daily plain-text briefing: security, markets, business, and pittsburgh
Attackers handed hands-on-keyboard intrusion work to an unattended AI agent inside Thailand's finance ministry as a browser-built malvertising wave and an unpatched Fastjson flaw drew live exploitation.
Latest developments: Confiant detailed SourTrade on July 23, 2026, a malvertising operation running since late 2024 that impersonates TradingView, Solana, and Luno and makes victims' browsers assemble the final Windows executable from pieces using the legitimate Bun runtime, defeating scanners that expect one complete malicious file at a fixed URL.
SourTrade targets retail cryptocurrency traders through fake ad-driven pages whose JavaScript builds malware directly in browser memory. Block the impersonated domains and flag unexpected Bun runtime execution on endpoints.
Sources: The Hacker News · BleepingComputer · ↑ top
Latest developments: PRODAFT exposed a centralized DevMan ransomware-as-a-service portal it tracks as Funky Mantis, where affiliates build payloads, manage victims, and track payouts, while the Golden Chickens malware-as-a-service crew resurfaced with four new families: TinyEgg, ChonkyChicken, a modular ChonkyChicken variant, and a reworked browser-credential stealer.
Both operations sell turnkey attack infrastructure to affiliates, lowering the bar for ransomware and credential theft. Monitor for the named families and treat commodity service portals as active threats.
Sources: The Hacker News · The Hacker News · ↑ top
Latest developments: ThreatBook and Imperva report attackers exploiting CVE-2026-16723, a 9.0-rated flaw in Alibaba's Fastjson Java library, where a single malicious JSON request runs code without authentication at the privileges of the Java process, and no fix is yet available.
Fastjson parses JSON inside countless Spring Boot applications, exposing affected servers to unauthenticated remote code execution. Filter untrusted JSON, apply Alibaba's mitigations, and move off the 1.x branch.
Sources: The Hacker News · ↑ top
Latest developments: A threat actor installed the open-source Hermes AI agent on a rented server, switched off its permission prompts, and ran it in unattended "YOLO" mode to automate post-exploitation across Thailand's Ministry of Finance, checking hosts for root, hunting through file systems, and working the treasury-and-tax network on its own.
The Ministry of Finance runs Thailand's treasury and tax collection, and the case marks attackers handing live intrusion work to a commodity AI agent. Restrict outbound access from AI tooling and treat agent activity as privileged.
Sources: BleepingComputer · The Hacker News · ↑ top
Latest developments: XBOW showed that a crafted SVG submitted to Bing's image search ran commands as NT AUTHORITY\SYSTEM on Microsoft's production image-processing workers and as root on the Linux machines in the same fleet, prompting Microsoft to issue two critical CVEs, including CVE-2026-32194.
The flaws sat in Bing's image-processing tier, letting attacker-controlled SVG files execute at the highest privilege across Microsoft's server fleet. Microsoft has patched its infrastructure, so customers need take no action.
Sources: The Hacker News · ↑ top
Latest developments: Researchers found the North Korean group BlueNoroff running an active phishing kit that impersonates Zoom and Microsoft Teams through typosquatted domains and profiles a target's cryptocurrency wallets before it delivers malware.
BlueNoroff blends compromised industry contacts with ClickFix-style social engineering to steal from crypto holders. Verify meeting links out of band and block typosquatted videoconferencing domains.
Sources: The Hacker News · ↑ top
Latest developments: Investors sharply raised bets on a Federal Reserve rate increase after the US-Iran war drove oil prices up, and they now call next week's Fed meeting "live."
The energy-price spike from the conflict with Iran has revived US inflation fears, pushing markets to price in a possible interest-rate increase when the Federal Reserve meets next week, a reversal from earlier expectations of steady or falling rates.
Sources: FT Markets · ↑ top
Today: Patchy Fog then Mostly Sunny, high 86F.
Tonight: Partly Cloudy, low 66F.
Monday: Partly Sunny then Scattered Showers And Thunderstorms, high 88F.
Latest developments: United Airlines is removing some middle seats as it reconfigures cabins, a move driven by premium-seating economics rather than passenger comfort.
United Airlines is cutting some middle seats to make room for higher-margin premium seating, the Pittsburgh Post-Gazette reported, reshaping the cabin layout on a carrier that flies out of Pittsburgh International Airport.
Sources: Pittsburgh Post-Gazette · ↑ top
Latest developments: Pittsburgh officials are searching for a response to large, spontaneous teen gatherings that have repeatedly formed in public spaces across the city.
The Pittsburgh Post-Gazette reported that the city is grappling with mass teen gatherings, weighing curfews and other measures as leaders look for a way to manage the crowds.
Sources: Pittsburgh Post-Gazette · ↑ top
Latest developments: The Pittsburgh region is on pace to set an annual record for tornadoes after a summer of repeated severe storms, the Post-Gazette reported.
Western Pennsylvania has logged an unusual number of tornadoes this year, and the Pittsburgh Post-Gazette reported the region could break its annual record, with more storms forecast into next week.
Sources: Pittsburgh Post-Gazette · ↑ top
Pirates (53-52)
Sat Jul 25 · Cubs 11 · Pirates 0 · Final
Crow-Armstrong powers the Cubs to an 11-0 rout of the Pirates
Up Next · Cubs @ Pirates · Sun Jul 26, 1:35 PM
Latest developments: The Post-Gazette's training-camp countdown cast newly added receiver Michael Pittman Jr. as a key to opening up Mike McCarthy's passing attack.
The Pittsburgh Post-Gazette's Steelers camp countdown argued wideout Michael Pittman Jr. gives quarterback Aaron Rodgers a big possession target opposite DK Metcalf, a fit central to head coach Mike McCarthy's offense as camp opens in Latrobe.
Sources: Post-Gazette Steelers · ↑ top
Latest developments: Barcelona signed American goalkeeper Tyler McCamey for its European-champion women's team, the Spanish club announced July 25.
Barcelona, the reigning European women's champion, added United States goalkeeper Tyler McCamey to its roster, giving the young American a place at one of the sport's biggest clubs.
Sources: ESPN Soccer · ↑ top
Latest developments: With one year until the 2027 Women's World Cup final, ESPN weighed five reasons the United States women's national team will or won't reach it.
ESPN marked the one-year countdown to the 2027 Women's World Cup final by assessing the United States women's national team's path, laying out arguments for and against a US run to the title match.
Sources: ESPN Soccer · ↑ top
S&P 500 7,454.34 ▼ -0.9% Dow 51,988.28 ▼ -0.9% Nasdaq 25,429.94 ▼ -1.9% WTI crude 87.29 ▲ +9.5% EUR/USD 1.1397 ▼ -0.3% GBP/USD 1.3389 ▼ -0.3% USD/JPY 163.28 ▲ +0.6%