daily plain-text briefing: security, markets, business, and pittsburgh
Attackers weaponized freshly disclosed ServiceNow and WordPress flaws within days while espionage crews hid command channels inside Microsoft 365 calendars.
Latest developments: A public exploit landed and drove mass internet scanning, with successful chaining of CVE-2026-60137 and CVE-2026-63030 already well underway, and SANS confirmed the SQL-injection-to-RCE bug in WordPress core now carries CVE-2026-63030.
wp2shell chains two flaws in WordPress core to give unauthenticated remote code execution and full site takeover across one of the largest attack surfaces online. Sites must run WordPress 6.9.5 or 7.0.2.
Sources: The Hacker News · Dark Reading · SANS Internet Storm Center · ↑ top
Latest developments: Kaspersky's GReAT team detailed a new Project CAV3RN module that hides command-and-control inside Outlook calendar events through the Microsoft Graph API and recovers its configuration from DNS AAAA records, extending the calendar-hijacking framework that Group-IB tracks as HollowGraph and ties to Iranian espionage.
The modular Cavern/CAV3RN backdoor plants operator tasking and exfiltrates stolen files as attachments on Microsoft 365 calendar events, some dated to 2050, so its traffic blends into legitimate Graph API calls. Defenders should watch for anomalous Graph calendar activity.
Sources: Securelist (Kaspersky) · The Hacker News · BleepingComputer · ↑ top
Latest developments: Clover Health Investments disclosed that attackers used social engineering to hijack employee accounts holding personal and health data, hackers spent nine months inside South Korea's diplomatic-academy training system stealing Foreign Ministry staff records, and Romania's land registry called a cyberattack the worst incident in its history as it raced to restore property transactions.
Three unrelated intrusions exposed sensitive records at Medicare insurer Clover Health, South Korea's Ministry of Foreign Affairs, and Romania's national land registry, with social engineering and prolonged unnoticed access driving each. Affected people and agencies face notification and recovery.
Sources: SecurityWeek · The Record · The Record · ↑ top
Latest developments: Defused Cyber caught in-the-wild exploitation of CVE-2026-6875 within days of disclosure, a 9.5-rated sandbox escape in the ServiceNow AI Platform that lets an unauthenticated attacker run arbitrary code, and ServiceNow has shipped patches.
The flaw sits in the ServiceNow AI Platform and hands remote code execution to anyone who can reach the instance, with no login required. Administrators should apply ServiceNow's fix immediately.
Sources: The Hacker News · SecurityWeek · ↑ top
Latest developments: Sysdig tied a second intrusion on the same Langflow server to the autonomous AI-agent operator JadePuffer, which now drops ENCFORGE, a compiled Go ransomware built to encrypt model weights, vector indexes, and training datasets across the host.
JadePuffer breaks in through a Langflow remote-code-execution flaw and, with EncForge, targets AI infrastructure files—model weights, vector indexes, and training datasets—for encryption across the filesystem. Operators running Langflow should patch and isolate model storage.
Sources: The Hacker News · BleepingComputer · ↑ top
Latest developments: Researchers uncovered nearly 7,600 malicious GitHub repositories in the FakeGit campaign, more than 800 of them posing as AI skills or Model Context Protocol servers, all delivering the SmartLoader malware through convincing README files and booby-trapped ZIP archives.
FakeGit clones real projects and lookalike developer profiles to trick users into downloading SmartLoader, which stages follow-on infostealers. Developers should verify repository provenance before running any downloaded code.
Sources: The Hacker News · ↑ top
Latest developments: Andy Burnham named his cabinet, appointing former defense minister John Healey as chancellor and pledging to scrap value-added tax on electricity bills.
Andy Burnham took office as UK prime minister and built a cabinet drawn largely from Labour's old right, handing chancellor John Healey an in-tray of rising defense costs and government borrowing still above target; sterling slipped against the euro as investors weighed his opening measures.
Sources: FT World · FT World · WSJ Markets · ↑ top
Latest developments: Mediators pushed for a fresh US-Iran ceasefire, easing Brent crude back below $90 a barrel, as the Pentagon identified two Army soldiers—Pvt. Isabella Gonzales and 1st Lt. Tyler Feehan—killed when an Iranian missile hit troop housing at a Jordan base.
US forces carried out their 10th straight night of strikes on Iran to reopen the Strait of Hormuz while Iran struck a tanker in the waterway; the Pentagon says nearly 100 US troops have suffered mostly minor concussions over two weeks, and an Iranian missile hit housing units at Muwaffaq Salti Air Base in Jordan.
Sources: FT World · WSJ Markets · WSJ World News · ↑ top
Today: Slight Chance Showers And Thunderstorms then Chance Showers And Thunderstorms, high 83F.
Tonight: Chance Showers And Thunderstorms, low 65F.
Wednesday: Slight Chance Rain Showers then Mostly Sunny, high 77F.
Latest developments: The Post-Gazette reported July 21 that a new Pittsburgh clinical pilot will put artificial intelligence to work in diabetes care.
