================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Friday, July 17, 2026 - 6:05 AM EDT ================================================================ CISA forced emergency patching of actively exploited SharePoint, Fortinet, and Oracle flaws as ransomware halted Coca-Cola's Fairlife and Japan's Nichirei food production. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Ransomware crews keep knocking production floors offline, suspending Coca-Cola's Fairlife dairy and Japan's Nichirei frozen-food plants within days of each other. see: Ransomware Halts Fairlife and Nichirei Food Production * [TREND] Prompt injection is becoming the web agent era's cross-site scripting, as a Claude for Chrome extension flaw lets planted clicks steer AI actions against Gmail and Salesforce. see: Prompt Injection Becomes the Web Agent Era's XSS * [UPDATE (new)] CISA flagged three actively exploited bugs including the 9.8-rated SharePoint deserialization flaw CVE-2026-58644 alongside Fortinet FortiSandbox command-injection holes. see: SharePoint, Fortinet, and Oracle Flaws Under Active Attack * [TREND] Fresh stealer and rootkit tradecraft surfaced as the macOS ClickLock infostealer harassed victims into surrendering passwords and China-linked Daxin resurfaced inside a Taiwan manufacturer. see: ClickLock and OkoBot Stealers Hit macOS and Crypto; China-Linked Daxin Rootkit Resurfaces in Taiwan * [TREND] Investors dumped semiconductor stocks worldwide as the AI trade reversed, echoing Zitron's argument that OpenAI's spending amounts to an inflating bubble. see: AI Trade Reverses, Chip Stocks Sell Off Worldwide; The OpenAI Bubble * [UPDATE (new)] Wildfire smoke pushed Pennsylvania to a Code Purple alert even as Picklesburgh opened downtown, with Saturday storms forecast to wash the haze out. see: Wildfire Smoke Pushes State to Code Purple, Relief Saturday; Picklesburgh Runs Downtown Through Sunday SECURITY ---------------------------------------------------------------- 1. SHAREPOINT, FORTINET, AND ORACLE FLAWS UNDER ACTIVE ATTACK Vulnerabilities and Exploits · [zero-day, patch, exploit] Latest developments: CISA on July 16, 2026 added three actively exploited flaws to its Known Exploited Vulnerabilities catalog—SharePoint deserialization bug CVE-2026-58644 rated 9.8, plus Fortinet FortiSandbox command-injection flaws CVE-2026-25089 and CVE-2026-39808—ordering agencies to patch SharePoint by July 19 and Fortinet by Sunday, while separately demanding a fix for an exploited Oracle E-Business Suite flaw by Saturday. The SharePoint flaw lets remote, authenticated attackers run arbitrary code on the server, and attackers began exploiting it soon after disclosure; organizations running on-premises SharePoint, FortiSandbox, or Oracle E-Business Suite should patch immediately. - The Hacker News: https://thehackernews.com/2026/07/cisa-adds-exploited-sharepoint-rce-zero.html - SecurityWeek: https://www.securityweek.com/fresh-sharepoint-vulnerability-exploited-soon-after-disclosure/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/cisa-warns-feds-to-patch-exploited-fortinet-fortisandbox-flaws-by-sunday/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-actively-exploited-oracle-flaw-by-saturday/ 2. RANSOMWARE HALTS FAIRLIFE AND NICHIREI FOOD PRODUCTION Ransomware and Cybercrime · [ransomware, breach] Latest developments: The Coca-Cola Company detailed in a July 16, 2026 SEC Form 8-K that a ransomware attack suspended all US production at its Fairlife dairy subsidiary, and Japanese frozen-food giant Nichirei disclosed it disconnected its systems on July 13 after a cyberattack and began a gradual restoration. Two food manufacturers halted production floors within days of one another; Coca-Cola says Fairlife product quality and safety stayed intact, and Nichirei is restoring operations while both companies assess the full scope. - Help Net Security: https://www.helpnetsecurity.com/2026/07/17/coca-cola-fairlife-ransomware-attack/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/coca-cola-says-fairlife-ransomware-attack-halts-us-dairy-production/ - SecurityWeek: https://www.securityweek.com/coca-cola-suspends-us-fairlife-production-due-to-ransomware-attack/ - SecurityWeek: https://www.securityweek.com/cyberattack-disrupts-operations-of-japanese-frozen-food-giant-nichirei/ 3. PROMPT INJECTION BECOMES THE WEB AGENT ERA'S XSS AI Security · [ai, prompt-injection, exploit] Latest developments: BleepingComputer detailed a flaw in Anthropic's Claude for Chrome extension that lets a malicious extension simulate clicks to trigger predefined AI actions against Gmail, Google Docs, Calendar, and Salesforce, as UC Berkeley researchers named