================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Tuesday, July 21, 2026 - 4:05 PM EDT ================================================================ Ransomware crews and AI-powered attackers race defenders to weaponize freshly disclosed flaws, as Qilin turns a Palo Alto VPN bug into initial access and poisoned web pages hijack AI coding agents. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] AI sits on both sides of security, as poisoned web pages hijack AWS's Kiro coding agent into running attacker code while Google's Gemini and Cisco's Antares hunt vulnerabilities. see: Poisoned Content Hijacks AI Coding Agents; AI Takes Both Sides of Vulnerability Hunting * [TREND] Ransomware crews keep breaching perimeter gear, with Qilin abusing a Palo Alto GlobalProtect bypass, N-day WordPress webshells landing within hours, and Anubis claiming the Fairlife attack. see: Qilin Ransomware Exploits Palo Alto GlobalProtect; N-Day Exploitation Windows Collapse to Hours; Anubis Claims Coca-Cola Fairlife Attack * [TREND] Geopolitical friction rattles markets as Trump threatens Iran's Pickaxe Mountain nuclear site sending oil toward $120, races to avert a 50% Canadian tariff, and orders defense supply-chain mapping. see: U.S.-Iran War Escalates, Oil Rallies; Canada, U.S. to Talk to Avert 50% Tariff; Trump Orders Defense Supply-Chain Mapping * [UPDATE (new)] A severe thunderstorm watch across Allegheny and five other counties forced Kennywood, Sandcastle, and Idlewild to close early Tuesday afternoon. see: Severe Storms Shutter Kennywood and Sandcastle * [TREND] The Pirates' bad-blood series with the Yankees dominated the beat, from cleared benches over José Caballero to renewed 'future Yankee' chatter around Paul Skenes. see: Benches Clear in Pirates-Yankees Opener; 'Future Yankee' Talk Trails Paul Skenes * [UPDATE (updated)] The Reading list refreshed with fresh takes on Netflix's mature earnings, Zitron's case for an OpenAI bubble, and Newport's defense of deep reading. see: Netflix Earnings, Is Netflix Washed?, Additional Notes; The OpenAI Bubble; Why Reading Matters SECURITY ---------------------------------------------------------------- 1. POISONED CONTENT HIJACKS AI CODING AGENTS AI Security · [ai, zero-day, patch] Latest developments: Intezer and Kodem Security showed that hidden text on a web page makes AWS's agentic IDE Kiro rewrite its own configuration file and run attacker code with no approval step, which AWS has patched, while separate researchers proved invisible on-screen text can drive five open-source Android agent frameworks, including AppAgent and AppAgentX, to run commands on the host PC. Attackers hide instructions in ordinary web pages and app screens that AI coding and mobile agents faithfully execute, converting a routine summarize-this-page request into remote code execution. Developers running agentic tools should restrict what the agent can write and run. - The Hacker News: https://thehackernews.com/2026/07/aws-kiro-flaw-let-poisoned-web-page.html - The Hacker News: https://thehackernews.com/2026/07/open-source-android-ai-agents-could-let.html - Wired Security: https://www.wired.com/story/a-sneaky-hacking-tool-targeting-ai-infrastructure-is-lurking-in-victims-blind-spots/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/cursor-codex-gemini-cli-antigravity-hit-by-sandbox-escapes/ 2. AI TAKES BOTH SIDES OF VULNERABILITY HUNTING AI Security · [ai, vulnerability] Latest developments: Google DeepMind released Gemini 3.5 Flash Cyber, a model that discovers, validates, and patches flaws through CodeMender for governments and trusted partners, and Cisco shipped its open-weight Antares models for cheap vulnerability localization, even as Dark Reading detailed a Russian-speaking actor named Trim who stripped guardrails from frontier models and bolted them onto offensive security tools. The same large language models now power vulnerability discovery for defenders and exploit development for attackers, with Google, Cisco, and Ivanti automating triage while criminal operators build jailbroken attack platforms. Security teams should weigh AI remediation gains against the accelerating offensive tooling. - The Hacker News: https://thehackernews.com/2026/07/google-launches-gemini-35-flash-cyber.html - SecurityWeek: