================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Thursday, July 9, 2026 - 6:06 AM EDT ================================================================ Attackers weaponized developers' own AI coding agents en masse, hijacking approved file writes and tricking the tools into running the very malware they were asked to inspect. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Wiz's GhostApproval symlink flaw weaponizes developers' own AI coding assistants—Cursor, Claude Code, Amazon Q—redirecting approved file writes onto sensitive targets across six tools. see: AI Coding Agents Turned Into Attack Surface * [TREND] Signed trust markers ring hollow as the GodDamn ransomware crew abuses a kernel driver Microsoft itself co-signed to disable endpoint defenses before encrypting U.S. companies. see: GodDamn Ransomware Abuses Microsoft-Signed Driver * [TREND] Personal data spilled by the millions—6.9 million drivers at AssuranceAmerica and 12 million-plus at KDDI—even as a 97-country dragnet logged 5,811 arrests. see: Breaches Expose Millions at AssuranceAmerica and KDDI; Global Anti-Fraud Sweep Nets 5,811 Arrests * [UPDATE (new)] Microsoft shipped an out-of-band fix for the RoguePlanet Defender zero-day as Google's Chrome 150 patched 27 flaws, including thirteen use-after-free bugs. see: Defender Zero-Day and Chrome Fixes Head Patch Rush * [UPDATE (new)] Infoblox exposed Lurking Lizard, a residential-proxy operation pushing fake 7-Zip installers across 230-plus lookalike domains to enroll victim machines as proxy nodes. see: Fake 7-Zip and Cracked Software Seed Crimeware SECURITY ---------------------------------------------------------------- 1. AI CODING AGENTS TURNED INTO ATTACK SURFACE AI Security · [ai, supply-chain, zero-day] Latest developments: Wiz disclosed GhostApproval on July 9, a symlink flaw across six AI coding assistants—Amazon Q Developer, Anthropic's Claude Code, Augment, Cursor, Google Antigravity, and Windsurf—that redirects an approved write onto a sensitive file and hands a booby-trapped repository control of the developer's machine, the same day the AI Now Institute's Friendly Fire proof-of-concept tricked Claude Code and OpenAI's Codex into running attacker code while scanning it and researchers unveiled HalluSquatting, which pre-registers the fake package names AI assistants reliably invent to serve botnet malware. AI coding agents load skills, packages, and whole repositories with little vetting, and every channel now carries an exploit; teams running these tools in autonomous mode should restrict file writes, pin dependencies, and treat agent self-approvals as untrusted. - SecurityWeek: https://www.securityweek.com/ai-coding-tools-tricked-into-hacking-developer-machine-via-decades-old-technique/ - The Hacker News: https://thehackernews.com/2026/07/friendly-fire-ai-agents-built-to-catch.html - The Hacker News: https://thehackernews.com/2026/07/ghostapproval-symlink-flaws-could-let.html - The Hacker News: https://thehackernews.com/2026/07/new-hallusquatting-attack-could-trick.html 2. BREACHES EXPOSE MILLIONS AT ASSURANCEAMERICA AND KDDI Data Breaches · [breach, data-theft] Latest developments: AssuranceAmerica disclosed July 9 a breach exposing records of nearly 6.9 million drivers after intruders reached its systems earlier this year, the same day Japanese telecom KDDI said attackers who breached an email platform shared by five internet service providers exposed the email addresses and passwords of more than 12 million people, and Mount Royal University in Calgary confirmed hackers stole then deleted data from its file storage. Three fresh intrusions spilled personal data across insurance, telecom, and higher education. Affected customers and students should reset passwords, watch for phishing, and monitor accounts for fraud. - BleepingComputer: https://www.bleepingcomputer.com/news/security/assuranceamerica-data-breach-exposes-records-of-69-million-drivers/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/japanese-telecom-giant-kddi-says-data-breach-affects-12-million-people/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/mount-royal-university-confirms-breach-as-hackers-claim-attack/ 3. DEFENDER ZERO-DAY AND CHROME FIXES HEAD