================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Tuesday, July 14, 2026 - 9:08 AM EDT ================================================================ Enterprise patch pressure mounted as SAP shipped critical fixes while researchers exposed unpatched flaws in AI coding tools that read inboxes and run attacker code. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Unpatched flaws pile up in AI developer tools, with Claude for Chrome leaking Gmail and Calendar to rival extensions and Cursor still auto-running poisoned repository code. see: Unpatched Flaws in Claude for Chrome and Cursor * [TREND] Enterprises face a heavy patch load as SAP fixes critical NetWeaver, AppRouter, and Commerce Cloud holes while Microsoft revokes old signed shims that bypass UEFI Secure Boot. see: SAP Patches Critical NetWeaver, AppRouter, and Commerce Cloud Flaws; Old Signed Shims Bypass UEFI Secure Boot * [TREND] New attacker tooling emerged, with the Jalisco and OmegaLord kits punching through Microsoft 365 MFA and the modular GigaWiper implant pairing backdoor access with destructive wiping. see: New Phishing Kits Defeat Microsoft 365 MFA; GigaWiper Modular Backdoor and Wiper * [TREND] June inflation cooled to 3.5% as falling gas prices eased pressure on Pittsburgh households, while JPMorgan and Goldman Sachs led Wall Street to a blockbuster quarter. see: U.S. Inflation Slows to 3.5% in June; Falling Gas Prices Ease Local Inflation; Wall Street Banks Post Blockbuster Quarter * [TREND] Around town, another 90-degree stretch of First Alert Weather Days threatens storms, while Frick Park's Trackchair program rolls visitors with limited mobility onto the trails. see: Another 90-Degree Stretch and Storm Risk; Frick Park Trackchair Program Widens Access * [UPDATE (updated)] Commentary refreshed as Ben Thompson recasts ChatGPT around Codex, Cal Newport defends deep reading, and Ed Zitron skewers the AI memory-crisis narrative. see: The OpenAI Super App, ChatGPT = Codex, Whither Chat; Why Reading Matters; Premium: The Hater's Guide To The Memory Crisis SECURITY ---------------------------------------------------------------- 1. SAP PATCHES CRITICAL NETWEAVER, APPROUTER, AND COMMERCE CLOUD FLAWS Vulnerabilities and Exploits · [patch, vulnerability] Latest developments: SAP's July 2026 security updates fixed 16 vulnerabilities, including three critical flaws in NetWeaver, Commerce Cloud, and the AppRouter that let attackers read and alter data, knock systems offline, and desynchronize request-response traffic. SAP runs the core finance, supply-chain, and commerce systems at most large enterprises. Administrators should apply the July notes promptly because the critical bugs threaten both data integrity and availability. - BleepingComputer: https://www.bleepingcomputer.com/news/security/sap-warns-of-critical-flaws-in-netweaver-and-commerce-cloud/ - SecurityWeek: https://www.securityweek.com/sap-patches-critical-vulnerabilities-in-netweaver-approuter-commerce-cloud/ 2. UNPATCHED FLAWS IN CLAUDE FOR CHROME AND CURSOR AI Security · [ai, vulnerability, zero-day] Latest developments: SecurityWeek reported that a ClaudeBleed-linked flaw in Claude for Chrome survives eight patches and lets other browser extensions read a user's Gmail and Calendar, while Dark Reading found Cursor still auto-runs malicious code hidden in poisoned repositories seven months after researchers alerted the company in December. AI coding assistants and browser agents hold broad access to code, inboxes, and calendars, and these unpatched flaws let a poisoned repository or rogue extension turn that access against the user. Treat untrusted repositories and extensions as hostile until the vendors ship fixes. - SecurityWeek: https://www.securityweek.com/unpatched-claude-for-chrome-flaw-lets-extensions-read-gmail-calendar/ - Dark Reading: https://www.darkreading.com/application-security/cursor-ide-malicious-code-poisoned-repos 