================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Wednesday, July 15, 2026 - 4:05 PM EDT ================================================================ Microsoft's record 622-CVE Patch Tuesday collides with a same-day Windows privilege-escalation zero-day proof-of-concept as attackers weaponize AI coding tools and crypto-wallet malware. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Attackers keep weaponizing developers' own AI tooling, with Anysphere's Cursor editor silently running any planted git.exe when a malicious cloned repository is opened on Windows. see: Cursor and Gemini CLI Turned Against Developers * [TREND] Microsoft's record 622-CVE Patch Tuesday landed beside a same-day LegacyHive privilege-escalation PoC, while Progress fixed its ShareFile zero-day and ServiceNow, Fortinet, and Ivanti shipped patches. see: Record Patch Tuesday and a Same-Day Windows Zero-Day PoC; Progress ShareFile Zero-Day Confirmed, ServiceNow RCE Patched * [TREND] Financial crime spans OkoBot injecting seed-phrase phishing into genuine Ledger and Trezor apps, a Spanish ring laundering €140 million, and 23andMe's $18 million breach settlement. see: OkoBot Steals Crypto Seed Phrases From Wallet Apps; Spanish Fraud Ring and Russian Bulletproof Hosts Charged; 23andMe Pays $18 Million Over Genetic Data Breach * [UPDATE (new)] Pittsburgh sees Fire Chief Darryl Jones set to retire September 16, PennDOT imploding the Commercial Street Bridge on the Parkway East, and two charged in a deed-fraud scheme. see: Fire Chief Darryl Jones to Retire; Parkway East Bridge Imploded; Two Charged in Deed-Fraud Scheme * [UPDATE (updated)] Picklesburgh opens downtown Thursday, with two Primanti Bros. locations serving sandwiches on limited-edition pickle bread through Sunday or while supplies last. see: Picklesburgh Opens Downtown SECURITY ---------------------------------------------------------------- 1. RECORD PATCH TUESDAY AND A SAME-DAY WINDOWS ZERO-DAY POC Vulnerabilities and Exploits · [patch, zero-day] Latest developments: Researcher Chaotic Eclipse, also known as Nightmare-Eclipse, published a proof-of-concept named LegacyHive for a Windows User Profile Service arbitrary-hive-load privilege-escalation flaw hours after Microsoft shipped a record 622-CVE Patch Tuesday that closed three zero-days, two of them already under active attack. Microsoft's July release triples June's previous high of roughly 200 CVEs and carries 57 critical bugs; administrators should grab the two exploited zero-days first and treat the fresh LegacyHive primitive as imminent. - Ars Technica Security: https://arstechnica.com/security/2026/07/windows-0-day-drops-the-same-day-microsoft-releases-record-number-of-patches/ - The Hacker News: https://thehackernews.com/2026/07/researcher-drops-new-windows-zero-day.html - The Record: https://therecord.media/microsoft-vulnerabilities-patch-tuesday-release - Dark Reading: https://www.darkreading.com/vulnerabilities-threats/records-broken-patch-tuesday-raises-triage-stakes 2. CURSOR AND GEMINI CLI TURNED AGAINST DEVELOPERS AI Security · [ai, vulnerability] Latest developments: Researchers found that opening a malicious cloned repository in Anysphere's Cursor AI editor on Windows silently runs any git.exe planted in the project root, a flaw that stays unpatched, as BleepingComputer traced a Russian-speaking actor called bandcampro who bent Google's Gemini CLI into a hacking agent and small-scale botnet operator. The Cursor flaw executes attacker code with the developer's source, SSH keys, and cloud tokens the moment a project opens and re-runs it as long as the project stays open; developers should avoid opening untrusted repositories until a patch lands. - The Hacker News: https://thehackernews.com/2026/07/cursor-flaw-lets-malicious-cloned.html - SecurityWeek: https://www.securityweek.com/unpatched-cursor-vulnerability-exposes-users-to-code-execution/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/google-gemini-cli-abused-as-a-hacking-agent-malware-botnet-operator/ - Dark Reading: https://www.darkreading.com/application-security/2-click-cursor-exploit-dev-environment-takeover 3. SPANISH FRAUD RING AND RUSSIAN BULLETPROOF HOSTS CHARGED Ransomware and Cybercrime · [fraud, cybercrime] Latest developments: Spanish National Police dismantled a network that stole and laundered about €140 million through fake investment platforms, CEO fraud, and man-in-the-middle attacks, arresting four people across Portugal, Spain, and Panama, as U.S. prosecutors unsealed charges against three Russian nationals accused of running bulletproof hosting that shielded ransomware gangs and caused over $62 million in damage. The Spanish operation began after officers flagged 19 companies whose finances resembled money laundering; the parallel U.S. charges target previously sanctioned Russian operators who rented infrastructure to extortion crews. - Help Net Security: https://www.helpnetsecurity.com/2026/07/15/cybercrime-network-investment-fraud-spain/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/spanish-police-take-down-140-million-cyber-fraud-ring-arrest-four/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/us-charges-alleged-russian-bulletproof-hosting-service-operators/ - SecurityWeek: https://www.securityweek.com/us-charges-russian-individuals-and-firms-for-running-cybercrime-services/ 4. PROGRESS SHAREFILE ZERO-DAY CONFIRMED, SERVICENOW RCE PATCHED Vulnerabilities and Exploits · [zero-day, patch] Latest developments: Progress Software confirmed a zero-day vulnerability drove the ShareFile Storage Zones Controller shutdown it ordered on July 10, rolled out a fix, and began restoring access, while Fortinet, Ivanti, and ServiceNow shipped patches including a critical remote-code-execution flaw in the ServiceNow AI platform. Progress had told customers to power off on-premises Storage Zone Controllers amid a credible external threat; ShareFile admins should apply the fix before re-enabling servers, and ServiceNow customers should close the AI-platform RCE. - SecurityWeek: https://www.securityweek.com/progress-confirms-zero-day-vulnerability-behind-sharefile-disruption/ - SecurityWeek: https://www.securityweek.com/vulnerabilities-patched-by-fortinet-ivanti-servicenow/ 5. OKOBOT STEALS CRYPTO SEED PHRASES FROM WALLET APPS Ransomware and Cybercrime · [malware, cryptocurrency] Latest developments: Kaspersky's GReAT team detailed OkoBot, a malware framework running on Windows since April 2025 that injects seed-phrase phishing pages into the genuine Ledger and Trezor desktop apps to steal recovery phrases, pairing the TookPS loader, Chromium-browser monitoring, and the Rilide stealer. OkoBot waits for a victim to plug in a hardware wallet, then pops a malicious prompt from inside the wallet's own software to capture the recovery phrase; crypto holders should treat any in-app seed request on a general-purpose PC as fraud. - Securelist (Kaspersky): https://securelist.com/okobot-framework-targets-cryptocurrency-wallets/120660/ - The Hacker News: https://thehackernews.com/2026/07/okobot-malware-framework-injects-seed.html 6. 23ANDME PAYS $18 MILLION OVER GENETIC DATA BREACH Data Breaches · [breach, policy] Latest developments: A coalition of 42 state attorneys general reached an $18 million settlement with genetic-testing firm 23andMe over the cybersecurity failings that led to its massive data breach. The breach exposed genetic and personal data from millions of 23andMe customers; the multistate settlement resolves state claims and signals mounting regulatory cost for consumer-genomics data protection failures. - The Record: https://therecord.media/genetic-testing-settlement-data-breach BUSINESS AND POLITICS ---------------------------------------------------------------- * Trump Weighs Widening the Iran War Latest developments: Trump, still favoring diplomacy, was briefed this week on options that