daily plain-text briefing: security, markets, business, and pittsburgh
Attackers are weaponizing fresh disclosures within hours, driving active exploitation of critical SharePoint, ServiceNow, and WordPress flaws faster than defenders can patch.
Latest developments: watchTowr caught attackers exploiting SharePoint deserialization flaw CVE-2026-50522, the third July SharePoint bug to go live after a public proof-of-concept, and Defused Cyber spotted in-the-wild exploitation of ServiceNow AI Platform sandbox-escape CVE-2026-6875.
Both flaws let an unauthenticated attacker run code over the network—CVE-2026-50522 rates 9.8 and CVE-2026-6875 rates 9.5. Microsoft patched SharePoint in its July Patch Tuesday and credited DEVCORE, and ServiceNow shipped its fix days before the attacks began. Patch both now.
Sources: The Hacker News · The Hacker News · SecurityWeek · The Hacker News · ↑ top
Latest developments: CISA added four actively exploited flaws to its Known Exploited Vulnerabilities catalog on July 21—WordPress core bugs CVE-2026-60137 and CVE-2026-63030 that together form the wp2shell chain, Langflow flaw CVE-2026-0770, and DD-WRT stack overflow CVE-2021-27137—as wp2shell scanning and successful compromises spread within three days of disclosure.
wp2shell chains a WordPress-core SQL injection with an interpretation-conflict bug to reach unauthenticated remote code execution, and WordPress pushed 6.9.5 and 7.0.2 through auto-update. Federal agencies face a KEV patch deadline, and every site owner should update immediately.
Sources: CISA Advisories · The Hacker News · Dark Reading · SANS Internet Storm Center · ↑ top
Latest developments: Sysdig tied a second attack on the same Langflow server to JadePuffer, the AI-agent-driven extortion operator, which now deploys ENCFORGE, a compiled Go ransomware that encrypts model weights, vector indexes, training datasets, and model checkpoints across the host.
JadePuffer runs its extortion end-to-end through an autonomous AI agent, and the same extortion contact ties both campaigns; ENCFORGE is the first ransomware aimed squarely at AI and machine-learning infrastructure. The operators entered through a Langflow remote-code-execution flaw.
Sources: The Hacker News · BleepingComputer · Help Net Security · ↑ top
Latest developments: Kaspersky's GReAT team detailed a new Project CAV3RN module that drives command-and-control through a compromised Outlook calendar over Microsoft Graph and falls back to DNS AAAA responses to recover its configuration, while researchers separately traced HollowGraph turning a hijacked Microsoft 365 calendar into a two-way dead-drop.
Both families bury their command traffic inside legitimate Microsoft cloud services to support long-term espionage, and investigators have linked the calendar-hijacking activity to Iranian operations. Hunt for anomalous Graph API and calendar activity on compromised mailboxes.
Sources: Securelist (Kaspersky) · SecurityWeek · BleepingComputer · ↑ top
Latest developments: Island uncovered FakeGit, roughly 7,600 malicious GitHub repositories—more than 800 posing as AI Skills or Model Context Protocol servers—tied to about 6,600 accounts and built to feed SmartLoader malware to developers and to the AI agents that recommend code.
The repos copy real projects with lookalike developer profiles and convincing READMEs, ranging from Gmail and WhatsApp integrations to AI workflows, and deliver SmartLoader through malicious ZIP files; the wave peaked in April 2026. Verify a repository's provenance before cloning it or trusting an agent's suggestion.
Sources: Help Net Security · The Hacker News · ↑ top
Latest developments: Kenya opened an investigation after attackers hijacked President William Ruto's official website on Saturday, July 18, swapping its homepage for a cryptocurrency wallet address and a threat to publish unspecified information about Ruto unless he paid.
The attackers left an extortion demand and a bitcoin wallet address, and no group has claimed the hack. Kenyan authorities are probing how the intruders reached the site.
Sources: The Record · ↑ top
This Afternoon: Chance Showers And Thunderstorms, high 83F.
Tonight: Chance Showers And Thunderstorms, low 65F.
Wednesday: Slight Chance Rain Showers then Mostly Sunny, high 77F.
