daily plain-text briefing: security, markets, business, and pittsburgh
Artificial intelligence drove Microsoft to a record 622-flaw Patch Tuesday and now runs intrusions on its own, as SonicWall, SharePoint, and decade-old Secure Boot zero-days force emergency patching worldwide.
Latest developments: Microsoft shipped fixes on July 14, 2026 for a record 622 CVEs by its own count—Krebs tallies 570 Windows-specific holes, nearly triple June's prior record—including two zero-days already under attack, Active Directory Federation Services flaw CVE-2026-56155 and SharePoint Server flaw CVE-2026-56164, plus a publicly disclosed BitLocker bug; Microsoft blocked the update on some Dell PCs after shutdowns, and CISA urged SharePoint hardening against an exploitation chain of CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164.
The monthly release patches Windows and related software; Microsoft credits AI-assisted discovery for the ballooning counts and incident responders for both live zero-days. Administrators should prioritize the ADFS and SharePoint fixes and, for on-premises SharePoint, apply CISA's hardening steps.
Sources: The Hacker News · Krebs on Security · CISA Advisories · BleepingComputer · ↑ top
Latest developments: SonicWall confirmed on July 14, 2026 active zero-day exploitation of two SMA1000 series flaws—server-side request forgery CVE-2026-15409 rated 10.0 and code-injection CVE-2026-15410, one of which enables unauthenticated remote command execution—released fixed firmware, and told customers showing indicators of compromise to re-image appliances and reset all passwords, as CISA added both to its Known Exploited Vulnerabilities catalog.
SonicWall's Secure Mobile Access 1000 appliances sit at the network edge for remote access, making unauthenticated command execution especially dangerous. Organizations must upgrade immediately and hunt for compromise.
Sources: The Hacker News · BleepingComputer · SecurityWeek · Help Net Security · ↑ top
Latest developments: Check Point's AI Security Report 2026, published July 15, 2026, documented intrusions in which AI autonomously ran exploitation workflows generating thousands of commands across dozens of sessions with minimal human direction, while Palo Alto's Unit 42 dissected TuxBot v3, an IoT botnet framework built with LLM assistance, and Michigan Technological University showed an overthinking attack that ties up a vision-language-model robot for over a minute.
Attackers are wiring capable models into every stage of the kill chain and abusing how robots read text in camera frames. Defenders face faster, less-supervised campaigns and a new class of denial-of-service against embodied AI.
Sources: Help Net Security · Unit 42 (Palo Alto) · Help Net Security · ↑ top
Latest developments: OX Security, SafeDep, Socket, and StepSecurity found four compromised @asyncapi npm packages delivering a multi-stage botnet loader on July 15, 2026, as a threat actor stood up nearly 300 fake GitHub repositories impersonating legitimate software and security projects to push infostealers, and Blackpoint Cyber flagged LabubaRAT, a Rust remote-access trojan posing as NVIDIA software.
The affected npm packages include @asyncapi/generator@3.3.1 and @asyncapi/specs, widely pulled by API tooling. Developers should pin known-good versions, scrutinize GitHub project provenance, and treat NVIDIA-branded binaries from untrusted sources as suspect.
Sources: The Hacker News · BleepingComputer · The Hacker News · ↑ top
Latest developments: Kaspersky's GReAT team detailed OkoBot on July 15, 2026, a framework that uses TookPS to exfiltrate seed phrases, watch Chromium browsers, and drop the Rilide stealer, while Jamf Threat Labs moved CrashStealer—a macOS infostealer posing as Apple's crash-reporting tool to grab passwords, Keychain data, and wallets—from development into in-the-wild use, and KU Leuven found 85 browser-extension wallets leaking addresses that enable cross-site tracking.
Cryptocurrency users face a widening set of stealers across Windows and macOS plus privacy leaks baked into popular wallet extensions. Users should verify software sources, isolate wallet browsers, and treat seed phrases as never-typed secrets.
Sources: Securelist (Kaspersky) · Help Net Security · The Hacker News · ↑ top
Latest developments: Researchers revealed on July 14, 2026 that Microsoft failed for roughly a decade to revoke old, forgotten signed shims, leaving Secure Boot trivially bypassable on most systems, and separately catalogued 11 old Microsoft-signed Linux UEFI applications that let an attacker run untrusted code during boot and plant bootkits.
Secure Boot verifies that only trusted code loads at startup; the stale Microsoft-signed components let attackers defeat that check and install malware that survives reinstalls. Affected systems need the revoked-certificate and firmware updates.
Sources: Ars Technica Security · The Hacker News · ↑ top
Latest developments: Tehran threatened to halt all Middle East energy exports after the U.S. reimposed its naval blockade of Iranian ports, Brent crude climbed near $86 a barrel on a fourth straight night of U.S. strikes, and Senate Democrats blocked a $1 trillion defense bill in protest of the war.
The United States has battled Iran for weeks over control of the Strait of Hormuz, the chokepoint for roughly a fifth of the world's seaborne liquefied natural gas, and Iranian attacks have already erased 17% of Qatar's LNG export capacity as Europe scrambles to fill storage before winter. President Trump also moved to withdraw all U.S. forces from Iraq by the end of September, closing a 23-year presence.
Sources: WSJ Markets · ↑ top
Latest developments: China's economy expanded 4.3% in the second quarter, one of its lowest rates in decades and below Beijing's target range, as feeble domestic demand offset surging exports.
