================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Friday, July 24, 2026 - 9:07 PM EDT ================================================================ Autonomous AI agents drove the day's vulnerability research, finding and exploiting fresh zero-days in Redis and NodeBB while Google's CodeMender turned the same automation toward writing patches. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Autonomous agents overran the vulnerability pipeline as Kimi K3 bots forced seven Redis security releases and Aikido's pentest AI cracked NodeBB, research tooling attackers can wield just as easily. see: AI Agents Find and Patch Zero-Days at Scale * [TREND] Ransomware kept splintering with 61 new crews surfacing in a year while Clop opened a data-theft extortion campaign against internet-exposed PTC Windchill and FlexPLM instances. see: Ransomware Market Fragments as Groups Multiply; Clop Extortion Campaign Hits PTC Windchill and FlexPLM * [TREND] Attackers turned identity plumbing against its owners: the Certighost exploit hands low-privileged AD users domain control, Azure Automation defaults enable cross-tenant takeover, and Laundry Bear weaponizes a Zimbra flaw. see: Certighost Lets Low-Privilege Users Seize Domain Controllers; Azure Automation Default Enables Cross-Tenant Takeover; Laundry Bear Zimbra Flaw Gets CVE-2025-66376 * [UPDATE (new)] The Pirates placed Rafael Flores on the IL and added catcher Shawn Ross while deadline chatter still centers on shortstop Oneil Cruz and a hunt for bullpen help. see: Pirates Move Flores to IL, Add Catcher Shawn Ross; Pirates' Deadline Plans Take Shape * [TREND] Reading-list skeptics piled onto the AI boom, with Ed Zitron likening data-center financing to subprime lending and Ben Thompson dissecting how OpenAI accidentally hacked Hugging Face. see: The Subprime Data Center Crisis; OpenAI Hacks Hugging Face, What Happened, Alignment and Paper Clips SECURITY ---------------------------------------------------------------- 1. AI AGENTS FIND AND PATCH ZERO-DAYS AT SCALE AI Security · [ai, zero-day, patch] Latest developments: Redis shipped seven security releases on July 23 after researchers ran Kimi K3 agents to find memory flaws and build authenticated remote-code-execution proofs across stock Redis 6.2.22, 7.4.9, 8.6.4, and 8.8.0; Aikido Security's AI pentest agents found eight high-severity NodeBB flaws in a six-hour source review; and Google previewed CodeMender, an agent that confirms exploitable bugs and generates fixes. Researchers and defenders now point autonomous agents at source code to discover, prove, and repair vulnerabilities faster than manual review, a capability that cuts both ways. Redis patched in 6.2.23, 7.2.15, and 7.4.10; NodeBB administrators should run 4.14.2. - The Hacker News: https://thehackernews.com/2026/07/kimi-k3-agents-found-redis-zero-days.html - The Hacker News: https://thehackernews.com/2026/07/nodebb-patches-eight-ai-found-flaws.html - Help Net Security: https://www.helpnetsecurity.com/2026/07/24/google-codemender-ai-agent-code-security/ 2. RANSOMWARE MARKET FRAGMENTS AS GROUPS MULTIPLY Ransomware and Cybercrime · [ransomware, healthcare] Latest developments: Black Kite's 2026 report counted 61 new ransomware groups between April 2025 and March 2026, more than one a month, and Flare's Assaf Morag found gangs hitting EMEA healthcare's suppliers—telemedicine providers and vendors—across the whole ecosystem rather than headline hospital targets alone. The ransomware market has fragmented as many crews scale playbooks at once and reach deeper into the supply chain. Smaller healthcare vendors now absorb attacks as damaging as those against hospitals. - Help Net Security: https://www.helpnetsecurity.com/2026/07/24/ransomware-attack-trends-2026-report/ - Help Net Security: https://www.helpnetsecurity.com/2026/07/24/emea-healthcare-ransomware-activity/ 3. CERTIGHOST LETS LOW-PRIVILEGE USERS SEIZE DOMAIN CONTROLLERS Vulnerabilities and Exploits · [privilege-escalation, active-directory, exploit] Latest developments: Researchers H0j3n and Aniq Fakhrul published