================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Tuesday, July 14, 2026 - 4:05 PM EDT ================================================================ Microsoft attributed a record 570-flaw Patch Tuesday—two zero-days already under attack—to AI-assisted bug discovery, as SAP, Adobe, VMware, SonicWall, and Progress piled critical fixes onto the same day. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] AI-assisted bug hunting drove Microsoft's record 570-flaw Patch Tuesday while SAP, Adobe, and VMware rushed critical enterprise fixes including a CVSS 9.9 NetWeaver flaw. see: Microsoft Ships a Record 570-Flaw Patch Tuesday; SAP, Adobe, and VMware Rush Critical Enterprise Patches * [UPDATE (new)] SonicWall patched two exploited flaws in its SMA 1000 appliances while Progress confirmed a ShareFile zero-day forced last week's emergency shutdown. see: SonicWall and ShareFile Zero-Days Under Active Attack * [TREND] AI coding and browser assistants keep leaking data, with a ClaudeBleed flaw exposing Gmail through Claude for Chrome and Cursor auto-running untrusted repo code. see: AI Assistants Leak User Data and Run Untrusted Code * [UPDATE (new)] A threat actor ran nearly 300 fake GitHub repositories pushing infostealers alongside the new Rust-based LabubaRAT documented by Blackpoint Cyber. see: Fake GitHub Repos, RATs, and Phishing Kits Spread Infostealers * [UPDATE (new)] ESET found 11 old Microsoft-signed Linux UEFI shims reopen the Secure Boot bypass, letting attackers plant bootkits until Microsoft revoked them. see: Old Signed Shims Reopen the UEFI Secure Boot Bypass * [UPDATE (new)] Locally, PennDOT will implode the I-376 Commercial Street Bridge Wednesday, and Allegheny County named Connie Clark interim jail warden. see: Commercial Street Bridge Implosion Set for Wednesday; Allegheny County Names Interim Jail Warden SECURITY ---------------------------------------------------------------- 1. MICROSOFT SHIPS A RECORD 570-FLAW PATCH TUESDAY Vulnerabilities and Exploits · [patch, zero-day] Latest developments: Microsoft fixed 570 vulnerabilities on July 14, 2026—nearly triple June's record and 622 counting Chromium fixes in Edge—crediting AI-assisted discovery, and warned that two zero-days in Active Directory and SharePoint Server are already exploited while a BitLocker bug went public before the patch. The July release patches 62 critical flaws and the actively attacked SharePoint remote-code-execution bugs CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164, which CISA separately urged on-premises SharePoint Server 2016, 2019, and Subscription Edition operators to harden. Administrators should apply the Windows and SharePoint updates immediately. - Krebs on Security: https://krebsonsecurity.com/2026/07/microsoft-patches-a-record-570-security-flaws/ - BleepingComputer: https://www.bleepingcomputer.com/news/microsoft/microsoft-july-2026-patch-tuesday-fixes-massive-570-flaws-3-zero-days/ - SecurityWeek: https://www.securityweek.com/microsoft-patches-record-622-vulnerabilities-including-two-exploited-zero-days/ - CISA Advisories: https://www.cisa.gov/news-events/alerts/2026/07/14/cisa-urges-sharepoint-hardening-after-new-exploitations 2. SAP, ADOBE, AND VMWARE RUSH CRITICAL ENTERPRISE PATCHES Vulnerabilities and Exploits · [patch, vulnerability] Latest developments: On July 14, 2026 SAP fixed 16 flaws including the CVSS 9.9 NetWeaver Application Server ABAP out-of-bounds write CVE-2026-44747 plus critical Commerce Cloud and AppRouter bugs, Adobe patched critical ColdFusion code-execution and privilege-escalation defects, and VMware repaired seven severe Avi Load Balancer vulnerabilities. The flaws span authentication bypass, remote code execution, privilege escalation, and directory traversal across widely deployed business software. Enterprises running SAP NetWeaver, ColdFusion, or VMware Avi should prioritize these fixes alongside the Microsoft rollout. - The Hacker News: https://thehackernews.com/2026/07/sap-patches-cvss-99-netweaver-abap-flaw.html - SecurityWeek: https://www.securityweek.com/adobe-patches-critical-coldfusion-vulnerabilities/ - SecurityWeek: https://www.securityweek.com/7-severe-vulnerabilities-patched-in-vmware-avi-load-balancer/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/sap-warns-of-critical-flaws-in-netweaver-and-commerce-cloud/ 3. AI ASSISTANTS LEAK USER DATA AND RUN UNTRUSTED CODE AI Security · [ai, vulnerability] Latest developments: Researchers reported on July 14, 2026 that a ClaudeBleed-linked flaw survives eight patches and lets any extension running on claude.ai trigger Claude for Chrome to read a victim's Gmail, Google Docs, and Calendar, that Cursor