================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Friday, July 17, 2026 - 9:06 AM EDT ================================================================ Fresh zero-day exploit code for Windows and Siemens switches lands as attackers turn hidden text and voice-cloning scripts against AI security defenses. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Attackers keep weaponizing AI itself, hiding text salting inside phishing emails to slip past LLM filters and scripting voice-cloning calls that talk victims into resetting passwords. see: Salted Emails and Voice Scripts Slip Past AI Defenses * [TREND] Speed now defines the worst threats, as Spirals ransomware encrypts a full network in under 24 hours while the LegacyHive zero-day escalates to admin on fully patched Windows. see: Spirals Ransomware Encrypts Networks in Under 24 Hours; New Zero-Day Exploits Hit Windows, Siemens, and n8n * [TREND] Governments are pressing platform power, with the European Commission forcing Google to open Android to rival AI assistants and San Francisco moving to pull AI nudify apps off app stores. see: Regulators Press Google, TikTok, and AI Nudify Apps * [UPDATE (new)] Wildfire smoke drove a statewide Code Purple alert that shuttered Kennywood, Idlewild, and Sandcastle and drew scrutiny to the timing of U.S. Steel's Edgar Thomson open house. see: Smoke Shutters Kennywood, Idlewild, Sandcastle; U.S. Steel Touts Edgar Thomson Investment at Open House * [UPDATE (updated)] The AI trade reversed Friday as a deepening chip selloff and IBM's 25% plunge—whose mainframe moat one analysis still defends—dragged semiconductors toward their worst week since 2025. see: Global Chip Selloff Deepens as AI Trade Reverses; IBM Misses, IBM's Mainframe Moat, IBM's Many AI Problems * [UPDATE (new)] Andy Burnham enters Downing Street Monday as Britain's prime minister after winning the Labour leadership, pledging pro-business governance to steady markets. see: Burnham Becomes Britain's Prime Minister SECURITY ---------------------------------------------------------------- 1. NEW ZERO-DAY EXPLOITS HIT WINDOWS, SIEMENS, AND N8N Vulnerabilities and Exploits · [zero-day, patch, ot] Latest developments: A researcher using the handle Nightmare Eclipse published a working Windows zero-day exploit called LegacyHive that escalates privileges to administrator on fully patched systems, Palo Alto Networks' Unit 42 chained three zero-days in Siemens ROX II OT switches to win persistent root, and n8n disclosed a JWT flaw that logs Enterprise users in as accounts belonging to a different token issuer. LegacyHive abuses the Windows User Profile Service, the Siemens ROX II trilogy grants privilege escalation and root on industrial switches, and n8n's multi-issuer instances matched incoming tokens on the sub claim alone while ignoring iss. Patch each product and restrict exposure. - BleepingComputer: https://www.bleepingcomputer.com/news/security/new-windows-legacyhive-zero-day-exploit-grants-hackers-admin-access/ - Unit 42 (Palo Alto): https://unit42.paloaltonetworks.com/siemens-rox-ii-zero-day-vulnerabilities/ - The Hacker News: https://thehackernews.com/2026/07/n8n-token-exchange-flaw-could-let.html 2. SALTED EMAILS AND VOICE SCRIPTS SLIP PAST AI DEFENSES AI Security · [ai, phishing] Latest developments: Dark Reading detailed how more than a million phishing emails hide characters through text salting to fool AI and LLM security filters into passing them to inboxes, researchers at Harvard Kennedy School and Meta found that a convincing script drives AI voice-phishing success across six commercial systems tested on 4,100 US adults, and 1Password shipped a beta letting Anthropic's Claude complete authenticated browser tasks without seeing user credentials. Attackers exploit LLM filters' blind spots with hidden characters while agent makers scramble to contain credential exposure days after the Claude for Chrome extension flaw. Treat AI-driven filtering and browsing agents as porous. - Dark Reading: https://www.darkreading.com/threat-intelligence/1m-emails-hidden-text-dupe-ai-security-filters - Help Net Security: https://www.helpnetsecurity.com/2026/07/17/research-ai-voice-phishing/ - Help Net Security: https://www.helpnetsecurity.com/2026/07/17/1password-anthropic-claude-integration/ 3. REGULATORS PRESS GOOGLE, TIKTOK, AND AI NUDIFY APPS Policy and Regulation · [policy] Latest developments: The European Commission ordered Google to give rival AI assistants the same Android reach Gemini enjoys—camera, microphone, on-screen