daily plain-text briefing: security, markets, business, and pittsburgh
Attackers weaponized freshly disclosed flaws across WordPress, SharePoint, Fortinet, and SonicWall as CISA set emergency patch deadlines and two Fortune 500 firms disclosed breaches.
Latest developments: CISA added SharePoint Server deserialization flaw CVE-2026-58644, rated 9.8, to its Known Exploited Vulnerabilities catalog with a July 19 fix deadline, ordered agencies to patch two exploited Fortinet FortiSandbox flaws by Sunday, and Dark Reading tied the Inc ransomware crew to a chain of two SonicWall SMA zero-days that yields root.
Attackers are weaponizing freshly disclosed enterprise flaws within days; federal agencies and enterprises running SharePoint, FortiSandbox, and SonicWall SMA appliances should patch on the emergency timelines.
Sources: The Hacker News · SecurityWeek · BleepingComputer · Dark Reading · ↑ top
Latest developments: A UC Berkeley team named Cross-Site Prompting, or XSP, the web-agent version of cross-site scripting and built a mediator called Prismata to block it, Google's Gemini let strangers send messages from a locked Android phone, and Harvard Kennedy School and Meta researchers found a convincing script carries AI voice phishing further than the synthetic voice itself.
Autonomous browser agents read stranger-supplied page text as instructions, opening a class of attacks defenders liken to XSS; teams deploying web agents should constrain what content the agent trusts.
Sources: Help Net Security · Graham Cluley · Help Net Security · ↑ top
Latest developments: Abbott Laboratories opened two investigations—one into unauthorized access of legacy Exact Sciences systems in its cancer-diagnostics unit, another into an extortion claim that attackers breached its LabCentral portal—and Ernst & Young began notifying customers of a breach it traced to a compromised third-party support-ticket system its IT staff used.
Two large firms disclosed intrusions reaching through legacy and third-party systems; Abbott and Ernst & Young customers should watch for breach notices.
Sources: BleepingComputer · BleepingComputer · ↑ top
Latest developments: Adam Kues of Assetnote, Searchlight Cyber's attack-surface arm, found wp2shell, a WordPress core flaw that runs code from a single anonymous HTTP request, exposing every 6.9 and 7.0 site until WordPress shipped 6.9.5 and 7.0.2 on Friday and forced the updates through its auto-update system.
The flaw sits in WordPress core, so even a bare install with no plugins runs attacker code from one unauthenticated request; administrators should confirm their sites took the forced 6.9.5 or 7.0.2 update.
Sources: The Hacker News · ↑ top
Latest developments: Researchers caught Contagious Interview operators using steganography in SVG image files, rendered as flags, to smuggle a four-stage OtterCookie payload into fake coding challenges, dropping a browser-credential and crypto-wallet stealer plus a file stealer on job seekers who ran the project.
North Korea-linked actors keep weaponizing fake job postings and coding tests; developers should treat unsolicited take-home projects and their image assets as hostile.
Sources: The Hacker News · ↑ top
Latest developments: Kaspersky uncovered GoSerpent, a previously undocumented malware that has hit government and diplomatic entities across Southeast Asia since late 2025, built for long-term access and intelligence gathering.
The espionage tool focuses on persistence and data collection against regional governments; affected agencies should hunt for the associated implants.
Sources: The Hacker News · ↑ top
Latest developments: American and Iranian forces traded strikes on infrastructure Friday, July 17—U.S. bombs hit bridges and Iran hit a water plant—and Iran began firing on neighboring Gulf states as Yemen's Houthis renewed threats to close Saudi Arabia's Red Sea export route, raising the risk of a wider spiral.
The United States and Iran have fought an escalating war over the Strait of Hormuz for weeks, and crude oil posted double-digit weekly gains as the fighting spread across the Persian Gulf; House Republicans meanwhile pressed a military-funding package smaller than the boost President Trump wants, its passage uncertain amid party divisions.
Sources: WSJ World News · WSJ World News · WSJ Markets · WSJ Politics · ↑ top
Latest developments: U.S. semiconductor shares capped their worst week in more than a year Friday, July 17, as crowded momentum trades unwound, Netflix plunged on a growth warning, and Apple briefly overtook Nvidia as the most valuable U.S. company.
A deepening selloff in Nvidia and other chipmakers, stoked by fresh competition from China's Moonshot AI, dragged the Nasdaq lower and ended a punishing week for the technology stocks that led the market, with Netflix's drop compounding the pressure.
Sources: FT World · WSJ Markets · WSJ Markets · FT World · ↑ top
Tonight: Smoke, low 71F.
Saturday: Areas Of Smoke then Patchy Smoke, high 86F.
Saturday Night: Showers And Thunderstorms then Chance Showers And Thunderstorms, low 66F.
Latest developments: Fences, caution tape, and traffic cones still block Depot Street in Youngwood after a building collapsed there, keeping nearby businesses closed for weeks, WPXI reported July 17.
A building collapse in the Westmoreland County borough of Youngwood has closed Depot Street and forced surrounding businesses to shut down, with no reopening date set.
Latest developments: Tom and Lisa Bihon are transforming the long-abandoned Charlie's Ballgame along Route 30 in Unity Township into Charlie's Hideout Putt and Hit, a mini-golf and batting-cage complex, KDKA reported July 17.
