daily plain-text briefing: security, markets, business, and pittsburgh
Enterprise patch pressure mounted as SAP shipped critical fixes while researchers exposed unpatched flaws in AI coding tools that read inboxes and run attacker code.
Latest developments: SAP's July 2026 security updates fixed 16 vulnerabilities, including three critical flaws in NetWeaver, Commerce Cloud, and the AppRouter that let attackers read and alter data, knock systems offline, and desynchronize request-response traffic.
SAP runs the core finance, supply-chain, and commerce systems at most large enterprises. Administrators should apply the July notes promptly because the critical bugs threaten both data integrity and availability.
Sources: BleepingComputer · SecurityWeek · ↑ top
Latest developments: SecurityWeek reported that a ClaudeBleed-linked flaw in Claude for Chrome survives eight patches and lets other browser extensions read a user's Gmail and Calendar, while Dark Reading found Cursor still auto-runs malicious code hidden in poisoned repositories seven months after researchers alerted the company in December.
AI coding assistants and browser agents hold broad access to code, inboxes, and calendars, and these unpatched flaws let a poisoned repository or rogue extension turn that access against the user. Treat untrusted repositories and extensions as hostile until the vendors ship fixes.
Sources: SecurityWeek · Dark Reading · ↑ top
Latest developments: BleepingComputer detailed two new phishing kits, Jalisco and OmegaLord, that target Microsoft 365 accounts and defeat multi-factor authentication, alongside the Forg365 service that chains device-code phishing and adversary-in-the-middle session theft.
The kits intercept session tokens to walk past MFA and seize Microsoft 365 mailboxes for extortion. Enforcing phishing-resistant passkeys and tight conditional-access policies blunts them.
Sources: BleepingComputer · The Hacker News · ↑ top
Latest developments: ESET disclosed that eleven Microsoft-signed shims at version 0.9 or below undo Secure Boot on nearly every UEFI PC that trusts them, and Microsoft revoked the vulnerable loaders in its June update.
A shim is a small first-stage loader Microsoft signs so Linux and boot tools run with Secure Boot on, and the outdated versions let an attacker bypass the protection outright. Apply the June revocations and inventory boot media for the old shims.
Sources: Help Net Security · ↑ top
Latest developments: The Pentagon suspended Phase 2 of its Cybersecurity Maturity Model Certification program and stood up a review-and-reform task force to reexamine the contractor security rules.
CMMC sets cybersecurity requirements across the U.S. defense industrial base, and the pause delays enforcement while the task force conducts a comprehensive review. Contractors gain more time before certification requirements take hold.
Sources: SecurityWeek · ↑ top
Latest developments: Dark Reading profiled GigaWiper, a modular implant that borrows code from several malware families to combine backdoor access with destructive wiping, letting each operator choose the damage it inflicts.
GigaWiper hands attackers persistent control and a data-destruction payload in one tool, maximizing impact while keeping their own footprint small. Its modular design lets operators tune the destructive stage per target.
Sources: Dark Reading · ↑ top
Latest developments: June consumer prices rose 3.5% year over year, a sharper cooldown than economists forecast, as tumbling gasoline prices offset the U.S.-Iran oil shock and traders pared bets on Federal Reserve rate rises.
The U.S. consumer-price index climbed 3.5% in the year through June, easing more than expected as falling petrol prices countered the energy spike from the war with Iran; the softer reading tempered fears that Middle East fighting would reignite inflation and force the Federal Reserve to tighten.
Sources: Financial Times · WSJ · ↑ top
Latest developments: JPMorgan, Goldman Sachs, Citigroup, and Bank of America opened earnings season Tuesday with bumper profits driven by an equities-trading boom, signaling a resilient U.S. economy despite the oil-war backdrop.
The largest U.S. banks reported strong quarterly results as booming equities trading lifted profits, a sign of underlying economic strength as the Federal Reserve weighs its rate path during the Iran conflict.
Sources: Financial Times · ↑ top
Today: Sunny, high 94F.
Tonight: Mostly Clear, low 73F.
Wednesday: Mostly Sunny, high 97F.
Latest developments: The Post-Gazette reported June's national inflation cooled to 3.5% as pump prices fell, while warning the renewed Iran war could stall further relief for Pittsburgh-area households.
Lower gasoline prices cut inflation for western Pennsylvania consumers in June, though the Post-Gazette cautioned that the renewed U.S.-Iran war and climbing oil prices could limit further progress at the pump.
