infosecfollow

daily plain-text briefing: security, markets, business, and pittsburgh

Public exploit code and a working proof-of-concept now chase the wp2shell flaws in WordPress core, letting a single anonymous request run code on any unpatched 6.9 or 7.0 site.

Emerging Trends and Key Updates

Trend Attackers are racing to weaponize fresh exposure, with public exploits chasing unpatched wp2shell sites, an ACR Stealer surge draining Microsoft credentials, and scans mapping Hikvision cameras.
Update · new A third U.S. service member died in Iraq as Iran fired missiles toward Jordan, threatening to pull Israel into a widening war.
Trend Two updated Reading essays probe AI's limits, with Ed Zitron calling OpenAI an unsustainable bubble and Ben Thompson weighing IBM's mainframe moat against its AI struggles.
Update · new The National Weather Service confirmed two tornadoes touched down in Pennsylvania during Saturday's storms, with a possible third under review in Derry Township.
Update · new Panasonic recalled 11,480 electric toaster ovens nationwide, telling owners to stop using them and verify the model number.

Security

1. Hikvision Camera API Draws Internet-Wide Scans

Vulnerabilities and Exploits · [iot, scanning]

Latest developments: The SANS Internet Storm Center reported July 19, 2026 that its honeypot network is picking up internet-wide scans probing the Hikvision Intelligent Security API.

Hikvision, the Chinese maker of internet-connected security cameras, carries a long history of vulnerabilities that draw mass scanning. The current scans hunt exposed Intelligent Security API endpoints, so operators should pull these cameras off the public internet and update firmware.

Sources: SANS Internet Storm Center · ↑ top

2. wp2shell WordPress Core RCE Gets Public Exploits

Vulnerabilities and Exploits · [rce, patch, exploit]

Latest developments: Attackers now hold public exploits and a working proof-of-concept for the two wp2shell bugs, which carry CVE IDs CVE-2026-60137 and CVE-2026-63030, and researchers surfaced a persistent-object-cache variant that widens the reach.

wp2shell pairs two WordPress core flaws—a facilitated SQL injection and a REST API batch-route confusion that chains to remote code execution—so a single anonymous HTTP request runs code on a bare install with zero plugins. Adam Kues of Assetnote and Searchlight Cyber, along with the trio TF1T, dtro, and haongo, reported the bugs; WordPress fixed them in 6.9.5 and 7.0.2, so administrators of every 6.9 and 7.0 site must patch now.

Sources: BleepingComputer · Help Net Security · The Hacker News · ↑ top

3. ACR Stealer Surge Hits Microsoft Customers

Ransomware and Cybercrime · [infostealer, clickfix, cybercrime]

Latest developments: Microsoft warned its enterprise customers on July 18, 2026 of a fresh surge in ACR Stealer infections that lift browser-stored passwords, authentication tokens, and sensitive documents.

ACR Stealer is an information stealer that operators spread largely through ClickFix lures, which trick users into pasting a malicious command. It targets Microsoft's enterprise customers, so defenders should block clipboard-run PowerShell and reset harvested credentials and tokens.

Sources: BleepingComputer · ↑ top

Business and Politics

U.S.-Iran War Widens Toward Israel

Latest developments: A third U.S. service member died Saturday, July 18, in Iraq during a controlled detonation of an Iranian drone, and Iran fired missiles toward Jordan that Israel warned are landing close to its own territory, threatening to pull Israel into the fight.

Iranian ballistic missiles killed two U.S. troops and left one missing in Jordan, prompting U.S. Central Command to launch fresh strikes to "swiftly punish" Tehran; Iran had used a brief earlier truce to rush out about $6 billion of oil on roughly 20 tankers bound for Asia before Washington reimposed pressure, keeping crude and the Strait of Hormuz at the center of market risk.

Sources: FT World · WSJ World News · WSJ World News · ↑ top

Pittsburgh

Weather

This Afternoon: Sunny, high 82F.

Tonight: Mostly Clear, low 58F.

Monday: Sunny, high 84F.

Business

Panasonic Toaster Ovens Recalled

Latest developments: Panasonic recalled 11,480 electric toaster ovens nationwide, telling owners to stop using them and check the model number.

The recall covers Panasonic electric toaster ovens sold online through Amazon and Costco for about $170, which the company says pose a shock or fire hazard.

Sources: WTAE · ↑ top

Around Town

Two Tornadoes Confirmed After Saturday Storms

Latest developments: The National Weather Service confirmed Sunday, July 19, that two tornadoes touched down in Pennsylvania during Saturday's storms, one of them in Western Pennsylvania, and it is examining a possible third in Derry Township, Westmoreland County.

Severe storms swept Western Pennsylvania on Saturday, July 18, downing trees and flooding roads across Westmoreland and Jefferson counties, damage crews are still clearing.

Sources: WTAE · TribLive · WTAE · ↑ top

'Guns Down Minds Up' Youth Program Launches

Latest developments: A new youth mentorship program, Guns Down Minds Up, launched Friday, July 17, at the Kingsley Center in Pittsburgh.

The Kingsley Center hosted the launch of Guns Down Minds Up, a program that pairs young people with mentors to steer them away from violence.

Sources: WPXI · ↑ top

Sports

Pirates (51-48)

Sat Jul 18 · Pirates 7 · Guardians 1 · Final

Sat Jul 18 · Pirates 3 · Guardians 5 · Final

Bazzana hits 2-run homer in 9th to rally Guardians to 5-3 victory over Pirates

Sun Jul 19 · Pirates 5 · Guardians 1 · Bot 8th (in progress at last update)

Up Next · Pirates @ Yankees · Mon Jul 20, 7:05 PM

Around the Teams

Five Storylines for the Pirates' Second Half

Latest developments: A Post-Gazette breakdown, July 16, laid out five storylines to watch as the Pirates chase a wild-card spot after the All-Star break, led by ace Paul Skenes.

The Pittsburgh Pirates enter the second half positioned for a wild-card run, and the Post-Gazette outlined five questions—centered on Skenes—that will decide whether they reach the playoffs.

Sources: Post-Gazette Pirates · ↑ top

Reading

Ed Zitron — The OpenAI Bubble. Ed Zitron argues that OpenAI's spending, financing, and hype add up to an unsustainable bubble headed for a reckoning.
Stratechery — IBM Misses, IBM's Mainframe Moat, IBM's Many AI Problems. Ben Thompson dissects IBM's disappointing preliminary results, arguing its mainframe franchise remains a durable moat even as the company struggles to find its footing in AI.
Cal Newport — Why Reading Matters. Cal Newport responds to an Atlantic essay on the decline of reading, making the case for why sustained, deep reading still matters.

Markets

weekly average, change vs prior week

S&P 500     7,524.56  ▼ -0.1%
Dow        52,472.99  ▼ -0.4%
Nasdaq     25,930.32  ▼ -0.5%
WTI crude      79.56  ▲ +11.7%
EUR/USD       1.1426  = -0.0%
GBP/USD       1.3430  ▲ +0.4%
USD/JPY       162.19  = +0.0%