================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Thursday, July 9, 2026 - 4:07 PM EDT ================================================================ A 15-year-old Linux root flaw and a Microsoft-signed rootkit anchor a day of destructive new malware, even as Microsoft warns its own AI will surface still more Windows bugs. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] A cryptomining break-in showed AI gateways can expose the cloud credentials and IAM data behind them, even as Microsoft's own bug-hunting models promise a surge of Windows fixes. see: AI Gateways and AI-Found Flaws * [TREND] Attackers keep reforging old code, with GodDamn ransomware riding the Microsoft-signed PoisonX driver to disable defenses while GigaWiper welds three older destructive tools into one backdoor. see: GodDamn Ransomware Rides Signed PoisonX Driver; GigaWiper Bolts Three Destructive Tools Into One Backdoor * [UPDATE (new)] Researchers disclosed GhostLock, a 15-year-old Linux kernel flaw granting root on every distribution shipped since 2011, and collected $92,000 from Google. see: GhostLock Grants Root on Every Linux Since 2011 * [TREND] GitHub shipped npm 12 disabling install scripts by default as Datadog warned attackers ride dormant GitHub ghost accounts and stolen OAuth tokens to poison the supply chain. see: npm 12 and Dormant GitHub Accounts Reshape Supply-Chain Risk * [UPDATE (new)] A new data-extortion crew named Helix is combining voice phishing, device-code phishing, and MFA abuse to loot corporate Microsoft SharePoint environments. see: Helix Vishing Crew Loots SharePoint * [UPDATE (new)] Locally, PennDOT's Parkway East shutdown begins Friday night for 25 days while Pennsylvania's measles outbreak topped 100 cases across seven counties. see: Parkway East Closes Friday Night; Pennsylvania Measles Cases Top 100 SECURITY ---------------------------------------------------------------- 1. AI GATEWAYS AND AI-FOUND FLAWS AI Security · [ai, cloud, vulnerability] Latest developments: Dark Reading detailed July 9 a cryptomining intrusion showing that AI gateways brokering model access also expose the cloud infrastructure, credentials, and IAM data behind them, the same day Microsoft told Windows users to expect more security updates as it leans on AI to find bugs in its own code. AI gateways widen the blast radius when compromised, handing attackers models, cloud, and identity data at once. Separately, the Alan Turing Institute found GitHub Copilot approving harmful actions inside code that it refuses in chat. - Dark Reading: https://www.darkreading.com/cyber-risk/ai-gateways-keys-kingdom - BleepingComputer: https://www.bleepingcomputer.com/news/microsoft/microsoft-expects-more-windows-security-updates-from-ai-discovered-flaws/ - Help Net Security: https://www.helpnetsecurity.com/2026/07/09/github-coding-agent-jailbreak/ 2. NPM 12 AND DORMANT GITHUB ACCOUNTS RESHAPE SUPPLY-CHAIN RISK Vulnerabilities and Exploits · [supply-chain, npm, reconnaissance] Latest developments: GitHub shipped npm 12 on July 9 with install scripts disabled by default and granular access tokens deprecated, the same day Datadog Security Labs warned that attackers ride years-old dormant GitHub 'ghost' accounts and stolen OAuth tokens to enumerate corporate GitHub organizations and repositories. The npm 12 defaults cut off a common package-install attack path, while the reconnaissance campaigns show adversaries mapping targets quietly through the GitHub API. Audit token usage and watch for anomalous scraping. - The Hacker News: https://thehackernews.com/2026/07/npm-12-disables-install-scripts-by.html - The Hacker News: https://thehackernews.com/2026/07/dormant-github-accounts-help-attackers.html 3. GIGAWIPER BOLTS THREE DESTRUCTIVE TOOLS INTO ONE BACKDOOR Ransomware and Cybercrime · [wiper, malware, destructive] Latest developments: Microsoft published a July 9 dissection of GigaWiper, a destructive Windows backdoor that welds code from several older malware families into one operator-selectable platform. GigaWiper lets an operator choose among wiping the full disk, overwriting the Windows drive, or running fake ransomware that scrambles files with a key it never saves. Microsoft shipped detection and defense guidance. - Microsoft Security Blog: https://www.microsoft.com/en-us/security/blog/2026/07/09/gigawiper-anatomy-of-a-destructive-backdoor-assembled-from-multiple-malware/ - The Hacker News: https://thehackernews.com/2026/07/new-gigawiper-windows-backdoor-bundles.html 4. GODDAMN RANSOMWARE RIDES SIGNED POISONX DRIVER Ransomware and Cybercrime · [ransomware, byovd, malware] Latest developments: Symantec's Threat Hunter Team flagged GodDamn, a ransomware family first seen in the wild May 21, 2026 and assessed as a rebrand of Beast, that loads the Microsoft-signed PoisonX kernel driver to disable endpoint defenses on U.S. companies. GodDamn uses bring-your-own-vulnerable-driver tactics, abusing a legitimately signed kernel driver to kill security software before encrypting victims. Block the