================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Sunday, July 19, 2026 - 4:07 PM EDT ================================================================ Public exploit code and a working proof-of-concept now chase the wp2shell flaws in WordPress core, letting a single anonymous request run code on any unpatched 6.9 or 7.0 site. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Attackers are racing to weaponize fresh exposure, with public exploits chasing unpatched wp2shell sites, an ACR Stealer surge draining Microsoft credentials, and scans mapping Hikvision cameras. see: wp2shell WordPress Core RCE Gets Public Exploits; ACR Stealer Surge Hits Microsoft Customers; Hikvision Camera API Draws Internet-Wide Scans * [UPDATE (new)] A third U.S. service member died in Iraq as Iran fired missiles toward Jordan, threatening to pull Israel into a widening war. see: U.S.-Iran War Widens Toward Israel * [TREND] Two updated Reading essays probe AI's limits, with Ed Zitron calling OpenAI an unsustainable bubble and Ben Thompson weighing IBM's mainframe moat against its AI struggles. see: The OpenAI Bubble; IBM Misses, IBM's Mainframe Moat, IBM's Many AI Problems * [UPDATE (new)] The National Weather Service confirmed two tornadoes touched down in Pennsylvania during Saturday's storms, with a possible third under review in Derry Township. see: Two Tornadoes Confirmed After Saturday Storms * [UPDATE (new)] Panasonic recalled 11,480 electric toaster ovens nationwide, telling owners to stop using them and verify the model number. see: Panasonic Toaster Ovens Recalled SECURITY ---------------------------------------------------------------- 1. HIKVISION CAMERA API DRAWS INTERNET-WIDE SCANS Vulnerabilities and Exploits · [iot, scanning] Latest developments: The SANS Internet Storm Center reported July 19, 2026 that its honeypot network is picking up internet-wide scans probing the Hikvision Intelligent Security API. Hikvision, the Chinese maker of internet-connected security cameras, carries a long history of vulnerabilities that draw mass scanning. The current scans hunt exposed Intelligent Security API endpoints, so operators should pull these cameras off the public internet and update firmware. - SANS Internet Storm Center: https://isc.sans.edu/diary/rss/33164 2. WP2SHELL WORDPRESS CORE RCE GETS PUBLIC EXPLOITS Vulnerabilities and Exploits · [rce, patch, exploit] Latest developments: Attackers now hold public exploits and a working proof-of-concept for the two wp2shell bugs, which carry CVE IDs CVE-2026-60137 and CVE-2026-63030, and researchers surfaced a persistent-object-cache variant that widens the reach. wp2shell pairs two WordPress core flaws—a facilitated SQL injection and a REST API batch-route confusion that chains to remote code execution—so a single anonymous HTTP request runs code on a bare install with zero plugins. Adam Kues of Assetnote and Searchlight Cyber, along with the trio TF1T, dtro, and haongo, reported the bugs; WordPress fixed them in 6.9.5 and 7.0.2, so administrators of every 6.9 and 7.0 site must patch now. - BleepingComputer: https://www.bleepingcomputer.com/news/security/wordpress-core-wp2shell-rce-flaws-get-public-exploits-patch-now/ - Help Net Security: https://www.helpnetsecurity.com/2026/07/18/wordpress-vulnerabilities-wp2shell-cve-2026-60137-cve-2026-60137/ - The Hacker News: https://thehackernews.com/2026/07/new-wp2shell-wordpress-core-flaw-lets.html 3. ACR STEALER SURGE HITS MICROSOFT CUSTOMERS Ransomware and Cybercrime · [infostealer, clickfix, cybercrime] Latest developments: Microsoft warned its enterprise customers on July 18, 2026 of a fresh surge in ACR Stealer infections that lift browser-stored passwords, authentication tokens, and sensitive documents. ACR Stealer is an information stealer that operators spread largely through ClickFix lures, which trick users into pasting a malicious command. It targets Microsoft's enterprise customers, so defenders should block clipboard-run PowerShell and reset harvested credentials and tokens. - BleepingComputer: https://www.bleepingcomputer.com/news/security/microsoft-warns-of-surge-in-acr-stealer-attacks-on-customers/ BUSINESS AND POLITICS ---------------------------------------------------------------- * U.S.