PATCH RUSH Vulnerabilities and Exploits · [patch, zero-day] Latest developments: Microsoft shipped an out-of-band patch July 9 for RoguePlanet, a Defender zero-day disclosed after the June 2026 Patch Tuesday, as Google released Chrome 150 fixing 27 flaws including 13 use-after-free bugs and two critical holes it found itself, and Wireshark 4.6.7 closed a dozen protocol-dissector weaknesses. Fresh fixes landed across Microsoft Defender, the Chrome browser, and the Wireshark packet analyzer, several exploitable through crafted files or web content. Administrators should apply all three promptly. - BleepingComputer: https://www.bleepingcomputer.com/news/microsoft/microsoft-patches-rogueplanet-defender-zero-day-vulnerability/ - SecurityWeek: https://www.securityweek.com/chrome-150-update-patches-27-vulnerabilities/ - Help Net Security: https://www.helpnetsecurity.com/2026/07/09/wireshark-4-6-7-released/ 4. FAKE 7-ZIP AND CRACKED SOFTWARE SEED CRIMEWARE Ransomware and Cybercrime · [malware, infostealer, proxy] Latest developments: Infoblox exposed Lurking Lizard on July 9, a threat actor running a residential-proxy business since at least August 2022 across more than 230 lookalike domains that push fake 7-Zip installers to enroll victim devices as proxy nodes, while Dark Reading tracked a Vidar infostealer malvertising campaign luring small businesses with cracked and pirated software to steal data and mine cryptocurrency. Both operations disguise malware as trusted or free software downloads, one to build a for-hire proxy network and the other to combine data theft with cryptomining. Users should avoid pirated installers and verify download sources. - The Hacker News: https://thehackernews.com/2026/07/fake-7-zip-installers-turn-devices-into.html - Dark Reading: https://www.darkreading.com/cyberattacks-data-breaches/vidar-infostealer-smb-malvertising-campaign 5. GODDAMN RANSOMWARE ABUSES MICROSOFT-SIGNED DRIVER Ransomware and Cybercrime · [ransomware, byovd] Latest developments: Dark Reading reported July 9 that a new crew calling itself GodDamn wields a malicious kernel driver Microsoft itself co-signed to shut off endpoint security software at U.S. companies before encrypting them, a bring-your-own-vulnerable-driver play that turns a trusted signature into a skeleton key. GodDamn loads a Microsoft-signed driver to reach kernel level and disable defenses ahead of encryption. Organizations should block the known vulnerable driver by hash and alert on anomalous driver loads. - Dark Reading: https://www.darkreading.com/cyberattacks-data-breaches/goddamn-ransomware-byovd-smite-companies 6. GLOBAL ANTI-FRAUD SWEEP NETS 5,811 ARRESTS Ransomware and Cybercrime · [fraud, law-enforcement] Latest developments: BleepingComputer reported July 9 that a coordinated law-enforcement operation spanning 97 countries arrested 5,811 suspects and seized $293 million in illicit assets in a single online-fraud crackdown. The multinational sweep targeted online payment and investment fraud rings across nearly a hundred jurisdictions. It marks one of the largest coordinated fraud takedowns of the year, though the operating groups behind the schemes remain unnamed. - BleepingComputer: https://www.bleepingcomputer.com/news/security/police-arrests-5-800-suspects-in-global-anti-fraud-crackdown/ BUSINESS AND POLITICS ---------------------------------------------------------------- * U.S. and Iran Trade Fire Across the Gulf Latest developments: The United States struck Iran a second straight night, and Tehran fired back at Bahrain, Kuwait, and Qatar, widening the war beyond the two combatants and threatening the interim deal meant to end it. President Trump declared the eight-week ceasefire 'over' at the NATO summit in Ankara, calling Iran's leaders 'liars' and 'cheats,' as global oil posted its steepest climb since May and the Dow fell on revived inflation fears before oil eased Thursday. - WSJ World News: https://www.wsj.com/world/middle-east/u-s-launches-new-strikes-on-iran-after-trump-declares-ceasefire-over-2c0738fe - FT World: https://www.ft.com/content/ea2d4977-b1d1-44e4-9645-e6d8cd226439 - WSJ Markets: https://www.wsj.com/finance/stocks/wall-streets-peace-trade-collides-with-renewed-iran-fighting-86b83d67?mod=rss_markets_main