================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Tuesday, July 28, 2026 - 4:07 PM EDT ================================================================ Anthropic's Claude derived a working key-recovery attack against the HAWK-256 post-quantum signature scheme and sped an attack on seven-round AES, as AI reshaped both offense and defense across the day's news. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Anthropic's Claude derived an end-to-end key-recovery attack on the HAWK-256 post-quantum scheme while newly disclosed PleaseFix flaws let attackers socially engineer agentic browsers. see: Claude Cracks HAWK-256 and Speeds an AES Attack; Agentic Browser Flaws Reopen Old Web Attacks * [TREND] Chaos ransomware operators reached deployment through Microsoft Teams vishing and legitimate remote tools rather than novel exploits, as Talos tied a Q2 intrusion surge to the same channels. see: Chaos Ransomware Rides Teams Vishing as Phishing Surges * [TREND] Decades-old hardware design flaws keep surfacing as 24,650 exposed BMCs leak IPMI password hashes and the Tengu botnet abuses a Linux watchdog to survive process kills. see: Exposed Server BMCs Leak IPMI Password Hashes; Tengu Botnet Reboots Linux Devices to Survive Cleanup * [UPDATE (new)] CISA, the FBI, and Australian partners released joint CI Fortify guidance urging critical infrastructure operators to prepare to isolate operational technology from compromised networks. see: US and Australia Push Critical Infrastructure to Isolate OT * [UPDATE (new)] Pittsburgh City Council approved the Downtown TRID plan, the Parkway East reopened with the new Commercial Street Bridge, and McCarthy opened his first Steelers camp. see: City Council Approves Downtown TRID Plan; Parkway East Reopens After Bridge Replacement; McCarthy's Camp Differs From Tomlin's * [UPDATE (updated)] Chip stocks slid a third session as investors rotated out of AI stocks, echoing Zitron's argument that hyperscalers lose more the more they spend. see: Rotation Out of AI Stocks Accelerates; The More You Buy, The More You Lose SECURITY ---------------------------------------------------------------- 1. EXPOSED SERVER BMCS LEAK IPMI PASSWORD HASHES Vulnerabilities and Exploits · [exposure, patch] Latest developments: Researchers reported on July 28, 2026 that 24,650 of 36,872 internet-exposed baseboard management controllers hand out password-derived authentication hashes before login, through a flaw in the IPMI 2.0 handshake built on an authentication protocol introduced in 2004. An attacker who reaches UDP port 623 on a server's controller asks for a hash and receives one without logging in. The BMC runs beneath the operating system, power-cycling the host, mounting virtual media, opening a remote console, and flashing firmware, where host security tools never watch, so administrators should pull these interfaces off the public internet. - The Hacker News: https://thehackernews.com/2026/07/24650-internet-exposed-bmcs-disclose.html - BleepingComputer: https://www.bleepingcomputer.com/news/security/over-24-000-exposed-server-bmcs-leak-password-hash-via-decades-old-flaw/ - Help Net Security: https://www.helpnetsecurity.com/2026/07/28/exposed-bmc-ipmi-vulnerability-research/ 2. US AND AUSTRALIA PUSH CRITICAL INFRASTRUCTURE TO ISOLATE OT Policy and Regulation · [policy, critical-infrastructure] Latest developments: CISA, the Australian Signals Directorate's Australian Cyber Security Centre, the FBI, and international partners released joint guidance called CI Fortify on July 28, 2026 urging critical infrastructure operators to prepare to isolate vital operational technology from all other networks during a cyberattack, while Senator Ron Wyden pressed CISA, OMB, and NIST to purge obsolete VPNs from federal agencies. The guidance gives critical infrastructure organizations practical steps to segment operational technology and enabling systems so an intruder on the IT side cannot reach the machinery that runs power, water, and manufacturing. Wyden's letter frames aging VPN appliances as a persistent entry point that federal agencies should retire. - CISA Advisories: https://www.cisa.gov/resources-tools/resources/ci-fortify-advice-isolating-vital-systems - BleepingComputer: