daily plain-text briefing: security, markets, business, and pittsburgh
Two healthcare data thefts surfaced in a day, exposing more than 24 million dental and medical patients as DentaQuest and MCBS disclosed intrusions.
Latest developments: GitHub detailed on July 27, 2026 that its new Dependabot cooldown waits at least three days after a release publishes before opening a pull request, and cited the September 2025 npm attack that phished a maintainer and poisoned chalk, debug, and roughly a dozen packages downloaded over 2 billion times a week.
GitHub's configurable three-day Dependabot cooldown delays automatic adoption of fresh package versions so defenders can catch poisoned releases first. Teams can tune the window in dependabot.yml to fit their tolerance for update lag.
Sources: The Hacker News · Help Net Security · BleepingComputer · ↑ top
Latest developments: DentaQuest disclosed on July 27, 2026 that a May 2026 intrusion stole personal and dental-health data on more than 23 million people, and SecurityWeek reported the PEAR ransomware group claimed 3 terabytes from medical business management firm MCBS, hitting 1.2 million individuals.
DentaQuest, a dental-benefits administrator, lost personal and dental-health records on over 23 million people; MCBS, a medical business management company, saw PEAR claim 3 terabytes covering 1.2 million people. Affected patients should watch for medical-identity fraud and enroll in any monitoring offered.
Sources: SecurityWeek · SecurityWeek · ↑ top
Latest developments: Zscaler ThreatLabz reported on July 27, 2026 that a threat actor with East Asia ties targeted Middle East government entities earlier this month, dropping three previously unreported malware families—TELESHIM, MIXEDKEY, and BINDCLOAK—with TELESHIM routing command-and-control through Telegram.
A suspected East Asian actor breached Middle East government networks and deployed the new TELESHIM, MIXEDKEY, and BINDCLOAK implants, using Telegram as a covert C2 channel. Government defenders in the region should hunt for Telegram-based traffic and these signatures.
Sources: The Hacker News · ↑ top
Latest developments: Help Net Security profiled Nono on July 27, 2026, a free open-source sandbox that isolates AI coding agents which otherwise run with their launcher's full permissions and can read every file and live cloud key in the environment.
AI coding agents inherit the operator's access, so a prompt injection, mistyped command, or hallucinated path can point that reach at a company's own credentials. Nono confines the agent to blunt that damage; teams running agentic tools can adopt it now.
Sources: Help Net Security · ↑ top
Latest developments: The SANS Internet Storm Center reported on July 26, 2026 renewed scanning for weak logins on ESAFENET's CDG 3 Content Data Guard, a document-management and data-leak-prevention product aimed at the Chinese market that carries SQL injection, cross-site scripting, and default passwords.
ESAFENET CDG 3, a Chinese-market secure document-management product, ships with default passwords and injection flaws, and attackers are probing internet-exposed instances for weak credentials. Operators should change defaults and pull the consoles off the public internet.
Sources: SANS Internet Storm Center · ↑ top
Latest developments: Brent crude fell about 8% back below $90 a barrel as the two sides held their strike pause for a second day and signaled diplomacy, with U.S. stock futures rallying and Treasury yields and the dollar sliding.
The United States and Iran refrained from military strikes across the Persian Gulf for a second straight day, easing fears over the Strait of Hormuz and reviving hopes of ending the five-month conflict; crude retreated from above $100 a barrel, lifting global equities and gold while pressuring the dollar.
Sources: FT Markets · WSJ US Business · ↑ top
Today: Patchy Fog then Chance Showers And Thunderstorms, high 88F.
Tonight: Chance Showers And Thunderstorms, low 69F.
Tuesday: Showers And Thunderstorms Likely then Chance Showers And Thunderstorms, high 82F.
Latest developments: Columbia Gas of Pennsylvania launched a Small Commercial Rebate Program that pays eligible customers who replace less-efficient equipment with higher-efficiency natural gas systems.
Columbia Gas of Pennsylvania rolled out rebate programs aimed at small businesses, rewarding customers who swap aging equipment for higher-efficiency natural gas equipment to trim energy use and bills.
Latest developments: The Post-Gazette detailed how Downtown Pittsburgh's block-by-block redevelopment push has reached Liberty Avenue.
