================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Monday, July 27, 2026 - 9:05 AM EDT ================================================================ Coca-Cola confirmed a data breach after the Anubis gang ransomed its Fairlife dairy unit, as hackers ran an autonomous AI agent to spy on Thailand's finance ministry and researchers shipped a working exploit for the Certighost Active Directory flaw. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Attackers handed a whole espionage campaign against Thailand's Finance Ministry to an autonomous AI agent as Nvidia's alliance and Anthropic's Opus 5 fence in offensive AI. see: Autonomous AI Agent Spies on Thailand's Finance Ministry; Nvidia Launches AI Security Alliance as Opus 5 Caps Cyber Skills * [TREND] New Windows malware doubles down on stealth, with Cruciferra pairing vulnerable-driver abuse and process ghosting while MedusaHVNC runs browsers on invisible desktops. see: New Windows Malware Hides With Cruciferra and MedusaHVNC * [UPDATE (new)] Fresh threats hit credentials as Anubis breached Coca-Cola's Fairlife, hacked Wi-Fi gateways harvested Microsoft 365 logins, and a Certighost exploit dropped for CVE-2026-54121. see: Coca-Cola Confirms Fairlife Ransomware Breach; Hacked Wi-Fi Gateways Harvest Corporate Microsoft 365 Credentials; Certighost AD CS Exploit Released (CVE-2026-54121) * [TREND] Data centers press on the region as Pennsylvania's budget adds transparency rules while Gilpin Township delayed a zoning vote to August. see: Pennsylvania Budget Tightens Data-Center Rules; Gilpin Township Weighs Data-Center Zoning * [UPDATE (updated)] Brent crude slid about 8% toward $87 as the U.S.-Iran strike pause held a third night with mediators reporting progress. see: Oil Plunges as U.S.-Iran Strike Pause Holds * [UPDATE (new)] The American Red Cross declared only its second-ever national blood crisis, deepening a severe summer shortage. see: American Red Cross Declares Blood Crisis SECURITY ---------------------------------------------------------------- 1. NEW WINDOWS MALWARE HIDES WITH CRUCIFERRA AND MEDUSAHVNC Ransomware and Cybercrime · [malware, byovd] Latest developments: Proofpoint detailed Cruciferra on July 27, 2026, a crypter service using bring-your-own-vulnerable-driver and process ghosting that a China-linked group aims at Indian taxpayers, the same day SecurityWeek profiled MedusaHVNC, a malware-as-a-service that runs browsers on hidden Windows desktops. Cruciferra is a crypter that multiple unrelated cybercrime clusters use to deliver remote access trojans, cloaking payloads with signed-driver abuse and process ghosting; its China-linked operators phish Indian taxpayers, tax professionals, and corporate finance teams with income-tax lures. MedusaHVNC rents covert, persistent remote access by launching legitimate browsers on an invisible Windows desktop. - The Hacker News: https://thehackernews.com/2026/07/cruciferra-crypter-uses-byovd-and.html - SecurityWeek: https://www.securityweek.com/medusahvnc-malware-uses-hidden-windows-desktops-to-evade-detection/ 2. NVIDIA LAUNCHES AI SECURITY ALLIANCE AS OPUS 5 CAPS CYBER SKILLS AI Security · [ai, policy] Latest developments: Nvidia and fellow tech firms launched an AI security alliance on July 27, 2026 to give defenders open tools for testing and auditing AI models and agents, the same day SecurityWeek reported Anthropic's Opus 5 nears Mythos 5 at finding bugs while blocking binary vulnerability scanning, penetration testing, and exploit generation. The Nvidia-led coalition offers open tools to test, audit, and protect AI models and agents against abuse. Anthropic's Opus 5 matches rival Mythos 5 at finding bugs and refuses the riskiest offensive tasks, showing vendors racing to bound what their models will do for attackers. - SecurityWeek: https://www.securityweek.com/nvidia-and-tech-giants-launch-ai-security-alliance/ - SecurityWeek: https://www.securityweek.com/anthropics-opus-5-nears-mythos-5-on-finding-bugs-but-falls-short-on-exploits/ 3. COCA-COLA CONFIRMS FAIRLIFE RANSOMWARE BREACH Data Breaches · [ransomware, breach] Latest developments: Coca-Cola confirmed on July 27, 2026 that the Anubis cybercrime group breached its Fairlife dairy subsidiary and now threatens to leak the stolen data. Anubis, a ransomware crew, hit Fairlife, Coca-Cola's ultra-filtered milk brand, and took data the company confirmed as stolen; Anubis is pressuring for payment by threatening publication. Fairlife customers and staff should watch for