================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Monday, July 27, 2026 - 12:05 PM EDT ================================================================ Extortion crews cash in fresh breaches at Ernst & Young and DentaQuest while public exploits arm attackers against vBulletin, n8n, and PTC Windchill. CONTENTS: Emerging Trends and Key Updates | Security | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Extortion crews keep monetizing intrusions as ShinyHunters claims Ernst & Young via a supply-chain hack while ransomware operators weaponize a critical PTC Windchill deserialization flaw. see: Ernst & Young and DentaQuest Breaches Widen; PTC Windchill Flaw Drives Ransomware Campaign * [TREND] Working exploit code arrives fast, with SSD publishing a pre-auth RCE for vBulletin and n8n, as Zscaler exposes TELESHIM malware abusing Telegram against Middle East governments. see: Public Exploits Land for vBulletin and n8n; TELESHIM Hits Middle East Governments * [TREND] Attackers impersonate trusted software, with Operation BlueDash cloning Microsoft Teams prompts to drop ScreenConnect and Level RMM on victims. see: Fake Teams and ChatGPT Lures Fuel Phishing * [TREND] Location surveillance expands as Cognyte sells its FalcoNet cell-site simulator to Texas and data brokers resell phone-derived movement records. see: Cell-Site Simulators and Location Data Erode Privacy * [TREND] AI commentary dominates Reading, dissecting OpenAI's accidental Hugging Face intrusion and Zitron's warning that debt-laden data-center financing resembles subprime lending. see: OpenAI Hacks Hugging Face, What Happened, Alignment and Paper Clips; Did OpenAI's New Model "Go Rogue"?; The Subprime Data Center Crisis * [UPDATE (new)] Locally, Wabtec landed a $1 billion Australian order, the Pirates' Cherington stayed open-minded before the deadline, and forecasters warned of severe storms tonight. see: Wabtec Lands $1 Billion Australian Order; Cherington 'Open-Minded' at the Deadline; Severe Storms Threaten Western Pennsylvania Tonight SECURITY ---------------------------------------------------------------- 1. ERNST & YOUNG AND DENTAQUEST BREACHES WIDEN Data Breaches · [breach, extortion, supply-chain] Latest developments: The ShinyHunters extortion gang claimed the Ernst & Young breach on July 27, 2026, saying a supply-chain attack handed it credentials to the accounting firm's systems, as DentaQuest disclosed that a May 2026 intrusion exposed personal and dental health data on more than 23 million people. Ernst & Young, the Big Four accounting firm, faces ShinyHunters extortion after intruders reached its systems through a vendor, while dental-benefits administrator DentaQuest is notifying over 23 million people whose records thieves stole. Affected customers should watch for fraud and reset any exposed credentials. - BleepingComputer: https://www.bleepingcomputer.com/news/security/ernst-and-young-data-breach-claimed-by-shinyhunters-extortion-gang/ - SecurityWeek: https://www.securityweek.com/dentaquest-data-breach-potentially-impacts-over-23-million-people/ 2. PUBLIC EXPLOITS LAND FOR VBULLETIN AND N8N Vulnerabilities and Exploits · [rce, exploit, patch] Latest developments: SSD Secure Disclosure published a working exploit on July 27, 2026 for a pre-authentication remote-code-execution flaw in vBulletin 6.2.1 and earlier and 6.1.6 and earlier that routes an unauthenticated request into PHP's eval(), the same day n8n patched an expression-sandbox escape that lets an authenticated workflow editor run operating-system commands on the automation server. vBulletin powers online discussion forums, and n8n is a self-hosted workflow-automation platform; both flaws hand attackers code execution on the host. Operators should upgrade immediately—vBulletin past 6.2.1 and 6.1.6, n8n to 2.31.5 or 2.32.1. - The Hacker News: https://thehackernews.com/2026/07/public-exploit-released-for-patched.html - The Hacker News: https://thehackernews.com/2026/07/n8n-sandbox-escape-lets-workflow.html 3. FAKE TEAMS AND CHATGPT LURES FUEL PHISHING Ransomware and Cybercrime · [phishing, rmm, social-engineering] Latest developments: The Hacker News detailed Operation BlueDash on July 27, 2026, a Microsoft Teams-themed campaign that ZeroBEC found steering victims through a counterfeit Microsoft Store page to install Level RMM and ScreenConnect, as Check Point's Q2 2026 report named ChatGPT a newly impersonated phishing brand trailing Microsoft's 23% share. Attackers abuse trusted brands to plant remote-management tools and steal logins, cloning Microsoft Teams update prompts and ChatGPT Plus billing pages. Employees should distrust unexpected software-update pages and verify RMM installs. - The Hacker News: https://thehackernews.com/2026/07/operation-bluedash-deploys-level-rmm.html - Help Net