daily plain-text briefing: security, markets, business, and pittsburgh
A poisoned jscrambler npm release ran a Rust infostealer on developers' machines, the sharpest of a day's attacks reaching from software supply chains down to device bootloaders.
Latest developments: SentinelOne disclosed that suspected China- and India-aligned threat actors ran separate espionage campaigns against Pakistan's Balochistan Police between February 2024 and April 2026, in some cases breaching the exact same servers that host web applications managing criminal and citizen records for the force policing the country's insurgency-hit southwestern province.
Two rival states independently compromised the same Pakistani law-enforcement systems, a rare case of adversaries and near-allies colliding on one target tied to the long-running Balochistan separatist conflict. The intrusions exposed police and citizen data across the province.
Sources: The Record · SecurityWeek · The Hacker News · ↑ top
Latest developments: The jscrambler package's 8.14.0 release, published July 11, 2026, carried a preinstall hook that dropped and ran a native Rust infostealer—separate Windows, macOS, and Linux builds—on any machine that installed it, and Socket flagged the release six minutes after publication, while SecurityWeek reported ghost accounts abusing the GitHub API to map organizations' repositories and members in a mass reconnaissance campaign.
Two developer-ecosystem threats surfaced together: a compromised jscrambler npm build that steals credentials at install time, and throwaway GitHub accounts quietly cataloging corporate repos and staff for later attacks. Pin dependency versions, audit recent installs, and lock down GitHub organization visibility.
Sources: The Hacker News · SecurityWeek · ↑ top
Latest developments: Firmware security firm Binarly disclosed six new flaws in U-Boot, the bootloader that starts home routers, smart cameras, and data-center management chips, four of which crash a device and two of which let an attacker who slips a malicious image in front of the bootloader run code before the device raises its defenses.
U-Boot runs on an enormous range of hardware, so the code-execution bugs open a path to stealthy, persistent firmware implants that survive reinstalls and defeat later protections. Device makers should ship the patched builds; operators should track firmware updates from affected vendors.
Sources: BleepingComputer · The Hacker News · ↑ top
Latest developments: SecurityWeek detailed GigaWiper, a backdoor that bundles a standalone wiper, ransomware-style encryption, and a multi-pass wiping command into one tool built for system-level sabotage.
GigaWiper blurs the line between ransomware and pure destruction, giving operators the choice to extort or simply erase a compromised system beyond recovery. Organizations should treat it as a data-destruction threat and verify that backups sit beyond the reach of a compromised host.
Sources: SecurityWeek · ↑ top
Latest developments: FoxIO researcher Sébastien Féry disclosed XRING on July 8, a single wrong variable in Alibaba's XQUIC QUIC and HTTP/3 library that lets any remote client crash the server with roughly 260 bytes of legal QPACK traffic, no login and no malformed packets required, and there is no patch.
XRING turns ordinary HTTP/3 requests into a reliable denial-of-service against anyone running XQUIC, a widely embedded library. With no fix available, operators should restrict exposure of XQUIC-backed services and monitor for repeated QPACK-triggered crashes.
Sources: The Hacker News · ↑ top
Latest developments: Chinese security firm QiAnXin attributed a new Rust-based remote access trojan called MODBEACON to the China-linked group Silver Fox, which uses gRPC streaming to encrypt its command-and-control traffic and spreads through counterfeit installers pushed by SEO poisoning.
MODBEACON reveals a more organized operation behind what looked like a high-volume, low-sophistication malware crew, with encrypted gRPC channels that blend into normal traffic. Defenders should watch for counterfeit software installers and unusual gRPC connections.
Sources: The Hacker News · ↑ top
Latest developments: U.S. Central Command launched fresh strikes overnight into July 12 after Iran's Revolutionary Guard fired on a containership transiting the strait, left a crew member missing, again declared the waterway closed, and turned its threats on the Gulf Arab states.
Iran and the United States traded new attacks over the Strait of Hormuz, the chokepoint carrying roughly a fifth of the world's seaborne oil, as the Trump administration warned Tehran to reopen the passage and grew pessimistic about any nuclear deal. The Wall Street Journal reports Iran now treats control of the strait as cementing its regional power, keeping tanker traffic and oil prices at risk.
Sources: WSJ · FT · WSJ · ↑ top
Overnight: Mostly Cloudy, low 67F.
