daily plain-text briefing: security, markets, business, and pittsburgh
Attackers reinvented delivery this week—fragmenting malware for the browser to reassemble and handing live intrusions to autonomous AI agents—while an unpatched Fastjson flaw came under active exploitation.
Latest developments: GitHub and PyPI added a time-based mechanism to the Dependabot dependency tool on July 26, 2026, delaying adoption of freshly published package versions to blunt supply-chain attacks and limit their spread.
The cooldown gives maintainers and scanners a window to catch a malicious release before projects pull it automatically. Developers who rely on Dependabot gain a buffer against poisoned updates.
Sources: BleepingComputer · ↑ top
Latest developments: Confiant detailed SourTrade on July 23, 2026, a malvertising operation that since late 2024 has impersonated TradingView, Solana, and Luno to feed retail traders malware in fragments that the victim's own browser assembles into a Windows executable atop a legitimate Bun runtime.
The technique defeats scanners that hunt one complete malicious file at a fixed URL, since no single download carries the payload. Retail traders landing on fake trading sites should distrust browser-driven downloads and installer prompts.
Sources: The Hacker News · BleepingComputer · ↑ top
Latest developments: ThreatBook and Imperva reported July 25, 2026 that attackers are exploiting CVE-2026-16723, a critical remote-code-execution flaw in Alibaba's Fastjson 1.x Java library, before any patch exists.
Fastjson 1.x parses JSON in Java; on affected Spring Boot applications a malicious JSON request runs code without authentication at the privileges of the Java process, and Alibaba assigns the flaw a CVSS score of 9.0. Teams still running Fastjson 1.x should isolate or replace it since no fix ships.
Sources: The Hacker News · ↑ top
Latest developments: PRODAFT disclosed July 25, 2026 that the DevMan ransomware-as-a-service operation, which it tracks as Funky Mantis, runs a single web portal that builds payloads, manages victims, and handles affiliate payouts.
The portal lowers the skill floor for affiliates by folding build generation, victim management, and finance into one console. Defenders now face a professionalized DevMan operation that scales through its recruits.
Sources: The Hacker News · ↑ top
Latest developments: A threat actor ran the open-source Hermes AI agent in unattended "YOLO" mode to automate post-exploitation during an alleged breach of Thailand's Ministry of Finance, BleepingComputer reported July 24, 2026.
Hermes acts on its own once given a foothold, chaining reconnaissance and lateral movement without an operator at the keyboard. The case shows criminals wiring off-the-shelf AI agents directly into live intrusions.
Sources: BleepingComputer · ↑ top
Latest developments: OnTrac, the regional parcel-delivery carrier, began notifying customers on July 24, 2026 that intruders breached its corporate network and may have reached their personal details.
OnTrac has not yet detailed the exposed data or named the attacker. Customers should watch for fraud and phishing that leans on their delivery-account information.
Sources: BleepingComputer · ↑ top
This Afternoon: Partly Sunny, high 85F.
Tonight: Chance Showers And Thunderstorms then Partly Cloudy, low 66F.
Monday: Partly Sunny then Slight Chance Showers And Thunderstorms, high 88F.
Latest developments: United Airlines disclosed it will pull middle seats from part of its fleet, and the Post-Gazette reports cabin economics, rather than passenger distaste, drive the move.
United Airlines plans to reconfigure sections of its aircraft to eliminate certain middle seats, a change the carrier ties to the math of premium and extra-legroom seating rather than to travelers' well-known dislike of the middle.
Sources: Pittsburgh Post-Gazette · ↑ top
Latest developments: Forecasters posted a Severe Weather Alert Day for Monday night into Tuesday, July 27 and 28, with rounds of storms crossing western Pennsylvania over three days as another wildfire-smoke plume drifted about 7,000 feet above the region Sunday.
Meteorologists at WTAE and KDKA warned of repeated thunderstorms across western Pennsylvania through midweek, flagging Monday night into Tuesday as the sharpest threat, while a high-altitude wildfire-smoke plume hazed Pittsburgh skies Sunday without fouling surface air quality the way the Code Purple smoke did earlier in July.
Sources: Pittsburgh Post-Gazette · WTAE · ↑ top
Latest developments: The Post-Gazette detailed why the Pittsburgh region stands on the verge of setting an annual record for tornadoes after a summer of repeated touchdowns across western Pennsylvania.
Western Pennsylvania is tracking toward the most tornadoes ever recorded in a single year, the Post-Gazette reported, after the National Weather Service confirmed a string of touchdowns across counties including Westmoreland and Jefferson during this month's storms.
Sources: Pittsburgh Post-Gazette · ↑ top
Latest developments: The Post-Gazette examined how Pittsburgh officials are searching for answers to the mass teen gatherings, or takeovers, that have drawn large crowds downtown and prompted the new Market Square youth curfew.
Pittsburgh leaders are hunting for a response to spontaneous mass gatherings of teenagers around Market Square and downtown, the Post-Gazette reported, weighing options after the city imposed a youth curfew that now faces its own legal challenge.
Sources: Pittsburgh Post-Gazette · ↑ top
Pirates (53-52)
Sat Jul 25 · Cubs 11 · Pirates 0 · Final
Crow-Armstrong powers the Cubs to an 11-0 rout of the Pirates
Up Next · Cubs @ Pirates · Sun Jul 26, 1:35 PM
Latest developments: The Post-Gazette's training-camp countdown argued Sunday that receiver Michael Pittman Jr. can open up Mike McCarthy's passing attack.
The Post-Gazette's Steelers camp countdown cast newly added wideout Michael Pittman Jr. as a reliable possession target who can stretch Mike McCarthy's offense and give quarterback Aaron Rodgers a dependable option opposite DK Metcalf as Latrobe camp nears.
Sources: Post-Gazette Steelers · ↑ top
Latest developments: ESPN, at the one-year mark before the 2027 Women's World Cup final, laid out five reasons the United States women's national team will or will not reach it.
With exactly one year remaining until the 2027 Women's World Cup final, ESPN weighed the case for and against a United States women's national team return to the title game, assessing its form, depth, and rivals as the tournament approaches.
Sources: ESPN Soccer · ↑ top
Latest developments: Barcelona signed American goalkeeper Tyler McCamey for its women's team, the reigning European champions, the club announced Saturday.
FC Barcelona added United States goalkeeper Tyler McCamey to the roster of its women's side, winners of the European title, in a move giving another American a place at one of the sport's dominant clubs.
Sources: ESPN Soccer · ↑ top
S&P 500 7,454.34 ▼ -0.9% Dow 51,988.28 ▼ -0.9% Nasdaq 25,429.94 ▼ -1.9% WTI crude 87.29 ▲ +9.5% EUR/USD 1.1397 ▼ -0.3% GBP/USD 1.3389 ▼ -0.3% USD/JPY 163.28 ▲ +0.6%