Cross-Site Prompting and built the Prismata defense, and researchers disclosed a new Agent Data Injection attack that corrupts the facts an agent trusts to make it misclick or run attacker commands. Autonomous web agents read whatever a page displays and can treat stranger-supplied text as instructions; the emerging fixes range from Berkeley's Prismata filter to least-privilege identity binding, while text-salting phishing already slips past AI email filters in more than a million messages. - Help Net Security: https://www.helpnetsecurity.com/2026/07/17/xss-web-agent-prompt-injection/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/claude-chrome-extension-flaw-lets-malicious-extensions-trigger-ai-actions/ - The Hacker News: https://thehackernews.com/2026/07/new-agent-data-injection-attack-can.html - Dark Reading: https://www.darkreading.com/threat-intelligence/1m-emails-hidden-text-dupe-ai-security-filters 4. SCATTERED SPIDER PAIR JAILED FOR TFL HACK Ransomware and Cybercrime · [cybercrime, breach] Latest developments: Woolwich Crown Court on July 16, 2026 sentenced Thalha Jubair, 20, of East London, and Owen Flowers, 18, of Walsall, to five and a half years each for the 2024 Transport for London breach that knocked out 148 systems and forced all 27,000 TfL employees into offices to reset their passwords in person. The two members of the Scattered Spider collective pleaded guilty last month; the National Crime Agency put TfL's losses and recovery costs at roughly £29 million. - The Hacker News: https://thehackernews.com/2026/07/two-scattered-spider-hackers-get-55.html - Help Net Security: https://www.helpnetsecurity.com/2026/07/16/ransport-for-london-cyberattack-prison-time/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/scattered-spider-members-behind-transport-for-london-hack-get-five-years-in-prison/ - The Record: https://therecord.media/scattered-spider-hackers-tfl-sentenced 5. CLICKLOCK AND OKOBOT STEALERS HIT MACOS AND CRYPTO Ransomware and Cybercrime · [malware, cybercrime] Latest developments: A new macOS infostealer dubbed ClickLock arrives as a command pasted into Terminal, then kills Finder, the Dock, Spotlight, and Terminal on a loop roughly every 210 milliseconds until victims surrender their login password, hitting at least 100 users, while a separate framework called OkoBot deploys more than 20 payloads to steal cryptocurrency wallet seed phrases and credentials. Both operations lean on social engineering and modular payloads to drain passwords and crypto; ClickLock installs two LaunchAgents for persistence, and users should refuse to paste unfamiliar Terminal commands or enter passwords into unexpected system dialogs. - BleepingComputer: https://www.bleepingcomputer.com/news/security/new-clicklock-macos-malware-traps-users-into-revealing-login-password/ - The Hacker News: https://thehackernews.com/2026/07/new-clicklock-macos-stealer-kills-apps.html - SecurityWeek: https://www.securityweek.com/clicklock-stealer-bypasses-macos-security-with-social-engineering-process-killing/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/new-okobot-framework-deploys-20-payloads-to-steal-data-crypto/ 6. CHINA-LINKED DAXIN ROOTKIT RESURFACES IN TAIWAN Nation-State Activity · [apt, backdoor] Latest developments: The Daxin kernel-mode rootkit that Symantec first documented in March 2022 resurfaced after more than four years inside a Taiwan manufacturing firm, alongside a previously unreported pre-login SYSTEM backdoor dubbed Stupig, while Kaspersky detailed GoSerpent backdoor attacks using Stowaway RAT and ThumbcacheService to steal data from Southeast Asian government entities. Both campaigns point to persistent China-linked espionage against Asian manufacturing and government targets; defenders should hunt for the srt64.sys driver and the new Stupig implant that loads before login. - The Hacker News: https://thehackernews.com/2026/07/daxin-resurfaces-in-taiwan-alongside.html - Securelist (Kaspersky): https://securelist.com/goserpent-backdoor-in-southeast-asia/120687/ BUSINESS AND POLITICS ---------------------------------------------------------------- * AI Trade Reverses, Chip Stocks Sell Off Worldwide Latest developments: The AI trade went into reverse Friday, July 17: U.S. semiconductor stocks headed for their worst week since 2025's 'liberation day' rout, Tokyo's Nikkei 225 fell nearly 5%, and Nasdaq futures dropped as investors questioned the pace of the AI buildout. A global selloff hit chipmakers and AI-linked shares after IBM's preliminary results triggered a 25% stock plunge, its steepest ever, feeding fear that the spending underpinning the AI boom will not pay off; the rout dragged Asian and European markets and premarket U.S. futures lower. - FT Markets: https://www.ft.com/content/79a15abd-5892-4f1c-b038-b09a1ceecabb?syn-25a6b1a6=1 - WSJ Markets: https://www.wsj.com/finance/stocks/u-s-stock-futures-lower-as-chip-selloff-rocks-markets-aeac8c1b?mod=rss_markets_main - WSJ US Business: https://www.wsj.com/finance/investing/the-boardroom-debate-that-led-to-ibms-historic-25-stock-plunge-8a3b9170?mod=pls_whats_news_us_business_f * U.S. Widens Iran Strikes, Oil Set for 10% Weekly Gain Latest developments: American forces widened their target list Friday, July 17, striking bridges and collapsing a tower at a key Iranian port, and crude headed for a weekly gain topping 10% as the U.S.