================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Sunday, July 12, 2026 - 4:06 PM EDT ================================================================ Attackers worked the software supply chain and developer platforms, spreading an infostealer through a poisoned jscrambler npm release while ghost accounts quietly mapped GitHub organizations. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Attackers are working the developer supply chain, with a poisoned jscrambler npm release dropping a Rust infostealer while ghost accounts abuse the GitHub API to map organizations. see: Compromised jscrambler npm Package Drops Infostealer; Ghost Accounts Map GitHub Organizations * [TREND] Six fresh U-Boot bootloader flaws push the fight below the operating system, where boot-time code survives reinstalls and evades ordinary defenses. see: U-Boot Bootloader Flaws Enable Firmware Attacks * [TREND] State-aligned actors keep treating law-enforcement databases as intelligence goldmines, with sustained espionage compromising Balochistan Police servers across Pakistan. see: Espionage Campaigns Hit Pakistani Police Systems * [UPDATE (updated)] Iran widened its Hormuz war by striking Bahrain, Kuwait, Qatar, Oman, and Jordan after fresh U.S. strikes and an attack that set a container ship ablaze. see: U.S. and Iran Widen Hormuz War to Gulf Arab States * [UPDATE (new)] Senator Lindsey Graham, the hawkish South Carolina Republican and close Trump ally, died at 71, and Governor McMaster will move quickly to appoint a successor. see: Senator Lindsey Graham Dies at 71 * [UPDATE (new)] Pittsburgh-area traffic tightened as the Parkway East closure gridlocked Allegheny County and PennDOT launched an aggressive-driving crackdown on speeding and tailgating. see: Parkway East Closure Snarls Allegheny County; PennDOT Launches Aggressive-Driving Crackdown SECURITY ---------------------------------------------------------------- 1. COMPROMISED JSCRAMBLER NPM PACKAGE DROPS INFOSTEALER Ransomware and Cybercrime · [supply-chain, npm, malware] Latest developments: The Hacker News reported July 11, 2026 that attackers pushed a malicious 8.14.0 release of the widely used jscrambler npm package whose preinstall hook drops and runs a native Rust infostealer on Windows, macOS, and Linux, a build for each; Socket flagged the release six minutes after publication. jscrambler is a popular JavaScript-protection package, and simply installing its poisoned 8.14.0 version executes a platform-specific binary that harvests data from the machine. Anyone who pulled that version should remove it and rotate every credential the host touched. - The Hacker News: https://thehackernews.com/2026/07/compromised-jscrambler-8140-npm-release.html 2. GHOST ACCOUNTS MAP GITHUB ORGANIZATIONS Ransomware and Cybercrime · [reconnaissance, github] Latest developments: SecurityWeek reported July 11, 2026 that multiple campaigns use throwaway ghost accounts to abuse the GitHub API and map target organizations, cataloging their repositories and members for reconnaissance. The recon builds detailed inventories of a company's code and staff that attackers can turn into phishing lures or supply-chain intrusions. GitHub organizations should tighten member and repository visibility and watch for anomalous API scraping. - SecurityWeek: https://www.securityweek.com/ghost-accounts-abuse-github-api-in-mass-recon-campaign/ 3. ESPIONAGE CAMPAIGNS HIT PAKISTANI POLICE SYSTEMS Nation-State Activity · [apt, espionage] Latest developments: The Hacker News reported July 11, 2026 that suspected China- and India-aligned threat actors ran sustained cyber espionage against Pakistani law enforcement from February 2024 through April 2026, compromising Balochistan Police servers that host web applications managing criminal and citizen data. Multiple state-aligned groups broke into police web applications and servers holding criminal records and citizen data across several Pakistani agencies. The targeting shows adversaries mining law-enforcement databases for intelligence value. - The Hacker News: https://thehackernews.com/2026/07/hackers-weaponize-balochistan-police.html 4. U-BOOT BOOTLOADER FLAWS ENABLE FIRMWARE ATTACKS Vulnerabilities and Exploits · [firmware, vulnerability, iot] Latest developments: