Roethlisberger released 'Footbahlin' episode 132, reflecting on a quiet Steelers offseason before training camp.
On episode 132 of 'Footbahlin,' Ben Roethlisberger said a slow Steelers offseason will not push him to manufacture drama, and he talked about facing Dude Perfect in the Squad Games and the World Cup while football finally slows for family time.
Sources: Ben Roethlisberger / Channel Seven (YouTube) · ↑ top
Latest developments: A Post-Gazette breakdown asked whether Mike McCarthy will make the Steelers more aggressive on early downs in 2026.
The Post-Gazette tied Mike McCarthy's pass-first, first-down philosophy—honed coaching Brett Favre and Aaron Rodgers in Green Bay—to the NFL's most productive offenses, weighing whether it will reshape the Steelers with Rodgers at quarterback.
Sources: Post-Gazette Steelers · ↑ top
Latest developments: Andrew Giuliani, who heads the White House World Cup taskforce, defended Trump's lobbying of FIFA to clear U.S. striker Folarin Balogun, calling referee Raphael Claus's red card 'very, very highly suspicious,' as EU lawmakers gather support to investigate FIFA president Gianni Infantino.
After Trump phoned FIFA to overturn the red card that nearly kept Folarin Balogun out of the United States' round-of-16 loss to Belgium, dozens of European Parliament members are seeking to open an investigation of Infantino's role, and Giuliani publicly backed the president's intervention.
Sources: Guardian World Cup 2026 · ESPN Soccer · ↑ top
Latest developments: ESPN argued the United States' World Cup failure traces to its pay-to-play youth system, where families' ability to fund travel teams matters more than developing players.
In the wake of the U.S. men's round-of-16 exit as a tournament host, ESPN examined how America's pay-to-play, travel-team youth soccer model—prioritizing parents' spending over talent development—helps explain the national team's shortcomings.
Sources: ESPN Soccer · ↑ top
Latest developments: ESPN's Transfer Talk reported Paris Saint-Germain, Tottenham, and Chelsea are pursuing U.S. striker Folarin Balogun of Monaco.
Fresh off his contentious World Cup, U.S. striker Folarin Balogun is drawing transfer interest from Paris Saint-Germain, Tottenham, and Chelsea as he weighs a move from Monaco.
Sources: ESPN Soccer · ↑ top
S&P 500 7,498.09 ▲ +1.3% Dow 52,706.95 ▲ +1.3% Nasdaq 25,936.64 ▲ +1.2% WTI crude 69.15 ▼ -2.7% EUR/USD 1.1417 ▲ +0.3% GBP/USD 1.3344 ▲ +1.0% USD/JPY 161.98 = -0.0%