include sending ground troops into Iran and bombing the nuclear-linked Pickaxe Mountain site, a step beyond the naval blockade and airstrikes already under way. The United States and Iran remain at war after Tehran's attacks on shipping through the Strait of Hormuz; Washington reimposed a full naval blockade of Iran's ports after dropping a planned 20% transit fee, and oil edged higher as traders braced for the next escalation. - WSJ World News: https://www.wsj.com/world/middle-east/trump-leans-toward-expanding-u-s-military-operations-in-iran-6c230462 - WSJ Markets: https://www.wsj.com/finance/commodities-futures/oil-rises-amid-irans-attacks-on-shipping-in-strait-of-hormuz-e334b6d7?mod=rss_markets_main PITTSBURGH ---------------------------------------------------------------- Weather: This Afternoon: Sunny, high 96F. Tonight: Partly Cloudy, low 75F. Thursday: Mostly Sunny then Smoke, high 92F. Business: * Yinz Mart Goes National Latest developments: Founder Jurgen Koster sat down with KDKA to explain how his online Pittsburgh superstore, Yinz Mart, has begun drawing attention from shoppers nationwide. Yinz Mart is a web store built around Pittsburgh-themed merchandise, one of a crop of local e-commerce ventures leaning on the region's brand identity. - KDKA: https://www.cbsnews.com/pittsburgh/video/the-story-behind-the-newest-online-pittsburgh-superstore/ * Roux Orleans Draws a Lunch Crowd Latest developments: Pittsburgh Magazine profiled Roux Orleans, where chef Mike "Big EZ" Barnes is packing the dining room with jambalaya, blackened catfish, gumbo, and gator po'boys. Roux Orleans is a New Orleans-style Cajun restaurant whose brisk business signals continued appetite for destination dining in the Pittsburgh market. - Pittsburgh Magazine: https://www.pittsburghmagazine.com/roux-orleans-chateau/ Around town: * Fire Chief Darryl Jones to Retire Latest developments: Mayor Corey O'Connor announced July 15 that Chief Darryl Jones, on paid administrative leave since June, will retire September 16 after a review of the bureau's finances and management. Darryl Jones has led the Pittsburgh Bureau of Fire for nearly 20 years; his departure follows an internal investigation into the bureau's financial, operational, and administrative practices. - Pittsburgh Post-Gazette: https://www.post-gazette.com/local/city/2026/07/15/pittsburgh-fire-chief-darryl-jones/stories/202607150060 - KDKA: https://www.cbsnews.com/pittsburgh/news/pittsburgh-fire-chief-darryl-jones-to-retire-management-review/ * Parkway East Bridge Imploded Latest developments: PennDOT set an explosive demolition of the old Commercial Street Bridge for the evening of July 15, between 6 and 9 p.m., and livestreamed the blast for the public. The implosion falls midway through PennDOT's 25-day closure of the Parkway East (I-376) between the Edgewood/Swissvale and Squirrel Hill exits for the bridge's replacement. - KDKA: https://www.cbsnews.com/pittsburgh/news/parkway-east-376-commercial-street-bridge-demolition/ * Two Charged in Deed-Fraud Scheme Latest developments: The Allegheny County District Attorney's Office charged William Schneider, 45, and William Petruskie, 57, with more than 100 felonies in a scheme that fraudulently transferred 43 property deeds without owners' knowledge. Investigators say Schneider used counterfeit notary stamps bought on Amazon to file the bogus transfers and Petruskie created an LLC listed as owner on 10 of the properties across Allegheny County. - KDKA: https://www.cbsnews.com/pittsburgh/news/pittsburgh-men-charged-fraud-deed-scheme/ - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/crime-courts/2026/07/15/pittsburgh-deed-fraud-scheme/stories/202607150062 Events: * Picklesburgh Opens Downtown Latest developments: As the festival opens Thursday, two Primanti Bros. locations are serving sandwiches on limited-edition pickle bread through Sunday, or while supplies last. Picklesburgh, the pickle-themed street festival, runs