3. NEW PHISHING KITS DEFEAT MICROSOFT 365 MFA Ransomware and Cybercrime · [phishing, credential-theft] Latest developments: BleepingComputer detailed two new phishing kits, Jalisco and OmegaLord, that target Microsoft 365 accounts and defeat multi-factor authentication, alongside the Forg365 service that chains device-code phishing and adversary-in-the-middle session theft. The kits intercept session tokens to walk past MFA and seize Microsoft 365 mailboxes for extortion. Enforcing phishing-resistant passkeys and tight conditional-access policies blunts them. - BleepingComputer: https://www.bleepingcomputer.com/news/security/new-phishing-kits-target-microsoft-365-accounts-evade-mfa/ - The Hacker News: https://thehackernews.com/2026/07/forg365-phaas-targets-microsoft-365.html 4. OLD SIGNED SHIMS BYPASS UEFI SECURE BOOT Vulnerabilities and Exploits · [vulnerability, patch] Latest developments: ESET disclosed that eleven Microsoft-signed shims at version 0.9 or below undo Secure Boot on nearly every UEFI PC that trusts them, and Microsoft revoked the vulnerable loaders in its June update. A shim is a small first-stage loader Microsoft signs so Linux and boot tools run with Secure Boot on, and the outdated versions let an attacker bypass the protection outright. Apply the June revocations and inventory boot media for the old shims. - Help Net Security: https://www.helpnetsecurity.com/2026/07/14/eset-uefi-secure-boot-bypass/ 5. PENTAGON SUSPENDS CMMC PHASE 2 Policy and Regulation · [policy] Latest developments: The Pentagon suspended Phase 2 of its Cybersecurity Maturity Model Certification program and stood up a review-and-reform task force to reexamine the contractor security rules. CMMC sets cybersecurity requirements across the U.S. defense industrial base, and the pause delays enforcement while the task force conducts a comprehensive review. Contractors gain more time before certification requirements take hold. - SecurityWeek: https://www.securityweek.com/pentagon-suspends-cmmc-phase-2-as-it-rethinks-contractor-cybersecurity-rules/ 6. GIGAWIPER MODULAR BACKDOOR AND WIPER Ransomware and Cybercrime · [malware, wiper] Latest developments: Dark Reading profiled GigaWiper, a modular implant that borrows code from several malware families to combine backdoor access with destructive wiping, letting each operator choose the damage it inflicts. GigaWiper hands attackers persistent control and a data-destruction payload in one tool, maximizing impact while keeping their own footprint small. Its modular design lets operators tune the destructive stage per target. - Dark Reading: https://www.darkreading.com/cyberattacks-data-breaches/gigawiper-threat-actors-choose-their-own-destructive-attack BUSINESS AND POLITICS ---------------------------------------------------------------- * U.S. Inflation Slows to 3.5% in June Latest developments: June consumer prices rose 3.5% year over year, a sharper cooldown than economists forecast, as tumbling gasoline prices offset the U.S.-Iran oil shock and traders pared bets on Federal Reserve rate rises. The U.S. consumer-price index climbed 3.5% in the year through June, easing more than expected as falling petrol prices countered the energy spike from the war with Iran; the softer reading tempered fears that Middle East fighting would reignite inflation and force the Federal Reserve to tighten. - Financial Times: https://www.ft.com/content/cb3b2887-d805-402b-9c85-55e3b44d867b - WSJ: https://www.wsj.com/livecoverage/stock-market-today-bank-earnings-07-14-2026?mod=rss_markets_main * Wall Street Banks Post Blockbuster Quarter Latest developments: JPMorgan, Goldman Sachs, Citigroup, and Bank of America opened earnings season Tuesday with bumper profits driven by an equities-trading boom, signaling a resilient U.S. economy despite the oil-war backdrop. The largest U.S. banks reported strong quarterly results as booming equities