daily plain-text briefing: security, markets, business, and pittsburgh
Credential thieves close the gap to real-time account takeover by poisoning hotel Wi-Fi and insurance logins, as Cl0p extorts exposed PTC Windchill systems and physical wrench attacks on crypto holders climb.
Latest developments: Rockwell Automation patched code-execution vulnerabilities in its Arena discrete-event simulation software, and SecurityWeek flagged fresh flaws in Siemens ROX II industrial switches, both exposing industrial operators to remote compromise.
Manufacturers running Rockwell Arena simulation software or Siemens ROX II switches face attacker code execution on engineering and network gear; apply the vendor updates and segment industrial control networks from corporate access.
Sources: SecurityWeek · SecurityWeek · ↑ top
Latest developments: The Hacker News laid out the exploitation chain today: Cl0p affiliates pair a pre-authentication information-disclosure flaw in the FlexPLM WSDL endpoint with a server-side bug in the Windchill login servlet to run code without authentication and steal data for extortion.
The Cl0p gang, also tracked as Chubby Scorpius, FIN11, Graceful Spider, and Lace Tempest, is raiding internet-exposed PTC Windchill and FlexPLM product-lifecycle-management servers; operators should pull these instances off the public internet and apply PTC fixes.
Sources: The Hacker News · ↑ top
Latest developments: CTM360 disclosed that insurance-focused phishing has shifted from harvesting credentials for later use to hijacking accounts in real time, relaying each username and password the instant a victim submits it.
Adversary-in-the-middle phishing kits capture and replay insurance and financial customers' logins immediately, defeating one-time codes; defenders need phishing-resistant authentication and rapid session monitoring.
Sources: The Hacker News · ↑ top
Latest developments: Hackers are changing DNS settings on Wi-Fi equipment at hotels and conference centers to route guests to counterfeit Microsoft 365 login pages that harvest credentials, BleepingComputer reported July 24, 2026.
Traveling employees who join a compromised hotel or venue network land on spoofed sign-in pages that capture usernames and passwords; guard against it with a corporate VPN, strict URL checks, and phishing-resistant multifactor authentication.
Sources: BleepingComputer · ↑ top
Latest developments: The Record reported that researchers now count more wrench attacks than ever—home invasions and kidnappings that strong-arm cryptocurrency holders into surrendering their funds.
Criminals increasingly bypass digital defenses and physically coerce known crypto holders into transferring assets; holders should limit public disclosure of their holdings and harden home and travel security.
Sources: The Record · ↑ top
Latest developments: ActiveState argued that slopsquatting, phantom domains, and HalluSquatting all exploit one late-binding weakness—AI coding agents trusting invented package, repository, and domain names—and pushed pre-fetch verification to stop the malicious code before it reaches the pipeline.
Attackers pre-register the package, repo, and domain names that AI assistants hallucinate, so an agent's recommendation pulls hostile dependencies into builds; teams should verify names before fetch and enforce governed dependency management.
Sources: BleepingComputer · ↑ top
Latest developments: The United States halted its air campaign, and neither side attacked for a second straight night while Oman pursued a Strait of Hormuz transit deal.
The United States paused its two-week bombing of Iran, and neither combatant launched attacks for a second consecutive night as Omani mediators worked to reopen safe transit through the Strait of Hormuz, opening a possible off-ramp from a war that had driven oil prices higher.
Today: Mostly Sunny, high 86F.
Tonight: Partly Cloudy, low 66F.
Monday: Partly Sunny then Scattered Showers And Thunderstorms, high 88F.
Latest developments: Pennsylvania authorities charged the driver, alleging he diverted product to flea markets and filed fake invoices to cover it.
A delivery driver who supplied Little Debbie snack cakes to stores across Pennsylvania faces charges for selling the product at flea markets for cash and submitting falsified invoices, KDKA reported.
Latest developments: A Spotlight PA investigation found the new state budget quietly loosened the standards schools must meet to report lead in drinking water.
A provision in Pennsylvania's newly enacted state budget relaxed the reporting standards schools must follow for lead in drinking water, and Spotlight PA reporters concluded the underlying law's problems run deeper than the change, TribLive reported.
Latest developments: A wildfire-smoke plume settled over the region Sunday, July 26, as scattered afternoon thunderstorms returned to the forecast.
Wildfire smoke drifted into the Pittsburgh area Sunday, July 26, though the plume sat roughly 7,000 feet up and spared surface air quality, while scattered thunderstorms threatened after 2 p.m. under highs in the low 80s, KDKA reported.
Latest developments: Ryan Park, a Franklin Regional graduate, earned a Tony Award nomination for his costume work.
Ryan Park, a Franklin Regional Senior High School graduate from Westmoreland County who gravitated to backstage theater work as a student, earned a Tony Award nomination for costume design on 'Lost Boys,' TribLive reported.
Pirates (53-52)
Sat Jul 25 · Cubs 11 · Pirates 0 · Final
Crow-Armstrong powers the Cubs to an 11-0 rout of the Pirates
Up Next · Cubs @ Pirates · Sun Jul 26, 1:35 PM
Latest developments: The Pirates officially signed 2026 first-round pick Derek Curiel, reportedly for a $6.2 million bonus.
The Pittsburgh Pirates signed LSU outfielder Derek Curiel, their 2026 first-round draft pick, to a reported $6.2 million bonus, the Post-Gazette reported, adding the club's top pick to the farm system.
Sources: Post-Gazette Pirates · ↑ top
Latest developments: The Post-Gazette revisited the infamous Jerry Meals safe call 15 years to the day after it happened.
On July 26, 2011, umpire Jerry Meals ruled Atlanta's Julio Lugo safe at the plate in the 19th inning, handing the Braves a 4-3 win over the Pirates, and the Post-Gazette gathered Greg Brown, Michael McKenry, and others to relive one of the most infamous calls in franchise history.
Sources: Post-Gazette Pirates · ↑ top
Latest developments: ESPN detailed a four-day Las Vegas celebration rapper Flavor Flav staged for United States women Olympians.
Rapper Flavor Flav hosted 'She Weekend,' a four-day Las Vegas celebration honoring Team USA's women Olympians, an event ESPN reported left the athletes feeling seen, celebrated, and connected.
Sources: ESPN Olympics · ↑ top
S&P 500 7,454.34 ▼ -0.9% Dow 51,988.28 ▼ -0.9% Nasdaq 25,429.94 ▼ -1.9% WTI crude 87.29 ▲ +9.5% EUR/USD 1.1397 ▼ -0.3% GBP/USD 1.3389 ▼ -0.3% USD/JPY 163.28 ▲ +0.6%