https://www.securityweek.com/cisco-launches-low-cost-ai-models-for-source-code-security/ - Dark Reading: https://www.darkreading.com/cyber-risk/hacker-ai-jailbreaks-offensive-attack-platform - Dark Reading: https://www.darkreading.com/cybersecurity-operations/remediating-vulnerabilities-llms-ivanti-automation 3. N-DAY EXPLOITATION WINDOWS COLLAPSE TO HOURS Vulnerabilities and Exploits · [vulnerability, exploit, patch] Latest developments: Attackers exploiting the WordPress wp2shell chain, CVE-2026-63030 and CVE-2026-60137, moved past scanning to install persistent webshells and malicious plugins on compromised servers, while Defused Cyber confirmed in-the-wild remote code execution against ServiceNow AI Platform sandbox-escape flaw CVE-2026-6875, rated 9.5. Public proof-of-concept code now turns disclosure into mass compromise within hours, as vendor patch diffs hand attackers a map of what to hit. Administrators must patch WordPress, ServiceNow, and SharePoint on emergency timelines and hunt for webshells. - The Hacker News: https://thehackernews.com/2026/07/wordpress-wp2shell-exploitation-grows.html - BleepingComputer: https://www.bleepingcomputer.com/news/security/critical-wp2shell-wordpress-flaws-exploited-to-install-webshells/ - SecurityWeek: https://www.securityweek.com/exploitation-of-servicenow-vulnerability-seen-days-after-disclosure/ - The Hacker News: https://thehackernews.com/2026/07/n-day-is-becoming-n-hour-patching.html 4. QILIN RANSOMWARE EXPLOITS PALO ALTO GLOBALPROTECT Ransomware and Cybercrime · [ransomware, zero-day, patch] Latest developments: Arctic Wolf Labs tied multiple June 2026 intrusions to Qilin, also called Agenda, exploiting Palo Alto Networks PAN-OS authentication bypass CVE-2026-0257, rated 7.8, in the GlobalProtect portal and gateway to gain a foothold before deploying ransomware. Qilin runs a ransomware-as-a-service operation that now uses the patched GlobalProtect flaw as its entry point. Organizations running PAN-OS should apply the fix and audit VPN portals for compromise. - The Hacker News: https://thehackernews.com/2026/07/qilin-ransomware-attackers-exploit-pan.html - BleepingComputer: https://www.bleepingcomputer.com/news/security/critical-globalprotect-vpn-bug-now-exploited-in-ransomware-attacks/ 5. TRUMP ORDERS DEFENSE SUPPLY-CHAIN MAPPING Policy and Regulation · [policy, supply-chain] Latest developments: President Trump signed an executive order directing defense contractors to build end-to-end visibility into critical supply chains, covering software dependencies, foreign ownership, and cyber-related supplier risk, landing as Ars Technica reported that more than one-eighth of apps aimed at U.S. troops carry Chinese and Russian code. The order pushes the defense industrial base toward full software and supplier transparency to root out hidden foreign risk. Contractors face new requirements to inventory dependencies and ownership across their supply chains. - SecurityWeek: https://www.securityweek.com/trump-orders-defense-contractors-to-map-software-suppliers-across-critical-supply-chains/ - Ars Technica Security: https://arstechnica.com/security/2026/07/apps-targeted-at-us-troops-contain-chinese-and-russian-code/ 6. ANUBIS CLAIMS COCA-COLA FAIRLIFE ATTACK Ransomware and Cybercrime · [ransomware, breach] Latest developments: The Anubis ransomware gang publicly claimed the attack that suspended production at the Coca-Cola Company's Fairlife dairy subsidiary and threatened to publish stolen corporate data unless Fairlife pays. Anubis, a ransomware-as-a-service crew that has battered healthcare targets, halted Fairlife dairy production across the United States earlier this month and now moves to extortion by leak threat. - BleepingComputer: https://www.bleepingcomputer.com/news/security/anubis-ransomware-claims-coca-cola-fairlife-attack-threatens-data-leak/ BUSINESS AND POLITICS ---------------------------------------------------------------- * U.S.