================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Saturday, July 18, 2026 - 9:06 PM EDT ================================================================ An 11-byte request that freezes OpenSSL servers, a Rust ransomware strain that locks a network in under a day, and a botnet ransacking exposed AI services headline a day defined by attacks on infrastructure trust. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Attackers hollowed the software trust chain, stealing DigiCert code-signing certificates via GoldenEyeDog while ViteVenom slipped malicious npm packages that hide command-and-control on blockchains. see: GoldenEyeDog Linked to DigiCert Certificate Theft; ViteVenom npm Packages Use Blockchain C2 * [TREND] The rush to deploy AI tooling is opening fresh attack surface, with the new Go botnet NadMesh scanning the internet for exposed AI services and harvesting thousands of cloud keys. see: NadMesh Botnet Hunts Exposed AI Services * [UPDATE (new)] Symantec disclosed Spirals, a Rust ransomware that raced from initial access to full network encryption in under 24 hours against a South Asian IT services firm. see: Spirals Ransomware Encrypts in Under 24 Hours * [UPDATE (new)] U.S. Central Command struck Iran again after 16 American service-member deaths, while Tehran hit a Kuwaiti desalination plant in its first attack on Gulf allies. see: U.S. Strikes Iran After Troop Deaths, Tehran Hits Gulf States * [UPDATE (new)] Okta's Red Team revealed HollowByte, an OpenSSL memory-freezing denial-of-service bug that maintainers quietly patched in June with no CVE, advisory, or changelog entry. see: HollowByte Freezes OpenSSL Server Memory * [UPDATE (new)] The European Commission ordered Google to grant rival AI assistants the same Android camera, microphone, and wake-word reach that Gemini currently enjoys. see: EU Orders Google to Open Android to Rival AI SECURITY ---------------------------------------------------------------- 1. HOLLOWBYTE FREEZES OPENSSL SERVER MEMORY Vulnerabilities and Exploits · [vulnerability, dos, patch] Latest developments: Okta's Red Team, which found and named the denial-of-service bug, published HollowByte's details on July 17, 2026, revealing that OpenSSL had quietly shipped the fix in June with no CVE, advisory, or changelog entry. HollowByte lets an unauthenticated attacker send an 11-byte TLS request that makes an OpenSSL server reserve up to 131 KB of memory for a message that never arrives, and on glibc systems that memory stays gone until the process restarts. Any organization running an unpatched OpenSSL server faces denial of service and should apply the June fix. - The Hacker News: https://thehackernews.com/2026/07/openssl-hollowbyte-flaw-could-freeze.html - BleepingComputer: https://www.bleepingcomputer.com/news/security/hollowbyte-ddos-flaw-bloats-openssl-server-memory-with-11-byte-payload/ 2. NADMESH BOTNET HUNTS EXPOSED AI SERVICES AI Security · [botnet, cloud, ai] Latest developments: The Hacker News reported that NadMesh, a Go botnet that surfaced in early July 2026, scans Shodan for exposed AI services and that the operator's own dashboard claims 3,811 unique AWS keys. NadMesh hunts ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio instances to steal cloud keys and Kubernetes tokens from teams that stand up AI tools fast and firewall them late. Organizations should lock down exposed model runners and workflow builders. - The Hacker News: https://thehackernews.com/2026/07/new-nadmesh-botnet-hunts-exposed-ai.html 3. SPIRALS RANSOMWARE ENCRYPTS IN UNDER 24 HOURS Ransomware and Cybercrime · [ransomware] Latest developments: Symantec's Threat Hunter Team disclosed Spirals, a previously unknown Rust ransomware that attackers deployed last month against an IT services company in South Asia, moving from initial access to data theft and full encryption in under 24 hours. Spirals encrypts each file with a separate AES-128 key wrapped by an attacker-controlled ECDH key, making recovery without the operator impossible. The speed leaves defenders little time to detect and respond. - Help Net Security: https://www.helpnetsecurity.com/2026/07/17/spirals-ransomware-south-asia/ 4. VITEVENOM NPM PACKAGES USE BLOCKCHAIN C2 Ransomware and Cybercrime · [supply-chain, malware] Latest developments: Checkmarx uncovered ViteVenom, seven malicious npm packages targeting the Vite frontend tooling ecosystem that deliver a remote access trojan through a four-tier blockchain command-and-control spanning Tron and other chains, expanding the earlier ChainVeil campaign. Developers who pull the poisoned Vite packages get a RAT, and the blockchain-based C2 makes takedown hard