daily plain-text briefing: security, markets, business, and pittsburgh
Autonomous AI agents drove the day's vulnerability research, finding and exploiting fresh zero-days in Redis and NodeBB while Google's CodeMender turned the same automation toward writing patches.
Latest developments: Redis shipped seven security releases on July 23 after researchers ran Kimi K3 agents to find memory flaws and build authenticated remote-code-execution proofs across stock Redis 6.2.22, 7.4.9, 8.6.4, and 8.8.0; Aikido Security's AI pentest agents found eight high-severity NodeBB flaws in a six-hour source review; and Google previewed CodeMender, an agent that confirms exploitable bugs and generates fixes.
Researchers and defenders now point autonomous agents at source code to discover, prove, and repair vulnerabilities faster than manual review, a capability that cuts both ways. Redis patched in 6.2.23, 7.2.15, and 7.4.10; NodeBB administrators should run 4.14.2.
Sources: The Hacker News · The Hacker News · Help Net Security · ↑ top
Latest developments: Black Kite's 2026 report counted 61 new ransomware groups between April 2025 and March 2026, more than one a month, and Flare's Assaf Morag found gangs hitting EMEA healthcare's suppliers—telemedicine providers and vendors—across the whole ecosystem rather than headline hospital targets alone.
The ransomware market has fragmented as many crews scale playbooks at once and reach deeper into the supply chain. Smaller healthcare vendors now absorb attacks as damaging as those against hospitals.
Sources: Help Net Security · Help Net Security · ↑ top
Latest developments: Researchers H0j3n and Aniq Fakhrul published a working exploit on July 24 that lets any low-privileged Active Directory user obtain a certificate for a domain controller, authenticate as that machine, and abuse its replication rights to DCSync the krbtgt secret.
Certighost turns an ordinary domain account into full directory compromise through Active Directory Certificate Services. Organizations running AD CS should audit certificate templates and enrollment permissions now.
Sources: The Hacker News · ↑ top
Latest developments: Microsoft fixed a public-by-default configuration and chain of code flaws in Azure Automation that let an attacker seize another tenant's managed identity and reach its data, credentials, and cloud workloads.
The default Azure Automation setting exposed accounts across tenant boundaries, opening the door to cross-tenant identity theft. Microsoft has remediated the issue; customers should verify their Automation configurations.
Sources: Dark Reading · ↑ top
Latest developments: The Clop ransomware gang, also tracked as Cl0p, opened a data-theft extortion campaign against internet-exposed PTC Windchill and FlexPLM product-lifecycle-management instances.
Clop, known for mass exploitation of file-transfer and enterprise software, now steals data from manufacturers' PLM platforms and extorts the owners. Companies running Windchill or FlexPLM should pull them off the public internet and hunt for exfiltration.
Sources: BleepingComputer · ↑ top
Latest developments: Help Net Security identified the Zimbra Collaboration Suite bug that Russian group Laundry Bear exploits as CVE-2025-66376, the flaw behind the joint NSA, FBI, CISA, Netherlands, UK, Australia, and Canada advisory documenting a campaign that has run since July 2025.
Laundry Bear, also called Void Blizzard, CL-STA-1114, and TA488, breaks into government and commercial networks by exploiting unpatched Zimbra webmail to steal emails. Administrators should patch ZCS immediately.
Sources: Help Net Security · ↑ top
Latest developments: President Trump threatened to intensify the bombing of Iran as ship insurers restricted war coverage for Saudi Arabian cargoes in the Red Sea, and oil futures closed the week higher with Yemen's Houthis menacing Riyadh's export route.
The United States and Iran remain locked in a cycle of strikes now in its second month, and Iranian-backed Houthi rebels are threatening Red Sea shipping and Saudi Arabia's oil exports, a spiral that lifts crude prices and tightens war-risk insurance for tankers worldwide.
Sources: WSJ World News · FT World · WSJ Markets · ↑ top
Tonight: Mostly Cloudy then Chance Rain Showers, low 65F.
Saturday: Chance Rain Showers, high 84F.
Saturday Night: Slight Chance Showers And Thunderstorms then Areas Of Fog, low 64F.
Latest developments: Executives from West Virginia University Health System and Independence Health, joined by local officials, told state regulators Friday that acquiring Independence's five hospitals benefits patients, advancing the takeover a step.
West Virginia University Health System is buying Independence Health System and its five hospitals across Westmoreland and surrounding counties, a deal that needs Pennsylvania regulators' approval; supporters including Danielle Yackovich urged the state to clear it.
Sources: WPXI · TribLive · ↑ top
Latest developments: The Pennsylvania Insurance Department said individual-market insurers seek an average 17.1% premium increase for Affordable Care Act plans next year, with Highmark asking 16.16% and UPMC Health Network 15.82% in the southwestern region.
