================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Saturday, July 25, 2026 - 6:06 AM EDT ================================================================ Attackers handed whole post-exploitation phases to an autonomous AI agent inside Thailand's treasury while Microsoft's own Bing image tier and self-managed GitLab yielded fresh remote-code-execution holes. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] A threat actor turned the open-source Hermes agent loose in unattended YOLO mode against Thailand's Ministry of Finance, letting the AI hunt for root on its own. see: Hermes AI Agent Automates Breach of Thai Finance Ministry * [TREND] Server-side code-execution keeps surfacing, from a GitLab proof-of-concept running commands as git to a crafted SVG in Bing image search executing as SYSTEM. see: GitLab PoC Lets Authenticated Users Run Code as Git; Bing Image Search SVG Flaws Run Code as SYSTEM * [UPDATE (new)] Fresh breaches piled up as OnTrac warned of a network intrusion, a porous Vatican prayer app API leaked user data, and Chick-fil-A joined the tally. see: OnTrac, Vatican App, and Chick-fil-A Breaches Surface * [TREND] Tracked crews stayed busy, with North Korea's BlueNoroff profiling crypto wallets through fake Zoom domains and Golden Chickens resurfacing with four new malware families. see: BlueNoroff Zoom Kit Profiles Crypto Wallets Before Malware; Golden Chickens Returns With Four New Malware Families * [UPDATE (new)] Around Pittsburgh, overnight I-279 closures run through Aug. 3 as a cyclospora outbreak tied to shredded lettuce reached Pennsylvania. see: I-279 Overnight Closures Through Aug. 3; Cyclospora Outbreak Reaches Pennsylvania * [TREND] AI's economics drew fresh scrutiny in the Reading list, from a warning that the subprime data-center buildout won't hold to OpenAI's accidental Hugging Face hack. see: The Subprime Data Center Crisis; OpenAI Hacks Hugging Face, What Happened, Alignment and Paper Clips SECURITY ---------------------------------------------------------------- 1. GITLAB POC LETS AUTHENTICATED USERS RUN CODE AS GIT Vulnerabilities and Exploits · [rce, patch, exploit] Latest developments: Security researcher Yuhang Wu at depthfirst published a working proof-of-concept on July 25 that executes commands as git on an unpatched self-managed GitLab 18.11.3 server, triggered when an ordinary authenticated user commits two crafted Jupyter notebooks and requests their diff. The chain needs no administrator rights, no continuous-integration runner access, and no victim interaction, so any registered user can reach remote code execution on a vulnerable self-managed instance. Administrators running self-managed GitLab should patch immediately. - The Hacker News: https://thehackernews.com/2026/07/researcher-publishes-gitlab-rce-poc.html 2. ONTRAC, VATICAN APP, AND CHICK-FIL-A BREACHES SURFACE Data Breaches · [breach, credential-stuffing, data-leak] Latest developments: OnTrac told customers hackers breached its corporate network and may have reached their personal details, Dark Reading found a porous API endpoint in the Vatican's official prayer app exposing names, email addresses, country, and status for more than 700,000 users, and Chick-fil-A confirmed credential-stuffing attacks between June 17 and June 19 compromised more than 13,000 customer accounts. The three incidents span a parcel carrier, a religious app, and a fast-food chain, hitting victims through a network intrusion, an exposed API anyone with a browser could read, and reused passwords. Affected users should reset credentials and watch for fraud. - BleepingComputer: https://www.bleepingcomputer.com/news/security/ontrac-notifies-customers-of-data-breach-after-network-hack/ - Dark Reading: https://www.darkreading.com/vulnerabilities-threats/vatican-official-prayer-app-leaks-700k-pii - BleepingComputer: https://www.bleepingcomputer.com/news/security/chick-fil-a-data-breach-affects-more-than-13-000-customers/ 3. HERMES AI AGENT AUTOMATES BREACH OF THAI FINANCE MINISTRY AI