daily plain-text briefing: security, markets, business, and pittsburgh
An autonomous AI agent breached Hugging Face, the world's largest AI model repository, stealing internal datasets and service credentials from its production infrastructure.
Latest developments: Hugging Face disclosed that it detected and responded earlier last week to an autonomous AI agent system that breached its production infrastructure and reached a limited set of internal datasets and several service credentials.
Hugging Face runs the largest public repository of AI models and datasets. The company is rotating the exposed credentials; the episode marks a live case of an AI agent running an offensive operation end to end against the very ecosystem it draws from.
Sources: SecurityWeek · The Hacker News · ↑ top
Latest developments: Threat-intelligence firm Defused caught attackers exploiting CVE-2026-6875, a critical code-execution flaw in the ServiceNow AI Platform, while exploitation of the WP2Shell WordPress bugs CVE-2026-60137 and CVE-2026-63030 began soon after their disclosure.
The ServiceNow flaw hits its AI Platform; the WP2Shell pair, found by Assetnote's Adam Kues, lets an anonymous HTTP request run code on WordPress 6.9 and 7.0 sites. Both vendors have shipped fixes, and defenders should apply them immediately.
Sources: BleepingComputer · SecurityWeek · ↑ top
Latest developments: Trend Micro's Zero Day Initiative detailed CVE-2026-14266 on July 15, a heap-based buffer overflow that runs code when 7-Zip extracts a crafted XZ archive, and Google shipped Chrome 150 to close six critical and high-severity use-after-free flaws.
7-Zip fixed the XZ overflow on June 25 in version 26.02; the flaw executes code in the context of the current process when a user opens a malicious archive. Chrome and 7-Zip users should update now.
Sources: The Hacker News · SecurityWeek · ↑ top
Latest developments: An analysis of 200 Gemini CLI session logs from March 19 to April 21, 2026 showed the solo Russian-speaking actor bandcampro using Google's open-source Gemini CLI to crack passwords, set up a residential proxy, and command a live botnet of eight dental-clinic PCs.
bandcampro outsourced routine hacking chores to a mainstream AI coding tool, turning it into an operator's console. The case shows how open agentic tooling lowers the bar for a lone criminal to run a working botnet.
Sources: The Hacker News · ↑ top
Latest developments: A first-of-its-kind analysis found more than one in eight apps built for US service members carry foreign code, some from firms in countries the Pentagon designates as adversaries.
Wired reported the study, which flagged Chinese and Russian components embedded in commercial apps that vendors market to troops. The finding exposes a supply-chain hole in software the military never vetted.
Sources: Wired Security · ↑ top
Latest developments: Researchers flagged SleeperGem, a supply-chain campaign that published three malicious gems—including git_credential_manager and Dendreo—to RubyGems on July 18, 2026 to fetch and run additional payloads on developer machines.
The rogue gems mimic legitimate developer tooling and serve second-stage code once installed. Ruby developers should audit their dependencies and remove the named packages.
Sources: The Hacker News · ↑ top
Latest developments: Brent crude touched $90 a barrel Monday, July 20, for the first time in the war before easing after Tehran said mediators had sent cease-fire proposals, while another U.S. service member killed in Iraq on July 18 pushed the American death toll to 17.
The war between the United States and Iran, now in its second week, has drawn Jordan and Iraq into the fighting as U.S. Central Command works to identify human remains at a Jordanian base struck over the weekend; crude's climb past $90 lifts inflation risk for a global economy still dependent on Persian Gulf supply.
Sources: WSJ US Business · WSJ World News · FT World · ↑ top
Latest developments: China's state-owned funds bought and pledged nearly $9 billion of shares Monday, July 20, to arrest a deepening rout in chip and technology stocks that rippled across global markets last week.
Beijing's so-called national team of state funds moved to stem a slide in semiconductor and AI-related shares; the intervention deepens worry about an AI investment bubble as everyday investors rotate out of the Magnificent Seven.
Sources: WSJ Markets · FT World · ↑ top
Overnight: Mostly Clear, low 58F.
Monday: Sunny, high 85F.
Monday Night: Mostly Cloudy, low 67F.
Latest developments: The Post-Gazette reported July 20 that Haven Cafe has joined a cluster of new businesses remaking Bellevue into a food and drink destination.
Haven Cafe is one of several fresh eateries and bars turning the Allegheny County borough of Bellevue, north of Pittsburgh above the Ohio River, into a dining draw.