still auto-executes malicious code from poisoned repositories despite a December report, and that xAI's Grok Build CLI uploaded entire Git repositories, full commit history included, to a Google Cloud Storage bucket. Agentic AI coding and browsing tools expose data through over-broad permissions and unsafe defaults. Anthropic, Cursor, and xAI users should restrict which extensions load, avoid opening untrusted repositories in AI IDEs, and audit what these agents transmit. - The Hacker News: https://thehackernews.com/2026/07/claude-for-chrome-flaw-lets-other.html - SecurityWeek: https://www.securityweek.com/unpatched-claude-for-chrome-flaw-lets-extensions-read-gmail-calendar/ - Dark Reading: https://www.darkreading.com/application-security/cursor-ide-malicious-code-poisoned-repos - The Hacker News: https://thehackernews.com/2026/07/grok-build-uploads-entire-git.html 4. FAKE GITHUB REPOS, RATS, AND PHISHING KITS SPREAD INFOSTEALERS Ransomware and Cybercrime · [malware, phishing] Latest developments: On July 14, 2026 researchers found a threat actor running nearly 300 GitHub repositories that impersonate legitimate software and security projects to push infostealers, Blackpoint Cyber documented the new Rust-based LabubaRAT masquerading as NVIDIA software to seize Windows hosts, and two phishing kits, Jalisco and OmegaLord, surfaced defeating multi-factor authentication on Microsoft 365 accounts. The campaigns lean on trust in familiar brands, from GitHub projects and NVIDIA drivers to LastPass and Bitwarden security alerts, to harvest credentials and deploy malware. Users should download software only from verified sources, distrust unsolicited password-manager warnings, and pair MFA with phishing-resistant authentication. - BleepingComputer: https://www.bleepingcomputer.com/news/security/nearly-300-github-repos-pose-as-legit-software-to-push-malware/ - The Hacker News: https://thehackernews.com/2026/07/labubarat-masquerades-as-nvidia.html - BleepingComputer: https://www.bleepingcomputer.com/news/security/new-phishing-kits-target-microsoft-365-accounts-evade-mfa/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/lastpass-bitwarden-users-targeted-with-fake-security-alerts/ 5. SONICWALL AND SHAREFILE ZERO-DAYS UNDER ACTIVE ATTACK Vulnerabilities and Exploits · [zero-day, patch] Latest developments: SonicWall patched two exploited flaws, CVE-2026-15409 and CVE-2026-15410, in its Secure Mobile Access 1000 Series appliances on July 14, 2026, while Progress Software confirmed a high-severity zero-day drove last week's emergency shutdown of ShareFile Storage Zone Controllers and released a fix. Both vendors sell internet-facing remote-access gear that attackers reach directly. SonicWall tells organizations showing its indicators of compromise to reimage hardware or redeploy virtual appliances and reset all user and administrator passwords; ShareFile customers should apply the new patch and rebuild affected Windows servers. - Help Net Security: https://www.helpnetsecurity.com/2026/07/14/sonicwall-sma-attacks-via-cve-2026-15409-cve-2026-15410/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/progress-confirms-sharefile-zero-day-flaw-behind-storage-zone-shutdown/ 6. OLD SIGNED SHIMS REOPEN THE UEFI SECURE BOOT BYPASS Vulnerabilities and Exploits · [vulnerability, patch] Latest developments: ESET researchers disclosed on July 14, 2026 that 11 old Microsoft-signed Linux UEFI shims, all version 0.9 or below, let attackers run untrusted code during boot and plant bootkits on most Secure Boot systems; Microsoft revoked them in its June update. A shim is a small first-stage loader Microsoft signs so Linux and boot tools launch under Secure Boot. Because nearly every UEFI machine trusts that certificate, the vulnerable shims undo the protection; the number of systems still carrying them is unknown, so administrators should apply the revocation and firmware updates. - The Hacker News: https://thehackernews.com/2026/07/11-old-microsoft-signed-linux-uefi.html - Help Net Security: https://www.helpnetsecurity.com/2026/07/14/eset-uefi-secure-boot-bypass/ BUSINESS AND POLITICS ---------------------------------------------------------------- * June Inflation Cools, Fed Rate Rise Off Table Latest developments: June consumer prices rose 3.5%, below expectations as petrol prices tumbled, and traders pulled their bets on a July Federal Reserve rate increase. U.S. consumer inflation fell more than forecast to 3.5% in June as energy costs eased from the Middle East war, sending Treasury yields and the dollar lower; Fed chair Kevin Warsh told Congress the central bank will stay 'resolute' on inflation and gave no signal of imminent tightening. - FT