daily plain-text briefing: security, markets, business, and pittsburgh
The U.S. Treasury and European allies opened a coordinated sanctions front against ransomware enablers and Russian state hackers as poisoned npm packages and browser extensions turned the software supply chain into the day's broadest attack surface.
Latest developments: The UK and EU jointly sanctioned Russian individuals and entities for the first time over cyberattacks and disinformation, and Dutch intelligence disclosed that a Russian agency is hijacking internet-connected cameras across Europe to watch NATO military logistics and Ukrainian troops.
The moves extend the July 13 CISA-led advisory warning that FSB-linked actors compromise poorly secured routers to build residential proxies inside critical-infrastructure networks; operators should patch and harden edge devices and internet-connected cameras.
Sources: The Record · Dark Reading · SecurityWeek · Ars Technica Security · ↑ top
Latest developments: Researchers disclosed a cluster of registry-based attacks: a backdoored Jscrambler npm package downloaded nearly 1,500 times, 148 npm modules posing as student web proxies that turned browsers into a DDoS botnet for two weeks in May, and the removal of ModHeader, a 1.6-million-install browser extension carrying a dormant browsing-history collector.
The campaigns exploit trust in the npm registry and browser extension stores; a KU Leuven study separately found 85 popular crypto wallet extensions leak addresses and enable cross-site tracking. Audit dependencies and extension permissions.
Sources: BleepingComputer · The Hacker News · The Hacker News · The Hacker News · ↑ top
Latest developments: Microsoft will make passkeys the default sign-in for Entra ID in the public cloud on September 1, 2026, and require SMS or voice users to register a passkey by February 1, 2027, while Google began rolling out FIDO2 security keys and phone passkeys for Windows login through GCPW.
The shifts push enterprise identity toward phishing-resistant authentication as credential-phishing kits proliferate. Administrators should prepare users for passkey enrollment and enforce FIDO2 second factors.
Sources: BleepingComputer · Help Net Security · Help Net Security · Microsoft Security Blog · ↑ top
Latest developments: OFAC sanctioned First VPN Service and its 45-year-old Ukrainian administrator along with a Belarusian seller of malware cryptors, the Treasury's first designation of a VPN provider for enabling ransomware.
First VPN Service, known as 1VPNS, rented anonymizing infrastructure to ransomware crews attacking U.S. organizations; the sanctions freeze the operators' U.S. assets and bar Americans from transacting with them.
Sources: The Hacker News · BleepingComputer · The Record · ↑ top
Latest developments: Jamf Threat Labs identified CrashStealer, a native C++ macOS infostealer that disguises itself as Apple's crash-reporting tool and uses a notarized dropper to pass Gatekeeper, moving from development in May to in-the-wild use by early July.
CrashStealer validates the victim's login password locally, then harvests passwords, Keychain data, and cryptocurrency wallets. Mac users should distrust unexpected crash-report prompts and verify app notarization.
Sources: Help Net Security · The Hacker News · BleepingComputer · ↑ top
Latest developments: Microsoft mapped three Salesforce attack paths from a year of ShinyHunters OAuth abuse, and researchers disclosed OAuth client ID spoofing, a technique two threat actors use to validate stolen Microsoft Entra credentials without generating a sign-in event.
Attackers exploit the OAuth connections tying SaaS platforms to third-party apps, sidestepping platform flaws entirely; separate RabbitMQ access-control bugs can leak the broker's OAuth client secrets and cross tenant boundaries. Review OAuth grants and guest access.
Sources: Microsoft Security Blog · The Hacker News · The Hacker News · ↑ top
Latest developments: One day after floating a 20% toll on cargo crossing the Strait of Hormuz, Trump abandoned the plan Tuesday, saying he will replace it with trade and investment deals from Gulf states, and Brent crude touched $87 after fresh U.S. strikes answered Iranian attacks on tankers.
The United States and Iran are fighting through their most dangerous stretch since an April truce collapsed; Washington launched a new round of strikes after Iranian forces hit commercial tankers in the Strait of Hormuz, the chokepoint for roughly a fifth of the world's oil, driving Brent above $85 and lifting Treasury yields and gold.
