daily plain-text briefing: security, markets, business, and pittsburgh
Federal agencies flagged a fourth exploited SharePoint flaw for urgent patching as attackers turned trusted AI tools and a 314-million-install browser extension into fresh paths into corporate networks.
Latest developments: CISA added CVE-2026-50522 and Check Point SmartConsole flaw CVE-2026-16232 to its Known Exploited Vulnerabilities catalog on July 22, 2026, after watchTowr's honeypots caught attackers stealing IIS machine keys through the SharePoint bug once public exploit code appeared.
CVE-2026-50522 marks the fourth Microsoft SharePoint deserialization flaw attackers have exploited in a month. They run code on on-premises servers and lift the IIS machine keys that preserve access after a patch, so administrators must patch and rotate those keys.
Sources: CISA Advisories · Help Net Security · SecurityWeek · ↑ top
Latest developments: Guardio Labs disclosed HermeticReader, tracked as CVE-2026-48294, a now-patched flaw chain in the Adobe Acrobat Chrome extension and its 314 million installs that let any malicious website silently read a victim's WhatsApp Web messages and contacts.
A user only had to visit a booby-trapped page for an attacker to exfiltrate WhatsApp Web chats and contacts through the Adobe extension. Adobe has patched the flaw, and users should update the extension.
Sources: The Hacker News · SecurityWeek · BleepingComputer · ↑ top
Latest developments: Dark Reading detailed Sandworm_Mode, malware that hides inside trusted AI tools and workflows so its actions resemble ordinary developer activity, as researchers disclosed a flaw in Microsoft's official Azure DevOps MCP server that lets one invisible pull-request comment hijack a reviewer's AI coding agent.
Attackers increasingly abuse the AI development toolchain itself—coding agents, MCP servers, and generated code. Analysis of vibe-coded applications turned up 434 exploitable flaws, and the trend erases the line between malicious steps and normal automation, so teams need least-privilege controls on every agent.
Sources: Dark Reading · The Hacker News · SecurityWeek · ↑ top
Latest developments: SecurityWeek reported hackers leaked names, emails, phone numbers, passwords, and financial data pulled from AI music generator Suno and rewards platform Paidwork, hitting tens of millions of accounts, while Chick-fil-A began notifying customers whose accounts fell to credential-stuffing and Upbound Group said thieves turned stolen data into $13 million in fraudulent Acima leases.
Four consumer and fintech brands disclosed intrusions the same day. Affected users should reset reused passwords, watch for fraud, and turn on multi-factor authentication.
Sources: SecurityWeek · BleepingComputer · BleepingComputer · ↑ top
Latest developments: The US House folded a 10-year renewal of the CISA 2015 cyber information-sharing law into its fiscal 2027 defense authorization bill, France's Parliament voted to bar children under 15 from social media, and the Justice Department's Operation Offsides seized more than 1,000 domains that streamed FIFA World Cup 2026 matches without a license.
Lawmakers and prosecutors moved on three fronts—liability protections for sharing threat data, youth online safety, and piracy enforcement. The CISA 2015 renewal restores the legal cover companies rely on to exchange threat indicators with the government.
Sources: The Record · The Record · Help Net Security · ↑ top
Latest developments: South Korea disclosed that intruders spent ten months inside the National Diplomatic Academy's online education system and stole personal data on current and former Ministry of Foreign Affairs staff, including diplomats posted overseas.
The breach exposed a sensitive roster of South Korean foreign-service personnel worldwide, a prime target for espionage. Affected diplomats face heightened phishing and impersonation risk.
Sources: BleepingComputer · ↑ top
Latest developments: Trump announced July 22 that the United States will strike Iranian bridges and power plants for every Iranian attack on a ship, surged troops, medics, and weaponry toward the Middle East, and paid respects at Dover to four service members killed in recent attacks.
The war between the United States and Iran centers on control of the Strait of Hormuz; Trump's retaliatory policy and force buildup signal a planned escalation, and the House passed a Republican-only $95 billion package to fund the fight.
Sources: WSJ World News · WSJ World News · FT World · ↑ top
Latest developments: Trump approved a landmark civil nuclear cooperation agreement with Saudi Arabia on July 22, terms that could hand the kingdom uranium-enrichment capability and drew warnings the deal lacks proliferation safeguards.
The agreement promises large profits for American nuclear firms, and critics—including a Wall Street Journal editorial—warn its missing enrichment and reprocessing controls risk spreading nuclear weapons capability across the Middle East.
Sources: WSJ World News · FT World · ↑ top
Latest developments: A government-bond selloff pushed the 2-year Treasury yield to its highest level in more than a year on July 22 and lifted the 10-year yield close to its 2026 high, tightening financial conditions as oil climbs.