a working exploit on July 24 that lets any low-privileged Active Directory user obtain a certificate for a domain controller, authenticate as that machine, and abuse its replication rights to DCSync the krbtgt secret. Certighost turns an ordinary domain account into full directory compromise through Active Directory Certificate Services. Organizations running AD CS should audit certificate templates and enrollment permissions now. - The Hacker News: https://thehackernews.com/2026/07/certighost-exploit-lets-low-privileged.html 4. AZURE AUTOMATION DEFAULT ENABLES CROSS-TENANT TAKEOVER Vulnerabilities and Exploits · [cloud, vulnerability] Latest developments: Microsoft fixed a public-by-default configuration and chain of code flaws in Azure Automation that let an attacker seize another tenant's managed identity and reach its data, credentials, and cloud workloads. The default Azure Automation setting exposed accounts across tenant boundaries, opening the door to cross-tenant identity theft. Microsoft has remediated the issue; customers should verify their Automation configurations. - Dark Reading: https://www.darkreading.com/cloud-security/default-azure-automation-setting-cross-tenant-identity-takeover 5. CLOP EXTORTION CAMPAIGN HITS PTC WINDCHILL AND FLEXPLM Ransomware and Cybercrime · [ransomware, extortion] Latest developments: The Clop ransomware gang, also tracked as Cl0p, opened a data-theft extortion campaign against internet-exposed PTC Windchill and FlexPLM product-lifecycle-management instances. Clop, known for mass exploitation of file-transfer and enterprise software, now steals data from manufacturers' PLM platforms and extorts the owners. Companies running Windchill or FlexPLM should pull them off the public internet and hunt for exfiltration. - BleepingComputer: https://www.bleepingcomputer.com/news/security/clop-ransomware-targets-windchill-flexplm-in-data-theft-attacks/ 6. LAUNDRY BEAR ZIMBRA FLAW GETS CVE-2025-66376 Nation-State Activity · [apt, nation-state, patch] Latest developments: Help Net Security identified the Zimbra Collaboration Suite bug that Russian group Laundry Bear exploits as CVE-2025-66376, the flaw behind the joint NSA, FBI, CISA, Netherlands, UK, Australia, and Canada advisory documenting a campaign that has run since July 2025. Laundry Bear, also called Void Blizzard, CL-STA-1114, and TA488, breaks into government and commercial networks by exploiting unpatched Zimbra webmail to steal emails. Administrators should patch ZCS immediately. - Help Net Security: https://www.helpnetsecurity.com/2026/07/24/laundry-bear-zimbra-vulnerability-cve-2025-66376/ BUSINESS AND POLITICS ---------------------------------------------------------------- * Iran War Escalation Threatens Oil and Red Sea Shipping Latest developments: President Trump threatened to intensify the bombing of Iran as ship insurers restricted war coverage for Saudi Arabian cargoes in the Red Sea, and oil futures closed the week higher with Yemen's Houthis menacing Riyadh's export route. The United States and Iran remain locked in a cycle of strikes now in its second month, and Iranian-backed Houthi rebels are threatening Red Sea shipping and Saudi Arabia's oil exports, a spiral that lifts crude prices and tightens war-risk insurance for tankers worldwide. - WSJ World News: https://www.wsj.com/world/middle-east/iran-war-us-escalation-cycle-8d90061e - FT World: https://www.ft.com/content/52aa89e9-f014-498e-8415-2c435a1c858d?syn-25a6b1a6=1 - WSJ Markets: https://www.wsj.com/finance/commodities-futures/oil-futures-edge-lower-on-likely-technical-correction-2971174b?mod=rss_markets_main PITTSBURGH ---------------------------------------------------------------- Weather: Tonight: Mostly Cloudy then Chance Rain Showers, low 65F. Saturday: Chance Rain Showers, high 84F. Saturday Night: Slight Chance Showers And Thunderstorms then Areas Of Fog, low 64F. Business: * WVU Health System Nears Independence Deal Latest developments: Executives from West Virginia University Health System and Independence Health, joined by local officials, told state regulators Friday