================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Sunday, July 26, 2026 - 9:06 AM EDT ================================================================ Credential thieves close the gap to real-time account takeover by poisoning hotel Wi-Fi and insurance logins, as Cl0p extorts exposed PTC Windchill systems and physical wrench attacks on crypto holders climb. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Attackers are compressing credential theft into real time, hijacking hotel Wi-Fi DNS to serve fake Microsoft 365 pages and relaying insurance customers' logins the instant they submit them. see: Hotel Wi-Fi DNS Hijacking Steals Microsoft 365 Logins; Insurance Phishing Turns Into Real-Time Account Hijacking * [TREND] AI coding agents have become a soft target, trusting hallucinated package and domain names that attackers pre-register to slip malicious code into build pipelines. see: AI Coding Agents Trust Hallucinated Packages * [TREND] Cybercrime keeps spilling into the physical world as researchers tally record wrench attacks—home invasions and kidnappings forcing cryptocurrency holders to surrender their keys. see: Wrench Attacks on Cryptocurrency Holders Rise * [UPDATE (new)] Enterprise exploitation widened as Rockwell and Siemens patched industrial control flaws while Cl0p detailed a Windchill and FlexPLM chain to run code without authentication. see: Rockwell and Siemens Patch Industrial Control Flaws; Cl0p Details Windchill and FlexPLM Extortion Chain * [UPDATE (new)] Around Pittsburgh, wildfire smoke and storms settled over the region as a Spotlight PA probe found the state budget quietly loosened school lead-reporting rules. see: Wildfire Smoke and Storms Over Pittsburgh; Pennsylvania Budget Relaxed School Lead Rules * [UPDATE (new)] The Pirates officially signed 2026 first-round pick Derek Curiel for a reported $6.2 million bonus. see: Pirates Sign First-Rounder Derek Curiel SECURITY ---------------------------------------------------------------- 1. ROCKWELL AND SIEMENS PATCH INDUSTRIAL CONTROL FLAWS Vulnerabilities and Exploits · [patch, ics, rce] Latest developments: Rockwell Automation patched code-execution vulnerabilities in its Arena discrete-event simulation software, and SecurityWeek flagged fresh flaws in Siemens ROX II industrial switches, both exposing industrial operators to remote compromise. Manufacturers running Rockwell Arena simulation software or Siemens ROX II switches face attacker code execution on engineering and network gear; apply the vendor updates and segment industrial control networks from corporate access. - SecurityWeek: https://www.securityweek.com/rockwell-patches-code-execution-flaws-in-arena-simulation-software/ - SecurityWeek: https://www.securityweek.com/in-other-news-dolphin-x-ai-powered-malware-car-anti-theft-device-hack-400-linux-kernel-flaws/ 2. CL0P DETAILS WINDCHILL AND FLEXPLM EXTORTION CHAIN Ransomware and Cybercrime · [ransomware, extortion, rce] Latest developments: The Hacker News laid out the exploitation chain today: Cl0p affiliates pair a pre-authentication information-disclosure flaw in the FlexPLM WSDL endpoint with a server-side bug in the Windchill login servlet to run code without authentication and steal data for extortion. The Cl0p gang, also tracked as Chubby Scorpius, FIN11, Graceful Spider, and Lace Tempest, is raiding internet-exposed PTC Windchill and FlexPLM product-lifecycle-management servers; operators should pull these instances off the public internet and apply PTC fixes. - The Hacker News: https://thehackernews.com/2026/07/cl0p-affiliates-target-internet-exposed.html 3. INSURANCE PHISHING TURNS INTO REAL-TIME ACCOUNT HIJACKING Ransomware and Cybercrime · [phishing, credential-theft] Latest developments: CTM360 disclosed that insurance-focused phishing has shifted from harvesting credentials for later use to hijacking accounts in real time, relaying each username and password the instant a victim submits it. Adversary-in-the-middle phishing kits capture and replay insurance and financial customers' logins immediately, defeating one-time codes; defenders need phishing-resistant authentication and rapid session monitoring. - The Hacker News: https://thehackernews.com/2026/07/ctm360-research-reveals-how-insurance.html 4. HOTEL WI-FI DNS HIJACKING STEALS MICROSOFT 365 LOGINS Ransomware and Cybercrime · [phishing, credential-theft] Latest developments: Hackers are changing DNS settings on Wi-Fi equipment at hotels and conference centers to route guests to counterfeit Microsoft 365 login pages that harvest credentials, BleepingComputer reported July 24, 2026. Traveling employees who join a compromised hotel or venue network land on spoofed sign-in pages that capture usernames and passwords; guard against it with a corporate VPN, strict URL checks, and phishing-resistant multifactor authentication. - BleepingComputer: https://www.bleepingcomputer.com/news/security/hackers-hijack-hotel-wi-fi-dns-to-steal-microsoft-365-accounts/ 5. WRENCH ATTACKS ON CRYPTOCURRENCY HOLDERS RISE Ransomware and Cybercrime · [cryptocurrency, physical-security] Latest developments: The Record reported that researchers now count more wrench attacks than ever—home invasions and kidnappings that strong-arm cryptocurrency holders into surrendering their funds. Criminals increasingly bypass digital defenses and physically coerce known crypto holders into transferring assets; holders should limit public disclosure of their holdings and harden home and travel security. - The Record: https://therecord.media/wrench-attacks-against-cryptocurrency-holders 6. AI CODING AGENTS TRUST HALLUCINATED PACKAGES AI Security · [ai, supply-chain] Latest developments: ActiveState argued that slopsquatting, phantom domains, and HalluSquatting all exploit one late-binding weakness—AI coding agents trusting invented package, repository, and domain names—and pushed pre-fetch verification to stop the malicious code before it reaches the pipeline. Attackers pre-register the package, repo, and domain names that AI assistants hallucinate, so an agent's recommendation pulls hostile dependencies into builds; teams should verify names before fetch and enforce governed dependency management. - BleepingComputer: https://www.bleepingcomputer.com/news/security/slopsquatting-phantom-domains-and-hallusquatting-are-the-same-ai-attack/ BUSINESS AND POLITICS ---------------------------------------------------------------- * U.S. Pauses Iran Strikes as Oman Brokers Hormuz Deal Latest developments: The United States halted its air campaign, and neither side attacked for a second straight night while Oman pursued a Strait of Hormuz transit deal. The United States paused its two-week bombing of Iran, and neither combatant launched attacks for a second consecutive night as Omani mediators worked to reopen safe transit through the Strait of Hormuz, opening a possible off-ramp from a war that had driven oil prices higher. - FT World: https://www.ft.com/content/ffdeacf0-91b8-48fd-9ff8-d8d134ef5f11?syn-25a6b1a6=1 PITTSBURGH ---------------------------------------------------------------- Weather: Today: Mostly Sunny, high 86F. Tonight: Partly Cloudy, low 66F. Monday: Partly Sunny then Scattered Showers And Thunderstorms, high 88F. Business: * Little Debbie Driver Charged in Snack Fraud Latest developments: Pennsylvania authorities charged the driver, alleging he diverted product to flea markets and filed fake invoices to cover it. A delivery driver who supplied Little Debbie snack cakes to stores across Pennsylvania faces charges for selling the product at flea markets for cash and submitting falsified invoices, KDKA reported. - KDKA: https://www.cbsnews.com/pittsburgh/video/little-debbie-snack-delivery-driver-charged-in-fraud-scheme/ Around town: * Pennsylvania Budget Relaxed School Lead Rules Latest developments: A Spotlight PA investigation found the new state budget quietly loosened the standards schools must meet to report lead in drinking water. A provision in Pennsylvania's newly enacted state budget relaxed the reporting standards schools must follow for lead in drinking water, and Spotlight PA reporters concluded the underlying law's problems run deeper than the change, TribLive reported. - TribLive: https://triblive.com/news/pennsylvania/pa-budget-quietly-relaxed-lead-reporting-standards-for-schools-issues-with-law-go-much-deeper/ * Wildfire Smoke and Storms Over Pittsburgh Latest