================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Wednesday, July 8, 2026 - 9:06 PM EDT ================================================================ Federal agencies race a Friday deadline to patch exploited ColdFusion and Langflow flaws as autonomous AI agents tear open fresh attack surface across cloud and code. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Autonomous AI agents are a fresh attack surface, from a Rogue Agent flaw in Google's Dialogflow CX to prompt injection inside GitHub's agentic workflows. see: AI Agents Open a New Attack Surface * [TREND] China's UAT-7810 crew is expanding its LapDogs relay network with new LongLeash, DogLeash, and JarLeash backdoors planted on hijacked routers and small-office devices. see: China's UAT-7810 Grows Its LapDogs Relay Network * [TREND] Attackers are targeting money through EvilTokens ghost-phishing pages that decrypt inside the browser and fake Paysafe payment SDKs seeded on npm and PyPI. see: Ghost Phishing and Fake Payment SDKs Target Finance * [UPDATE (new)] CISA gave agencies until July 10 to patch actively exploited ColdFusion, Langflow, and Joomla flaws, while Ubiquiti shipped fixes for seven critical UniFi bugs. see: CISA Flags Exploited ColdFusion, Langflow, and Joomla Flaws; Ubiquiti Patches Max-Severity UniFi Flaws * [UPDATE (new)] The U.S. launched a second night of strikes on Iran after Trump declared the ceasefire dead, sending oil to its steepest climb since May. see: U.S. Resumes Strikes on Iran, Ceasefire Dead * [UPDATE (new)] PennDOT's 25-day Parkway East closure begins Friday night, with Route 28 expected to absorb much of the diverted traffic. see: Parkway East Closes Friday SECURITY ---------------------------------------------------------------- 1. CISA FLAGS EXPLOITED COLDFUSION, LANGFLOW, AND JOOMLA FLAWS Vulnerabilities and Exploits · [patch, exploit] Latest developments: CISA added four actively exploited flaws to its Known Exploited Vulnerabilities catalog on July 7 and gave federal agencies until July 10 to patch, naming Adobe ColdFusion path-traversal bug CVE-2026-48282 rated 10.0, Langflow authentication-bypass CVE-2026-55255 that the JadePuffer ransomware crew rode, and two Joomla extension flaws. ColdFusion powers web applications and Langflow builds AI agents; both draw live exploitation, so administrators should patch these systems immediately. - The Hacker News: https://thehackernews.com/2026/07/cisa-adds-4-actively-exploited-adobe.html - SecurityWeek: https://www.securityweek.com/cisa-urges-immediate-patching-of-exploited-coldfusion-langflow-joomla-flaws/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-max-severity-coldfusion-flaw-by-friday/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-prioritize-patching-langflow-auth-bypass-flaw/ 2. AI AGENTS OPEN A NEW ATTACK SURFACE AI Security · [ai, vulnerability] Latest developments: SecurityWeek disclosed July 8 the Rogue Agent flaw in Google Dialogflow CX that let attackers hijack and exfiltrate data from every AI agent in a Cloud project, plus a critical prompt-injection hole in GitHub's agentic workflows that a crafted public issue triggers, as Dark Reading detailed a lone attacker who chained AI, cloud weaknesses, and stolen credentials to breach and extort an AWS customer in seventy-two hours. Companies wire AI agents into cloud pipelines and code repositories; flaws in those agents leak private data and speed intrusions, so teams should treat every agent input as untrusted. - SecurityWeek: https://www.securityweek.com/google-dialogflow-cx-bug-allowed-attackers-to-hijack-ai-conversations/ - SecurityWeek: https://www.securityweek.com/critical-vulnerability-exposes-github-agentic-workflows-to-prompt-injection/ - Dark Reading: https://www.darkreading.com/cloud-security/lone-attacker-ai-breach-aws-cloud-environment 3. GHOST PHISHING AND FAKE PAYMENT SDKS TARGET FINANCE Ransomware and Cybercrime · [phishing, supply-chain] Latest developments: The Hacker News detailed July 8 an EvilTokens ghost-phishing