PITTSBURGH ---------------------------------------------------------------- Weather: Today: Isolated Rain Showers then Isolated Showers And Thunderstorms, high 88F. Tonight: Isolated Showers And Thunderstorms then Scattered Showers And Thunderstorms, low 69F. Friday: Showers And Thunderstorms, high 84F. Business: * Wegmans Breaks Ground in Cranberry Latest developments: Wegmans confirmed that construction on its first Pittsburgh-area store, along Cool Springs Drive in Cranberry Township near the Penguins' practice facility, will begin this month. The New York grocer bought the Cranberry Township land earlier this year after planning the store for years, and it now moves to break ground on the region's first Wegmans location. - KDKA: https://www.cbsnews.com/pittsburgh/news/wegmans-pittsburgh-area-construction-cranberry-begins-this-month/ * 'Mic Drop' Nightlife Spot for North Shore Latest developments: TribLive reported a new nightlife destination called Mic Drop is coming to Pittsburgh's North Shore. Mic Drop will open as a nightlife venue on the North Shore, adding to the ballpark district's bar and entertainment scene. - TribLive: https://triblive.com/lifestyles/food-drink/new-nightlife-spot-mic-drop-coming-to-north-shore/ Around town: * Parkway East Closure Tools Go Live Latest developments: Two days before the 25-day shutdown, PennDOT launched a website posting real-time drive times on the detour routes and said its Western Regional Traffic Management Center will monitor them around the clock. PennDOT closes Interstate 376 between the Squirrel Hill and Edgewood/Swissvale interchanges at 9 p.m. Friday, July 10, to demolish and replace the Commercial Street Bridge, forcing roughly 100,000 daily drivers in each direction off at the Wilkinsburg and Forbes Avenue/Oakland exits. - KDKA: https://www.cbsnews.com/pittsburgh/news/penndot-parkway-east-closure-specialized-website-drive-times/ - KDKA: https://www.cbsnews.com/pittsburgh/news/when-will-parkway-east-376-close-reopen-timeline/ * Pennsylvania Budget Impasse Squeezes Grantees Latest developments: Pennsylvania's overdue budget is straining schools, counties, and nonprofits that depend on state money, the Post-Gazette reported, with recipients calling the wait 'super stressful.' With the commonwealth's spending plan stalled in Harrisburg, organizations that rely on state reimbursements face delayed payments and mounting uncertainty across the region. - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/politics-state/2026/07/09/pa-budget-impasse-state-funding/stories/202607090024 Events: * 'Europa' Screening at Carnegie Museum Latest developments: The Carnegie Museum of Art screens 'Europa: Based on a True Story' on Thursday, July 9. The film shows at 7 p.m. Thursday, July 9, at the Carnegie Museum of Art, 4400 Forbes Ave. in Oakland; tickets cost $10 at carnegieart.org. - Pittsburgh City Paper: https://www.pghcitypaper.com/listings/this-weeks-top-events/pittsburghs-top-events-thu-july-9-wed-july-15/ * Zinzi Clemmons at White Whale Bookstore Latest developments: Writer Zinzi Clemmons discusses her essay collection 'Freedom' with Bekezela Mguni on Thursday, July 9. The free reading and conversation runs 7 to 8 p.m. Thursday, July 9, at White Whale Bookstore, 4754 Liberty Ave. in Bloomfield; an RSVP is required and a livestream is available. - Pittsburgh City Paper: https://www.pghcitypaper.com/listings/this-weeks-top-events/pittsburghs-top-events-thu-july-9-wed-july-15/ * Fourth Northside Music Festival Latest developments: The fourth annual Northside Music Festival anchors Pittsburgh's weekend of July 9-12 on the North Side. NEXTpittsburgh's Summer Concert Guide flags the fourth annual Northside Music Festival and the brand-new Pittsburgh Music Festival as the city's two top music events this July. - NEXTpittsburgh Events: https://nextpittsburgh.com/events/14-things-to-do-this-weekend-from-the-pittsburgh-vintage-grand-prix/ * Pittsburgh Vintage Grand Prix Weekend Latest developments: The Pittsburgh Vintage Grand Prix runs the weekend of July 9-12, NEXTpittsburgh reports. The vintage car event headlines more than a dozen things to do around Pittsburgh the weekend of July 9-12, alongside a staging of 