Sources: FT World · WSJ World News · FT World · ↑ top
Today: Sunny, high 94F.
Tonight: Mostly Clear, low 73F.
Wednesday: Mostly Sunny, high 97F.
Latest developments: Two technology companies signed leases at Bakery Square in East Liberty, where owner Walnut Capital and the AI Strike Team policy group are branding the development and the surrounding Penn Avenue corridor as "AI Avenue."
Bakery Square, built on the old Nabisco plant in East Liberty, has become a magnet for Pittsburgh tech startups, and Walnut Capital's push recasts the stretch of Penn Avenue as a hub for artificial-intelligence firms.
Latest developments: CNBC's annual "America's Top States for Business" study ranked Pennsylvania 13th, up from 17th in 2025, the state's best showing in 15 years and the highest among Northeastern states.
The CNBC ranking grades states on economy, workforce, infrastructure, and cost, and Pennsylvania's climb marks a rebound for a state that has trailed its neighbors.
Latest developments: The David L. Lawrence Convention Center Downtown netted more than $600,000 in May, lifted by steel-industry gatherings and volleyball tournaments.
The Downtown Pittsburgh convention center's May surplus points to a busy events calendar drawing trade shows and tournaments back to the riverfront hall.
Latest developments: Four days into the 25-day Parkway East closure, PennDOT says it has flagged several traffic pinch points and is adjusting signals around the clock from its command center as drivers hunt for routes around Homestead and Swissvale.
PennDOT closed the Parkway East (I-376) on July 10 to slide a new Commercial Street Bridge into place, diverting roughly 100,000 daily drivers onto surface streets and Route 28 through August 3.
Latest developments: Pittsburgh opened cooling centers Tuesday as highs return to the 90s from July 14 through Friday, all First Alert Weather Days, under a Code Orange air-quality alert and a Code Red heat advisory across parts of southwestern Pennsylvania.
A heat dome parked over the region pushes heat-index values toward 100, prompting the city to open cooling stations while the Pennsylvania DEP warns of unhealthy ozone.
Latest developments: ScareHouse, the nationally known Pittsburgh haunted attraction, is partnering with The Plaza at North Shore to launch a Halloween destination called the "Halloween Hangout."
The collaboration gives ScareHouse a new seasonal home on the North Shore, adding a fall draw to the retail and entertainment complex near the stadiums.
Latest developments: Picklesburgh, the pickle-themed festival that USA Today readers have voted the country's No. 1 specialty food festival four times, runs Thursday, July 16, through Sunday, July 19, at multiple Pittsburgh locations.
Picklesburgh serves handcrafted food and artisan drinks built around pickled ingredients from local chefs and restaurants, drawing crowds across several Downtown and neighborhood sites.
Sources: Pittsburgh Magazine · ↑ top
Pirates (50-47)
Up Next · Pirates @ Guardians · Fri Jul 17, 7:10 PM
Latest developments: American gymnastics star Suni Lee announced on Instagram Tuesday she is returning to the sport to chase a third Olympics at the 2028 Los Angeles Games, roughly two years out.
Lee, the Olympic all-around champion, steps back toward elite competition as the U.S. gymnastics program builds toward a home Games in Los Angeles.
Sources: ESPN Olympics · ↑ top
Latest developments: U.S. striker Folarin Balogun signed with LeBron James's agency Klutch Sports after a breakout 2026 World Cup that raised his profile on and off the field.
Balogun, the Monaco forward whose red-card suspension Trump lobbied FIFA to overturn, emerged as a standout of the American run before the round-of-16 exit to Belgium.
Sources: ESPN Soccer · ↑ top
S&P 500 7,524.19 ▲ +0.5% Dow 52,579.32 ▲ +0.1% Nasdaq 26,010.20 = +0.0% WTI crude 73.12 ▲ +5.6% EUR/USD 1.1421 ▲ +0.1% GBP/USD 1.3389 ▲ +0.7% USD/JPY 162.25 ▲ +0.2%