================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Sunday, July 26, 2026 - 12:05 PM EDT ================================================================ Attackers reinvented delivery this week—fragmenting malware for the browser to reassemble and handing live intrusions to autonomous AI agents—while an unpatched Fastjson flaw came under active exploitation. CONTENTS: Emerging Trends and Key Updates | Security | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Criminals are wiring autonomous agents like Hermes into live intrusions against Thailand's finance ministry, while OpenAI's accidental compromise of Hugging Face reframes the AI alignment debate. see: Hermes AI Agent Automates Ministry Breach; OpenAI Hacks Hugging Face, What Happened, Alignment and Paper Clips * [TREND] Attackers are exploiting an unpatched Fastjson RCE, running the DevMan ransomware-as-a-service portal, and using SourTrade malvertising to assemble malware inside victims' own browsers. see: Unpatched Fastjson RCE Under Active Exploitation; DevMan RaaS Portal Centralizes Affiliate Operations; SourTrade Malvertising Builds Malware in the Browser * [UPDATE (new)] GitHub and PyPI taught Dependabot to delay adopting freshly published package versions, adding a time-based brake on supply-chain poisoning. see: GitHub and PyPI Add Time-Based Supply-Chain Defenses * [UPDATE (new)] OnTrac began notifying customers that intruders breached its corporate network and may have reached their personal details. see: OnTrac Breach Exposes Customer Data * [TREND] Western Pennsylvania faces Severe Weather Alert days of repeated storms this week even as the region nears an annual tornado record. see: Severe Weather Days This Week; Region Nears Tornado Record SECURITY ---------------------------------------------------------------- 1. GITHUB AND PYPI ADD TIME-BASED SUPPLY-CHAIN DEFENSES Vulnerabilities and Exploits · [supply-chain, patch] Latest developments: GitHub and PyPI added a time-based mechanism to the Dependabot dependency tool on July 26, 2026, delaying adoption of freshly published package versions to blunt supply-chain attacks and limit their spread. The cooldown gives maintainers and scanners a window to catch a malicious release before projects pull it automatically. Developers who rely on Dependabot gain a buffer against poisoned updates. - BleepingComputer: https://www.bleepingcomputer.com/news/security/github-pypi-add-time-absed-defenses-against-supply-chain-attacks/ 2. SOURTRADE MALVERTISING BUILDS MALWARE IN THE BROWSER Ransomware and Cybercrime · [malvertising, malware] Latest developments: Confiant detailed SourTrade on July 23, 2026, a malvertising operation that since late 2024 has impersonated TradingView, Solana, and Luno to feed retail traders malware in fragments that the victim's own browser assembles into a Windows executable atop a legitimate Bun runtime. The technique defeats scanners that hunt one complete malicious file at a fixed URL, since no single download carries the payload. Retail traders landing on fake trading sites should distrust browser-driven downloads and installer prompts. - The Hacker News: https://thehackernews.com/2026/07/malvertising-sends-malware-in-pieces.html - BleepingComputer: https://www.bleepingcomputer.com/news/security/malicious-sites-use-javascript-to-build-malware-in-browser-memory/ 3. UNPATCHED FASTJSON RCE UNDER ACTIVE EXPLOITATION Vulnerabilities and Exploits · [zero-day, rce, exploit] Latest developments: ThreatBook and Imperva reported July 25, 2026 that attackers are exploiting CVE-2026-16723, a critical remote-code-execution flaw in Alibaba's Fastjson 1.x Java library, before any patch exists. Fastjson 1.x parses JSON in Java; on affected Spring Boot applications a malicious JSON request runs code without authentication at the privileges of the Java process, and Alibaba assigns the flaw a CVSS score of 9.0. Teams still running Fastjson 1.x should isolate or replace it since no fix ships. - The Hacker News: https://thehackernews.com/2026/07/fastjson-1x-rce-vulnerability-targeted.html 4. DEVMAN RAAS PORTAL