Thursday, July 16, through Sunday, July 19, in Downtown Pittsburgh, noon to 10 p.m. Thursday through Saturday and noon to 6 p.m. Sunday. - NEXTpittsburgh Events: https://nextpittsburgh.com/events/14-things-to-do-this-weekend-from-picklesburgh-to-the-pittsburgh-vintage-grand-prix/ - WPXI: https://www.wpxi.com/news/local/2-primanti-bros-locations-offering-sandwiches-limited-edition-pickle-bread-duirng-picklesburgh/HBKZOYYP2NFOVIMUBBIRGV3NCY/ * The Frick Sets Its August Slate Latest developments: The Frick released its August programming, including Summer Fridays at The Frick and a new soundbathing and stargazing concert, and urges visitors to buy tickets in advance. The Frick Pittsburgh Museum and Gardens sits in Point Breeze and runs a summer calendar of outdoor concerts, films, and gallery events on its historic grounds. - Pittsburgh Magazine: https://www.pittsburghmagazine.com/the-frick-pittsburgh-events-august/ SPORTS ---------------------------------------------------------------- Pirates (50-47) Up Next · Pirates @ Guardians · Fri Jul 17, 7:10 PM https://plaintextsports.com/mlb/2026-07-17/pit-cle Around the Teams: * Hiles: Baseball's Cap Fight Already Tiresome Latest developments: Post-Gazette columnist Noah Hiles writes that MLB's brewing labor war over a salary cap is already exhausting, with commissioner Rob Manfred and MLBPA lead negotiator Bruce Meyer far apart. The next collective bargaining agreement looms as a flashpoint, and Hiles frames the cap standoff as an ominous backdrop for a small-payroll club like the Pirates. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/07/15/hiles-column-salarycap-mlbpa-cba-bargaining/stories/202607150035 Team USA: * Juventus Eye USMNT's Balogun Latest developments: ESPN's Transfer Talk reports Juventus are considering a move for AS Monaco striker Folarin Balogun, adding the Turin club to earlier suitors Paris Saint-Germain, Tottenham, and Chelsea. Balogun, a forward for the United States men's national team, could change clubs this summer as European sides weigh bids after the World Cup. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49365030/transfer-rumors-news-usmnt-striker-balogun-juventus-shortlist * Flavor Flav Backs U.S. Women's Hockey Latest developments: ESPN detailed how rapper Flavor Flav became the driving force behind SHE Weekend, an inaugural Las Vegas showcase and his biggest show of support yet for the U.S. women's national ice hockey team. Flavor Flav has grown into one of the most visible boosters of American women's sports, and SHE Weekend puts Team USA women's hockey at the center of the event. - ESPN Olympics: https://www.espn.com/olympics/story/_/id/49368037/she-weekend-las-vegas-flavor-flav-team-usa-womens-ice-hockey READING ---------------------------------------------------------------- * Ed Zitron -- The OpenAI Bubble Zitron argues that OpenAI sits at the center of an inflated and unsustainable financial bubble in artificial intelligence. https://www.wheresyoured.at/the-openai-bubble/ * Stratechery -- IBM Misses, IBM's Mainframe Moat, IBM's Many AI Problems Ben Thompson reads IBM's disappointing preliminary results as a company-specific story, holding that its mainframe franchise remains a durable moat even as IBM struggles to compete in AI. https://stratechery.com/2026/ibm-misses-ibms-mainframe-moat-ibms-many-ai-problems/ * Cal Newport -- Why Reading Matters Newport answers Rose Horowitch's Atlantic piece 'The End of Reading Is Here,' making the case that sustained deep reading still matters for thinking. https://calnewport.com/why-reading-matters/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,532.13 ▲ +0.4% Dow 52,495.94 ▼ -0.4% Nasdaq 26,067.87 ▲ +0.2% WTI crude 74.90 ▲ +8.3% EUR/USD 1.1414 = -0.0% GBP/USD 1.3389 ▲ +0.3% USD/JPY 162.28 ▲ +0.2% ================================================================ Generated 2026-07-15 16:05 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================