================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Saturday, July 11, 2026 - 6:06 AM EDT ================================================================ Progress Software told ShareFile customers to power down their servers over a credible threat, leading a day thick with actively exploited web flaws and ransomware guilty pleas. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Attackers hid prompt injections inside PNG images with a technique called Ghostcommit that slips past AI code reviewers and walks coding agents into leaking repository secrets. see: Prompt Injection Against AI Agents * [TREND] Emergency fixes multiplied as Progress told ShareFile users to power down Storage Zone Controllers while CISA flagged exploited Joomla file-upload bugs and Binarly disclosed six U-Boot bootloader flaws. see: Progress ShareFile Emergency Shutdown; Actively Exploited Web-Facing Flaws; Six U-Boot Bootloader Flaws * [TREND] U.S. courts squeezed the people behind ransomware, with an Armenian man pleading guilty over Ryuk deployments and a former BlackCat negotiator drawing prison time. see: Ransomware Operators Face Prison * [TREND] SentinelOne found separate China-linked and India-linked campaigns spying on Pakistan's Balochistan Police across the insurgency-hit southwestern province between 2024 and 2026. see: China and India Spy on Balochistan Police * [UPDATE (updated)] A state housing measure became law after Trump's signing window lapsed, even as Allegheny County crews mapped response routes around the 25-day Parkway East closure. see: Housing Bill Becomes Law; Parkway East Closure Underway * [UPDATE (new)] On the MLB Draft's eve the Pirates traded for Jacob Gonzalez and Brandon Eisert, having already blown past their entire 2025 home run total. see: Pirates Trade for Gonzalez, Eisert; Pirates Pass Last Year's Home Run Total SECURITY ---------------------------------------------------------------- 1. ACTIVELY EXPLOITED WEB-FACING FLAWS Vulnerabilities and Exploits · [exploited, patch] Latest developments: CISA added two actively exploited file-upload flaws—CVE-2026-48939 in the iCagenda Joomla extension and CVE-2026-56291 in Balbooa Forms—to its Known Exploited Vulnerabilities catalog July 10, the same day attackers began exploiting a critical Gitea Docker-image authentication bypass that lets them impersonate any user including administrators, as Zimbra urged customers to patch a critical Classic Web Client stored cross-site-scripting flaw that crafted emails abuse to run code in a user's session. The flaws hit self-hosted Git services, Joomla sites, and the Zimbra collaboration suite, all internet-facing. Administrators should patch immediately and check for signs of compromise. - CISA Advisories: https://www.cisa.gov/news-events/alerts/2026/07/10/cisa-adds-two-known-exploited-vulnerabilities-catalog - BleepingComputer: https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-auth-bypass-in-gitea-docker-image/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/zimbra-urges-customers-to-patch-critical-web-client-xss-flaw/ - The Hacker News: https://thehackernews.com/2026/07/critical-zimbra-flaw-could-let-crafted_0483473395.html 2. PROMPT INJECTION AGAINST AI AGENTS AI Security · [ai, prompt-injection] Latest developments: BleepingComputer detailed July 11 "Ghostcommit," a technique that hides prompt injections inside PNG images and slips past AI code reviewers CodeRabbit and Bugbot—which never open image files—then tricks a coding agent into reading a repository's .env file and writing every secret into code as a list of numbers, as researchers disclosed three patched flaws in the OpenClaw personal AI assistant enabling credential theft, privilege escalation, and code execution on the host. Prompt-injection attacks turn autonomous AI coding tools and assistants against their owners to steal credentials and repository secrets. Organizations should restrict agent access to files, secrets, and hosts. - BleepingComputer: https://www.bleepingcomputer.com/news/security/ghostcommit-hides-prompt-injection-in-images-to-fool-ai-agents-steal-secrets/ - The Hacker News: https://thehackernews.com/2026/07/researcher-details-whatsapp-to-host.html 3. RANSOMWARE OPERATORS FACE PRISON Ransomware and Cybercrime · [ransomware, law-enforcement] Latest developments: In U.S. courts July 10 a 34-year-old Armenian man pleaded guilty in Oregon federal court to conspiracy and computer fraud for deploying Ryuk ransomware against American companies, facing up to 15 years, while a Florida court sentenced former ransomware negotiator Angelo Martino to 70 months for helping the BlackCat/AlphV gang extort victims, and Canada separately disrupted ransomware operations. Ryuk and BlackCat/AlphV rank among the most prolific ransomware operations of recent years. The prosecutions extend sustained law-enforcement pressure aimed at operators and their enablers rather than only their servers. - BleepingComputer: https://www.bleepingcomputer.com/news/security/ryuk-ransomware-member-pleads-guilty-in-the-us-faces-15-years-in-prison/ - The Record: https://therecord.media/ryuk-operator-pleads-guilty-alphv-conspirator-sentenced - SecurityWeek: https://www.securityweek.com/third-us-security-expert-sentenced-to-prison-for-helping-ransomware-gang/ - SecurityWeek: https://www.securityweek.com/in-other-news-dhs-database-hacked-adobe-boosts-patch-cadence-canada-disrupts-ransomware-ops/ 4. PROGRESS SHAREFILE EMERGENCY SHUTDOWN Vulnerabilities and Exploits · [vulnerability, file-transfer] Latest developments: Progress Software emailed ShareFile customers July 10, telling those who run Storage Zone Controllers on Windows servers to shut them down immediately over a confirmed "credible external security threat," and temporarily disabled access to affected accounts out of caution while it investigates. ShareFile is Progress's enterprise secure file-sharing product, and Storage Zone Controllers manage its on-premises data storage. Administrators running the affected on-premises servers should power them down and await Progress guidance. - The Hacker News: https://thehackernews.com/2026/07/urgent-progress-tells-sharefile.html - BleepingComputer: https://www.bleepingcomputer.com/news/security/progress-urges-sharefile-customers-to-shut-down-servers-over-credible-threat/ 5. SIX U-BOOT BOOTLOADER FLAWS Vulnerabilities and Exploits · [firmware, vulnerability] Latest developments: Firmware security firm Binarly disclosed six new flaws in U-Boot, the small program that starts hardware from home routers and smart cameras to the management chips inside data-center servers; four crash a device, and two let an attacker who slips a malicious image in front of the bootloader run code at boot, opening the door to stealthy, persistent firmware implants. U-Boot is a widely used open-source bootloader across embedded and IoT devices. Device makers and owners should apply firmware updates as vendors ship them. - BleepingComputer: https://www.bleepingcomputer.com/news/security/new-u-boot-flaws-could-enable-stealthy-firmware-attacks/ - The Hacker News: https://thehackernews.com/2026/07/six-new-u-boot-flaws-could-let.html 6. CHINA AND INDIA SPY ON BALOCHISTAN POLICE Nation-State Activity · [apt, nation-state, espionage] Latest developments: SentinelOne reported that separate China-linked and India-linked espionage campaigns targeted Pakistan's Balochistan Police—the force covering the insurgency-hit southwestern province—between February 2024 and April 2026, in some cases breaching the exact same systems. The Balochistan Police oversees a region gripped by a long-running separatist insurgency, drawing intelligence interest from both a rival and a nominal ally. The dual campaigns show a single target absorbing competing state espionage operations. - The Record: https://therecord.media/china-india-ran-separate-spy-campaigns-against-same-police-force - SecurityWeek: https://www.securityweek.com/china-india-linked-hackers-both-targeted-same-pakistani-police-force/ BUSINESS AND POLITICS ---------------------------------------------------------------- * Housing Bill Becomes Law Latest developments: The