infosecfollow

daily plain-text briefing: security, markets, business, and pittsburgh

Okta uncovers a voice-phishing crew enrolling rogue Microsoft Entra passkeys to hijack Microsoft 365 accounts, as an unpatched flaw in Alibaba's XQUIC and a mass WordPress backdoor widen the day's attack surface.


Emerging Trends and Key Updates

Security

1. New Flaws Hit XQUIC, Zimbra, and Palo Alto

Vulnerabilities and Exploits · [vulnerability, patch, zero-day]

Latest developments: FoxIO researcher Sébastien Féry disclosed XRING on July 8, an unpatched flaw in Alibaba's XQUIC library that lets any remote client crash an HTTP/3 server with roughly 260 bytes of legal QPACK traffic, while Zimbra urged customers to patch a critical Classic Web Client cross-site-scripting bug, Palo Alto Networks fixed 13 PAN-OS flaws, and Cisco Talos disclosed vulnerabilities in WolfSSL, GeoVision, and VTK-DICOM.

read more

XRING needs no login and no malformed packets, and no patch exists yet. Apply the Zimbra, Palo Alto, and Talos-tracked vendor fixes and monitor XQUIC-backed HTTP/3 servers for denial-of-service probes.

Sources: The Hacker News · BleepingComputer · SecurityWeek · Cisco Talos · ↑ top

2. Okta Traces Vishing Crew Enrolling Rogue Entra Passkeys

Ransomware and Cybercrime · [phishing, extortion, breach]

Latest developments: Okta warned July 10 of a threat actor it tracks as O-UNC-066 that phones Microsoft 365 users with fake security requests, steers them to phishing sites mirroring Microsoft Entra ID login pages, and enrolls attacker-controlled Entra passkeys to seize accounts for data extortion.

read more

The crew runs a panel-controlled phishing kit built to hijack the passkey enrollment process across multiple sectors. Train staff to reject unsolicited voice requests to enroll new authenticators and lock down Entra passkey registration.

Sources: SecurityWeek · The Hacker News · ↑ top

3. WP-SHELLSTORM Backdoors WordPress at Scale

Ransomware and Cybercrime · [malware, backdoor, web]

Latest developments: The Hacker News reported July 10 that a cybercrime crew left its own server exposed on the internet for three weeks, revealing WP-SHELLSTORM, a mass site-hacking operation whose target list names more than 1.4 million WordPress websites alongside its hacking tools and activity logs.

read more

The exposed files showed researchers how a mass WordPress compromise runs from the inside, though far fewer than the 1.4 million listed sites were actually broken into. Patch WordPress core and plugins and audit sites for injected backdoors.

Sources: The Hacker News · ↑ top

4. Ill Bloom Flaw Drains Crypto Wallets

Ransomware and Cybercrime · [cryptocurrency, vulnerability]

Latest developments: Security firm Coinspect disclosed Ill Bloom on July 10, a flaw in how some wallet software generated its recovery phrase with weak randomness that lets an attacker reconstruct the seed words and take everything they control, and confirmed one coordinated sweep in May that drained $3.1 million.

read more

The recovery phrase is the set of words that control the money, so weak generation hands attackers full control of the wallet. Holders on affected software should migrate funds to wallets whose seed generation uses strong randomness.

Sources: The Hacker News · ↑ top

5. China and India Both Hack Balochistan Police

Nation-State Activity · [apt, nation-state]

Latest developments: SentinelOne revealed July 10 that both China-linked and India-linked hackers have separately targeted Pakistan's Balochistan Police force for at least two years, putting rival and allied intelligence services on the same victim.

read more

The overlapping intrusions show a single regional law-enforcement body drawing sustained attention from multiple state-aligned groups. Organizations in contested regions should assume interest from several actors at once and harden internet-facing systems accordingly.

Sources: SecurityWeek · ↑ top

6. EU Revives Chat Control as NIS2 Lags

Policy and Regulation · [policy, privacy, regulation]

Latest developments: Wired reported July 9 that the EU's Chat Control bill will again let companies scan citizens' private texts, emails, and social media messages for child-abuse material even though a majority of European lawmakers voted against it, the same day The Record reported the European Commission took Ireland, Spain, France, and the Netherlands to court for missing the NIS2 critical-infrastructure transposition deadline by more than 20 months.

read more

Chat Control reopens bulk scanning of private communications across the bloc, while four member states remain out of compliance with NIS2, the EU's baseline law for securing critical infrastructure. Compliance teams in the named countries face pending enforcement and should track final NIS2 transposition.

Sources: Wired Security · The Record · ↑ top

Pittsburgh

Weather

Today: Chance Showers And Thunderstorms, high 82F.

Tonight: Chance Showers And Thunderstorms then Areas Of Fog, low 67F.

Saturday: Areas Of Fog then Scattered Showers And Thunderstorms, high 84F.

Business

Bloomfield's Liberty Avenue in Transition

Latest developments: PublicSource published a feature today tracing how Bloomfield's main commercial strip is changing.

read more

PublicSource examined how shifting demographics, stalled development, and a wave of new storefronts are reshaping Liberty Avenue, the historically Italian commercial spine of Pittsburgh's Bloomfield neighborhood.

Sources: PublicSource · ↑ top

Harrison Property Appeals Cost Highlands Schools

Latest developments: TribLive reported the two successful appeals will cut revenue for both bodies this year.

read more

Harrison Township and the Highlands School District face a revenue hit after the owners of two large Harrison properties won Allegheny County tax-assessment appeals cutting roughly $1.2 million in taxable value.

Sources: TribLive · ↑ top

Around Town

Parkway East Closes Tonight for 25 Days

Latest developments: The closure begins tonight at 9 p.m., and WTAE launched a tool that maps detours and estimates travel times.

read more

PennDOT closes the Parkway East, Interstate 376, between the Squirrel Hill Tunnel and the Edgewood/Swissvale exit for 25 days starting at 9 p.m. Friday, July 10, to demolish the old Commercial Street Bridge and slide a replacement into place, rerouting a corridor that carries roughly 100,000 vehicles a day.

Sources: WTAE · ↑ top

Flood Watch Grips the Region Again

Latest developments: Forecasters placed the Pittsburgh area under a flood watch for today, with rain returning this afternoon.

read more

The National Weather Service put the Pittsburgh region under a flood watch for Friday, July 10, warning of rainfall rates up to two inches an hour, days after storms swamped parts of Allegheny and Westmoreland counties over the July 4 weekend.

Sources: Pittsburgh Post-Gazette · ↑ top

New Kensington Stuck on Abandoned Hospital

Latest developments: TribLive reported the city has few legal levers to force the owners to act.

read more

New Kensington officials say they have limited options in a standoff with the owners of a long-abandoned hospital, a predicament the Westmoreland County city shares with Hornell, New York.

Sources: TribLive · ↑ top

Sports

Pirates (47-47)

Thu Jul 9 · Braves 10 · Pirates 5 · Final

Mike Yastrzemski hits grand slam in Braves' 10-5 win over Pirates

Up Next · Brewers @ Pirates · Fri Jul 10, 6:40 PM

Reading

Markets

weekly average, change vs prior week

S&P 500     7,510.17  ▲ +1.1%
Dow        52,743.39  ▲ +1.2%
Nasdaq     25,970.01  ▲ +0.9%
WTI crude      70.66  ▲ +0.9%
EUR/USD       1.1426  ▲ +0.3%
GBP/USD       1.3367  ▲ +1.0%
USD/JPY       161.98  ▼ -0.1%