World: https://www.ft.com/content/cb3b2887-d805-402b-9c85-55e3b44d867b - FT World: https://www.ft.com/content/24f2322d-1fd8-439b-84da-b78e0b6eeb5d - WSJ Markets: https://www.wsj.com/finance/jgbs-mixed-may-be-weighed-by-declines-in-u-s-treasurys-a3a67b11?mod=rss_markets_main * Wall Street Banks Post Record Profits Latest developments: JPMorgan, Goldman Sachs, Citigroup, and Bank of America opened earnings season Tuesday with blockbuster results powered by an equities-trading boom. The four largest U.S. banks reported surging profits on record stock-trading revenue tied to the AI frenzy and the SpaceX IPO; JPMorgan chief Jamie Dimon said conditions were nearly 'as good as it gets.' - FT World: https://www.ft.com/content/137efc01-087f-4b1d-b2a4-e18ea61197f2 - WSJ Markets: https://www.wsj.com/finance/banking/big-banks-profits-surge-after-a-red-hot-quarter-on-wall-street-7a25ffbe?mod=rss_markets_main PITTSBURGH ---------------------------------------------------------------- Weather: This Afternoon: Sunny, high 92F. Tonight: Mostly Clear, low 73F. Wednesday: Sunny, high 96F. Business: * Voyager Acquires Astrobotic Latest developments: Colorado-based Voyager Technologies completed its acquisition of North Side lunar-robotics firm Astrobotic on Tuesday, keeping the operation in Pittsburgh. Voyager Technologies of Colorado finalized its purchase of Astrobotic, the North Side company building lunar landers and moon-base technology; John Thornton, executive vice president of lunar systems, said Pittsburgh will help build a base on the moon. - KDKA: https://www.cbsnews.com/pittsburgh/news/astrobotic-sale-finalized-voyager-technologies/ * Battery Project Eyes Little Blue Coal-Ash Site Latest developments: Developer DESRI is advancing a large battery-storage project on the former Little Blue Run coal-ash disposal site to feed the PJM grid. A big battery-storage project backed by DESRI targets the former Little Blue Run coal-ash impoundment, aiming to store power for the PJM Interconnection grid as electricity demand climbs across the region. - Pittsburgh Post-Gazette: https://www.post-gazette.com/business/powersource/2026/07/14/little-blue-project-batteries-desri-coal-ash-pjm/stories/202607130043 * Potential Buyer for Schwebel's Latest developments: A buyer could emerge for Schwebel Baking Company after the bread maker announced plans to wind down its operation. Schwebel Baking Company, which said it would wind down, may draw a purchaser, the Post-Gazette reported, offering a possible reprieve for its workers. - Pittsburgh Post-Gazette: https://www.post-gazette.com/business/career-workplace/2026/07/14/schwebels-baking-company-potential-buyer/stories/202607140033 Around town: * Commercial Street Bridge Implosion Set for Wednesday Latest developments: PennDOT will explosively demolish the Interstate 376 Commercial Street Bridge on Wednesday, July 15, between 1 p.m. and 9 p.m., weather permitting. PennDOT plans to implode the Commercial Street Bridge over the Parkway East on July 15 once crews clear the blast radius on the ground and in the air, advancing the 25-day Interstate 376 replacement project that has detoured hundreds of thousands of drivers off at the Wilkinsburg and Oakland exits. - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/transportation/2026/07/14/commercial-street-bridge-demolition-parkway-east/stories/202607140048 - KDKA: https://www.cbsnews.com/pittsburgh/news/parkway-east-376-commercial-street-bridge-demolition/ * Allegheny County Names Interim Jail Warden Latest developments: County Executive Sara Innamorato named Deputy Warden Connie Clark interim warden of the Allegheny County Jail, effective August 1, as Warden Trevor Wingard departs for another job. Connie Clark, a deputy warden, will run the Allegheny County Jail on an interim basis starting August 1, replacing Trevor Wingard, who is leaving Pittsburgh for a new position. - Pittsburgh Post-Gazette: https://www.post-gazette.com/local/region/2026/07/14/connie-clark-allegheny-county-jail-warden-trevor-wingard/stories/202607140036 - WPXI: https://www.wpxi.com/news/local/allegheny-county-names-interim-warden-jail-operations/TZSGAG6CDREJNC5FWLC2TJRR34/ * Pennsylvania Weighs Online Gambling Addiction Curbs Latest developments: A report to Pennsylvania legislators warns the state's nation-leading online casino industry is fueling a growing gambling-addiction problem. PublicSource reports that Pennsylvania's online gambling industry, the largest in the country, generates billions in revenue while worsening addiction; the report presses lawmakers to choose between collecting more data and imposing prompt limits that could cut that revenue. - PublicSource: