daily plain-text briefing: security, markets, business, and pittsburgh
Autonomous AI agents crossed into the vulnerability pipeline this week, mining Redis and NodeBB for fresh zero-days, as a public Certighost exploit handed any low-privileged user the keys to Active Directory.
Latest developments: Redis shipped seven security releases July 23 after Kimi K3 agents found memory-corruption zero-days and built authenticated remote-code-execution exploits spanning stock Redis 6.2.22 through 8.8.0, while Aikido Security's AI pentest agents surfaced eight high-severity NodeBB flaws in a six-hour code review and Google previewed CodeMender, an agent that confirms exploitable bugs and writes the patch.
Autonomous agents now scan source code, prove exploitability, and in Google's case propose fixes, compressing the disclosure cycle; Redis operators should move to 6.2.23, 7.2.15, or 7.4.10, and NodeBB administrators to 4.14.2.
Sources: The Hacker News · The Hacker News · Help Net Security · ↑ top
Latest developments: The Clop gang launched a data-theft extortion campaign against Internet-exposed PTC Windchill and FlexPLM product-lifecycle-management instances, the same week Black Kite counted 61 new ransomware groups entering the market between April 2025 and March 2026.
Clop, which built its name on mass data theft through enterprise file-transfer and PLM software, steals data and threatens to leak it rather than encrypt; organizations running PTC Windchill or FlexPLM should pull the systems off the public Internet and patch.
Sources: BleepingComputer · Help Net Security · ↑ top
Latest developments: Origin Energy confirmed that an intruder accessed and then leaked customer data online, and the hacker claims to hold personal information on 2 million Origin customers with a threat to publish the rest.
Origin Energy, one of Australia's largest electricity and gas retailers, exposed customer personally identifiable information; affected customers should watch for fraud and phishing tied to their account details.
Sources: SecurityWeek · BleepingComputer · ↑ top
Latest developments: Ukraine's CERT-UA warned that the Russia-aligned UAC-0099 cluster now ships an archive bundling the genuine Notepad++ editor with LunchPoke, a malicious utility disguised as a plugin that establishes persistence and delivers the MATCHBOIL.V2 backdoor.
UAC-0099, a group that previously weaponized WinRAR flaws against Ukrainian targets, uses trusted software as cover; defenders should flag Notepad++ archives from untrusted sources and hunt for LunchPoke persistence.
Sources: The Hacker News · BleepingComputer · ↑ top
Latest developments: Researchers H0j3n and Aniq Fakhrul published a working July 24 exploit that lets a low-privileged Active Directory user request a certificate for a Domain Controller, authenticate as that machine, and run DCSync to pull the krbtgt secret.
Certighost turns an ordinary domain account into full domain compromise because Domain Controller accounts carry directory replication rights; administrators running Active Directory Certificate Services should restrict enrollment and audit certificate templates immediately.
Sources: The Hacker News · ↑ top
Latest developments: Dark Reading detailed a public-by-default configuration and a chain of code flaws in Microsoft Azure Automation that let an attacker seize another tenant's identity and reach that tenant's data, credentials, and cloud workloads, which Microsoft has since fixed.
Azure Automation, the service enterprises use to run scheduled scripts and manage cloud resources, shipped with a setting that exposed accounts across tenant boundaries; Microsoft closed the hole, and customers should review Automation account permissions.
Sources: Dark Reading · ↑ top
Latest developments: Trump said Thursday he may intensify operations as U.S. airstrikes reached their 13th straight night, and a senior administration official described him as skeptical of diplomacy and in "revenge mode" against Tehran.
The U.S.-Iran war has ground into its fifth month with no end in sight, frustrating President Trump, who once expected a conflict of weeks; the fighting keeps oil markets and the Strait of Hormuz on edge as drones strike near American forces in the region.
Sources: WSJ Politics · ↑ top
Latest developments: The new 10% duties on 60 trading partners took effect, now covering roughly 99% of U.S. imports while exempting oil, gas, and fertilizer, after the Supreme Court struck down Trump's earlier blanket levies.
