================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Sunday, July 26, 2026 - 9:06 PM EDT ================================================================ Attackers exploit an unpatched Fastjson flaw for unauthenticated code execution as malvertising crews teach victims' browsers to build their own malware. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Cybercrime keeps industrializing, as SourTrade turns victims' browsers into in-memory malware factories while DevMan's ransomware-as-a-service runs a self-service portal for payloads and affiliate payouts. see: SourTrade Malvertising Builds Malware Inside the Browser; DevMan Runs a Self-Service Ransomware Portal * [TREND] Frontier AI vendors sharpen the cyber edge, as Anthropic's Claude Opus 5 reaches AWS with stronger coding and security skills, handing the riskiest prompts to Opus 4.8. see: Claude Opus 5 Lands on AWS With Sharper Cyber Skills * [UPDATE (new)] On the software-defense front, GitHub and PyPI added time-based Dependabot delays against supply-chain attacks even as attackers exploit an unpatched Fastjson flaw, CVE-2026-16723. see: GitHub and PyPI Add Time-Based Supply-Chain Defenses; Attackers Exploit Unpatched Fastjson RCE Flaw * [UPDATE (updated)] U.S.-Iran fighting paused for a second day as Brent crude slipped below $100 and Oman pushed a Strait of Hormuz transit deal. see: U.S.-Iran Fighting Pauses for a Second Day * [UPDATE (new)] Around town, the Parkway East and new Commercial Street Bridge reopen a week early while OpenStreetsPGH cleared Lawrenceville and Strip District roads for people. see: Parkway East Reopens a Week Early; OpenStreetsPGH Clears Roads for People SECURITY ---------------------------------------------------------------- 1. CLAUDE OPUS 5 LANDS ON AWS WITH SHARPER CYBER SKILLS AI Security · [ai, policy] Latest developments: Anthropic released Claude Opus 5 on Amazon Bedrock and the Claude Platform on AWS on July 26, 2026, saying the model improves on Opus 4.8's coding and cybersecurity capabilities and hands the riskiest requests back to Opus 4.8 with a visible notice to the user. Anyone with an AWS account in a supported region can call Opus 5, and API customers can configure the fallback that catches high-risk prompts. The stronger cyber capabilities cut both ways, aiding defenders and raising the ceiling for offensive misuse. - Help Net Security: https://www.helpnetsecurity.com/2026/07/27/claude-opus-5-aws-coding-cybersecurity-work/ 2. GITHUB AND PYPI ADD TIME-BASED SUPPLY-CHAIN DEFENSES Software Supply Chain · [supply-chain, patch] Latest developments: GitHub and the Python Package Index added a time-based mechanism to the Dependabot dependency-management tool on July 26, 2026 that delays adoption of freshly published package versions to blunt supply-chain attacks and limit their spread. The cooldown gives maintainers and scanners time to catch a malicious release before Dependabot pulls it into downstream projects. Teams relying on Dependabot can enable the delay to reduce exposure to poisoned packages. - BleepingComputer: https://www.bleepingcomputer.com/news/security/github-pypi-add-time-absed-defenses-against-supply-chain-attacks/ 3. SOURTRADE MALVERTISING BUILDS MALWARE INSIDE THE BROWSER Ransomware and Cybercrime · [malvertising, malware, evasion] Latest developments: Confiant detailed on July 23, 2026 a malvertising operation it named SourTrade that ships malware in fragments and makes victims' browsers assemble the final Windows executable in memory, using the legitimate Bun runtime as its base rather than serving one complete file from a fixed URL. Active since late 2024, SourTrade impersonates TradingView, Solana, and Luno to lure retail traders, running malicious JavaScript that stitches the payload together in browser memory to dodge file-based detection. Block the spoofed trading domains and watch endpoints for unexpected Bun runtime activity. - The Hacker News: https://thehackernews.com/2026/07/malvertising-sends-malware-in-pieces.html - BleepingComputer: https://www.bleepingcomputer.com/news/security/malicious-sites-use-javascript-to-build-malware-in-browser-memory/ 