daily plain-text briefing: security, markets, business, and pittsburgh
Attackers weaponized developers' own AI coding agents en masse, hijacking approved file writes and tricking the tools into running the very malware they were asked to inspect.
Latest developments: Wiz disclosed GhostApproval on July 9, a symlink flaw across six AI coding assistants—Amazon Q Developer, Anthropic's Claude Code, Augment, Cursor, Google Antigravity, and Windsurf—that redirects an approved write onto a sensitive file and hands a booby-trapped repository control of the developer's machine, the same day the AI Now Institute's Friendly Fire proof-of-concept tricked Claude Code and OpenAI's Codex into running attacker code while scanning it and researchers unveiled HalluSquatting, which pre-registers the fake package names AI assistants reliably invent to serve botnet malware.
AI coding agents load skills, packages, and whole repositories with little vetting, and every channel now carries an exploit; teams running these tools in autonomous mode should restrict file writes, pin dependencies, and treat agent self-approvals as untrusted.
Sources: SecurityWeek · The Hacker News · The Hacker News · The Hacker News · ↑ top
Latest developments: AssuranceAmerica disclosed July 9 a breach exposing records of nearly 6.9 million drivers after intruders reached its systems earlier this year, the same day Japanese telecom KDDI said attackers who breached an email platform shared by five internet service providers exposed the email addresses and passwords of more than 12 million people, and Mount Royal University in Calgary confirmed hackers stole then deleted data from its file storage.
Three fresh intrusions spilled personal data across insurance, telecom, and higher education. Affected customers and students should reset passwords, watch for phishing, and monitor accounts for fraud.
Sources: BleepingComputer · BleepingComputer · BleepingComputer · ↑ top
Latest developments: Microsoft shipped an out-of-band patch July 9 for RoguePlanet, a Defender zero-day disclosed after the June 2026 Patch Tuesday, as Google released Chrome 150 fixing 27 flaws including 13 use-after-free bugs and two critical holes it found itself, and Wireshark 4.6.7 closed a dozen protocol-dissector weaknesses.
Fresh fixes landed across Microsoft Defender, the Chrome browser, and the Wireshark packet analyzer, several exploitable through crafted files or web content. Administrators should apply all three promptly.
Sources: BleepingComputer · SecurityWeek · Help Net Security · ↑ top
Latest developments: Infoblox exposed Lurking Lizard on July 9, a threat actor running a residential-proxy business since at least August 2022 across more than 230 lookalike domains that push fake 7-Zip installers to enroll victim devices as proxy nodes, while Dark Reading tracked a Vidar infostealer malvertising campaign luring small businesses with cracked and pirated software to steal data and mine cryptocurrency.
Both operations disguise malware as trusted or free software downloads, one to build a for-hire proxy network and the other to combine data theft with cryptomining. Users should avoid pirated installers and verify download sources.
Sources: The Hacker News · Dark Reading · ↑ top
Latest developments: Dark Reading reported July 9 that a new crew calling itself GodDamn wields a malicious kernel driver Microsoft itself co-signed to shut off endpoint security software at U.S. companies before encrypting them, a bring-your-own-vulnerable-driver play that turns a trusted signature into a skeleton key.
GodDamn loads a Microsoft-signed driver to reach kernel level and disable defenses ahead of encryption. Organizations should block the known vulnerable driver by hash and alert on anomalous driver loads.
Sources: Dark Reading · ↑ top
Latest developments: BleepingComputer reported July 9 that a coordinated law-enforcement operation spanning 97 countries arrested 5,811 suspects and seized $293 million in illicit assets in a single online-fraud crackdown.
The multinational sweep targeted online payment and investment fraud rings across nearly a hundred jurisdictions. It marks one of the largest coordinated fraud takedowns of the year, though the operating groups behind the schemes remain unnamed.
Sources: BleepingComputer · ↑ top
Latest developments: The United States struck Iran a second straight night, and Tehran fired back at Bahrain, Kuwait, and Qatar, widening the war beyond the two combatants and threatening the interim deal meant to end it.
President Trump declared the eight-week ceasefire 'over' at the NATO summit in Ankara, calling Iran's leaders 'liars' and 'cheats,' as global oil posted its steepest climb since May and the Dow fell on revived inflation fears before oil eased Thursday.
Sources: WSJ World News · FT World · WSJ Markets · ↑ top
Today: Isolated Rain Showers then Isolated Showers And Thunderstorms, high 88F.
Tonight: Isolated Showers And Thunderstorms then Scattered Showers And Thunderstorms, low 69F.
Friday: Showers And Thunderstorms, high 84F.
Latest developments: Wegmans confirmed that construction on its first Pittsburgh-area store, along Cool Springs Drive in Cranberry Township near the Penguins' practice facility, will begin this month.
The New York grocer bought the Cranberry Township land earlier this year after planning the store for years, and it now moves to break ground on the region's first Wegmans location.
Latest developments: TribLive reported a new nightlife destination called Mic Drop is coming to Pittsburgh's North Shore.
