================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Monday, July 20, 2026 - 4:06 PM EDT ================================================================ Iranian spies buried command traffic in Microsoft 365 calendars, attackers began exploiting a critical ServiceNow pre-authentication flaw, and the FakeGit campaign flooded GitHub with 7,600 malware repositories. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Attackers abuse AI and cloud trust, cloning repositories as AI skills via FakeGit, hiding C2 inside Microsoft 365 calendars with HollowGraph, and mass-exploiting a ServiceNow AI Platform flaw. see: FakeGit and SleeperGem Flood Open-Source Registries; HollowGraph Hides C2 in Microsoft 365 Calendars; Actively Exploited ServiceNow AI Platform RCE * [TREND] Fresh breaches at Paidwork and WINDTRE surface as governments weigh ransom-payment bans and World Leaks claims files from India's Kudankulam nuclear plant. see: Fresh Breaches Hit Consumers, Telecom, and Governments; Ransomware Payment Bans and World Leaks Extortion * [UPDATE (new)] A first-of-its-kind Wired analysis found more than one in eight apps built for US troops carry foreign code, some from Pentagon-designated adversary nations. see: Apps for US Troops Ship Chinese and Russian Code * [UPDATE (new)] The national gas average crossed $4 a gallon for the first time in a month as U.S.-Iran fighting and Houthi blockade threats lifted oil. see: Gas Tops $4 a Gallon Again; Iran War Pushes Gas Past $4 as Mediators Seek Truce * [TREND] The Reading list debates AI's trajectory, with Zitron warning of an OpenAI bubble and Ben Thompson downplaying fears of Chinese models. see: The OpenAI Bubble; Who's Afraid of Chinese Models? * [UPDATE (new)] Locally, the Parkway East may reopen early after the Commercial Street Bridge slide, while Allegheny County sprays six neighborhoods over West Nile virus. see: Parkway East on Track to Reopen Early; West Nile Prompts Mosquito Spraying SECURITY ---------------------------------------------------------------- 1. FRESH BREACHES HIT CONSUMERS, TELECOM, AND GOVERNMENTS Data Breaches · [breach, policy] Latest developments: Microtask platform Paidwork exposed data on more than 23 million users; Italy's Garante per la Protezione dei Dati Personali fined WINDTRE €1.7 million over two February 2025 breaches affecting more than 365,000 customers; hackers lurked nine months inside South Korea's diplomatic academy training system, stealing Ministry of Foreign Affairs staff data; and Romania's land registry agency is still recovering from what it called its most serious technical incident. The day's breaches span a gig-work platform, an Italian telecom, a South Korean government training system, and a Romanian property registry, with old-school social engineering behind the WINDTRE intrusions; affected users should watch for phishing and fraud tied to exposed personal data. - Help Net Security: https://www.helpnetsecurity.com/2026/07/20/paidwork-data-breach-23-million-users/ - Help Net Security: https://www.helpnetsecurity.com/2026/07/20/italy-windtre-1-7-million-fine/ - The Record: https://therecord.media/south-korea-cyberattack-foreign-ministry - The Record: https://therecord.media/romania-cyberattack-land-registry 2. HOLLOWGRAPH HIDES C2 IN MICROSOFT 365 CALENDARS Nation-State Activity · [apt, espionage, malware] Latest developments: Group-IB named HollowGraph, an espionage implant that hijacks a compromised Microsoft 365 calendar as its command channel, planting tasking and exfiltrating stolen files as attachments on events dated to 2050 so the activity blends into legitimate Microsoft Graph traffic. Group-IB ties HollowGraph with high confidence to the modular Cavern backdoor framework and Iranian espionage; because commands and data move through normal Graph API calls, defenders should hunt for anomalous calendar events and far-future appointment dates in Microsoft 365 mailboxes. - BleepingComputer: https://www.bleepingcomputer.com/news/security/new-hollowgraph-malware-uses-microsoft-graph-for-stealthy-c2-comms/ - Help Net Security: https://www.helpnetsecurity.com/2026/07/20/hollowgraph-malware-microsoft-365-calendar/ - The Hacker News: https://thehackernews.com/2026/07/hollowgraph-malware-hides-c2-and-stolen.html 3. ACTIVELY EXPLOITED SERVICENOW AI PLATFORM RCE Vulnerabilities and Exploits · [zero-day, patch, exploited] Latest developments: Threat-intelligence firm Defused reported that attackers began exploiting CVE-2026-6875, a critical pre-authentication code-injection flaw in the ServiceNow AI Platform. CVE-2026-6875 lets