daily plain-text briefing: security, markets, business, and pittsburgh
Public exploits for the wp2shell WordPress flaw and a released Windows LegacyHive zero-day put mass code execution within reach as administrators race to patch.
Latest developments: WordPress assigned the two wp2shell bugs CVE-2026-60137 and CVE-2026-63030 on July 18, 2026, and working public exploits appeared, letting anyone run code on unpatched 6.9 and 7.0 sites.
wp2shell is a WordPress core flaw that runs code from a single anonymous HTTP request, so even a bare install with zero plugins is exploitable; Adam Kues of Assetnote reported the REST API batch-route confusion behind CVE-2026-63030, and administrators must apply 6.9.5 and 7.0.2 at once.
Sources: BleepingComputer · Help Net Security · The Hacker News · ↑ top
Latest developments: 7-Zip shipped version 26.02 on July 18, 2026, closing a remote code execution flaw that fires when a user opens a specially crafted compressed archive.
7-Zip is a widely used free file archiver for Windows; a booby-trapped archive runs attacker code on the opener's machine, so users should update to 26.02 immediately.
Sources: BleepingComputer · ↑ top
Latest developments: A researcher using the handle Nightmare Eclipse released a working LegacyHive exploit on July 17, 2026 that escalates privileges to administrator on fully patched Windows systems.
LegacyHive abuses the Windows User Profile Service to hand a local attacker admin rights; Microsoft has no fix yet, so defenders should hunt for local privilege-escalation activity.
Sources: BleepingComputer · ↑ top
Latest developments: Armenia has held Russian tourist Aleksandr Ermakov since June 28, 2026 on a U.S. extradition request naming a REvil ransomware suspect of the same name, and his wife Maria Yurova told REN TV that border officers pulled him from the departure hall at Yerevan's Zvartnots airport off a VKontakte photo.
REvil ran one of the most damaging ransomware operations before its 2022 disruption; Ermakov's lawyers insist Armenia seized the wrong man, testing the identification behind the U.S. case.
Sources: The Hacker News · ↑ top
Latest developments: Apple warned iPhone and iPad users on July 17, 2026 that scammers pose as banks and trusted organizations over FaceTime calls, spoofing caller IDs to look like Apple itself and social-engineering victims into surrendering credentials, security codes, and money.
The scheme leans on caller-ID spoofing and social engineering to impersonate Apple and banks; Apple never asks for security codes and urges users to hang up and verify through official channels.
Sources: Help Net Security · ↑ top
Latest developments: The Pentagon suspended Phase 2 of its Cybersecurity Maturity Model Certification program, pausing third-party audits while leaving intact contractors' legal obligation to protect controlled unclassified information.
CMMC requires defense contractors to prove they safeguard controlled unclassified information; the suspension halts outside audits, though industry professionals stress the underlying compliance duty stands.
Sources: SecurityWeek · ↑ top
Latest developments: U.S. Central Command launched fresh strikes after an Iranian missile attack in Jordan killed two American troops and left one missing, the U.S. Strategic Petroleum Reserve sank to its lowest level since 1983, and Iran hurried roughly $6 billion of oil to Asia during the brief truce.
The United States and Iran keep trading strikes on military and infrastructure targets around the Persian Gulf and the Strait of Hormuz, a spiral that has drawn down the emergency U.S. oil reserve and kept crude markets on edge.
Sources: FT World · WSJ World News · WSJ World News · ↑ top
Latest developments: Ukrainian drones struck warehouses of Wildberries, Russia's largest online retailer, and Russia answered with roughly 50 ballistic missiles at Kyiv in one of the war's biggest such barrages, while President Volodymyr Zelensky weighs firing his commander-in-chief.
The four-year war has entered a sharper phase of deep strikes on each other's territory, and Zelensky faces swelling protests after dismissing his popular defense minister, deepening turmoil inside Ukraine's military command.
Sources: WSJ World News · FT World · ↑ top
Today: Partly Sunny, high 82F.
Tonight: Mostly Clear, low 58F.
Monday: Sunny, high 84F.
Latest developments: The National Weather Service confirmed two tornadoes touched down in Pennsylvania on Saturday, July 18, as severe storms downed trees, flooded roads, and knocked out power to thousands, with Derry Township in Westmoreland County among the hardest hit.
A Severe Weather Alert Day brought two lines of thunderstorms across Western Pennsylvania, leaving cleanup crews clearing trees in Westmoreland County and thousands of homes without electricity.
Latest developments: The Post-Gazette reported July 19 that Senator John Fetterman's small-dollar fundraising has collapsed, a fresh sign of his deepening estrangement from Democrats.
Pennsylvania's junior U.S. senator, John Fetterman, has drawn party backlash over his support for Israel and his breaks with fellow Democrats, and his once-formidable grassroots donor base has now thinned.
Sources: Pittsburgh Post-Gazette · ↑ top
Latest developments: Taylor Farms expanded its voluntary recall of iceberg lettuce shipped to 27 states, with the FDA traceback pointing to a single central-Mexico farm behind the multistate cyclospora outbreak.
California-based Taylor Farms, a major supplier to restaurants and retailers, pulled iceberg lettuce sourced from central Mexico after health officials linked it to one of the largest recent U.S. cyclosporiasis outbreaks, which has sickened people across dozens of states including in Allegheny County.
Pirates (51-48)
Sat Jul 18 · Pirates 7 · Guardians 1 · Final
Sat Jul 18 · Pirates 3 · Guardians 5 · Final
Bazzana hits 2-run homer in 9th to rally Guardians to 5-3 victory over Pirates
Up Next · Pirates @ Guardians · Sun Jul 19, 1:40 PM
Latest developments: A Post-Gazette training-camp countdown, July 19, argued defensive lineman Derrick Harmon's untapped ability as a pass rusher could sharply lift his sack total this season.
The Steelers count on second-year lineman Derrick Harmon to grow into a disruptive interior rusher as camp opens in Latrobe, a jump the beat writers see as pivotal to the front seven.
Sources: Post-Gazette Steelers · ↑ top
Latest developments: ESPN published a photo retrospective July 19 of the U.S. men's national team's 2026 World Cup, a run that ended with a round-of-16 loss to Belgium.
The United States co-hosted the 2026 World Cup with Canada and Mexico, and ESPN's time capsule collects the images from the USMNT's monthlong run that captured the country's attention before its exit.
Sources: ESPN Soccer · ↑ top
S&P 500 7,524.56 ▼ -0.1% Dow 52,472.99 ▼ -0.4% Nasdaq 25,930.32 ▼ -0.5% WTI crude 79.56 ▲ +11.7% EUR/USD 1.1434 ▲ +0.1% GBP/USD 1.3430 ▲ +0.4% USD/JPY 162.28 = +0.0%