Allegheny Health Network and UPMC are launching a Pittsburgh pilot that applies clinical AI tools to manage diabetes care, testing whether the technology can improve treatment across the region's two largest health systems.
Sources: Pittsburgh Post-Gazette · ↑ top
Latest developments: The Post-Gazette detailed July 21 a VisitPittsburgh campaign to lift the city's profile in the nation's capital.
The tourism agency VisitPittsburgh is running a marketing campaign in Washington, D.C., aiming to draw capital-area visitors to Pittsburgh and reshape how the city registers with a national audience.
Sources: Pittsburgh Post-Gazette · ↑ top
Latest developments: The Post-Gazette reported July 21 that a restaurant called Nothingman is opening in the former Redbeard's space atop Mount Washington.
Nothingman is taking over the former Redbeard's on Mount Washington, giving the prominent hilltop dining spot a second life.
Sources: Pittsburgh Post-Gazette · ↑ top
Latest developments: Forecasters declared Tuesday, July 21, an Alert Day for Western Pennsylvania, warning of two rounds of thunderstorms carrying a tornado risk.
Meteorologists expect strong to severe thunderstorms across the Pittsburgh area Tuesday afternoon and evening, with damaging wind, heavy rain, and possible tornadoes in two separate rounds.
Sources: WTAE · KDKA · WPXI · ↑ top
Latest developments: Rostraver Township residents pressed township officials July 20 to reject any data center, though officials said none is planned.
A contingent of residents in Rostraver Township, Westmoreland County, urged their officials to oppose data centers after social-media rumors that the township could host one; township officials said no such facility is on the table.
Latest developments: A new study ranks Pennsylvania last among states for registering 18-year-olds to vote, the Post-Gazette reported July 21.
Pennsylvania sits at the bottom nationally in the share of 18-year-olds registered to vote, according to a new study that spotlights the state's lagging youth-registration numbers.
Sources: Pittsburgh Post-Gazette · ↑ top
Latest developments: New Amsterdam hosts its inaugural Rivers of Fire Hot Wing Competition on Thursday, July 23.
New Amsterdam holds the first Rivers of Fire Hot Wing Competition, presented by Hammajack Heat Co., on Thursday, July 23, at 4421 Butler Street in Lawrenceville, challenging participants to eat through a pile of wings.
Sources: Pittsburgh City Paper · ↑ top
Pirates (52-49)
Mon Jul 20 · Pirates 5 · Yankees 8 · Final
Jazz Chisholm Jr. homers twice and drives in 5 as Yankees sink Pirates 8-5 after benches clear
Up Next · Pirates @ Yankees · Tue Jul 21, 7:05 PM
Latest developments: The Post-Gazette's training-camp countdown, July 21, argued the Steelers now need outside linebacker Nick Herbig as a full-time impact rusher after his roughly $100 million deal.
The Post-Gazette wrote that Nick Herbig's $100 million contract ends his days as a rotational pass rusher, and the Steelers are counting on him to start and produce off the edge alongside T.J. Watt.
Sources: Post-Gazette Steelers · ↑ top
Latest developments: Post-Gazette columnist Noah Hiles argued July 20 the Pirates should keep shortstop Oneil Cruz, at least for now, as the trade deadline nears.
In his weekend column, Noah Hiles made the case that the Pirates hold onto Oneil Cruz rather than deal him, weighing the team's direction under manager Don Kelly.
Sources: Post-Gazette Pirates · ↑ top
Latest developments: The Post-Gazette's Off The Bat, July 20, revisited Paul Skenes' long-term Pittsburgh future after a 'future Yankee' comment stirred fans.
A stray 'future Yankee' remark reopened the recurring question of whether the Pirates can keep ace Paul Skenes past his cheap early years, the Post-Gazette's Off The Bat column noted.
Sources: Post-Gazette Pirates · ↑ top
Latest developments: A Washington judge set a September 28 trial date for former US Olympic canoe racer David Hearn, ESPN reported July 20.
David Hearn, a former United States Olympic canoe racer, faces trial September 28 in the nation's capital on charges he deliberately damaged the Lincoln Memorial Reflecting Pool.
Sources: ESPN Olympics · ↑ top
Latest developments: Gotham FC climbed to No. 1 in ESPN's NWSL Power Rankings July 20 after beating the Washington Spirit, with US internationals Rose Lavelle and Jaedyn Shaw in form.
NJ/NY Gotham FC rose to first in ESPN's NWSL Power Rankings behind US national-team midfielder Rose Lavelle and forward Jaedyn Shaw, alongside Esther González and Sam Kerr, after defeating the Washington Spirit.
Sources: ESPN Soccer · ↑ top
S&P 500 7,510.15 ▼ -0.2% Dow 52,341.11 ▼ -0.5% Nasdaq 25,857.30 ▼ -0.6% WTI crude 80.72 ▲ +10.4% EUR/USD 1.1430 ▲ +0.1% GBP/USD 1.3442 ▲ +0.4% USD/JPY 162.32 = +0.0%