daily plain-text briefing: security, markets, business, and pittsburgh
Anthropic's Claude derived a working key-recovery attack against the HAWK-256 post-quantum signature scheme and sped an attack on seven-round AES, as AI reshaped both offense and defense across the day's news.
Latest developments: Researchers reported on July 28, 2026 that 24,650 of 36,872 internet-exposed baseboard management controllers hand out password-derived authentication hashes before login, through a flaw in the IPMI 2.0 handshake built on an authentication protocol introduced in 2004.
An attacker who reaches UDP port 623 on a server's controller asks for a hash and receives one without logging in. The BMC runs beneath the operating system, power-cycling the host, mounting virtual media, opening a remote console, and flashing firmware, where host security tools never watch, so administrators should pull these interfaces off the public internet.
Sources: The Hacker News · BleepingComputer · Help Net Security · ↑ top
Latest developments: CISA, the Australian Signals Directorate's Australian Cyber Security Centre, the FBI, and international partners released joint guidance called CI Fortify on July 28, 2026 urging critical infrastructure operators to prepare to isolate vital operational technology from all other networks during a cyberattack, while Senator Ron Wyden pressed CISA, OMB, and NIST to purge obsolete VPNs from federal agencies.
The guidance gives critical infrastructure organizations practical steps to segment operational technology and enabling systems so an intruder on the IT side cannot reach the machinery that runs power, water, and manufacturing. Wyden's letter frames aging VPN appliances as a persistent entry point that federal agencies should retire.
Sources: CISA Advisories · BleepingComputer · The Record · ↑ top
Latest developments: Sophos detailed on July 28, 2026 how Chaos ransomware operators used Microsoft Teams vishing, custom malware, and remote access tools to reach ransomware deployment, and Cisco Talos's Q2 2026 incident-response report tied a surge in intrusions to phishing-based initial access and the weaponization of legitimate remote management tools.
Attackers pose as help-desk staff over Teams voice calls to trick employees into granting remote access, then plant tooling that leads to encryption. Talos found the same pattern across its caseload, with phishing and trusted admin utilities driving the quarter's attack chains.
Sources: Sophos News · Cisco Talos · ↑ top
Latest developments: Anthropic reported on July 28, 2026 that its Claude Mythos Preview model helped derive an end-to-end key-recovery attack against the HAWK-256 post-quantum signature scheme and a 200- to 800-fold speedup for an attack on seven-round AES-128.
The HAWK attack exploits a previously unused symmetry in the lattice under the signature scheme, and Anthropic's released implementation recovers a key in about three hours and 42 minutes on a 96-core server. HAWK-256 is a test scheme, yet the result shows an AI model accelerating genuine cryptanalysis.
Sources: The Hacker News · ↑ top
Latest developments: Nozomi Networks Labs reported on July 28, 2026 that a new Mirai-derived botnet called Tengu abuses a compromised Linux device's hardware watchdog to trigger a reboot when defenders kill its main process, giving its other persistence mechanisms another chance to relaunch it.
The dropper reaches Nozomi's honeypots through Telnet credential brute force, and the malware supports 25 distributed denial-of-service methods. Operators of internet-facing Linux devices should close Telnet and change default credentials.
Sources: The Hacker News · ↑ top
Latest developments: Dark Reading reported on July 27, 2026 that a class of flaws it calls PleaseFix makes agentic browsers easy to socially engineer and exposes weaknesses in how they handle cross-origin requests, effectively rolling web security back two decades.
Agentic browsers act on a user's behalf across sites, and the PleaseFix pattern lets an attacker plant instructions that the agent follows across origins, bypassing the same-origin protections that guard ordinary browsers. The finding widens the attack surface as AI agents take over routine web tasks.
Sources: Dark Reading · ↑ top
Latest developments: Chip stocks fell for a third straight session Tuesday and the Nasdaq 100 briefly touched correction territory, while the Dow rallied as investors rotated cash into sectors left behind this year.
Investors kept dumping the semiconductor darlings that led the market and buying laggard sectors, with Apple topping a $5 trillion valuation on its comparatively light artificial-intelligence spending, all ahead of Wednesday's Federal Reserve rate decision under Chair Kevin Warsh.
Sources: Financial Times · Wall Street Journal · Financial Times · ↑ top
Latest developments: President Trump signaled a shift toward backing Kyiv during a July 28 Oval Office meeting that Ukrainian President Volodymyr Zelensky called a good meeting, with Ukraine pressing for fresh United States support against Russia.
Zelensky met Trump at the White House to discuss Ukraine producing its own weapons amid its war with Russia, and both leaders reported a constructive session that could reopen American military backing for Kyiv.
Sources: Financial Times · ↑ top
This Afternoon: Chance Showers And Thunderstorms, high 82F.
