daily plain-text briefing: security, markets, business, and pittsburgh
Okta uncovers a voice-phishing crew enrolling rogue Microsoft Entra passkeys to hijack Microsoft 365 accounts, as an unpatched flaw in Alibaba's XQUIC and a mass WordPress backdoor widen the day's attack surface.
Latest developments: FoxIO researcher Sébastien Féry disclosed XRING on July 8, an unpatched flaw in Alibaba's XQUIC library that lets any remote client crash an HTTP/3 server with roughly 260 bytes of legal QPACK traffic, while Zimbra urged customers to patch a critical Classic Web Client cross-site-scripting bug, Palo Alto Networks fixed 13 PAN-OS flaws, and Cisco Talos disclosed vulnerabilities in WolfSSL, GeoVision, and VTK-DICOM.
XRING needs no login and no malformed packets, and no patch exists yet. Apply the Zimbra, Palo Alto, and Talos-tracked vendor fixes and monitor XQUIC-backed HTTP/3 servers for denial-of-service probes.
Sources: The Hacker News · BleepingComputer · SecurityWeek · Cisco Talos · ↑ top
Latest developments: Okta warned July 10 of a threat actor it tracks as O-UNC-066 that phones Microsoft 365 users with fake security requests, steers them to phishing sites mirroring Microsoft Entra ID login pages, and enrolls attacker-controlled Entra passkeys to seize accounts for data extortion.
The crew runs a panel-controlled phishing kit built to hijack the passkey enrollment process across multiple sectors. Train staff to reject unsolicited voice requests to enroll new authenticators and lock down Entra passkey registration.
Sources: SecurityWeek · The Hacker News · ↑ top
Latest developments: The Hacker News reported July 10 that a cybercrime crew left its own server exposed on the internet for three weeks, revealing WP-SHELLSTORM, a mass site-hacking operation whose target list names more than 1.4 million WordPress websites alongside its hacking tools and activity logs.
The exposed files showed researchers how a mass WordPress compromise runs from the inside, though far fewer than the 1.4 million listed sites were actually broken into. Patch WordPress core and plugins and audit sites for injected backdoors.
Sources: The Hacker News · ↑ top
Latest developments: Security firm Coinspect disclosed Ill Bloom on July 10, a flaw in how some wallet software generated its recovery phrase with weak randomness that lets an attacker reconstruct the seed words and take everything they control, and confirmed one coordinated sweep in May that drained $3.1 million.
The recovery phrase is the set of words that control the money, so weak generation hands attackers full control of the wallet. Holders on affected software should migrate funds to wallets whose seed generation uses strong randomness.
Sources: The Hacker News · ↑ top
Latest developments: SentinelOne revealed July 10 that both China-linked and India-linked hackers have separately targeted Pakistan's Balochistan Police force for at least two years, putting rival and allied intelligence services on the same victim.
The overlapping intrusions show a single regional law-enforcement body drawing sustained attention from multiple state-aligned groups. Organizations in contested regions should assume interest from several actors at once and harden internet-facing systems accordingly.
Sources: SecurityWeek · ↑ top
Latest developments: Wired reported July 9 that the EU's Chat Control bill will again let companies scan citizens' private texts, emails, and social media messages for child-abuse material even though a majority of European lawmakers voted against it, the same day The Record reported the European Commission took Ireland, Spain, France, and the Netherlands to court for missing the NIS2 critical-infrastructure transposition deadline by more than 20 months.
Chat Control reopens bulk scanning of private communications across the bloc, while four member states remain out of compliance with NIS2, the EU's baseline law for securing critical infrastructure. Compliance teams in the named countries face pending enforcement and should track final NIS2 transposition.
Sources: Wired Security · The Record · ↑ top
Today: Chance Showers And Thunderstorms, high 82F.
Tonight: Chance Showers And Thunderstorms then Areas Of Fog, low 67F.
Saturday: Areas Of Fog then Scattered Showers And Thunderstorms, high 84F.
Latest developments: PublicSource published a feature today tracing how Bloomfield's main commercial strip is changing.
PublicSource examined how shifting demographics, stalled development, and a wave of new storefronts are reshaping Liberty Avenue, the historically Italian commercial spine of Pittsburgh's Bloomfield neighborhood.
Sources: PublicSource · ↑ top
Latest developments: TribLive reported the two successful appeals will cut revenue for both bodies this year.
Harrison Township and the Highlands School District face a revenue hit after the owners of two large Harrison properties won Allegheny County tax-assessment appeals cutting roughly $1.2 million in taxable value.
Latest developments: The closure begins tonight at 9 p.m., and WTAE launched a tool that maps detours and estimates travel times.
PennDOT closes the Parkway East, Interstate 376, between the Squirrel Hill Tunnel and the Edgewood/Swissvale exit for 25 days starting at 9 p.m. Friday, July 10, to demolish the old Commercial Street Bridge and slide a replacement into place, rerouting a corridor that carries roughly 100,000 vehicles a day.
Latest developments: Forecasters placed the Pittsburgh area under a flood watch for today, with rain returning this afternoon.
The National Weather Service put the Pittsburgh region under a flood watch for Friday, July 10, warning of rainfall rates up to two inches an hour, days after storms swamped parts of Allegheny and Westmoreland counties over the July 4 weekend.
Sources: Pittsburgh Post-Gazette · ↑ top
Latest developments: TribLive reported the city has few legal levers to force the owners to act.
New Kensington officials say they have limited options in a standoff with the owners of a long-abandoned hospital, a predicament the Westmoreland County city shares with Hornell, New York.
Pirates (47-47)
Thu Jul 9 · Braves 10 · Pirates 5 · Final
Mike Yastrzemski hits grand slam in Braves' 10-5 win over Pirates
Up Next · Brewers @ Pirates · Fri Jul 10, 6:40 PM
S&P 500 7,510.17 ▲ +1.1% Dow 52,743.39 ▲ +1.2% Nasdaq 25,970.01 ▲ +0.9% WTI crude 70.66 ▲ +0.9% EUR/USD 1.1426 ▲ +0.3% GBP/USD 1.3367 ▲ +1.0% USD/JPY 161.98 ▼ -0.1%