================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Friday, July 10, 2026 - 6:06 AM EDT ================================================================ Microsoft dismantled the GigaWiper destructive backdoor while warning that AI is collapsing the time defenders have to patch a freshly disclosed flaw. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Microsoft is shortening its Windows update guidance because AI now narrows the span between a patch's release and a working exploit to minutes. see: AI Compresses the Patch Window * [TREND] Attackers keep burrowing into developer supply chains, standing up 200 GitHub repositories and reviving dormant ghost accounts while poisoning npm to map corporate networks. see: Malware Floods GitHub and npm * [TREND] Extortion operators stayed busy as the new Helix crew called employees to loot SharePoint via device-code and MFA abuse, while a BlackCat negotiator drew 70 months. see: Helix Vishing Extortion Crew; BlackCat Negotiator Sentenced * [UPDATE (new)] Fresh Windows and Linux threats surfaced, with Microsoft dissecting the menu-driven GigaWiper backdoor and researchers disclosing the 15-year-old GhostLock kernel root flaw. see: GigaWiper Destructive Backdoor; GhostLock Linux Root Flaw * [TREND] AI skepticism deepens across the Reading picks, as Zitron argues the industry's mounting losses should be left to collapse while Newport warns new tools rarely deliver promised productivity gains. see: Let AI Burn; Beware of Productivity Paradoxes * [UPDATE (new)] Locally, PASSHE schools including Slippery Rock will waive tuition for some students, while Walmart seeks to convert a vacant Bloomfield Rite Aid into a delivery hub. see: PASSHE Schools to Waive Tuition for Some Students; Walmart Seeks Bloomfield Delivery Hub SECURITY ---------------------------------------------------------------- 1. MALWARE FLOODS GITHUB AND NPM Vulnerabilities and Exploits · [supply-chain, malware, ai] Latest developments: SecurityWeek exposed a network of 200 GitHub repositories that use a Go module to load PowerShell and fetch Windows malware from public dead drops, as Datadog warned of campaigns riding years-old dormant ghost accounts to map corporate orgs, SecurityWeek detailed HalluSquatting weaponizing AI package-name hallucinations for remote code execution, and GitHub shipped npm 12 with install scripts disabled by default. Attackers increasingly hide inside developer platforms, from GitHub repositories and OAuth tokens to poisoned package names. Defenders should audit dependencies, keep auto-run install scripts off, and monitor GitHub access. - SecurityWeek: https://www.securityweek.com/network-of-200-github-repositories-used-for-malware-infection/ - The Hacker News: https://thehackernews.com/2026/07/dormant-github-accounts-help-attackers.html - SecurityWeek: https://www.securityweek.com/hallusquatting-turns-ai-hallucinations-into-botnet-delivery-mechanism/ - The Hacker News: https://thehackernews.com/2026/07/npm-12-disables-install-scripts-by.html 2. GIGAWIPER DESTRUCTIVE BACKDOOR Ransomware and Cybercrime · [malware, wiper, ransomware] Latest developments: Microsoft's threat team dissected GigaWiper on July 9, a Windows backdoor that welds three older destructive programs into one menu-driven platform—a standalone disk wiper, a multi-pass command that overwrites the Windows drive, and fake ransomware that scrambles files with a key it never saves. GigaWiper hands an operator a choice of ways to destroy a machine, and its sham encryption leaves no path to recovery. Microsoft published detection and defense guidance for the assembled malware. - Microsoft Security Blog: https://www.microsoft.com/en-us/security/blog/2026/07/09/gigawiper-anatomy-of-a-destructive-backdoor-assembled-from-multiple-malware/ - The Hacker News: https://thehackernews.com/2026/07/new-gigawiper-windows-backdoor-bundles.html - SecurityWeek: https://www.securityweek.com/gigawiper-combines-multiple-malware-for-system-level-sabotage/ 3. AI COMPRESSES THE PATCH WINDOW AI Security · [patch, ai, vulnerability] Latest developments: Microsoft urged organizations on July 10 to shorten