Sunday: Mostly Sunny, high 87F.
Sunday Night: Mostly Clear, low 67F.
Latest developments: West Overton Village's distillery in Scottdale, Westmoreland County, launched a historic cherry bounce, a colonial cherry-steeped whiskey liqueur, to mark the United States' semiquincentennial.
West Overton Village, the restored 19th-century industrial hamlet near Scottdale where Henry Clay Frick was born, runs a working distillery; its America 250 cherry bounce ties the region's whiskey heritage to the July 4 anniversary of independence.
Latest developments: Jeannette hired three police officers this week, which city officials said should ease the department's ballooning overtime costs.
Jeannette, a Westmoreland County city that has leaned on costly overtime to staff a short-handed police force, added three officers to bring those payroll costs down.
Latest developments: Thousands lined the rails in Homestead on Saturday, July 11, to watch Union Pacific's Big Boy No. 4014 steam locomotive, jamming a borough already absorbing detour traffic from the Parkway East closure and leaving drivers in hours of gridlock.
PennDOT closed the Parkway East (I-376) and the Squirrel Hill Tunnel on July 10 for a 25-day Commercial Street Bridge replacement, rerouting roughly 100,000 daily drivers through Homestead and the Waterfront; Union Pacific's Big Boy No. 4014, the world's largest operating steam locomotive, drew thousands to Homestead's rail lines on its Western Pennsylvania tour before stopping in Leetsdale on its way home. Homestead-area officials warned that weekday rush hour could worsen the congestion.
Sources: KDKA · Pittsburgh Post-Gazette · WPXI · ↑ top
Latest developments: Film composer Danny Elfman, in a Post-Gazette Q&A, discussed the shrinking audience for classical music ahead of an upcoming Pittsburgh appearance.
Danny Elfman, who scored Tim Burton's films, the 1989 'Batman,' and the theme to 'The Simpsons,' spoke with the Post-Gazette about the decline of classical music's audience before a coming performance in Pittsburgh.
Sources: Pittsburgh Post-Gazette · ↑ top
Pirates (49-47)
Sat Jul 11 · Brewers 6 · Pirates 7 · Final
Esmerlyn Valdez's grand slam, two homers lead Pirates past Brewers 7-6 in first game of doubleheader
Sat Jul 11 · Brewers 2 · Pirates 3 · Final
Esmerlyn Valdez homers again as Pirates edge Brewers, 3-2, sweep twinbill from NL Central leaders
Up Next · Brewers @ Pirates · Sun Jul 12, 12:15 PM
Latest developments: The Post-Gazette's 'Off The Bat' charted how the Pirates have already surpassed their entire 2025 home run total, crediting Bryan Reynolds, Brandon Lowe, and Ryan O'Hearn.
The Pittsburgh Pirates, long among baseball's weakest power-hitting teams, have found sustained pop in 2026 from Bryan Reynolds, Brandon Lowe, and Ryan O'Hearn, topping their full 2025 home run count with months of the season left.
Sources: Post-Gazette Pirates · ↑ top
Latest developments: Post-Gazette columnist Noah Hiles argued the Pirates must make better use of right-handed reliever Carmen Mlodzinski, faulting how the club deploys him.
Noah Hiles wrote that the Pittsburgh Pirates are wasting Carmen Mlodzinski by keeping him out of higher-leverage bullpen work, a critique aimed at how general manager Ben Cherington's staff manages its relief corps.
Sources: Post-Gazette Pirates · ↑ top
Latest developments: Greg Hawthorne, the back the Pittsburgh Steelers took in the first round of the 1979 NFL Draft, has died at 69, the Post-Gazette reported.
The Pittsburgh Steelers made Greg Hawthorne their first-round draft pick in 1979, during the closing years of the franchise's Steel Curtain dynasty; he has died at 69.
Sources: Post-Gazette Steelers · ↑ top
S&P 500 7,528.60 ▲ +1.0% Dow 52,690.77 ▲ +0.7% Nasdaq 26,059.80 ▲ +0.8% WTI crude 71.20 ▲ +2.7% EUR/USD 1.1424 ▲ +0.1% GBP/USD 1.3382 ▲ +0.9% USD/JPY 162.21 ▲ +0.1%