================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Tuesday, July 21, 2026 - 6:05 AM EDT ================================================================ Attackers weaponized freshly disclosed ServiceNow and WordPress flaws within days while espionage crews hid command channels inside Microsoft 365 calendars. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Attackers weaponized fresh disclosures within days, exploiting a 9.5-rated ServiceNow AI Platform sandbox escape and chaining CVE-2026-63030 against WordPress core amid mass wp2shell scanning. see: ServiceNow AI Platform RCE Exploited; WordPress wp2shell Mass Exploitation * [TREND] AI infrastructure sits on both ends of attacks as JadePuffer's EncForge ransomware encrypts model weights while nearly 7,600 FakeGit repositories pose as AI skills spreading SmartLoader. see: JadePuffer Deploys EncForge AI Ransomware; FakeGit Floods GitHub With SmartLoader * [TREND] Kaspersky detailed a Project CAV3RN espionage module hiding command-and-control inside Outlook calendar events via Microsoft Graph, blending tasking into trusted cloud traffic. see: CAV3RN Espionage Abuses Outlook Calendars * [UPDATE (new)] Fresh breaches surfaced as Clover Health disclosed social-engineered account hijacks exposing health data and intruders spent nine months inside South Korea's diplomatic-academy training system. see: Fresh Breaches Hit Insurers and Governments * [TREND] In commentary, Zitron sharpens his case that OpenAI anchors an unsustainable AI bubble, while Ben Thompson reads Netflix earnings as a mature company past its fastest growth. see: The OpenAI Bubble; Netflix Earnings, Is Netflix Washed?, Additional Notes * [TREND] Locally, forecasters flagged an Alert Day for tornado-capable storms across Western Pennsylvania as Rostraver residents pressed officials to reject any data center. see: Severe Storms, Tornadoes Possible Tuesday; Rostraver Residents Oppose Data Centers SECURITY ---------------------------------------------------------------- 1. WORDPRESS WP2SHELL MASS EXPLOITATION Vulnerabilities and Exploits · [vulnerability, rce, exploit] Latest developments: A public exploit landed and drove mass internet scanning, with successful chaining of CVE-2026-60137 and CVE-2026-63030 already well underway, and SANS confirmed the SQL-injection-to-RCE bug in WordPress core now carries CVE-2026-63030. wp2shell chains two flaws in WordPress core to give unauthenticated remote code execution and full site takeover across one of the largest attack surfaces online. Sites must run WordPress 6.9.5 or 7.0.2. - The Hacker News: https://thehackernews.com/2026/07/wordpress-wp2shell-exploitation-grows.html - Dark Reading: https://www.darkreading.com/cyberattacks-data-breaches/wp2shell-millions-wordpress-sites-remote-takeover - SANS Internet Storm Center: https://isc.sans.edu/diary/rss/33168 2. CAV3RN ESPIONAGE ABUSES OUTLOOK CALENDARS Nation-State Activity · [apt, espionage] Latest developments: Kaspersky's GReAT team detailed a new Project CAV3RN module that hides command-and-control inside Outlook calendar events through the Microsoft Graph API and recovers its configuration from DNS AAAA records, extending the calendar-hijacking framework that Group-IB tracks as HollowGraph and ties to Iranian espionage. The modular Cavern/CAV3RN backdoor plants operator tasking and exfiltrates stolen files as attachments on Microsoft 365 calendar events, some dated to 2050, so its traffic blends into legitimate Graph API calls. Defenders should watch for anomalous Graph calendar activity. - Securelist (Kaspersky): https://securelist.com/project-cav3rn-cyberespionage-framework-using-outlook-and-dns/120757/ - The Hacker News: https://thehackernews.com/2026/07/hollowgraph-malware-hides-c2-and-stolen.html - BleepingComputer: https://www.bleepingcomputer.com/news/security/new-hollowgraph-malware-uses-microsoft-graph-for-stealthy-c2-comms/ 3. FRESH BREACHES HIT INSURERS AND GOVERNMENTS Data Breaches · [breach] Latest developments: Clover Health Investments disclosed that attackers used social engineering to hijack employee accounts holding personal and health data, hackers spent nine months inside South Korea's diplomatic-academy training system stealing Foreign Ministry staff records, and Romania's land registry called a cyberattack the worst incident in its history as it raced to restore property