daily plain-text briefing: security, markets, business, and pittsburgh
Microsoft attributed a record 570-flaw Patch Tuesday—two zero-days already under attack—to AI-assisted bug discovery, as SAP, Adobe, VMware, SonicWall, and Progress piled critical fixes onto the same day.
Latest developments: Microsoft fixed 570 vulnerabilities on July 14, 2026—nearly triple June's record and 622 counting Chromium fixes in Edge—crediting AI-assisted discovery, and warned that two zero-days in Active Directory and SharePoint Server are already exploited while a BitLocker bug went public before the patch.
The July release patches 62 critical flaws and the actively attacked SharePoint remote-code-execution bugs CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164, which CISA separately urged on-premises SharePoint Server 2016, 2019, and Subscription Edition operators to harden. Administrators should apply the Windows and SharePoint updates immediately.
Sources: Krebs on Security · BleepingComputer · SecurityWeek · CISA Advisories · ↑ top
Latest developments: On July 14, 2026 SAP fixed 16 flaws including the CVSS 9.9 NetWeaver Application Server ABAP out-of-bounds write CVE-2026-44747 plus critical Commerce Cloud and AppRouter bugs, Adobe patched critical ColdFusion code-execution and privilege-escalation defects, and VMware repaired seven severe Avi Load Balancer vulnerabilities.
The flaws span authentication bypass, remote code execution, privilege escalation, and directory traversal across widely deployed business software. Enterprises running SAP NetWeaver, ColdFusion, or VMware Avi should prioritize these fixes alongside the Microsoft rollout.
Sources: The Hacker News · SecurityWeek · SecurityWeek · BleepingComputer · ↑ top
Latest developments: Researchers reported on July 14, 2026 that a ClaudeBleed-linked flaw survives eight patches and lets any extension running on claude.ai trigger Claude for Chrome to read a victim's Gmail, Google Docs, and Calendar, that Cursor still auto-executes malicious code from poisoned repositories despite a December report, and that xAI's Grok Build CLI uploaded entire Git repositories, full commit history included, to a Google Cloud Storage bucket.
Agentic AI coding and browsing tools expose data through over-broad permissions and unsafe defaults. Anthropic, Cursor, and xAI users should restrict which extensions load, avoid opening untrusted repositories in AI IDEs, and audit what these agents transmit.
Sources: The Hacker News · SecurityWeek · Dark Reading · The Hacker News · ↑ top
Latest developments: On July 14, 2026 researchers found a threat actor running nearly 300 GitHub repositories that impersonate legitimate software and security projects to push infostealers, Blackpoint Cyber documented the new Rust-based LabubaRAT masquerading as NVIDIA software to seize Windows hosts, and two phishing kits, Jalisco and OmegaLord, surfaced defeating multi-factor authentication on Microsoft 365 accounts.
The campaigns lean on trust in familiar brands, from GitHub projects and NVIDIA drivers to LastPass and Bitwarden security alerts, to harvest credentials and deploy malware. Users should download software only from verified sources, distrust unsolicited password-manager warnings, and pair MFA with phishing-resistant authentication.
Sources: BleepingComputer · The Hacker News · BleepingComputer · BleepingComputer · ↑ top
Latest developments: SonicWall patched two exploited flaws, CVE-2026-15409 and CVE-2026-15410, in its Secure Mobile Access 1000 Series appliances on July 14, 2026, while Progress Software confirmed a high-severity zero-day drove last week's emergency shutdown of ShareFile Storage Zone Controllers and released a fix.
Both vendors sell internet-facing remote-access gear that attackers reach directly. SonicWall tells organizations showing its indicators of compromise to reimage hardware or redeploy virtual appliances and reset all user and administrator passwords; ShareFile customers should apply the new patch and rebuild affected Windows servers.
Sources: Help Net Security · BleepingComputer · ↑ top
Latest developments: ESET researchers disclosed on July 14, 2026 that 11 old Microsoft-signed Linux UEFI shims, all version 0.9 or below, let attackers run untrusted code during boot and plant bootkits on most Secure Boot systems; Microsoft revoked them in its June update.
A shim is a small first-stage loader Microsoft signs so Linux and boot tools launch under Secure Boot. Because nearly every UEFI machine trusts that certificate, the vulnerable shims undo the protection; the number of systems still carrying them is unknown, so administrators should apply the revocation and firmware updates.
Sources: The Hacker News · Help Net Security · ↑ top
Latest developments: June consumer prices rose 3.5%, below expectations as petrol prices tumbled, and traders pulled their bets on a July Federal Reserve rate increase.
U.S. consumer inflation fell more than forecast to 3.5% in June as energy costs eased from the Middle East war, sending Treasury yields and the dollar lower; Fed chair Kevin Warsh told Congress the central bank will stay 'resolute' on inflation and gave no signal of imminent tightening.
Sources: FT World · FT World · WSJ Markets · ↑ top
Latest developments: JPMorgan, Goldman Sachs, Citigroup, and Bank of America opened earnings season Tuesday with blockbuster results powered by an equities-trading boom.
The four largest U.S. banks reported surging profits on record stock-trading revenue tied to the AI frenzy and the SpaceX IPO; JPMorgan chief Jamie Dimon said conditions were nearly 'as good as it gets.'