fraud and targeted phishing. - SecurityWeek: https://www.securityweek.com/coca-cola-confirms-data-breach-after-fairlife-ransomware-attack/ 4. AUTONOMOUS AI AGENT SPIES ON THAILAND'S FINANCE MINISTRY Nation-State Activity · [apt, ai] Latest developments: Researchers disclosed on July 27, 2026 that hackers used an autonomous artificial intelligence agent to run a cyber-espionage campaign against Thailand's Ministry of Finance. Attackers pointed an autonomous AI agent at Thailand's Ministry of Finance, letting the software carry out the espionage tasks a human operator would normally run. The case marks another government network breached by an AI agent acting on its own. - The Record: https://therecord.media/thailand-hackers-ai-finance-ministry 5. CERTIGHOST AD CS EXPLOIT RELEASED (CVE-2026-54121) Vulnerabilities and Exploits · [zero-day, patch, exploit] Latest developments: The researchers who reported CVE-2026-54121, dubbed Certighost, published a proof-of-concept exploit and technical writeup on July 27, 2026 for the critical privilege-elevation flaw in Active Directory Certificate Services. Certighost, CVE-2026-54121, sits in Microsoft's Active Directory Certificate Services, the Windows Server role that runs an organization's certificate authority, and lets a low-privileged user escalate to full domain takeover. Administrators running AD CS should apply Microsoft's fix and lock down certificate enrollment. - Help Net Security: https://www.helpnetsecurity.com/2026/07/27/certighost-cve-2026-54121-poc-exploit-released/ 6. HACKED WI-FI GATEWAYS HARVEST CORPORATE MICROSOFT 365 CREDENTIALS Ransomware and Cybercrime · [credential-theft, phishing] Latest developments: SecurityWeek reported on July 27, 2026 that a threat actor compromised public Wi-Fi gateway appliances and used them to harvest the Microsoft 365 credentials of traveling corporate employees. Attackers seized public Wi-Fi gateway hardware and turned it into a credential trap for corporate staff logging in while on the road, capturing Microsoft 365 accounts. Enterprises should enforce phishing-resistant MFA and require VPN use on untrusted networks. - SecurityWeek: https://www.securityweek.com/hacked-public-wi-fi-gateways-used-to-harvest-corporate-credentials/ BUSINESS AND POLITICS ---------------------------------------------------------------- * Oil Plunges as U.S.-Iran Strike Pause Holds Latest developments: The pause held a third straight night, Brent crude fell about 8% to near $87 a barrel, and mediators reported progress toward halting the five-month war. The United States and Iran refrained from attacks for a third consecutive night while negotiators worked to sustain a fragile ceasefire, easing fears over the Strait of Hormuz; oil, Treasury yields, and the dollar all slid as stock futures jumped ahead of the Federal Reserve's rate decision on Wednesday. - FT Markets: https://www.ft.com/content/403625cc-8371-43ee-997a-f6908a97f52e?syn-25a6b1a6=1 - WSJ Markets: https://www.wsj.com/finance/stocks/oil-prices-slide-u-s-futures-rally-after-u-s-iran-pause-attacks-f6281828?mod=rss_markets_main PITTSBURGH ---------------------------------------------------------------- Weather: Today: Partly Sunny then Scattered Showers And Thunderstorms, high 88F. Tonight: Chance Showers And Thunderstorms, low 69F. Tuesday: Showers And Thunderstorms Likely then Chance Showers And Thunderstorms, high 82F. Business: * Valley Dairy Adds a North Huntingdon Restaurant Latest developments: Valley Dairy Restaurants will open its newest location in September at Norwin Hills Plaza along Route 30 in North Huntingdon. The regional diner chain Valley Dairy Restaurants is expanding its 13-restaurant footprint with a new eatery at Norwin Hills Plaza on Route 30 in North Huntingdon, expected to open in September. - TribLive: https://triblive.com/local/westmoreland/valley-dairy-restaurants-expanding-to-north-huntingdon-at-norwin-hills-plaza/ * Pennsylvania Budget Tightens Data-Center Rules Latest developments: The new Pennsylvania budget adds transparency requirements for data centers while leaving a roughly $2 billion sales-tax exemption for the industry untouched. Pennsylvania lawmakers increased disclosure requirements on data centers in the state budget but kept intact a sales-tax exemption worth about $2 billion that benefits the power-hungry industry, Spotlight PA reported. - TribLive: https://triblive.com/news/pennsylvania/lawmakers-up-transparency-for-data-centers-leave-2b-tax-exemption-untouched-in-pa-budget/ Around