https://www.bleepingcomputer.com/news/security/cisa-shares-advice-on-isolating-vital-systems-during-cyberattacks/ - The Record: https://therecord.media/federal-purge-outdated-vpns-wyden-letter 3. CHAOS RANSOMWARE RIDES TEAMS VISHING AS PHISHING SURGES Ransomware and Cybercrime · [ransomware, phishing] Latest developments: Sophos detailed on July 28, 2026 how Chaos ransomware operators used Microsoft Teams vishing, custom malware, and remote access tools to reach ransomware deployment, and Cisco Talos's Q2 2026 incident-response report tied a surge in intrusions to phishing-based initial access and the weaponization of legitimate remote management tools. Attackers pose as help-desk staff over Teams voice calls to trick employees into granting remote access, then plant tooling that leads to encryption. Talos found the same pattern across its caseload, with phishing and trusted admin utilities driving the quarter's attack chains. - Sophos News: https://www.sophos.com/en-us/blog/chaos-in-teams-vishing - Cisco Talos: https://blog.talosintelligence.com/ir-trends-q2-2026/ 4. CLAUDE CRACKS HAWK-256 AND SPEEDS AN AES ATTACK AI Security · [ai, cryptography] Latest developments: Anthropic reported on July 28, 2026 that its Claude Mythos Preview model helped derive an end-to-end key-recovery attack against the HAWK-256 post-quantum signature scheme and a 200- to 800-fold speedup for an attack on seven-round AES-128. The HAWK attack exploits a previously unused symmetry in the lattice under the signature scheme, and Anthropic's released implementation recovers a key in about three hours and 42 minutes on a 96-core server. HAWK-256 is a test scheme, yet the result shows an AI model accelerating genuine cryptanalysis. - The Hacker News: https://thehackernews.com/2026/07/claude-ai-just-cracked-post-quantum.html 5. TENGU BOTNET REBOOTS LINUX DEVICES TO SURVIVE CLEANUP Ransomware and Cybercrime · [botnet, ddos] Latest developments: Nozomi Networks Labs reported on July 28, 2026 that a new Mirai-derived botnet called Tengu abuses a compromised Linux device's hardware watchdog to trigger a reboot when defenders kill its main process, giving its other persistence mechanisms another chance to relaunch it. The dropper reaches Nozomi's honeypots through Telnet credential brute force, and the malware supports 25 distributed denial-of-service methods. Operators of internet-facing Linux devices should close Telnet and change default credentials. - The Hacker News: https://thehackernews.com/2026/07/tengu-botnet-reboots-compromised-linux.html 6. AGENTIC BROWSER FLAWS REOPEN OLD WEB ATTACKS AI Security · [ai, browser] Latest developments: Dark Reading reported on July 27, 2026 that a class of flaws it calls PleaseFix makes agentic browsers easy to socially engineer and exposes weaknesses in how they handle cross-origin requests, effectively rolling web security back two decades. Agentic browsers act on a user's behalf across sites, and the PleaseFix pattern lets an attacker plant instructions that the agent follows across origins, bypassing the same-origin protections that guard ordinary browsers. The finding widens the attack surface as AI agents take over routine web tasks. - Dark Reading: https://www.darkreading.com/endpoint-security/agentic-browsers-rewind-web-security-20-years BUSINESS AND POLITICS ---------------------------------------------------------------- * Rotation Out of AI Stocks Accelerates Latest developments: Chip stocks fell for a third straight session Tuesday and the Nasdaq 100 briefly touched correction territory, while the Dow rallied as investors rotated cash into sectors left behind this year. Investors kept dumping the semiconductor darlings that led the market and buying laggard sectors, with Apple topping a $5 trillion valuation on its comparatively light artificial-intelligence spending, all ahead of Wednesday's Federal Reserve rate decision under Chair Kevin Warsh. - Financial Times: https://www.ft.com/content/f8c03b5b-e194-4236-82c3-389b6f5dd7ae?syn-25a6b1a6=1 - Wall Street Journal: https://www.wsj.com/finance/stocks/oil-extends-fall-on-hopes-of-hormuz-reopening-but-chip-selloff-deepens-331d84a1?mod=rss_markets_main - Financial Times: https://www.ft.com/content/024fb6a1-fb39-4b2d-be3e-2393ed62482a?syn-25a6b1a6=1 * Trump Shifts Toward Ukraine in Oval Office Meeting Latest developments: President Trump signaled a shift toward backing Kyiv during a July 28 Oval Office meeting that Ukrainian President Volodymyr Zelensky called a good meeting, with Ukraine pressing for fresh United States support against Russia. Zelensky met Trump at the White House to discuss Ukraine producing its own weapons amid its war with Russia, and both leaders reported a constructive session that could reopen American military backing for Kyiv. - Financial Times: https://www.ft.com/content/5dca4c81-be8a-4555-971f-181eebf53e62?syn-25a6b1a6=1 PITTSBURGH ---------------------------------------------------------------- Weather: This Afternoon: Chance Showers And Thunderstorms, high 82F. Tonight: Slight Chance Showers And Thunderstorms then Partly Cloudy, low 63F. Wednesday: Mostly Sunny, high 80F. Business: * City Council Approves Downtown TRID Plan Latest developments: Pittsburgh City Council approved the contested Downtown TRID investment plan July 28, amending it to favor unionized building workers, after dozens of detractors turned out against it. The plan pulls future tax revenue from the Strip District, North Shore, and Downtown to fund Golden Triangle improvements around transit hubs, a multimillion-dollar bet on the Golden Triangle that split residents and Council. - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/politics-local/2026/07/28/pittsburgh-development-ura-trid-downtown/stories/202607280051 - PublicSource: https://www.publicsource.org/downtown-pittsburgh-council-approves-trid-vote/ * Pittsburgh Ballet Theatre Wins $1 Million Mellon Grant Latest developments: Pittsburgh Ballet Theatre revealed this week it received $1 million from the Mellon Foundation, some of it supporting a reimagined Nutcracker set to debut in December 2027. The grant caps a busy year for the company, which in May announced plans to revamp its long-running Nutcracker production. - Pittsburgh Magazine: https://www.pittsburghmagazine.com/pittsburgh-ballet-theatre-receives-1-million-grant/ Around town: * Parkway East Reopens After Bridge Replacement Latest developments: The new Commercial Street Bridge on the Parkway East opened Monday night, and drivers returned to Interstate 376 Tuesday under new traffic patterns, with some ramp closures still in place. PennDOT replaced the Commercial Street Bridge on I-376 in Pittsburgh, reopening the heavily traveled corridor about a week ahead of schedule. - WTAE: https://www.wtae.com/article/parkway-east-reopens-new-traffic-patterns-bridge-replacement/73283940 - TribLive: https://triblive.com/local/traffic-slowly-returning-to-parkway-east-after-bridge-reopening/ * Oakmont Carnegie Library Turns 125 Latest developments: The Oakmont Carnegie Library is marking its 125th anniversary this summer with a lawn party celebration, TribLive reported July 28. Leaders of the Oakmont Carnegie Library, in the Allegheny County borough of Oakmont, are keeping to tradition with a lawn party to celebrate the milestone. - TribLive: https://triblive.com/local/valley-news-dispatch/oakmont-carnegie-library-rings-in-125-years-with-lawn-party-celebration/ Events: * Panda Fest at Station Square Latest developments: Panda Fest, one of the nation's largest outdoor celebrations of Asian cuisine and culture, comes to Pittsburgh September 18 through 20. Panda Fest runs rain or shine Friday through Sunday, September 18-20, 2026, at the Station Square Parking Lot, 73 East Carson Street on the South Side, with more than 80 vendors serving authentic street food; tickets are available online. - Pittsburgh Magazine: https://www.pittsburghmagazine.com/panda-fest/ SPORTS ---------------------------------------------------------------- Pirates (55-52) Mon Jul 27 · Diamondbacks 2 · Pirates 3 · Final (10) Brandon Lowe’s 10th-inning hit rallies the Pirates over the Diamondbacks 3-2 https://plaintextsports.com/mlb/2026-07-27/ari-pit Up Next · Diamondbacks @ Pirates · Tue Jul 28, 6:40 PM https://plaintextsports.com/mlb/2026-07-28/ari-pit Around the Teams: * Porter Jr. Opens Camp on PUP List Latest developments: The Steelers placed cornerback Joey Porter Jr. on the active physically-unable-to-perform list as camp opened Tuesday, alongside cornerback Jalen