daily plain-text briefing: security, markets, business, and pittsburgh
Actively exploited zero-days in Arista and Fortinet gear top a day of fresh public exploits, as private Claude chats spill into search engines and an autonomous AI agent runs an espionage campaign against Thailand.
Latest developments: Researchers identified the tool behind the espionage against Thailand's Ministry of Finance as Hermes, an open-source autonomous agent the attackers ran in unrestricted "YOLO mode" to carry the campaign end to end.
Hackers pointed the self-directing Hermes agent at Thailand's Ministry of Finance, letting the software plan and execute the intrusion with little human control. The case shows attackers turning off-the-shelf AI agents into hands-free spies.
Sources: Dark Reading · The Record · ↑ top
Latest developments: On July 27, 2026 SSD Secure Disclosure published a pre-auth remote-code-execution exploit for vBulletin 6.2.1 and earlier that reaches PHP's eval(), n8n patched a sandbox escape that Security Joes found letting an authenticated workflow editor run OS commands, and BleepingComputer reported hackers hitting US firms with the unpatched FastJson zero-day CVE-2026-16723.
Attackers exploit newly public flaws faster than defenders patch. Forum operators on vBulletin, teams running the n8n automation platform, and companies using Alibaba's FastJson Java library should update immediately.
Sources: The Hacker News · The Hacker News · BleepingComputer · ↑ top
Latest developments: Arista patched CVE-2026-16812, a maximum-severity command-injection zero-day in on-premises VeloCloud Orchestrator that attackers already exploit, and CISA added it to its Known Exploited Vulnerabilities catalog on July 27, 2026 alongside Fortinet FortiOS information-exposure flaw CVE-2025-68686.
The VeloCloud Orchestrator manages VeloCloud SD-WAN networks, and the injection lets an attacker run arbitrary commands on the appliance. Federal agencies must patch both bugs, and every operator running the affected Arista and Fortinet gear should apply the fixes now.
Sources: BleepingComputer · CISA Advisories · ↑ top
Latest developments: Wired and 404 Media reported on July 27, 2026 that the public share links Claude users create push their conversations and creations into Google and Bing search results, where anyone can read them.
Anthropic's Claude lets users generate public share URLs, and web crawlers index those pages, exposing chats their authors assumed stayed private. Users should delete public share links and check search engines for indexed conversations.
Sources: Wired Security · 404 Media · ↑ top
Latest developments: CNCERT and XLab reported the Dysphoria IoT botnet has compromised roughly 200,000 devices worldwide and adopted blockchain-based name services and infected-device relays for its command-and-control after a March law-enforcement operation dismantled the rival JackSkid infrastructure.
Dysphoria hijacks internet-of-things devices to launch distributed-denial-of-service attacks and relay traffic, and its blockchain C2 resists takedown. Owners should update device firmware and replace default credentials.
Sources: BleepingComputer · The Hacker News · ↑ top
Latest developments: SecurityWeek reported that a May 2026 intrusion at dental-benefits administrator DentaQuest exposed personal and dental-health data on more than 23 million people, and the ShinyHunters extortion gang claimed the Ernst & Young breach, saying it stole credentials for company systems through a supply-chain attack.
DentaQuest and Ernst & Young both face fallout from stolen data, with ShinyHunters pressing extortion against the accounting firm. Affected people should watch for fraud and identity-theft attempts and enroll in offered monitoring.
Sources: SecurityWeek · BleepingComputer · ↑ top
Latest developments: Iran and Oman opened talks on a Strait of Hormuz transit agreement to jumpstart peace negotiations while the United States held off on planned major strikes, pushing Brent crude down about 6% back below $100 a barrel.
Two weeks of escalating U.S.-Iran attacks over Persian Gulf shipping had driven oil above $100; a multi-day halt in fighting and Omani mediation over the Strait of Hormuz, the chokepoint for roughly a fifth of the world's oil, have now reversed much of that spike as both sides test whether talks can hold.
Sources: Financial Times · WSJ · WSJ · ↑ top
Latest developments: The Financial Times reported credit risk on Big Tech debt is climbing sharply as hyperscalers borrow heavily to fund data centers, and chip stocks fell again to open the week on renewed doubts about the artificial-intelligence buildout.
Investors are growing wary of the wave of debt Alphabet, Microsoft, Meta, and their peers are taking on to build AI data centers; semiconductor shares dropped and Tokyo's Nikkei fell 2.6% as the AI-spending boom that has powered markets drew fresh scrutiny.
Sources: Financial Times · WSJ · ↑ top
Tonight: Scattered Showers And Thunderstorms, low 69F.
Tuesday: Showers And Thunderstorms then Scattered Showers And Thunderstorms, high 82F.
