daily plain-text briefing: security, markets, business, and pittsburgh
Progress orders ShareFile servers shut down over a credible threat as active exploitation campaigns sweep content management systems, Git services, and Zimbra webmail.
Latest developments: The Australian Cyber Security Centre warned July 11, 2026 of a global campaign hitting vulnerable content management systems and plugins, the same week CISA added two actively exploited Joomla extension file-upload flaws—iCagenda's CVE-2026-48939 and Balbooa Forms' CVE-2026-56291—to its Known Exploited Vulnerabilities catalog and attackers began abusing an authentication-bypass bug in the official Gitea Docker image to impersonate administrators.
The campaigns target internet-facing web software—content management systems such as Joomla, their extensions, and self-hosted Git services; operators should patch immediately and inspect for unauthorized accounts and web shells.
Sources: BleepingComputer · CISA Advisories · BleepingComputer · ↑ top
Latest developments: Researchers demonstrated Ghostcommit on July 11, 2026, a prompt injection concealed inside a PNG image that slipped past the CodeRabbit and Bugbot AI code reviewers—which never open image files—and coaxed a coding agent into reading a repository's .env file and writing every secret back as a list of numbers, as SecurityWeek detailed HalluSquatting, which exploits AI-assistant hallucinations to reach remote code execution and seed a botnet, and The Hacker News mapped a WhatsApp-to-host chain through three flaws in the OpenClaw personal AI assistant.
The attacks target autonomous AI agents and assistants that read untrusted content; teams deploying coding agents should treat every model input as hostile and restrict what secrets and hosts an agent can reach.
Sources: BleepingComputer · SecurityWeek · The Hacker News · ↑ top
Latest developments: Zimbra urged customers on July 10, 2026 to patch a critical stored cross-site-scripting flaw in the Classic Web Client of Zimbra Collaboration that lets a crafted email run arbitrary scripts in a victim's session; the bug carries no CVE identifier yet.
Zimbra Collaboration is a widely deployed email and groupware suite, and administrators running the Classic Web Client should apply the fix now, since exploitation needs only a malicious email a user opens.
Sources: The Hacker News · BleepingComputer · ↑ top
Latest developments: A 34-year-old Armenian man pleaded guilty in an Oregon federal court to conspiracy and computer fraud for deploying Ryuk ransomware against US companies and now faces up to 15 years, while Angelo Martino, 41, a former DigitalMint ransomware negotiator, drew 70 months in a Florida federal court for secretly helping the BlackCat/AlphV gang extort victims in 2023, the third US security professional imprisoned in that scheme.
Ryuk and BlackCat/AlphV rank among the most damaging ransomware operations, and the sentencings show US prosecutors reaching both foreign operators and the American incident-response insiders who turned on their own clients.
Sources: The Record · BleepingComputer · SecurityWeek · ↑ top
Latest developments: Progress Software emailed ShareFile customers on July 10, 2026 to immediately power off the Windows servers running their on-premises Storage Zone Controllers and disabled access to affected accounts, citing a credible external security threat it is still investigating with outside responders.
ShareFile is Progress's enterprise secure file-sharing platform, and the Storage Zone Controllers hold customer data on-premises; administrators who run them should shut the servers down and watch for further guidance from Progress.
Sources: The Hacker News · BleepingComputer · ↑ top
Latest developments: The European Parliament passed the law known as Chat Control 2.0 on July 10, 2026, permitting companies including Google, Meta, and Microsoft to scan users' private messages in search of child sexual abuse material.
Chat Control 2.0 revives a contested EU proposal that sets child-safety scanning against end-to-end encryption and message privacy, and providers operating in the EU now must weigh how to scan content while preserving their encryption guarantees.
Sources: The Record · ↑ top
Latest developments: Iran's Revolutionary Guard fired on a commercial ship transiting the Strait of Hormuz, again declared the waterway closed, and U.S. Central Command launched fresh strikes as a crew member went missing.
The IRGC hit a commercial vessel using what it called an "unauthorized route" through the Strait of Hormuz, prompting new U.S. military strikes, while President Trump and Iranian leaders traded threats and mediators fought to hold together a buckling interim ceasefire; Tehran treats its chokehold on the strait as a mark of regional power.
Sources: FT World · WSJ World News · ↑ top
Tonight: Slight Chance Rain Showers then Patchy Fog, low 66F.