Sources: Pittsburgh Post-Gazette · ↑ top
Latest developments: The Post-Gazette profiled a rising class of Pittsburgh restaurateurs, among them John Paradise and Itai Tuti, building the region's dining scene.
Younger Pittsburgh chefs and owners, including John Paradise and Itai Tuti, are opening and running restaurants across the region, pursuing food as a calling in a Post-Gazette feature on the city's dining future.
Sources: Pittsburgh Post-Gazette · ↑ top
Latest developments: KDKA forecasts highs in the 90s Tuesday through Friday—all First Alert Weather Days—with a severe-storm setup possible Saturday, as an air-quality alert covers western Pennsylvania.
The Pittsburgh region faces four straight days of 90-degree heat from Tuesday, July 14, through Friday, with higher heat-index values and a Pennsylvania DEP air-quality alert; forecasters flag Saturday for possible severe storms and the city keeps cooling centers open.
Sources: KDKA · TribLive · ↑ top
Latest developments: Pittsburgh's Bureau of Animal Care and Control and local rescues removed at least 60 cats from a Franklin Road home in Perry North that one volunteer said smelled of 'ammonia and death.'
An ongoing operation pulled dozens of cats—officials estimate at least 60—from a home on Franklin Road in Pittsburgh's Perry North neighborhood, with the Bureau of Animal Care and Control and volunteers including Anna Montano working the scene.
Latest developments: Pittsburgh Magazine spotlighted Frick Park's all-terrain Trackchair program, which lets visitors with limited mobility, including teens Hailey Tucker and Maddock Wall, roll the park's trails together.
Frick Park's Trackchair program offers all-terrain power wheelchairs so people with limited mobility can navigate the park's trails; Pittsburgh Magazine profiled Hailey Tucker and Maddock 'Doc' Wall exploring the outdoors with them.
Sources: Pittsburgh Magazine · ↑ top
Latest developments: The Post-Gazette featured Bloop, a grassroots museum of vintage technology taking shape in Penn Hills.
Bloop, a grassroots museum in Penn Hills, gathers vintage computers and gadgets for enthusiasts to browse, an emerging spot for fans of old technology in the eastern suburbs.
Sources: Post-Gazette Arts & Entertainment · ↑ top
Latest developments: NEXTpittsburgh toured the Andrew Carnegie Free Library & Music Hall in Carnegie, spotlighting its music hall, secret passages, and ghost lore.
The Andrew Carnegie Free Library & Music Hall—the 'Carnegie Carnegie' in Carnegie, Pennsylvania—opens its historic music hall and reputedly haunted passages to visitors, guided by executive director Marlee Gallagher and library staff.
Sources: NEXTpittsburgh Arts & Entertainment · ↑ top
Pirates (50-47)
Up Next · Pirates @ Guardians · Fri Jul 17, 7:10 PM
Latest developments: The Post-Gazette traced Pirates right-hander Braxton Ashcraft's path from a high-school football star through a run of major injuries to his first All-Star selection.
Pirates pitcher Braxton Ashcraft, a onetime gridiron standout who battled serious injuries in the minors, reached the 2026 All-Star Game in Philadelphia as a National League replacement, and the Post-Gazette chronicled the journey.
Sources: Post-Gazette Pirates · ↑ top
Latest developments: ESPN reported growing support to send major-leaguers to the 2028 Los Angeles Olympics runs into disputes with the players' union over tickets and accommodations.
Momentum is building to put big-league players in the 2028 Los Angeles Games, but ESPN sources say disagreements between Major League Baseball and the MLB Players Association over matters like tickets and hotel rooms complicate baseball's Olympic return on home soil.
Sources: ESPN Olympics · ↑ top
Latest developments: ESPN argued the U.S. men's World Cup shortcomings resist a fix through overhauling youth development, suggesting the program is progressing and luck ran against it.
Days after the U.S. men's national team's round-of-16 exit from the home World Cup, ESPN pushed back on calls to remake American youth soccer, contending the United States keeps making progress and simply lacked luck.
Sources: ESPN Soccer · ↑ top
S&P 500 7,524.19 ▲ +0.5% Dow 52,579.32 ▲ +0.1% Nasdaq 26,010.20 = +0.0% WTI crude 73.12 ▲ +5.6% EUR/USD 1.1421 ▲ +0.1% GBP/USD 1.3389 ▲ +0.7% USD/JPY 162.25 ▲ +0.2%