daily plain-text briefing: security, markets, business, and pittsburgh
An 11-byte request that freezes OpenSSL servers, a Rust ransomware strain that locks a network in under a day, and a botnet ransacking exposed AI services headline a day defined by attacks on infrastructure trust.
Latest developments: Okta's Red Team, which found and named the denial-of-service bug, published HollowByte's details on July 17, 2026, revealing that OpenSSL had quietly shipped the fix in June with no CVE, advisory, or changelog entry.
HollowByte lets an unauthenticated attacker send an 11-byte TLS request that makes an OpenSSL server reserve up to 131 KB of memory for a message that never arrives, and on glibc systems that memory stays gone until the process restarts. Any organization running an unpatched OpenSSL server faces denial of service and should apply the June fix.
Sources: The Hacker News · BleepingComputer · ↑ top
Latest developments: The Hacker News reported that NadMesh, a Go botnet that surfaced in early July 2026, scans Shodan for exposed AI services and that the operator's own dashboard claims 3,811 unique AWS keys.
NadMesh hunts ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio instances to steal cloud keys and Kubernetes tokens from teams that stand up AI tools fast and firewall them late. Organizations should lock down exposed model runners and workflow builders.
Sources: The Hacker News · ↑ top
Latest developments: Symantec's Threat Hunter Team disclosed Spirals, a previously unknown Rust ransomware that attackers deployed last month against an IT services company in South Asia, moving from initial access to data theft and full encryption in under 24 hours.
Spirals encrypts each file with a separate AES-128 key wrapped by an attacker-controlled ECDH key, making recovery without the operator impossible. The speed leaves defenders little time to detect and respond.
Sources: Help Net Security · ↑ top
Latest developments: Checkmarx uncovered ViteVenom, seven malicious npm packages targeting the Vite frontend tooling ecosystem that deliver a remote access trojan through a four-tier blockchain command-and-control spanning Tron and other chains, expanding the earlier ChainVeil campaign.
Developers who pull the poisoned Vite packages get a RAT, and the blockchain-based C2 makes takedown hard because attackers rotate infrastructure on-chain. Teams should audit npm dependencies and pin trusted versions.
Sources: The Hacker News · ↑ top
Latest developments: Expel attributed the April 2026 DigiCert incident to CylindricalCanine, a sub-group of the Chinese group GoldenEyeDog, also tracked as APT-Q-27, Dragon Breath, and Miuuti Group, tying the breach to code-signing certificate theft.
GoldenEyeDog targets the gambling and gaming sectors, and stolen code-signing certificates let its operators sign malware that operating systems and users trust. Organizations should watch for abuse of DigiCert-issued certificates.
Sources: The Hacker News · ↑ top
Latest developments: The European Commission on July 17, 2026 ordered Google to give rival AI assistants the same Android reach Gemini enjoys—the camera, microphone, on-screen content, a display-off wake word, and background control of other apps—starting with Android 18 and fully by August 1, 2027.
The order reshapes how AI assistants reach Android hardware and raises fresh privacy and security questions about third-party assistants driving apps by imitating taps and typing. Regulators frame the move as competition enforcement.
Sources: The Hacker News · ↑ top
Latest developments: U.S. Central Command launched fresh retaliatory strikes Saturday, July 18, and promised swift retaliation, while Iran for the first time hit U.S. Gulf allies—striking a Kuwaiti desalination plant—pushing the toll to 16 American service members killed and more than 430 wounded since the war began.
The war between the United States and Iran, centered on control of the Strait of Hormuz, widened Saturday as both sides bombed each other's infrastructure and military targets and Tehran opened fire on U.S. Gulf allies; an Iranian missile attack on a base in Jordan killed two American troops and left one missing.
Sources: Financial Times · Wall Street Journal · Wall Street Journal · ↑ top
Tonight: Showers And Thunderstorms then Chance Showers And Thunderstorms, low 66F.