-Iran fight escalated. The United States has intensified its air campaign against Iran over the Strait of Hormuz, hitting infrastructure deeper inside the country; oil's double-digit weekly climb and strained refining capacity threaten to keep U.S. gasoline prices elevated for months even after crude eases. - FT World: https://www.ft.com/content/119c8222-89ce-4c45-ad77-9bb4aab06bdd?syn-25a6b1a6=1 - WSJ Markets: https://www.wsj.com/finance/commodities-futures/oil-rises-amid-escalating-supply-disruption-concerns-c3dcf86d?mod=rss_markets_main PITTSBURGH ---------------------------------------------------------------- Weather: Today: Smoke, high 91F. Tonight: Smoke, low 71F. Saturday: Patchy Smoke then Showers And Thunderstorms, high 86F. Business: * Shapiro Touts $678 Million in New School Funding Latest developments: Governor Josh Shapiro visited Gateway High School in Monroeville Thursday, July 16, to celebrate $678 million in new public-education money in the freshly signed state budget, part of $3 billion in increases—a 35% rise—over his administration. Pennsylvania's $50.8 billion budget, signed July 12, steers $678 million in new funding to public schools; officials at the Gateway School District credited earlier state increases with higher graduation rates and test scores. - TribLive: https://triblive.com/news/pennsylvania/shapiro-touts-public-education-funding-in-state-budget-during-gateway-visit/ - KDKA: https://www.cbsnews.com/pittsburgh/news/josh-shapiro-state-budget-education-investments/ * Family Finds Void Beneath Ryan Homes Garage Latest developments: Nicole Holderfield's family found a large hollow void beneath the two-car garage of their Ryan Homes-built house in the Altman Farms neighborhood of North Huntingdon, Westmoreland County, and went public to warn other buyers. The Holderfields discovered dead space under their front-facing garage in a home built by Ryan Homes and want other owners aware that similar houses across the region could be constructed the same way. - KDKA: https://www.cbsnews.com/pittsburgh/news/void-under-garage-ryan-homes-westmoreland-county/ Around town: * Wildfire Smoke Pushes State to Code Purple, Relief Saturday Latest developments: Wildfire smoke drove all of Pennsylvania to a Code Purple 'very unhealthy' alert Friday, July 17, with Allegheny County touching the hazardous 'maroon' range Thursday evening; forecasters expect Saturday storms to wash the smoke out. Smoke from wildfires in Canada and Minnesota blanketed Western Pennsylvania, sending fine-particulate pollution to hazardous levels; doctors reported patients with burning throats and eyes, and the Allegheny County Health Department urged residents to limit time outdoors. - WTAE: https://www.wtae.com/article/heavy-smoke-to-storms-two-alert-days-for-western-pa/73148972 - WTAE: https://www.wtae.com/article/pennsylvania-code-purple-air-quality-wildfire-smoke/72819604 * Commercial Street Bridge Demolition Done, May Finish Early Latest developments: PennDOT called Thursday's implosion of the Commercial Street Bridge a success, began cleanup at the demolition site July 17, and said the Parkway East closure phase could finish early, though engineers said it is too soon to tell. PennDOT closed the Parkway East (I-376) on July 10 for a 25-day replacement of the Commercial Street Bridge and is using the closure to also pave inside the Squirrel Hill Tunnels. - WPXI: https://www.wpxi.com/news/local/penndot-holds-press-conference-after-successful-demolition-commercial-street-bridge/5ZZYW6K2UJDOBLJEGUZPJCVVIM/ - WPXI: https://www.wpxi.com/news/local/clean-up-already-underway-demo-site-old-commercial-street-bridge/7LPEBJZBDFGEBJ4DHBPKL5C5EY/ * McKeesport Vetted as Duquesne Merger Partner Latest developments: Pennsylvania's education secretary said McKeesport Area 'checked the boxes' on infrastructure, finances, academics, and community input as a partner to merge with the distressed Duquesne City School District, TribLive reported July 17. The state is