trading lifted profits, a sign of underlying economic strength as the Federal Reserve weighs its rate path during the Iran conflict. - Financial Times: https://www.ft.com/content/f4231724-bb67-4cfd-81e2-d20f4badb82e PITTSBURGH ---------------------------------------------------------------- Weather: Today: Sunny, high 94F. Tonight: Mostly Clear, low 73F. Wednesday: Mostly Sunny, high 97F. Business: * Falling Gas Prices Ease Local Inflation Latest developments: The Post-Gazette reported June's national inflation cooled to 3.5% as pump prices fell, while warning the renewed Iran war could stall further relief for Pittsburgh-area households. Lower gasoline prices cut inflation for western Pennsylvania consumers in June, though the Post-Gazette cautioned that the renewed U.S.-Iran war and climbing oil prices could limit further progress at the pump. - Pittsburgh Post-Gazette: https://www.post-gazette.com/business/money/2026/07/14/cpi-data-inflation-report-june-2026/stories/202607140029 * Next Generation of Pittsburgh Restaurateurs Latest developments: The Post-Gazette profiled a rising class of Pittsburgh restaurateurs, among them John Paradise and Itai Tuti, building the region's dining scene. Younger Pittsburgh chefs and owners, including John Paradise and Itai Tuti, are opening and running restaurants across the region, pursuing food as a calling in a Post-Gazette feature on the city's dining future. - Pittsburgh Post-Gazette: https://www.post-gazette.com/life/dining/2026/07/14/john-paradise-itai-tuti-pittsburgh-chefs/stories/202607080041 Around town: * Another 90-Degree Stretch and Storm Risk Latest developments: KDKA forecasts highs in the 90s Tuesday through Friday—all First Alert Weather Days—with a severe-storm setup possible Saturday, as an air-quality alert covers western Pennsylvania. The Pittsburgh region faces four straight days of 90-degree heat from Tuesday, July 14, through Friday, with higher heat-index values and a Pennsylvania DEP air-quality alert; forecasters flag Saturday for possible severe storms and the city keeps cooling centers open. - KDKA: https://www.cbsnews.com/pittsburgh/news/pittsburgh-area-weather-forecast-high-temperatures-90s/ - TribLive: https://triblive.com/local/morning-roundup-air-quality-alert-issued-for-western-pa-pittsburgh-opens-cooling-centers-amid-heat-wave/ * Dozens of Cats Rescued in Perry North Latest developments: Pittsburgh's Bureau of Animal Care and Control and local rescues removed at least 60 cats from a Franklin Road home in Perry North that one volunteer said smelled of 'ammonia and death.' An ongoing operation pulled dozens of cats—officials estimate at least 60—from a home on Franklin Road in Pittsburgh's Perry North neighborhood, with the Bureau of Animal Care and Control and volunteers including Anna Montano working the scene. - KDKA: https://www.cbsnews.com/pittsburgh/news/pittsburgh-perry-north-cat-rescue/ * Frick Park Trackchair Program Widens Access Latest developments: Pittsburgh Magazine spotlighted Frick Park's all-terrain Trackchair program, which lets visitors with limited mobility, including teens Hailey Tucker and Maddock Wall, roll the park's trails together. Frick Park's Trackchair program offers all-terrain power wheelchairs so people with limited mobility can navigate the park's trails; Pittsburgh Magazine profiled Hailey Tucker and Maddock 'Doc' Wall exploring the outdoors with them. - Pittsburgh Magazine: https://www.pittsburghmagazine.com/trackchair-couple-frick-park/ Events: * Bloop Vintage-Tech Museum in Penn Hills Latest developments: The Post-Gazette featured Bloop, a grassroots museum of vintage technology taking shape in Penn Hills. Bloop, a grassroots museum in Penn Hills, gathers vintage computers and gadgets for enthusiasts to browse, an emerging spot for fans of old technology in the eastern suburbs. - Post-Gazette Arts & Entertainment: https://www.post-gazette.com/business/tech-news/2026/07/13/bloop-penn-hills-grassroots-museum-vintage-technology/stories/202607120088 * Tours at the Carnegie Carnegie Latest developments: NEXTpittsburgh toured the Andrew Carnegie Free Library & Music Hall in Carnegie, spotlighting its music hall, secret passages, and ghost lore. The Andrew Carnegie Free Library & Music Hall—the 'Carnegie Carnegie' in Carnegie, Pennsylvania—opens its historic music hall and reputedly haunted passages to visitors, guided by executive director Marlee Gallagher and library staff. - NEXTpittsburgh Arts & Entertainment: https://nextpittsburgh.com/arts-entertainment/ghosts-and-secret-passages-at-the-carnegie-carnegie/ SPORTS ---------------------------------------------------------------- Pirates (50-47) Up Next · Pirates @ Guardians · Fri Jul 17, 7:10 PM https://plaintextsports.com/mlb/2026-07-17/pit-cle Around the Teams: * Braxton Ashcraft's Road to the All-Star Game Latest developments: The Post-Gazette traced Pirates right-hander Braxton Ashcraft's path from a high-school football star through a run of major injuries to his first All-Star selection. Pirates pitcher Braxton Ashcraft, a onetime gridiron standout who battled serious injuries in the minors, reached the 2026 All-Star Game in Philadelphia as a National League replacement, and the Post-Gazette chronicled the journey. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/07/14/allstar-braxton-ashcraft-football-mlb/stories/202607130045 Team USA: * MLB's 2028 Olympic Bid Hits Union Snags Latest developments: ESPN reported growing support to send major-leaguers to the 2028 Los Angeles Olympics runs into disputes with the players' union over tickets and accommodations. Momentum is building to put big-league players in the 2028 Los Angeles Games, but ESPN sources say disagreements between Major League Baseball and the MLB Players Association over matters like tickets and hotel rooms complicate baseball's Olympic return on home soil. - ESPN Olympics: https://www.espn.com/mlb/story/_/id/49357692/issues-tickets-rooms-complicate-mlb-playing-olympics * Rethinking the USMNT's World Cup Failure Latest developments: ESPN argued the U.S. men's World Cup shortcomings resist a fix through overhauling youth development, suggesting the program is progressing and luck ran against it. Days after the U.S. men's national team's round-of-16 exit from the home World Cup, ESPN pushed back on calls to remake American youth soccer, contending the United States keeps making progress and simply lacked luck. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49353204/the-usmnt-struggles-world-cup-fixed-overhauling-youth-development READING ---------------------------------------------------------------- * Stratechery -- The OpenAI Super App, ChatGPT = Codex, Whither Chat Ben Thompson argues OpenAI has recast Codex as the new face of ChatGPT, and asks whether the company is walking away from the conversational chat category it pioneered. https://stratechery.com/2026/the-openai-super-app-chatgpt-codex-whither-chat/ * Cal Newport -- Why Reading Matters Responding to Rose Horowitch's Atlantic piece 'The End of Reading Is Here,' Newport makes the case that sustained deep reading still matters for thinking and attention. https://calnewport.com/why-reading-matters/ * Ed Zitron -- Premium: The Hater's Guide To The Memory Crisis Zitron delivers a skeptical, detailed takedown of the AI industry's much-hyped 'memory' problem and the narratives being spun around it. https://www.wheresyoured.at/premium-the-haters-guide-to-the-memory-crisis/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,524.19 ▲ +0.5% Dow 52,579.32 ▲ +0.1% Nasdaq 26,010.20 = +0.0% WTI crude 73.12 ▲ +5.6% EUR/USD 1.1421 ▲ +0.1% GBP/USD 1.3389 ▲ +0.7% USD/JPY 162.25 ▲ +0.2% ================================================================ Generated 2026-07-14 09:08 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================