BleepingComputer reported July 10, 2026 that researchers found six vulnerabilities in the widely deployed U-Boot bootloader that let an attacker run code during device boot, opening the door to stealthy firmware compromise and persistent malware. U-Boot loads the operating system on countless embedded and Linux devices, and the flaws let an attacker execute code early in the boot chain, defeat security protections, and plant implants that survive reinstalls. Device makers shipping U-Boot should apply the fixes and reflash affected fleets. - BleepingComputer: https://www.bleepingcomputer.com/news/security/new-u-boot-flaws-could-enable-stealthy-firmware-attacks/ BUSINESS AND POLITICS ---------------------------------------------------------------- * U.S. and Iran Widen Hormuz War to Gulf Arab States Latest developments: Iran answered a fresh round of U.S. strikes by hitting Bahrain, Kuwait, Qatar, Oman, and Jordan, spreading the fight beyond the strait after an Iranian attack set a container ship ablaze and forced its crew to abandon it. The United States struck Iran early Sunday, July 12, after Iran's Revolutionary Guard fired on a commercial vessel crossing the Strait of Hormuz; President Trump calls the waterway open while Tehran insists it stays closed 'until further notice,' menacing the ceasefire and the roughly fifth of the world's oil that moves through the chokepoint. - WSJ World News: https://www.wsj.com/world/middle-east/u-s-launches-new-strikes-on-iran-after-hormuz-tensions-escalate-d6903c7f - FT World: https://www.ft.com/content/6b6c23e9-f24e-4c3e-bb1a-e5cb6860008d - WSJ World News: https://www.wsj.com/world/middle-east/https-www-wsj-com-world-middle-east-iran-deal-strait-of-hormuz-b027c30f-580ee99f * Senator Lindsey Graham Dies at 71 Latest developments: Graham, the hawkish South Carolina Republican and close Trump ally, died Saturday evening, July 11, after a brief and sudden illness, and South Carolina Governor Henry McMaster will move quickly to appoint a successor. Lindsey Graham, the longtime senator who pressed hard for backing Israel and Ukraine and for tough action against Iran, died at 71 just after returning from a trip to Ukraine; his death hands Governor Henry McMaster a Senate appointment and thins the chamber's Republican majority. - WSJ Politics: https://www.wsj.com/politics/lindsey-graham-republican-senator-dies-71-bd02a353 - FT World: https://www.ft.com/content/b3b93565-652a-41e9-aabd-9ed35309bdeb - WSJ Politics: https://www.wsj.com/politics/policy/the-scramble-to-replace-lindsey-graham-after-his-sudden-death-ad036b76 PITTSBURGH ---------------------------------------------------------------- Weather: This Afternoon: Mostly Sunny, high 86F. Tonight: Slight Chance Showers And Thunderstorms then Mostly Clear, low 67F. Monday: Sunny, high 88F. Business: * Cash App Owner Settles for $45 Million Latest developments: Pennsylvania Attorney General Dave Sunday announced Sunday, July 12, a $45 million national settlement with Block, the owner of Cash App, that sends the commonwealth $1,137,695.72. Block, the company behind the Cash App payment service, reached a $45 million multistate settlement, and Pennsylvania Attorney General Dave Sunday said the commonwealth will collect $1,137,695.72 of it. - WPXI: https://www.wpxi.com/news/local/attorney-general-sunday-announces-45-million-national-settlement-with-cash-app-owner/JTYVKD6BFVAKBP4BVE7VULBR7M/ * Water Main Break Briefly Shuts Kennywood Latest developments: A water main break in West Mifflin delayed Kennywood's Sunday, July 12, opening until 1 p.m., and the park reopened once water returned. Kennywood, the amusement park in West Mifflin, pushed back its Sunday opening to 1 p.m. after a water main break cut service near the grounds, then reopened for the day. - WTAE: https://www.wtae.com/article/kennywood-delays-sunday-opening-water-main-break-west-mifflin/71909547 - TribLive: https://triblive.com/local/regional/waterline-break-impact-kennywood-pass-holders/ Around town: * Parkway East Closure Snarls Allegheny County Latest developments: The Parkway East shutdown gridlocked Allegheny County through its first weekend, and crews on Saturday, July 11, began breaking apart and hauling off the old Commercial Street Bridge deck. PennDOT's 25-day closure of the Parkway