measure automatically became law Saturday, July 11, when President Trump's 10-day signing window lapsed without his signature. The landmark federal housing bill Congress passed to ease voters' affordability worries took effect as law after President Trump refused to sign it and let the constitutional window expire. - WSJ Politics: https://www.wsj.com/politics/policy/trump-says-he-wont-sign-landmark-housing-bill-5b27976c PITTSBURGH ---------------------------------------------------------------- Weather: Today: Areas Of Fog then Isolated Showers And Thunderstorms, high 83F. Tonight: Scattered Showers And Thunderstorms then Mostly Cloudy, low 65F. Sunday: Mostly Sunny, high 86F. Business: * USPS Hiring Fair in Warrendale Latest developments: The United States Postal Service holds a walk-in career fair Saturday, July 11, from 10 a.m. to 2 p.m. at the Pittsburgh Network Distribution Center in Warrendale. The Postal Service is recruiting to fill jobs at its Pittsburgh Network Distribution Center in Warrendale, opening the site to job-seekers for a one-day career fair. - WPXI: https://www.wpxi.com/news/local/usps-host-career-fair-pittsburgh-area/YMTCK53RJRE6FC2N5O3JOXXCTA/ * Point Park Joins NCAA Division II Latest developments: The NCAA approved Point Park University for full Division II membership, effective September 1, 2026. Point Park University, the downtown Pittsburgh school, completed its jump to full NCAA Division II membership, a move that reshapes its athletic budget and scheduling starting September 1. - WPXI: https://www.wpxi.com/news/local/point-park-university-approved-full-ncaa-division-ii-membership/W6NKFOTNEVHUPBXC3XN6HKNKXQ/ Around town: * Parkway East Closure Underway Latest developments: With the 25-day Parkway East closure now in effect, Allegheny County emergency crews are preparing to run response routes—including restricted roads closed to other drivers—to reach calls around the detours. PennDOT's $95 million Commercial Street Bridge replacement has shut the Parkway East (I-376) between the Squirrel Hill Tunnel and the Edgewood/Swissvale exit through August 3, pushing 100,000 daily drivers onto detours. - WTAE: https://www.wtae.com/article/376-bridge-closure-allegheny-county-emergency-services/71900482 * Homewood Pool Reopens Latest developments: Pittsburgh opened the Homewood Pool to the public on Friday, July 10, with more Homewood park upgrades in the works. The city reopened the Homewood Pool on a rainy Friday, drawing residents like Kamari Jones, part of a broader effort to upgrade the neighborhood's parks. - TribLive: https://triblive.com/local/pittsburghs-homewood-pool-opens-to-the-public-more-park-upgrades-in-the-works/ * City Pools Require Adults for Under-15s Latest developments: Pittsburgh reintroduced a policy requiring children under 15 to bring an accompanying adult to city pools. Pittsburgh brought back a rule barring children under 15 from its public pools without an adult, echoing chaperone policies Kennywood and Sandcastle adopted earlier this summer. - WPXI: https://www.wpxi.com/news/local/pittsburgh-reintroduces-policy-children-under-15-years-age/4UEGCNLCE5HVJEPNYLCHA6QP7M/ Events: * Big Boy Locomotive Stops in Leetsdale Latest developments: Union Pacific's Big Boy No. 4014, the world's largest operating steam locomotive, rolls through western Pennsylvania on Saturday, July 11, ending its regional run with a stop in Leetsdale. The historic Big Boy No. 4014, touring the country for America's 250th birthday after celebrating July 4 in Philadelphia, passes back through the Pittsburgh area Saturday before heading west, with a final area stop in Leetsdale. - KDKA: https://www.cbsnews.com/pittsburgh/news/big-boy-leetsdale-western-pennsylvania-how-to-see/ SPORTS ---------------------------------------------------------------- Pirates (47-47) Fri Jul 10 · Brewers @ Pirates · Postponed https://plaintextsports.com/mlb/2026-07-10/mil-pit Up Next · Brewers @ Pirates · Sat Jul 11, 12:05 PM https://plaintextsports.com/mlb/2026-07-11/mil-pit Around the Teams: * Pirates Trade for Gonzalez, Eisert Latest developments: On the eve of the MLB Draft, the Pirates acquired infielder Jacob Gonzalez and left-handed reliever Brandon Eisert from the Chicago White Sox, sending back lefty Jaden Woods and a 2026 draft selection. The Pirates turned a draft pick and pitcher Jaden Woods into two big-league-ready players, adding infielder Jacob Gonzalez and reliever Brandon Eisert from the White Sox in a swap the Post-Gazette detailed the night before the draft. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/07/10/pirates-trade-white-sox-eisert-gonzalez-griffin-chicago-mlb-draft-woods/stories/202607100076 * Porter Eyes Rich Cornerback Deal Latest developments: The Post-Gazette reported cornerback Joey Porter Jr. is looking to cash in on a booming market, framing the question of how much the Steelers will pay to keep him. With cornerback contracts across the NFL soaring, Steelers corner Joey Porter Jr. is positioning for a lucrative extension the team must now decide whether to fund. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/07/10/porter-contract-extension-cornerback-nfl-offseason-witherspoon-gonzalez/stories/202607100048 * Pirates Pass Last Year's Home Run Total Latest developments: The Post-Gazette's Off The Bat charted how the Pirates have already blown past their entire 2025 home run total, crediting bats like Bryan Reynolds, Brandon Lowe, and Ryan O'Hearn. Pittsburgh's lineup, led by Bryan Reynolds, Brandon Lowe, and Ryan O'Hearn, has out-homered all of last season, a power surge the beat broke down in its Off The Bat feature. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/07/11/pirates-mlb-home-run-reynolds-lowe-o-hearn/stories/202607100074 Team USA: * USMNT Weighs Pochettino's Future Latest developments: With the World Cup over, U.S. Soccer has offered coach Mauricio Pochettino a contract extension and both sides are taking time to decide, while sporting director Matt Crocker abruptly left for a similar job elsewhere. As the United States enters the 2030 World Cup cycle after its round-of-16 exit, Mauricio Pochettino's contract is up, U.S. Soccer has tabled an extension offer, and the program lost sporting director Matt Crocker. - Guardian World Cup 2026: https://www.theguardian.com/football/2026/jul/10/usmnt-world-cup-qualifying-gold-cup-copa-america * Pulisic's Disappointing World Cup Latest developments: ESPN examined how Christian Pulisic, expected to be the USMNT's biggest star at a home World Cup, instead became its biggest mystery. Christian Pulisic, in his prime and playing a World Cup on home soil, underdelivered as the United States lost in the round of 16 to Belgium, though ESPN weighs how much blame he truly deserves. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49317008/instead-being-usmnt-biggest-world-cup-star-pulisic-was-biggest-mystery READING ---------------------------------------------------------------- * Ed Zitron -- Premium: The Hater's Guide To The Memory Crisis Zitron picks apart the surge in memory-chip prices, arguing the so-called memory crisis is more hype than genuine emergency. https://www.wheresyoured.at/premium-the-haters-guide-to-the-memory-crisis/ * Stratechery -- Muse Image, Grok 4.5, Alex Karp on CNBC Thompson argues the fight over verifiable data—spanning Meta's Muse Image, xAI's Grok 4.5, and the frontier labs—is increasingly the axis on which the AI race turns. https://stratechery.com/2026/muse-image-grok-4-5-alex-karp-on-cnbc/ * Cal Newport -- Beware of Productivity Paradoxes Newport warns that tools like the personal computer, seemingly sure productivity wins, often fail to deliver the gains they promise—a caution worth heeding as AI arrives. https://calnewport.com/beware-of-productivity-paradoxes/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,528.60 ▲ +1.0% Dow 52,690.77 ▲ +0.7% Nasdaq 26,059.80 ▲ +0.8% WTI crude 71.20 ▲ +2.7% EUR/USD 1.1424 ▲ +0.1% GBP/USD 1.3391 ▲ +0.7% USD/JPY 162.21 ▲ +0.1% ================================================================ Generated 2026-07-11 06:06 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================