-Iran War Escalates, Oil Rallies Latest developments: President Trump vowed to strike Iran's Pickaxe Mountain nuclear site, Goldman Sachs warned crude could hit $120 a barrel if the Strait of Hormuz stays disrupted, and Kazakhstan halted oil shipments through the Caspian Pipeline Consortium terminal after Ukrainian tanker attacks. The war between the United States and Iran has closed the Strait of Hormuz on and off for weeks and killed 18 American service members; oil futures rose a third straight session Tuesday, July 21, as Saudi tankers reversed course following Houthi threats to Red Sea shipping. - FT World: https://www.ft.com/content/90facd68-4df7-40c2-9383-e989a02fbe51?syn-25a6b1a6=1 - WSJ Markets: https://www.wsj.com/finance/commodities-futures/oil-edges-lower-amid-hopes-of-new-u-s-iran-ceasefire-892b1c0a?mod=rss_markets_main - FT Markets: https://www.ft.com/content/4b3ad003-07dd-4b82-a9ac-4bf6e7028844?syn-25a6b1a6=1 * Canada, U.S. to Talk to Avert 50% Tariff Latest developments: Prime Minister Mark Carney said he and President Trump agreed to accelerate trade talks to resolve friction and avoid the new 50% U.S. tariff Trump imposed Monday on Canadian goods. Trump slapped an additional 50% tariff on a wide range of Canadian goods Monday, July 20, accusing Ottawa of unfair practices in autos, alcohol, and dairy; a deal in the accelerated talks would head off the levy. - WSJ World News: https://www.wsj.com/world/americas/canadas-carney-says-trump-agrees-to-talks-to-avert-new-50-tariff-c049e9e9 PITTSBURGH ---------------------------------------------------------------- Weather: This Afternoon: Showers And Thunderstorms Likely, high 83F. Tonight: Showers And Thunderstorms Likely, low 64F. Wednesday: Partly Sunny, high 76F. Business: * Humane Animal Rescue Workers to Unionize Latest developments: Union representatives for employees of Humane Animal Rescue of Pittsburgh are entering contract negotiations with management after years of pushback. Workers at Humane Animal Rescue of Pittsburgh, which runs shelters and a wildlife rehabilitation center, voted to unionize and will begin bargaining with management, TribLive reported July 21. - TribLive: https://triblive.com/local/workers-at-humane-animal-rescue-of-pittsburgh-to-unionize-after-years-of-pushback-from-management/ * Gibsonia's Dough Daddy Wins Beer Gold Latest developments: Dough Daddy Brewery in Gibsonia took the gold medal in the pumpkin beer category at the U.S. Open Beer Championships. Dough Daddy Brewery, in Gibsonia, won gold for its pumpkin beer at the U.S. Open Beer Championships, KDKA reported July 21. - KDKA: https://www.cbsnews.com/pittsburgh/video/dough-daddys-winning-pumpkin-beer/ Around town: * Severe Storms Shutter Kennywood and Sandcastle Latest developments: The National Weather Service issued a severe thunderstorm watch through 8 p.m. Tuesday for Allegheny, Beaver, Fayette, Greene, Washington, and Westmoreland counties, and Kennywood, Sandcastle, and Idlewild & Soak Zone closed early at 2 p.m. as damaging winds, hail, and a possible tornado approached. Two waves of strong to severe storms carrying damaging winds, heavy rain, flash flooding, and a tornado threat moved across Western Pennsylvania on Tuesday, July 21. - WTAE: https://www.wtae.com/article/kennywood-closing-thunderstorms/73220015 - KDKA: https://www.cbsnews.com/pittsburgh/news/severe-weather-pittsburgh-area-hail-wind-tornado-threats/ * Pittsburgh Hunts for Its 113th Christmas Tree Latest developments: The Department of Public Works' Forestry Division launched its annual search for the City of Pittsburgh's official Christmas tree, inviting residents to submit evergreens of any variety for the City-County Building display. Pittsburgh sources the tree that stands at the City-County Building each holiday season from local residents; submissions opened this week, five months before Christmas. - Pittsburgh Magazine: https://www.pittsburghmagazine.com/pittsburgh-is-seeking-its-113th-christmas-tree/ - KDKA: https://www.cbsnews.com/pittsburgh/news/pittsburgh-city-hall-christmas-tree-2026/ * Beth Huston Named Deer Lakes Superintendent Latest developments: Beth Huston will lead the Deer Lakes School District as its new superintendent, part of a broader administrative shake-up, TribLive reported July 21. The Deer Lakes School District, serving West Deer, East Deer, Frazer, and Fawn townships in northern Allegheny County, named Beth Huston superintendent amid changes to its administrative team. - TribLive: https://triblive.com/local/valley-news-dispatch/beth-huston-to-lead-deer-lakes-as-new-superintendent/ Events: * OpenStreetsPgh Closes Strip, Lawrenceville to Cars Latest developments: OpenStreetsPgh holds its final 2026 event Sunday, July 26, turning three miles