Rising yields raise borrowing costs for consumers and companies and pressure equities; the move comes as elevated bond yields across major economies and Middle East supply fears reshape the rate outlook.
Sources: WSJ Markets · WSJ Markets · ↑ top
Tonight: Mostly Clear then Areas Of Fog, low 53F.
Thursday: Areas Of Fog then Sunny, high 78F.
Thursday Night: Mostly Clear, low 56F.
Latest developments: West Virginia University Health System agreed to pay $4.17 million to settle a U.S. Department of Justice civil case over controlled-substance oversight failures at several registered facilities, TribLive reported July 22.
The system, which recently struck a deal to acquire the five-hospital Independence Health System serving Westmoreland and Butler counties, resolved allegations of lax narcotics recordkeeping across multiple sites.
Latest developments: A $500,000 state grant will help upgrade the historic Union Hotel in the heart of Etna, TribLive reported July 22.
The community redevelopment award funds restoration of the long-standing Union Hotel building in Etna, the borough along Pine Creek just north of Pittsburgh.
Latest developments: PennDOT now expects to reopen the Parkway East by the middle of next week after crews slid the new Commercial Street Bridge into place ahead of schedule, and Transportation Secretary Mike Carroll called the swap a "stunning achievement" on July 22.
The Commercial Street Bridge replacement outside the Squirrel Hill Tunnel closed the Parkway East for a project first set to run 25 days with an August 3 reopening; the accelerated pace moves that up.
Latest developments: Pittsburgh City Council split sharply July 22 over a proposal to divert future tax revenue to Downtown redevelopment and transit projects, advancing the multimillion-dollar plan even as resident backlash and opposition persist.
The tax-increment plan, a TRID, would channel future revenue into Downtown Pittsburgh revitalization and transit work; council members remain divided as residents object to the diversion.
Sources: TribLive · Pittsburgh Post-Gazette · ↑ top
Latest developments: The new Brentwood Elementary School will not be ready for the coming school year, delayed by weather and a labor shortage, WPXI reported July 22.
Brentwood Borough, south of Pittsburgh, built the new elementary building expecting to open it for 2026-27, but construction setbacks pushed the timeline back.
Latest developments: The Andy Warhol Museum is showing "Homecoming," an exhibition bringing celebrated ceramic sculptor Sharif Bey back to Pittsburgh, where his career began, the Post-Gazette reported July 22.
"Homecoming" gathers work by Sharif Bey, a sculptor who came up in Pittsburgh, at the Andy Warhol Museum on the North Shore.
Sources: Post-Gazette Arts & Entertainment · ↑ top
Latest developments: The Post-Gazette's off-the-beaten-path feature July 20 spotlighted Trundle Manor, a macabre house of curiosities in Swissvale.
Trundle Manor, a private museum in Swissvale run by its collectors, displays a weird, quirky trove of oddities open to visitors.
Sources: Post-Gazette Arts & Entertainment · ↑ top
Pirates (53-49)
Tue Jul 21 · Pirates @ Yankees · Postponed
Wed Jul 22 · Pirates 5 · Yankees 3 · Final (10)
Wed Jul 22 · Pirates 0 · Yankees 2 · Bot 7th (in progress at last update)
Up Next · Cubs @ Pirates · Fri Jul 24, 6:40 PM
Latest developments: A Post-Gazette video segment July 22 asked whether Steelers edge rusher T.J. Watt would still command a first-round pick in a trade, weighing the rumors swirling around the star pass rusher.
The discussion turns on Watt, the Steelers' All-Pro outside linebacker, and whether his age or contract have cooled the market for him as offseason speculation continues.
Sources: Post-Gazette Steelers · ↑ top
Latest developments: Post-Gazette columnist Noah Hiles argued July 22 that the Pirates should keep their promises and "push chips in" at the trade deadline, pressing general manager Ben Cherington and owner Bob Nutting to add talent now.
With the Pirates clinging to wild-card hopes, Hiles called for win-now moves, a shift from his earlier stance that the club hold onto Oneil Cruz.
Sources: Post-Gazette Pirates · ↑ top
Latest developments: The Post-Gazette detailed July 22 how rookies, including outfielder Esmerlyn Valdez and Billy Cook, have propped up a Pirates lineup gutted by injuries and kept the postseason push going.
Injuries thinned the Pirates roster; young players stepping into everyday roles have sustained the club's wild-card chase through the summer.
Sources: Post-Gazette Pirates · ↑ top
S&P 500 7,488.58 ▼ -0.8% Dow 52,196.37 ▼ -0.7% Nasdaq 25,687.67 ▼ -1.8% WTI crude 81.84 ▲ +9.3% EUR/USD 1.1433 ▲ +0.2% GBP/USD 1.3455 ▲ +0.5% USD/JPY 162.53 ▲ +0.2%