daily plain-text briefing: security, markets, business, and pittsburgh
Attackers handed whole post-exploitation phases to an autonomous AI agent inside Thailand's treasury while Microsoft's own Bing image tier and self-managed GitLab yielded fresh remote-code-execution holes.
Latest developments: Security researcher Yuhang Wu at depthfirst published a working proof-of-concept on July 25 that executes commands as git on an unpatched self-managed GitLab 18.11.3 server, triggered when an ordinary authenticated user commits two crafted Jupyter notebooks and requests their diff.
The chain needs no administrator rights, no continuous-integration runner access, and no victim interaction, so any registered user can reach remote code execution on a vulnerable self-managed instance. Administrators running self-managed GitLab should patch immediately.
Sources: The Hacker News · ↑ top
Latest developments: OnTrac told customers hackers breached its corporate network and may have reached their personal details, Dark Reading found a porous API endpoint in the Vatican's official prayer app exposing names, email addresses, country, and status for more than 700,000 users, and Chick-fil-A confirmed credential-stuffing attacks between June 17 and June 19 compromised more than 13,000 customer accounts.
The three incidents span a parcel carrier, a religious app, and a fast-food chain, hitting victims through a network intrusion, an exposed API anyone with a browser could read, and reused passwords. Affected users should reset credentials and watch for fraud.
Sources: BleepingComputer · Dark Reading · BleepingComputer · ↑ top
Latest developments: A threat actor installed the open-source Hermes AI agent on a rented server, switched off its permission prompts to run it in unattended YOLO mode, and pointed it at Thailand's Ministry of Finance, where it worked through the network on its own checking hosts for root access and hunting file systems.
The Ministry of Finance runs Thailand's treasury and tax collection, and the incident shows attackers delegating live post-exploitation to a commodity AI agent rather than driving each step by hand. Organizations should treat AI agents as privileged actors and restrict what they can execute.
Sources: BleepingComputer · The Hacker News · ↑ top
Latest developments: XBOW showed that a crafted SVG submitted to Bing's image search ran commands as NT AUTHORITY\SYSTEM on Microsoft's production image-processing workers and as root on the Linux machines in the same fleet, reproducing across different hosts and network ranges, and Microsoft issued two critical fixes including CVE-2026-32194.
The bug sat in Bing's image tier rather than one bad machine, so a single malicious file gave full control of Microsoft's image-processing infrastructure. Microsoft has patched the affected workers.
Sources: The Hacker News · ↑ top
Latest developments: Researchers found the North Korean group BlueNoroff operating an active phishing kit that impersonates Zoom and Microsoft Teams through typosquatted domains, combining compromised industry contacts with social engineering to profile a target's cryptocurrency wallet before it delivers malware.
BlueNoroff runs ClickFix-style campaigns against crypto holders and finance staff, tailoring the payload to victims whose wallets it identifies first. Staff should verify videoconferencing links out of band and treat unexpected Zoom or Teams prompts as suspect.
Sources: The Hacker News · ↑ top
Latest developments: The operators behind the Golden Chickens malware-as-a-service ecosystem resurfaced with four new families—TinyEgg, ChonkyChicken, a modularized ChonkyChicken variant, and a modified web-browser credential stealer—showing no signs of stopping despite extensive public disclosure of their inner workings.
Golden Chickens rents modular implants to other criminals, and the refreshed toolkit keeps the operation viable after researchers exposed its earlier components. Defenders should update detection for the new implant names and browser-credential theft.
Sources: The Hacker News · ↑ top
Latest developments: Warplanes from Bahrain and Kuwait struck Iran in a rare Gulf retaliation, and the U.S. military said Friday it fired on another merchant vessel trying to breach its blockade of Iran's ports as Tehran targeted American strongholds around the Persian Gulf.
The United States and Iran remain locked in an escalating war that has killed U.S. service members and now draws in Arab states; President Trump threatens to intensify bombing while Iran's militia allies widen the fighting, keeping oil prices and Persian Gulf shipping at risk.
Sources: WSJ World News · WSJ World News · ↑ top
Today: Isolated Rain Showers then Isolated Showers And Thunderstorms, high 83F.
Tonight: Isolated Showers And Thunderstorms then Patchy Fog, low 63F.
Sunday: Patchy Fog then Isolated Showers And Thunderstorms, high 86F.
Latest developments: Pennsylvania American Water began knocking on doors July 15 across parts of its City of Pittsburgh territory to help 5,700 customers identify the material of their home water service lines.