The miniature-golf course sat abandoned for nearly 25 years in Unity Township, Westmoreland County; the Bihons, who played there as children, are reopening it as Charlie's Hideout Putt and Hit.
Latest developments: KDKA profiled July 17 a Pennsylvania employment program run by Achieva that placed Jack Hartley assembling boxes at Grandpa Joe's Candy's warehouse in Robinson Township, part of a broader push to bring people with disabilities into the workforce.
The state-supported Achieva program helps people with disabilities find paying jobs; Hartley has worked for two and a half months building shipping boxes at the Grandpa Joe's warehouse in Robinson Township.
Latest developments: The CDC confirmed Friday, July 17, that the multistate cyclosporiasis outbreak traces to iceberg lettuce from a single central-Mexico farm supplied to Taco Bell, prompting Taylor Fresh Foods to pull all iceberg lettuce from the region.
The parasitic outbreak, which the Allegheny County Health Department flagged locally with 11 confirmed cases, sickened thousands across more than 30 states; an FDA traceback pointed to Taylor Farms iceberg lettuce used by Taco Bell locations in Indiana, Kentucky, Michigan, Ohio, and West Virginia.
Latest developments: Pennsylvania Western University president Jon Anderson will step down in August to become president of Utah Valley University, TribLive and the Post-Gazette reported July 17.
Jon Anderson leads PennWest, the state system's merged university, and now leaves the post for the presidency of Utah Valley University in Orem, Utah.
Sources: TribLive · Pittsburgh Post-Gazette · ↑ top
Latest developments: Forecasters made Saturday, July 18, a Severe Weather Alert Day for Western Pennsylvania, calling for strong to severe storms that will wash out the wildfire smoke behind the statewide Code Purple air-quality alert.
Wildfire smoke from Canada and Minnesota pushed Pennsylvania into a Code Purple 'very unhealthy' alert Friday, closing Kennywood and Sandcastle and postponing the Pirates' game in Cleveland; storms arriving late Saturday will clear the haze.
Latest developments: The 44th Pittsburgh Vintage Grand Prix holds its race Sunday, July 19, KDKA previewed July 17, with organizers watching whether lingering wildfire smoke affects the weekend.
The Pittsburgh Vintage Grand Prix, one of the world's premier vintage motorsports events, runs its 44th annual race Sunday, July 19, capping a weekend of vintage-car competition.
Sources: KDKA · NEXTpittsburgh Events · ↑ top
Pirates (50-47)
Fri Jul 17 · Pirates @ Guardians · Postponed
Up Next · Pirates @ Guardians · Sat Jul 18, 1:10 PM
Latest developments: The Post-Gazette examined July 17 how the hold-in—reporting to camp but sitting out practice—has become the Steelers' negotiating tactic of choice, and what the team's history with it signals for cornerback Joey Porter Jr.'s stalled contract talks.
Joey Porter Jr. wants a new deal as cornerback salaries surge across the NFL; Post-Gazette writers traced the hold-in from Le'Veon Bell's era to Porter's situation as Steelers training camp nears in Latrobe.
Sources: Post-Gazette Steelers · Post-Gazette Steelers · ↑ top
Latest developments: Post-Gazette columnist Noah Hiles argued July 17 that the Pirates' starting rotation—Paul Skenes, Braxton Ashcraft, Bailey Jones, and Mitch Keller—will ultimately determine how far the team goes in its wild-card push.
The Pirates lean on a young rotation fronted by ace Paul Skenes and All-Star Braxton Ashcraft; Hiles wrote that its performance sets the ceiling for the second half as Pittsburgh chases a playoff berth.
Sources: Post-Gazette Pirates · ↑ top
Latest developments: A Post-Gazette training-camp countdown argued July 17 that tight end Pat Freiermuth should finally become a central piece of the Steelers offense under quarterback Aaron Rodgers and coach Mike McCarthy.
Freiermuth has flashed potential across his career without a defined featured role; the Post-Gazette projects the new Rodgers-McCarthy offense will lean on him heavily as camp opens in Latrobe.
Sources: Post-Gazette Steelers · ↑ top
Latest developments: Mauricio Pochettino said Friday, July 17, he will decide next week whether to stay on as coach of the U.S. men's national team, days after U.S. Soccer said it would 'take a break' before resolving his future.
Pochettino's contract, funded partly by billionaire donors, expired with the United States' round-of-16 exit from its home World Cup; the sporting-director job has sat vacant since Matt Crocker resigned in April.
Sources: ESPN Soccer · ↑ top
Latest developments: Dozens of Team USA women Olympians and Paralympians received personalized keys to the Las Vegas Strip on Thursday, July 16, at the inaugural SHE Weekend parade honoring American female athletes, ESPN reported.
The first SHE Weekend celebrated United States women Olympic and Paralympic athletes with a Las Vegas Strip parade and festivities built around them.
Sources: ESPN Olympics · ↑ top
S&P 500 7,524.56 ▼ -0.1% Dow 52,472.99 ▼ -0.4% Nasdaq 25,930.32 ▼ -0.5% WTI crude 79.56 ▲ +11.7% EUR/USD 1.1434 ▲ +0.1% GBP/USD 1.3444 ▲ +0.4% USD/JPY 162.28 = +0.0%