content, and background app control—by the Android 18 release, San Francisco's City Attorney sent Apple and Google cease-and-desist letters demanding they pull 13 AI nudify face-swap apps, and Britain's Ofcom opened an investigation into TikTok over alleged age-verification lapses. The three actions show regulators tightening control over how large platforms handle AI access, child safety, and abusive apps. Google, TikTok, Apple, and the app-store owners face binding deadlines and legal demands. - The Hacker News: https://thehackernews.com/2026/07/eu-orders-google-to-open-android-mic.html - Wired Security: https://www.wired.com/story/san-francisco-demands-apple-and-google-delete-ai-nudify-apps-from-app-stores/ - The Record: https://therecord.media/ofcom-investigation-tiktok-age-verification 4. US CHARGES FRAUD LAUNDERERS AS ARMENIA DETAINS A REVIL SUSPECT Ransomware and Cybercrime · [cybercrime, ransomware] Latest developments: US prosecutors charged a New York man and woman with laundering $43 million stolen through cyber investment-fraud scams, while Armenia has held Russian tourist Aleksandr Ermakov since June 28 on a US extradition request tied to a REvil ransomware suspect of the same name, whose lawyers say authorities have the wrong man. The two cases show law enforcement pressing both the money-laundering networks behind investment fraud and the individuals tied to ransomware crews. Ermakov's wife, Maria Yurova, and his lawyers dispute the identification. - BleepingComputer: https://www.bleepingcomputer.com/news/security/us-charges-two-over-laundering-43-million-from-investment-fraud/ - The Hacker News: https://thehackernews.com/2026/07/armenia-detains-russian-tourist-on-us.html 5. SPIRALS RANSOMWARE ENCRYPTS NETWORKS IN UNDER 24 HOURS Ransomware and Cybercrime · [ransomware] Latest developments: Symantec's Threat Hunter Team documented Spirals, a previously unknown Rust-based ransomware strain that last month struck an IT services company in South Asia, moving from initial access through data theft to full network encryption in under 24 hours. Spirals encrypts each file with a separate AES-128 key and wraps every key with attacker-controlled ECDH, running fast once it gains a foothold. Its speed leaves defenders little time to detect and respond before encryption completes. - Help Net Security: https://www.helpnetsecurity.com/2026/07/17/spirals-ransomware-south-asia/ BUSINESS AND POLITICS ---------------------------------------------------------------- * Burnham Becomes Britain's Prime Minister Latest developments: Andy Burnham was crowned Labour leader Friday, July 17, and enters Downing Street as prime minister Monday, pledging to govern as "pro-business" and to steady markets. Andy Burnham, the former mayor of Manchester who joined parliament only last month, takes office Monday as Britain's prime minister and Labour leader, and his first task is calming bond and mortgage markets that lenders have already jolted with fixed-rate rises after renewed Middle East hostilities. - FT World: https://www.ft.com/content/8cbd0b07-d0db-4c1a-a985-c495bd7168b8?syn-25a6b1a6=1 - WSJ World News: https://www.wsj.com/world/uk/the-u-k-gets-another-new-leader-on-monday-his-first-task-reassure-the-markets-187dae5e * Global Chip Selloff Deepens as AI Trade Reverses Latest developments: The AI-driven rout deepened Friday, July 17, with Netflix sliding on a weak-growth warning and IBM reeling from a 25% plunge, pushing the U.S. semiconductor index toward its worst week since 2025's "liberation day" selloff. Investors kept fleeing chipmakers and AI-linked shares Friday—Tokyo's Nikkei 225 fell nearly 5%, Nasdaq futures dropped, gold slid, and Treasury yields fell as money sought safety—amid spreading doubt about the pace and payoff of the artificial-intelligence buildout. - FT Markets: https://www.ft.com/content/79a15abd-5892-4f1c-b038-b09a1ceecabb?syn-25a6b1a6=1 - WSJ Markets: https://www.wsj.com/finance/stocks/u-s-stock-futures-lower-as-chip-selloff-rocks-markets-aeac8c1b?mod=rss_markets_main PITTSBURGH ---------------------------------------------------------------- Weather: Today: Smoke, high 91F. Tonight: Smoke, low 71F. Saturday: Patchy Smoke then Showers And Thunderstorms, high 86F. Business: * U.S. Steel Touts Edgar Thomson Investment at Open House Latest developments: U.S. Steel held an open house Thursday, July 16, to spotlight its planned plant investment, timing that drew scrutiny as wildfire smoke pushed the Mon Valley to a Code Purple air-quality alert. U.S. Steel, now owned by Nippon