================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Saturday, July 11, 2026 - 12:09 PM EDT ================================================================ Progress Software ordered ShareFile customers to power down their servers against a credible active threat, while researchers showed a single PNG image can hijack AI coding agents and drain a repository's secrets. CONTENTS: Emerging Trends and Key Updates | Security | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Researchers unveiled Ghostcommit, which hides a prompt injection inside a PNG to slip past AI code reviewers CodeRabbit and Bugbot and drain a repository's secrets. see: Ghostcommit Poisons AI Code Reviewers * [TREND] Web-facing enterprise software drew fire everywhere, from Progress ordering ShareFile servers powered down to a critical Zimbra web-client flaw and an Australian alert on a global CMS campaign. see: Progress Orders ShareFile Servers Shut Down; Critical Zimbra Web Client Flaw; Australia Warns of Global CMS Campaign * [TREND] Prosecutors closed in on ransomware crews as an Armenian man pleaded guilty in Oregon over Ryuk while a Blackcat/AlphV conspirator was sentenced in Florida. see: Ryuk and AlphV Members Face Justice * [UPDATE (new)] Researchers disclosed six U-Boot bootloader flaws that let attackers run code during device boot, opening the door to stealthy firmware attacks and persistent malware. see: New U-Boot Bootloader Flaws * [UPDATE (new)] The Pirates closed a trade for a White Sox bat and arm and blew past their season home run total amid a power surge. see: Pirates Deal for White Sox Bat and Arm; Pirates Blow Past Their Home Run Total * [TREND] Commentators cast a skeptical eye on tech hype, from Zitron dissecting the memory crisis to Thompson on Grok 4.5 and Newport's productivity paradox. see: Premium: The Hater's Guide To The Memory Crisis; Muse Image, Grok 4.5, Alex Karp on CNBC; Beware of Productivity Paradoxes SECURITY ---------------------------------------------------------------- 1. CRITICAL ZIMBRA WEB CLIENT FLAW Vulnerabilities and Exploits · [vulnerability, xss, rce] Latest developments: Zimbra urged customers July 11, 2026 to patch a critical stored cross-site-scripting flaw in the Classic Web Client, still without a CVE, that lets a specially crafted email run malicious scripts and achieve arbitrary code execution inside a victim's session. Zimbra runs email for governments and enterprises worldwide and draws frequent attacks; administrators should apply the update at once. - The Hacker News: https://thehackernews.com/2026/07/critical-zimbra-flaw-could-let-crafted_0483473395.html 2. AUSTRALIA WARNS OF GLOBAL CMS CAMPAIGN Vulnerabilities and Exploits · [exploitation, cms] Latest developments: The Australian Cyber Security Centre issued an alert July 11, 2026 warning of a global campaign exploiting vulnerable content management systems and their plugins. The ACSC flagged mass exploitation of outdated CMS platforms and add-ons that attackers use to plant web shells; site operators should patch core software and plugins and audit for compromise. - BleepingComputer: https://www.bleepingcomputer.com/news/security/australia-warns-of-global-campaign-targeting-vulnerable-cms-platforms/ 3. GHOSTCOMMIT POISONS AI CODE REVIEWERS AI Security · [ai, prompt-injection, supply-chain] Latest developments: Researchers unveiled Ghostcommit on July 11, 2026, a technique that buries a prompt injection inside a PNG image, sails past AI code reviewers CodeRabbit and Bugbot that never open image files, and tricks a coding agent into reading a repository's .env file and writing every secret into the code as a list of numbers. The attack turns AI coding assistants into exfiltration tools; teams that let agents review or commit code should treat image files as untrusted input and cut off agent access to secrets. - BleepingComputer: https://www.bleepingcomputer.com/news/security/ghostcommit-hides-prompt-injection-in-images-to-fool-ai-agents-steal-secrets/ 4. PROGRESS ORDERS SHAREFILE SERVERS SHUT DOWN Vulnerabilities and Exploits · [vulnerability, patch] Latest developments: Progress Software emailed ShareFile customers on July 10, 