daily plain-text briefing: security, markets, business, and pittsburgh
Ransomware knocked Coca-Cola's Fairlife, Japan's Nichirei, and naval builder TKMS offline as CISA raced to flag actively exploited SharePoint and Fortinet zero-days.
Latest developments: Coca-Cola confirmed the Fairlife ransomware attack idled dairy plants in Michigan, New York, and Arizona, Japan's frozen-food giant Nichirei disconnected its systems July 13 and began gradually restoring operations, and ransomware also struck German naval-defense builder TKMS.
Ransomware operators are freezing manufacturing output; Fairlife, whose retail sales topped $1 billion in 2022, suspended US production while its Canada operations continue, and affected firms are pulling systems offline and rebuilding piecemeal.
Sources: The Record · Help Net Security · SecurityWeek · SecurityWeek · ↑ top
Latest developments: CISA on July 17, 2026 added critical SharePoint deserialization remote-code-execution flaw CVE-2026-58644, rated 9.8, to its Known Exploited Vulnerabilities catalog with a July 19 federal patch deadline, and separately ordered agencies to fix two actively exploited Fortinet FortiSandbox flaws by Sunday.
The SharePoint bug lets remote, authenticated attackers run arbitrary code on on-premises servers, and attackers began exploiting it soon after disclosure; administrators of SharePoint Server and Fortinet FortiSandbox threat-detection appliances should patch immediately.
Sources: The Hacker News · SecurityWeek · BleepingComputer · ↑ top
Latest developments: UC Berkeley researchers framed Cross-Site Prompting, or XSP, as the web-agent version of cross-site scripting and built Prismata to sit between an agent and the pages it reads, as BleepingComputer detailed a Claude for Chrome extension flaw that lets a malicious extension simulate clicks to trigger Claude's authenticated access to Gmail, Google Docs, Calendar, and Salesforce.
Autonomous web agents read attacker-controlled text—reviews, listings, ads, rogue extensions—as instructions, letting any of it steer the agent; enterprises deploying agentic AI should isolate untrusted content and constrain what connected services an agent can touch.
Sources: Help Net Security · BleepingComputer · Dark Reading · ↑ top
Latest developments: The Hacker News detailed North Korea's Contagious Interview crews hiding a four-stage OTTERCOOKIE payload—a browser-credential and crypto-wallet stealer plus a file stealer—inside steganographic SVG images delivered through fake coding challenges, while Kaspersky exposed the previously undocumented GoSerpent malware spying on Southeast Asian governments and diplomats since late 2025.
Both operations chase long-term access and intelligence; job-seeking developers who run the fake take-home projects and diplomatic staff across Southeast Asia are the targets, so treat unsolicited coding tests and unexpected attachments as hostile.
Sources: The Hacker News · The Hacker News · ↑ top
Latest developments: Ernst & Young began notifying customers July 17, 2026 of a data breach after attackers compromised a third-party support-ticket system its IT personnel used.
The Big Four accounting and advisory firm's exposure came through a vendor system rather than its own core network, underscoring the risk that support and ticketing suppliers carry; affected clients should watch for follow-on phishing tied to leaked support data.
Sources: BleepingComputer · ↑ top
Latest developments: Woolwich Crown Court on July 16, 2026 sentenced Scattered Spider members Owen Flowers, 18, and Thalha Jubair, 20, to five and a half years each for the 2024 Transport for London hack that knocked out 148 systems and forced all 27,000 TfL staff to reset passwords in person.
The attack cost Transport for London roughly £29 million in losses and recovery; the sentencing marks continued law-enforcement pressure on the Scattered Spider social-engineering crew.
Sources: The Hacker News · ↑ top
Latest developments: American forces bombed Iranian bridges and collapsed a tower at a key port Friday, July 17, as Iran retaliated against Qatar and a tanker in the Strait of Hormuz, and Brent crude rose 2.1% with WTI up 2.4%.
The United States has struck Iranian infrastructure and military targets for a sixth straight night, widening its target list to sever the supply routes Tehran uses to attack shipping near the Strait of Hormuz; House Republicans are pushing a smaller-than-requested package to fund the war amid party divisions.
Sources: FT World · WSJ Markets · WSJ Politics · ↑ top
Latest developments: Apple leapfrogged Nvidia on Friday, July 17, to become the most valuable U.S. public company, its shares escaping a selloff that drove the semiconductor index toward its worst week since 2025's 'liberation day' rout.
The reversal in the artificial-intelligence trade deepened as Netflix slid on its weakest revenue forecast in three years and chipmakers crashed, while investors rewarded Apple for consumer execution over hardware-supply exposure.
Sources: WSJ Markets · FT Markets · FT World · ↑ top
This Afternoon: Smoke, high 91F.
Tonight: Smoke, low 71F.
Saturday: Patchy Smoke then Showers And Thunderstorms, high 86F.
