daily plain-text briefing: security, markets, business, and pittsburgh
CISA forced emergency patching of actively exploited SharePoint, Fortinet, and Oracle flaws as ransomware halted Coca-Cola's Fairlife and Japan's Nichirei food production.
Latest developments: CISA on July 16, 2026 added three actively exploited flaws to its Known Exploited Vulnerabilities catalog—SharePoint deserialization bug CVE-2026-58644 rated 9.8, plus Fortinet FortiSandbox command-injection flaws CVE-2026-25089 and CVE-2026-39808—ordering agencies to patch SharePoint by July 19 and Fortinet by Sunday, while separately demanding a fix for an exploited Oracle E-Business Suite flaw by Saturday.
The SharePoint flaw lets remote, authenticated attackers run arbitrary code on the server, and attackers began exploiting it soon after disclosure; organizations running on-premises SharePoint, FortiSandbox, or Oracle E-Business Suite should patch immediately.
Sources: The Hacker News · SecurityWeek · BleepingComputer · BleepingComputer · ↑ top
Latest developments: The Coca-Cola Company detailed in a July 16, 2026 SEC Form 8-K that a ransomware attack suspended all US production at its Fairlife dairy subsidiary, and Japanese frozen-food giant Nichirei disclosed it disconnected its systems on July 13 after a cyberattack and began a gradual restoration.
Two food manufacturers halted production floors within days of one another; Coca-Cola says Fairlife product quality and safety stayed intact, and Nichirei is restoring operations while both companies assess the full scope.
Sources: Help Net Security · BleepingComputer · SecurityWeek · SecurityWeek · ↑ top
Latest developments: BleepingComputer detailed a flaw in Anthropic's Claude for Chrome extension that lets a malicious extension simulate clicks to trigger predefined AI actions against Gmail, Google Docs, Calendar, and Salesforce, as UC Berkeley researchers named Cross-Site Prompting and built the Prismata defense, and researchers disclosed a new Agent Data Injection attack that corrupts the facts an agent trusts to make it misclick or run attacker commands.
Autonomous web agents read whatever a page displays and can treat stranger-supplied text as instructions; the emerging fixes range from Berkeley's Prismata filter to least-privilege identity binding, while text-salting phishing already slips past AI email filters in more than a million messages.
Sources: Help Net Security · BleepingComputer · The Hacker News · Dark Reading · ↑ top
Latest developments: Woolwich Crown Court on July 16, 2026 sentenced Thalha Jubair, 20, of East London, and Owen Flowers, 18, of Walsall, to five and a half years each for the 2024 Transport for London breach that knocked out 148 systems and forced all 27,000 TfL employees into offices to reset their passwords in person.
The two members of the Scattered Spider collective pleaded guilty last month; the National Crime Agency put TfL's losses and recovery costs at roughly £29 million.
Sources: The Hacker News · Help Net Security · BleepingComputer · The Record · ↑ top
Latest developments: A new macOS infostealer dubbed ClickLock arrives as a command pasted into Terminal, then kills Finder, the Dock, Spotlight, and Terminal on a loop roughly every 210 milliseconds until victims surrender their login password, hitting at least 100 users, while a separate framework called OkoBot deploys more than 20 payloads to steal cryptocurrency wallet seed phrases and credentials.
Both operations lean on social engineering and modular payloads to drain passwords and crypto; ClickLock installs two LaunchAgents for persistence, and users should refuse to paste unfamiliar Terminal commands or enter passwords into unexpected system dialogs.
Sources: BleepingComputer · The Hacker News · SecurityWeek · BleepingComputer · ↑ top
Latest developments: The Daxin kernel-mode rootkit that Symantec first documented in March 2022 resurfaced after more than four years inside a Taiwan manufacturing firm, alongside a previously unreported pre-login SYSTEM backdoor dubbed Stupig, while Kaspersky detailed GoSerpent backdoor attacks using Stowaway RAT and ThumbcacheService to steal data from Southeast Asian government entities.
Both campaigns point to persistent China-linked espionage against Asian manufacturing and government targets; defenders should hunt for the srt64.sys driver and the new Stupig implant that loads before login.
Sources: The Hacker News · Securelist (Kaspersky) · ↑ top
Latest developments: The AI trade went into reverse Friday, July 17: U.S. semiconductor stocks headed for their worst week since 2025's 'liberation day' rout, Tokyo's Nikkei 225 fell nearly 5%, and Nasdaq futures dropped as investors questioned the pace of the AI buildout.
A global selloff hit chipmakers and AI-linked shares after IBM's preliminary results triggered a 25% stock plunge, its steepest ever, feeding fear that the spending underpinning the AI boom will not pay off; the rout dragged Asian and European markets and premarket U.S. futures lower.
Sources: FT Markets · WSJ Markets · WSJ US Business · ↑ top
Latest developments: American forces widened their target list Friday, July 17, striking bridges and collapsing a tower at a key Iranian port, and crude headed for a weekly gain topping 10% as the U.S.-Iran fight escalated.