The utility's outreach supports a program to locate and eventually replace lead and other aging service lines that feed homes in its Pittsburgh service area.
Latest developments: WTAE reported Friday that the pothole-choked lots and access roads at the Galleria at Pittsburgh Mills in Frazer Township are close to being repaved.
Namdar Realty Group, the mall's owner, committed to fixing the crater-filled roads that drivers and tenants have complained about for years at the Frazer Township shopping center.
Latest developments: The Allegheny County Department of Public Works announced Friday a schedule of overnight closures on I-279 and the I-279/I-579 HOV lanes running July 25 through Aug. 3 in Pittsburgh, Ross Township, and Ohio Township.
Crews will shut lane segments overnight through the North Hills corridor; commuters should plan detours during the work window.
Latest developments: The CDC added Pennsylvania and three other states to a cyclospora outbreak Friday, bringing the total to nine states, and the Pennsylvania Department of Health confirmed several cases tied to shredded iceberg lettuce from central Mexico.
Cyclosporiasis, caused by the cyclospora parasite, brings long bouts of severe diarrhea; the FDA's investigation has centered on Taylor Farms shredded iceberg lettuce grown in central Mexico.
Latest developments: KDKA profiled Amy Constantine of Dormont, who has set out to map every little free library in her community.
Constantine and her husband built one of the sidewalk boxes two years ago for their growing collection of vinyl records, CDs, and cassettes, part of a neighbor-built network that lets people swap books and media.
Latest developments: The Post-Gazette detailed Friday how the Original Pittsburgh Winery's Aug. 15 closing will silence one of the Strip District's intimate live-music rooms.
The Original Pittsburgh Winery, a Strip District spot that doubled as a small listening room for touring and local acts, will pour and play its final shows through mid-August before shutting down.
Sources: Post-Gazette Music · ↑ top
Pirates (53-51)
Fri Jul 24 · Cubs 3 · Pirates 2 · Final (10)
Dansby Swanson's two-out single in the 10th inning, Boyd's strong outing lift Cubs over Pirates 3-2
Up Next · Cubs @ Pirates · Sat Jul 25, 6:40 PM
Latest developments: The Post-Gazette's training-camp countdown Friday argued that Troy Fautanu's move to a new spot on the offensive line will be critical to protecting quarterback Aaron Rodgers.
Fautanu, the 2024 first-round tackle out of Washington, is shifting positions alongside guard Mason McCormick as Pittsburgh reworks its front for Mike McCarthy's first camp in Latrobe.
Sources: Post-Gazette Steelers · ↑ top
Latest developments: A Post-Gazette countdown Friday framed cornerback Joey Porter Jr. as chasing both a lucrative contract and elite status as camp opens with his deal unresolved.
Porter, the Steelers' 2023 second-round pick and son of the former linebacker Joey Porter, enters a pivotal season with his stalled contract among the top storylines at Saint Vincent College.
Sources: Post-Gazette Steelers · ↑ top
Latest developments: On 'Footbahlin' episode 133, Ben Roethlisberger broke down what to watch when the Steelers hit the practice fields and what makes a franchise quarterback.
Roethlisberger said training camp finally replaces the offseason rumor mill with real competition, previewing the first hints of what Pittsburgh's new era under Mike McCarthy is trying to be.
Sources: Ben Roethlisberger / Channel Seven (YouTube) · ↑ top
Latest developments: Sha'Carri Richardson and Noah Lyles surged to 100-meter victories Friday night at the U.S. track and field championships, days after cruising through their opening heats.
Richardson took the women's 100 and Lyles the men's, reasserting both sprinters atop American sprinting as the outdoor season builds.
Sources: ESPN Olympics · ↑ top
Latest developments: Gotham FC and U.S. women's national team defender Emily Sonnett left on a stretcher in the opening minutes of Friday's 2-2 draw with the Portland Thorns after a non-contact knee injury.
Sonnett, a veteran of the USWNT back line, went down early with the severity unclear, a worry for the national team a year out from the 2027 Women's World Cup.
Sources: ESPN Soccer · ↑ top
S&P 500 7,454.34 ▼ -0.9% Dow 51,988.28 ▼ -0.9% Nasdaq 25,429.94 ▼ -1.9% WTI crude 87.29 ▲ +9.5% EUR/USD 1.1397 ▼ -0.3% GBP/USD 1.3363 ▼ -0.6% USD/JPY 163.28 ▲ +0.6%