daily plain-text briefing: security, markets, business, and pittsburgh
Progress Software told ShareFile customers to power down their servers over a credible threat, leading a day thick with actively exploited web flaws and ransomware guilty pleas.
Latest developments: CISA added two actively exploited file-upload flaws—CVE-2026-48939 in the iCagenda Joomla extension and CVE-2026-56291 in Balbooa Forms—to its Known Exploited Vulnerabilities catalog July 10, the same day attackers began exploiting a critical Gitea Docker-image authentication bypass that lets them impersonate any user including administrators, as Zimbra urged customers to patch a critical Classic Web Client stored cross-site-scripting flaw that crafted emails abuse to run code in a user's session.
The flaws hit self-hosted Git services, Joomla sites, and the Zimbra collaboration suite, all internet-facing. Administrators should patch immediately and check for signs of compromise.
Sources: CISA Advisories · BleepingComputer · BleepingComputer · The Hacker News · ↑ top
Latest developments: BleepingComputer detailed July 11 "Ghostcommit," a technique that hides prompt injections inside PNG images and slips past AI code reviewers CodeRabbit and Bugbot—which never open image files—then tricks a coding agent into reading a repository's .env file and writing every secret into code as a list of numbers, as researchers disclosed three patched flaws in the OpenClaw personal AI assistant enabling credential theft, privilege escalation, and code execution on the host.
Prompt-injection attacks turn autonomous AI coding tools and assistants against their owners to steal credentials and repository secrets. Organizations should restrict agent access to files, secrets, and hosts.
Sources: BleepingComputer · The Hacker News · ↑ top
Latest developments: In U.S. courts July 10 a 34-year-old Armenian man pleaded guilty in Oregon federal court to conspiracy and computer fraud for deploying Ryuk ransomware against American companies, facing up to 15 years, while a Florida court sentenced former ransomware negotiator Angelo Martino to 70 months for helping the BlackCat/AlphV gang extort victims, and Canada separately disrupted ransomware operations.
Ryuk and BlackCat/AlphV rank among the most prolific ransomware operations of recent years. The prosecutions extend sustained law-enforcement pressure aimed at operators and their enablers rather than only their servers.
Sources: BleepingComputer · The Record · SecurityWeek · SecurityWeek · ↑ top
Latest developments: Progress Software emailed ShareFile customers July 10, telling those who run Storage Zone Controllers on Windows servers to shut them down immediately over a confirmed "credible external security threat," and temporarily disabled access to affected accounts out of caution while it investigates.
ShareFile is Progress's enterprise secure file-sharing product, and Storage Zone Controllers manage its on-premises data storage. Administrators running the affected on-premises servers should power them down and await Progress guidance.
Sources: The Hacker News · BleepingComputer · ↑ top
Latest developments: Firmware security firm Binarly disclosed six new flaws in U-Boot, the small program that starts hardware from home routers and smart cameras to the management chips inside data-center servers; four crash a device, and two let an attacker who slips a malicious image in front of the bootloader run code at boot, opening the door to stealthy, persistent firmware implants.
U-Boot is a widely used open-source bootloader across embedded and IoT devices. Device makers and owners should apply firmware updates as vendors ship them.
Sources: BleepingComputer · The Hacker News · ↑ top
Latest developments: SentinelOne reported that separate China-linked and India-linked espionage campaigns targeted Pakistan's Balochistan Police—the force covering the insurgency-hit southwestern province—between February 2024 and April 2026, in some cases breaching the exact same systems.
The Balochistan Police oversees a region gripped by a long-running separatist insurgency, drawing intelligence interest from both a rival and a nominal ally. The dual campaigns show a single target absorbing competing state espionage operations.
Sources: The Record · SecurityWeek · ↑ top
Latest developments: The measure automatically became law Saturday, July 11, when President Trump's 10-day signing window lapsed without his signature.
The landmark federal housing bill Congress passed to ease voters' affordability worries took effect as law after President Trump refused to sign it and let the constitutional window expire.
Sources: WSJ Politics · ↑ top
Today: Areas Of Fog then Isolated Showers And Thunderstorms, high 83F.
Tonight: Scattered Showers And Thunderstorms then Mostly Cloudy, low 65F.
Sunday: Mostly Sunny, high 86F.
Latest developments: The United States Postal Service holds a walk-in career fair Saturday, July 11, from 10 a.m. to 2 p.m. at the Pittsburgh Network Distribution Center in Warrendale.
