================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Wednesday, July 22, 2026 - 9:06 PM EDT ================================================================ Federal agencies flagged a fourth exploited SharePoint flaw for urgent patching as attackers turned trusted AI tools and a 314-million-install browser extension into fresh paths into corporate networks. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Attackers are weaving AI into operations, from Sandworm_Mode malware hiding in Azure DevOps developer tools to an OpenAI agent that accidentally breached Hugging Face. see: Attackers Live Off the AI Toolchain; OpenAI Hacks Hugging Face, What Happened, Alignment and Paper Clips * [UPDATE (new)] CISA added the fourth SharePoint bug CVE-2026-50522 to its exploited catalog after watchTowr caught attackers stealing IIS machine keys to survive patching. see: Fourth SharePoint Flaw CVE-2026-50522 Hits CISA's Exploited List * [UPDATE (new)] A now-patched Adobe Acrobat Chrome extension flaw across 314 million installs let any website silently read a victim's WhatsApp Web messages. see: Adobe Acrobat Extension Flaw Exposed WhatsApp Web Data * [UPDATE (new)] Fresh breaches surfaced as hackers leaked Suno and Chick-fil-A customer data while intruders spent ten months inside South Korea's diplomatic academy exposing overseas diplomats. see: Suno, Chick-fil-A, and Upbound Breaches Surface; South Korea Diplomatic Academy Breach Exposes Diplomats * [TREND] Trump threatened to bomb Iran's bridges and power plants over ship attacks and approved a Saudi Arabia civil nuclear pact that could allow uranium enrichment. see: Trump Threatens to Bomb Iran's Bridges and Power Plants; U.S. and Saudi Arabia Seal Nuclear Pact That Could Allow Enrichment * [UPDATE (new)] Locally, PennDOT will reopen the Parkway East by mid-next week while Pittsburgh City Council splits over a Downtown tax-diversion plan. see: Parkway East to Reopen by Mid-Next Week; Downtown Tax-Diversion Plan Splits City Council SECURITY ---------------------------------------------------------------- 1. FOURTH SHAREPOINT FLAW CVE-2026-50522 HITS CISA'S EXPLOITED LIST Vulnerabilities and Exploits · [zero-day, patch, exploit] Latest developments: CISA added CVE-2026-50522 and Check Point SmartConsole flaw CVE-2026-16232 to its Known Exploited Vulnerabilities catalog on July 22, 2026, after watchTowr's honeypots caught attackers stealing IIS machine keys through the SharePoint bug once public exploit code appeared. CVE-2026-50522 marks the fourth Microsoft SharePoint deserialization flaw attackers have exploited in a month. They run code on on-premises servers and lift the IIS machine keys that preserve access after a patch, so administrators must patch and rotate those keys. - CISA Advisories: https://www.cisa.gov/news-events/alerts/2026/07/22/cisa-adds-two-known-exploited-vulnerabilities-catalog - Help Net Security: https://www.helpnetsecurity.com/2026/07/22/sharepoint-cve-2026-50522-exploited/ - SecurityWeek: https://www.securityweek.com/fourth-sharepoint-vulnerability-exploited-in-past-months-wave-of-attacks/ 2. ADOBE ACROBAT EXTENSION FLAW EXPOSED WHATSAPP WEB DATA Vulnerabilities and Exploits · [vulnerability, patch] Latest developments: Guardio Labs disclosed HermeticReader, tracked as CVE-2026-48294, a now-patched flaw chain in the Adobe Acrobat Chrome extension and its 314 million installs that let any malicious website silently read a victim's WhatsApp Web messages and contacts. A user only had to visit a booby-trapped page for an attacker to exfiltrate WhatsApp Web chats and contacts through the Adobe extension. Adobe has patched the flaw, and users should update the extension. - The Hacker News: https://thehackernews.com/2026/07/adobe-acrobat-extension-flaw-let.html - SecurityWeek: https://www.securityweek.com/flaw-in-adobe-extension-with-300m-installs-enabled-whatsapp-data-theft/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/adobe-chrome-extension-flaw-let-sites-access-private-whatsapp-chats/ 3. ATTACKERS LIVE OFF THE AI TOOLCHAIN AI Security · [ai, prompt-injection] Latest developments: Dark Reading detailed Sandworm_Mode, malware that hides inside trusted AI tools and workflows so its actions resemble ordinary developer activity, as researchers disclosed a flaw in Microsoft's official Azure DevOps MCP server that lets one invisible pull-request comment hijack a reviewer's AI coding agent. Attackers increasingly abuse the AI development toolchain itself—coding