Mic Drop will open as a nightlife venue on the North Shore, adding to the ballpark district's bar and entertainment scene.
Latest developments: Two days before the 25-day shutdown, PennDOT launched a website posting real-time drive times on the detour routes and said its Western Regional Traffic Management Center will monitor them around the clock.
PennDOT closes Interstate 376 between the Squirrel Hill and Edgewood/Swissvale interchanges at 9 p.m. Friday, July 10, to demolish and replace the Commercial Street Bridge, forcing roughly 100,000 daily drivers in each direction off at the Wilkinsburg and Forbes Avenue/Oakland exits.
Latest developments: Pennsylvania's overdue budget is straining schools, counties, and nonprofits that depend on state money, the Post-Gazette reported, with recipients calling the wait 'super stressful.'
With the commonwealth's spending plan stalled in Harrisburg, organizations that rely on state reimbursements face delayed payments and mounting uncertainty across the region.
Sources: Pittsburgh Post-Gazette · ↑ top
Latest developments: The Carnegie Museum of Art screens 'Europa: Based on a True Story' on Thursday, July 9.
The film shows at 7 p.m. Thursday, July 9, at the Carnegie Museum of Art, 4400 Forbes Ave. in Oakland; tickets cost $10 at carnegieart.org.
Sources: Pittsburgh City Paper · ↑ top
Latest developments: Writer Zinzi Clemmons discusses her essay collection 'Freedom' with Bekezela Mguni on Thursday, July 9.
The free reading and conversation runs 7 to 8 p.m. Thursday, July 9, at White Whale Bookstore, 4754 Liberty Ave. in Bloomfield; an RSVP is required and a livestream is available.
Sources: Pittsburgh City Paper · ↑ top
Latest developments: The fourth annual Northside Music Festival anchors Pittsburgh's weekend of July 9-12 on the North Side.
NEXTpittsburgh's Summer Concert Guide flags the fourth annual Northside Music Festival and the brand-new Pittsburgh Music Festival as the city's two top music events this July.
Sources: NEXTpittsburgh Events · ↑ top
Latest developments: The Pittsburgh Vintage Grand Prix runs the weekend of July 9-12, NEXTpittsburgh reports.
The vintage car event headlines more than a dozen things to do around Pittsburgh the weekend of July 9-12, alongside a staging of 'Mean Girls.'
Sources: NEXTpittsburgh Events · ↑ top
Pirates (47-46)
Wed Jul 8 · Braves 3 · Pirates 0 · Final
Bart's 2-run homer helps Atlanta to 3-0 win after Braves end Pirates' combined perfect-game bid
Up Next · Braves @ Pirates · Thu Jul 9, 12:35 PM
Latest developments: Pro Football Hall of Famer Rod Woodson joined Cam Heyward's 'Not Just Football' for a deep dive into his 17-year career, sharing untold Steelers stories.
On the July 8 episode, the former Steelers cornerback recounted how coach Bill Cowher trusted his Hall of Fame players and reflected on how 'old school' NFL players were built differently.
Sources: Not Just Football with Cam Heyward · ↑ top
Latest developments: A Post-Gazette preview asked whether the Pirates will use the No. 5 overall pick in the MLB draft on another high schooler.
With the fifth overall selection in the July MLB draft, the Post-Gazette examined the Pirates' recent tendency to draft high school players and what the board may offer at No. 5.
Sources: Post-Gazette Pirates · ↑ top
Latest developments: On the July 8 SNR Drive, Matt Williamson and Wes Uhler ranked the best running backs in NFL history and broke down the top edge rushers for 2026.
The Steelers show continued its World Cup-style bracket debating the greatest running backs ever and discussed Jeremy Fowler's 2026 edge-rusher list while marking the franchise's and Jack Lambert's birthdays.
Sources: Pittsburgh Steelers (YouTube) · ↑ top
Latest developments: MLS named a 29-man All-Star Game roster including U.S. internationals Matt Freese, Max Arfsten, Tim Ream, and Sebastian Berhalter, alongside Lionel Messi.
The MLS All-Star Game roster pairs Inter Miami's Lionel Messi with four U.S. national-team players—goalkeeper Matt Freese, Max Arfsten, Tim Ream, and Sebastian Berhalter.
Sources: ESPN Soccer · ↑ top
Latest developments: ESPN argued the United States' World Cup failure falls on the players themselves, contending no coach could have salvaged the campaign.
In the wake of the round-of-16 loss to Belgium in Seattle, ESPN held that fans overrated coach Mauricio Pochettino's impact and that the U.S. roster simply lacked the talent to advance at its home World Cup.
Sources: ESPN Soccer · ↑ top
S&P 500 7,498.09 ▲ +1.3% Dow 52,706.95 ▲ +1.3% Nasdaq 25,936.64 ▲ +1.2% WTI crude 69.96 ▼ -0.6% EUR/USD 1.1417 ▲ +0.3% GBP/USD 1.3344 ▲ +1.0% USD/JPY 161.98 = -0.0%