The Postal Service is recruiting to fill jobs at its Pittsburgh Network Distribution Center in Warrendale, opening the site to job-seekers for a one-day career fair.
Latest developments: The NCAA approved Point Park University for full Division II membership, effective September 1, 2026.
Point Park University, the downtown Pittsburgh school, completed its jump to full NCAA Division II membership, a move that reshapes its athletic budget and scheduling starting September 1.
Latest developments: With the 25-day Parkway East closure now in effect, Allegheny County emergency crews are preparing to run response routes—including restricted roads closed to other drivers—to reach calls around the detours.
PennDOT's $95 million Commercial Street Bridge replacement has shut the Parkway East (I-376) between the Squirrel Hill Tunnel and the Edgewood/Swissvale exit through August 3, pushing 100,000 daily drivers onto detours.
Latest developments: Pittsburgh opened the Homewood Pool to the public on Friday, July 10, with more Homewood park upgrades in the works.
The city reopened the Homewood Pool on a rainy Friday, drawing residents like Kamari Jones, part of a broader effort to upgrade the neighborhood's parks.
Latest developments: Pittsburgh reintroduced a policy requiring children under 15 to bring an accompanying adult to city pools.
Pittsburgh brought back a rule barring children under 15 from its public pools without an adult, echoing chaperone policies Kennywood and Sandcastle adopted earlier this summer.
Latest developments: Union Pacific's Big Boy No. 4014, the world's largest operating steam locomotive, rolls through western Pennsylvania on Saturday, July 11, ending its regional run with a stop in Leetsdale.
The historic Big Boy No. 4014, touring the country for America's 250th birthday after celebrating July 4 in Philadelphia, passes back through the Pittsburgh area Saturday before heading west, with a final area stop in Leetsdale.
Pirates (47-47)
Fri Jul 10 · Brewers @ Pirates · Postponed
Up Next · Brewers @ Pirates · Sat Jul 11, 12:05 PM
Latest developments: On the eve of the MLB Draft, the Pirates acquired infielder Jacob Gonzalez and left-handed reliever Brandon Eisert from the Chicago White Sox, sending back lefty Jaden Woods and a 2026 draft selection.
The Pirates turned a draft pick and pitcher Jaden Woods into two big-league-ready players, adding infielder Jacob Gonzalez and reliever Brandon Eisert from the White Sox in a swap the Post-Gazette detailed the night before the draft.
Sources: Post-Gazette Pirates · ↑ top
Latest developments: The Post-Gazette reported cornerback Joey Porter Jr. is looking to cash in on a booming market, framing the question of how much the Steelers will pay to keep him.
With cornerback contracts across the NFL soaring, Steelers corner Joey Porter Jr. is positioning for a lucrative extension the team must now decide whether to fund.
Sources: Post-Gazette Steelers · ↑ top
Latest developments: The Post-Gazette's Off The Bat charted how the Pirates have already blown past their entire 2025 home run total, crediting bats like Bryan Reynolds, Brandon Lowe, and Ryan O'Hearn.
Pittsburgh's lineup, led by Bryan Reynolds, Brandon Lowe, and Ryan O'Hearn, has out-homered all of last season, a power surge the beat broke down in its Off The Bat feature.
Sources: Post-Gazette Pirates · ↑ top
Latest developments: With the World Cup over, U.S. Soccer has offered coach Mauricio Pochettino a contract extension and both sides are taking time to decide, while sporting director Matt Crocker abruptly left for a similar job elsewhere.
As the United States enters the 2030 World Cup cycle after its round-of-16 exit, Mauricio Pochettino's contract is up, U.S. Soccer has tabled an extension offer, and the program lost sporting director Matt Crocker.
Sources: Guardian World Cup 2026 · ↑ top
Latest developments: ESPN examined how Christian Pulisic, expected to be the USMNT's biggest star at a home World Cup, instead became its biggest mystery.
Christian Pulisic, in his prime and playing a World Cup on home soil, underdelivered as the United States lost in the round of 16 to Belgium, though ESPN weighs how much blame he truly deserves.
Sources: ESPN Soccer · ↑ top
S&P 500 7,528.60 ▲ +1.0% Dow 52,690.77 ▲ +0.7% Nasdaq 26,059.80 ▲ +0.8% WTI crude 71.20 ▲ +2.7% EUR/USD 1.1424 ▲ +0.1% GBP/USD 1.3391 ▲ +0.7% USD/JPY 162.21 ▲ +0.1%