Tonight: Slight Chance Showers And Thunderstorms then Partly Cloudy, low 63F.
Wednesday: Mostly Sunny, high 80F.
Latest developments: Pittsburgh City Council approved the contested Downtown TRID investment plan July 28, amending it to favor unionized building workers, after dozens of detractors turned out against it.
The plan pulls future tax revenue from the Strip District, North Shore, and Downtown to fund Golden Triangle improvements around transit hubs, a multimillion-dollar bet on the Golden Triangle that split residents and Council.
Sources: Pittsburgh Post-Gazette · PublicSource · ↑ top
Latest developments: Pittsburgh Ballet Theatre revealed this week it received $1 million from the Mellon Foundation, some of it supporting a reimagined Nutcracker set to debut in December 2027.
The grant caps a busy year for the company, which in May announced plans to revamp its long-running Nutcracker production.
Sources: Pittsburgh Magazine · ↑ top
Latest developments: The new Commercial Street Bridge on the Parkway East opened Monday night, and drivers returned to Interstate 376 Tuesday under new traffic patterns, with some ramp closures still in place.
PennDOT replaced the Commercial Street Bridge on I-376 in Pittsburgh, reopening the heavily traveled corridor about a week ahead of schedule.
Sources: WTAE · TribLive · ↑ top
Latest developments: The Oakmont Carnegie Library is marking its 125th anniversary this summer with a lawn party celebration, TribLive reported July 28.
Leaders of the Oakmont Carnegie Library, in the Allegheny County borough of Oakmont, are keeping to tradition with a lawn party to celebrate the milestone.
Latest developments: Panda Fest, one of the nation's largest outdoor celebrations of Asian cuisine and culture, comes to Pittsburgh September 18 through 20.
Panda Fest runs rain or shine Friday through Sunday, September 18-20, 2026, at the Station Square Parking Lot, 73 East Carson Street on the South Side, with more than 80 vendors serving authentic street food; tickets are available online.
Sources: Pittsburgh Magazine · ↑ top
Pirates (55-52)
Mon Jul 27 · Diamondbacks 2 · Pirates 3 · Final (10)
Brandon Lowe’s 10th-inning hit rallies the Pirates over the Diamondbacks 3-2
Up Next · Diamondbacks @ Pirates · Tue Jul 28, 6:40 PM
Latest developments: The Steelers placed cornerback Joey Porter Jr. on the active physically-unable-to-perform list as camp opened Tuesday, alongside cornerback Jalen Ramsey, with Porter still seeking a contract extension.
Porter skipped voluntary work and mandatory minicamp during a contract standoff, and general manager Omar Khan opened training camp at Saint Vincent College in Latrobe with three players on the active PUP list.
Sources: Pittsburgh Post-Gazette · ↑ top
Latest developments: As camp opened July 28, the Post-Gazette detailed how head coach Mike McCarthy will run his first Steelers training camp at Saint Vincent College differently from predecessor Mike Tomlin.
McCarthy, in his first camp leading the Steelers around quarterback Aaron Rodgers, is reshaping the practice structure and routine that Tomlin ran for years in Latrobe.
Sources: Pittsburgh Post-Gazette · ↑ top
Latest developments: With the July 31 trade deadline nearing, general manager Ben Cherington said the Pirates will be open-minded on moves, weighing bullpen help.
Cherington framed the Pirates' approach as flexible as the club chases a National League wild-card spot, leaving open both buying and selling.
Sources: Pittsburgh Post-Gazette · ↑ top
Latest developments: United States midfielder Sebastian Berhalter joined English Championship club Middlesbrough from the Vancouver Whitecaps, both clubs announced Tuesday, July 28.
Berhalter, a USMNT midfielder, leaves Major League Soccer for the second tier of English football with the move to Middlesbrough.
Latest developments: ESPN reported July 28 that United States Soccer must soon settle whether Mauricio Pochettino stays on as men's national team coach following the 2026 World Cup exit.
The USMNT fell 4-1 to Belgium in the round of 16 on home soil, and the federation now weighs Pochettino's future with the 2030 World Cup ahead.
Latest developments: Members of Congress from both parties raised concerns July 28 over lax anti-doping protocols ahead of the 2028 Los Angeles Olympics.
The bipartisan scrutiny targets anti-doping enforcement as the United States prepares to host the Summer Games in Los Angeles in 2028.
S&P 500 7,448.32 ▼ -0.8% Dow 52,062.44 ▼ -0.5% Nasdaq 25,314.74 ▼ -2.1% WTI crude 87.17 ▲ +8.0% EUR/USD 1.1391 ▼ -0.4% GBP/USD 1.3342 ▼ -0.9% USD/JPY 163.50 ▲ +0.7%