CENTRALIZES AFFILIATE OPERATIONS Ransomware and Cybercrime · [ransomware, raas] Latest developments: PRODAFT disclosed July 25, 2026 that the DevMan ransomware-as-a-service operation, which it tracks as Funky Mantis, runs a single web portal that builds payloads, manages victims, and handles affiliate payouts. The portal lowers the skill floor for affiliates by folding build generation, victim management, and finance into one console. Defenders now face a professionalized DevMan operation that scales through its recruits. - The Hacker News: https://thehackernews.com/2026/07/devman-raas-portal-centralizes-payload.html 5. HERMES AI AGENT AUTOMATES MINISTRY BREACH AI Security · [ai, breach] Latest developments: A threat actor ran the open-source Hermes AI agent in unattended "YOLO" mode to automate post-exploitation during an alleged breach of Thailand's Ministry of Finance, BleepingComputer reported July 24, 2026. Hermes acts on its own once given a foothold, chaining reconnaissance and lateral movement without an operator at the keyboard. The case shows criminals wiring off-the-shelf AI agents directly into live intrusions. - BleepingComputer: https://www.bleepingcomputer.com/news/security/hermes-ai-agent-used-to-automate-attack-on-thai-finance-ministry/ 6. ONTRAC BREACH EXPOSES CUSTOMER DATA Data Breaches · [breach] Latest developments: OnTrac, the regional parcel-delivery carrier, began notifying customers on July 24, 2026 that intruders breached its corporate network and may have reached their personal details. OnTrac has not yet detailed the exposed data or named the attacker. Customers should watch for fraud and phishing that leans on their delivery-account information. - BleepingComputer: https://www.bleepingcomputer.com/news/security/ontrac-notifies-customers-of-data-breach-after-network-hack/ PITTSBURGH ---------------------------------------------------------------- Weather: This Afternoon: Partly Sunny, high 85F. Tonight: Chance Showers And Thunderstorms then Partly Cloudy, low 66F. Monday: Partly Sunny then Slight Chance Showers And Thunderstorms, high 88F. Business: * United to Drop Some Middle Seats Latest developments: United Airlines disclosed it will pull middle seats from part of its fleet, and the Post-Gazette reports cabin economics, rather than passenger distaste, drive the move. United Airlines plans to reconfigure sections of its aircraft to eliminate certain middle seats, a change the carrier ties to the math of premium and extra-legroom seating rather than to travelers' well-known dislike of the middle. - Pittsburgh Post-Gazette: https://www.post-gazette.com/business/money/2026/07/25/airline-passengers-hate-middle-seats-united/stories/202607250006 Around town: * Severe Weather Days This Week Latest developments: Forecasters posted a Severe Weather Alert Day for Monday night into Tuesday, July 27 and 28, with rounds of storms crossing western Pennsylvania over three days as another wildfire-smoke plume drifted about 7,000 feet above the region Sunday. Meteorologists at WTAE and KDKA warned of repeated thunderstorms across western Pennsylvania through midweek, flagging Monday night into Tuesday as the sharpest threat, while a high-altitude wildfire-smoke plume hazed Pittsburgh skies Sunday without fouling surface air quality the way the Code Purple smoke did earlier in July. - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/weather-news/2026/07/26/pittsburgh-weather-thunderstorms-wildfire-smoke/stories/202607260079 - WTAE: https://www.wtae.com/article/western-pa-impact-day-followed-by-severe-weather-alert-days/73264885 * Region Nears Tornado Record Latest developments: The Post-Gazette detailed why the Pittsburgh region stands on the verge of setting an annual record for tornadoes after a summer of repeated touchdowns across western Pennsylvania. Western Pennsylvania is tracking toward the most tornadoes ever recorded in a single year, the Post-Gazette reported, after the National Weather Service confirmed a string of touchdowns across counties including Westmoreland and Jefferson during this month's