================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Friday, July 17, 2026 - 9:06 PM EDT ================================================================ Attackers weaponized freshly disclosed flaws across WordPress, SharePoint, Fortinet, and SonicWall as CISA set emergency patch deadlines and two Fortune 500 firms disclosed breaches. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] CISA flagged actively exploited SharePoint, Fortinet, and SonicWall bugs while WordPress rushed patches for the anonymous-RCE wp2shell core flaw, all weaponized within days of disclosure. see: CISA Flags Exploited SharePoint, Fortinet, and SonicWall Flaws; wp2shell WordPress Core Zero-Day * [TREND] UC Berkeley researchers dubbed browser-agent prompt injection Cross-Site Prompting, echoing XSS, after Google's Gemini let strangers message from a locked Android phone. see: AI Web Agents Face Prompt Injection * [TREND] Abbott opened investigations into legacy Exact Sciences systems and an extortion claim while Ernst & Young traced its breach to a compromised support vendor. see: Abbott and Ernst & Young Breaches * [TREND] North Korea's Contagious Interview crews hid OtterCookie in steganographic SVG coding tests as Kaspersky exposed GoSerpent spying on Southeast Asian governments. see: North Korea Hides OtterCookie in SVG Coding Tests; GoSerpent Espionage in Southeast Asia * [UPDATE (updated)] U.S. and Iranian forces struck each other's infrastructure Friday as Iran fired on Gulf neighbors and Houthis threatened Saudi Arabia's Red Sea shipping. see: U.S.-Iran War Widens to Gulf Infrastructure * [UPDATE (new)] U.S. semiconductor shares logged their worst week in over a year as momentum trades unwound, Netflix plunged, and Apple briefly passed Nvidia. see: Chip Stocks Post Worst Week in Over a Year SECURITY ---------------------------------------------------------------- 1. CISA FLAGS EXPLOITED SHAREPOINT, FORTINET, AND SONICWALL FLAWS Vulnerabilities and Exploits · [zero-day, patch, ransomware] Latest developments: CISA added SharePoint Server deserialization flaw CVE-2026-58644, rated 9.8, to its Known Exploited Vulnerabilities catalog with a July 19 fix deadline, ordered agencies to patch two exploited Fortinet FortiSandbox flaws by Sunday, and Dark Reading tied the Inc ransomware crew to a chain of two SonicWall SMA zero-days that yields root. Attackers are weaponizing freshly disclosed enterprise flaws within days; federal agencies and enterprises running SharePoint, FortiSandbox, and SonicWall SMA appliances should patch on the emergency timelines. - The Hacker News: https://thehackernews.com/2026/07/cisa-adds-exploited-sharepoint-rce-zero.html - SecurityWeek: https://www.securityweek.com/fresh-sharepoint-vulnerability-exploited-soon-after-disclosure/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/cisa-warns-feds-to-patch-exploited-fortinet-fortisandbox-flaws-by-sunday/ - Dark Reading: https://www.darkreading.com/vulnerabilities-threats/inc-ransomware-exploits-sonicwall-sma-zero-days 2. AI WEB AGENTS FACE PROMPT INJECTION AI Security · [ai, prompt-injection] Latest developments: A UC Berkeley team named Cross-Site Prompting, or XSP, the web-agent version of cross-site scripting and built a mediator called Prismata to block it, Google's Gemini let strangers send messages from a locked Android phone, and Harvard Kennedy School and Meta researchers found a convincing script carries AI voice phishing further than the synthetic voice itself. Autonomous browser agents read stranger-supplied page text as instructions, opening a class of attacks defenders liken to XSS; teams deploying web agents should constrain what content the agent trusts. - Help Net Security: https://www.helpnetsecurity.com/2026/07/17/xss-web-agent-prompt-injection/ - Graham Cluley: https://www.bitdefender.com/en-us/blog/hotforsecurity/googles-gemini-strangers-messages-locked-android-phone - Help Net Security: https://www.helpnetsecurity.com/2026/07/17/research-ai-voice-phishing/ 3. ABBOTT AND ERNST & YOUNG BREACHES Data Breaches · [breach, extortion] Latest developments: Abbott Laboratories opened two investigations—one into unauthorized access of legacy Exact Sciences systems in its cancer-diagnostics unit, another into an extortion claim that attackers breached its LabCentral portal—and Ernst & Young began notifying customers of a breach it traced to a compromised third-party support-ticket system its IT staff used. Two large firms disclosed intrusions reaching through legacy and third-party systems; Abbott and Ernst & Young customers should watch for breach notices. - BleepingComputer: https://www.bleepingcomputer.com/news/security/abbott-laboratories-probes-two-cyber-incidents-amid-extortion-claims/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/ernst-and-young-discloses-data-breach-after-support-system-hack/ 4. WP2SHELL WORDPRESS CORE ZERO-DAY Vulnerabilities and Exploits · [zero-day, patch, rce] Latest developments: Adam Kues of Assetnote, Searchlight Cyber's attack-surface arm, found wp2shell, a WordPress core flaw that runs code from a single anonymous HTTP request, exposing every 6.9 and 7.0 site until WordPress shipped 6.9.5 and 7.0.2 on Friday and forced the updates through its auto-update system. The flaw sits in WordPress core, so even a bare install with no plugins runs attacker code from one unauthenticated request; administrators should confirm their sites took the forced 6.9.5 or 7.0.2 update. - The Hacker News: https://thehackernews.com/2026/07/new-wp2shell-wordpress-core-flaw-lets.html 5. NORTH KOREA HIDES OTTERCOOKIE IN SVG CODING TESTS Nation-State Activity · [apt, north-korea, malware] Latest developments: Researchers caught Contagious Interview operators using steganography in SVG image files, rendered as flags, to smuggle a four-stage OtterCookie payload into fake coding challenges, dropping a browser-credential and crypto-wallet stealer plus a file stealer on job seekers who ran the project. North Korea-linked actors keep weaponizing fake job postings and coding tests; developers should treat unsolicited take-home projects and their image assets as hostile. - The Hacker News: https://thehackernews.com/2026/07/north-korea-linked-hackers-hide.html 6. GOSERPENT ESPIONAGE IN SOUTHEAST ASIA Nation-State Activity · [apt, espionage, malware] Latest developments: Kaspersky uncovered GoSerpent, a previously undocumented malware that has hit government and diplomatic entities across Southeast Asia since late 2025, built for long-term access and intelligence gathering. The espionage tool focuses on persistence and data collection against regional governments; affected agencies should hunt for the associated implants. - The Hacker News: https://thehackernews.com/2026/07/new-goserpent-malware-targets-southeast.html BUSINESS AND POLITICS ---------------------------------------------------------------- * U.S.-Iran War Widens to Gulf Infrastructure Latest developments: American and Iranian forces traded strikes on infrastructure Friday, July 17—U.S. bombs hit bridges and Iran hit a water plant—and Iran began firing on neighboring Gulf states as Yemen's Houthis renewed threats to close Saudi Arabia's Red Sea export route, raising the risk of a wider spiral. The United States and Iran have fought an escalating war over the Strait of Hormuz for weeks, and crude oil posted double-digit weekly gains as the fighting spread across the Persian Gulf; House Republicans meanwhile pressed a military-funding package smaller than the boost President Trump wants, its passage uncertain amid party divisions. - WSJ World News: https://www.wsj.com/world/middle-east/the-u-s-and-iran-creep-toward-a-wider-war-with-escalating-attacks-7323c060 - WSJ World News: https://www.wsj.com/world/middle-east/the-threat-to-saudi-arabias-main-oil-export-route-is-growing-6927e974 - WSJ Markets: https://www.wsj.com/finance/commodities-futures/oil-rises-amid-escalating-supply-disruption-concerns-c3dcf86d?mod=rss_markets_main - WSJ Politics: https://www.wsj.com/politics/policy/gop-package-to-fund-iran-war-runs-into-republican-doubts-5502da4e * Chip Stocks Post Worst Week in Over a Year Latest developments: U.S. semiconductor shares capped their worst week in more than a year Friday, July 17, as crowded momentum trades unwound, Netflix plunged on a growth warning, and Apple briefly overtook Nvidia as the most valuable U.S. company. A deepening selloff in Nvidia and other chipmakers, stoked by fresh competition from China's Moonshot AI, dragged the Nasdaq lower and ended a punishing week for the technology stocks that led the market, with Netflix's drop compounding the pressure. - FT World: https://www.ft.com/content/79a15abd-5892-4f1c-b038-b09a1ceecabb?syn-25a6b1a6=1 - WSJ Markets: https://www.wsj.com/finance/stocks/nasdaq-drops-again-as-chip-slump-deepens-fa87ecb0?mod=rss_markets_main - WSJ Markets: https://www.wsj.com/finance/stocks/u-s-chip-stocks-extend-slide-netflix-tumbles-on-growth-warning-f69617d1?mod=rss_markets_main - FT World: https://www.ft.com/content/9586223a-8339-4a57-9e2f-251899ebd211?syn-25a6b1a6=1 PITTSBURGH ---------------------------------------------------------------- Weather: Tonight: Smoke, low 71F. Saturday: Areas Of Smoke then Patchy Smoke, high 86F. Saturday Night: Showers And Thunderstorms then Chance Showers And