agents, MCP servers, and generated code. Analysis of vibe-coded applications turned up 434 exploitable flaws, and the trend erases the line between malicious steps and normal automation, so teams need least-privilege controls on every agent. - Dark Reading: https://www.darkreading.com/cyber-risk/attackers-live-off-ai-toolchain - The Hacker News: https://thehackernews.com/2026/07/microsoft-azure-devops-mcp-flaw-lets.html - SecurityWeek: https://www.securityweek.com/vibe-coded-apps-riddled-with-exploitable-security-flaws/ 4. SUNO, CHICK-FIL-A, AND UPBOUND BREACHES SURFACE Data Breaches · [breach, credential-stuffing] Latest developments: SecurityWeek reported hackers leaked names, emails, phone numbers, passwords, and financial data pulled from AI music generator Suno and rewards platform Paidwork, hitting tens of millions of accounts, while Chick-fil-A began notifying customers whose accounts fell to credential-stuffing and Upbound Group said thieves turned stolen data into $13 million in fraudulent Acima leases. Four consumer and fintech brands disclosed intrusions the same day. Affected users should reset reused passwords, watch for fraud, and turn on multi-factor authentication. - SecurityWeek: https://www.securityweek.com/suno-paidwork-data-breaches-affect-tens-of-millions-of-accounts/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/chick-fil-a-discloses-data-breach-after-credential-stuffing-attacks/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/upbound-says-hack-caused-13-million-in-fraudulent-acima-leases/ 5. CISA 2015 RENEWAL AND FRANCE'S UNDER-15 SOCIAL MEDIA BAN Policy and Regulation · [policy] Latest developments: The US House folded a 10-year renewal of the CISA 2015 cyber information-sharing law into its fiscal 2027 defense authorization bill, France's Parliament voted to bar children under 15 from social media, and the Justice Department's Operation Offsides seized more than 1,000 domains that streamed FIFA World Cup 2026 matches without a license. Lawmakers and prosecutors moved on three fronts—liability protections for sharing threat data, youth online safety, and piracy enforcement. The CISA 2015 renewal restores the legal cover companies rely on to exchange threat indicators with the government. - The Record: https://therecord.media/cisa-2015-extension-passes-house-ndaa - The Record: https://therecord.media/france-social-media-ban-parliament - Help Net Security: https://www.helpnetsecurity.com/2026/07/22/world-cup-2026-illegal-stream-domains-seized/ 6. SOUTH KOREA DIPLOMATIC ACADEMY BREACH EXPOSES DIPLOMATS Nation-State Activity · [breach, apt] Latest developments: South Korea disclosed that intruders spent ten months inside the National Diplomatic Academy's online education system and stole personal data on current and former Ministry of Foreign Affairs staff, including diplomats posted overseas. The breach exposed a sensitive roster of South Korean foreign-service personnel worldwide, a prime target for espionage. Affected diplomats face heightened phishing and impersonation risk. - BleepingComputer: https://www.bleepingcomputer.com/news/security/south-korea-discloses-data-breach-impacting-diplomats-worldwide/ BUSINESS AND POLITICS ---------------------------------------------------------------- * Trump Threatens to Bomb Iran's Bridges and Power Plants Latest developments: Trump announced July 22 that the United States will strike Iranian bridges and power plants for every Iranian attack on a ship, surged troops, medics, and weaponry toward the Middle East, and paid respects at Dover to four service members killed in recent attacks. The war between the United States and Iran centers on control of the Strait of Hormuz; Trump's retaliatory policy and force buildup signal a planned escalation, and the House passed a Republican-only $95 billion package to fund the fight. - WSJ World News: https://www.wsj.com/world/middle-east/u-s-surges-forces-toward-middle-east-giving-trump-options-to-expand-iran-war-e5d627b1 - WSJ World News: https://www.wsj.com/world/middle-east/trump-says-u-s-will-bomb-irans-power-plants-bridges-if-tehran-strikes-ships-7db7e165 - FT World: https://www.ft.com/content/755c218f-40db-4a8a-8e0b-acd2ccee3d3d?syn-25a6b1a6=1 * U.S. and Saudi Arabia Seal Nuclear Pact That Could Allow Enrichment Latest developments: Trump approved a landmark civil nuclear cooperation agreement with Saudi Arabia on July 22, terms that could hand the kingdom uranium-enrichment capability and drew warnings