Latest developments: A publicly traded blockchain-native capital marketplace agreed to buy Pittsburgh real-estate lender Kiavi for $717 million, WPXI reported Friday, July 17.
Kiavi, a Pittsburgh lender that uses artificial intelligence to underwrite loans to real-estate investors, will fold into a marketplace for tokenized assets under the $717 million transaction.
Latest developments: Nicole Holderfield said her family found a large empty void beneath the two-car garage of their Ryan Homes house in North Huntingdon's Altman Farms neighborhood and is warning other buyers, KDKA reported July 17.
The Holderfields discovered dead space under the front-facing garage of their Westmoreland County home built by Ryan Homes and want other owners to check for similar construction.
Latest developments: The Ross and Carol Nese Foundation gave the city of Pittsburgh a $1 million grant to expand public-safety recruitment, WPXI reported Friday, July 17.
Mayor Corey O'Connor and the Pittsburgh Department of Public Safety will use the Nese Foundation money to bolster hiring across the city's police, fire, and emergency-medical agencies.
Latest developments: The Food and Drug Administration traced the multistate cyclosporiasis outbreak—which sickened 11 people in Allegheny County—to a single Mexican iceberg-lettuce supplier used by Taco Bell, the CDC said Friday, July 17.
The tainted iceberg lettuce reached Taco Bell locations in Indiana, Kentucky, Michigan, Ohio, and West Virginia; the cyclospora parasite causes prolonged diarrheal illness.
Latest developments: The Andy Warhol Museum named Hannah Klemm its new Milton Fine Curator of Art, WPXI reported July 17.
Klemm takes the top curatorial post at the Andy Warhol Museum on Pittsburgh's North Shore.
Latest developments: Picklesburgh opened as planned Friday, July 17, in Downtown Pittsburgh even as the Code Purple air-quality alert forced cancellation of other outdoor events such as America's Mile.
Picklesburgh, the city's pickle-themed food festival, runs Thursday through Sunday, July 16-19, in Downtown Pittsburgh, with hours of noon to 10 p.m. Thursday through Saturday and noon to 6 p.m. Sunday.
Sources: WPXI · NEXTpittsburgh Events · ↑ top
Pirates (50-47)
Up Next · Pirates @ Guardians · Fri Jul 17, 7:10 PM
Latest developments: A Post-Gazette training-camp countdown argued July 17 that tight end Pat Freiermuth should finally become a central member of the Steelers offense.
The Post-Gazette ties Freiermuth's expected leap to quarterback Aaron Rodgers and coach Mike McCarthy's scheme as camp nears at Saint Vincent College in Latrobe.
Sources: Post-Gazette Steelers · ↑ top
Latest developments: A Post-Gazette piece July 17 detailed how the 'hold-in'—reporting to camp while sitting out drills—has become Steelers players' preferred tool in stalled contract talks, with cornerback Joey Porter Jr. among those seeking a new deal.
The Post-Gazette traced the hold-in from Le'Veon Bell's holdout era to the present, framing Porter's push for a raise as cornerback salaries around the NFL surge.
Sources: Post-Gazette Steelers · ↑ top
Latest developments: Post-Gazette columnist Noah Hiles argued July 17 that the starting rotation will ultimately decide how far the Pirates go in the second half.
Hiles pins the Pirates' playoff push on starters Paul Skenes, Braxton Ashcraft, and Mitch Keller as the club sits two games out of a wild-card spot at 50-47 after the All-Star break.
Sources: Post-Gazette Pirates · ↑ top
Latest developments: Mauricio Pochettino said Friday, July 17, he will announce next week whether he stays as United States men's national team coach.
Pochettino's contract, funded in part by billionaire donors, expired with the Americans' round-of-16 World Cup exit to Belgium; U.S. Soccer earlier said it would 'take a break' before settling his future and the vacant sporting-director job.
Sources: ESPN Soccer · ↑ top
Latest developments: New York City FC would like to bring United States captain Christian Pulisic to Major League Soccer, ESPN reported July 17, though it calls the move 'dead in the water' because AC Milan has no interest in selling.
Pulisic, the top American men's player, remains under contract at AC Milan following the U.S. World Cup exit.
Sources: ESPN Soccer · ↑ top
Latest developments: Dozens of Team USA women Olympians and Paralympians received personalized keys to the Las Vegas Strip at the inaugural SHE Weekend parade Thursday, July 16, ESPN reported.
The SHE Weekend festivities in Las Vegas honored American women Olympic and Paralympic athletes.
Sources: ESPN Olympics · ↑ top
S&P 500 7,548.10 ▲ +0.5% Dow 52,571.11 ▼ -0.3% Nasdaq 26,082.60 ▲ +0.4% WTI crude 77.49 ▲ +9.7% EUR/USD 1.1423 = -0.0% GBP/USD 1.3418 ▲ +0.4% USD/JPY 162.19 ▲ +0.1%