================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Saturday, July 11, 2026 - 9:06 PM EDT ================================================================ Progress orders ShareFile servers shut down over a credible threat as active exploitation campaigns sweep content management systems, Git services, and Zimbra webmail. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] A prompt injection dubbed Ghostcommit hid inside a PNG image to slip past CodeRabbit and Bugbot AI code reviewers and hijack an autonomous coding agent. see: Hidden Prompt Injection Hijacks AI Agents * [TREND] Defenders scrambled as Australia warned of mass CMS exploitation alongside CISA's Joomla flaws, Zimbra patched a critical web-client XSS, and Progress told ShareFile users to power off servers. see: Mass Exploitation of CMS and Git Platforms; Critical Zimbra Web Client Flaw; Progress ShareFile Emergency Shutdown * [UPDATE (new)] A federal court in Oregon took a guilty plea from a Ryuk ransomware operator while a former DigitalMint negotiator was sentenced, squeezing the ecosystem's enablers. see: Ransomware Operators and Enablers Sentenced * [TREND] Reading pieces push back on AI hype, with Zitron dismantling the memory-chip crisis, Ben Thompson framing verifiable data as the real race, and Newport warning of productivity paradoxes. see: Premium: The Hater's Guide To The Memory Crisis; Muse Image, Grok 4.5, Alex Karp on CNBC; Beware of Productivity Paradoxes * [UPDATE (new)] The Parkway East (I-376) began its first full day closed, backing up traffic in Homestead as some 100,000 daily drivers hunted for detours. see: Parkway East Closure Snarls Its First Day * [UPDATE (new)] The Pirates surprised analysts by drafting LSU's Derek Curiel fifth overall and acquired Jacob Gonzalez and reliever Brandon Eisert from the White Sox. see: Pirates Take LSU's Derek Curiel at No. 5; Pirates Add Gonzalez, Eisert From White Sox SECURITY ---------------------------------------------------------------- 1. MASS EXPLOITATION OF CMS AND GIT PLATFORMS Vulnerabilities and Exploits · [exploit, patch] Latest developments: The Australian Cyber Security Centre warned July 11, 2026 of a global campaign hitting vulnerable content management systems and plugins, the same week CISA added two actively exploited Joomla extension file-upload flaws—iCagenda's CVE-2026-48939 and Balbooa Forms' CVE-2026-56291—to its Known Exploited Vulnerabilities catalog and attackers began abusing an authentication-bypass bug in the official Gitea Docker image to impersonate administrators. The campaigns target internet-facing web software—content management systems such as Joomla, their extensions, and self-hosted Git services; operators should patch immediately and inspect for unauthorized accounts and web shells. - BleepingComputer: https://www.bleepingcomputer.com/news/security/australia-warns-of-global-campaign-targeting-vulnerable-cms-platforms/ - CISA Advisories: https://www.cisa.gov/news-events/alerts/2026/07/10/cisa-adds-two-known-exploited-vulnerabilities-catalog - BleepingComputer: https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-auth-bypass-in-gitea-docker-image/ 2. HIDDEN PROMPT INJECTION HIJACKS AI AGENTS AI Security · [ai, zero-day] Latest developments: Researchers demonstrated Ghostcommit on July 11, 2026, a prompt injection concealed inside a PNG image that slipped past the CodeRabbit and Bugbot AI code reviewers—which never open image files—and coaxed a coding agent into reading a repository's .env file and writing every secret back as a list of numbers, as SecurityWeek detailed HalluSquatting, which exploits AI-assistant hallucinations to reach remote code execution and seed a botnet, and The Hacker News mapped a WhatsApp-to-host chain through three flaws in the OpenClaw personal AI assistant. The attacks target autonomous AI agents and assistants that read untrusted content; teams deploying coding