an unauthenticated attacker escape ServiceNow's script sandbox and run code remotely on a targeted instance; every organization running the AI Platform-as-a-Service should patch immediately. - Help Net Security: https://www.helpnetsecurity.com/2026/07/20/servicenow-cve-2026-6875-exploited/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/critical-servicenow-code-execution-flaw-now-exploited-in-attacks/ 4. FAKEGIT AND SLEEPERGEM FLOOD OPEN-SOURCE REGISTRIES Software Supply Chain · [supply-chain, malware] Latest developments: Researchers exposed FakeGit, nearly 7,600 malicious GitHub repositories—more than 800 impersonating AI skills or Model Context Protocol servers—that deliver the SmartLoader malware, while a separate campaign called SleeperGem published three malicious RubyGems, including git_credential_manager and Dendreo, to serve follow-on payloads to developer machines. Both campaigns weaponize the trust developers place in package registries, using copied projects, lookalike profiles, and convincing READMEs to smuggle loaders and stealers; teams should vet dependencies and repository provenance before installing. - The Hacker News: https://thehackernews.com/2026/07/fakegit-campaign-uses-7600-github.html - The Hacker News: https://thehackernews.com/2026/07/sleepergem-uses-three-malicious.html 5. RANSOMWARE PAYMENT BANS AND WORLD LEAKS EXTORTION Ransomware and Cybercrime · [ransomware, extortion, policy] Latest developments: Ars Technica reported that a ransomware surge is pushing governments to weigh outright bans on ransom payments, as Indian officials confirmed the World Leaks group claimed files from the Kudankulam Nuclear Power Plant but said the documents hold no safety or security information. Rising ransomware sophistication has victims facing pay-or-refuse dilemmas while regulators consider prohibiting payments; World Leaks' Kudankulam claim shows extortion crews targeting critical infrastructure even when the stolen files prove less sensitive than advertised. - Ars Technica Security: https://arstechnica.com/security/2026/07/pay-up-or-not-ransomware-surge-has-victims-facing-tough-choices/ - The Record: https://therecord.media/india-nuclear-plant-kudankulam-world-leaks-documents 6. APPS FOR US TROOPS SHIP CHINESE AND RUSSIAN CODE Nation-State Activity · [supply-chain, policy] Latest developments: A first-of-its-kind Wired analysis found that more than one in eight apps built for US service members carry foreign code, some of it from firms in nations the Pentagon designates as adversaries. The study exposes a supply-chain risk in software marketed to military users, where embedded Chinese and Russian components could hand adversaries access to sensitive personnel; the Pentagon and app vendors face pressure to audit code provenance. - Wired Security: https://www.wired.com/story/apps-marketed-to-us-troops-are-shipping-chinese-and-russian-code/ BUSINESS AND POLITICS ---------------------------------------------------------------- * Iran War Pushes Gas Past $4 as Mediators Seek Truce Latest developments: Gas topped $4 a gallon nationally for the first time in a month, Yemen's Iranian-backed Houthis threatened to blockade Saudi crude exports through the Red Sea, and regional mediators narrowed talks toward a proposed 10-day ceasefire. U.S. and Iranian forces have fought openly since early July; Iran struck Gulf tankers Monday to briefly lift Brent crude near $90 a barrel, the U.S. average pump price crossed $4.003 as strikes hit Middle East oil infrastructure, and a wider spiral now threatens Saudi Arabia's Red Sea export route. - FT Markets: https://www.ft.com/content/52e98fc4-32e3-4ed9-90fd-dcbba6188df5?syn-25a6b1a6=1 - WSJ World News: https://www.wsj.com/world/middle-east/iran-war-mediators-push-for-traction-on-a-new-ceasefire-6174506c - FT World: https://www.ft.com/content/97389cc7-7c83-496e-a2d2-72a1eb574281?syn-25a6b1a6=1 - FT Markets: https://www.ft.com/content/522fc69e-77df-40fd-8ab4-6726b866d289?syn-25a6b1a6=1 * Burnham Names Cabinet, Gilts Sell Off Latest developments: Andy Burnham surprised his own Labour MPs by making former defence minister John Healey chancellor, and gilts came under pressure as investors braced for higher spending after Burnham pledged to 'use any flexibility' in the fiscal rules. Andy Burnham took over as Britain's prime minister Monday after Keir Starmer resigned, becoming the seventh UK leader in a decade; his cost-of-living agenda and vow to loosen fiscal constraints unsettled bond markets that expect higher taxes and borrowing. - FT World: https://www.ft.com/content/740f0449-f367-46e0-92a6-43251f56f974?syn-25a6b1a6=1 - FT Markets: https://www.ft.com/content/b7cc3ea9-c89c-4f94-8ce0-3786034a6ddc?syn-25a6b1a6=1 - FT World: https://www.ft.com/content/05b20ea3-425b-49da-886e-fd0ac9270fe7?syn-25a6b1a6=1 PITTSBURGH ---------------------------------------------------------------- Weather: This Afternoon: Sunny, high 85F. Tonight: Mostly Cloudy, low 67F. Tuesday: Slight Chance Showers And Thunderstorms then Showers And Thunderstorms, high 82F. Business: * Trump Praises Giant Eagle Price Cuts Latest developments: President Trump singled out Giant Eagle on Monday for lowering prices on many products this summer. Giant Eagle, the O'Hara Township-based grocery chain that anchors much of Western Pennsylvania's supermarket business, drew presidential praise for cutting prices across many products amid national attention to grocery costs. - WTAE: https://www.wtae.com/article/president-trump-giant-eagle-grocery-prices/73194101 * Gas Tops $4 a Gallon Again Latest developments: AAA data showed the national gas average hit $4.003 Monday, the first crossing above $4 in over a month, as U.S.-Iran fighting drove up oil. The U.S. average gasoline price crossed $4 a gallon for the first time in over a month, pushed by escalating U.S.-Iran strikes on Middle East oil infrastructure; rising diesel threatens to lift the cost of groceries and other goods trucked into Pittsburgh. - KDKA: https://www.cbsnews.com/pittsburgh/news/gas-prices-iran-war-oil-supply/ * Judge Halts Paramount-Warner Merger Latest developments: A federal judge issued a 14-day restraining order Monday blocking Paramount Skydance's takeover of Warner Bros. Discovery, with a hearing set for August 3, after a coalition of states sued. California district judge granted the states a temporary halt to the roughly $81 billion Paramount Skydance–Warner Bros. Discovery deal, citing compelling evidence the combined firm would hold substantial share of the wide-release theatrical distribution market. - KDKA: https://www.cbsnews.com/pittsburgh/news/paramount-warner-bros-merger-judge-halts/ Around town: * Parkway East on Track to Reopen Early Latest developments: Crews finished sliding the 22-million-pound Commercial Street Bridge into position over the weekend, and PennDOT District 11 executive Jason Zang said Monday the Parkway East could reopen next week, ahead of schedule. PennDOT's replacement of the Commercial Street Bridge on the Parkway East (I-376) reached a milestone as contractors moved the new span into place; an early reopening would end weeks of closures on the busy corridor east of Downtown Pittsburgh. - KDKA: https://www.cbsnews.com/pittsburgh/news/parkway-east-penndot-early-opening-commercial-street-bridge-replacement/ * West Nile Prompts Mosquito Spraying Latest developments: The Allegheny County Health Department will spray six Pittsburgh neighborhoods Wednesday after mosquito samples tested positive for West Nile virus. The Allegheny County Health Department scheduled pesticide treatment in six city neighborhoods for Wednesday, July 22, after recent mosquito samples returned positive for the mosquito-borne West Nile virus. - WPXI: https://www.wpxi.com/news/local/6-pittsburgh-neighborhoods-be-sprayed-after-mosquito-samples-test-positive-west-nile-virus/TVIQXSQULJFADB4EBNFPYIZIG4/ * Environmental Charter School to Relocate Latest developments: The Environmental Charter School board of directors voted to move its middle- and high-school programs to a new campus. Environmental Charter School, a Pittsburgh public charter, approved relocating its middle- and high-school programs to a new facility, consolidating its older grades away from their current buildings. - WPXI: https://www.wpxi.com/news/local/environmental-charter-school-votes-relocate-middle-high-schools-new-campus/X46CUDES7FDLJK6TYAAMHXYT4Q/ Events: * FlyBy 5K Returns to the Airport Latest developments: Organizers announced the FlyBy 5K and 2-Mile Fun Run/Walk will return to Pittsburgh International Airport on Saturday, September 19, 2026. The FlyBy 5K and 2-Mile Fun Run/Walk sends runners and walkers along the flat, closed taxiways of Pittsburgh International Airport in Findlay Township on Saturday, September 19, 2026, a rare chance to travel the airfield on foot. - Pittsburgh Magazine: https://www.pittsburghmagazine.com/pittsburgh-international-airport-flyby-5k-race-2026/ * Trundle Manor Oddities Museum in Swissvale Latest developments: The Post-Gazette spotlighted Trundle Manor, a macabre curiosity museum in Swissvale, in its off-the-beaten-path series. Trundle Manor, a by-appointment museum of the