Windows update deployment timelines, warning that AI shrinks the span between a patch's release and a working exploit, and said AI-discovered flaws in its own code will push its monthly update counts higher. Microsoft is reworking its patch-cadence advice as AI speeds both vulnerability discovery and exploitation. Help Net Security's July forecast notes June already brought over 200 Microsoft CVEs, straining the practicality of CVE tracking. - Help Net Security: https://www.helpnetsecurity.com/2026/07/10/microsoft-windows-update-deployment-timelines/ - BleepingComputer: https://www.bleepingcomputer.com/news/microsoft/microsoft-expects-more-windows-security-updates-from-ai-discovered-flaws/ - Help Net Security: https://www.helpnetsecurity.com/2026/07/10/july-2026-patch-tuesday-forecast/ 4. BLACKCAT NEGOTIATOR SENTENCED Ransomware and Cybercrime · [ransomware, arrest, blackcat] Latest developments: A U.S. court sentenced Martino, a former DigitalMint incident-response employee, to 70 months in prison for conspiring with the defunct BlackCat/ALPHV crew and two other security professionals to extort U.S. companies in 2023. The case exposes insider betrayal within incident-response ranks: a negotiator paid to fight ransomware instead helped run BlackCat extortion against the victims he was hired to defend. - BleepingComputer: https://www.bleepingcomputer.com/news/security/us-ransomware-negotiator-gets-4-years-in-prison-for-blackcat-attacks/ - The Hacker News: https://thehackernews.com/2026/07/ransomware-negotiator-gets-70-months-in.html 5. HELIX VISHING EXTORTION CREW Ransomware and Cybercrime · [extortion, vishing, phishing] Latest developments: BleepingComputer identified Helix on July 9, a new data-extortion group stealing from SharePoint environments through voice phishing, device-code phishing, and multi-factor authentication abuse. Helix leans on identity tricks rather than malware, calling employees to gain access and exfiltrate SharePoint data. Enforce phishing-resistant MFA and verify anyone claiming to be IT. - BleepingComputer: https://www.bleepingcomputer.com/news/security/new-helix-vishing-group-emerges-in-sharepoint-data-theft-attacks/ 6. GHOSTLOCK LINUX ROOT FLAW Vulnerabilities and Exploits · [vulnerability, linux, privilege-escalation] Latest developments: Researchers disclosed GhostLock on July 9, a 15-year-old Linux kernel privilege-escalation flaw present in every major distribution since 2011 that hands attackers root and earned the finders a $92,000 Google bounty. GhostLock lets a local user escalate to root across Linux desktops, servers, and derived systems. Administrators should apply their distribution's kernel updates. - SecurityWeek: https://www.securityweek.com/15-year-old-linux-vulnerability-ghostlock-earns-researchers-92k-from-google/ BUSINESS AND POLITICS ---------------------------------------------------------------- * SK Hynix Completes Largest-Ever Foreign U.S. Listing Latest developments: SK Hynix raised $26.51 billion selling American depositary receipts and debuts on Nasdaq Friday, the largest U.S. listing ever by a foreign company. The South Korean memory-chip maker, a key supplier of the high-bandwidth memory that feeds AI accelerators, tapped surging investor appetite for AI hardware; the Financial Times called the jumbo sale a sign of overheated markets. - WSJ Markets: https://www.wsj.com/tech/sk-hynix-raises-26-51-billion-through-adr-offering-865f35cf?mod=rss_markets_main - FT Markets: https://www.ft.com/content/33133a86-925e-4395-9f60-35e2a4052500 * IEA Warns of Global Fuel Supply Crunch Latest developments: The International Energy Agency warned Friday that refinery outages across the Gulf and Russia threaten a petrol and diesel supply crunch, even as crude futures fell on hopes that U.S.