Sources: Pittsburgh Post-Gazette · ↑ top
Latest developments: A Post-Gazette report July 20 found that the surge of detoured cars along Parkway East alternate routes has brought congestion but few new customers to businesses on those streets.
With the Parkway East closed near Swissvale for the Commercial Street Bridge replacement, PennDOT's detours push heavy traffic through nearby neighborhoods, yet merchants along the routes say the passing drivers rarely stop to shop.
Sources: Pittsburgh Post-Gazette · ↑ top
Latest developments: Forecasters placed Western Pennsylvania under an enhanced risk—3 of 5—for strong to severe thunderstorms Tuesday, July 21, along an approaching cold front, KDKA and WTAE said July 20.
The National Weather Service made Tuesday a First Alert Day for the Pittsburgh area, warning of numerous severe storms after a calm, low-humidity Monday.
Latest developments: PublicSource reported July 20 that a Pride Month display at the Monroeville Public Library has reignited the regional dispute over LGBTQ+ books and library policy.
The Monroeville display is the latest flashpoint in a run of Western Pennsylvania clashes since 2021 over books, displays, and library rules across several communities.
Sources: PublicSource · ↑ top
Latest developments: The Post-Gazette reported July 20 that Pennsylvania's new budget steers millions more toward child welfare, aging services, and crisis centers, though advocates question whether it meets the need.
The enacted state budget directs additional money to strained social services statewide, including county child-welfare agencies, programs for older residents, and crisis centers.
Sources: Pittsburgh Post-Gazette · ↑ top
Latest developments: Pittsburgh City Paper previewed July 20 that Pittsburgh CLO will present the Tony Award-winning musical 'Suffs' this week.
'Suffs,' which dramatizes the suffragists' campaign to ratify the 19th Amendment and carries a Pittsburgh connection, runs this week in a Pittsburgh CLO production.
Sources: Pittsburgh City Paper · ↑ top
Latest developments: The Post-Gazette highlighted July 20 a new exhibit, 'Fort McIntosh: Its People and Archaeology,' at the Beaver Area Heritage Museum.
The exhibit at the Beaver Area Heritage Museum displays artifacts unearthed at Beaver's 18th-century Fort McIntosh and explores the people who manned the frontier post.
Sources: Pittsburgh Post-Gazette · ↑ top
Latest developments: A Post-Gazette 'off the beaten path' feature July 20 spotlighted Trundle Manor, the macabre oddities museum in Swissvale.
Trundle Manor, a private house-museum in the Allegheny County borough of Swissvale, shows off a quirky collection of the weird and macabre for visitors who seek it out.
Sources: Post-Gazette Arts & Entertainment · ↑ top
Pirates (52-48)
Sun Jul 19 · Pirates 7 · Guardians 1 · Final
Skenes strikes out 8 in 7 innings as Pirates roll to 7-1 win over Guardians
Up Next · Pirates @ Yankees · Mon Jul 20, 7:05 PM
Latest developments: In his July 20 weekend column, Post-Gazette writer Noah Hiles argued the Pirates should hold onto Oneil Cruz as the trade deadline nears.
Hiles weighed manager Don Kelly's deadline options and made the case for keeping the electric, streaky Cruz while the Pirates stay in the wild-card hunt.
Sources: Post-Gazette Pirates · ↑ top
Latest developments: A Post-Gazette 'Off The Bat' column July 20 examined how an offhand 'future Yankee' comment reopened debate over ace Paul Skenes's long-term future in Pittsburgh.
The column revisited the recurring question of whether the small-market Pirates can keep Skenes, prompted by a remark casting the All-Star right-hander as a future New York Yankee.
Sources: Post-Gazette Pirates · ↑ top
Latest developments: The Post-Gazette's training-camp countdown July 20 cast center Zach Frazier as a candidate to follow a line of great Steelers centers.
The Post-Gazette argued young center Zach Frazier could anchor the Steelers' offensive line and join a lineage of accomplished Pittsburgh centers as camp opens in Latrobe.
Sources: Post-Gazette Steelers · ↑ top
S&P 500 7,524.56 ▼ -0.1% Dow 52,472.99 ▼ -0.4% Nasdaq 25,930.32 ▼ -0.5% WTI crude 79.70 ▲ +11.9% EUR/USD 1.1426 = -0.0% GBP/USD 1.3430 ▲ +0.4% USD/JPY 162.19 = +0.0%