Pennsylvanians who buy their own health coverage through the Affordable Care Act face steep premium increases next year, as Highmark, UPMC Health Network, and Ambetter Health of Pennsylvania file double-digit rate requests with state regulators.
Latest developments: The Original Pittsburgh Winery set August 15 as its closing date, ending a Strip District spot that doubled as an intimate live-music venue.
The Original Pittsburgh Winery, a Strip District winery and small concert hall, will shut down August 15, dealing a blow to both wine drinkers and live-music fans in the neighborhood.
Latest developments: Allegheny County District Attorney Stephen Zappala Jr. called Friday for a state-led takeover of the county's pension fund, blasting a new report he says downplays the political mismanagement behind a $1.4 billion unfunded liability.
Allegheny County's pension fund carries a $1.4 billion unfunded liability, and District Attorney Stephen Zappala Jr. accused local officials of governance failures while pressing Harrisburg to take control of the system.
Sources: Pittsburgh Post-Gazette · TribLive · ↑ top
Latest developments: Three Rivers Waterkeeper reported high E. coli levels in Pine Creek along Route 8, in the popular fishing stretch from the waterfall near Burger King downstream toward Grant Avenue in Etna.
Recent samples from Pine Creek in Etna, a well-used fishing spot off Route 8, showed high levels of E. coli, and Three Rivers Waterkeeper environmental scientist Koa Reitz warned people against contact with the water.
Latest developments: Kennywood brings back its drone shows for two final performances, Saturday and Sunday, July 25 and 26, each at 9:30 p.m.
Kennywood, the amusement park in West Mifflin, stages the last two drone shows of its run on Saturday and Sunday, July 25 and 26, both at 9:30 p.m.
Latest developments: NEXTpittsburgh's guide for the weekend of July 23 through 26 highlights DanceAfrica, Goat Fest, and OpenStreetsPGH among things to do.
The weekend of July 23 through 26 brings DanceAfrica, Goat Fest, and OpenStreetsPGH, the city program that opens car-free streets to walkers and cyclists, across Pittsburgh.
Sources: NEXTpittsburgh Events · ↑ top
Pirates (53-50)
Fri Jul 24 · Cubs 1 · Pirates 1 · Top 10th (in progress at last update)
Up Next · Cubs @ Pirates · Sat Jul 25, 6:40 PM
Latest developments: The Post-Gazette laid out five storylines for Steelers training camp, opening next week in Latrobe: Mike McCarthy's first camp as head coach, the stalled Joey Porter Jr. contract, and a quarterback battle involving Will Howard and Drew Allar.
The Pittsburgh Steelers report to Saint Vincent College in Latrobe next week under new coach Mike McCarthy, with an unresolved cornerback contract for Joey Porter Jr. and a quarterback competition between Will Howard and Drew Allar topping the questions.
Sources: Post-Gazette Steelers · ↑ top
Latest developments: The Post-Gazette's Friday report on what it is hearing before the trade deadline points to continued interest in shortstop Oneil Cruz and a hunt for bullpen help, with general manager Ben Cherington weighing whether to buy.
The Pittsburgh Pirates, clinging to a wild-card push, face a trade-deadline decision under general manager Ben Cherington: field offers for shortstop Oneil Cruz or add bullpen arms to shore up an injury-hit roster.
Sources: Post-Gazette Pirates · ↑ top
Latest developments: The Pirates placed Rafael Flores Jr. on the injured list and added catcher Shawn Ross, the Post-Gazette reported, as newly acquired right-hander Ron Marinaccio joins a battered bullpen.
The Pittsburgh Pirates, thinned by injuries, sent Rafael Flores Jr. to the injured list and brought in catcher Shawn Ross, while reliever Ron Marinaccio steps into a depleted bullpen ahead of the trade deadline.
Sources: Post-Gazette Pirates · ↑ top
Latest developments: Beatriz Hatz, a 'Love Island' Season 8 alum, captured the women's T64 long jump national title at the USA Track and Field championships.
Beatriz Hatz, a United States Paralympic long jumper who competed on 'Love Island,' won the women's T64 long jump national title at the USATF championships, adding to her medal résumé.
Sources: ESPN Olympics · ↑ top
S&P 500 7,454.34 ▼ -0.9% Dow 51,988.28 ▼ -0.9% Nasdaq 25,429.94 ▼ -1.9% WTI crude 87.53 ▲ +9.8% EUR/USD 1.1397 ▼ -0.3% GBP/USD 1.3363 ▼ -0.6% USD/JPY 163.28 ▲ +0.6%