daily plain-text briefing: security, markets, business, and pittsburgh
Attackers exploit an unpatched Fastjson flaw for unauthenticated code execution as malvertising crews teach victims' browsers to build their own malware.
Latest developments: Anthropic released Claude Opus 5 on Amazon Bedrock and the Claude Platform on AWS on July 26, 2026, saying the model improves on Opus 4.8's coding and cybersecurity capabilities and hands the riskiest requests back to Opus 4.8 with a visible notice to the user.
Anyone with an AWS account in a supported region can call Opus 5, and API customers can configure the fallback that catches high-risk prompts. The stronger cyber capabilities cut both ways, aiding defenders and raising the ceiling for offensive misuse.
Sources: Help Net Security · ↑ top
Latest developments: GitHub and the Python Package Index added a time-based mechanism to the Dependabot dependency-management tool on July 26, 2026 that delays adoption of freshly published package versions to blunt supply-chain attacks and limit their spread.
The cooldown gives maintainers and scanners time to catch a malicious release before Dependabot pulls it into downstream projects. Teams relying on Dependabot can enable the delay to reduce exposure to poisoned packages.
Sources: BleepingComputer · ↑ top
Latest developments: Confiant detailed on July 23, 2026 a malvertising operation it named SourTrade that ships malware in fragments and makes victims' browsers assemble the final Windows executable in memory, using the legitimate Bun runtime as its base rather than serving one complete file from a fixed URL.
Active since late 2024, SourTrade impersonates TradingView, Solana, and Luno to lure retail traders, running malicious JavaScript that stitches the payload together in browser memory to dodge file-based detection. Block the spoofed trading domains and watch endpoints for unexpected Bun runtime activity.
Sources: The Hacker News · BleepingComputer · ↑ top
Latest developments: ThreatBook and Imperva reported on July 25, 2026 that attackers are exploiting CVE-2026-16723, a 9.0-rated flaw in Alibaba's Fastjson 1.x JSON library for Java, before any patch exists.
In affected Spring Boot applications, a crafted JSON request runs code without authentication at the Java process's privilege level. Organizations running Fastjson 1.x should isolate internet-exposed services and restrict untrusted input until Alibaba ships a fix.
Sources: The Hacker News · ↑ top
Latest developments: Swiss firm PRODAFT, tracking the operation as Funky Mantis, revealed on July 25, 2026 that the DevMan ransomware-as-a-service scheme runs a dedicated web portal that combines payload generation, finance, and victim management for its affiliates.
The portal lets affiliates build custom payloads, oversee earnings, and administer victims from one centralized console, lowering the skill needed to run ransomware operations. Defenders should treat DevMan as a scaling, professionally run threat rather than a lone-actor tool.
Sources: The Hacker News · ↑ top
Latest developments: Neither side launched attacks for a second straight night, Iran's military said it halted retaliatory strikes on U.S. allies, and Brent crude fell back below $100 a barrel as Oman pressed a Strait of Hormuz transit deal.
The United States and Iran each held their fire while mediators worked to head off a return to full-blown war, easing two weeks of escalation that had drawn Saudi Arabia and Yemen's Houthis into wider fighting and lifted oil above $100 a barrel.
Sources: FT World · WSJ World News · FT Markets · ↑ top
Latest developments: Stocks open the week facing a Federal Reserve rate decision at Chair Kevin Warsh's second meeting alongside a wave of Big Tech earnings, with an unsettled tone spreading through markets.
Investors weigh whether the Warsh-led Federal Reserve raises interest rates this week, a rare move that, paired with major technology earnings and lingering Middle East risk, could sharply move equities and bond yields.
Sources: FT World · WSJ Markets · ↑ top
Tonight: Partly Cloudy then Areas Of Fog, low 66F.
Monday: Areas Of Fog then Chance Showers And Thunderstorms, high 88F.
Monday Night: Chance Showers And Thunderstorms, low 68F.
Latest developments: PennDOT and Governor Josh Shapiro's office confirmed the new Commercial Street Bridge and the Parkway East reopen Monday evening, July 27, a full week ahead of schedule.
The $95 million project slid a 22-million-pound bridge deck 102 feet into place outside the Squirrel Hill Tunnel, restoring the Parkway East (Interstate 376) after crews demolished the old Commercial Street span.
Sources: Pittsburgh Post-Gazette · TribLive · ↑ top
Latest developments: Bike Pittsburgh's OpenStreetsPGH closed usually car-clogged roads through Lawrenceville and the Strip District on Sunday, July 26, opening them to walkers, cyclists, and vendors.
The nonprofit Bike Pittsburgh runs the OpenStreetsPGH series, temporarily turning congested corridors into car-free public space for residents to walk, ride, and gather.
Pirates (54-52)
Sat Jul 25 · Cubs 11 · Pirates 0 · Final
Crow-Armstrong powers the Cubs to an 11-0 rout of the Pirates
Sun Jul 26 · Cubs 7 · Pirates 8 · Final
Ryan O'Hearn hits a grand slam on his 33rd birthday to lead Pirates to 8-7 victory over Cubs
Up Next · Diamondbacks @ Pirates · Mon Jul 27, 6:40 PM
Latest developments: The Post-Gazette's training-camp countdown on July 26 cast receiver Michael Pittman Jr. as the piece who can open up Mike McCarthy's passing attack alongside D.K. Metcalf and quarterback Aaron Rodgers.
As Steelers camp opens in Latrobe under new head coach Mike McCarthy, the paper argues Pittman gives Rodgers a big, reliable target across the middle to complement Metcalf on the outside.
Sources: Post-Gazette Steelers · ↑ top
Latest developments: Noah Lyles pulled up halfway through the 200-meter final at the U.S. track and field championships on Sunday, July 26, handing the title to USC's Garrett Kaalund in a rare loss in his signature event.
Lyles, days after winning the 100 meters at these championships, stopped mid-race in the 200 final, raising injury concerns for the reigning Olympic sprint champion.
Sources: ESPN Olympics · ↑ top
Latest developments: ESPN marked one year until the 2027 Women's World Cup final with an assessment of whether the U.S. women's national team will reach it.
The USWNT enters the final year before the 2027 Women's World Cup facing questions about form and depth as ESPN weighs five reasons the team will, or will not, make the final.
Sources: ESPN Soccer · ↑ top
S&P 500 7,454.34 ▼ -0.9% Dow 51,988.28 ▼ -0.9% Nasdaq 25,429.94 ▼ -1.9% WTI crude 87.29 ▲ +9.5% EUR/USD 1.1408 ▼ -0.2% GBP/USD 1.3389 ▼ -0.3% USD/JPY 163.02 ▲ +0.5%