Sunday: Mostly Sunny, high 86F.
Sunday Night: Mostly Clear, low 67F.
Latest developments: State lawmakers returned to the Capitol in Harrisburg for weekend sessions on the overdue Pennsylvania budget with Governor Josh Shapiro.
Pennsylvania legislators convened at the Harrisburg Capitol over the weekend to negotiate the state budget with Governor Josh Shapiro, past the June 30 fiscal-year deadline.
Sources: Pittsburgh Post-Gazette · ↑ top
Latest developments: The #BurghProud Challenge closed with 4,300 participants and $1.5 million raised to fight hunger across the Pittsburgh region.
The #BurghProud Challenge drew 4,300 people to move 30 miles over 30 days and raised $1.5 million for hunger relief across the Pittsburgh region.
Latest developments: The Parkway East (I-376) opened its first full day closed, and traffic backed up in Homestead as roughly 100,000 daily drivers hunted for detours.
PennDOT's 25-day Parkway East closure for the Commercial Street Bridge replacement, running through August 3, pushed the highway's roughly 100,000 daily drivers onto detours, jamming Homestead and leaving the Squirrel Hill Tunnel bypassed.
Sources: KDKA · Pittsburgh Post-Gazette · ↑ top
Latest developments: Allegheny County's Hartwood Acres entered the Old-Growth Forward Network.
Hartwood Acres, the 629-acre former estate whose mixed hardwood forest holds red and white oak, sugar maple, black cherry, shagbark hickory, and American beech, was inducted into the Old-Growth Forward Network.
Latest developments: A new museum in Erie centers on Frank Lloyd Wright's restored field office.
The Hagen History Center in Erie built a new museum around Frank Lloyd Wright's field office, drawing on Carnegie collections, roughly two hours north of Pittsburgh.
Sources: Post-Gazette Arts & Entertainment · ↑ top
Pirates (49-47)
Fri Jul 10 · Brewers @ Pirates · Postponed
Sat Jul 11 · Brewers 6 · Pirates 7 · Final
Esmerlyn Valdez's grand slam, two homers lead Pirates past Brewers 7-6 in first game of doubleheader
Sat Jul 11 · Brewers 2 · Pirates 3 · Final
Esmerlyn Valdez homers again as Pirates edge Brewers, 3-2, sweep twinbill from NL Central leaders
Up Next · Brewers @ Pirates · Sun Jul 12, 12:15 PM
Latest developments: The Pirates surprised draft analysts by selecting LSU outfielder Derek Curiel fifth overall in the 2026 MLB Draft in Philadelphia.
Pittsburgh spent its seventh consecutive top-10 pick on LSU outfielder Derek Curiel at No. 5 overall, a choice the Post-Gazette and TribLive called a surprise among projected picks.
Sources: Post-Gazette Pirates · ↑ top
Latest developments: The Pirates acquired infielder Jacob Gonzalez and left-handed reliever Brandon Eisert from the Chicago White Sox.
General manager Ben Cherington traded with the Chicago White Sox for infielder Jacob Gonzalez and lefty reliever Brandon Eisert, adding infield and bullpen depth as injuries mount.
Sources: Post-Gazette Pirates · ↑ top
Latest developments: The Post-Gazette reported cornerback Joey Porter Jr. is looking to cash in as cornerback salaries surge, testing how much the Steelers will pay.
Steelers cornerback Joey Porter Jr. is seeking an extension amid soaring pay at the position, and the Post-Gazette measured Pittsburgh's willingness to pay against recent deals for Devon Witherspoon and Christian Gonzalez.
Sources: Post-Gazette Steelers · ↑ top
Latest developments: ESPN examined why Christian Pulisic underperformed at the home World Cup and whether he deserves the blame.
ESPN argued Christian Pulisic, cast as the U.S. men's biggest star at a World Cup on home soil, instead became its biggest mystery before the round-of-16 exit to Belgium.
Sources: ESPN Soccer · ↑ top
S&P 500 7,528.60 ▲ +1.0% Dow 52,690.77 ▲ +0.7% Nasdaq 26,059.80 ▲ +0.8% WTI crude 71.20 ▲ +2.7% EUR/USD 1.1424 ▲ +0.1% GBP/USD 1.3391 ▲ +0.7% USD/JPY 162.21 ▲ +0.1%