2026 to immediately power down the Windows servers running their Storage Zone Controllers over a 'credible external security threat,' and temporarily cut access to affected accounts out of an abundance of caution. Storage Zone Controllers move files for the on-premises version of Progress's ShareFile secure file-sharing platform; administrators should shut the servers down and watch for guidance while Progress investigates. - The Hacker News: https://thehackernews.com/2026/07/urgent-progress-tells-sharefile.html - BleepingComputer: https://www.bleepingcomputer.com/news/security/progress-urges-sharefile-customers-to-shut-down-servers-over-credible-threat/ 5. RYUK AND ALPHV MEMBERS FACE JUSTICE Ransomware and Cybercrime · [ransomware, arrest] Latest developments: A 34-year-old Armenian man pleaded guilty July 10, 2026 in Oregon federal court to conspiracy and computer fraud for deploying Ryuk ransomware against U.S. companies, facing up to 15 years, while a Florida court handed a Blackcat/AlphV conspirator a 70-month sentence for helping extort multiple victims. Ryuk encrypted companies and hospitals across the U.S. at its peak, and AlphV ran one of the most prolific extortion operations; the two cases mark continued law-enforcement pressure on ransomware affiliates years after the crimes. - BleepingComputer: https://www.bleepingcomputer.com/news/security/ryuk-ransomware-member-pleads-guilty-in-the-us-faces-15-years-in-prison/ - The Record: https://therecord.media/ryuk-operator-pleads-guilty-alphv-conspirator-sentenced 6. NEW U-BOOT BOOTLOADER FLAWS Vulnerabilities and Exploits · [vulnerability, firmware] Latest developments: Researchers disclosed six vulnerabilities July 10, 2026 in the widely used U-Boot bootloader that let attackers run malicious code during device boot, opening the door to stealthy firmware attacks and persistent malware. U-Boot boots countless embedded and IoT devices; the flaws let an attacker subvert security protections before the operating system loads, so device vendors need to ship firmware fixes. - BleepingComputer: https://www.bleepingcomputer.com/news/security/new-u-boot-flaws-could-enable-stealthy-firmware-attacks/ PITTSBURGH ---------------------------------------------------------------- Weather: This Afternoon: Isolated Showers And Thunderstorms, high 83F. Tonight: Scattered Showers And Thunderstorms then Mostly Cloudy, low 65F. Sunday: Mostly Sunny, high 86F. Around town: * Homewood Pool Reopens Latest developments: The city of Pittsburgh celebrated the pool's grand opening Saturday, July 11. Pittsburgh reopened the Homewood Pool as the centerpiece of a $22.87 million transformation of Homewood Park in the city's East End. - WPXI: https://www.wpxi.com/news/local/city-pittsburgh-celebrates-grand-opening-homewood-pool/7AZZVVXAW5GCNHWJBHULHBONBU/ * Hamlin Runs Hometown Football Camp Latest developments: Hamlin's Chasing M's Foundation is sponsoring the weekend camp and all-star game. Buffalo Bills safety Damar Hamlin, through his Chasing M's Foundation, is running a youth football camp and all-star game for Pittsburgh-area children this weekend in his hometown region. - WPXI: https://www.wpxi.com/news/local/damar-hamlin-hosts-hometown-youth-football-camp-all-star-game/K2FC23A3EBE4HMW2IHOAAPBF24/ * Fort Pitt Museum Plans 1776 Symposium Latest developments: The museum announced the symposium as part of America's 250th commemoration. The Fort Pitt Museum, at Point State Park in downtown Pittsburgh, will host a 1776 Symposium marking the nation's 250th anniversary of independence, exploring the American Revolution and the western frontier. - WPXI: https://www.wpxi.com/news/local/fort-pitt-museum-host-1776-symposium-part-americas-250th-anniversary/LIWPC2H2WZFSTB6A65N6YJDD44/ Events: * Big Boy Locomotive Stops in Leetsdale Latest developments: The locomotive's western Pennsylvania run Saturday, July 11, ends with a stop in Leetsdale. Union Pacific's Big Boy No. 4014, the world's largest operating steam locomotive, rolls through western Pennsylvania on Saturday, July 11, on its cross-country tour marking America's 250th birthday, capping the day with a stop in Leetsdale in Allegheny County. - KDKA: https://www.cbsnews.com/pittsburgh/news/big-boy-leetsdale-western-pennsylvania-how-to-see/ * Danny Elfman Coming to Pittsburgh Latest developments: The Post-Gazette published a Q&A with Elfman ahead of his appearance. Film composer Danny Elfman, known for his scores for Tim Burton's movies and the theme to 'The Simpsons,' will appear in Pittsburgh, and in a Post-Gazette interview he discussed the shrinking audience for classical music. - Post-Gazette Arts & Entertainment: https://www.post-gazette.com/ae/music/2026/07/09/danny-elfman-classical-music-decline-film-pittsburgh/stories/202607090002 SPORTS ---------------------------------------------------------------- Pirates (47-47) Fri Jul 10 · Brewers @ Pirates · Postponed https://plaintextsports.com/mlb/2026-07-10/mil-pit Up Next · Brewers @ Pirates · Sat Jul 11, 12:05 PM https://plaintextsports.com/mlb/2026-07-11/mil-pit Around the Teams: * Pirates Deal for White Sox Bat and Arm Latest developments: The Pirates closed the trade Friday night, July 10. The Pirates acquired infielder Jacob Gonzalez and left-handed reliever Brandon Eisert from the Chicago White Sox, sending pitcher Jaden Woods and the No. 34 overall pick in the 2026 draft to Chicago; general manager Ben Cherington said the club weighed multiple ways to use the compensation pick to strengthen a roster battered by pitching injuries. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/07/10/pirates-trade-white-sox-eisert-gonzalez-griffin-chicago-mlb-draft-woods/stories/202607100076 * Porter Jr. Eyes a Booming Market Latest developments: The Post-Gazette reported July 10 on his extension leverage. Steelers cornerback Joey Porter Jr. is angling for a contract extension as the cornerback market booms behind deals for Devon Witherspoon and Sauce Gardner, and the Post-Gazette weighed how much Pittsburgh will pay to keep him. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/07/10/porter-contract-extension-cornerback-nfl-offseason-witherspoon-gonzalez/stories/202607100048 * Pirates Blow Past Their Home Run Total Latest developments: The Post-Gazette's July 11 Off The Bat charted the power surge. The Pirates have already topped last season's full-year home run total, and the Post-Gazette traced the jump to bats including Bryan Reynolds, Brandon Lowe, and Ryan O'Hearn. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/07/11/pirates-mlb-home-run-reynolds-lowe-o-hearn/stories/202607100074 Team USA: * Pulisic's World Cup Falls Flat Latest developments: ESPN examined whether Pulisic deserves blame for the exit. Christian Pulisic, the U.S. men's national team's biggest star, underwhelmed at the home World Cup, and ESPN weighed how much blame he deserves for the round-of-16 loss to Belgium. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49317008/instead-being-usmnt-biggest-world-cup-star-pulisic-was-biggest-mystery READING ---------------------------------------------------------------- * Ed Zitron -- Premium: The Hater's Guide To The Memory Crisis Zitron delivers a skeptical breakdown of the memory-chip crisis, dissecting the surge in memory prices and the industry narrative around it. https://www.wheresyoured.at/premium-the-haters-guide-to-the-memory-crisis/ * Stratechery -- Muse Image, Grok 4.5, Alex Karp on CNBC Ben Thompson argues the battle for verifiable data increasingly defines the AI race, running from Meta's Muse Image and xAI's Grok 4.5 to Palantir's Alex Karp and the frontier labs. https://stratechery.com/2026/muse-image-grok-4-5-alex-karp-on-cnbc/ * Cal Newport -- Beware of Productivity Paradoxes Newport warns that tools seemingly poised to be productivity slam dunks—like the personal computer—often fail to deliver clear gains, a paradox worth keeping in mind as new technologies arrive. https://calnewport.com/beware-of-productivity-paradoxes/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,528.60 ▲ +1.0% Dow 52,690.77 ▲ +0.7% Nasdaq 26,059.80 ▲ +0.8% WTI crude 71.20 ▲ +2.7% EUR/USD 1.1424 ▲ +0.1% GBP/USD 1.3391 ▲ +0.7% USD/JPY 162.21 ▲ +0.1% ================================================================ Generated 2026-07-11 12:09 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================