4. ATTACKERS EXPLOIT UNPATCHED FASTJSON RCE FLAW Vulnerabilities and Exploits · [zero-day, rce, exploit] Latest developments: ThreatBook and Imperva reported on July 25, 2026 that attackers are exploiting CVE-2026-16723, a 9.0-rated flaw in Alibaba's Fastjson 1.x JSON library for Java, before any patch exists. In affected Spring Boot applications, a crafted JSON request runs code without authentication at the Java process's privilege level. Organizations running Fastjson 1.x should isolate internet-exposed services and restrict untrusted input until Alibaba ships a fix. - The Hacker News: https://thehackernews.com/2026/07/fastjson-1x-rce-vulnerability-targeted.html 5. DEVMAN RUNS A SELF-SERVICE RANSOMWARE PORTAL Ransomware and Cybercrime · [ransomware, raas] Latest developments: Swiss firm PRODAFT, tracking the operation as Funky Mantis, revealed on July 25, 2026 that the DevMan ransomware-as-a-service scheme runs a dedicated web portal that combines payload generation, finance, and victim management for its affiliates. The portal lets affiliates build custom payloads, oversee earnings, and administer victims from one centralized console, lowering the skill needed to run ransomware operations. Defenders should treat DevMan as a scaling, professionally run threat rather than a lone-actor tool. - The Hacker News: https://thehackernews.com/2026/07/devman-raas-portal-centralizes-payload.html BUSINESS AND POLITICS ---------------------------------------------------------------- * U.S.-Iran Fighting Pauses for a Second Day Latest developments: Neither side launched attacks for a second straight night, Iran's military said it halted retaliatory strikes on U.S. allies, and Brent crude fell back below $100 a barrel as Oman pressed a Strait of Hormuz transit deal. The United States and Iran each held their fire while mediators worked to head off a return to full-blown war, easing two weeks of escalation that had drawn Saudi Arabia and Yemen's Houthis into wider fighting and lifted oil above $100 a barrel. - FT World: https://www.ft.com/content/ffdeacf0-91b8-48fd-9ff8-d8d134ef5f11?syn-25a6b1a6=1 - WSJ World News: https://www.wsj.com/world/middle-east/trump-pauses-iran-strikes-as-officials-weigh-dwindling-air-defense-stocks-c7d7ebb0 - FT Markets: https://www.ft.com/content/403625cc-8371-43ee-997a-f6908a97f52e?syn-25a6b1a6=1 * Fed Rate Decision Anchors an Unsettled Market Week Latest developments: Stocks open the week facing a Federal Reserve rate decision at Chair Kevin Warsh's second meeting alongside a wave of Big Tech earnings, with an unsettled tone spreading through markets. Investors weigh whether the Warsh-led Federal Reserve raises interest rates this week, a rare move that, paired with major technology earnings and lingering Middle East risk, could sharply move equities and bond yields. - FT World: https://www.ft.com/content/4b67aefb-f61a-4d0e-941c-bf93d625f5ca?syn-25a6b1a6=1 - WSJ Markets: https://www.wsj.com/finance/stocks/the-unsettled-vibe-thats-creeping-through-the-markets-e3996676?mod=rss_markets_main PITTSBURGH ---------------------------------------------------------------- Weather: Tonight: Partly Cloudy then Areas Of Fog, low 66F. Monday: Areas Of Fog then Chance Showers And Thunderstorms, high 88F. Monday Night: Chance Showers And Thunderstorms, low 68F. Around town: * Parkway East Reopens a Week Early Latest developments: PennDOT and Governor Josh Shapiro's office confirmed the new Commercial Street Bridge and the Parkway East reopen Monday evening, July 27, a full week ahead of schedule. The $95 million project slid a 22-million-pound bridge deck 102 feet into place outside the Squirrel Hill Tunnel, restoring the Parkway East (Interstate 376) after crews demolished the old Commercial Street span. - Pittsburgh Post-Gazette: https://www.post-gazette.com/local/city/2026/07/26/commercial-street-bridge-parkway-east-reopening-july-27/stories/202607260096 - TribLive: https://triblive.com/local/parkway-easts-commercial-street-bridge-to-reopen-monday-evening/ * OpenStreetsPGH Clears Roads for People Latest developments: Bike Pittsburgh's