'Mean Girls.' - NEXTpittsburgh Events: https://nextpittsburgh.com/events/14-things-to-do-this-weekend-from-the-pittsburgh-vintage-grand-prix/ SPORTS ---------------------------------------------------------------- Pirates (47-46) Wed Jul 8 · Braves 3 · Pirates 0 · Final Bart's 2-run homer helps Atlanta to 3-0 win after Braves end Pirates' combined perfect-game bid https://plaintextsports.com/mlb/2026-07-08/atl-pit Up Next · Braves @ Pirates · Thu Jul 9, 12:35 PM https://plaintextsports.com/mlb/2026-07-09/atl-pit Around the Teams: * Rod Woodson on 'Not Just Football' Latest developments: Pro Football Hall of Famer Rod Woodson joined Cam Heyward's 'Not Just Football' for a deep dive into his 17-year career, sharing untold Steelers stories. On the July 8 episode, the former Steelers cornerback recounted how coach Bill Cowher trusted his Hall of Fame players and reflected on how 'old school' NFL players were built differently. - Not Just Football with Cam Heyward: https://www.youtube.com/watch?v=pSO2ujESg2M * Pirates' No. 5 Draft Pick Latest developments: A Post-Gazette preview asked whether the Pirates will use the No. 5 overall pick in the MLB draft on another high schooler. With the fifth overall selection in the July MLB draft, the Post-Gazette examined the Pirates' recent tendency to draft high school players and what the board may offer at No. 5. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/07/08/mlb-draft-preview-pirates-kevan-graves/stories/202607070029 * SNR Drive Ranks Backs and Edge Rushers Latest developments: On the July 8 SNR Drive, Matt Williamson and Wes Uhler ranked the best running backs in NFL history and broke down the top edge rushers for 2026. The Steelers show continued its World Cup-style bracket debating the greatest running backs ever and discussed Jeremy Fowler's 2026 edge-rusher list while marking the franchise's and Jack Lambert's birthdays. - Pittsburgh Steelers (YouTube): https://www.youtube.com/watch?v=cvaKmJYkbhg Team USA: * U.S. Players on MLS All-Star Roster Latest developments: MLS named a 29-man All-Star Game roster including U.S. internationals Matt Freese, Max Arfsten, Tim Ream, and Sebastian Berhalter, alongside Lionel Messi. The MLS All-Star Game roster pairs Inter Miami's Lionel Messi with four U.S. national-team players—goalkeeper Matt Freese, Max Arfsten, Tim Ream, and Sebastian Berhalter. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49298192/lionel-messi-tim-ream-seb-berhalter-headline-mls-all-star-game-roster * USMNT Exit Pinned on Players Latest developments: ESPN argued the United States' World Cup failure falls on the players themselves, contending no coach could have salvaged the campaign. In the wake of the round-of-16 loss to Belgium in Seattle, ESPN held that fans overrated coach Mauricio Pochettino's impact and that the U.S. roster simply lacked the talent to advance at its home World Cup. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49298797/usmnt-failed-world-cup-players-no-coach-save-them READING ---------------------------------------------------------------- * Stratechery -- Muse Image, Grok 4.5, Alex Karp on CNBC Ben Thompson argues the battle for verifiable data increasingly defines the AI race, drawing on Microsoft's Muse Image, xAI's Grok 4.5, and Palantir chief Alex Karp's CNBC remarks. https://stratechery.com/2026/muse-image-grok-4-5-alex-karp-on-cnbc/ * Ed Zitron -- Let AI Burn Zitron argues the AI industry is financially unsustainable and that society should let the bubble collapse rather than prop it up. https://www.wheresyoured.at/let-ai-burn/ * Cal Newport -- Beware of Productivity Paradoxes Newport revisits how transformative tools like the personal computer often failed to deliver their promised productivity gains, cautioning that AI may follow the same paradoxical path. https://calnewport.com/beware-of-productivity-paradoxes/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,498.09 ▲ +1.3% Dow 52,706.95 ▲ +1.3% Nasdaq 25,936.64 ▲ +1.2% WTI crude 69.96 ▼ -0.6% EUR/USD 1.1417 ▲ +0.3% GBP/USD 1.3344 ▲ +1.0% USD/JPY 161.98 = -0.0% ================================================================ Generated 2026-07-09 06:06 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================