daily plain-text briefing: security, markets, business, and pittsburgh
AI now drives both sides of the vulnerability race, fueling Microsoft's record 622-flaw Patch Tuesday and a fresh Windows zero-day proof-of-concept while the White House stands up an AI-driven coordination program.
Latest developments: Researcher Nightmare Eclipse released LegacyHive, a proof-of-concept for an unpatched Windows User Profile Service (ProfSvc) elevation-of-privilege bug, hours after the release, and The Record noted Microsoft broke its own Patch Tuesday record for the second straight month with a batch larger than the prior three combined.
Microsoft's July 14, 2026 update fixed a record 622 CVEs—Krebs counts 570 Windows-specific holes—including two exploited zero-days, Active Directory Federation Services flaw CVE-2026-56155 and SharePoint Server flaw CVE-2026-56164, plus a publicly disclosed BitLocker bug. Administrators should patch the two live bugs first and watch for the new ProfSvc exploit.
Sources: The Record · The Hacker News · Krebs on Security · The Hacker News · ↑ top
Latest developments: SAP patched CVE-2026-44747, a 9.9-rated out-of-bounds write in NetWeaver Application Server ABAP; ServiceNow closed a critical remote-code-execution hole in its AI platform; Fortinet and Ivanti shipped fixes; and Progress confirmed a zero-day behind last week's ShareFile Storage Zone Controller shutdown and released a patch.
The same week as Microsoft's mega-release, enterprise vendors closed high-severity holes—SAP NetWeaver ABAP, ServiceNow AI, Fortinet, Ivanti, plus RabbitMQ flaws that leak OAuth client secrets and cross Chrome 150 and Firefox 152 browser patches—that authenticated or remote attackers could ride to code execution or data theft. Patch the internet-facing systems first.
Sources: The Hacker News · SecurityWeek · The Hacker News · BleepingComputer · ↑ top
Latest developments: U.S. prosecutors unsealed charges against three Russian nationals accused of running St. Petersburg bulletproof host Media Land and sister firm ML Cloud for ransomware crews that caused over $62 million in damage, Spain's National Police arrested four people behind a €140 million investment-fraud and business-email-compromise ring, and Finland issued a wanted notice for Vastaamo psychotherapy-breach hacker Aleksanteri Kivimäki.
Law enforcement pressed three fronts against cybercrime infrastructure and fraud: an unsealed indictment naming the operators who hosted ransomware gangs, four arrests across Portugal, Spain, and Panama over a laundering ring, and a fresh manhunt for Kivimäki, who is believed to have fled Finland.
Sources: BleepingComputer · BleepingComputer · The Record · SecurityWeek · ↑ top
Latest developments: Researchers showed Cursor on Windows silently runs a git.exe planted in a cloned repository's root with the developer's own privileges and no prompt, a separate two-click Cursor exploit hands attackers a developer's secrets and source, and a Claude for Chrome flaw lets a rogue extension trigger reads of a victim's Gmail, latest Google Doc, and Calendar.
AI coding assistants and browser agents inherit the user's SSH keys, cloud tokens, and source access, so a poisoned repository or a malicious extension becomes full workstation compromise. Developers should distrust untrusted repos and audit which extensions can script on claude.ai.
Sources: The Hacker News · Dark Reading · The Hacker News · ↑ top
Latest developments: ReversingLabs reported that ClickFix has grown from a one-off trick into an industrialized, rentable attack ecosystem that skips exploits entirely, outpaces antivirus and endpoint detection, and leaves YARA analysis as the strongest detection option.
ClickFix, which surfaced in late 2023 and drew its name from Proofpoint in mid-2024, uses fake CAPTCHA checks, browser-update notices, or meeting-error pages to trick victims into pasting commands into the Windows Run box. Criminals now rent the kit at scale, so defenders should train users and hunt the run-box behavior directly.
Sources: Help Net Security · Dark Reading · ↑ top
Latest developments: The White House launched Gold Eagle, an AI-driven vulnerability coordination initiative that stems from the AI-focused executive order President Trump signed on June 2, 2026, as Microsoft credited AI-assisted discovery for nearly tripling its monthly patch volume.
