daily plain-text briefing: security, markets, business, and pittsburgh
Attackers turned a JavaScript-security vendor's own npm package into an infostealer and abused GitHub's API for mass reconnaissance, driving home that the developer supply chain is the day's battleground.
Latest developments: Attackers pushed a malicious jscrambler 8.14.0 release to npm on July 11, 2026, whose preinstall hook drops and runs a native Rust infostealer compiled for Windows, macOS, and Linux, and Socket flagged the version six minutes after publication.
Jscrambler builds JavaScript obfuscation and protection tools, so anyone who installed version 8.14.0 ran the infostealer automatically. Roll the package back, rotate any credentials the build touched, and hunt for the dropped binary.
Sources: The Hacker News · ↑ top
Latest developments: SecurityWeek reported July 11, 2026 that multiple campaigns spin up disposable ghost accounts to abuse the GitHub API and enumerate organizations' repositories and members at scale.
The reconnaissance profiles GitHub organizations, likely to seed later targeted attacks against developers and their code. Restrict API exposure and watch for anomalous enumeration of members and repos.
Sources: SecurityWeek · ↑ top
Latest developments: Researchers disclosed July 11, 2026 that suspected China- and India-aligned actors ran sustained espionage against Pakistani law enforcement from February 2024 through April 2026, compromising Balochistan Police servers that host web applications managing criminal and citizen records.
The intrusions struck several Pakistani law enforcement organizations and exposed police and citizen data across multiple espionage campaigns. Affected agencies should hunt for the compromise and lock down internet-facing web applications.
Sources: The Hacker News · ↑ top
Latest developments: Wired reported July 11, 2026 that an AI system found a root-privilege bug in the Linux kernel that human reviewers overlooked for fifteen years.
AI-driven code analysis is surfacing long-buried kernel flaws that grant local root access. Administrators should track the forthcoming fix and update their kernels promptly.
Sources: Wired Security · ↑ top
Latest developments: The Wireshark project shipped version 4.6.7 on July 11, 2026, fixing 12 vulnerabilities and 16 bugs.
Wireshark is the standard network-protocol analyzer, and malformed captures can crash or exploit older builds. Update to 4.6.7.
Sources: SANS Internet Storm Center · ↑ top
Latest developments: Bruce Schneier flagged July 10, 2026 a 29-year-old bug in the Squid proxy, dubbed Squidbleed, that can leak the contents of HTTP requests.
Squid is a widely deployed open-source caching proxy, and the flaw can expose sensitive request data to attackers. Operators should apply the fixed release.
Sources: Schneier on Security · ↑ top
Latest developments: The Saturday, July 11, deadline for Iran to reopen the Strait of Hormuz arrived as the Trump administration signaled it now doubts any nuclear deal, and Trump and Iran's leadership traded fresh threats after Ayatollah Ali Khamenei's funeral.
A senior U.S. official demanded Iran reopen the Strait of Hormuz—the chokepoint carrying roughly a fifth of the world's crude—or face consequences, while mediators scrambled to salvage a crumbling agreement as the Trump administration grew pessimistic about reaching a nuclear accord with Tehran.
Sources: WSJ World News · FT World · ↑ top
This Afternoon: Chance Showers And Thunderstorms, high 83F.
Tonight: Chance Showers And Thunderstorms then Mostly Cloudy, low 66F.
Sunday: Mostly Sunny, high 86F.
Latest developments: TribLive reported July 11 on a growing local backlash against gratuity prompts.
TribLive found Western Pennsylvania consumers pushing back as more businesses add tip suggestions and gratuity requests to checkout screens, testing where shoppers draw the line on prompted tipping.
Pirates (48-47)
Fri Jul 10 · Brewers @ Pirates · Postponed
Sat Jul 11 · Brewers 6 · Pirates 7 · Final
Esmerlyn Valdez's grand slam, two homers lead Pirates past Brewers 7-6 in first game of doubleheader
Up Next · Brewers @ Pirates · Sat Jul 11, 4:05 PM
Latest developments: In a July 11 column, Post-Gazette writer Noah Hiles argued the Pirates must make better use of reliever Carmen Mlodzinski.
Post-Gazette columnist Noah Hiles wrote that manager Don Kelly and general manager Ben Cherington are underusing right-handed reliever Carmen Mlodzinski as the Pittsburgh Pirates work through bullpen struggles and mounting injuries.
Sources: Post-Gazette Pirates · ↑ top
Latest developments: The Post-Gazette reported July 10 that Greg Hawthorne, the Steelers' first-round pick in 1979, died at 69.
Greg Hawthorne, whom the Pittsburgh Steelers selected in the first round of the 1979 NFL Draft, died at 69.
Sources: Post-Gazette Steelers · ↑ top
Latest developments: The Guardian reported July 11 on how the tournament captivated the United States even after the men's team's exit.
The Guardian described packed stadiums and record television audiences as the United States embraced hosting the 2026 World Cup, framing the tournament as a unifying, multicultural celebration that arrived despite President Trump's threats against co-hosts Canada and Mexico and his tightened travel restrictions.
Sources: Guardian World Cup 2026 · ↑ top
S&P 500 7,528.60 ▲ +1.0% Dow 52,690.77 ▲ +0.7% Nasdaq 26,059.80 ▲ +0.8% WTI crude 71.20 ▲ +2.7% EUR/USD 1.1424 ▲ +0.1% GBP/USD 1.3391 ▲ +0.7% USD/JPY 162.21 ▲ +0.1%