transactions. Three unrelated intrusions exposed sensitive records at Medicare insurer Clover Health, South Korea's Ministry of Foreign Affairs, and Romania's national land registry, with social engineering and prolonged unnoticed access driving each. Affected people and agencies face notification and recovery. - SecurityWeek: https://www.securityweek.com/clover-health-investments-discloses-data-breach/ - The Record: https://therecord.media/south-korea-cyberattack-foreign-ministry - The Record: https://therecord.media/romania-cyberattack-land-registry 4. SERVICENOW AI PLATFORM RCE EXPLOITED Vulnerabilities and Exploits · [vulnerability, rce, patch] Latest developments: Defused Cyber caught in-the-wild exploitation of CVE-2026-6875 within days of disclosure, a 9.5-rated sandbox escape in the ServiceNow AI Platform that lets an unauthenticated attacker run arbitrary code, and ServiceNow has shipped patches. The flaw sits in the ServiceNow AI Platform and hands remote code execution to anyone who can reach the instance, with no login required. Administrators should apply ServiceNow's fix immediately. - The Hacker News: https://thehackernews.com/2026/07/critical-servicenow-ai-platform-flaw.html - SecurityWeek: https://www.securityweek.com/exploitation-of-servicenow-vulnerability-seen-days-after-disclosure/ 5. JADEPUFFER DEPLOYS ENCFORGE AI RANSOMWARE AI Security · [ransomware, ai] Latest developments: Sysdig tied a second intrusion on the same Langflow server to the autonomous AI-agent operator JadePuffer, which now drops ENCFORGE, a compiled Go ransomware built to encrypt model weights, vector indexes, and training datasets across the host. JadePuffer breaks in through a Langflow remote-code-execution flaw and, with EncForge, targets AI infrastructure files—model weights, vector indexes, and training datasets—for encryption across the filesystem. Operators running Langflow should patch and isolate model storage. - The Hacker News: https://thehackernews.com/2026/07/new-encforge-ransomware-targets-ai.html - BleepingComputer: https://www.bleepingcomputer.com/news/security/jadepuffer-agentic-attacks-now-target-ai-model-data-with-ransomware/ 6. FAKEGIT FLOODS GITHUB WITH SMARTLOADER Ransomware and Cybercrime · [malware, supply chain] Latest developments: Researchers uncovered nearly 7,600 malicious GitHub repositories in the FakeGit campaign, more than 800 of them posing as AI skills or Model Context Protocol servers, all delivering the SmartLoader malware through convincing README files and booby-trapped ZIP archives. FakeGit clones real projects and lookalike developer profiles to trick users into downloading SmartLoader, which stages follow-on infostealers. Developers should verify repository provenance before running any downloaded code. - The Hacker News: https://thehackernews.com/2026/07/fakegit-campaign-uses-7600-github.html BUSINESS AND POLITICS ---------------------------------------------------------------- * Andy Burnham Forms New UK Government Latest developments: Andy Burnham named his cabinet, appointing former defense minister John Healey as chancellor and pledging to scrap value-added tax on electricity bills. Andy Burnham took office as UK prime minister and built a cabinet drawn largely from Labour's old right, handing chancellor John Healey an in-tray of rising defense costs and government borrowing still above target; sterling slipped against the euro as investors weighed his opening measures. - FT World: https://www.ft.com/content/05b20ea3-425b-49da-886e-fd0ac9270fe7?syn-25a6b1a6=1 - FT World: https://www.ft.com/content/45ef8443-e5ab-4c61-aed2-e646cb8dc285?syn-25a6b1a6=1 - WSJ Markets: https://www.wsj.com/finance/currencies/new-trump-tariffs-threaten-to-further-strain-cad-3b0f1e73?mod=rss_markets_main * Mediators Push US-Iran Ceasefire as Toll Rises Latest developments: Mediators pushed for a fresh US-Iran ceasefire, easing Brent crude back below $90 a barrel, as the Pentagon identified two Army soldiers—Pvt. Isabella Gonzales and 1st Lt. Tyler Feehan—killed when an Iranian missile hit troop housing at a Jordan base. US forces carried out their 10th straight night of strikes on Iran to reopen the Strait of Hormuz while Iran struck a tanker in the waterway; the Pentagon says nearly 100 US troops have suffered mostly minor concussions over two weeks, and an Iranian missile hit housing units at Muwaffaq