-Iran War Widens Toward Israel Latest developments: A third U.S. service member died Saturday, July 18, in Iraq during a controlled detonation of an Iranian drone, and Iran fired missiles toward Jordan that Israel warned are landing close to its own territory, threatening to pull Israel into the fight. Iranian ballistic missiles killed two U.S. troops and left one missing in Jordan, prompting U.S. Central Command to launch fresh strikes to "swiftly punish" Tehran; Iran had used a brief earlier truce to rush out about $6 billion of oil on roughly 20 tankers bound for Asia before Washington reimposed pressure, keeping crude and the Strait of Hormuz at the center of market risk. - FT World: https://www.ft.com/content/e8e8adc5-7c56-45a8-99fc-bb5acfda263e?syn-25a6b1a6=1 - WSJ World News: https://www.wsj.com/articles/u-s-iran-fighting-escalates-8d744da2 - WSJ World News: https://www.wsj.com/world/middle-east/iran-rushed-out-6-billion-of-oil-during-brief-truce-with-u-s-5a3d0818 PITTSBURGH ---------------------------------------------------------------- Weather: This Afternoon: Sunny, high 82F. Tonight: Mostly Clear, low 58F. Monday: Sunny, high 84F. Business: * Panasonic Toaster Ovens Recalled Latest developments: Panasonic recalled 11,480 electric toaster ovens nationwide, telling owners to stop using them and check the model number. The recall covers Panasonic electric toaster ovens sold online through Amazon and Costco for about $170, which the company says pose a shock or fire hazard. - WTAE: https://www.wtae.com/article/panasonic-electric-toaster-oven-recall-amazon-costco/73179645 Around town: * Two Tornadoes Confirmed After Saturday Storms Latest developments: The National Weather Service confirmed Sunday, July 19, that two tornadoes touched down in Pennsylvania during Saturday's storms, one of them in Western Pennsylvania, and it is examining a possible third in Derry Township, Westmoreland County. Severe storms swept Western Pennsylvania on Saturday, July 18, downing trees and flooding roads across Westmoreland and Jefferson counties, damage crews are still clearing. - WTAE: https://www.wtae.com/article/westmoreland-jefferson-counties-tornadoes-saturday-storms/73179582 - TribLive: https://triblive.com/local/westmoreland/possible-tornado-saturday-in-derry-township/ - WTAE: https://www.wtae.com/article/severe-storms-flooding-damage-western-pa-saturday-july-18-2026/73179491 * 'Guns Down Minds Up' Youth Program Launches Latest developments: A new youth mentorship program, Guns Down Minds Up, launched Friday, July 17, at the Kingsley Center in Pittsburgh. The Kingsley Center hosted the launch of Guns Down Minds Up, a program that pairs young people with mentors to steer them away from violence. - WPXI: https://www.wpxi.com/news/local/new-mentorship-program-looks-curb-violence-among-young-people-pittsburgh/ZHG4KANRWBHYXH7NSN7CAJSKDY/ SPORTS ---------------------------------------------------------------- Pirates (51-48) Sat Jul 18 · Pirates 7 · Guardians 1 · Final https://plaintextsports.com/mlb/2026-07-18/pit-cle Sat Jul 18 · Pirates 3 · Guardians 5 · Final Bazzana hits 2-run homer in 9th to rally Guardians to 5-3 victory over Pirates https://plaintextsports.com/mlb/2026-07-18/pit-cle Sun Jul 19 · Pirates 5 · Guardians 1 · Bot 8th (in progress at last update) https://plaintextsports.com/mlb/2026-07-19/pit-cle Up Next · Pirates @ Yankees · Mon Jul 20, 7:05 PM https://plaintextsports.com/mlb/2026-07-20/pit-nyy Around the Teams: * Five Storylines for the Pirates' Second Half Latest developments: A Post-Gazette breakdown, July 16, laid out five storylines to watch as the Pirates chase a wild-card spot after the All-Star break, led by ace Paul Skenes. The Pittsburgh Pirates enter the second half positioned for a wild-card run, and the Post-Gazette outlined five questions—centered on Skenes—that will decide whether they reach the playoffs. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/07/16/storylines-analysis-mlb-second-half-skenes/stories/202607150032 READING ---------------------------------------------------------------- * Ed Zitron -- The OpenAI Bubble Ed Zitron argues that OpenAI's spending, financing, and hype add up to an unsustainable bubble headed for a reckoning. https://www.wheresyoured.at/the-openai-bubble/ * Stratechery -- IBM Misses, IBM's Mainframe Moat, IBM's Many AI Problems Ben Thompson dissects IBM's disappointing preliminary results, arguing its mainframe franchise remains a durable moat even as the company struggles to find its footing in AI. https://stratechery.com/2026/ibm-misses-ibms-mainframe-moat-ibms-many-ai-problems/ * Cal Newport -- Why Reading Matters Cal Newport responds to an Atlantic essay on the decline of reading, making the case for why sustained, deep reading still matters. https://calnewport.com/why-reading-matters/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,524.56 ▼ -0.1% Dow 52,472.99 ▼ -0.4% Nasdaq 25,930.32 ▼ -0.5% WTI crude 79.56 ▲ +11.7% EUR/USD 1.1426 = -0.0% GBP/USD 1.3430 ▲ +0.4% USD/JPY 162.19 = +0.0% ================================================================ Generated 2026-07-19 16:07 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================