that acquiring Independence's five hospitals benefits patients, advancing the takeover a step. West Virginia University Health System is buying Independence Health System and its five hospitals across Westmoreland and surrounding counties, a deal that needs Pennsylvania regulators' approval; supporters including Danielle Yackovich urged the state to clear it. - WPXI: https://www.wpxi.com/news/local/wvu-independence-health-executives-say-planned-acquisition-is-win-all/MPLNAIP5X5AKHGER7LZ6SBKT4U/ - TribLive: https://triblive.com/local/westmoreland/hospital-local-officials-support-wvu-health-system-takeover-of-independence-health/ * Pennsylvania ACA Premiums Set to Jump Again Latest developments: The Pennsylvania Insurance Department said individual-market insurers seek an average 17.1% premium increase for Affordable Care Act plans next year, with Highmark asking 16.16% and UPMC Health Network 15.82% in the southwestern region. Pennsylvanians who buy their own health coverage through the Affordable Care Act face steep premium increases next year, as Highmark, UPMC Health Network, and Ambetter Health of Pennsylvania file double-digit rate requests with state regulators. - KDKA: https://www.cbsnews.com/pittsburgh/news/affordable-care-act-pennsylvania-rates/ * Original Pittsburgh Winery to Close August 15 Latest developments: The Original Pittsburgh Winery set August 15 as its closing date, ending a Strip District spot that doubled as an intimate live-music venue. The Original Pittsburgh Winery, a Strip District winery and small concert hall, will shut down August 15, dealing a blow to both wine drinkers and live-music fans in the neighborhood. - WPXI: https://www.wpxi.com/news/local/original-pittsburgh-winery-strip-district-close-this-fall/K5YSRSBRCJENNCV2KQIH4SI2FE/ - WTAE: https://www.wtae.com/article/pittsburgh-winery-closing/73260266 Around town: * DA Seeks State Takeover of County Pension Fund Latest developments: Allegheny County District Attorney Stephen Zappala Jr. called Friday for a state-led takeover of the county's pension fund, blasting a new report he says downplays the political mismanagement behind a $1.4 billion unfunded liability. Allegheny County's pension fund carries a $1.4 billion unfunded liability, and District Attorney Stephen Zappala Jr. accused local officials of governance failures while pressing Harrisburg to take control of the system. - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/politics-local/2026/07/24/allegheny-county-pension-zappala-innamorato/stories/202607240063 - TribLive: https://triblive.com/local/allegheny-county-da-blasts-new-report-citing-political-conflicts-in-pension-crisis/ * High E. coli Found in Etna's Pine Creek Latest developments: Three Rivers Waterkeeper reported high E. coli levels in Pine Creek along Route 8, in the popular fishing stretch from the waterfall near Burger King downstream toward Grant Avenue in Etna. Recent samples from Pine Creek in Etna, a well-used fishing spot off Route 8, showed high levels of E. coli, and Three Rivers Waterkeeper environmental scientist Koa Reitz warned people against contact with the water. - KDKA: https://www.cbsnews.com/pittsburgh/news/pine-creek-e-coli/ Events: * Kennywood Drone Shows Return for Final Weekend Latest developments: Kennywood brings back its drone shows for two final performances, Saturday and Sunday, July 25 and 26, each at 9:30 p.m. Kennywood, the amusement park in West Mifflin, stages the last two drone shows of its run on Saturday and Sunday, July 25 and 26, both at 9:30 p.m. - KDKA: https://www.cbsnews.com/pittsburgh/video/kennywoods-iconic-drone-shows-are-back-for-one-weekend/ * Weekend Festivals Around Pittsburgh Latest developments: NEXTpittsburgh's guide for the weekend of July 23 through 26 highlights DanceAfrica, Goat Fest, and OpenStreetsPGH among things to do. The weekend of July 23 through 26 brings DanceAfrica, Goat Fest, and OpenStreetsPGH, the city program that opens car-free streets to walkers and cyclists, across Pittsburgh. - NEXTpittsburgh Events: https://nextpittsburgh.com/events/13-things-to-do-this-weekend-july-23-26/ SPORTS ---------------------------------------------------------------- Pirates (53-50) Fri Jul 24 · Cubs 1 · Pirates 1 · Top 10th (in progress at last update) https://plaintextsports.com/mlb/2026-07-24/chc-pit Up Next · Cubs @ Pirates · Sat Jul 25, 6:40 PM https://plaintextsports.com/mlb/2026-07-25/chc-pit Around the Teams: * Steelers Camp Opens Next Week in Latrobe Latest developments: The Post-Gazette laid out five storylines for Steelers training camp, opening next week in Latrobe: Mike McCarthy's first camp as head coach, the stalled Joey Porter Jr. contract, and a quarterback battle involving Will Howard and Drew Allar. The Pittsburgh Steelers report to Saint Vincent College in Latrobe next week under new coach Mike McCarthy, with an unresolved cornerback contract for Joey Porter Jr. and a quarterback competition between Will Howard and Drew Allar topping the questions. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/07/24/nfl-training-camp-mccarthy-joey-porter-will-howard-drew-allar/stories/202607230005 * Pirates' Deadline Plans Take Shape Latest developments: The Post-Gazette's Friday report on what it is hearing before the trade deadline points to continued interest in shortstop Oneil Cruz and a hunt for bullpen help, with general manager Ben Cherington weighing whether to buy. The Pittsburgh Pirates, clinging to a wild-card push, face a trade-deadline decision under general manager Ben Cherington: field offers for shortstop Oneil Cruz or add bullpen arms to shore up an injury-hit roster. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/07/24/mlb-trade-rumors-oneil-cruz-bullpen-ben-cherington/stories/202607240042 * Pirates Move Flores to IL, Add Catcher Shawn Ross Latest developments: The Pirates placed Rafael Flores Jr. on the injured list and added catcher Shawn Ross, the Post-Gazette reported, as newly acquired right-hander Ron Marinaccio joins a battered bullpen. The Pittsburgh Pirates, thinned by injuries, sent Rafael Flores Jr. to the injured list and brought in catcher Shawn Ross, while reliever Ron Marinaccio steps into a depleted bullpen ahead of the trade deadline. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/07/24/mlb-pirates-cubs-chicago-nl-central-bullpen-ron-marinaccio/stories/202607240065 Team USA: * Beatriz Hatz Wins Para Long Jump National Title Latest developments: Beatriz Hatz, a 'Love Island' Season 8 alum, captured the women's T64 long jump national title at the USA Track and Field championships. Beatriz Hatz, a United States Paralympic long jumper who competed on 'Love Island,' won the women's T64 long jump national title at the USATF championships, adding to her medal résumé. - ESPN Olympics: https://www.espn.com/olympics/story/_/id/49436263/beatriz-hatz-love-island-national-championship READING ---------------------------------------------------------------- * Stratechery -- OpenAI Hacks Hugging Face, What Happened, Alignment and Paper Clips Ben Thompson unpacks how OpenAI accidentally hacked Hugging Face and argues the episode's lessons about AI alignment are more encouraging than alarmed observers assume. https://stratechery.com/2026/openai-hacks-hugging-face-what-happened-alignment-and-paper-clips/ * Ed Zitron -- The Subprime Data Center Crisis Ed Zitron argues the AI buildout rests on shaky, debt-laden data-center financing he likens to subprime lending, warning that the arrangement invites a reckoning. https://www.wheresyoured.at/the-subprime-data-center-crisis/ * Cal Newport -- Why Reading Matters Cal Newport responds to an Atlantic piece on declining reading, arguing that sustained deep reading builds cognitive capacities screens and skimming leave underdeveloped. https://calnewport.com/why-reading-matters/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,454.34 ▼ -0.9% Dow 51,988.28 ▼ -0.9% Nasdaq 25,429.94 ▼ -1.9% WTI crude 87.53 ▲ +9.8% EUR/USD 1.1397 ▼ -0.3% GBP/USD 1.3363 ▼ -0.6% USD/JPY 163.28 ▲ +0.6% ================================================================ Generated 2026-07-24 21:07 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================