Salti Air Base in Jordan. - FT World: https://www.ft.com/content/2e137205-df69-47a2-9674-2f4a9deec0d9?syn-25a6b1a6=1 - WSJ Markets: https://www.wsj.com/finance/commodities-futures/oil-edges-lower-amid-hopes-of-new-u-s-iran-ceasefire-892b1c0a?mod=rss_markets_main - WSJ World News: https://www.wsj.com/world/middle-east/iran-missile-struck-housing-for-u-s-troops-at-jordan-base-9f5b8120 PITTSBURGH ---------------------------------------------------------------- Weather: Today: Slight Chance Showers And Thunderstorms then Chance Showers And Thunderstorms, high 83F. Tonight: Chance Showers And Thunderstorms, low 65F. Wednesday: Slight Chance Rain Showers then Mostly Sunny, high 77F. Business: * AHN and UPMC Pilot AI for Diabetes Care Latest developments: The Post-Gazette reported July 21 that a new Pittsburgh clinical pilot will put artificial intelligence to work in diabetes care. Allegheny Health Network and UPMC are launching a Pittsburgh pilot that applies clinical AI tools to manage diabetes care, testing whether the technology can improve treatment across the region's two largest health systems. - Pittsburgh Post-Gazette: https://www.post-gazette.com/business/healthcare-business/2026/07/21/ai-diabetes-ahn-upmc/stories/202607200030 * VisitPittsburgh Courts Washington Travelers Latest developments: The Post-Gazette detailed July 21 a VisitPittsburgh campaign to lift the city's profile in the nation's capital. The tourism agency VisitPittsburgh is running a marketing campaign in Washington, D.C., aiming to draw capital-area visitors to Pittsburgh and reshape how the city registers with a national audience. - Pittsburgh Post-Gazette: https://www.post-gazette.com/local/city/2026/07/21/visit-pittsburgh-tourism-washington-dc/stories/202607170061 * Nothingman Revives Mount Washington Space Latest developments: The Post-Gazette reported July 21 that a restaurant called Nothingman is opening in the former Redbeard's space atop Mount Washington. Nothingman is taking over the former Redbeard's on Mount Washington, giving the prominent hilltop dining spot a second life. - Pittsburgh Post-Gazette: https://www.post-gazette.com/life/dining/2026/07/21/nothingman-mount-washington-given-to-fly/stories/202607170044 Around town: * Severe Storms, Tornadoes Possible Tuesday Latest developments: Forecasters declared Tuesday, July 21, an Alert Day for Western Pennsylvania, warning of two rounds of thunderstorms carrying a tornado risk. Meteorologists expect strong to severe thunderstorms across the Pittsburgh area Tuesday afternoon and evening, with damaging wind, heavy rain, and possible tornadoes in two separate rounds. - WTAE: https://www.wtae.com/article/alert-day-severe-storms-this-afternoon-and-evening/73199917 - KDKA: https://www.cbsnews.com/pittsburgh/video/severe-storms-and-tornadoes-possible-in-pittsburgh-area-tuesday/ - WPXI: https://www.wpxi.com/news/local/widespread-severe-storms-possible-tuesday/Z3FXTURUG5GFLNZ5PGYCAIYYIE/ * Rostraver Residents Oppose Data Centers Latest developments: Rostraver Township residents pressed township officials July 20 to reject any data center, though officials said none is planned. A contingent of residents in Rostraver Township, Westmoreland County, urged their officials to oppose data centers after social-media rumors that the township could host one; township officials said no such facility is on the table. - TribLive: https://triblive.com/local/westmoreland/rostraver-residents-voice-concerns-over-data-centers-urge-officials-to-oppose-it/ * Pennsylvania Last in Youth Voter Registration Latest developments: A new study ranks Pennsylvania last among states for registering 18-year-olds to vote, the Post-Gazette reported July 21. Pennsylvania sits at the bottom nationally in the share of 18-year-olds registered to vote, according to a new study that spotlights the state's lagging youth-registration numbers. - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/politics-state/2026/07/21/pennsylvania-youth-voters/stories/202607210009 Events: * Rivers of Fire Hot Wing Competition Latest developments: New Amsterdam hosts its inaugural Rivers of Fire Hot Wing Competition on Thursday, July 23. New Amsterdam holds the first Rivers of Fire Hot Wing Competition, presented by Hammajack Heat Co., on Thursday, July 23, at 4421 Butler Street in Lawrenceville, challenging participants to eat through a pile