OpenStreetsPGH closed usually car-clogged roads through Lawrenceville and the Strip District on Sunday, July 26, opening them to walkers, cyclists, and vendors. The nonprofit Bike Pittsburgh runs the OpenStreetsPGH series, temporarily turning congested corridors into car-free public space for residents to walk, ride, and gather. - WPXI: https://www.wpxi.com/news/local/often-car-congested-lawrenceville-strip-district-roads-filled-with-people-during-openstreetspgh/NYTYLNHUVZAFJL7X345LC7SUXY/ SPORTS ---------------------------------------------------------------- Pirates (54-52) Sat Jul 25 · Cubs 11 · Pirates 0 · Final Crow-Armstrong powers the Cubs to an 11-0 rout of the Pirates https://plaintextsports.com/mlb/2026-07-25/chc-pit Sun Jul 26 · Cubs 7 · Pirates 8 · Final Ryan O'Hearn hits a grand slam on his 33rd birthday to lead Pirates to 8-7 victory over Cubs https://plaintextsports.com/mlb/2026-07-26/chc-pit Up Next · Diamondbacks @ Pirates · Mon Jul 27, 6:40 PM https://plaintextsports.com/mlb/2026-07-27/ari-pit Around the Teams: * Pittman Jr. Seen Unlocking McCarthy's Passing Game Latest developments: The Post-Gazette's training-camp countdown on July 26 cast receiver Michael Pittman Jr. as the piece who can open up Mike McCarthy's passing attack alongside D.K. Metcalf and quarterback Aaron Rodgers. As Steelers camp opens in Latrobe under new head coach Mike McCarthy, the paper argues Pittman gives Rodgers a big, reliable target across the middle to complement Metcalf on the outside. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/07/26/nfl-training-camp-pittman-mccarthy-metcalf-aaron-rodgers/stories/202607260061 Team USA: * Lyles Pulls Up in 200-Meter Final Latest developments: Noah Lyles pulled up halfway through the 200-meter final at the U.S. track and field championships on Sunday, July 26, handing the title to USC's Garrett Kaalund in a rare loss in his signature event. Lyles, days after winning the 100 meters at these championships, stopped mid-race in the 200 final, raising injury concerns for the reigning Olympic sprint champion. - ESPN Olympics: https://www.espn.com/olympics/trackandfield/story/_/id/49458625/noah-lyles-pulls-mid-race-200-meter-final-us-track-championships * One Year to the Women's World Cup Final Latest developments: ESPN marked one year until the 2027 Women's World Cup final with an assessment of whether the U.S. women's national team will reach it. The USWNT enters the final year before the 2027 Women's World Cup facing questions about form and depth as ESPN weighs five reasons the team will, or will not, make the final. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49435317/5-reasons-uswnt-in-women-world-cup-final-one-year READING ---------------------------------------------------------------- * Stratechery -- OpenAI Hacks Hugging Face, What Happened, Alignment and Paper Clips Ben Thompson argues that OpenAI's accidental 'hack' of Hugging Face, and the alignment questions it surfaced, point to more encouraging conclusions about AI safety than the alarmed reaction suggested. https://stratechery.com/2026/openai-hacks-hugging-face-what-happened-alignment-and-paper-clips/ * Ed Zitron -- Premium: The Hater's Guide To Oracle (Part 2) Zitron continues his skeptical dissection of Oracle, challenging the company's reputation for deep profitability and fast growth and questioning the strength of its cloud and AI business. https://www.wheresyoured.at/premium-the-haters-guide-to-oracle-part-2/ * Cal Newport -- Why Reading Matters Responding to Rose Horowitch's Atlantic essay 'The End of Reading Is Here,' Newport defends the cognitive value of sustained deep reading against claims that the practice is dying among students. https://calnewport.com/why-reading-matters/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,454.34 ▼ -0.9% Dow 51,988.28 ▼ -0.9% Nasdaq 25,429.94 ▼ -1.9% WTI crude 87.29 ▲ +9.5% EUR/USD 1.1408 ▼ -0.2% GBP/USD 1.3389 ▼ -0.3% USD/JPY 163.02 ▲ +0.5% ================================================================ Generated 2026-07-26 21:06 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================