Security · [ai, apt, breach] Latest developments: A threat actor installed the open-source Hermes AI agent on a rented server, switched off its permission prompts to run it in unattended YOLO mode, and pointed it at Thailand's Ministry of Finance, where it worked through the network on its own checking hosts for root access and hunting file systems. The Ministry of Finance runs Thailand's treasury and tax collection, and the incident shows attackers delegating live post-exploitation to a commodity AI agent rather than driving each step by hand. Organizations should treat AI agents as privileged actors and restrict what they can execute. - BleepingComputer: https://www.bleepingcomputer.com/news/security/hermes-ai-agent-used-to-automate-attack-on-thai-finance-ministry/ - The Hacker News: https://thehackernews.com/2026/07/hacker-runs-hermes-ai-agent-unattended.html 4. BING IMAGE SEARCH SVG FLAWS RUN CODE AS SYSTEM Vulnerabilities and Exploits · [zero-day, rce, patch] Latest developments: XBOW showed that a crafted SVG submitted to Bing's image search ran commands as NT AUTHORITY\SYSTEM on Microsoft's production image-processing workers and as root on the Linux machines in the same fleet, reproducing across different hosts and network ranges, and Microsoft issued two critical fixes including CVE-2026-32194. The bug sat in Bing's image tier rather than one bad machine, so a single malicious file gave full control of Microsoft's image-processing infrastructure. Microsoft has patched the affected workers. - The Hacker News: https://thehackernews.com/2026/07/bing-images-flaws-let-crafted-svgs-run.html 5. BLUENOROFF ZOOM KIT PROFILES CRYPTO WALLETS BEFORE MALWARE Nation-State Activity · [apt, phishing, cryptocurrency] Latest developments: Researchers found the North Korean group BlueNoroff operating an active phishing kit that impersonates Zoom and Microsoft Teams through typosquatted domains, combining compromised industry contacts with social engineering to profile a target's cryptocurrency wallet before it delivers malware. BlueNoroff runs ClickFix-style campaigns against crypto holders and finance staff, tailoring the payload to victims whose wallets it identifies first. Staff should verify videoconferencing links out of band and treat unexpected Zoom or Teams prompts as suspect. - The Hacker News: https://thehackernews.com/2026/07/bluenoroff-zoom-phishing-kit-profiles.html 6. GOLDEN CHICKENS RETURNS WITH FOUR NEW MALWARE FAMILIES Ransomware and Cybercrime · [malware, maas, cybercrime] Latest developments: The operators behind the Golden Chickens malware-as-a-service ecosystem resurfaced with four new families—TinyEgg, ChonkyChicken, a modularized ChonkyChicken variant, and a modified web-browser credential stealer—showing no signs of stopping despite extensive public disclosure of their inner workings. Golden Chickens rents modular implants to other criminals, and the refreshed toolkit keeps the operation viable after researchers exposed its earlier components. Defenders should update detection for the new implant names and browser-credential theft. - The Hacker News: https://thehackernews.com/2026/07/golden-chickens-resurfaces-with-four.html BUSINESS AND POLITICS ---------------------------------------------------------------- * Gulf States Strike Iran as U.S. Blockades Its Ports Latest developments: Warplanes from Bahrain and Kuwait struck Iran in a rare Gulf retaliation, and the U.S. military said Friday it fired on another merchant vessel trying to breach its blockade of Iran's ports as Tehran targeted American strongholds around the Persian Gulf. The United States and Iran remain locked in an escalating war that has killed U.S. service members and now draws in Arab states; President Trump threatens to intensify bombing while Iran's militia allies widen the fighting, keeping oil prices and Persian Gulf shipping at risk. - WSJ World News: https://www.wsj.com/world/middle-east/iran-gulf-states-bahrain-kuwait-strikes-009637db - WSJ World News: https://www.wsj.com/world/middle-east/iran-war-us-escalation-cycle-8d90061e