Sunday: Mostly Sunny, high 82F.
Sunday Night: Mostly Clear, low 58F.
Latest developments: The Pennsylvania Turnpike Commission will close Camp Hollow Road in West Mifflin in both directions for about a month starting Monday, July 20, for Mon/Fayette Expressway construction.
Camp Hollow Road between New England Road and Camden Hill Road shuts for roadway and drainage reconstruction tied to the Mon/Fayette Expressway project; a detour routes drivers onto Clairton Road and Lebanon Church Road.
Latest developments: PennDOT reiterated Saturday, July 18, that Commercial Street stays closed after some drivers' GPS apps wrongly showed it open beneath the Parkway East bridge project.
PennDOT has the Parkway East (I-376) closed for 25 days through August 3 while crews slide the new Commercial Street Bridge into position; Commercial Street below remains shut to traffic despite navigation maps indicating otherwise.
Latest developments: Crews contained a hydraulic fluid spill in the Allegheny River, the Lower Burrell fire chief said Saturday, July 18, after a Westmoreland County hazmat response.
A reported oil spill in the Allegheny River in Westmoreland County drew a hazmat crew; the Lower Burrell fire chief said responders contained the hydraulic fluid.
Sources: Pittsburgh Post-Gazette · WTAE · ↑ top
Latest developments: Picklesburgh drew thinner crowds Friday and Saturday as rain and wildfire smoke kept people away, and the festival runs its last day Sunday, July 19.
Picklesburgh, Pittsburgh's pickle-themed food festival, fills Downtown Pittsburgh through Sunday, July 19, with final-day hours of noon to 6 p.m.; Canadian-wildfire haze and rain reduced attendance over the weekend.
Sources: Pittsburgh Post-Gazette · NEXTpittsburgh · ↑ top
Pirates (51-47)
Fri Jul 17 · Pirates @ Guardians · Postponed
Sat Jul 18 · Pirates 7 · Guardians 1 · Final
Sat Jul 18 · Pirates 1 · Guardians 0 · Top 3rd (in progress at last update)
Up Next · Pirates @ Guardians · Sun Jul 19, 1:40 PM
Latest developments: A Post-Gazette training-camp countdown, July 18, cast cornerback Jamel Dean as the answer to end the Steelers' long free-agent drought at the position.
The Post-Gazette framed veteran cornerback Jamel Dean as a rare outside free-agent solution in the Steelers secondary as the team opens training camp in Latrobe.
Sources: Post-Gazette Steelers · ↑ top
Latest developments: A Post-Gazette profile, July 18, dug into fifth-overall pick Derek Curiel and his win-at-all-costs reputation.
The Pirates' first-round pick Derek Curiel, an outfielder from LSU by way of Orange Lutheran High School, earned scouts' 'no doubt about it' praise for doing whatever it takes to win, the Post-Gazette reported.
Sources: Post-Gazette Pirates · ↑ top
Latest developments: ESPN's Transfer Talk reported July 19 that United States striker Folarin Balogun could move this summer.
Folarin Balogun, the U.S. men's national team forward, sits at the center of transfer speculation as the summer window opens, ESPN reported.
Sources: ESPN Soccer · ↑ top
Latest developments: U.S. women's captain Lindsey Heaps made her Denver Summit FC debut Saturday, July 18, wearing the armband and setting up the game-winner.
Lindsey Heaps, captain of the United States women's national team, tallied the game-winning assist in her Denver Summit FC debut, a 2-1 win over the Portland Thorns.
Sources: ESPN Soccer · ↑ top
S&P 500 7,524.56 ▼ -0.1% Dow 52,472.99 ▼ -0.4% Nasdaq 25,930.32 ▼ -0.5% WTI crude 79.70 ▲ +11.9% EUR/USD 1.1434 ▲ +0.1% GBP/USD 1.3444 ▲ +0.4% USD/JPY 162.28 = +0.0%