daily plain-text briefing: security, markets, business, and pittsburgh
Public exploits for the wp2shell flaws in WordPress core put every unpatched 6.9 and 7.0 site one anonymous HTTP request from remote code execution, as Microsoft warns of a surge in ACR Stealer against enterprises.
Latest developments: BleepingComputer and Help Net Security confirmed on July 18, 2026 that working public exploits now circulate for the two wp2shell flaws—SQL injection CVE-2026-60137 and REST API batch-route confusion CVE-2026-63030—and a persistent-object-cache condition has surfaced that widens the path to code execution on unpatched sites.
wp2shell is a WordPress core bug that runs attacker code from one unauthenticated HTTP request, so a bare install with no plugins is exploitable. Adam Kues at Assetnote reported the REST API flaw; every 6.9 and 7.0 site is at risk until administrators apply the 7.0.2 and 6.9.5 releases.
Sources: BleepingComputer · Help Net Security · The Hacker News · ↑ top
Latest developments: Microsoft reported July 18, 2026 a surge in ACR Stealer attacks that lift browser-stored passwords, authentication tokens, and sensitive documents from its enterprise customers.
ACR Stealer is a commodity infostealer that harvests saved credentials and session tokens, often arriving through ClickFix copy-paste lures. Organizations should hunt for token theft, rotate exposed secrets, and block the fake-CAPTCHA PowerShell pattern.
Sources: BleepingComputer · ↑ top
Latest developments: The Record reported July 17, 2026 that Fairlife's suspended US operation spans plants in Michigan, New York, and Arizona, a Coca-Cola business whose retail sales passed $1 billion in 2022.
A ransomware attack on Coca-Cola's Fairlife dairy subsidiary halted production of its ultra-filtered milk products across the United States. The disclosed plant footprint underscores how one intrusion can idle a billion-dollar consumer supply chain.
Sources: The Record · ↑ top
Latest developments: SecurityWeek reported July 17, 2026 that Iran tracks the phones of US military personnel, that new CrashStealer malware targets macOS, that attackers exploit OpenClaw AI agents through WhatsApp, and that ransomware struck naval defense builder TKMS.
The roundup ties Iranian device-location surveillance of American troops to a widening set of threats spanning macOS credential theft, AI-agent abuse, and a ransomware hit on a naval defense contractor. Defense-sector operators face pressure to lock down mobile devices, macOS endpoints, and agent integrations.
Sources: SecurityWeek · ↑ top
Latest developments: A procurement record surfaced July 17, 2026 shows US Immigration and Customs Enforcement will pay Thomson Reuters $125 million for personal data—names, Social Security numbers, and ethnicity—to investigate what the agency calls "voters fraud" and immigration fraud.
The contract hands a federal enforcement agency bulk access to commercial data-broker records on Americans, sharpening the debate over government surveillance through private data purchases. Privacy advocates warn the ethnicity and identity fields invite profiling.
Today: Mostly Sunny, high 82F.
Tonight: Mostly Clear, low 58F.
Monday: Sunny, high 84F.
Latest developments: TribLive surveyed the region's candle makers July 19 and found a business expanding into new retail storefronts and online shops.
Candle makers across Western Pennsylvania are opening storefronts and launching online shops as demand for hand-poured candles climbs, a small-scale manufacturing niche gaining ground in the regional economy.
Latest developments: The Post-Gazette reported July 19 that Pennsylvania holds state library aid flat even as branches take on more roles.
Public libraries across Pennsylvania increasingly serve as community centers, providing internet access, programming, and social services, while state funding for them stays flat, the Post-Gazette reported.
Sources: Pittsburgh Post-Gazette · ↑ top
Latest developments: TribLive reported July 19 that Allegheny and Westmoreland counties have already logged more than 1,300 Lyme disease cases this year.
Allegheny and Westmoreland counties have recorded over 1,300 Lyme disease cases so far in 2026, keeping Western Pennsylvania among the nation's hardest-hit regions for the tick-borne illness.
Latest developments: WPXI reported July 19 that a joint April toll-enforcement effort produced more than 200 traffic stops.
The Pennsylvania Turnpike Commission and Pennsylvania State Police ran a joint toll-enforcement initiative in April that led to more than 200 traffic stops, part of a push to collect from drivers dodging tolls.
Pirates (51-48)
Sat Jul 18 · Pirates 7 · Guardians 1 · Final
Sat Jul 18 · Pirates 3 · Guardians 5 · Final
Bazzana hits 2-run homer in 9th to rally Guardians to 5-3 victory over Pirates
Up Next · Pirates @ Guardians · Sun Jul 19, 1:40 PM
Latest developments: The Guardian reported July 18 that the IOC will probably take no action against FIFA president Gianni Infantino after a formal complaint over the Balogun red-card affair.
United States striker Folarin Balogun's World Cup red card fell away after President Trump phoned Gianni Infantino, and the human rights group FairSquare complained to the International Olympic Committee that FIFA bent its political-neutrality rules under pressure.
Sources: Guardian World Cup 2026 · ↑ top
S&P 500 7,524.56 ▼ -0.1% Dow 52,472.99 ▼ -0.4% Nasdaq 25,930.32 ▼ -0.5% WTI crude 79.56 ▲ +11.7% EUR/USD 1.1434 ▲ +0.1% GBP/USD 1.3430 ▲ +0.4% USD/JPY 162.28 = +0.0%