-Iran tensions stay contained. Wars have knocked out refining capacity in the Persian Gulf and in Russia—where Ukrainian drones now reach Siberian energy assets—while global fuel consumption holds high, tightening product markets even as oil prices ease. - FT Markets: https://www.ft.com/content/54261075-72c5-4b47-9d53-8c94738201e3 - WSJ Markets: https://www.wsj.com/finance/commodities-futures/oil-falls-on-prospects-u-s-iran-tensions-may-be-contained-5a767f46?mod=rss_markets_main PITTSBURGH ---------------------------------------------------------------- Weather: Today: Chance Showers And Thunderstorms, high 85F. Tonight: Chance Showers And Thunderstorms then Areas Of Fog, low 67F. Saturday: Areas Of Fog then Scattered Showers And Thunderstorms, high 84F. Business: * Walmart Seeks Bloomfield Delivery Hub Latest developments: Walmart asked Pittsburgh's zoning board Thursday to convert the vacant Rite Aid on Liberty Avenue in Bloomfield into an online-grocery delivery hub, drawing opposition from neighbors. Shoppers would place orders through Walmart's app for pickup or delivery, and the depot would have no walk-in store; Bloomfield residents testified the plan adds traffic without giving the neighborhood a place to shop. - KDKA: https://www.cbsnews.com/pittsburgh/news/walmart-delivery-hub-proposal-bloomfield-pittsburgh/ - WTAE: https://www.wtae.com/article/walmart-bloomfield-rite-aid-delivery-hub/71884711 * Giant Eagle Cuts Prices for Summer Latest developments: Giant Eagle said it is lowering prices on more than 300 grocery staples for the rest of the summer. The Pittsburgh-based grocer framed the reductions on key items as relief for shoppers facing elevated food costs across its western Pennsylvania stores. - WTAE: https://www.wtae.com/article/giant-eagle-prices-summer/71891078 Around town: * PASSHE Schools to Waive Tuition for Some Students Latest developments: Slippery Rock, Indiana University of Pennsylvania, and PennWest rank among the state-system schools set to waive tuition for certain students under a new PASSHE Pledge. Pennsylvania's State System of Higher Education will cover costs for qualifying students at several of its universities, aiming to widen access as enrollment pressures mount. - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/education/2026/07/10/passhe-pledge-tuition-waive-slippery-rock-iup-pennwest/stories/202607090058 * Scottdale Weighs Flood Response Latest developments: Scottdale Borough Council held a special meeting Thursday evening where residents whose homes and businesses flooded over the July 4 weekend aired their frustrations. Heavy rain during the Independence Day weekend inundated properties across the Westmoreland County borough, and residents pressed borough leaders for answers on drainage and prevention. - WTAE: https://www.wtae.com/article/residents-frustrated-flooded-homes-businesses-scottdale-borough-fourth-of-july-storms/71891447 * Allegheny County Parental-Leave Comment Period Closing Latest developments: Allegheny County's public comment period on a proposed paid parental-leave policy nears its close, with parents sharing birth stories to press the case. The county is weighing paid parental leave, and residents are weighing in before the comment window shuts. - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/health/2026/07/10/allegheny-county-paid-parental-leave-1/stories/202607120030 Events: * Guardian Angels Parish Summer Festival Latest developments: The Guardian Angels Parish Summer Festival runs Friday, July 10, from 6 to 10 p.m. and Saturday, July 11, from 5 to 10 p.m. The parish festival takes place on the Most Blessed Sacrament Church grounds at 800 Montana Avenue in Harrison Township, Allegheny County. - TribLive: https://triblive.com/local/valley-news-dispatch/guardian-angels-parish-summer-festival-running-through-saturday/ * Pittsburgh Vintage Grand Prix Weekend Latest developments: NEXTpittsburgh's guide to July 9-12 highlights the Pittsburgh Vintage Grand Prix and a staging of the 'Mean Girls' musical among the weekend's options. The vintage car festival headlines a Pittsburgh weekend that also includes the fourth annual Northside Music Festival across the city's Northside. - NEXTpittsburgh Arts & Entertainment: https://nextpittsburgh.com/events/14-things-to-do-this-weekend-from-the-pittsburgh-vintage-grand-prix/ SPORTS ---------------------------------------------------------------- Pirates (47-47) Thu Jul 9 · Braves 10 · Pirates 5 · Final Mike Yastrzemski hits grand slam in Braves' 10-5 win over Pirates https://plaintextsports.com/mlb/2026-07-09/atl-pit Up Next · Brewers @ Pirates · Fri Jul 10, 6:40 PM https://plaintextsports.com/mlb/2026-07-10/mil-pit Around the Teams: * Watt Slips in ESPN Edge-Rusher Poll Latest developments: A Post-Gazette piece weighed whether Steelers linebacker T.J. Watt deserved to fall out of the top five in ESPN's 2026 edge-rusher poll of league executives, coaches, and scouts. Watt landed behind Myles Garrett, Micah Parsons, Maxx Crosby, and Aidan Hutchinson in the ranking, prompting the beat to debate whether the Steelers star's standing has slipped. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/07/09/espn-poll-garrett-parsons-crosby-hutchinson-highsmith-herbig/stories/202607090006 * How the Pirates Landed Konnor Griffin Latest developments: The Post-Gazette detailed the inside story of how the Pirates drafted shortstop Konnor Griffin, with the White Sox and Nationals picking ahead of general manager Ben Cherington. Griffin, now an injured rookie phenom the club expects back in September, became the centerpiece of the Pirates' farm system, and the account traces the draft-room decisions that brought him to Pittsburgh. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/07/10/konnor-griffin-mlb-draft-cherington-whitesox-nationals/stories/202607090056 * Steelers Show Ranks RBs and Edge Rushers Latest developments: On the July 8 SNR Drive, Matt Williamson and Wes Uhler ranked the best running backs in NFL history and broke down Jeremy Fowler's top edge rushers for 2026. The Steelers team channel's daily show continued its World Cup-style bracket, this round on all-time running backs, alongside a look at the league's premier pass rushers entering the season. - Pittsburgh Steelers (YouTube): https://www.youtube.com/watch?v=cvaKmJYkbhg Team USA: * Pulisic Out Weeks With Leg Fracture Latest developments: U.S. Soccer confirmed Thursday that Christian Pulisic suffered a microfracture and bone bruise in his lower leg during the World Cup loss to Belgium, sidelining the forward for several weeks. Pulisic, the U.S. captain and AC Milan attacker, left the 4-1 round-of-16 defeat in Seattle in the second half; imaging Tuesday confirmed the injury after a home World Cup in which his availability drew criticism. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49315041/usa-christian-pulisic-suffered-microfracture-belgium-sources - Guardian World Cup 2026: https://www.theguardian.com/football/2026/jul/09/christian-pulisic-injury-world-cup-usmnt * U.S. Forward Campbell Joins Elversberg Latest developments: American forward Cole Campbell is transferring from Borussia Dortmund to Bundesliga newcomer SV Elversberg. The move sends the young U.S. attacker to top-flight German football with the promoted club in search of regular playing time. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49315578/us-cole-campbell-joins-elversberg-borussia-dortmund READING ---------------------------------------------------------------- * Stratechery -- A Script for Mark Zuckerberg Ben Thompson writes, in the form of a script, what Mark Zuckerberg should say on Meta's next earnings call to justify the company's AI spending and strategy. https://stratechery.com/2026/a-script-for-mark-zuckerberg/ * Ed Zitron -- Let AI Burn Zitron argues the AI industry's mounting losses are unsustainable and that society should let the bubble collapse rather than prop up the companies inflating it. https://www.wheresyoured.at/let-ai-burn/ * Cal Newport -- Beware of Productivity Paradoxes Newport uses the personal computer's disappointing productivity record to warn that new tools like AI often fail to deliver the straightforward gains their boosters promise. https://calnewport.com/beware-of-productivity-paradoxes/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,510.17 ▲ +1.1% Dow 52,743.39 ▲ +1.2% Nasdaq 25,970.01 ▲ +0.9% WTI crude 70.66 ▲ +0.9% EUR/USD 1.1426 ▲ +0.3% GBP/USD 1.3367 ▲ +1.0% USD/JPY 161.98 ▼ -0.1% ================================================================ Generated 2026-07-10 06:06 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================