of wings. - Pittsburgh City Paper: https://www.pghcitypaper.com/food-drink/hot-wing-war-ted-lasso-ice-cream-and-more-pittsburgh-food-news/ SPORTS ---------------------------------------------------------------- Pirates (52-49) Mon Jul 20 · Pirates 5 · Yankees 8 · Final Jazz Chisholm Jr. homers twice and drives in 5 as Yankees sink Pirates 8-5 after benches clear https://plaintextsports.com/mlb/2026-07-20/pit-nyy Up Next · Pirates @ Yankees · Tue Jul 21, 7:05 PM https://plaintextsports.com/mlb/2026-07-21/pit-nyy Around the Teams: * Steelers Expect More From Nick Herbig Latest developments: The Post-Gazette's training-camp countdown, July 21, argued the Steelers now need outside linebacker Nick Herbig as a full-time impact rusher after his roughly $100 million deal. The Post-Gazette wrote that Nick Herbig's $100 million contract ends his days as a rotational pass rusher, and the Steelers are counting on him to start and produce off the edge alongside T.J. Watt. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/07/21/trainingcamp-countdown-analysis-defense-herbig/stories/202607210001 * Hiles: Pirates Shouldn't Trade Oneil Cruz Yet Latest developments: Post-Gazette columnist Noah Hiles argued July 20 the Pirates should keep shortstop Oneil Cruz, at least for now, as the trade deadline nears. In his weekend column, Noah Hiles made the case that the Pirates hold onto Oneil Cruz rather than deal him, weighing the team's direction under manager Don Kelly. - Post-Gazette Pirates: https://www.post-gazette.com/sports/columns/2026/07/20/noah-hiles-weekend-pirates-oneil-cruz-don-kelly/stories/202607200010 * 'Future Yankee' Talk Reopens Skenes Debate Latest developments: The Post-Gazette's Off The Bat, July 20, revisited Paul Skenes' long-term Pittsburgh future after a 'future Yankee' comment stirred fans. A stray 'future Yankee' remark reopened the recurring question of whether the Pirates can keep ace Paul Skenes past his cheap early years, the Post-Gazette's Off The Bat column noted. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/07/20/paul-skenes-all-star-pirates-yankees/stories/202607180027 Team USA: * Trial Set for US Olympic Canoeist David Hearn Latest developments: A Washington judge set a September 28 trial date for former US Olympic canoe racer David Hearn, ESPN reported July 20. David Hearn, a former United States Olympic canoe racer, faces trial September 28 in the nation's capital on charges he deliberately damaged the Lincoln Memorial Reflecting Pool. - ESPN Olympics: https://www.espn.com/olympics/story/_/id/49410663/sept-28-trial-date-set-david-hearn-reflecting-pool-case * US Stars Lift Gotham to Top of NWSL Rankings Latest developments: Gotham FC climbed to No. 1 in ESPN's NWSL Power Rankings July 20 after beating the Washington Spirit, with US internationals Rose Lavelle and Jaedyn Shaw in form. NJ/NY Gotham FC rose to first in ESPN's NWSL Power Rankings behind US national-team midfielder Rose Lavelle and forward Jaedyn Shaw, alongside Esther González and Sam Kerr, after defeating the Washington Spirit. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49409810/nwsl-power-rankings-star-studded-njny-gotham-fc-beat-washington-spirit-jump-no-1 READING ---------------------------------------------------------------- * Stratechery -- Netflix Earnings, Is Netflix Washed?, Additional Notes Ben Thompson reads Netflix's solid but unremarkable earnings as the mark of a mature company whose most exciting growth likely sits behind it. https://stratechery.com/2026/netflix-earnings-is-netflix-washed-additional-notes/ * Ed Zitron -- The OpenAI Bubble Zitron argues that OpenAI anchors an unsustainable AI investment bubble propped up by circular financing and unrealistic revenue expectations. https://www.wheresyoured.at/the-openai-bubble/ * Cal Newport -- Why Reading Matters Responding to an Atlantic piece on the decline of reading, Newport argues that sustained deep reading remains essential to serious thought. https://calnewport.com/why-reading-matters/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,510.15 ▼ -0.2% Dow 52,341.11 ▼ -0.5% Nasdaq 25,857.30 ▼ -0.6% WTI crude 80.72 ▲ +10.4% EUR/USD 1.1430 ▲ +0.1% GBP/USD 1.3442 ▲ +0.4% USD/JPY 162.32 = +0.0% ================================================================ Generated 2026-07-21 06:05 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================