daily plain-text briefing: security, markets, business, and pittsburgh
Attackers worked the software supply chain and developer platforms, spreading an infostealer through a poisoned jscrambler npm release while ghost accounts quietly mapped GitHub organizations.
Latest developments: The Hacker News reported July 11, 2026 that attackers pushed a malicious 8.14.0 release of the widely used jscrambler npm package whose preinstall hook drops and runs a native Rust infostealer on Windows, macOS, and Linux, a build for each; Socket flagged the release six minutes after publication.
jscrambler is a popular JavaScript-protection package, and simply installing its poisoned 8.14.0 version executes a platform-specific binary that harvests data from the machine. Anyone who pulled that version should remove it and rotate every credential the host touched.
Sources: The Hacker News · ↑ top
Latest developments: SecurityWeek reported July 11, 2026 that multiple campaigns use throwaway ghost accounts to abuse the GitHub API and map target organizations, cataloging their repositories and members for reconnaissance.
The recon builds detailed inventories of a company's code and staff that attackers can turn into phishing lures or supply-chain intrusions. GitHub organizations should tighten member and repository visibility and watch for anomalous API scraping.
Sources: SecurityWeek · ↑ top
Latest developments: The Hacker News reported July 11, 2026 that suspected China- and India-aligned threat actors ran sustained cyber espionage against Pakistani law enforcement from February 2024 through April 2026, compromising Balochistan Police servers that host web applications managing criminal and citizen data.
Multiple state-aligned groups broke into police web applications and servers holding criminal records and citizen data across several Pakistani agencies. The targeting shows adversaries mining law-enforcement databases for intelligence value.
Sources: The Hacker News · ↑ top
Latest developments: BleepingComputer reported July 10, 2026 that researchers found six vulnerabilities in the widely deployed U-Boot bootloader that let an attacker run code during device boot, opening the door to stealthy firmware compromise and persistent malware.
U-Boot loads the operating system on countless embedded and Linux devices, and the flaws let an attacker execute code early in the boot chain, defeat security protections, and plant implants that survive reinstalls. Device makers shipping U-Boot should apply the fixes and reflash affected fleets.
Sources: BleepingComputer · ↑ top
Latest developments: Iran answered a fresh round of U.S. strikes by hitting Bahrain, Kuwait, Qatar, Oman, and Jordan, spreading the fight beyond the strait after an Iranian attack set a container ship ablaze and forced its crew to abandon it.
The United States struck Iran early Sunday, July 12, after Iran's Revolutionary Guard fired on a commercial vessel crossing the Strait of Hormuz; President Trump calls the waterway open while Tehran insists it stays closed 'until further notice,' menacing the ceasefire and the roughly fifth of the world's oil that moves through the chokepoint.
Sources: WSJ World News · FT World · WSJ World News · ↑ top
Latest developments: Graham, the hawkish South Carolina Republican and close Trump ally, died Saturday evening, July 11, after a brief and sudden illness, and South Carolina Governor Henry McMaster will move quickly to appoint a successor.
Lindsey Graham, the longtime senator who pressed hard for backing Israel and Ukraine and for tough action against Iran, died at 71 just after returning from a trip to Ukraine; his death hands Governor Henry McMaster a Senate appointment and thins the chamber's Republican majority.
Sources: WSJ Politics · FT World · WSJ Politics · ↑ top
This Afternoon: Mostly Sunny, high 86F.
Tonight: Slight Chance Showers And Thunderstorms then Mostly Clear, low 67F.
Monday: Sunny, high 88F.
Latest developments: Pennsylvania Attorney General Dave Sunday announced Sunday, July 12, a $45 million national settlement with Block, the owner of Cash App, that sends the commonwealth $1,137,695.72.
Block, the company behind the Cash App payment service, reached a $45 million multistate settlement, and Pennsylvania Attorney General Dave Sunday said the commonwealth will collect $1,137,695.72 of it.
Latest developments: A water main break in West Mifflin delayed Kennywood's Sunday, July 12, opening until 1 p.m., and the park reopened once water returned.
Kennywood, the amusement park in West Mifflin, pushed back its Sunday opening to 1 p.m. after a water main break cut service near the grounds, then reopened for the day.
Sources: WTAE · TribLive · ↑ top
Latest developments: The Parkway East shutdown gridlocked Allegheny County through its first weekend, and crews on Saturday, July 11, began breaking apart and hauling off the old Commercial Street Bridge deck.
PennDOT's 25-day closure of the Parkway East (I-376) for the Commercial Street Bridge replacement pushed roughly 100,000 daily drivers onto detours and backed up traffic across Allegheny County as demolition of the old span got underway.
Latest developments: PennDOT and its safety partners kicked off an enforcement campaign against aggressive driving, aiming at speeding, tailgating, and running red lights.
PennDOT and its safety partners began a regional enforcement push targeting aggressive-driving behaviors, singling out speeding, tailgating, and red-light running.
Latest developments: Ahead of the Thursday, July 16 opening, WTAE's '4 The Record' aired a preview with organizers, and Pittsburgh will close the Roberto Clemente and Andy Warhol bridges downtown with traffic detours for the crowds.
Picklesburgh, Pittsburgh's pickle-themed street festival, opens Thursday, July 16 downtown for its 11th year, and the city will shut the Roberto Clemente and Andy Warhol bridges, routing northbound and southbound traffic around the footprint.
Pirates (50-47)
Sat Jul 11 · Brewers 6 · Pirates 7 · Final
Esmerlyn Valdez's grand slam, two homers lead Pirates past Brewers 7-6 in first game of doubleheader
Sat Jul 11 · Brewers 2 · Pirates 3 · Final
Esmerlyn Valdez homers again as Pirates edge Brewers, 3-2, sweep twinbill from NL Central leaders
Sun Jul 12 · Brewers 5 · Pirates 14 · Final
Skenes wins 2nd straight start after 9-game winless slide, Pirates rout Brewers 14-5 with 10-run 4th
Up Next · Pirates @ Guardians · Fri Jul 17, 7:10 PM
Latest developments: Post-Gazette columnist Noah Hiles argued the Pirates must make better use of right-hander Carmen Mlodzinski.
In a Post-Gazette column, Noah Hiles wrote that the Pirates are wasting reliever Carmen Mlodzinski and should hand him more high-leverage bullpen work down the stretch.
Sources: Post-Gazette Pirates · ↑ top
S&P 500 7,528.60 ▲ +1.0% Dow 52,690.77 ▲ +0.7% Nasdaq 26,059.80 ▲ +0.8% WTI crude 71.20 ▲ +2.7% EUR/USD 1.1428 ▲ +0.2% GBP/USD 1.3382 ▲ +0.9% USD/JPY 162.21 ▲ +0.1%