agents should treat every model input as hostile and restrict what secrets and hosts an agent can reach. - BleepingComputer: https://www.bleepingcomputer.com/news/security/ghostcommit-hides-prompt-injection-in-images-to-fool-ai-agents-steal-secrets/ - SecurityWeek: https://www.securityweek.com/hallusquatting-turns-ai-hallucinations-into-botnet-delivery-mechanism/ - The Hacker News: https://thehackernews.com/2026/07/researcher-details-whatsapp-to-host.html 3. CRITICAL ZIMBRA WEB CLIENT FLAW Vulnerabilities and Exploits · [patch, vulnerability] Latest developments: Zimbra urged customers on July 10, 2026 to patch a critical stored cross-site-scripting flaw in the Classic Web Client of Zimbra Collaboration that lets a crafted email run arbitrary scripts in a victim's session; the bug carries no CVE identifier yet. Zimbra Collaboration is a widely deployed email and groupware suite, and administrators running the Classic Web Client should apply the fix now, since exploitation needs only a malicious email a user opens. - The Hacker News: https://thehackernews.com/2026/07/critical-zimbra-flaw-could-let-crafted_0483473395.html - BleepingComputer: https://www.bleepingcomputer.com/news/security/zimbra-urges-customers-to-patch-critical-web-client-xss-flaw/ 4. RANSOMWARE OPERATORS AND ENABLERS SENTENCED Ransomware and Cybercrime · [ransomware] Latest developments: A 34-year-old Armenian man pleaded guilty in an Oregon federal court to conspiracy and computer fraud for deploying Ryuk ransomware against US companies and now faces up to 15 years, while Angelo Martino, 41, a former DigitalMint ransomware negotiator, drew 70 months in a Florida federal court for secretly helping the BlackCat/AlphV gang extort victims in 2023, the third US security professional imprisoned in that scheme. Ryuk and BlackCat/AlphV rank among the most damaging ransomware operations, and the sentencings show US prosecutors reaching both foreign operators and the American incident-response insiders who turned on their own clients. - The Record: https://therecord.media/ryuk-operator-pleads-guilty-alphv-conspirator-sentenced - BleepingComputer: https://www.bleepingcomputer.com/news/security/ryuk-ransomware-member-pleads-guilty-in-the-us-faces-15-years-in-prison/ - SecurityWeek: https://www.securityweek.com/third-us-security-expert-sentenced-to-prison-for-helping-ransomware-gang/ 5. PROGRESS SHAREFILE EMERGENCY SHUTDOWN Vulnerabilities and Exploits · [zero-day, patch] Latest developments: Progress Software emailed ShareFile customers on July 10, 2026 to immediately power off the Windows servers running their on-premises Storage Zone Controllers and disabled access to affected accounts, citing a credible external security threat it is still investigating with outside responders. ShareFile is Progress's enterprise secure file-sharing platform, and the Storage Zone Controllers hold customer data on-premises; administrators who run them should shut the servers down and watch for further guidance from Progress. - The Hacker News: https://thehackernews.com/2026/07/urgent-progress-tells-sharefile.html - BleepingComputer: https://www.bleepingcomputer.com/news/security/progress-urges-sharefile-customers-to-shut-down-servers-over-credible-threat/ 6. EU PARLIAMENT PASSES CHAT CONTROL 2.0 Policy and Regulation · [policy] Latest developments: The European Parliament passed the law known as Chat Control 2.0 on July 10, 2026, permitting companies including Google, Meta, and Microsoft to scan users' private messages in search of child sexual abuse material. Chat Control 2.0 revives a contested EU proposal that sets child-safety scanning against end-to-end encryption and message privacy, and providers operating in the EU now must weigh how to scan content while preserving their encryption guarantees. - The Record: https://therecord.media/chat-control-2-csam-scans-european-parliament-passage BUSINESS AND POLITICS ---------------------------------------------------------------- * Iran Declares Hormuz Closed, U.S. Strikes Again Latest developments: Iran's Revolutionary Guard fired on a commercial ship transiting the Strait of Hormuz, again declared the waterway closed, and U.S. Central Command launched fresh strikes as a crew member went missing. The IRGC hit a commercial vessel using what it called an "unauthorized route" through the Strait of Hormuz, prompting new U.S. military strikes, while President Trump and Iranian leaders traded threats and mediators fought to hold together a buckling interim ceasefire; Tehran treats its chokehold on the strait as a mark of regional power. - FT World: https://www.ft.com/content/6b6c23e9-f24e-4c3e-bb1a-e5cb6860008d - WSJ World News: https://www.wsj.com/world/middle-east/https-www-wsj-com-world-middle-east-iran-deal-strait-of-hormuz-b027c30f-580ee99f PITTSBURGH ---------------------------------------------------------------- Weather: Tonight: Slight Chance Rain Showers then Patchy Fog, low 66F. Sunday: Mostly Sunny, high 86F. Sunday Night: Mostly Clear, low 67F. Business: * Pennsylvania Budget Work Runs Into the Weekend Latest developments: State lawmakers returned to the Capitol in Harrisburg for weekend sessions on the overdue Pennsylvania budget with Governor Josh Shapiro. Pennsylvania legislators convened at the Harrisburg Capitol over the weekend to negotiate the state budget with Governor Josh Shapiro, past the June 30 fiscal-year deadline. - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/state/2026/07/11/lawmakers-harrisburg-capitol-pennsylvania-budget-shapiro/stories/202607110046 * #BurghProud Challenge Raises $1.5 Million Latest developments: The #BurghProud Challenge closed with 4,300 participants and $1.5 million raised to fight hunger across the Pittsburgh region. The #BurghProud Challenge drew 4,300 people to move 30 miles over 30 days and raised $1.5 million for hunger relief across the Pittsburgh region. - WPXI: https://www.wpxi.com/news/local/4300-people-help-raise-15m-combat-hunger-pittsburgh-region/ZOXJXWIKZFCM3LYI6RNYFAK76M/ Around town: * Parkway East Closure Snarls Its First Day Latest developments: The Parkway East (I-376) opened its first full day closed, and traffic backed up in Homestead as roughly 100,000 daily drivers hunted for detours. PennDOT's 25-day Parkway East closure for the Commercial Street Bridge replacement, running through August 3, pushed the highway's roughly 100,000 daily drivers onto detours, jamming Homestead and leaving the Squirrel Hill Tunnel bypassed. - KDKA: https://www.cbsnews.com/pittsburgh/video/day-1-of-parkway-east-closure-causes-congestion-for-drivers-in-homestead/ - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/transportation/2026/07/11/commercial-bridge-closure-day-1/stories/202607110044 * Hartwood Acres Joins Old-Growth Forest Network Latest developments: Allegheny County's Hartwood Acres entered the Old-Growth Forward Network. Hartwood Acres, the 629-acre former estate whose mixed hardwood forest holds red and white oak, sugar maple, black cherry, shagbark hickory, and American beech, was inducted into the Old-Growth Forward Network. - WPXI: https://www.wpxi.com/news/local/hartwood-acres-inducted-into-old-growth-forward-network/UJ3A6GX6ZBBD3EZLW5IPKE572E/ Events: * Frank Lloyd Wright Office Anchors New Erie Museum Latest developments: A new museum in Erie centers on Frank Lloyd Wright's restored field office. The Hagen History Center in Erie built a new museum around Frank Lloyd Wright's field office, drawing on Carnegie collections, roughly two hours north of Pittsburgh. - Post-Gazette Arts & Entertainment: https://www.post-gazette.com/ae/art-architecture/2026/07/09/frank-lloyd-wright-field-office-museum-erie-hagen-history-center-carnegie-art/stories/202607070036 SPORTS ---------------------------------------------------------------- Pirates (49-47) Fri Jul 10 · Brewers @ Pirates · Postponed https://plaintextsports.com/mlb/2026-07-10/mil-pit Sat Jul 11 · Brewers 6 · Pirates 7 · Final Esmerlyn Valdez's grand slam, two homers lead Pirates past Brewers 7-6 in first game of doubleheader https://plaintextsports.com/mlb/2026-07-11/mil-pit Sat Jul 11 · Brewers 2 · Pirates 3 · Final Esmerlyn Valdez homers again as Pirates edge Brewers, 3-2, sweep twinbill from NL Central leaders https://plaintextsports.com/mlb/2026-07-11/mil-pit Up Next · Brewers @ Pirates · Sun Jul 12, 12:15 PM https://plaintextsports.com/mlb/2026-07-12/mil-pit Around the Teams: * Pirates Take LSU's Derek Curiel at No. 5 Latest developments: The Pirates surprised draft analysts by selecting LSU outfielder Derek Curiel fifth overall in the 2026 MLB Draft in Philadelphia. Pittsburgh spent its seventh consecutive top-10 pick on LSU outfielder Derek Curiel at No. 5 overall, a choice the Post-Gazette and TribLive called a surprise among projected picks. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/07/11/mlb-draft-derek-curiel-pirates/stories/202607100075 * Pirates Add Gonzalez, Eisert From White Sox Latest developments: The Pirates acquired infielder Jacob Gonzalez and left-handed reliever Brandon Eisert from the Chicago White Sox. General manager Ben Cherington traded with the Chicago White Sox for infielder Jacob Gonzalez and lefty reliever Brandon Eisert, adding infield and bullpen depth as injuries mount. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/07/10/pirates-trade-white-sox-eisert-gonzalez-griffin-chicago-mlb-draft-woods/stories/202607100076 * Porter Eyes Extension in a Booming Corner Market Latest developments: The Post-Gazette reported cornerback Joey Porter Jr. is looking to cash in as cornerback salaries surge, testing how much the Steelers will pay. Steelers cornerback Joey Porter Jr. is seeking an extension amid soaring pay at the position, and the Post-Gazette measured Pittsburgh's willingness to pay against recent deals for Devon Witherspoon and Christian Gonzalez. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/07/10/porter-contract-extension-cornerback-nfl-offseason-witherspoon-gonzalez/stories/202607100048 Team USA: * Pulisic's Home World Cup Falls Flat Latest developments: ESPN examined why Christian Pulisic underperformed at the home World Cup and whether he deserves the blame. ESPN argued Christian Pulisic, cast as the U.S. men's biggest star at a World Cup on home soil, instead became its biggest mystery before the round-of-16 exit to Belgium. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49317008/instead-being-usmnt-biggest-world-cup-star-pulisic-was-biggest-mystery READING ---------------------------------------------------------------- * Ed Zitron -- Premium: The Hater's Guide To The Memory Crisis Zitron picks apart the narrative of a memory-chip crisis, arguing the AI-driven surge in memory demand and prices runs on hype more than fundamentals. https://www.wheresyoured.at/premium-the-haters-guide-to-the-memory-crisis/ * Stratechery -- Muse Image, Grok 4.5, Alex Karp on CNBC Ben Thompson argues the fight over verifiable data increasingly defines the AI race, from Meta to Grok to the frontier labs. https://stratechery.com/2026/muse-image-grok-4-5-alex-karp-on-cnbc/ * Cal Newport -- Beware of Productivity Paradoxes Newport notes the personal computer looked like a productivity slam dunk yet often failed to deliver measurable gains, a caution against assuming new tools like AI automatically make workers more productive. https://calnewport.com/beware-of-productivity-paradoxes/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,528.60 ▲ +1.0% Dow 52,690.77 ▲ +0.7% Nasdaq 26,059.80 ▲ +0.8% WTI crude 71.20 ▲ +2.7% EUR/USD 1.1424 ▲ +0.1% GBP/USD 1.3391 ▲ +0.7% USD/JPY 162.21 ▲ +0.1% ================================================================ Generated 2026-07-11 21:06 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================