Thunderstorms, low 66F. Business: * Youngwood Building Collapse Shutters Businesses Latest developments: Fences, caution tape, and traffic cones still block Depot Street in Youngwood after a building collapsed there, keeping nearby businesses closed for weeks, WPXI reported July 17. A building collapse in the Westmoreland County borough of Youngwood has closed Depot Street and forced surrounding businesses to shut down, with no reopening date set. - WPXI: https://www.wpxi.com/news/local/businesses-closed-weeks-after-building-collapses-westmoreland-county/7QMD6XUG3ZFB3ANKTLQVBATHDA/ * Unity Township Mini-Golf Course Reborn Latest developments: Tom and Lisa Bihon are transforming the long-abandoned Charlie's Ballgame along Route 30 in Unity Township into Charlie's Hideout Putt and Hit, a mini-golf and batting-cage complex, KDKA reported July 17. The miniature-golf course sat abandoned for nearly 25 years in Unity Township, Westmoreland County; the Bihons, who played there as children, are reopening it as Charlie's Hideout Putt and Hit. - KDKA: https://www.cbsnews.com/pittsburgh/news/abandoned-golf-course-charlies-hideout-putt-and-hit/ * Achieva Program Puts Disabled Workers on the Job Latest developments: KDKA profiled July 17 a Pennsylvania employment program run by Achieva that placed Jack Hartley assembling boxes at Grandpa Joe's Candy's warehouse in Robinson Township, part of a broader push to bring people with disabilities into the workforce. The state-supported Achieva program helps people with disabilities find paying jobs; Hartley has worked for two and a half months building shipping boxes at the Grandpa Joe's warehouse in Robinson Township. - KDKA: https://www.cbsnews.com/pittsburgh/news/achieva-disability-employment-program/ Around town: * Cyclospora Outbreak Traced to Taco Bell Lettuce Latest developments: The CDC confirmed Friday, July 17, that the multistate cyclosporiasis outbreak traces to iceberg lettuce from a single central-Mexico farm supplied to Taco Bell, prompting Taylor Fresh Foods to pull all iceberg lettuce from the region. The parasitic outbreak, which the Allegheny County Health Department flagged locally with 11 confirmed cases, sickened thousands across more than 30 states; an FDA traceback pointed to Taylor Farms iceberg lettuce used by Taco Bell locations in Indiana, Kentucky, Michigan, Ohio, and West Virginia. - KDKA: https://www.cbsnews.com/pittsburgh/news/cyclosporiasis-outbreak-taco-bell-lettuce-mexico/ - KDKA: https://www.cbsnews.com/pittsburgh/news/taylor-farms-pulls-iceberg-lettuce/ * PennWest President Departs for Utah Latest developments: Pennsylvania Western University president Jon Anderson will step down in August to become president of Utah Valley University, TribLive and the Post-Gazette reported July 17. Jon Anderson leads PennWest, the state system's merged university, and now leaves the post for the presidency of Utah Valley University in Orem, Utah. - TribLive: https://triblive.com/local/regional/pennwest-president-steps-down-heads-to-utah-valley-university/ - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/education/2026/07/17/pennwest-utah-valley-jon-anderson/stories/202607170060 * Severe Storms to Clear the Smoke Saturday Latest developments: Forecasters made Saturday, July 18, a Severe Weather Alert Day for Western Pennsylvania, calling for strong to severe storms that will wash out the wildfire smoke behind the statewide Code Purple air-quality alert. Wildfire smoke from Canada and Minnesota pushed Pennsylvania into a Code Purple 'very unhealthy' alert Friday, closing Kennywood and Sandcastle and postponing the Pirates' game in Cleveland; storms arriving late Saturday will clear the haze. - WTAE: https://www.wtae.com/article/pennsylvania-storms-saturday-july-18/73174354 - WTAE: https://www.wtae.com/article/heavy-smoke-to-storms-two-alert-days-for-western-pa/73148972 Events: * Pittsburgh Vintage Grand Prix Runs Sunday Latest developments: The 44th Pittsburgh Vintage Grand Prix holds its race Sunday, July 19, KDKA previewed July 17, with organizers watching whether lingering wildfire smoke affects the weekend. The Pittsburgh Vintage Grand Prix, one of the world's premier vintage motorsports events, runs its 44th annual race Sunday, July 19, capping a weekend of vintage-car competition. - KDKA: https://www.cbsnews.com/pittsburgh/video/pittsburgh-vintage-grand-prix-back-for-44th-race-weekend/ - NEXTpittsburgh Events: https://nextpittsburgh.com/events/14-things-to-do-this-weekend-from-picklesburgh-to-the-pittsburgh-vintage-grand-prix/ SPORTS ---------------------------------------------------------------- Pirates (50-47) Fri Jul 17 · Pirates @ Guardians · Postponed https://plaintextsports.com/mlb/2026-07-17/pit-cle Up Next · Pirates @ Guardians · Sat Jul 18, 1:10 PM https://plaintextsports.com/mlb/2026-07-18/pit-cle Around the Teams: * Porter Jr.'s Hold-In Looms Over Steelers Camp Latest developments: The Post-Gazette examined July 17 how the hold-in—reporting to camp but sitting out practice—has become the Steelers' negotiating tactic of choice, and what the team's history with it signals for cornerback Joey Porter Jr.'s stalled contract talks. Joey Porter Jr. wants a new deal as cornerback salaries surge across the NFL; Post-Gazette writers traced the hold-in from Le'Veon Bell's era to Porter's situation as Steelers training camp nears in Latrobe. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/07/17/leveon-holdout-holdin-contract-negotiations-porter/stories/202607170040 - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/07/17/nfl-news-rumors-joey-porter-jr/stories/202607170046 * Rotation Will Decide the Pirates' Season Latest developments: Post-Gazette columnist Noah Hiles argued July 17 that the Pirates' starting rotation—Paul Skenes, Braxton Ashcraft, Bailey Jones, and Mitch Keller—will ultimately determine how far the team goes in its wild-card push. The Pirates lean on a young rotation fronted by ace Paul Skenes and All-Star Braxton Ashcraft; Hiles wrote that its performance sets the ceiling for the second half as Pittsburgh chases a playoff berth. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/07/17/hiles-column-rotation-skenes-ashcraft-jones-keller/stories/202607170043 * Freiermuth Poised for Bigger Steelers Role Latest developments: A Post-Gazette training-camp countdown argued July 17 that tight end Pat Freiermuth should finally become a central piece of the Steelers offense under quarterback Aaron Rodgers and coach Mike McCarthy. Freiermuth has flashed potential across his career without a defined featured role; the Post-Gazette projects the new Rodgers-McCarthy offense will lean on him heavily as camp opens in Latrobe. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/07/17/training-camp-countdown-freiermuth-rodgers-offense-mccarthy/stories/202607170004 Team USA: * Pochettino to Announce USMNT Decision Next Week Latest developments: Mauricio Pochettino said Friday, July 17, he will decide next week whether to stay on as coach of the U.S. men's national team, days after U.S. Soccer said it would 'take a break' before resolving his future. Pochettino's contract, funded partly by billionaire donors, expired with the United States' round-of-16 exit from its home World Cup; the sporting-director job has sat vacant since Matt Crocker resigned in April. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49382484/mauricio-pochettino-make-decision-usmnt-future-next-week * Team USA Women Feted at Las Vegas SHE Weekend Latest developments: Dozens of Team USA women Olympians and Paralympians received personalized keys to the Las Vegas Strip on Thursday, July 16, at the inaugural SHE Weekend parade honoring American female athletes, ESPN reported. The first SHE Weekend celebrated United States women Olympic and Paralympic athletes with a Las Vegas Strip parade and festivities built around them. - ESPN Olympics: https://www.espn.com/olympics/story/_/id/49381919/team-usa-women-athletes-feted-weekend-get-keys-vegas-strip READING ---------------------------------------------------------------- * Stratechery -- IBM Misses, IBM's Mainframe Moat, IBM's Many AI Problems Ben Thompson reads IBM's disappointing preliminary results as a warning that its durable mainframe franchise, long a moat, leaves the company poorly positioned as AI reshapes enterprise software. https://stratechery.com/2026/ibm-misses-ibms-mainframe-moat-ibms-many-ai-problems/ * Ed Zitron -- The OpenAI Bubble Zitron argues OpenAI's soaring valuation rests on unsustainable economics and hype, placing the company at the center of an AI investment bubble he expects to deflate. https://www.wheresyoured.at/the-openai-bubble/ * Cal Newport -- Why Reading Matters Responding to Rose Horowitch's Atlantic essay 'The End of Reading Is Here,' Newport contends that sustained deep reading builds cognitive capacities that skimming and AI summaries cannot replicate. https://calnewport.com/why-reading-matters/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,524.56 ▼ -0.1% Dow 52,472.99 ▼ -0.4% Nasdaq 25,930.32 ▼ -0.5% WTI crude 79.56 ▲ +11.7% EUR/USD 1.1434 ▲ +0.1% GBP/USD 1.3444 ▲ +0.4% USD/JPY 162.28 = +0.0% ================================================================ Generated 2026-07-17 21:06 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================