================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Saturday, July 11, 2026 - 4:05 PM EDT ================================================================ Attackers turned a JavaScript-security vendor's own npm package into an infostealer and abused GitHub's API for mass reconnaissance, driving home that the developer supply chain is the day's battleground. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Attackers keep weaponizing developer infrastructure, poisoning the jscrambler npm release with a Rust infostealer while disposable ghost accounts abuse the GitHub API to map organizations. see: Compromised jscrambler npm Package; Ghost Accounts Map GitHub Organizations * [TREND] Foundational open-source software keeps yielding ancient wounds, from the 29-year-old Squidbleed leak in Squid to twelve fresh fixes shipped in Wireshark 4.6.7. see: Squidbleed Squid Proxy Flaw; Wireshark 4.6.7 Patches * [TREND] AI now cuts both ways in vulnerability research, surfacing a root-privilege Linux kernel bug that human reviewers walked past for fifteen years. see: AI Uncovers 15-Year-Old Linux Root Bug * [UPDATE (new)] Iran's Strait of Hormuz reopening deadline passed as the Trump administration signaled doubt over any nuclear deal amid fresh mutual threats. see: Iran Hormuz Deadline Passes, Nuclear Talks Falter * [TREND] This week's reading probes the AI hype cycle, from verifiable data behind Grok to Newport's productivity paradoxes and Zitron's contrarian memory-crisis skepticism. see: Muse Image, Grok 4.5, Alex Karp on CNBC; Beware of Productivity Paradoxes; Premium: The Hater's Guide To The Memory Crisis SECURITY ---------------------------------------------------------------- 1. COMPROMISED JSCRAMBLER NPM PACKAGE Supply Chain Security · [supply-chain, npm, infostealer] Latest developments: Attackers pushed a malicious jscrambler 8.14.0 release to npm on July 11, 2026, whose preinstall hook drops and runs a native Rust infostealer compiled for Windows, macOS, and Linux, and Socket flagged the version six minutes after publication. Jscrambler builds JavaScript obfuscation and protection tools, so anyone who installed version 8.14.0 ran the infostealer automatically. Roll the package back, rotate any credentials the build touched, and hunt for the dropped binary. - The Hacker News: https://thehackernews.com/2026/07/compromised-jscrambler-8140-npm-release.html 2. GHOST ACCOUNTS MAP GITHUB ORGANIZATIONS Supply Chain Security · [reconnaissance, github] Latest developments: SecurityWeek reported July 11, 2026 that multiple campaigns spin up disposable ghost accounts to abuse the GitHub API and enumerate organizations' repositories and members at scale. The reconnaissance profiles GitHub organizations, likely to seed later targeted attacks against developers and their code. Restrict API exposure and watch for anomalous enumeration of members and repos. - SecurityWeek: https://www.securityweek.com/ghost-accounts-abuse-github-api-in-mass-recon-campaign/ 3. ESPIONAGE AGAINST PAKISTANI POLICE Nation-State Activity · [apt, espionage, breach] Latest developments: Researchers disclosed July 11, 2026 that suspected China- and India-aligned actors ran sustained espionage against Pakistani law enforcement from February 2024 through April 2026, compromising Balochistan Police servers that host web applications managing criminal and citizen records. The intrusions struck several Pakistani law enforcement organizations and exposed police and citizen data across multiple espionage campaigns. Affected agencies should hunt for the compromise and lock down internet-facing web applications. - The Hacker News: https://thehackernews.com/2026/07/hackers-weaponize-balochistan-police.html 4. AI UNCOVERS 15-YEAR-OLD LINUX ROOT BUG AI Security · [ai, vulnerability, linux] Latest developments: Wired reported July 11, 2026 that an AI system found a root-privilege bug in the Linux kernel that human reviewers overlooked for fifteen years. AI-driven code analysis is surfacing long-buried kernel flaws that grant local root access. Administrators should track the forthcoming fix and update their kernels promptly. - Wired Security: https://www.wired.com/story/security-news-this-week-ai-found-a-root-bug-in-linux-that-everyone-missed-for-15-years/ 5. WIRESHARK 4.6.7 PATCHES Vulnerabilities and Exploits · [patch, vulnerability] Latest developments: The Wireshark project shipped version 4.6.7 on July 11, 2026, fixing 12 vulnerabilities and 16 bugs. Wireshark is the standard network-protocol analyzer, and malformed captures can crash or exploit older builds. Update to 4.6.7. - SANS Internet Storm Center: https://isc.sans.edu/diary/rss/33146 6. SQUIDBLEED SQUID PROXY FLAW Vulnerabilities and Exploits · [vulnerability, proxy] Latest developments: Bruce Schneier flagged July 10, 2026 a 29-year-old bug in the Squid proxy, dubbed Squidbleed, that can leak the contents of HTTP requests. Squid is a widely deployed open-source caching proxy, and the flaw can expose sensitive request data to attackers. Operators should apply the fixed release. - Schneier on Security: https://www.schneier.com/blog/archives/2026/07/friday-squid-blogging-squidbleed-vulnerability.html BUSINESS AND POLITICS ---------------------------------------------------------------- * Iran Hormuz Deadline Passes, Nuclear Talks Falter Latest developments: The Saturday, July 11, deadline for Iran to reopen the Strait of Hormuz arrived as the Trump administration signaled it now doubts any nuclear deal, and Trump and Iran's leadership traded fresh threats after Ayatollah Ali Khamenei's funeral. A senior U.S. official demanded Iran reopen the Strait of Hormuz—the chokepoint carrying roughly a fifth of the world's crude—or face consequences, while mediators scrambled to salvage a crumbling agreement as the Trump administration grew pessimistic about reaching a nuclear accord with Tehran. - WSJ World News: https://www.wsj.com/world/middle-east/trump-administration-increasingly-pessimistic-of-clinching-iran-nuclear-deal-ec3ad92e - FT World: https://www.ft.com/content/68d396cd-2800-4ff8-b563-1f5c95beb9ba PITTSBURGH ---------------------------------------------------------------- Weather: This Afternoon: Chance Showers And Thunderstorms, high 83F. Tonight: Chance Showers And Thunderstorms then Mostly Cloudy, low 66F. Sunday: Mostly Sunny, high 86F. Business: * Western Pennsylvania's Tipping Fatigue Latest developments: TribLive reported July 11 on a growing local backlash against gratuity prompts. TribLive found Western Pennsylvania consumers pushing back as more businesses add tip suggestions and gratuity requests to checkout screens, testing where shoppers draw the line on prompted tipping. - TribLive: https://triblive.com/local/regional/western-pennsylvanians-react-to-growing-tipping-culture-gratuity-requests/ SPORTS ---------------------------------------------------------------- Pirates (48-47) Fri Jul 10 · Brewers @ Pirates · Postponed https://plaintextsports.com/mlb/2026-07-10/mil-pit Sat Jul 11 · Brewers 6 · Pirates 7 · Final Esmerlyn Valdez's grand slam, two homers lead Pirates past Brewers 7-6 in first game of doubleheader https://plaintextsports.com/mlb/2026-07-11/mil-pit Up Next · Brewers @ Pirates · Sat Jul 11, 4:05 PM https://plaintextsports.com/mlb/2026-07-11/mil-pit Around the Teams: * Pirates' Use of Mlodzinski Questioned Latest developments: In a July 11 column, Post-Gazette writer Noah Hiles argued the Pirates must make better use of reliever Carmen Mlodzinski. Post-Gazette columnist Noah Hiles wrote that manager Don Kelly and general manager Ben Cherington are underusing right-handed reliever Carmen Mlodzinski as the Pittsburgh Pirates work through bullpen struggles and mounting injuries. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/07/11/hiles-column-mlodzinski-bullpen-mlb-kelly-cherington/stories/202607110014 * Greg Hawthorne Dies at 69 Latest developments: The Post-Gazette reported July 10 that Greg Hawthorne, the Steelers' first-round pick in 1979, died at 69. Greg Hawthorne, whom the Pittsburgh Steelers selected in the first round of the 1979 NFL Draft, died at 69. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/07/10/hawthorne-dies-obituary-nfl-player/stories/202607100049 Team USA: * America Embraces Its Home World Cup Latest developments: The Guardian reported July 11 on how the tournament captivated the United States even after the men's team's exit. The Guardian described packed stadiums and record television audiences as the United States embraced hosting the 2026 World Cup, framing the tournament as a unifying, multicultural celebration that arrived despite President Trump's threats against co-hosts Canada and Mexico and his tightened travel restrictions. - Guardian World Cup 2026: https://www.theguardian.com/football/2026/jul/11/america-world-cup-love-football READING ---------------------------------------------------------------- * Ed Zitron -- Premium: The Hater's Guide To The Memory Crisis Zitron delivers a skeptical, contrarian breakdown of the semiconductor memory-price crisis, questioning the narrative that surging chip prices signal a lasting shift in the technology industry. https://www.wheresyoured.at/premium-the-haters-guide-to-the-memory-crisis/ * Stratechery -- Muse Image, Grok 4.5, Alex Karp on CNBC Ben Thompson argues the battle for verifiable data increasingly defines the AI race, tracing that contest across Meta, xAI's Grok, and the frontier labs. https://stratechery.com/2026/muse-image-grok-4-5-alex-karp-on-cnbc/ * Cal Newport -- Beware of Productivity Paradoxes Newport examines why technologies seemingly destined to be productivity slam dunks, like the personal computer, often fail to deliver measurable gains, a caution he applies to today's assumptions about AI. https://calnewport.com/beware-of-productivity-paradoxes/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,528.60 ▲ +1.0% Dow 52,690.77 ▲ +0.7% Nasdaq 26,059.80 ▲ +0.8% WTI crude 71.20 ▲ +2.7% EUR/USD 1.1424 ▲ +0.1% GBP/USD 1.3391 ▲ +0.7% USD/JPY 162.21 ▲ +0.1% ================================================================ Generated 2026-07-11 16:05 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================