storms. - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/weather-news/2026/07/26/pittsburgh-western-pennsylvania-tornadoes/stories/202607260063 * City Weighs Teen Takeovers Latest developments: The Post-Gazette examined how Pittsburgh officials are searching for answers to the mass teen gatherings, or takeovers, that have drawn large crowds downtown and prompted the new Market Square youth curfew. Pittsburgh leaders are hunting for a response to spontaneous mass gatherings of teenagers around Market Square and downtown, the Post-Gazette reported, weighing options after the city imposed a youth curfew that now faces its own legal challenge. - Pittsburgh Post-Gazette: https://www.post-gazette.com/local/city/2026/07/26/pittsburgh-teen-takeovers/stories/202607230044 SPORTS ---------------------------------------------------------------- Pirates (53-52) Sat Jul 25 · Cubs 11 · Pirates 0 · Final Crow-Armstrong powers the Cubs to an 11-0 rout of the Pirates https://plaintextsports.com/mlb/2026-07-25/chc-pit Up Next · Cubs @ Pirates · Sun Jul 26, 1:35 PM https://plaintextsports.com/mlb/2026-07-26/chc-pit Around the Teams: * Pittman Can Unlock the Passing Game Latest developments: The Post-Gazette's training-camp countdown argued Sunday that receiver Michael Pittman Jr. can open up Mike McCarthy's passing attack. The Post-Gazette's Steelers camp countdown cast newly added wideout Michael Pittman Jr. as a reliable possession target who can stretch Mike McCarthy's offense and give quarterback Aaron Rodgers a dependable option opposite DK Metcalf as Latrobe camp nears. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/07/26/nfl-training-camp-pittman-mccarthy-metcalf-aaron-rodgers/stories/202607260061 Team USA: * USWNT's Path to the 2027 Final Latest developments: ESPN, at the one-year mark before the 2027 Women's World Cup final, laid out five reasons the United States women's national team will or will not reach it. With exactly one year remaining until the 2027 Women's World Cup final, ESPN weighed the case for and against a United States women's national team return to the title game, assessing its form, depth, and rivals as the tournament approaches. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49435317/5-reasons-uswnt-in-women-world-cup-final-one-year * Barcelona Sign U.S. Keeper McCamey Latest developments: Barcelona signed American goalkeeper Tyler McCamey for its women's team, the reigning European champions, the club announced Saturday. FC Barcelona added United States goalkeeper Tyler McCamey to the roster of its women's side, winners of the European title, in a move giving another American a place at one of the sport's dominant clubs. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49447813/barcelona-sign-us-goalkeeper-tyler-mccamey READING ---------------------------------------------------------------- * Stratechery -- OpenAI Hacks Hugging Face, What Happened, Alignment and Paper Clips Ben Thompson unpacks OpenAI's accidental compromise of Hugging Face and argues the episode's lessons about AI alignment run more encouraging than the alarmed reaction suggests. https://stratechery.com/2026/openai-hacks-hugging-face-what-happened-alignment-and-paper-clips/ * Ed Zitron -- Premium: The Hater's Guide To Oracle (Part 2) Zitron dismantles Oracle's reputation as an incredibly profitable, fast-growing company, arguing its mythology masks a far weaker business underneath. https://www.wheresyoured.at/premium-the-haters-guide-to-oracle-part-2/ * Cal Newport -- Why Reading Matters Newport responds to Rose Horowitch's Atlantic piece declaring the end of reading, making the case that deep, sustained reading still carries irreplaceable cognitive value. https://calnewport.com/why-reading-matters/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,454.34 ▼ -0.9% Dow 51,988.28 ▼ -0.9% Nasdaq 25,429.94 ▼ -1.9% WTI crude 87.29 ▲ +9.5% EUR/USD 1.1397 ▼ -0.3% GBP/USD 1.3389 ▼ -0.3% USD/JPY 163.28 ▲ +0.6% ================================================================ Generated 2026-07-26 12:05 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================