wave that keeps its malicious page encrypted until it renders inside the victim's browser and slips past URL scanners to grab Microsoft 365 access, while BleepingComputer found fake Paysafe, Skrill, and Neteller SDKs on npm and PyPI stealing credentials and Elastic tracked SCMBANKER using ClickFix CAPTCHA lures against Mexican bank customers. These campaigns chase money through phishing that evades link checks and through poisoned developer packages; verify SDK sources and inspect OAuth and CAPTCHA prompts before acting. - The Hacker News: https://thehackernews.com/2026/07/new-ghost-phishing-wave-is-breaking.html - BleepingComputer: https://www.bleepingcomputer.com/news/security/fake-paysafe-skrill-sdks-on-npm-and-pypi-steal-credentials/ - The Hacker News: https://thehackernews.com/2026/07/scmbanker-malware-uses-clickfix-lures.html 4. UBIQUITI PATCHES MAX-SEVERITY UNIFI FLAWS Vulnerabilities and Exploits · [patch, vulnerability] Latest developments: Ubiquiti shipped updates July 8 fixing seven critical UniFi flaws, topped by CVE-2026-50746 rated 10.0, an improper-access-control bug in the UniFi Connect Application, spanning UniFi Talk, Access, Protect, and UniFi OS and enabling privilege escalation and arbitrary command execution. UniFi gear runs networks, cameras, phones, and door access for businesses worldwide; unpatched devices let attackers run commands, so operators should update now. - The Hacker News: https://thehackernews.com/2026/07/ubiquiti-patches-critical-unifi-flaws.html - BleepingComputer: https://www.bleepingcomputer.com/news/security/ubiquiti-warns-of-new-max-severity-unifi-os-vulnerability/ 5. CHINA'S UAT-7810 GROWS ITS LAPDOGS RELAY NETWORK Nation-State Activity · [apt, malware] Latest developments: Cisco Talos reported July 8 that Chinese APT UAT-7810 expanded its LapDogs Operational Relay Box network with three new backdoors—LongLeash, DogLeash, and JarLeash—by breaking into internet-facing routers and small-office devices. Operational Relay Box networks route espionage traffic through hijacked home and small-office routers to mask attackers; the LapDogs mesh first surfaced in June 2025 and now runs custom malware. - SecurityWeek: https://www.securityweek.com/china-linked-apt-expands-arsenal-with-new-leash-backdoors/ - The Hacker News: https://thehackernews.com/2026/07/china-linked-uat-7810-expands-orb.html 6. GREEK VICTIMS SUE INTELLEXA OVER PREDATOR SPYWARE Surveillance and Privacy · [spyware, surveillance] Latest developments: The Record reported July 8 that Greek victims filed a lawsuit against Intellexa over its Predator spyware, found on dozens of phones since 2022 in a scandal that already forced out Greece's intelligence chief and the prime minister's chief of staff. Intellexa's Predator spyware infects phones for covert surveillance; the Greek 'Predatorgate' case now moves into civil court against the vendor. - The Record: https://therecord.media/greek-victims-file-lawsuit-against-intellexa-spyware BUSINESS AND POLITICS ---------------------------------------------------------------- * U.S. Resumes Strikes on Iran, Ceasefire Dead Latest developments: The U.S. military launched a second night of strikes on Iranian targets late July 8 after Trump declared the ceasefire 'over,' and global oil posted its steepest climb since May while Treasury yields jumped on revived inflation fears. President Trump, speaking at the NATO summit in Ankara, scrapped the interim ceasefire he signed two weeks earlier and warned the strikes 'will get much worse' if Iran keeps attacking commercial ships in the Strait of Hormuz; the Dow fell, crude pulled further from pre-war levels, and the administration canceled its waiver allowing sales of Iranian oil. - WSJ World News: https://www.wsj.com/world/middle-east/u-s-launches-new-strikes-on-iran-after-trump-declares-ceasefire-over-2c0738fe - WSJ Markets: https://www.wsj.com/finance/stocks/wall-streets-peace-trade-collides-with-renewed-iran-fighting-86b83d67?mod=rss_markets_main - FT Markets: https://www.ft.com/content/ea2d4977-b1d1-44e4-9645-e6d8cd226439 