Security: https://www.helpnetsecurity.com/2026/07/27/check-point-brand-phishing-trends-report/ 4. CELL-SITE SIMULATORS AND LOCATION DATA ERODE PRIVACY Privacy and Surveillance · [surveillance, privacy, policy] Latest developments: Bruce Schneier publicized on July 27, 2026 that Israeli firm Cognyte sells its FalcoNet cell-site simulator, concealable in a van, backpack, or on-foot rig, to the state of Texas, while 404 Media detailed how broker Mike Yeagley bought phone-location data from around the world. Cognyte's FalcoNet mimics a cell tower to force nearby phones to connect, letting Texas police track any device in range, and the commercial location-data trade lets brokers like Mike Yeagley buy global movement records. Both underscore how easily bystanders' phones become surveillance targets. - Schneier on Security: https://www.schneier.com/blog/archives/2026/07/cognyte-sells-a-mobile-cell-surveillance-van.html - 404 Media: https://www.404media.co/this-man-bought-phone-location-data-from-around-the-world-with-mike-yeagley/ 5. PTC WINDCHILL FLAW DRIVES RANSOMWARE CAMPAIGN Vulnerabilities and Exploits · [ransomware, rce, exploit] Latest developments: SecurityWeek reported on July 27, 2026 that ransomware operators now exploit a critical unauthenticated unsafe-deserialization flaw in PTC Windchill to execute code remotely, escalating the earlier Clop data-theft extortion into full ransomware deployment. PTC Windchill is product-lifecycle-management software that manufacturers run to manage engineering data, and the flaw lets unauthenticated attackers execute arbitrary code on internet-exposed servers. Administrators should patch Windchill and FlexPLM instances at once. - SecurityWeek: https://www.securityweek.com/ptc-windchill-vulnerability-exploited-in-ransomware-campaign/ 6. TELESHIM HITS MIDDLE EAST GOVERNMENTS Nation-State Activity · [apt, espionage, malware] Latest developments: Zscaler ThreatLabz disclosed on July 27, 2026 that an East Asia-linked threat actor struck Middle East government entities with three previously unreported malware families—TELESHIM, MIXEDKEY, and BINDCLOAK—that abuse Telegram for command-and-control. An East Asia-linked espionage actor breached government targets across the Middle East in a campaign Zscaler detected earlier this month, using Telegram-based malware to hide its command channel. Defenders should hunt for anomalous Telegram traffic and the named implants. - The Hacker News: https://thehackernews.com/2026/07/teleshim-abuses-telegram-for-c2-in.html PITTSBURGH ---------------------------------------------------------------- Weather: This Afternoon: Scattered Showers And Thunderstorms, high 88F. Tonight: Chance Showers And Thunderstorms, low 69F. Tuesday: Showers And Thunderstorms Likely then Chance Showers And Thunderstorms, high 82F. Business: * Wabtec Lands $1 Billion Australian Order Latest developments: On its quarterly earnings call, chief executive Rafael Santana disclosed a billion-dollar order spanning several of the company's divisions. Wabtec Corp., the North Shore rail conglomerate, booked a $1 billion order from an unnamed Australian customer that touches multiple of its business lines, chief executive Rafael Santana told analysts. - WPXI: https://www.wpxi.com/news/local/wabtec-ceo-unveils-1b-deal-with-australian-company-during-earnings/MYVVCDPBMFHXNOIEL4B2NH4XTE/ * State Grant Advances Etna's Union Hotel Latest developments: The state formally awarded the Union Hotel redevelopment a Redevelopment Assistance Capital Program grant, among a round of Pittsburgh-region awards. The historic Union Hotel in the center of Etna won a state Redevelopment Assistance Capital Program grant to fund its redevelopment, one of several projects across the region drawing significant grant money in recent days. - WPXI: https://www.wpxi.com/news/local/etnas-union-hotel-redevelopment-project-receives-state-racp-grant/LTSVOFDUABFPPPAV4YR2QJSIME/ Around town: * Allegheny County Jail Adds Health Monitors Latest developments: The jail rolled out Overwatch monitoring devices that track incarcerated people's health. The Allegheny County Jail deployed new devices that track the health of incarcerated people, aiming to flag medical problems early and intervene before they become crises. - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/social-services/2026/07/27/allegheny-county-jail-overwatch-monitors/stories/202607240057 * County Gains Court-Ordered Mental Health Treatment Latest developments: Allegheny County courts can now order outpatient mental health treatment instead of incarceration or hospitalization. A new Allegheny County program lets courts order treatment for people in mental health crisis; from 2015 through 2022 the county evaluated more than 5,000 people a year for involuntary hospitalization and committed roughly 