Steel, used the open house to promote its multibillion-dollar reinvestment in the Edgar Thomson works in Braddock, the pledge that helped clear the Nippon takeover, even as smoke choked the surrounding Monongahela River communities. - Pittsburgh Post-Gazette: https://www.post-gazette.com/business/powersource/2026/07/17/us-steel-nippon-air-quality/stories/202607170032 * Casino Revenue Funds Westmoreland Projects Latest developments: TribLive detailed Friday, July 17, how Westmoreland County's 65 municipalities will spend the $17.2 million in Local Share Account money—renovating infrastructure, replacing police vehicles, and funding stormwater and sewer repairs. The state-mandated Local Share Account, funded by Live! Casino gambling revenue, distributed more than $17.2 million to Westmoreland County's 65 municipalities and organizations, money state Sen. Joe Pittman said many communities could not otherwise raise for critical repairs. - TribLive: https://triblive.com/local/westmoreland/westmoreland-county-municipalities-repair-infrastructure-replace-aging-equipment-through-state-gambling-revenue/ Around town: * Smoke Shutters Kennywood, Idlewild, Sandcastle Latest developments: Kennywood, Sandcastle, and Idlewild all closed Friday, July 17, and outdoor events across Western Pennsylvania were canceled as the statewide Code Purple alert held, with relief expected from Saturday's storms. Wildfire smoke from Canada and Minnesota drove all of Pennsylvania to a Code Purple "very unhealthy" air-quality alert Friday, closing the Kennywood, Sandcastle, and Idlewild parks and forcing region-wide cancellations; forecasters expect Saturday storms to wash the haze out. - WTAE: https://www.wtae.com/article/kennywood-sandcastle-and-idlewild-all-closed-due-to-code-purple-air-quality-alert/73168952 - WPXI: https://www.wpxi.com/news/local/wildfire-smoke-pennsylvania-whats-closed-pittsburgh-region/SHZ3P3F5A5A2DPFVQGCGBEHSRU/ * Free Ride Bicycle Collective Turns 25 Latest developments: Free Ride Bicycle Collective marked its 25th year with an alleycat ride and announced a "black jorts gala" for later this year. Free Ride Bicycle Collective, a Pittsburgh co-op that teaches residents to repair and ride bicycles and earn a bike through volunteer hours, celebrated a quarter century of getting the city into the saddle. - Pittsburgh City Paper: https://www.pghcitypaper.com/news-2/infrastructure/free-ride-bicycle-collective-marks-25-years-of-getting-pittsburgh-into-the-saddle/ SPORTS ---------------------------------------------------------------- Pirates (50-47) Up Next · Pirates @ Guardians · Fri Jul 17, 7:10 PM https://plaintextsports.com/mlb/2026-07-17/pit-cle Team USA: * Heaps Returns Home to Denver Summit FC Latest developments: ESPN reported U.S. women's national team midfielder Lindsey Heaps has transferred to NWSL expansion side Denver Summit FC, a homecoming to Colorado. Lindsey Heaps, the USWNT midfielder whose career took her to Paris Saint-Germain and across Europe, has joined new NWSL club Denver Summit FC in a return to her native Colorado, she and her family told ESPN. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49363167/for-uswnt-star-lindsey-heaps-transfer-denver-summit-marks-welcome-return-home READING ---------------------------------------------------------------- * Ed Zitron -- The OpenAI Bubble Zitron argues OpenAI sits at the center of an unsustainable AI bubble, its enormous cash burn and losses propped up by hype rather than any durable business model. https://www.wheresyoured.at/the-openai-bubble/ * Stratechery -- IBM Misses, IBM's Mainframe Moat, IBM's Many AI Problems Thompson dissects IBM's disappointing preliminary results that spooked software stocks, arguing its mainframe franchise remains a genuine moat even as the company struggles to turn AI into growth. https://stratechery.com/2026/ibm-misses-ibms-mainframe-moat-ibms-many-ai-problems/ * Cal Newport -- Why Reading Matters Responding to Rose Horowitch's Atlantic essay on collapsing reading habits, Newport argues that sustained deep reading builds cognitive capacities that skimming and AI summaries cannot replace. https://calnewport.com/why-reading-matters/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,548.10 ▲ +0.5% Dow 52,571.11 ▼ -0.3% Nasdaq 26,082.60 ▲ +0.4% WTI crude 77.49 ▲ +9.7% EUR/USD 1.1423 = -0.0% GBP/USD 1.3418 ▲ +0.4% USD/JPY 162.19 ▲ +0.1% ================================================================ Generated 2026-07-17 09:06 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================