Gold Eagle aims to speed how the government and industry find and coordinate fixes for software flaws using machine assistance, arriving the same week AI-fueled bug hunting drove Microsoft to a 622-CVE record. Security teams should expect faster disclosure cycles and a shrinking window to patch.
Sources: SecurityWeek · Help Net Security · ↑ top
Latest developments: With Washington and Tehran out of easy off-ramps, the IMF warned that the global economy now holds a thinner cushion against an energy shock, and Iranian attacks have knocked out about 17% of Qatar's liquefied-natural-gas export capacity as Europe scrambles for winter gas.
The United States and Iran resumed hostilities after their ceasefire collapsed, with U.S. forces blockading Iranian ports and Tehran firing on ships in the Strait of Hormuz, a chokepoint that once carried roughly 20% of global LNG flows.
Sources: WSJ World News · WSJ Markets · WSJ Markets · ↑ top
Today: Sunny, high 97F.
Tonight: Partly Cloudy then Patchy Smoke, low 75F.
Thursday: Areas Of Smoke, high 95F.
Latest developments: The Gismondi Foundation committed $1 million to the Greater Pittsburgh Community Food Bank to launch the Gismondi Food Bank Academy.
The gift from the Gismondi Foundation establishes a new training academy at the Greater Pittsburgh Community Food Bank, the regional hunger-relief organization serving the Pittsburgh area.
Latest developments: Tyler and Cassandra Clark of Tarentum opened a winery in a restored former church in the Allegheny Township countryside.
The husband-and-wife pair restored and reimagined a historic church-turned-winery in Allegheny Township, Westmoreland County, adding a destination to the Alle-Kiski Valley.
Latest developments: PennDOT carries out the explosive demolition of the old Commercial Street Bridge today, July 15, between 1 and 9 p.m. with a livestream, and the section of Frick Park cleared for the work will be replanted afterward.
The $95 million Commercial Street Bridge replacement has closed the Parkway East (I-376) between the Edgewood/Swissvale and Squirrel Hill exits through August 3, forcing roughly 100,000 daily drivers onto detours.
Sources: TribLive · KDKA · ↑ top
Latest developments: As cleanup continued from storms that flooded homes and businesses, Slippery Rock Borough residents pressed for changes to prevent a repeat.
Powerful storms flooded homes and businesses in Slippery Rock Borough in Butler County, and residents are calling on officials for action.
Latest developments: A PublicSource analysis found that demand for Pittsburgh's cooling centers will likely climb as heat events grow more frequent, and local governments are not yet prepared for the recurring threat.
Amid another Western Pennsylvania heat wave, the report describes extreme heat shifting from an occasional emergency to an annual certainty across the Pittsburgh region.
Sources: PublicSource · ↑ top
Pirates (50-47)
Up Next · Pirates @ Guardians · Fri Jul 17, 7:10 PM
Latest developments: Super Bowl-winning coach Jon Gruden joined Cam Heyward and co-host Hayden on the July 15 episode of Not Just Football.
On Steelers defensive lineman Cam Heyward's podcast, Gruden traded war stories from Green Bay, the Raiders, and Tampa Bay, discussed Antonio Brown and coaching Brett Favre, and named his two biggest coaching regrets.
Sources: Not Just Football with Cam Heyward · ↑ top
Latest developments: ESPN's Transfer Talk reported Juventus is considering a move for U.S. men's national team striker Folarin Balogun of AS Monaco.
Balogun, whose overturned World Cup red-card suspension became a flashpoint in the United States' round-of-16 exit, has drawn transfer interest from the Italian club.
Sources: ESPN Soccer · ↑ top
Latest developments: ESPN sources said support is growing for Major League Baseball players to compete at the 2028 Los Angeles Olympics, though disputes with the players' union over tickets and hotel rooms complicate it.
Whether big-league stars appear for the U.S. and other nations at the LA28 Games hinges on MLB and the Major League Baseball Players Association resolving logistical disagreements.
Sources: ESPN Olympics · ↑ top
S&P 500 7,524.19 ▲ +0.5% Dow 52,579.32 ▲ +0.1% Nasdaq 26,010.20 = +0.0% WTI crude 74.90 ▲ +8.3% EUR/USD 1.1410 ▼ -0.1% GBP/USD 1.3379 ▲ +0.4% USD/JPY 162.31 ▲ +0.2%