Sources: FT World · WSJ Markets · ↑ top
This Afternoon: Sunny, high 92F.
Tonight: Mostly Clear, low 73F.
Wednesday: Sunny, high 96F.
Latest developments: Colorado-based Voyager Technologies completed its acquisition of North Side lunar-robotics firm Astrobotic on Tuesday, keeping the operation in Pittsburgh.
Voyager Technologies of Colorado finalized its purchase of Astrobotic, the North Side company building lunar landers and moon-base technology; John Thornton, executive vice president of lunar systems, said Pittsburgh will help build a base on the moon.
Latest developments: Developer DESRI is advancing a large battery-storage project on the former Little Blue Run coal-ash disposal site to feed the PJM grid.
A big battery-storage project backed by DESRI targets the former Little Blue Run coal-ash impoundment, aiming to store power for the PJM Interconnection grid as electricity demand climbs across the region.
Sources: Pittsburgh Post-Gazette · ↑ top
Latest developments: A buyer could emerge for Schwebel Baking Company after the bread maker announced plans to wind down its operation.
Schwebel Baking Company, which said it would wind down, may draw a purchaser, the Post-Gazette reported, offering a possible reprieve for its workers.
Sources: Pittsburgh Post-Gazette · ↑ top
Latest developments: PennDOT will explosively demolish the Interstate 376 Commercial Street Bridge on Wednesday, July 15, between 1 p.m. and 9 p.m., weather permitting.
PennDOT plans to implode the Commercial Street Bridge over the Parkway East on July 15 once crews clear the blast radius on the ground and in the air, advancing the 25-day Interstate 376 replacement project that has detoured hundreds of thousands of drivers off at the Wilkinsburg and Oakland exits.
Sources: Pittsburgh Post-Gazette · KDKA · ↑ top
Latest developments: County Executive Sara Innamorato named Deputy Warden Connie Clark interim warden of the Allegheny County Jail, effective August 1, as Warden Trevor Wingard departs for another job.
Connie Clark, a deputy warden, will run the Allegheny County Jail on an interim basis starting August 1, replacing Trevor Wingard, who is leaving Pittsburgh for a new position.
Sources: Pittsburgh Post-Gazette · WPXI · ↑ top
Latest developments: A report to Pennsylvania legislators warns the state's nation-leading online casino industry is fueling a growing gambling-addiction problem.
PublicSource reports that Pennsylvania's online gambling industry, the largest in the country, generates billions in revenue while worsening addiction; the report presses lawmakers to choose between collecting more data and imposing prompt limits that could cut that revenue.
Sources: PublicSource · ↑ top
Latest developments: The Post-Gazette profiled Bloop, a burgeoning grassroots museum of vintage technology in Penn Hills.
Bloop, a grassroots museum in Penn Hills, showcases a growing collection of vintage computers and electronics for the public to explore.
Sources: Post-Gazette Arts & Entertainment · ↑ top
Pirates (50-47)
Up Next · Pirates @ Guardians · Fri Jul 17, 7:10 PM
Latest developments: The Post-Gazette detailed Pirates pitcher Braxton Ashcraft's path from football stardom through injuries to his first All-Star appearance.
Pirates right-hander Braxton Ashcraft, a former gridiron standout who fought back through a string of injuries, reached his first All-Star Game as a National League replacement, the Post-Gazette recounted.
Sources: Post-Gazette Pirates · ↑ top
Latest developments: USA Basketball is expected to name the Thunder's Mark Daigneault, the Pistons' JB Bickerstaff, and Gonzaga's Mark Few as assistant coaches under head coach Erik Spoelstra for the 2028 Olympic team, ESPN reported Tuesday.
The men's national basketball team will pair head coach Erik Spoelstra with assistants Mark Daigneault of Oklahoma City, JB Bickerstaff of Detroit, and Mark Few of Gonzaga heading into the Los Angeles 2028 Games, sources told ESPN's Shams Charania.
Sources: ESPN Olympics · ↑ top
Latest developments: U.S. striker Folarin Balogun said he predicted President Trump's role in overturning his World Cup suspension would 'cause a lot of controversy' and that the outside noise proved hard for teammates to avoid.
Folarin Balogun, sent off in the United States' round-of-32 loss to Bosnia and Herzegovina, had his one-match ban suspended after Trump called FIFA president Gianni Infantino; the Monaco forward said the reversal created outside noise that weighed on the squad.
Sources: ESPN Soccer · Guardian World Cup 2026 · ↑ top
Latest developments: Support is growing for Major League Baseball to join the 2028 Los Angeles Olympics, but disagreements with the players' union over tickets and hotel rooms complicate participation, sources told ESPN.
Major League Baseball's potential appearance at the LA 2028 Olympics faces hurdles with the MLB Players Association over logistics including tickets and rooms, ESPN sources said, clouding whether big leaguers will play for Team USA.
Sources: ESPN Olympics · ↑ top
S&P 500 7,524.19 ▲ +0.5% Dow 52,579.32 ▲ +0.1% Nasdaq 26,010.20 = +0.0% WTI crude 73.12 ▲ +5.6% EUR/USD 1.1410 ▼ -0.1% GBP/USD 1.3379 ▲ +0.4% USD/JPY 162.31 ▲ +0.2%