weird and quirky in Swissvale, displays a private collection of oddities and curiosities for visitors seeking something off the beaten path. - Post-Gazette Arts & Entertainment: https://www.post-gazette.com/ae/2026/07/20/trundle-manor-museum-swissvale/stories/202607190074 SPORTS ---------------------------------------------------------------- Pirates (52-48) Sun Jul 19 · Pirates 7 · Guardians 1 · Final Skenes strikes out 8 in 7 innings as Pirates roll to 7-1 win over Guardians https://plaintextsports.com/mlb/2026-07-19/pit-cle Up Next · Pirates @ Yankees · Mon Jul 20, 7:05 PM https://plaintextsports.com/mlb/2026-07-20/pit-nyy Around the Teams: * Hiles: Don't Trade Oneil Cruz Yet Latest developments: Post-Gazette columnist Noah Hiles argued in his July 20 weekend column that the Pirates should hold onto shortstop Oneil Cruz, at least for now. Noah Hiles used his Post-Gazette weekend column to make the case against dealing Oneil Cruz as the trade deadline nears, weighing Cruz's value against the Pirates' longer-term direction under manager Don Kelly. - Post-Gazette Pirates: https://www.post-gazette.com/sports/columns/2026/07/20/noah-hiles-weekend-pirates-oneil-cruz-don-kelly/stories/202607200010 * 'Future Yankee' Talk Trails Skenes Latest developments: A Post-Gazette 'Off The Bat' column, July 20, said an unfortunate 'future Yankee' comment reopened the conversation about ace Paul Skenes' long-term future in Pittsburgh. The Post-Gazette revisited the perennial worry over whether the Pirates can keep All-Star right-hander Paul Skenes, prompted by an offhand 'future Yankee' remark that stirred fan anxiety about his eventual free agency. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/07/20/paul-skenes-all-star-pirates-yankees/stories/202607180027 * Can Frazier Join Steelers' Great Centers? Latest developments: The Post-Gazette's July 20 training-camp countdown asked whether center Zach Frazier can follow the franchise's line of standout centers. The Post-Gazette profiled Steelers center Zach Frazier as camp at Saint Vincent College nears, measuring him against Pittsburgh's history of anchoring pivots and his role protecting quarterback Aaron Rodgers. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/07/20/training-camp-countdown-zach-frazier-center-offensive-lineman/stories/202607200003 Team USA: * U.S. Stars Lift Gotham to No. 1 in NWSL Latest developments: ESPN's NWSL Power Rankings vaulted NJ/NY Gotham FC to the top spot after they beat the Washington Spirit. Gotham FC, powered by U.S. internationals Rose Lavelle and Jaedyn Shaw alongside Spain's Esther González and Australia's Sam Kerr, climbed to No. 1 in ESPN's NWSL Power Rankings on the strength of its star-studded, in-form attack. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49409810/nwsl-power-rankings-star-studded-njny-gotham-fc-beat-washington-spirit-jump-no-1 * Trial Set for Ex-Olympic Canoeist Hearn Latest developments: A Washington judge set a September 28 trial for former Olympic canoe racer David Hearn. David Hearn, a former U.S. Olympic canoe slalom racer, faces a September 28 trial in Washington on charges he deliberately damaged the Lincoln Memorial Reflecting Pool. - ESPN Olympics: https://www.espn.com/olympics/story/_/id/49410663/sept-28-trial-date-set-david-hearn-reflecting-pool-case READING ---------------------------------------------------------------- * Stratechery -- Who's Afraid of Chinese Models? Ben Thompson argues that U.S. frontier AI labs will withstand competition from Chinese open models, and that the real imperative is enabling strong open-weight American alternatives rather than fearing China's. https://stratechery.com/2026/whos-afraid-of-chinese-models/ * Ed Zitron -- The OpenAI Bubble Zitron contends that OpenAI's finances and growth story do not justify its valuation, warning that the company sits at the center of an AI bubble propped up by circular financing and hype. https://www.wheresyoured.at/the-openai-bubble/ * Cal Newport -- Why Reading Matters Responding to a viral Atlantic piece on 'the end of reading,' Newport defends deep reading as essential cognitive training that sustains sustained attention and complex thought. https://calnewport.com/why-reading-matters/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,524.56 ▼ -0.1% Dow 52,472.99 ▼ -0.4% Nasdaq 25,930.32 ▼ -0.5% WTI crude 79.70 ▲ +11.9% EUR/USD 1.1430 ▲ +0.1% GBP/USD 1.3442 ▲ +0.4% USD/JPY 162.32 = +0.0% ================================================================ Generated 2026-07-20 16:06 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================