https://www.publicsource.org/pennsylvania-online-casino-gambling-addiction-epidemic-report/ Events: * Bloop Vintage-Technology Museum in Penn Hills Latest developments: The Post-Gazette profiled Bloop, a burgeoning grassroots museum of vintage technology in Penn Hills. Bloop, a grassroots museum in Penn Hills, showcases a growing collection of vintage computers and electronics for the public to explore. - Post-Gazette Arts & Entertainment: https://www.post-gazette.com/business/tech-news/2026/07/13/bloop-penn-hills-grassroots-museum-vintage-technology/stories/202607120088 SPORTS ---------------------------------------------------------------- Pirates (50-47) Up Next · Pirates @ Guardians · Fri Jul 17, 7:10 PM https://plaintextsports.com/mlb/2026-07-17/pit-cle Around the Teams: * Ashcraft's Road to His All-Star Debut Latest developments: The Post-Gazette detailed Pirates pitcher Braxton Ashcraft's path from football stardom through injuries to his first All-Star appearance. Pirates right-hander Braxton Ashcraft, a former gridiron standout who fought back through a string of injuries, reached his first All-Star Game as a National League replacement, the Post-Gazette recounted. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/07/14/allstar-braxton-ashcraft-football-mlb/stories/202607130045 Team USA: * USA Basketball Names 2028 Assistant Coaches Latest developments: USA Basketball is expected to name the Thunder's Mark Daigneault, the Pistons' JB Bickerstaff, and Gonzaga's Mark Few as assistant coaches under head coach Erik Spoelstra for the 2028 Olympic team, ESPN reported Tuesday. The men's national basketball team will pair head coach Erik Spoelstra with assistants Mark Daigneault of Oklahoma City, JB Bickerstaff of Detroit, and Mark Few of Gonzaga heading into the Los Angeles 2028 Games, sources told ESPN's Shams Charania. - ESPN Olympics: https://www.espn.com/olympics/story/_/id/49360656/daigneault-bickerstaff-help-coach-team-usa * Balogun Says Red-Card Reversal Roiled USMNT Latest developments: U.S. striker Folarin Balogun said he predicted President Trump's role in overturning his World Cup suspension would 'cause a lot of controversy' and that the outside noise proved hard for teammates to avoid. Folarin Balogun, sent off in the United States' round-of-32 loss to Bosnia and Herzegovina, had his one-match ban suspended after Trump called FIFA president Gianni Infantino; the Monaco forward said the reversal created outside noise that weighed on the squad. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49358886/united-states-folarin-balogun-world-cup-ban-overturn-affected-teammates - Guardian World Cup 2026: https://www.theguardian.com/football/2026/jul/14/folarin-balogun-ban-usa-world-cup * MLB's LA28 Bid Snags on Players' Union Latest developments: Support is growing for Major League Baseball to join the 2028 Los Angeles Olympics, but disagreements with the players' union over tickets and hotel rooms complicate participation, sources told ESPN. Major League Baseball's potential appearance at the LA 2028 Olympics faces hurdles with the MLB Players Association over logistics including tickets and rooms, ESPN sources said, clouding whether big leaguers will play for Team USA. - ESPN Olympics: https://www.espn.com/mlb/story/_/id/49357692/issues-tickets-rooms-complicate-mlb-playing-olympics READING ---------------------------------------------------------------- * Stratechery -- The OpenAI Super App, ChatGPT = Codex, Whither Chat Ben Thompson argues OpenAI has refashioned its Codex coding tool into the new ChatGPT and asks whether the company is abandoning the chat category it pioneered as it builds toward a super app. https://stratechery.com/2026/the-openai-super-app-chatgpt-codex-whither-chat/ * Cal Newport -- Why Reading Matters Newport responds to Rose Horowitch's Atlantic piece 'The End of Reading is Here,' making the case for why sustained deep reading still matters even as attention fragments. https://calnewport.com/why-reading-matters/ * Ed Zitron -- Premium: The Hater's Guide To The Memory Crisis Zitron dismantles the narrative around the AI-driven memory-chip crisis, arguing the shortage and its hype serve the industry's interests more than they reflect durable demand. https://www.wheresyoured.at/premium-the-haters-guide-to-the-memory-crisis/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,524.19 ▲ +0.5% Dow 52,579.32 ▲ +0.1% Nasdaq 26,010.20 = +0.0% WTI crude 73.12 ▲ +5.6% EUR/USD 1.1410 ▼ -0.1% GBP/USD 1.3379 ▲ +0.4% USD/JPY 162.31 ▲ +0.2% ================================================================ Generated 2026-07-14 16:05 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================