daily plain-text briefing: security, markets, business, and pittsburgh
Attackers race to exploit an unpatched Fastjson flaw in Java applications while a threat actor turns the open-source Hermes agent loose on Thailand's finance ministry.
Latest developments: ThreatBook and Imperva reported on July 25 that attackers are exploiting CVE-2026-16723 in the wild, and Alibaba has shipped no patch.
Fastjson, Alibaba's JSON library for Java, carries a critical flaw that lets a malicious JSON request run code without authentication in affected Spring Boot applications, executing with the Java process's privileges; Alibaba rates it CVSS 9.0. Organizations running Fastjson 1.x should restrict exposure and monitor for exploitation until a fix arrives.
Sources: The Hacker News · ↑ top
Latest developments: Researchers at depthfirst published working exploit code on July 24 for a GitLab flaw that GitLab patched on June 10, letting any authenticated user who can push to a project run commands as git on self-managed 18.11.3 servers that skipped the update.
The attacker commits a crafted Jupyter notebook and opens its commit diff, leaking heap memory to reach code execution as the git user. Administrators of self-managed GitLab should apply the June 10 update immediately.
Sources: The Hacker News · ↑ top
Latest developments: BleepingComputer detailed a massive malvertising campaign on July 25 that serves counterfeit Solana, Luno, and TradingView pages whose JavaScript instructs the browser to assemble malware directly in memory.
The operation lures victims to fake cryptocurrency and trading sites, where in-browser JavaScript builds the payload in memory to dodge disk-based detection. Users should avoid ads promising crypto tools and verify domains before entering anything.
Sources: BleepingComputer · ↑ top
Latest developments: BleepingComputer reported on July 25 that scammers are mining email addresses from breaches ShinyHunters leaked to send sextortion emails demanding $2,000 in Bitcoin.
The campaign pairs victims' real email addresses from ShinyHunters-leaked breaches with threats to expose fabricated compromising material, extorting $2,000 in Bitcoin per target. Recipients should ignore and report the messages and rotate any exposed passwords.
Sources: BleepingComputer · ↑ top
Latest developments: BleepingComputer reported on July 24 that a threat actor drove the open-source Hermes AI agent in unattended 'YOLO' mode to automate post-exploitation during an alleged breach of Thailand's Ministry of Finance.
Hermes, an open-source autonomous agent, ran attacker commands after an intrusion into the Thai Ministry of Finance, marking offensive use of agentic AI against a government target. Defenders should watch for agent-driven, high-speed post-exploitation on sensitive networks.
Sources: BleepingComputer · ↑ top
Latest developments: OnTrac began notifying customers on July 24 that hackers breached its corporate network and may have accessed their personal details.
OnTrac, a regional parcel-delivery carrier, says intruders reached its corporate network and possibly took customer personal information. Affected customers should watch for fraud and phishing tied to their delivery accounts.
Sources: BleepingComputer · ↑ top
Latest developments: American forces struck deeper inside Iran—hitting bridges and infrastructure in the south and near Tehran's outskirts—as President Trump signaled faster strikes and Yemen's Houthis fired missiles and drones at Saudi Arabia in retaliation for strikes on Hodeidah.
The United States and Iran remain locked in a widening cycle of retaliation that has spread across the Gulf, with Saudi Arabia now trading blows with the Iran-backed Houthis and oil prices climbing high enough that investors call next week's Federal Reserve meeting live for a rate increase.
Sources: WSJ World News · FT World · ↑ top
This Afternoon: Mostly Sunny, high 83F.
Tonight: Mostly Clear then Patchy Fog, low 63F.
Sunday: Patchy Fog then Mostly Sunny, high 86F.
Latest developments: Jim Crockard, a longtime Pirates fan from Sewickley, received an abrupt July 6 email from the Pittsburgh Pirates and is now crying foul over the team's stance on reselling tickets, TribLive reported.
The Pittsburgh Pirates' policy restricting how season-ticket holders resell their seats has drawn a public complaint from a longtime Sewickley fan, spotlighting friction between the club and its ticket base at PNC Park.
Latest developments: Allegheny County Executive Sara Innamorato announced Friday a $6 million investment in two housing initiatives under her 'Housing for All' executive order.
Allegheny County Executive Sara Innamorato is directing $6 million toward two housing programs as part of the Housing for All order she signed, steering county money into affordable-housing efforts across the region.
Pirates (53-51)
Fri Jul 24 · Cubs 3 · Pirates 2 · Final (10)
Dansby Swanson's two-out single in the 10th inning, Boyd's strong outing lift Cubs over Pirates 3-2
Up Next · Cubs @ Pirates · Sat Jul 25, 6:40 PM
Latest developments: The Post-Gazette's camp countdown argued Troy Fautanu's move to a new spot on the offensive line will prove critical to the Steelers' 2026 offense and to protecting quarterback Aaron Rodgers.
The Post-Gazette cast Steelers lineman Troy Fautanu's switch, part of a reshuffled front alongside guard Mason McCormick, as a make-or-break factor in keeping Aaron Rodgers upright and the offense functioning.
Sources: Post-Gazette Steelers · ↑ top
Latest developments: Sha'Carri Richardson and Noah Lyles surged to victory in the 100-meter finals at the U.S. track and field championships, converting their first-round heats into national titles.
American sprinters Sha'Carri Richardson and Noah Lyles both won the 100 meters at the U.S. championships, cementing their standing as the country's fastest and setting the stage for the summer's global meets.
Sources: ESPN Olympics · ↑ top
Latest developments: United States women's national team defender Emily Sonnett was stretchered off in the opening minutes of Gotham FC's 2-2 draw with the Portland Thorns on Friday after a non-contact knee injury.
Emily Sonnett, a USWNT defender, went down with an apparent non-contact knee injury early in Gotham FC's National Women's Soccer League draw against the Portland Thorns, raising concern about her availability with one year until the 2027 Women's World Cup.
Sources: ESPN Soccer · ↑ top
S&P 500 7,454.34 ▼ -0.9% Dow 51,988.28 ▼ -0.9% Nasdaq 25,429.94 ▼ -1.9% WTI crude 87.29 ▲ +9.5% EUR/USD 1.1397 ▼ -0.3% GBP/USD 1.3363 ▼ -0.6% USD/JPY 163.28 ▲ +0.6%