because attackers rotate infrastructure on-chain. Teams should audit npm dependencies and pin trusted versions. - The Hacker News: https://thehackernews.com/2026/07/seven-malicious-vite-npm-packages-use.html 5. GOLDENEYEDOG LINKED TO DIGICERT CERTIFICATE THEFT Data Breaches · [apt, breach] Latest developments: Expel attributed the April 2026 DigiCert incident to CylindricalCanine, a sub-group of the Chinese group GoldenEyeDog, also tracked as APT-Q-27, Dragon Breath, and Miuuti Group, tying the breach to code-signing certificate theft. GoldenEyeDog targets the gambling and gaming sectors, and stolen code-signing certificates let its operators sign malware that operating systems and users trust. Organizations should watch for abuse of DigiCert-issued certificates. - The Hacker News: https://thehackernews.com/2026/07/goldeneyedog-subgroup-linked-to.html 6. EU ORDERS GOOGLE TO OPEN ANDROID TO RIVAL AI Policy and Regulation · [policy] Latest developments: The European Commission on July 17, 2026 ordered Google to give rival AI assistants the same Android reach Gemini enjoys—the camera, microphone, on-screen content, a display-off wake word, and background control of other apps—starting with Android 18 and fully by August 1, 2027. The order reshapes how AI assistants reach Android hardware and raises fresh privacy and security questions about third-party assistants driving apps by imitating taps and typing. Regulators frame the move as competition enforcement. - The Hacker News: https://thehackernews.com/2026/07/eu-orders-google-to-open-android-mic.html BUSINESS AND POLITICS ---------------------------------------------------------------- * U.S. Strikes Iran After Troop Deaths, Tehran Hits Gulf States Latest developments: U.S. Central Command launched fresh retaliatory strikes Saturday, July 18, and promised swift retaliation, while Iran for the first time hit U.S. Gulf allies—striking a Kuwaiti desalination plant—pushing the toll to 16 American service members killed and more than 430 wounded since the war began. The war between the United States and Iran, centered on control of the Strait of Hormuz, widened Saturday as both sides bombed each other's infrastructure and military targets and Tehran opened fire on U.S. Gulf allies; an Iranian missile attack on a base in Jordan killed two American troops and left one missing. - Financial Times: https://www.ft.com/content/e8e8adc5-7c56-45a8-99fc-bb5acfda263e?syn-25a6b1a6=1 - Wall Street Journal: https://www.wsj.com/world/middle-east/two-u-s-servicemembers-killed-one-missing-in-iran-missile-attack-on-jordan-a59f9699 - Wall Street Journal: https://www.wsj.com/world/middle-east/the-u-s-and-iran-creep-toward-a-wider-war-with-escalating-attacks-7323c060 PITTSBURGH ---------------------------------------------------------------- Weather: Tonight: Showers And Thunderstorms then Chance Showers And Thunderstorms, low 66F. Sunday: Mostly Sunny, high 82F. Sunday Night: Mostly Clear, low 58F. Around town: * West Mifflin Road Closes a Month for Mon/Fayette Work Latest developments: The Pennsylvania Turnpike Commission will close Camp Hollow Road in West Mifflin in both directions for about a month starting Monday, July 20, for Mon/Fayette Expressway construction. Camp Hollow Road between New England Road and Camden Hill Road shuts for roadway and drainage reconstruction tied to the Mon/Fayette Expressway project; a detour routes drivers onto Clairton Road and Lebanon Church Road. - WPXI: https://www.wpxi.com/news/local/west-mifflin-road-temporarily-close-monfayette-expressway-work/7SSZWBDMZBGNFH5CWOJG4NMPOY/ * PennDOT Warns GPS Wrongly Shows Commercial Street Open Latest developments: PennDOT reiterated Saturday, July 18, that Commercial Street stays closed after some drivers' GPS apps wrongly showed it open beneath the Parkway East bridge project. PennDOT has the Parkway East (I-376) closed for 25 days through August 3 while crews slide the new Commercial Street Bridge into position; Commercial Street below remains shut to traffic despite navigation maps indicating otherwise. - WTAE: https://www.wtae.com/article/penndot-commercial-street-closure-reported-gps-issues/73176351 - WTAE: https://www.wtae.com/article/is-376-bridge-parkway-east-closed/71772192 * Hydraulic Fluid Spill in Allegheny River Contained Latest developments: Crews contained a hydraulic fluid spill in the Allegheny River, the Lower Burrell fire chief said Saturday, July 18, after a Westmoreland County hazmat response. A reported oil spill in the Allegheny River in Westmoreland County drew a hazmat crew; the Lower Burrell fire chief said responders contained the hydraulic fluid. - Pittsburgh Post-Gazette: https://www.post-gazette.com/local/city/2026/07/18/hydraulic-fluid-spill-allegheny-river/stories/202607180037 - WTAE: https://www.wtae.com/article/westmoreland-hazmat-reported-oil-spill-allegheny-river/73177152 Events: * Picklesburgh Runs Its Final Day Sunday Latest developments: Picklesburgh drew thinner crowds Friday and Saturday as rain and wildfire smoke kept people away, and the festival runs its last day Sunday, July 19. Picklesburgh, Pittsburgh's pickle-themed food festival, fills Downtown Pittsburgh through Sunday, July 19, with final-day hours of noon to 6 p.m.; Canadian-wildfire haze and rain reduced attendance over the weekend. - Pittsburgh Post-Gazette: https://www.post-gazette.com/local/city/2026/07/18/picklesburgh-attendance-2026/stories/202607180035 - NEXTpittsburgh: https://nextpittsburgh.com/events/14-things-to-do-this-weekend-from-picklesburgh-to-the-pittsburgh-vintage-grand-prix/ SPORTS ---------------------------------------------------------------- Pirates (51-47) Fri Jul 17 · Pirates @ Guardians · Postponed https://plaintextsports.com/mlb/2026-07-17/pit-cle Sat Jul 18 · Pirates 7 · Guardians 1 · Final https://plaintextsports.com/mlb/2026-07-18/pit-cle Sat Jul 18 · Pirates 1 · Guardians 0 · Top 3rd (in progress at last update) https://plaintextsports.com/mlb/2026-07-18/pit-cle Up Next · Pirates @ Guardians · Sun Jul 19, 1:40 PM https://plaintextsports.com/mlb/2026-07-19/pit-cle Around the Teams: * Steelers Bank on Jamel Dean at Cornerback Latest developments: A Post-Gazette training-camp countdown, July 18, cast cornerback Jamel Dean as the answer to end the Steelers' long free-agent drought at the position. The Post-Gazette framed veteran cornerback Jamel Dean as a rare outside free-agent solution in the Steelers secondary as the team opens training camp in Latrobe. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/07/18/training-camp-countdown-jamel-dean-cornerback/stories/202607180002 * Pirates' Curiel Draws 'No Doubt About It' Praise Latest developments: A Post-Gazette profile, July 18, dug into fifth-overall pick Derek Curiel and his win-at-all-costs reputation. The Pirates' first-round pick Derek Curiel, an outfielder from LSU by way of Orange Lutheran High School, earned scouts' 'no doubt about it' praise for doing whatever it takes to win, the Post-Gazette reported. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/07/18/pirates-derek-curiel-lsu-orange-lutheran-draft-pick/stories/202607170065 Team USA: * USMNT's Balogun a Summer Transfer Target Latest developments: ESPN's Transfer Talk reported July 19 that United States striker Folarin Balogun could move this summer. Folarin Balogun, the U.S. men's national team forward, sits at the center of transfer speculation as the summer window opens, ESPN reported. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49389509/transfer-rumors-news-barcelona-real-madrid-atletico-inter-milan-tottenham-argentina-cristian-romero * Lindsey Heaps Assists Winner in Summit FC Debut Latest developments: U.S. women's captain Lindsey Heaps made her Denver Summit FC debut Saturday, July 18, wearing the armband and setting up the game-winner. Lindsey Heaps, captain of the United States women's national team, tallied the game-winning assist in her Denver Summit FC debut, a 2-1 win over the Portland Thorns. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49394034/denver-summit-beat-portland-thorns-2-1-lindsey-heaps-debut READING ---------------------------------------------------------------- * Ed Zitron -- The OpenAI Bubble Zitron argues OpenAI's finances and valuation amount to an unsustainable bubble that props up the broader generative-AI economy. https://www.wheresyoured.at/the-openai-bubble/ * Stratechery -- IBM Misses, IBM's Mainframe Moat, IBM's Many AI Problems Ben Thompson dissects IBM's earnings miss that spooked software stocks, arguing its enduring mainframe franchise masks deep structural problems in positioning for the AI cycle. https://stratechery.com/2026/ibm-misses-ibms-mainframe-moat-ibms-many-ai-problems/ * Cal Newport -- Why Reading Matters Responding to Rose Horowitch's Atlantic piece on collapsing reading ability, Newport defends sustained deep reading as essential cognitive training rather than a nostalgic pastime. https://calnewport.com/why-reading-matters/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,524.56 ▼ -0.1% Dow 52,472.99 ▼ -0.4% Nasdaq 25,930.32 ▼ -0.5% WTI crude 79.70 ▲ +11.9% EUR/USD 1.1434 ▲ +0.1% GBP/USD 1.3444 ▲ +0.4% USD/JPY 162.28 = +0.0% ================================================================ Generated 2026-07-18 21:06 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================