Latest developments: WPXI reported July 21 that Hey Babe is expanding with a 50-seat dining room.
Hey Babe, the East Liberty cocktail lounge inside the Maverick Hotel run by married industry veterans Danielle Cain and Rob Hirst, who met working at Soba in Shadyside, is adding a 50-seat dining room.
Latest developments: President Trump publicly praised Giant Eagle on July 21 for cutting prices this summer.
Giant Eagle, the O'Hara Township-based supermarket chain, drew praise from President Trump for lowering prices on many items this summer.
Latest developments: The National Weather Service put all of the Pittsburgh area under an enhanced risk for severe storms Tuesday, July 21.
Forecasters warned that strong to severe thunderstorms could bring damaging winds, hail, flash flooding, and isolated tornadoes across the Pittsburgh area, eastern Ohio, and the West Virginia panhandle between noon and 8 p.m. Tuesday, July 21, and Duquesne Light said it is staging crews for outages.
Latest developments: WPXI reported July 21 that Allegheny County secured nearly $90 million in Redevelopment Assistance Capital Program awards for 60 projects.
County Executive Sara Innamorato and the Shapiro administration landed nearly $90 million in state Redevelopment Assistance Capital Program grants spread across 60 projects in Allegheny County.
Latest developments: TribLive reported July 21 that a state panel ordered the Department of Environmental Protection to study whether the proposed mine land is unsuitable for mining.
The Pennsylvania Department of Environmental Protection must review a proposed mine site in Donegal and Mt. Pleasant townships in Westmoreland County to determine whether the land is suitable for mining.
Latest developments: Pittsburgh Magazine previewed July 21 that the second-annual Pittsburgh Caribbean Carnival returns Saturday, July 25.
The second annual Pittsburgh Caribbean Carnival runs Saturday, July 25, at Allegheny Commons Park West on the North Side, with Caribbean music, costumes, and cuisine; organizers say it will be bigger than last year's inaugural event.
Sources: Pittsburgh Magazine · ↑ top
Pirates (52-49)
Mon Jul 20 · Pirates 5 · Yankees 8 · Final
Jazz Chisholm Jr. homers twice and drives in 5 as Yankees sink Pirates 8-5 after benches clear
Up Next · Pirates @ Yankees · Tue Jul 21, 7:05 PM
Latest developments: The Post-Gazette's training-camp countdown argued July 21 the Steelers expect edge rusher Nick Herbig to become a front-line starter.
Having committed roughly $100 million to outside linebacker Nick Herbig, the Steelers expect him to anchor the pass rush as a full-time starter in 2026, the Post-Gazette wrote as camp opens in Latrobe.
Sources: Post-Gazette Steelers · ↑ top
Latest developments: Post-Gazette columnist Noah Hiles argued July 20 the Pirates should hold onto shortstop Oneil Cruz through the trade deadline.
With the July trade deadline nearing and reports that the Pirates could listen to offers, columnist Noah Hiles wrote that Pittsburgh should keep Oneil Cruz rather than sell at his current value.
Sources: Post-Gazette Pirates · ↑ top
Latest developments: ESPN reported July 21 that an angry motorist confronted American cyclist Brandon McNulty before Tuesday's time trial.
A motorist confronted United States rider Brandon McNulty before the individual time trial at the Tour de France on Tuesday, July 21, and McNulty was unhurt.
Sources: ESPN Olympics · ↑ top
Latest developments: ESPN reported July 20 that a Washington judge set a September 28 trial date for former Olympic canoe racer David Hearn.
A judge in Washington set a September 28 trial for former United States Olympic canoe racer David Hearn, charged with deliberately damaging the Lincoln Memorial Reflecting Pool.
Sources: ESPN Olympics · ↑ top
S&P 500 7,510.15 ▼ -0.2% Dow 52,341.11 ▼ -0.5% Nasdaq 25,857.30 ▼ -0.6% WTI crude 80.72 ▲ +10.4% EUR/USD 1.1430 ▲ +0.1% GBP/USD 1.3442 ▲ +0.4% USD/JPY 162.32 = +0.0%