the deal lacks proliferation safeguards. The agreement promises large profits for American nuclear firms, and critics—including a Wall Street Journal editorial—warn its missing enrichment and reprocessing controls risk spreading nuclear weapons capability across the Middle East. - WSJ World News: https://www.wsj.com/world/middle-east/trump-approves-landmark-nuclear-deal-with-saudi-arabia-in-big-win-for-kingdom-2ed77584 - FT World: https://www.ft.com/content/2707aeb6-dba0-4640-877b-4839d268c820?syn-25a6b1a6=1 * Treasury Selloff Drives Yields Toward 2026 Highs Latest developments: A government-bond selloff pushed the 2-year Treasury yield to its highest level in more than a year on July 22 and lifted the 10-year yield close to its 2026 high, tightening financial conditions as oil climbs. Rising yields raise borrowing costs for consumers and companies and pressure equities; the move comes as elevated bond yields across major economies and Middle East supply fears reshape the rate outlook. - WSJ Markets: https://www.wsj.com/finance/investing/jgb-futures-fall-tracking-declines-in-u-s-treasury-market-54cd45d8?mod=rss_markets_main - WSJ Markets: https://www.wsj.com/finance/investing/what-surging-bond-yields-mean-for-consumers-and-markets-cb37b61f?mod=rss_markets_main PITTSBURGH ---------------------------------------------------------------- Weather: Tonight: Mostly Clear then Areas Of Fog, low 53F. Thursday: Areas Of Fog then Sunny, high 78F. Thursday Night: Mostly Clear, low 56F. Business: * WVU Medicine Settles DEA Narcotics Case for $4.17 Million Latest developments: West Virginia University Health System agreed to pay $4.17 million to settle a U.S. Department of Justice civil case over controlled-substance oversight failures at several registered facilities, TribLive reported July 22. The system, which recently struck a deal to acquire the five-hospital Independence Health System serving Westmoreland and Butler counties, resolved allegations of lax narcotics recordkeeping across multiple sites. - TribLive: https://triblive.com/local/westmoreland/wvu-medicine-to-pay-4-17m-in-dea-settlement-over-narcotics-oversight/ * State Grant to Restore Etna's Union Hotel Latest developments: A $500,000 state grant will help upgrade the historic Union Hotel in the heart of Etna, TribLive reported July 22. The community redevelopment award funds restoration of the long-standing Union Hotel building in Etna, the borough along Pine Creek just north of Pittsburgh. - TribLive: https://triblive.com/local/community-redevelopment-grant-to-aid-in-restoration-of-etnas-historic-union-hotel/ Around town: * Parkway East to Reopen by Mid-Next Week Latest developments: PennDOT now expects to reopen the Parkway East by the middle of next week after crews slid the new Commercial Street Bridge into place ahead of schedule, and Transportation Secretary Mike Carroll called the swap a "stunning achievement" on July 22. The Commercial Street Bridge replacement outside the Squirrel Hill Tunnel closed the Parkway East for a project first set to run 25 days with an August 3 reopening; the accelerated pace moves that up. - KDKA: https://www.cbsnews.com/pittsburgh/news/penndot-parkway-east-opening-commercial-street-bridge/ - WTAE: https://www.wtae.com/article/commercial-street-bridge-project-update-pittsburgh/73229083 * Downtown Tax-Diversion Plan Splits City Council Latest developments: Pittsburgh City Council split sharply July 22 over a proposal to divert future tax revenue to Downtown redevelopment and transit projects, advancing the multimillion-dollar plan even as resident backlash and opposition persist. The tax-increment plan, a TRID, would channel future revenue into Downtown Pittsburgh revitalization and transit work; council members remain divided as residents object to the diversion. - TribLive: https://triblive.com/local/deep-fissures-split-pittsburgh-officials-over-proposed-downtown-tax-diversion/ - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/politics-local/2026/07/22/downtown-pittsburgh-trid-redevelopment-bond-issue/stories/202607220066 * New Brentwood Elementary Opening Delayed Latest developments: The new Brentwood Elementary School will not be ready for the coming school year, delayed by weather and a labor shortage, WPXI reported July 22. Brentwood Borough, south of Pittsburgh, built the new elementary building expecting to open it for 2026-27, but construction setbacks pushed the timeline back. - WPXI: https://www.wpxi.com/news/local/new-brentwood-elementary-schools-opening-delayed/KXPLARRAZFHHFODCP5KOQ3T44Q/ Events: * Sharif Bey 'Homecoming' at the Andy Warhol Museum Latest developments: The Andy Warhol Museum is showing "Homecoming," an exhibition bringing celebrated ceramic sculptor Sharif Bey back to Pittsburgh, where his career began, the Post-Gazette reported July 22. "Homecoming" gathers work by Sharif Bey, a sculptor who came up in Pittsburgh, at the Andy Warhol Museum on the North Shore. - Post-Gazette Arts & Entertainment: https://www.post-gazette.com/ae/art-architecture/2026/07/22/sharif-bey-homecoming-andy-warhol-museum/stories/202607150038 * Trundle Manor Shows Its Oddities in Swissvale Latest developments: The Post-Gazette's off-the-beaten-path feature July 20 spotlighted Trundle Manor, a macabre house of curiosities in Swissvale. Trundle Manor, a private museum in Swissvale run by its collectors, displays a weird, quirky trove of oddities open to visitors. - Post-Gazette Arts & Entertainment: https://www.post-gazette.com/ae/2026/07/20/trundle-manor-museum-swissvale/stories/202607190074 SPORTS ---------------------------------------------------------------- Pirates (53-49) Tue Jul 21 · Pirates @ Yankees · Postponed https://plaintextsports.com/mlb/2026-07-21/pit-nyy Wed Jul 22 · Pirates 5 · Yankees 3 · Final (10) https://plaintextsports.com/mlb/2026-07-22/pit-nyy Wed Jul 22 · Pirates 0 · Yankees 2 · Bot 7th (in progress at last update) https://plaintextsports.com/mlb/2026-07-22/pit-nyy Up Next · Cubs @ Pirates · Fri Jul 24, 6:40 PM https://plaintextsports.com/mlb/2026-07-24/chc-pit Around the Teams: * Debating T.J. Watt's Trade Value Latest developments: A Post-Gazette video segment July 22 asked whether Steelers edge rusher T.J. Watt would still command a first-round pick in a trade, weighing the rumors swirling around the star pass rusher. The discussion turns on Watt, the Steelers' All-Pro outside linebacker, and whether his age or contract have cooled the market for him as offseason speculation continues. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/07/22/nfl-news-rumors-tj-watt-trade-rumors/stories/202607220042 * Hiles Urges Pirates to Buy at the Deadline Latest developments: Post-Gazette columnist Noah Hiles argued July 22 that the Pirates should keep their promises and "push chips in" at the trade deadline, pressing general manager Ben Cherington and owner Bob Nutting to add talent now. With the Pirates clinging to wild-card hopes, Hiles called for win-now moves, a shift from his earlier stance that the club hold onto Oneil Cruz. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/07/22/hiles-column-cherington-nutting-mlb-trade-deadline/stories/202607220006 * Rookies Keep the Pirates' Playoff Hopes Alive Latest developments: The Post-Gazette detailed July 22 how rookies, including outfielder Esmerlyn Valdez and Billy Cook, have propped up a Pirates lineup gutted by injuries and kept the postseason push going. Injuries thinned the Pirates roster; young players stepping into everyday roles have sustained the club's wild-card chase through the summer. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/07/22/pirates-rookies-valdez-griffin-cook-callihan/stories/202607220038 READING ---------------------------------------------------------------- * Ed Zitron -- The Subprime Data Center Crisis Zitron argues the debt-fueled buildout of AI data centers resembles a subprime bubble, with shaky financing and questionable returns setting up a reckoning. https://www.wheresyoured.at/the-subprime-data-center-crisis/ * Stratechery -- OpenAI Hacks Hugging Face, What Happened, Alignment and Paper Clips Ben Thompson unpacks how an OpenAI agent accidentally breached Hugging Face and argues the incident's alignment lessons are more reassuring than the alarmed reaction suggests. https://stratechery.com/2026/openai-hacks-hugging-face-what-happened-alignment-and-paper-clips/ * Cal Newport -- Why Reading Matters Responding to an Atlantic piece declaring reading dead, Newport defends deep reading as essential to serious thinking and warns against surrendering it. https://calnewport.com/why-reading-matters/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,488.58 ▼ -0.8% Dow 52,196.37 ▼ -0.7% Nasdaq 25,687.67 ▼ -1.8% WTI crude 81.84 ▲ +9.3% EUR/USD 1.1433 ▲ +0.2% GBP/USD 1.3455 ▲ +0.5% USD/JPY 162.53 ▲ +0.2% ================================================================ Generated 2026-07-22 21:06 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================