PITTSBURGH ---------------------------------------------------------------- Weather: Today: Isolated Rain Showers then Isolated Showers And Thunderstorms, high 83F. Tonight: Isolated Showers And Thunderstorms then Patchy Fog, low 63F. Sunday: Patchy Fog then Isolated Showers And Thunderstorms, high 86F. Business: * Pennsylvania American Water Canvasses Pittsburgh Service Lines Latest developments: Pennsylvania American Water began knocking on doors July 15 across parts of its City of Pittsburgh territory to help 5,700 customers identify the material of their home water service lines. The utility's outreach supports a program to locate and eventually replace lead and other aging service lines that feed homes in its Pittsburgh service area. - WPXI: https://www.wpxi.com/news/local/pennsylvania-american-water-begins-door-to-door-canvassing-pittsburgh-service-line-program/FYBGHGUI5NGDLKH5AYCUQQYLSY/ * Pittsburgh Mills Potholes Near Repair Latest developments: WTAE reported Friday that the pothole-choked lots and access roads at the Galleria at Pittsburgh Mills in Frazer Township are close to being repaved. Namdar Realty Group, the mall's owner, committed to fixing the crater-filled roads that drivers and tenants have complained about for years at the Frazer Township shopping center. - WTAE: https://www.wtae.com/article/pittsburgh-mills-roads-paved-pothole-problems/73261294 Around town: * I-279 Overnight Closures Through Aug. 3 Latest developments: The Allegheny County Department of Public Works announced Friday a schedule of overnight closures on I-279 and the I-279/I-579 HOV lanes running July 25 through Aug. 3 in Pittsburgh, Ross Township, and Ohio Township. Crews will shut lane segments overnight through the North Hills corridor; commuters should plan detours during the work window. - WPXI: https://www.wpxi.com/news/local/schedule-i-279-closures-set-july-25-aug-3/7AHEZ5AQE5BHZLJKEDGAUFQBLA/ * Cyclospora Outbreak Reaches Pennsylvania Latest developments: The CDC added Pennsylvania and three other states to a cyclospora outbreak Friday, bringing the total to nine states, and the Pennsylvania Department of Health confirmed several cases tied to shredded iceberg lettuce from central Mexico. Cyclosporiasis, caused by the cyclospora parasite, brings long bouts of severe diarrhea; the FDA's investigation has centered on Taylor Farms shredded iceberg lettuce grown in central Mexico. - WTAE: https://www.wtae.com/article/cyclospora-outbreak-pennsylvania/73259940 - KDKA: https://www.cbsnews.com/pittsburgh/news/pennsylvania-cyclospora-outbreak-iceberg-lettuce/ * Mapping Dormont's Little Free Libraries Latest developments: KDKA profiled Amy Constantine of Dormont, who has set out to map every little free library in her community. Constantine and her husband built one of the sidewalk boxes two years ago for their growing collection of vinyl records, CDs, and cassettes, part of a neighbor-built network that lets people swap books and media. - KDKA: https://www.cbsnews.com/pittsburgh/news/non-traditional-little-free-libraries-dormont/ Events: * Original Pittsburgh Winery to Close Aug. 15 Latest developments: The Post-Gazette detailed Friday how the Original Pittsburgh Winery's Aug. 15 closing will silence one of the Strip District's intimate live-music rooms. The Original Pittsburgh Winery, a Strip District spot that doubled as a small listening room for touring and local acts, will pour and play its final shows through mid-August before shutting down. - Post-Gazette Music: https://www.post-gazette.com/life/drinks/2026/07/24/original-pittsburgh-winery-closing-strip-district/stories/202607240058 SPORTS ---------------------------------------------------------------- Pirates (53-51) Fri Jul 24 · Cubs 3 · Pirates 2 · Final (10) Dansby Swanson's two-out single in the 10th inning, Boyd's strong outing lift Cubs over Pirates 3-2 https://plaintextsports.com/mlb/2026-07-24/chc-pit Up Next · Cubs @ Pirates · Sat Jul 25, 6:40 PM https://plaintextsports.com/mlb/2026-07-25/chc-pit Around the Teams: * Fautanu's Position Switch Key to Steelers Offense Latest developments: The Post-Gazette's training-camp countdown Friday argued that Troy Fautanu's move to a new spot on the offensive line will be critical to protecting quarterback Aaron Rodgers. Fautanu, the 2024 first-round tackle out of Washington, is shifting positions alongside guard Mason McCormick as Pittsburgh reworks its front for Mike McCarthy's first camp in Latrobe. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/07/25/nfl-trainingcamp-fautanu-mason-mccormick-aaron-rodgers/stories/202607250004 * Porter Eyes Big Payday and Elite Corner Status Latest developments: A Post-Gazette countdown Friday framed cornerback Joey Porter Jr. as chasing both a lucrative contract and elite status as camp opens with his deal unresolved. Porter, the Steelers' 2023 second-round pick and son of the former linebacker Joey Porter, enters a pivotal season with his stalled contract among the top storylines at Saint Vincent College. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/07/24/nfl-trainingcamp-joey-porter-contract-cornerback-market/stories/202607230004 * Roethlisberger Previews Camp on 'Footbahlin' Latest developments: On 'Footbahlin' episode 133, Ben Roethlisberger broke down what to watch when the Steelers hit the practice fields and what makes a franchise quarterback. Roethlisberger said training camp finally replaces the offseason rumor mill with real competition, previewing the first hints of what Pittsburgh's new era under Mike McCarthy is trying to be. - Ben Roethlisberger / Channel Seven (YouTube): https://www.youtube.com/watch?v=Z1YJqSjWA74 Team USA: * Richardson and Lyles Win 100 Meters at U.S. Championships Latest developments: Sha'Carri Richardson and Noah Lyles surged to 100-meter victories Friday night at the U.S. track and field championships, days after cruising through their opening heats. Richardson took the women's 100 and Lyles the men's, reasserting both sprinters atop American sprinting as the outdoor season builds. - ESPN Olympics: https://www.espn.com/olympics/trackandfield/story/_/id/49443171/shacarri-richardson-noah-lyles-surge-100-meter-wins-us-track-field-championships * USWNT's Sonnett Stretchered Off With Knee Injury Latest developments: Gotham FC and U.S. women's national team defender Emily Sonnett left on a stretcher in the opening minutes of Friday's 2-2 draw with the Portland Thorns after a non-contact knee injury. Sonnett, a veteran of the USWNT back line, went down early with the severity unclear, a worry for the national team a year out from the 2027 Women's World Cup. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49444838/uswnt-gotham-fc-portland-thorns-emily-sonnett READING ---------------------------------------------------------------- * Ed Zitron -- The Subprime Data Center Crisis Zitron argues the AI boom's data-center buildout rests on shaky, debt-fueled financing he likens to subprime lending, warning the underlying economics do not hold. https://www.wheresyoured.at/the-subprime-data-center-crisis/ * Stratechery -- OpenAI Hacks Hugging Face, What Happened, Alignment and Paper Clips Ben Thompson unpacks how OpenAI accidentally 'hacked' Hugging Face and uses the episode to draw more encouraging conclusions about AI alignment than the alarm suggests. https://stratechery.com/2026/openai-hacks-hugging-face-what-happened-alignment-and-paper-clips/ * Cal Newport -- Why Reading Matters Newport responds to Rose Horowitch's Atlantic article 'The End of Reading is Here,' making the case for why deep reading still matters as attention spans erode. https://calnewport.com/why-reading-matters/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,454.34 ▼ -0.9% Dow 51,988.28 ▼ -0.9% Nasdaq 25,429.94 ▼ -1.9% WTI crude 87.29 ▲ +9.5% EUR/USD 1.1397 ▼ -0.3% GBP/USD 1.3363 ▼ -0.6% USD/JPY 163.28 ▲ +0.6% ================================================================ Generated 2026-07-25 06:06 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================