weighing consolidation of the financially distressed, academically underperforming Duquesne City district with the McKeesport Area district across the Monongahela River. - TribLive: https://triblive.com/news/education-classroom/state-education-secretary-mckeesport-area-checked-the-boxes-for-potential-duquesne-schools-merger/ Events: * Picklesburgh Runs Downtown Through Sunday Latest developments: Picklesburgh's opening day proceeded July 16 despite wildfire smoke blanketing the region, and the festival continues through Sunday, July 19. Picklesburgh, the pickle-themed food festival, fills Downtown Pittsburgh Thursday through Sunday, July 16-19, with hours of noon to 10 p.m. and noon to 6 p.m. across the four days. - WPXI: https://www.wpxi.com/news/local/picklesburgh-continuing-planned-despite-poor-air-quality/5B3CKJLPMFBD7O2PNSJJQQA4CM/ - NEXTpittsburgh Events: https://nextpittsburgh.com/events/14-things-to-do-this-weekend-from-picklesburgh-to-the-pittsburgh-vintage-grand-prix/ SPORTS ---------------------------------------------------------------- Pirates (50-47) Up Next · Pirates @ Guardians · Fri Jul 17, 7:10 PM https://plaintextsports.com/mlb/2026-07-17/pit-cle Around the Teams: * Freiermuth Cast as Key Piece of Steelers Offense Latest developments: A Post-Gazette training-camp countdown argues tight end Pat Freiermuth should finally become a central figure in the Steelers offense under quarterback Aaron Rodgers and coach Mike McCarthy as camp opens in Latrobe. The Post-Gazette's countdown to Steelers training camp makes the case that Pat Freiermuth's role expands this season alongside Rodgers, giving Pittsburgh a reliable target in the passing game. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/07/17/training-camp-countdown-freiermuth-rodgers-offense-mccarthy/stories/202607170004 * Post-Gazette Lays Out Pirates' Second-Half Storylines Latest developments: The Post-Gazette flagged five storylines for the Pirates' second-half playoff push, centered on ace Paul Skenes, as the club returns from the All-Star break chasing a wild-card spot. Pittsburgh's writers frame the Pirates' post-break run around Skenes and a revamped offense that has the clubhouse eager to stay in the National League wild-card race. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/07/16/storylines-analysis-mlb-second-half-skenes/stories/202607150032 Team USA: * Team USA Women Feted at Las Vegas SHE Weekend Latest developments: Dozens of Team USA women Olympians and Paralympians received personalized keys to the Las Vegas Strip Thursday, July 16, at the inaugural SHE Weekend parade. USA Olympic and Paralympic women athletes were honored during the first SHE Weekend festivities in Las Vegas, a new event spotlighting the country's female national-team competitors. - ESPN Olympics: https://www.espn.com/olympics/story/_/id/49381919/team-usa-women-athletes-feted-weekend-get-keys-vegas-strip * NYCFC Eyes Pulisic; Milan Unwilling to Sell Latest developments: New York City FC wants to sign USMNT star Christian Pulisic for Major League Soccer, but AC Milan has no interest in selling him, leaving the move 'dead in the water,' ESPN reported July 17. Pulisic, the top American men's player, remains at AC Milan; NYCFC would bring him back to a U.S. league, an option stalled by Milan's refusal to part with him. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49379980/nycfc-christian-pulisic-transfer-ac-milan-mls READING ---------------------------------------------------------------- * Ed Zitron -- The OpenAI Bubble Zitron argues that OpenAI's finances and promises amount to an inflating bubble, dissecting the gap between its spending and the revenue needed to justify its valuation. https://www.wheresyoured.at/the-openai-bubble/ * Stratechery -- IBM Misses, IBM’s Mainframe Moat, IBM’s Many AI Problems Ben Thompson reads IBM's earnings miss as a story about its enduring mainframe franchise and the structural difficulties it faces turning AI into a growth engine. https://stratechery.com/2026/ibm-misses-ibms-mainframe-moat-ibms-many-ai-problems/ * Cal Newport -- Why Reading Matters Responding to an Atlantic piece declaring the end of reading, Newport defends deep reading as essential cognitive work that skimming and AI summaries cannot replace. https://calnewport.com/why-reading-matters/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,548.10 ▲ +0.5% Dow 52,571.11 ▼ -0.3% Nasdaq 26,082.60 ▲ +0.4% WTI crude 77.49 ▲ +9.7% EUR/USD 1.1423 = -0.0% GBP/USD 1.3418 ▲ +0.4% USD/JPY 162.19 ▲ +0.1% ================================================================ Generated 2026-07-17 06:05 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================