China's gross domestic product cooled more than economists expected, undercutting Beijing's roughly 5% annual goal and pointing to deepening weakness in consumer spending and property that ripples through global commodity and trade flows.
Sources: WSJ World News · FT World · ↑ top
Today: Sunny, high 97F.
Tonight: Partly Cloudy then Patchy Smoke, low 75F.
Thursday: Areas Of Smoke, high 95F.
Latest developments: A viral internet video has sent local customers flocking to Marshall's, a Shell gas station in Pittsburgh's Spring Garden neighborhood, whose Reuben the Pittsburgh City Paper now judges the city's best.
Marshall's, a Shell station deli in Spring Garden, sells what Pittsburgh City Paper calls the region's best Reuben sandwich, and the online attention has driven a surge of new business.
Sources: Pittsburgh City Paper · ↑ top
Latest developments: Allegheny County Council voted Tuesday to pull from the November ballot a proposed charter amendment that would have asked voters to lift the 0.4% annual limit on council's operating budget.
In a swift reversal, Allegheny County Council abandoned its plan to let voters eliminate the cap that holds its own operating-budget increases to 0.4% a year.
Sources: Pittsburgh Post-Gazette · TribLive · ↑ top
Latest developments: Parents and education advocacy groups filed a complaint with the Pennsylvania Human Relations Commission on Tuesday seeking to halt Pittsburgh Public Schools' plan to close 12 schools across nine buildings.
Less than two months after the Pittsburgh Public Schools board approved closing 12 schools in nine buildings, opponents allege the plan discriminates and asked the state to stop it.
Latest developments: PennDOT scheduled the explosive demolition of the Interstate 376 Commercial Street Bridge for Wednesday, July 15, between 1 p.m. and 9 p.m., weather permitting, with a livestream planned.
Crews will blow up the Commercial Street Bridge on the closed Parkway East as part of the $95 million replacement that keeps I-376 shut through August 3, pushing roughly 100,000 daily drivers onto detours.
Latest developments: Quantum Theatre is mounting Shakespeare's 'The Tempest' on a blue circular stage at the Carrie Blast Furnaces, the final production of Karla Boos's tenure as the company's founding artistic director.
Quantum Theatre performs 'The Tempest' outdoors against the rust-covered Carrie Blast Furnaces in Rankin, capping Karla Boos's run leading the site-specific company she founded.
Sources: Pittsburgh City Paper · ↑ top
Latest developments: Bloop, a burgeoning grassroots museum of vintage technology, is showcasing its collection for visitors in Penn Hills.
In Penn Hills, a homegrown museum called Bloop displays vintage computers and technology, a new destination for enthusiasts of old electronics.
Sources: Post-Gazette Arts & Entertainment · ↑ top
Pirates (50-47)
Up Next · Pirates @ Guardians · Fri Jul 17, 7:10 PM
Latest developments: A Post-Gazette training-camp countdown argues rookie wide receiver Germie Bernard becomes key to the Steelers offense alongside DK Metcalf and quarterback Aaron Rodgers as camp opens in Latrobe.
As the Steelers prepare to report to Saint Vincent College in Latrobe, the Post-Gazette makes the case that rookie receiver Germie Bernard turns into an important piece of an offense built around DK Metcalf and Aaron Rodgers.
Sources: Post-Gazette Steelers · ↑ top
Latest developments: The Post-Gazette detailed Pirates pitcher Braxton Ashcraft's path from high school football stardom through a string of injuries to his first All-Star selection.
Pirates right-hander Braxton Ashcraft, once a football star before injuries slowed his early career, reached his first MLB All-Star Game, the subject of a Post-Gazette profile.
Sources: Post-Gazette Pirates · ↑ top
Latest developments: USA Basketball is expected to name Oklahoma City's Mark Daigneault, Detroit's JB Bickerstaff, and Gonzaga's Mark Few as assistant coaches under head coach Erik Spoelstra for the 2028 Los Angeles Olympics.
Team USA's men's basketball program set its coaching staff for the Los Angeles Games, with Miami Heat coach Erik Spoelstra leading and Daigneault, Bickerstaff, and Few assisting, ESPN's sources reported.
Sources: ESPN Olympics · ↑ top
Latest developments: With Mauricio Pochettino's future uncertain after the U.S. men's round-of-16 World Cup exit, ESPN named 11 coaches U.S. Soccer could hire to replace him.
ESPN floated 11 candidates to take over the U.S. men's national team should Mauricio Pochettino depart following the Americans' 4-1 loss to Belgium at their home World Cup.
Sources: ESPN Soccer · ↑ top
Latest developments: U.S. striker Folarin Balogun said he predicted President Trump's push to overturn his World Cup suspension would 'cause a lot of controversy,' and that the fallout affected his teammates.
Folarin Balogun of AS Monaco, whose red-card ban FIFA reversed after Trump intervened, said the resulting controversy weighed on the U.S. squad during its home World Cup.
Sources: ESPN Soccer · ↑ top
S&P 500 7,524.19 ▲ +0.5% Dow 52,579.32 ▲ +0.1% Nasdaq 26,010.20 = +0.0% WTI crude 74.90 ▲ +8.3% EUR/USD 1.1410 ▼ -0.1% GBP/USD 1.3379 ▲ +0.4% USD/JPY 162.31 ▲ +0.2%