East (I-376) for the Commercial Street Bridge replacement pushed roughly 100,000 daily drivers onto detours and backed up traffic across Allegheny County as demolition of the old span got underway. - WTAE: https://www.wtae.com/article/parkway-east-closure-prompts-traffic-backups-around-pittsburgh/71908113 - WTAE: https://www.wtae.com/article/deck-old-commercial-street-bridge-removed-replacement-project/71909794 * PennDOT Launches Aggressive-Driving Crackdown Latest developments: PennDOT and its safety partners kicked off an enforcement campaign against aggressive driving, aiming at speeding, tailgating, and running red lights. PennDOT and its safety partners began a regional enforcement push targeting aggressive-driving behaviors, singling out speeding, tailgating, and red-light running. - WPXI: https://www.wpxi.com/news/local/penndot-safety-partners-kick-off-aggressive-driving-enforcement-campaign/D5Z6IRVOIZDGBMMMT3D67MNW6A/ Events: * Picklesburgh Returns July 16 Latest developments: Ahead of the Thursday, July 16 opening, WTAE's '4 The Record' aired a preview with organizers, and Pittsburgh will close the Roberto Clemente and Andy Warhol bridges downtown with traffic detours for the crowds. Picklesburgh, Pittsburgh's pickle-themed street festival, opens Thursday, July 16 downtown for its 11th year, and the city will shut the Roberto Clemente and Andy Warhol bridges, routing northbound and southbound traffic around the footprint. - WTAE: https://www.wtae.com/article/very-uniquely-pittsburgh-picklesburgh-festival-set-to-kick-off-on-july-16/71875193 - WPXI: https://www.wpxi.com/news/local/roberto-clemente-andy-warhol-bridges-close-picklesburgh/HJHYOUE5D5B2NLQRYW74NBQJ2M/ SPORTS ---------------------------------------------------------------- Pirates (50-47) Sat Jul 11 · Brewers 6 · Pirates 7 · Final Esmerlyn Valdez's grand slam, two homers lead Pirates past Brewers 7-6 in first game of doubleheader https://plaintextsports.com/mlb/2026-07-11/mil-pit Sat Jul 11 · Brewers 2 · Pirates 3 · Final Esmerlyn Valdez homers again as Pirates edge Brewers, 3-2, sweep twinbill from NL Central leaders https://plaintextsports.com/mlb/2026-07-11/mil-pit Sun Jul 12 · Brewers 5 · Pirates 14 · Final Skenes wins 2nd straight start after 9-game winless slide, Pirates rout Brewers 14-5 with 10-run 4th https://plaintextsports.com/mlb/2026-07-12/mil-pit Up Next · Pirates @ Guardians · Fri Jul 17, 7:10 PM https://plaintextsports.com/mlb/2026-07-17/pit-cle Around the Teams: * Hiles: Pirates Should Lean on Mlodzinski Latest developments: Post-Gazette columnist Noah Hiles argued the Pirates must make better use of right-hander Carmen Mlodzinski. In a Post-Gazette column, Noah Hiles wrote that the Pirates are wasting reliever Carmen Mlodzinski and should hand him more high-leverage bullpen work down the stretch. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/07/11/hiles-column-mlodzinski-bullpen-mlb-kelly-cherington/stories/202607110014 READING ---------------------------------------------------------------- * Ed Zitron -- Premium: The Hater's Guide To The Memory Crisis Zitron's skeptical guide picks apart the narrative of an AI-driven computer-memory shortage, arguing the panic over surging prices owes more to industry hype than to a genuine crisis. https://www.wheresyoured.at/premium-the-haters-guide-to-the-memory-crisis/ * Stratechery -- Muse Image, Grok 4.5, Alex Karp on CNBC Ben Thompson argues the fight over verifiable data increasingly defines the AI race, running from Meta's Muse image model through xAI's Grok 4.5 to the frontier labs. https://stratechery.com/2026/muse-image-grok-4-5-alex-karp-on-cnbc/ * Cal Newport -- Beware of Productivity Paradoxes Newport argues that seemingly can't-miss technologies like the personal computer often fail to deliver their promised productivity gains, a caution he extends to today's tools. https://calnewport.com/beware-of-productivity-paradoxes/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,528.60 ▲ +1.0% Dow 52,690.77 ▲ +0.7% Nasdaq 26,059.80 ▲ +0.8% WTI crude 71.20 ▲ +2.7% EUR/USD 1.1428 ▲ +0.2% GBP/USD 1.3382 ▲ +0.9% USD/JPY 162.21 ▲ +0.1% ================================================================ Generated 2026-07-12 16:06 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================