The United States has intensified its air campaign against Iran over the Strait of Hormuz, hitting infrastructure deeper inside the country; oil's double-digit weekly climb and strained refining capacity threaten to keep U.S. gasoline prices elevated for months even after crude eases.
Sources: FT World · WSJ Markets · ↑ top
Today: Smoke, high 91F.
Tonight: Smoke, low 71F.
Saturday: Patchy Smoke then Showers And Thunderstorms, high 86F.
Latest developments: Governor Josh Shapiro visited Gateway High School in Monroeville Thursday, July 16, to celebrate $678 million in new public-education money in the freshly signed state budget, part of $3 billion in increases—a 35% rise—over his administration.
Pennsylvania's $50.8 billion budget, signed July 12, steers $678 million in new funding to public schools; officials at the Gateway School District credited earlier state increases with higher graduation rates and test scores.
Sources: TribLive · KDKA · ↑ top
Latest developments: Nicole Holderfield's family found a large hollow void beneath the two-car garage of their Ryan Homes-built house in the Altman Farms neighborhood of North Huntingdon, Westmoreland County, and went public to warn other buyers.
The Holderfields discovered dead space under their front-facing garage in a home built by Ryan Homes and want other owners aware that similar houses across the region could be constructed the same way.
Latest developments: Wildfire smoke drove all of Pennsylvania to a Code Purple 'very unhealthy' alert Friday, July 17, with Allegheny County touching the hazardous 'maroon' range Thursday evening; forecasters expect Saturday storms to wash the smoke out.
Smoke from wildfires in Canada and Minnesota blanketed Western Pennsylvania, sending fine-particulate pollution to hazardous levels; doctors reported patients with burning throats and eyes, and the Allegheny County Health Department urged residents to limit time outdoors.
Latest developments: PennDOT called Thursday's implosion of the Commercial Street Bridge a success, began cleanup at the demolition site July 17, and said the Parkway East closure phase could finish early, though engineers said it is too soon to tell.
PennDOT closed the Parkway East (I-376) on July 10 for a 25-day replacement of the Commercial Street Bridge and is using the closure to also pave inside the Squirrel Hill Tunnels.
Latest developments: Pennsylvania's education secretary said McKeesport Area 'checked the boxes' on infrastructure, finances, academics, and community input as a partner to merge with the distressed Duquesne City School District, TribLive reported July 17.
The state is weighing consolidation of the financially distressed, academically underperforming Duquesne City district with the McKeesport Area district across the Monongahela River.
Latest developments: Picklesburgh's opening day proceeded July 16 despite wildfire smoke blanketing the region, and the festival continues through Sunday, July 19.
Picklesburgh, the pickle-themed food festival, fills Downtown Pittsburgh Thursday through Sunday, July 16-19, with hours of noon to 10 p.m. and noon to 6 p.m. across the four days.
Sources: WPXI · NEXTpittsburgh Events · ↑ top
Pirates (50-47)
Up Next · Pirates @ Guardians · Fri Jul 17, 7:10 PM
Latest developments: A Post-Gazette training-camp countdown argues tight end Pat Freiermuth should finally become a central figure in the Steelers offense under quarterback Aaron Rodgers and coach Mike McCarthy as camp opens in Latrobe.
The Post-Gazette's countdown to Steelers training camp makes the case that Pat Freiermuth's role expands this season alongside Rodgers, giving Pittsburgh a reliable target in the passing game.
Sources: Post-Gazette Steelers · ↑ top
Latest developments: The Post-Gazette flagged five storylines for the Pirates' second-half playoff push, centered on ace Paul Skenes, as the club returns from the All-Star break chasing a wild-card spot.
Pittsburgh's writers frame the Pirates' post-break run around Skenes and a revamped offense that has the clubhouse eager to stay in the National League wild-card race.
Sources: Post-Gazette Pirates · ↑ top
Latest developments: Dozens of Team USA women Olympians and Paralympians received personalized keys to the Las Vegas Strip Thursday, July 16, at the inaugural SHE Weekend parade.
USA Olympic and Paralympic women athletes were honored during the first SHE Weekend festivities in Las Vegas, a new event spotlighting the country's female national-team competitors.
Sources: ESPN Olympics · ↑ top
Latest developments: New York City FC wants to sign USMNT star Christian Pulisic for Major League Soccer, but AC Milan has no interest in selling him, leaving the move 'dead in the water,' ESPN reported July 17.
Pulisic, the top American men's player, remains at AC Milan; NYCFC would bring him back to a U.S. league, an option stalled by Milan's refusal to part with him.
Sources: ESPN Soccer · ↑ top
S&P 500 7,548.10 ▲ +0.5% Dow 52,571.11 ▼ -0.3% Nasdaq 26,082.60 ▲ +0.4% WTI crude 77.49 ▲ +9.7% EUR/USD 1.1423 = -0.0% GBP/USD 1.3418 ▲ +0.4% USD/JPY 162.19 ▲ +0.1%