of the Strip District and Lawrenceville into car-free public space. OpenStreetsPgh, which opens city streets for walking, biking, and community activities, clears three miles through the Strip District and Lawrenceville of traffic on Sunday, July 26; the event is free and open to all. - WPXI: https://www.wpxi.com/news/local/openstreetspgh-holding-its-final-event-year-strip-district-lawrenceville/CDII6DUBPBEGVO65IMMZZETKGM/ SPORTS ---------------------------------------------------------------- Pirates (52-49) Mon Jul 20 · Pirates 5 · Yankees 8 · Final Jazz Chisholm Jr. homers twice and drives in 5 as Yankees sink Pirates 8-5 after benches clear https://plaintextsports.com/mlb/2026-07-20/pit-nyy Tue Jul 21 · Pirates @ Yankees · Postponed https://plaintextsports.com/mlb/2026-07-21/pit-nyy Up Next · Pirates @ Yankees · Wed Jul 22, 1:05 PM https://plaintextsports.com/mlb/2026-07-22/pit-nyy Around the Teams: * Benches Clear in Pirates-Yankees Opener Latest developments: Pirates reliever Dennis Santana explained why tempers flared and both benches cleared during the loss at Yankee Stadium, pointing to a confrontation involving the Yankees' José Caballero. The Post-Gazette reported July 21 on the bench-clearing dust-up in the Pirates-Yankees series opener in New York, with reliever Dennis Santana detailing what set it off. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/07/21/mlb-pirates-yankees-altercation-dennis-santana-jose-caballero-new-york/stories/202607200058 * Steelers Bank on Zach Frazier at Center Latest developments: The Post-Gazette's training-camp countdown asked whether center Zach Frazier can follow the Steelers' line of great centers as camp opens at Saint Vincent College. The July 20 countdown cast second-year center Zach Frazier as an anchor of the Steelers' offensive line under coach Mike McCarthy. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/07/20/training-camp-countdown-zach-frazier-center-offensive-lineman/stories/202607200003 * 'Future Yankee' Talk Trails Paul Skenes Latest developments: The Post-Gazette's Off The Bat column revisited speculation about ace Paul Skenes' future after a 'future Yankee' comment resurfaced during the Yankees series. The column weighed whether the small-market Pirates can keep two-time All-Star Paul Skenes long term amid recurring talk he could eventually land with a big-market club. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/07/20/paul-skenes-all-star-pirates-yankees/stories/202607180027 Team USA: * U.S. Eyes Hosting the World Cup Again in 2038 Latest developments: With the 2026 World Cup across the United States, Canada, and Mexico now finished, the Guardian reported an American bid for the 2038 tournament is gaining traction, spurred by President Trump urging FIFA's Gianni Infantino to bring it back while he is still around. Booming ticketing and hospitality revenue from the 2026 tournament, plus FIFA's drive to recoup lost television income, make another United States hosting run plausible for 2038. - Guardian World Cup 2026: https://www.theguardian.com/football/2026/jul/21/world-cup-back-usa-2038-donald-trump-fifa-football READING ---------------------------------------------------------------- * Stratechery -- Netflix Earnings, Is Netflix Washed?, Additional Notes Ben Thompson reads Netflix's fine-but-unexciting earnings as the mark of a mature company whose most thrilling growth days are likely behind it. https://stratechery.com/2026/netflix-earnings-is-netflix-washed-additional-notes/ * Ed Zitron -- The OpenAI Bubble Zitron argues OpenAI's finances rest on unsustainable spending and hype, making it the center of an AI bubble he expects to deflate. https://www.wheresyoured.at/the-openai-bubble/ * Cal Newport -- Why Reading Matters Responding to an Atlantic piece declaring reading dead, Newport defends deep reading as essential cognitive training that skimming and AI summaries cannot replace. https://calnewport.com/why-reading-matters/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,510.15 ▼ -0.2% Dow 52,341.11 ▼ -0.5% Nasdaq 25,857.30 ▼ -0.6% WTI crude 80.72 ▲ +10.4% EUR/USD 1.1430 ▲ +0.1% GBP/USD 1.3442 ▲ +0.4% USD/JPY 162.32 = +0.0% ================================================================ Generated 2026-07-21 16:05 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================