Pittsburgh's Downtown revitalization, advancing building by building, now centers on Liberty Avenue, where the city and developers aim to fill vacant storefronts and remake the corridor.
Sources: Pittsburgh Post-Gazette · ↑ top
Latest developments: PublicSource laid out the details of Allegheny County's proposed paid parental leave benefit, answering 13 questions on eligibility, cost, and effects.
Allegheny County is weighing a paid parental leave benefit for county employees; PublicSource examined the proposal's design and cost alongside research on how such leave affects families and the regional economy.
Sources: PublicSource · ↑ top
Latest developments: The Post-Gazette profiled the Seneca Valley School District's cyber school program, calling it a 'game changer' in Pennsylvania.
The Seneca Valley School District in Butler County runs an in-house cyber school program that officials tout as a statewide model, keeping online students enrolled with the district rather than in outside charter schools.
Sources: Pittsburgh Post-Gazette · ↑ top
Latest developments: WTAE meteorologists issued Alert Days for western Pennsylvania from Monday evening, July 27, into Tuesday morning, July 28, as storms move through.
Forecasters flagged Alert Days across western Pennsylvania for rain and potential severe storms arriving Monday night into Tuesday, urging residents to watch for fast-moving weather.
Latest developments: TribLive previewed the annual Fallen Heroes Ride & Freedom Festival, set for Saturday, August 1, 2026, noting the event will look different this year.
The Fallen Heroes Ride & Freedom Festival, honoring Westmoreland County veterans, returns Saturday, August 1, 2026, with a revamped format.
Pirates (54-52)
Sun Jul 26 · Cubs 7 · Pirates 8 · Final
Ryan O'Hearn hits a grand slam on his 33rd birthday to lead Pirates to 8-7 victory over Cubs
Up Next · Diamondbacks @ Pirates · Mon Jul 27, 6:40 PM
Latest developments: Post-Gazette columnist Noah Hiles argued the 2026 Steelers rate as the NFL's most boring team as training camp opens in Latrobe.
Noah Hiles wrote that Pittsburgh's changes—Mike McCarthy taking over from Mike Tomlin's run of nine-win seasons, Aaron Rodgers at quarterback—leave a team short on intrigue heading into camp, where McCarthy begins his first season with a stated intent to win now.
Sources: Post-Gazette Steelers · ↑ top
Latest developments: General manager Ben Cherington said the Pirates will stay 'open-minded' on moves as the MLB trade deadline nears, with bullpen help a focus.
With the trade deadline approaching, Pirates general manager Ben Cherington told the Post-Gazette the club will weigh both adding and subtracting, keeping the injury-battered bullpen a priority amid speculation around shortstop Oneil Cruz.
Sources: Post-Gazette Pirates · ↑ top
Latest developments: The Pirates officially signed outfielder Derek Curiel, the fifth overall pick in the 2026 draft, who said he is eager to make an impact.
Pittsburgh signed Derek Curiel, a 21-year-old LSU outfielder taken fifth overall and rated the draft's best college hitter and a top defensive outfielder, fresh off helping the Tigers win the 2026 national championship.
Sources: Post-Gazette Pirates · ↑ top
Latest developments: The U.S. track and field championships wrapped with Nikki Hiltz, Sha'Carri Richardson, and 17-year-old Cooper Lutkenhaus among standouts the Guardian framed as a dress rehearsal for the 2028 Los Angeles Olympics.
At the U.S. national track and field championships, Olympic stars and rising hopefuls including Nikki Hiltz, Sha'Carri Richardson, and teenager Cooper Lutkenhaus turned in strong performances two years out from the LA 2028 Games, a lower-stakes meet with no Olympics or worlds this season.
Sources: Guardian Olympics · ↑ top
S&P 500 7,454.34 ▼ -0.9% Dow 51,988.28 ▼ -0.9% Nasdaq 25,429.94 ▼ -1.9% WTI crude 87.29 ▲ +9.5% EUR/USD 1.1408 ▼ -0.2% GBP/USD 1.3389 ▼ -0.3% USD/JPY 163.02 ▲ +0.5%