town: * New Law to Inventory Pennsylvania School Buildings Latest developments: A new state law will catalog the age and condition of Pennsylvania's public school facilities as districts across the region reconfigure or close aging buildings. Pennsylvania will take a statewide inventory of public school building conditions under a new law meant to help officials plan renovations and closures as western Pennsylvania districts shutter aging schools. - TribLive: https://triblive.com/news/education-classroom/old-school-state-to-take-inventory-on-age-of-public-school-facilities/ * Gilpin Township Weighs Data-Center Zoning Latest developments: Gilpin Township supervisors postponed a vote on a zoning amendment aimed at future data centers to their August meeting. Gilpin Township supervisors are weighing a zoning ordinance amendment that would regulate where future data centers can go, pushing the decision to their next voting meeting in August. - TribLive: https://triblive.com/local/valley-news-dispatch/gilpin-supervisors-to-vote-on-zoning-ordinance-amendment/ * American Red Cross Declares Blood Crisis Latest developments: The American Red Cross declared a national blood crisis on July 27, only the second such declaration in its history, deepening a severe summer shortage. The American Red Cross declared a national blood crisis for just the second time ever, urging donors across the country as summer supplies ran critically low. - WPXI: https://www.wpxi.com/news/local/american-red-cross-declares-national-blood-crisis-only-second-time-its-history/FDJ3MXEVJVH7DEBTNHTFYRPLFY/ Events: * August Food Events Fill the Calendar Latest developments: The Post-Gazette previewed August food happenings around Pittsburgh, led by Pittsburgh Restaurant Week and Little Italy Days in Bloomfield. The Post-Gazette rounded up food events coming to Pittsburgh in August, headlined by Pittsburgh Restaurant Week and Bloomfield's Little Italy Days. - Pittsburgh Post-Gazette: https://www.post-gazette.com/life/food/2026/07/27/food-events-in-august/stories/202608020004 SPORTS ---------------------------------------------------------------- Pirates (54-52) Sun Jul 26 · Cubs 7 · Pirates 8 · Final Ryan O'Hearn hits a grand slam on his 33rd birthday to lead Pirates to 8-7 victory over Cubs https://plaintextsports.com/mlb/2026-07-26/chc-pit Up Next · Diamondbacks @ Pirates · Mon Jul 27, 6:40 PM https://plaintextsports.com/mlb/2026-07-27/ari-pit Around the Teams: * Watt Eyes a Bounce-Back Season Latest developments: The Post-Gazette's camp countdown cast edge rusher T.J. Watt as chasing a rebound as camp opens at Saint Vincent. The Post-Gazette's training-camp countdown argued Steelers outside linebacker T.J. Watt is looking for a bounce-back season, with camp at Saint Vincent College in Latrobe opening Wednesday. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/07/27/steelers-training-camp-countdown-tj-watt/stories/202607260060 * When the Pirates Unleash Jared Jones Latest developments: The Post-Gazette's Off The Bat asked when the Pirates will lift the pitch-count limits on right-hander Jared Jones as the trade deadline nears. The Post-Gazette's Off The Bat column weighed when the Pirates will let starter Jared Jones stretch past his pitch-count restrictions, a question bound up with the club's trade-deadline direction. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/07/27/pirates-jared-jones-pitch-count-trade-deadline/stories/202607270006 READING ---------------------------------------------------------------- * Stratechery -- OpenAI Hacks Hugging Face, What Happened, Alignment and Paper Clips Ben Thompson argues that OpenAI accidentally 'hacked' Hugging Face and that the episode's lessons about AI alignment are more encouraging than most people realize. https://stratechery.com/2026/openai-hacks-hugging-face-what-happened-alignment-and-paper-clips/ * Ed Zitron -- Premium: The Hater's Guide To Oracle (Part 2) Ed Zitron continues his skeptical dissection of Oracle, challenging the company's reputation as an incredibly profitable, fast-growing tech giant. https://www.wheresyoured.at/premium-the-haters-guide-to-oracle-part-2/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,454.34 ▼ -0.9% Dow 51,988.28 ▼ -0.9% Nasdaq 25,429.94 ▼ -1.9% WTI crude 87.29 ▲ +9.5% EUR/USD 1.1408 ▼ -0.2% GBP/USD 1.3389 ▼ -0.3% USD/JPY 163.02 ▲ +0.5% ================================================================ Generated 2026-07-27 09:05 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================