PITTSBURGH ---------------------------------------------------------------- Weather: Tonight: Partly Cloudy then Patchy Fog, low 70F. Thursday: Chance Showers And Thunderstorms, high 88F. Thursday Night: Chance Showers And Thunderstorms then Showers And Thunderstorms Likely, low 70F. Business: * Namdar Buys Into Downtown Offices Latest developments: Namdar Realty Group struck a deal for Gateway Center, its first move into Downtown Pittsburgh's office market. Namdar Realty Group, a New York commercial landlord known for buying troubled real estate, reached a deal for the Gateway Center office complex near Point State Park, entering a Downtown Pittsburgh office market weighed down by high vacancies. - Pittsburgh Post-Gazette: https://www.post-gazette.com/business/development/2026/07/08/namdar-gateway-center-downtown-property/stories/202607080057 * Rostraver Fights Rumored Data Center Latest developments: Rostraver Township resident Angela Carson launched a petition to ban data centers amid project speculation, gathering more than 1,000 signatures in two days. Speculation that a data center could come to Rostraver Township in Westmoreland County has stirred resident opposition, with Angela Carson's ban petition topping 1,000 signatures as neighbors say they have been left without answers—the latest flashpoint in southwestern Pennsylvania's fight over the power-hungry projects. - KDKA: https://www.cbsnews.com/pittsburgh/news/westmoreland-county-residents-voice-frustrations-amid-data-center-speculation/ Around town: * Parkway East Closes Friday Latest developments: With the 25-day closure set to begin at 9 p.m. Friday, July 10, PennDOT says it is 'ready to go,' and drivers expect Route 28 to absorb much of the diverted traffic. PennDOT will close the Parkway East (I-376) between the Squirrel Hill Tunnel and the Edgewood/Swissvale exit for 25 days starting July 10 to replace the aging Commercial Street Bridge, rerouting a corridor that carries roughly 100,000 vehicles a day onto Route 28 and surface streets. - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/transportation/2026/07/08/parkway-east-closure-detours/stories/202607080063 - WPXI: https://www.wpxi.com/news/local/ready-go-penndot-official-speaks-about-upcoming-parkway-east-closure/QS4J5DDXXBFKFJ4HWBJLUL3LQA/ SPORTS ---------------------------------------------------------------- Pirates (47-45) Tue Jul 7 · Braves 4 · Pirates 12 · Final Pirates' Jared Jones perfect through 6 innings against NL East-leading Braves https://plaintextsports.com/mlb/2026-07-07/atl-pit Wed Jul 8 · Braves 3 · Pirates 0 · Final https://plaintextsports.com/mlb/2026-07-08/atl-pit Up Next · Braves @ Pirates · Thu Jul 9, 12:35 PM https://plaintextsports.com/mlb/2026-07-09/atl-pit Around the Teams: * Pirates Absorb a Wave of Injuries Latest developments: General manager Ben Cherington said mounting injuries have not changed 'the opportunity in front of us,' while rookie shortstop Konnor Griffin, who jammed his left ring finger diving Sunday, is likely out until September. The Pirates are managing injuries to pitchers Braxton Ashcraft and Carmen Mlodzinski and now to rookie phenom Konnor Griffin, whose latest setback could keep him out until September; Cherington told the Post-Gazette the club still sees a chance to contend. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/07/08/pirates-ben-cherington-ashcraft-mlodzinski-griffin-skenes-keller/stories/202607080035 - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/07/08/konnor-griffin-endy-rodriguez-injury-update-mlb/stories/202607080054 * Big Ben's 'Footbahlin' Episode 132 Latest developments: Ben Roethlisberger released 'Footbahlin' episode 132, reflecting on a quiet Steelers offseason before training camp. On episode 132 of 'Footbahlin,' Ben Roethlisberger said a slow Steelers offseason will not push him to manufacture drama, and he talked about facing Dude Perfect in the Squad Games and the World Cup while football finally slows for family time. - Ben Roethlisberger / Channel Seven (YouTube): https://www.youtube.com/watch?v=InqyVnuKKmA * McCarthy's First-Down Aggression Latest developments: A Post-Gazette breakdown asked whether Mike McCarthy will make the Steelers more aggressive on early downs in 2026. The Post-Gazette tied Mike McCarthy's pass-first, first-down philosophy—honed coaching Brett Favre and Aaron Rodgers in Green Bay—to the NFL's most productive offenses, weighing whether it will reshape the Steelers with Rodgers at quarterback. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/07/08/nfl-news-rumors-mike-mccarthy-first-down/stories/202607080038 Team USA: * White House Defends FIFA Lobbying for Balogun Latest developments: Andrew Giuliani, who heads the White House World Cup taskforce, defended Trump's lobbying of FIFA to clear U.S. striker Folarin Balogun, calling referee Raphael Claus's red card 'very, very highly suspicious,' as EU lawmakers gather support to investigate FIFA president Gianni Infantino. After Trump phoned FIFA to overturn the red card that nearly kept Folarin Balogun out of the United States' round-of-16 loss to Belgium, dozens of European Parliament members are seeking to open an investigation of Infantino's role, and Giuliani publicly backed the president's intervention. - Guardian World Cup 2026: https://www.theguardian.com/us-news/2026/jul/08/trump-fifa-red-card - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49301831/eu-lawmakers-want-gianni-infantino-investigated-trump-contact * Pay-to-Play Blamed for USMNT's Exit Latest developments: ESPN argued the United States' World Cup failure traces to its pay-to-play youth system, where families' ability to fund travel teams matters more than developing players. In the wake of the U.S. men's round-of-16 exit as a tournament host, ESPN examined how America's pay-to-play, travel-team youth soccer model—prioritizing parents' spending over talent development—helps explain the national team's shortcomings. - ESPN Soccer: https://www.espn.com/soccer/worldcup/story/_/id/49297263/usmnt-world-cup-loss-youth-travel-soccer-system * Balogun Draws Big-Club Interest Latest developments: ESPN's Transfer Talk reported Paris Saint-Germain, Tottenham, and Chelsea are pursuing U.S. striker Folarin Balogun of Monaco. Fresh off his contentious World Cup, U.S. striker Folarin Balogun is drawing transfer interest from Paris Saint-Germain, Tottenham, and Chelsea as he weighs a move from Monaco. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49304151/transfer-rumors-news-psg-spurs-chelsea-eye-usmnt-monaco-striker-folarin-balogun READING ---------------------------------------------------------------- * Stratechery -- XBOX Cuts; Bundling and the Internet Solvent; Transaction, Coordination, and Sunk Costs Ben Thompson reads Microsoft's Xbox layoffs as proof its Game Pass bundling strategy failed, then uses the case to examine how bundling acts as an 'internet solvent' and how transaction costs, coordination, and sunk costs shape the outcome. https://stratechery.com/2026/xbox-cuts-bundling-and-the-internet-solvent-transaction-coordination-and-sunk-costs/ * Ed Zitron -- Let AI Burn Zitron contends the generative-AI industry rests on unsustainable losses and argues that, rather than propping it up, observers should let the bubble collapse under its own economics. https://www.wheresyoured.at/let-ai-burn/ * Cal Newport -- Beware of Productivity Paradoxes Newport notes that even the personal computer took years to deliver measurable productivity gains, and warns against assuming a new technology automatically makes knowledge work more efficient. https://calnewport.com/beware-of-productivity-paradoxes/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,498.09 ▲ +1.3% Dow 52,706.95 ▲ +1.3% Nasdaq 25,936.64 ▲ +1.2% WTI crude 69.15 ▼ -2.7% EUR/USD 1.1417 ▲ +0.3% GBP/USD 1.3344 ▲ +1.0% USD/JPY 161.98 = -0.0% ================================================================ Generated 2026-07-08 21:06 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================