President Trump reimposed double-digit tariffs on 60 countries, pinning them to a forced-labor enforcement rationale to survive legal challenges; the Financial Times reports the move shifts his trade war from shakedown to lock-in, sparing Europe while hitting Brazil hard.
Sources: FT World · FT World · ↑ top
This Afternoon: Mostly Cloudy, high 83F.
Tonight: Mostly Cloudy then Slight Chance Rain Showers, low 64F.
Saturday: Slight Chance Rain Showers then Slight Chance Showers And Thunderstorms, high 84F.
Latest developments: Pittsburgh's largest foundation announced it has surpassed its plan to award more than $1 billion in grants and program-related investments three years ahead of schedule.
The Richard King Mellon Foundation, the region's biggest philanthropy, blew past the $1 billion giving target set in its multiyear strategic plan, WPXI reported.
Latest developments: Aurora Innovation rolled out second-generation hardware that removes the safety observer from the cab, returning fully driverless trucks to roads across the Sun Belt.
Aurora Innovation, the Pittsburgh-based autonomous-trucking company, debuted upgraded self-driving hardware and resumed running trucks with no human aboard, WPXI reported.
Latest developments: The FDA disclosed a separate cyclospora outbreak from an as-yet-unidentified product and launched a traceback, as North Carolina investigators probe cilantro and parsley.
Days after federal officials tied an earlier cyclosporiasis outbreak to central-Mexico iceberg lettuce, the U.S. Food and Drug Administration said Thursday it is hunting a new outbreak whose source it has not pinned down, KDKA reported.
Latest developments: Madison Wiltrout, a Connellsville High School graduate, captured her first U.S. javelin championship.
Madison Wiltrout, who grew up in Connellsville, Fayette County, won the women's javelin at the U.S. track and field championships, advancing her Olympic ambitions, the Post-Gazette reported.
Sources: Pittsburgh Post-Gazette · ↑ top
Latest developments: The Warhol will hold a free ADA-anniversary celebration this Sunday, July 26.
The Andy Warhol Museum on the North Shore hosts a free National Disability Independence Day celebration Sunday, July 26, from 10:30 a.m. to 3 p.m., marking the 36th anniversary of the Americans with Disabilities Act, with hands-on art-making open to everyone.
Sources: Pittsburgh Magazine · ↑ top
Latest developments: This weekend, July 24 through 26, brings GoatFest, the DanceAfrica celebration, and OpenStreetsPGH.
NEXTpittsburgh's weekend guide for July 23-26 spotlights GoatFest, the DanceAfrica dance celebration, and OpenStreetsPGH, which opens city streets to walkers and cyclists.
Sources: NEXTpittsburgh Events · ↑ top
Pirates (53-50)
Up Next · Cubs @ Pirates · Fri Jul 24, 6:40 PM
Latest developments: The Post-Gazette laid out its camp storylines: Mike McCarthy's first camp as head coach and an open quarterback competition featuring Will Howard and Drew Allar.
Steelers training camp opens next week under new head coach Mike McCarthy, who inherits a quarterback battle involving Will Howard and Drew Allar and a defense in transition, the Post-Gazette wrote.
Sources: Post-Gazette Steelers · ↑ top
Latest developments: A Post-Gazette camp countdown framed Joey Porter Jr.'s push for a top-of-market extension and elite-cornerback status as a defining Steelers subplot.
Steelers cornerback Joey Porter Jr. is chasing a lucrative extension and aiming to cement himself among the NFL's best corners as his contract talks drag on, the Post-Gazette reported.
Sources: Post-Gazette Steelers · ↑ top
Latest developments: Beatriz Hatz, the "Love Island" Season 8 alum, won the T64 long jump national title at the USATF championships.
Beatriz Hatz, a U.S. Paralympic long jumper who appeared on "Love Island," captured the T64 long jump crown at the USA Track and Field national championships, ESPN reported.
Sources: ESPN Olympics · ↑ top
S&P 500 7,463.49 ▼ -1.1% Dow 52,028.11 ▼ -1.0% Nasdaq 25,538.82 ▼ -2.1% WTI crude 85.93 ▲ +10.9% EUR/USD 1.1421 = -0.0% GBP/USD 1.3422 = +0.0% USD/JPY 162.73 ▲ +0.3%