daily plain-text briefing: security, markets, business, and pittsburgh
Working exploit code went public for critical WordPress and Windows flaws as OpenSSL patched a one-packet denial-of-service bug and a Chinese group made off with DigiCert's code-signing certificates.
Latest developments: wp2shell picked up CVE IDs today, and researchers published its full mechanism, a persistent-object-cache condition, and a working proof-of-concept, while a researcher using the handle Nightmare Eclipse released a complete LegacyHive exploit that hands attackers administrator rights on fully patched Windows.
wp2shell, a WordPress core flaw Adam Kues of Assetnote found, runs code from a single anonymous HTTP request against any 6.9 or 7.0 site until admins install 6.9.5 or 7.0.2; LegacyHive escalates a local user to administrator on up-to-date Windows through the User Profile Service. Patch WordPress now and prepare for Microsoft's fix.
Sources: The Hacker News · BleepingComputer · ↑ top
Latest developments: Okta's Red Team disclosed HollowByte, a denial-of-service flaw that makes an unpatched OpenSSL server reserve up to 131 KB of memory for an 11-byte TLS request that never arrives, memory that stays gone on glibc systems until the process restarts.
OpenSSL shipped the HollowByte fix in June with no CVE, advisory, or changelog note, so many administrators never learned to update, and unauthenticated attackers can exhaust server memory with tiny payloads. Rebuild against the patched OpenSSL.
Sources: The Hacker News · BleepingComputer · ↑ top
Latest developments: Symantec's Threat Hunter Team documented Spirals, a Rust ransomware that hit an IT services company in South Asia last month and moved from initial access to data theft and full encryption in under 24 hours, as a separate crew struck German naval-defense builder TKMS.
Spirals encrypts each file with its own AES-128 key wrapped by attacker-controlled ECDH, leaving defenders little time to react, and the TKMS hit shows ransomware reaching into defense manufacturing. Tighten initial-access controls and rehearse rapid containment.
Sources: Help Net Security · SecurityWeek · ↑ top
Latest developments: Checkmarx flagged seven malicious npm packages, codenamed ViteVenom, that target the Vite tooling ecosystem and route command-and-control through a four-tier blockchain infrastructure spanning Tron to deliver a remote access trojan, while the new Go botnet NadMesh scanned exposed AI services and claims 3,811 stolen AWS keys.
NadMesh harvests cloud keys and Kubernetes tokens from fast-deployed, slow-firewalled AI tools such as ComfyUI, Ollama, and Open WebUI, and ViteVenom extends the ChainVeil campaign's blockchain-based command-and-control. Lock down exposed AI services and vet npm dependencies.
Sources: The Hacker News · The Hacker News · ↑ top
Latest developments: The European Commission ordered Google to open Android's camera, microphone, on-screen content, and wake word to rival AI assistants in Android 18 by August 1, 2027, and the Pentagon suspended CMMC Phase 2, pausing third-party audits of defense contractors.
The EU order forces Google to grant competitors the same device reach Gemini already enjoys, raising fresh privacy and security questions, while the CMMC pause halts audits yet leaves contractors' legal duty to protect controlled unclassified information intact. Track both as they reshape platform and compliance obligations.
Sources: The Hacker News · SecurityWeek · ↑ top
Latest developments: Expel attributed the April 2026 DigiCert breach to CylindricalCanine, a subgroup of the Chinese cybercrime group GoldenEyeDog, and tied the intrusion to the theft of code-signing certificates.
GoldenEyeDog, also tracked as APT-Q-27, Dragon Breath, and Miuuti Group, has long targeted gambling and gaming operators, and stolen code-signing certificates let its malware masquerade as trusted software. Audit certificate trust and hunt for signed but unexpected binaries.
Sources: The Hacker News · ↑ top
Latest developments: Iran switched to more-lethal missiles over the past week, making it one of the deadliest stretches for commercial sailors since the war began, and on Saturday, July 18, struck neighboring Gulf states—hitting a Kuwaiti desalination plant—while U.S. bombs took out bridges.
The United States and Iran traded strikes on infrastructure across the Persian Gulf, with neither side backing down and Iran firing on the waters around the Strait of Hormuz, sending oil futures to double-digit weekly gains and pushing the conflict toward a wider regional war.
Sources: WSJ World News · WSJ World News · WSJ Markets · ↑ top
Today: Showers And Thunderstorms Likely then Chance Showers And Thunderstorms, high 87F.