vulnerable driver and monitor for BYOVD behavior. - The Hacker News: https://thehackernews.com/2026/07/goddamn-ransomware-uses-poisonx-driver.html - Dark Reading: https://www.darkreading.com/cyberattacks-data-breaches/goddamn-ransomware-byovd-smite-companies 5. GHOSTLOCK GRANTS ROOT ON EVERY LINUX SINCE 2011 Vulnerabilities and Exploits · [vulnerability, linux, patch] Latest developments: SecurityWeek reported July 9 that researchers disclosed GhostLock, a 15-year-old Linux kernel privilege-escalation flaw present in every major distribution since 2011, and collected $92,000 from Google for it. GhostLock lets any local user escalate to root across desktops, servers, and Android. Apply distribution patches as they ship. - SecurityWeek: https://www.securityweek.com/15-year-old-linux-vulnerability-ghostlock-earns-researchers-92k-from-google/ 6. HELIX VISHING CREW LOOTS SHAREPOINT Ransomware and Cybercrime · [extortion, vishing, identity] Latest developments: BleepingComputer named Helix on July 9, a new data-extortion group using voice phishing, device-code phishing, and multifactor-authentication abuse to steal data from Microsoft SharePoint environments. Helix leans on identity tricks rather than malware, phoning employees and hijacking sign-in flows to reach corporate SharePoint stores. Harden identity flows and train staff to resist vishing. - BleepingComputer: https://www.bleepingcomputer.com/news/security/new-helix-vishing-group-emerges-in-sharepoint-data-theft-attacks/ BUSINESS AND POLITICS ---------------------------------------------------------------- * U.S. and Iran Edge Back Toward Talks Latest developments: After the widened Gulf strikes, President Trump said Tehran is now seeking a deal, and Treasury yields and oil futures fell as traders bet the flare-up ends quickly. Following the largest exchange of fire since the peace deal—including U.S. strikes on Iranian railway bridges near Mashhad, where the late supreme leader Ayatollah Ali Khamenei will be buried Thursday—markets steadied as both sides signaled openness to new negotiations over the disputed Strait of Hormuz clause that hands Iran a leading role in reopening the waterway. - WSJ Markets: https://www.wsj.com/finance/investing/jgbs-fall-tracking-declines-in-u-s-treasurys-c87454e8?mod=rss_markets_main - WSJ World News: https://www.wsj.com/world/middle-east/u-s-launches-new-strikes-on-iran-after-trump-declares-ceasefire-over-2c0738fe - FT World: https://www.ft.com/content/4b1df8e8-cc24-4991-a900-cde0d25f0f68 PITTSBURGH ---------------------------------------------------------------- Weather: This Afternoon: Chance Showers And Thunderstorms, high 88F. Tonight: Chance Showers And Thunderstorms, low 70F. Friday: Chance Showers And Thunderstorms then Showers And Thunderstorms Likely, high 85F. Business: * Walmart Eyes Bloomfield Rite Aid Latest developments: Walmart bid to convert the vacant Rite Aid in Pittsburgh's Bloomfield neighborhood into a delivery hub, and neighbors are pushing back. Walmart wants to turn a shuttered Rite Aid in Bloomfield into a delivery hub, and residents say the site would draw delivery traffic while leaving the neighborhood without a nearby place to shop for groceries or a pharmacy. - WTAE: https://www.wtae.com/article/walmart-bloomfield-rite-aid-delivery-hub/71884711 * Giant Eagle Cuts Summer Prices Latest developments: Giant Eagle launched an 'On Sale This Season' program, cutting prices on more than 300 grocery staples by about 10% through the summer. The O'Hara Township-based grocer Giant Eagle reduced prices on more than 300 everyday items across its stores, an average 10% cut aimed at summer shoppers facing higher food costs. - WPXI: https://www.wpxi.com/news/local/giant-eagle-cuts-prices-hundreds-items-through-summer-season/WXWB5TMQ5VC3THWF6R5XP4IRMA/ Around town: * Pennsylvania Measles Cases Top 100 Latest developments: Pennsylvania's measles outbreak surpassed 100 confirmed cases and is now spreading across seven counties, the state health department reported. The Pennsylvania Department of Health has recorded more than 100 measles cases in a growing outbreak that has reached seven counties, a public-health concern as the highly contagious virus spreads. - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/health/2026/07/09/pa-measles-outbreak/stories/202607090046 * Parkway East Closes Friday Night Latest developments: One day out, PennDOT released detailed detour maps for the 376 shutdown, and Kennywood urged guests to add travel time for the 25-day closure that begins 9 p.m. Friday, July 10. PennDOT will close the Parkway East (Interstate 376) between the Squirrel Hill Tunnel and the Edgewood/Swissvale exit for 25 days starting 9 p.m. Friday, July 10, to slide the 11,000-ton, $95 million Commercial Street Bridge into place, diverting the 100,000 vehicles a day that use the stretch onto detour routes. - KDKA: https://www.cbsnews.com/pittsburgh/news/parkway-east-closure-376-detours/ - KDKA: https://www.cbsnews.com/pittsburgh/news/kennywood-parkway-east-closure-impacts/ * Allegheny County Relaunches Alerts Latest developments: Allegheny County relaunched its emergency alert notification system on a new platform, and residents must enroll again to receive warnings. Allegheny County moved its resident alert system to a new platform with added features, and officials are asking residents to sign up again to get emergency and severe-weather notifications. - WPXI: https://www.wpxi.com/news/local/allegheny-county-relaunches-alert-notification-system-heres-how-enroll/F5SBSXCTWRBCHFK2LFLEQZHQA4/ Events: * Big Boy 4014 Stops in Leetsdale Latest developments: Leetsdale is bracing for thousands of visitors Saturday, July 11, and stressing heat safety as Union Pacific's Big Boy No. 4014 makes a scheduled weekend stop. Union Pacific's Big Boy No. 4014, the world's largest operating steam locomotive, stops in Leetsdale on Saturday, July 11, during its cross-country tour, one of its few weekend stops; officials expect large crowds and warn visitors to prepare for the heat. - WPXI: https://www.wpxi.com/news/local/leetsdale-prepares-thousands-visitors-big-boy-locomotive-officials-emphasize-heat-safety/XQ565RNWHBBE5KS3XLRRXSHELM/ SPORTS ---------------------------------------------------------------- Pirates (47-46) Wed Jul 8 · Braves 3 · Pirates 0 · Final Bart's 2-run homer helps Atlanta to 3-0 win after Braves end Pirates' combined perfect-game bid https://plaintextsports.com/mlb/2026-07-08/atl-pit Thu Jul 9 · Braves 6 · Pirates 5 · End 8th (in progress at last update) https://plaintextsports.com/mlb/2026-07-09/atl-pit Up Next · Brewers @ Pirates · Fri Jul 10, 6:40 PM https://plaintextsports.com/mlb/2026-07-10/mil-pit Around the Teams: * Watt Slips in Edge Rusher Poll Latest developments: ESPN's 2026 edge rusher poll of executives, coaches, and scouts dropped Steelers linebacker T.J. Watt out of the top five, and the Post-Gazette weighed whether the fall is fair. The Post-Gazette examined ESPN's ranking that placed Myles Garrett, Micah Parsons, Maxx Crosby, and Aidan Hutchinson ahead of Pittsburgh's T.J. Watt, questioning whether the Steelers standout deserved to drop from the top five. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/07/09/espn-poll-garrett-parsons-crosby-hutchinson-highsmith-herbig/stories/202607090006 Team USA: * U.S. Soccer Confirms Pulisic Injury Latest developments: U.S. Soccer confirmed Thursday that Christian Pulisic suffered a microfracture and bone bruise in his lower leg during the Belgium loss and will miss several weeks. USMNT and AC Milan forward Christian Pulisic sustained a microfracture and bone bruise in his lower leg during the World Cup round-of-16 loss to Belgium, an injury that sidelines him for several weeks. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49315041/usa-christian-pulisic-suffered-microfracture-belgium-sources * U.S. Forward Campbell Joins Elversberg Latest developments: American forward Cole Campbell is transferring from Borussia Dortmund to Bundesliga newcomer SV Elversberg, ESPN reported. Cole Campbell, a young United States forward, is leaving Borussia Dortmund to join newly promoted SV Elversberg in Germany's Bundesliga. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49315578/us-cole-campbell-joins-elversberg-borussia-dortmund * U.S. Weighs 2029 Club World Cup Bid Latest developments: U.S. officials have opened talks with FIFA about hosting the 2029 Club World Cup, seeking to build on the 2026 World Cup, the Guardian reported. The United States has told FIFA it is interested in staging the 2029 Club World Cup, capitalizing on the commercial and sporting momentum of co-hosting the 2026 World Cup, though it has yet to commit to a formal bid. - Guardian World Cup 2026: https://www.theguardian.com/football/2026/jul/09/us-fifa-talks-hosting-2029-club-world-cup READING ---------------------------------------------------------------- * Stratechery -- Muse Image, Grok 4.5, Alex Karp on CNBC Ben Thompson argues the contest over verifiable data increasingly defines the AI race, working through Microsoft's Muse image model, xAI's Grok 4.5, and Palantir chief Alex Karp's CNBC appearance. https://stratechery.com/2026/muse-image-grok-4-5-alex-karp-on-cnbc/ * Ed Zitron -- Let AI Burn Zitron argues investors and policymakers should let the overbuilt, unprofitable AI industry collapse under its own weight instead of propping it up. https://www.wheresyoured.at/let-ai-burn/ * Cal Newport -- Beware of Productivity Paradoxes Newport examines why powerful tools such as the personal computer often fail to deliver the productivity gains expected of them, a paradox worth heeding amid AI hype. https://calnewport.com/beware-of-productivity-paradoxes/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,498.09 ▲ +1.3% Dow 52,706.95 ▲ +1.3% Nasdaq 25,936.64 ▲ +1.2% WTI crude 69.96 ▼ -0.6% EUR/USD 1.1417 ▲ +0.3% GBP/USD 1.3344 ▲ +1.0% USD/JPY 161.98 = -0.0% ================================================================ Generated 2026-07-09 16:07 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================