3,700, fewer than half of whom got follow-up outpatient care. - NEXTpittsburgh: https://nextpittsburgh.com/health/what-allegheny-countys-new-court-ordered-mental-health-treatment-program-can-and-cant-do/ * Severe Storms Threaten Western Pennsylvania Tonight Latest developments: Forecasters flagged an alert for storms Monday night, July 27, into Tuesday morning. The Storm Prediction Center placed western Pennsylvania at a level 2 of 5 severe-weather risk overnight Monday into Tuesday, with strong mid-level winds fueling storms that could bring damaging winds, torrential rain, and flash flooding. - KDKA: https://www.cbsnews.com/pittsburgh/news/wind-storms-could-move-through-the-pittsburgh-area-this-evening/ Events: * Observatory Hill House Tour Latest developments: NEXTpittsburgh previewed the tour ahead of its August 1 date. The Observatory Hill House Tour runs Saturday, August 1, opening private homes in the North Side neighborhood of Observatory Hill, including a house steeped in local lore said to have been won in a card game. - NEXTpittsburgh: https://nextpittsburgh.com/real-estate/feeling-nebby-inside-the-observatory-hill-home-won-for-1-dollar/ SPORTS ---------------------------------------------------------------- Pirates (54-52) Sun Jul 26 · Cubs 7 · Pirates 8 · Final Ryan O'Hearn hits a grand slam on his 33rd birthday to lead Pirates to 8-7 victory over Cubs https://plaintextsports.com/mlb/2026-07-26/chc-pit Up Next · Diamondbacks @ Pirates · Mon Jul 27, 6:40 PM https://plaintextsports.com/mlb/2026-07-27/ari-pit Around the Teams: * Cherington 'Open-Minded' at the Deadline Latest developments: General manager Ben Cherington said the Pirates will stay open-minded on moves. Ben Cherington said the Pirates will keep an open mind as the trade deadline nears, with the club hunting bullpen help while hanging in the National League wild-card race as Arizona visits PNC Park for a key series. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/07/26/pirates-trade-deadline-ben-cherington-bullpen/stories/202607260084 * Hiles Calls the Steelers the NFL's Most Boring Team Latest developments: Post-Gazette columnist Noah Hiles published the argument. Noah Hiles argued the 2026 Steelers, built around new coach Mike McCarthy and quarterback Aaron Rodgers under Mike Tomlin, have become the NFL's most boring team. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/07/27/noah-hiles-steelers-nfl-boring-mike-mccarthy-aaron-rodgers-mike-tomlin/stories/202607270005 * Top Pirates Prospect Seth Hernandez Headed to IL Latest developments: The Post-Gazette's MiLB Monday reported Hernandez will likely land on the injured list. Seth Hernandez, the Pirates' top pitching prospect, is likely bound for the minor-league injured list, the Post-Gazette reported. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/07/27/mlb-prospects-seth-hernandez-khristian-curtis-axiel-plaz/stories/202607270012 Team USA: * U.S. Track Nationals Serve as LA 2028 Preview Latest developments: The Guardian recapped standout runs at the championships. At the U.S. track and field championships, a lower-stakes year with no Olympics or world championships, Nikki Hiltz, Sha'Carri Richardson, and teenage 800-meter runner Cooper Lutkenhaus delivered performances the Guardian cast as a dress rehearsal for the 2028 Los Angeles Olympics. - Guardian Olympics: https://www.theguardian.com/sport/2026/jul/27/us-track-and-field-nationals-nikki-hiltz-shacarri-richardson-cooper-lutkenhaus-noah-lyles READING ---------------------------------------------------------------- * Cal Newport -- Did OpenAI's New Model "Go Rogue"? Newport dissects the intrusion into Hugging Face's production infrastructure and argues the alarmist framing of an OpenAI model acting on its own overstates what actually happened. https://calnewport.com/did-openais-new-model-go-rogue/ * Stratechery -- OpenAI Hacks Hugging Face, What Happened, Alignment and Paper Clips Ben Thompson walks through how OpenAI accidentally hacked Hugging Face and argues the alignment lessons are more encouraging than the panic suggests. https://stratechery.com/2026/openai-hacks-hugging-face-what-happened-alignment-and-paper-clips/ * Ed Zitron -- The Subprime Data Center Crisis Zitron contends the AI data-center buildout rests on precarious, debt-laden financing resembling subprime lending, warning that the arrangement sets up a coming crisis. https://www.wheresyoured.at/the-subprime-data-center-crisis/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,454.34 ▼ -0.9% Dow 51,988.28 ▼ -0.9% Nasdaq 25,429.94 ▼ -1.9% WTI crude 87.29 ▲ +9.5% EUR/USD 1.1408 ▼ -0.2% GBP/USD 1.3389 ▼ -0.3% USD/JPY 163.02 ▲ +0.5% ================================================================ Generated 2026-07-27 12:05 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================