Tonight: Showers And Thunderstorms, low 67F.
Sunday: Mostly Sunny, high 82F.
Latest developments: WTAE reported July 17 that merchants along the Parkway East detour route through Homestead are gaining new customers as roughly 100,000 daily drivers reroute around the closed highway.
PennDOT's closure of the Parkway East (I-376) for the Commercial Street Bridge replacement funnels detour traffic through the borough of Homestead, and shops and restaurants along the route say the passing drivers have lifted sales.
Latest developments: Ford Motor ranked first among mass-market car brands in J.D. Power and Associates' 2026 survey, and KDKA talked July 17 with a Pittsburgh-area dealer about what the result means for buyers.
Ford placed atop J.D. Power's 2026 mass-market brand list, a ranking that shapes how area dealerships pitch the brand's reliability to shoppers.
Latest developments: The EPA expects Pittsburgh's air to improve sharply this weekend as strong to severe storms forecast for Saturday afternoon, July 18, clear the wildfire smoke, after Thursday hit the hazardous maroon range and Friday held at Code Purple 'very unhealthy.'
Smoke from wildfires in Canada and Minnesota drove Western Pennsylvania's air to 'very unhealthy' levels, closing Kennywood and Sandcastle, postponing the Pirates' game in Cleveland, and canceling the America's Mile race, before storms forecast for Saturday afternoon clear it out.
Sources: KDKA · WTAE · WPXI · ↑ top
Latest developments: The Post-Gazette examined July 18 how consolidating the Duquesne City and McKeesport Area school districts could help or hurt both cities, days after the Pennsylvania Department of Education agreed to study the merger.
Pennsylvania's education department is analyzing a consolidation of the financially troubled Duquesne City School District with the McKeesport Area School District across the Monongahela River, a step that would give the struggling Duquesne district a full-district partner.
Sources: Pittsburgh Post-Gazette · ↑ top
Latest developments: The Post-Gazette reported July 18 that Attorney General Dave Sunday is defending Pennsylvania's ban on Medicaid funding for abortion in a court challenge, and examined whether his office is legally required to mount that defense.
Pennsylvania Attorney General Dave Sunday is defending the state's prohibition on Medicaid coverage of abortion against a court challenge, raising the question of whether the office must defend a law it may not favor.
Sources: Pittsburgh Post-Gazette · ↑ top
Latest developments: Picklesburgh drew thinner Friday crowds under the wildfire smoke, and the Pittsburgh Downtown Partnership kept all Saturday and Sunday activities on schedule through the festival's close Sunday, July 19.
Picklesburgh, the Pittsburgh Downtown Partnership's pickle-themed street festival, runs through Sunday, July 19, in Downtown Pittsburgh, with hours of noon to 6 p.m. on the final day.
Latest developments: The 44th Pittsburgh Vintage Grand Prix holds its race Sunday, July 19, as air quality improves following the week's wildfire smoke.
The Pittsburgh Vintage Grand Prix, a vintage-car racing weekend, culminates in its 44th running Sunday, July 19.
Sources: NEXTpittsburgh Events · ↑ top
Pirates (50-47)
Fri Jul 17 · Pirates @ Guardians · Postponed
Up Next · Pirates @ Guardians · Sat Jul 18, 1:10 PM
Latest developments: A Post-Gazette training-camp countdown July 18 cast free-agent signing Jamel Dean as the Steelers' bid to stabilize a cornerback spot that has churned through open-market additions.
The Post-Gazette's camp countdown argues cornerback Jamel Dean, whom the Steelers signed in free agency, must end the team's long run of misses on veteran corners as camp opens in Latrobe.
Sources: Post-Gazette Steelers · ↑ top
Latest developments: ESPN reported July 17 that United States women's national team star Lindsey Heaps is transferring to NWSL expansion side Denver Summit FC, a homecoming to Colorado after years with PSG and other European clubs.
Lindsey Heaps, a veteran United States women's national team midfielder, is joining the new NWSL club Denver Summit FC, ending a globetrotting run through European soccer to return to her home state of Colorado.
Sources: ESPN Soccer · ↑ top
S&P 500 7,524.56 ▼ -0.1% Dow 52,472.99 ▼ -0.4% Nasdaq 25,930.32 ▼ -0.5% WTI crude 79.70 ▲ +11.9% EUR/USD 1.1434 ▲ +0.1% GBP/USD 1.3444 ▲ +0.4% USD/JPY 162.28 = +0.0%