Ramsey, with Porter still seeking a contract extension. Porter skipped voluntary work and mandatory minicamp during a contract standoff, and general manager Omar Khan opened training camp at Saint Vincent College in Latrobe with three players on the active PUP list. - Pittsburgh Post-Gazette: https://www.post-gazette.com/sports/steelers/2026/07/28/injuries-ramsey-pup-list-broderick-practice-training-camp/stories/202607280046 * McCarthy's Camp Differs From Tomlin's Latest developments: As camp opened July 28, the Post-Gazette detailed how head coach Mike McCarthy will run his first Steelers training camp at Saint Vincent College differently from predecessor Mike Tomlin. McCarthy, in his first camp leading the Steelers around quarterback Aaron Rodgers, is reshaping the practice structure and routine that Tomlin ran for years in Latrobe. - Pittsburgh Post-Gazette: https://www.post-gazette.com/sports/steelers/2026/07/28/mccarthy-training-camp-latrobe-tomlin-changes/stories/202607280050 * Cherington Says Pirates Are 'Open-Minded' at Deadline Latest developments: With the July 31 trade deadline nearing, general manager Ben Cherington said the Pirates will be open-minded on moves, weighing bullpen help. Cherington framed the Pirates' approach as flexible as the club chases a National League wild-card spot, leaving open both buying and selling. - Pittsburgh Post-Gazette: https://www.post-gazette.com/sports/pirates/2026/07/26/pirates-trade-deadline-ben-cherington-bullpen/stories/202607260084 Team USA: * Berhalter Joins Middlesbrough Latest developments: United States midfielder Sebastian Berhalter joined English Championship club Middlesbrough from the Vancouver Whitecaps, both clubs announced Tuesday, July 28. Berhalter, a USMNT midfielder, leaves Major League Soccer for the second tier of English football with the move to Middlesbrough. - ESPN: https://www.espn.com/soccer/story/_/id/49472491/usmnt-sebastian-berhalter-transfer-middlesbrough-vancouver-whitecaps * USMNT Coaching Question Looms Latest developments: ESPN reported July 28 that United States Soccer must soon settle whether Mauricio Pochettino stays on as men's national team coach following the 2026 World Cup exit. The USMNT fell 4-1 to Belgium in the round of 16 on home soil, and the federation now weighs Pochettino's future with the 2030 World Cup ahead. - ESPN: https://www.espn.com/soccer/story/_/id/49468665/united-states-usmnt-mauricio-pochettino-future-2030-world-cup * Congress Flags Doping Rules Before LA 2028 Latest developments: Members of Congress from both parties raised concerns July 28 over lax anti-doping protocols ahead of the 2028 Los Angeles Olympics. The bipartisan scrutiny targets anti-doping enforcement as the United States prepares to host the Summer Games in Los Angeles in 2028. - ESPN: https://www.espn.com/olympics/story/_/id/49471242/congress-concerned-lax-anti-doping-rules-ahead-28-olympics READING ---------------------------------------------------------------- * Ed Zitron -- The More You Buy, The More You Lose Argues that the more hyperscalers spend on AI infrastructure and compute, the deeper their losses run, extending Zitron's running critique of the economics of the AI buildout. https://www.wheresyoured.at/the-more-you-buy-the-more-you-lose/ * Cal Newport -- Did OpenAI's New Model "Go Rogue"? Examines a reported intrusion into Hugging Face's infrastructure and the claim that a new OpenAI model went rogue, arguing the episode is far more mundane than autonomous-AI fears suggest. https://calnewport.com/did-openais-new-model-go-rogue/ * Stratechery -- OpenAI Hacks Hugging Face, What Happened, Alignment and Paper Clips Contends that OpenAI accidentally hacking Hugging Face's infrastructure carries takeaways about AI alignment that are more encouraging than the alarm suggests. https://stratechery.com/2026/openai-hacks-hugging-face-what-happened-alignment-and-paper-clips/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,448.32 ▼ -0.8% Dow 52,062.44 ▼ -0.5% Nasdaq 25,314.74 ▼ -2.1% WTI crude 87.17 ▲ +8.0% EUR/USD 1.1391 ▼ -0.4% GBP/USD 1.3342 ▼ -0.9% USD/JPY 163.50 ▲ +0.7% ================================================================ Generated 2026-07-28 16:07 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================