Tuesday Night: Chance Showers And Thunderstorms, low 64F.
Latest developments: Residents of Hanover Township, Washington County mounted an 11th-hour push against a proposed eight-building data center campus with its own natural gas power plant, planned for 126 acres of a former strip mine inside an industrial park.
The project would rank among Pennsylvania's largest data centers; neighbors say they fear noise, pollution, and other impacts as the developer seeks approval to build on the reclaimed mine land.
Latest developments: Saint Vincent College and Latrobe-area businesses, including the self-styled unofficial camp sports bar Sharky's Café, are gearing up for the Steelers' arrival this week and the thousands of fans who follow.
The Steelers hold training camp at Saint Vincent College in Unity Township, Westmoreland County; the annual influx of players, coaches, and Steeler Nation fans lifts restaurants, hotels, and shops across Latrobe each summer.
Latest developments: The Allegheny County Health Department recorded 35 cyclosporiasis cases and two hospitalizations as of Sunday night and is waiting to learn whether they tie to the multistate outbreak the Pennsylvania Department of Health confirmed Friday.
Cyclospora, a parasite spread through contaminated food, causes prolonged intestinal illness; the county's count has grown alongside a broader outbreak federal investigators have been tracing to shredded lettuce.
Latest developments: A new Pennsylvania law recommends secondary schools start no earlier than 8:30 a.m., and the new state budget provides grant money to help high schools shift their start times.
University of Pittsburgh sleep neurologist Dr. Joanna Fong-Isariyawongse says four of five teenagers fall short on sleep; the grants aim to align school schedules with teenagers' biological clocks.
Latest developments: Pittsburgh Public Schools named Theodore L. Thompson III, an educator with more than 25 years of leadership across five urban districts, as its deputy superintendent.
The appointment adds a veteran administrator to the district's senior leadership heading into the coming school year.
Latest developments: The Steelers' first training-camp practice open to the public starts Wednesday, July 29 at 11:20 a.m. at Saint Vincent College in Latrobe.
The team's free public practices at Saint Vincent College draw thousands of fans each summer; the opening session runs Wednesday morning as camp begins in Unity Township, Westmoreland County.
Pirates (54-52)
Sun Jul 26 · Cubs 7 · Pirates 8 · Final
Ryan O'Hearn hits a grand slam on his 33rd birthday to lead Pirates to 8-7 victory over Cubs
Mon Jul 27 · Diamondbacks 2 · Pirates 1 · Bot 8th (in progress at last update)
Up Next · Diamondbacks @ Pirates · Tue Jul 28, 6:40 PM
Latest developments: Post-Gazette columnist Noah Hiles argued the 2026 Steelers, built around head coach Mike McCarthy, quarterback Aaron Rodgers, and defensive coordinator holdovers under Mike Tomlin, are the NFL's most boring team.
Hiles contends the roster and staff project steady competence without intrigue as McCarthy opens his first training camp running the Steelers' sideline.
Sources: Post-Gazette · ↑ top
Latest developments: The Post-Gazette profiled Mike McCarthy heading to Latrobe with few personal memories of Saint Vincent College but a profound sense of duty as he opens his first Steelers training camp, and examined the changes he may bring to the camp routine.
McCarthy takes over Pittsburgh's sideline this season after Mike Tomlin's long tenure, and beat writers are watching how he reshapes practice structure and installs the offense around Aaron Rodgers.
Sources: Post-Gazette · Post-Gazette · ↑ top
Latest developments: The Post-Gazette's MiLB Monday reported top Pirates pitching prospect Seth Hernandez is likely headed to the injured list.
Hernandez ranks among the organization's most promising arms; his setback adds to a run of pitching injuries as general manager Ben Cherington weighs trade-deadline moves.
Sources: Post-Gazette · ↑ top
Latest developments: At the U.S. track and field championships, Nikki Hiltz, Sha'Carri Richardson, and teenage 800-meter runner Cooper Lutkenhaus delivered standout performances in a low-stakes year with no Olympics or world championships, the Guardian reported.
The meet doubled as a preview of the 2028 Los Angeles Olympics, which will fill the Los Angeles Memorial Coliseum; U.S. stars used the lull between global championships to sharpen form ahead of that showcase.
Sources: The Guardian · ↑ top
S&P 500 7,448.32 ▼ -0.8% Dow 52,062.44 ▼ -0.5% Nasdaq 25,314.74 ▼ -2.1% WTI crude 87.29 ▲ +9.5% EUR/USD 1.1401 ▼ -0.3% GBP/USD 1.3370 ▼ -0.5% USD/JPY 163.24 ▲ +0.6%