developments: A wildfire-smoke plume settled over the region Sunday, July 26, as scattered afternoon thunderstorms returned to the forecast. Wildfire smoke drifted into the Pittsburgh area Sunday, July 26, though the plume sat roughly 7,000 feet up and spared surface air quality, while scattered thunderstorms threatened after 2 p.m. under highs in the low 80s, KDKA reported. - KDKA: https://www.cbsnews.com/pittsburgh/news/wildfire-smoke-pittsburgh-weather-forecast-sunday/ * Franklin Regional Grad Earns Tony Nomination Latest developments: Ryan Park, a Franklin Regional graduate, earned a Tony Award nomination for his costume work. Ryan Park, a Franklin Regional Senior High School graduate from Westmoreland County who gravitated to backstage theater work as a student, earned a Tony Award nomination for costume design on 'Lost Boys,' TribLive reported. - TribLive: https://triblive.com/local/westmoreland/franklin-regional-grad-earns-tony-award-nomination-for-lost-boys-costumes/ SPORTS ---------------------------------------------------------------- Pirates (53-52) Sat Jul 25 · Cubs 11 · Pirates 0 · Final Crow-Armstrong powers the Cubs to an 11-0 rout of the Pirates https://plaintextsports.com/mlb/2026-07-25/chc-pit Up Next · Cubs @ Pirates · Sun Jul 26, 1:35 PM https://plaintextsports.com/mlb/2026-07-26/chc-pit Around the Teams: * Pirates Sign First-Rounder Derek Curiel Latest developments: The Pirates officially signed 2026 first-round pick Derek Curiel, reportedly for a $6.2 million bonus. The Pittsburgh Pirates signed LSU outfielder Derek Curiel, their 2026 first-round draft pick, to a reported $6.2 million bonus, the Post-Gazette reported, adding the club's top pick to the farm system. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/07/26/derek-curiel-pirates-mlb-draft/stories/202607250045 * Revisiting the Jerry Meals Call Latest developments: The Post-Gazette revisited the infamous Jerry Meals safe call 15 years to the day after it happened. On July 26, 2011, umpire Jerry Meals ruled Atlanta's Julio Lugo safe at the plate in the 19th inning, handing the Braves a 4-3 win over the Pirates, and the Post-Gazette gathered Greg Brown, Michael McKenry, and others to relive one of the most infamous calls in franchise history. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/07/24/jerry-meals-game-greg-brown-mckenry-lugo-mccutchen/stories/202607240031 Team USA: * Flavor Flav Fetes Team USA's Women Olympians Latest developments: ESPN detailed a four-day Las Vegas celebration rapper Flavor Flav staged for United States women Olympians. Rapper Flavor Flav hosted 'She Weekend,' a four-day Las Vegas celebration honoring Team USA's women Olympians, an event ESPN reported left the athletes feeling seen, celebrated, and connected. - ESPN Olympics: https://www.espn.com/olympics/story/_/id/49388157/she-weekend-las-vegas-flavor-flav-team-usa-womens READING ---------------------------------------------------------------- * Ed Zitron -- Premium: The Hater's Guide To Oracle (Part 2) In the second part of his Oracle takedown, Ed Zitron argues the company's popular reputation as incredibly profitable and fast-growing rests on mythology rather than its actual financials. https://www.wheresyoured.at/premium-the-haters-guide-to-oracle-part-2/ * Stratechery -- OpenAI Hacks Hugging Face, What Happened, Alignment and Paper Clips Ben Thompson recounts how OpenAI accidentally 'hacked' Hugging Face and argues the alignment lessons of the episode are more encouraging than alarmed observers assume. https://stratechery.com/2026/openai-hacks-hugging-face-what-happened-alignment-and-paper-clips/ * Cal Newport -- Why Reading Matters Cal Newport responds to Rose Horowitch's Atlantic article 'The End of Reading Is Here,' making the case for why sustained, deep reading still matters. https://calnewport.com/why-reading-matters/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,454.34 ▼ -0.9% Dow 51,988.28 ▼ -0.9% Nasdaq 25,429.94 ▼ -1.9% WTI crude 87.29 ▲ +9.5% EUR/USD 1.1397 ▼ -0.3% GBP/USD 1.3389 ▼ -0.3% USD/JPY 163.28 ▲ +0.6% ================================================================ Generated 2026-07-26 09:06 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================