daily plain-text briefing: security, markets, business, and pittsburgh
A poisoned jscrambler npm release seeding a cross-platform infostealer led a day dominated by software supply-chain attacks, China- and India-aligned espionage against Pakistani police, and fresh bootloader flaws.
Latest developments: The Record and The Hacker News reported July 10 and 11, 2026 that suspected China- and India-aligned threat actors ran separate espionage campaigns against Pakistani law enforcement, chiefly the Balochistan Police, breaching servers that hold criminal and citizen records between February 2024 and April 2026 and in some cases hitting the exact same systems.
The targeted force polices Pakistan's southwestern province, the site of a long-running separatist insurgency; the compromised assets ran web applications managing police and citizen data, so investigators should assume broad credential and record theft.
Sources: The Hacker News · The Record · ↑ top
Latest developments: The Hacker News reported July 11, 2026 that attackers compromised the jscrambler npm package so its 8.14.0 release runs a native infostealer on install through a preinstall hook that drops one build each for Windows, macOS, and Linux, with Socket flagging the release six minutes after publication.
jscrambler is a widely used JavaScript obfuscation and protection tool; anyone who installed version 8.14.0 ran the stealer, so teams should remove it, pin to a known-good release, and rotate exposed credentials.
Sources: The Hacker News · ↑ top
Latest developments: SecurityWeek reported July 11, 2026 that multiple campaigns run disposable ghost accounts to abuse the GitHub API, mapping organizations along with their repositories and members at scale for pre-attack reconnaissance.
The throwaway accounts pull repository and membership data through GitHub's API to profile targets before striking; organizations should tighten API rate limits and audit who can enumerate their members.
Sources: SecurityWeek · ↑ top
Latest developments: Firmware security firm Binarly disclosed six new flaws July 10, 2026 in the U-Boot bootloader; four can crash a device, and two let an attacker who plants a malicious image run code before the device boots, opening the door to stealthy, persistent firmware implants.
U-Boot starts the hardware inside home routers, smart cameras, and the management chips in data-center servers; vendors need to ship firmware fixes, because code planted at boot survives operating-system reinstalls.
Sources: BleepingComputer · The Hacker News · ↑ top
Latest developments: Chinese security firm QiAnXin attributed a new Rust-based remote access trojan called MODBEACON to the China-linked Silver Fox group on July 10, 2026, describing malware that uses gRPC streaming to encrypt its command-and-control traffic and spreads through counterfeit installers pushed by search-engine poisoning.
Silver Fox looks like a low-sophistication, high-volume operation, though QiAnXin says its organization runs deeper; users should avoid installers surfaced through search results and verify software sources.
Sources: The Hacker News · ↑ top
Latest developments: American forces launched fresh strikes on Iranian military sites after Tehran again declared the strait closed following a warning shot at a commercial vessel, and Iran said it struck U.S. bases in neighboring Gulf countries.
The United States and Iran traded attacks over the Strait of Hormuz, the chokepoint for roughly a fifth of the world's seaborne oil, with Iran firing on shipping and on targets in Jordan, Oman, Kuwait, Bahrain, and Qatar while U.S. Central Command hit Iranian sites; Washington insists the waterway stays open, keeping a fragile ceasefire near collapse.
Sources: WSJ World News · FT World · ↑ top
Latest developments: Graham died Saturday evening, July 11, of a brief and sudden illness, his office said, leaving his South Carolina Senate seat open for the governor to fill.
Lindsey Graham, the South Carolina Republican who chaired the Senate Judiciary Committee and became one of President Trump's closest allies and the chamber's leading hawk on Iran and Israel, died at 71 after evolving from an early Trump critic into a central pillar of the president's agenda.
Sources: WSJ Politics · FT World · ↑ top
Today: Mostly Sunny, high 87F.
Tonight: Mostly Clear, low 67F.
Monday: Sunny, high 87F.
Latest developments: Attorney General Dave Sunday announced Sunday, July 12, a $45 million multistate settlement with the owner of the mobile-payment app Cash App, with Pennsylvania set to collect $1,137,695.72.
A national settlement resolves state claims against the company behind Cash App; the Commonwealth of Pennsylvania will receive $1,137,695.72 of the $45 million pot.
Latest developments: The distillery at West Overton Village in Westmoreland County launched a historic cherry bounce to mark the nation's 250th anniversary.
West Overton Village's distillery revived cherry bounce, a colonial cherry-infused whiskey, as its contribution to the semiquincentennial, betting on whiskey-making as a draw for the historic site.
Latest developments: On the closure's first full day, thousands who came to Homestead to watch Union Pacific's Big Boy No. 4014 steam locomotive pass through compounded detour gridlock for hours Saturday.
PennDOT's 25-day closure of the Parkway East (I-376) for the Commercial Street Bridge replacement is funneling roughly 100,000 daily vehicles onto detours through Homestead and Munhall, where the Big Boy's passage layered a crowd worse than Christmas onto already jammed streets, Munhall emergency management coordinator Daryyl Hunt said.
Latest developments: PennDOT and its safety partners kicked off an aggressive-driving enforcement campaign targeting speeding, tailgating, and running red lights.
The statewide campaign steps up police enforcement against speeding, tailgating, and red-light running across Pennsylvania roads.
Latest developments: The Westmoreland County city of Jeannette hired three new police officers this week, which officials said should ease the department's ballooning overtime costs.
Jeannette added three officers to its police force in a move officials framed as a way to rein in overtime spending.
Latest developments: Picklesburgh comes back for an 11th year with a bigger festival and new pickle creations.
Picklesburgh, Pittsburgh's pickle-themed food festival, returns larger with fresh pickle concoctions, extending a local obsession the Senator John Heinz History Center traces to Henry John Heinz's 1869 Anchor Pickle and Vinegar Works.
Pirates (49-47)
Sat Jul 11 · Brewers 6 · Pirates 7 · Final
Esmerlyn Valdez's grand slam, two homers lead Pirates past Brewers 7-6 in first game of doubleheader
Sat Jul 11 · Brewers 2 · Pirates 3 · Final
Esmerlyn Valdez homers again as Pirates edge Brewers, 3-2, sweep twinbill from NL Central leaders
Up Next · Brewers @ Pirates · Sun Jul 12, 12:15 PM
Latest developments: Columnist Noah Hiles argued the Pirates and general manager Ben Cherington must give right-handed reliever Carmen Mlodzinski a bigger role.
In a Post-Gazette column, Noah Hiles wrote that the Pirates are wasting Carmen Mlodzinski in the bullpen and should lean on him more heavily as the club sorts out its late-inning arms.
Sources: Post-Gazette Pirates · ↑ top
Latest developments: The Post-Gazette's 'Off The Bat' detailed how the Pirates have already passed their entire 2025 home run total.
The Post-Gazette charted how Bryan Reynolds, Brandon Lowe, and Ryan O'Hearn have driven the Pirates past last season's full home run count, a jolt of power for a lineup that lacked it a year ago.
Sources: Post-Gazette Pirates · ↑ top
S&P 500 7,528.60 ▲ +1.0% Dow 52,690.77 ▲ +0.7% Nasdaq 26,059.80 ▲ +0.8% WTI crude 71.20 ▲ +2.7% EUR/USD 1.1424 ▲ +0.1% GBP/USD 1.3382 ▲ +0.9% USD/JPY 162.21 ▲ +0.1%