daily plain-text briefing: security, markets, business, and pittsburgh
A coordinated cyberattack struck operational technology at more than 30 Minnesota community water systems, knocking Braham's plant offline and triggering a statewide incident response.
Latest developments: Minnesota IT Services confirmed that a coordinated cyberattack on July 26 and 27 struck operational-technology systems at more than 30 community water utilities, taking Braham's water plant offline and disrupting automated controls and communications at Plymouth, South St. Paul, and Maple Plain, while CISA and Australia released guidance the same week on isolating OT to survive such intrusions.
Unknown attackers hit control systems across dozens of small Minnesota water utilities at once; Braham asked residents to minimize water use after its plant went dark. Operators of internet-exposed OT should segment and isolate control networks and prepare to run them disconnected.
Sources: Help Net Security · BleepingComputer · The Hacker News · SecurityWeek · ↑ top
Latest developments: Noma Security disclosed CVE-2026-59726, a 10.0-rated flaw it codenamed RufRoot in Ruflo, an open-source agent meta-harness for Anthropic's Claude Code and OpenAI's Codex, that lets an unauthenticated attacker send an HTTP request to an exposed endpoint, run commands inside the MCP bridge container, and poison agent memory so malicious behavior survives patching.
Every Ruflo version before 3.16.3 exposes an MCP bridge that grants remote code execution and lets attackers spawn rogue AI agent swarms. Operators must upgrade to 3.16.3 and purge any corrupted agent memory, since a patch alone does not evict persisted instructions.
Sources: The Hacker News · Dark Reading · SecurityWeek · ↑ top
Latest developments: Researchers reported that Russia's Laundry Bear, also tracked as Void Blizzard, has exploited a Microsoft Outlook Web Access zero-day since July 22 to plant the OWAReaper backdoor, which retains mailbox access even after victims rotate credentials, striking US and European government, telecommunications, financial, hospitality, and aerospace targets.
The same Russian group behind the Zimbra espionage campaign now abuses OWA to hold email accounts through password changes, defeating a standard remediation step. Organizations running on-premises Exchange OWA should hunt for OWAReaper and monitor for persistent access surviving resets.
Sources: The Hacker News · BleepingComputer · The Record · ↑ top
Latest developments: Amazon attributed the September 2025 hijack of the npm packages debug and chalk to North Korea's Sapphire Sleet, an attack the public record had filed for ten months as ordinary crypto theft after a maintainer fell to a lookalike npm domain and a wallet-draining script reached at least 18 packages carrying more than 2 billion weekly downloads.
The compromise poisoned two of JavaScript's most-downloaded utility packages, and Amazon now links it to a state-sponsored North Korean group rather than freelance thieves. Developers who pulled affected versions last fall should audit builds and rotate any exposed wallet or CI credentials.
Sources: The Hacker News · ↑ top
Latest developments: Kaspersky dissected GenieLocker, a new custom ransomware family with distinct variants for Windows, Linux, and VMware ESXi that the financially motivated extortion group Toy Ghouls wields in its attacks.
GenieLocker's ESXi build lets Toy Ghouls encrypt entire virtualization estates in a single stroke, the tactic that makes hypervisor-targeting ransomware so damaging. Defenders should harden ESXi hosts, restrict management interfaces, and keep offline backups of virtual-machine data.
Sources: Securelist (Kaspersky) · ↑ top
Latest developments: Broadcom shipped fixes for five VMware flaws, three of them critical, led by CVE-2026-59309, a 9.8-rated authentication bypass in vCenter that a network-adjacent attacker can exploit, alongside a virtual-machine escape in ESX that lets a guest break out to the host.
The bugs hit VMware ESX, vCenter, Workstation, and Fusion, the backbone of most enterprise virtualization; a vCenter auth bypass and an ESX VM escape hand attackers control of the hypervisor and everything on it. Administrators should apply Broadcom's updates immediately given the products' exposure.
Sources: The Hacker News · SecurityWeek · ↑ top
Latest developments: The United States launched fresh strikes on Iran on July 30, a day after Iranian ballistic missiles hit a base in Jordan that hosts American troops, and hopes for a quick resolution faded.
The United States and Iran are exchanging missile barrages across the Middle East after President Trump vowed to hit Iran "very hard," widening a war that has driven crude prices and energy-trading profits higher, with Shell posting its second-highest earnings ever on the disruption.
Today: Sunny, high 83F.
Tonight: Clear, low 59F.
Friday: Sunny, high 87F.
Latest developments: Federal officials agreed to restore the broadband grant program after dropping diversity-related conditions, poising money to flow into Pennsylvania for high-speed internet expansion.
Washington's reversal clears hundreds of millions of dollars in BEAD broadband funding to reach Pennsylvania, money aimed at extending high-speed internet into unserved and rural corners of the state.
Sources: Pittsburgh Post-Gazette · ↑ top
Latest developments: Westinghouse is disassembling its atom smasher in Forest Hills and will rebuild it at the company's nuclear headquarters in Cranberry Township.
The Westinghouse atom smasher, a pear-shaped generator that opened in Forest Hills in 1937 and pioneered research that laid the foundation for nuclear power, will be taken apart and reassembled at Westinghouse's Cranberry Township nuclear headquarters; Gary Silversmith owns the Forest Hills property where it stood for nearly 90 years.
Latest developments: Strip District residents gathered July 29 to oppose a proposed townhome development and related taxing plans, a day after city officials made two decisions affecting the neighborhood.
Neighbors in Pittsburgh's Strip District organized against a new townhome project and financing plans they say will reshape the district, meeting the evening after city officials issued two rulings that directly touch the area.
Latest developments: PulpFest, the pulp-fiction and vintage-magazine convention, opens Thursday, July 30 in Cranberry.
PulpFest runs Thursday, July 30 through Sunday, August 2 at the DoubleTree by Hilton Pittsburgh, 910 Sheraton Drive in Cranberry, gathering collectors of pulp fiction and vintage magazines; registration runs $50 to $80 at pulpfest.com.
Sources: Pittsburgh City Paper · ↑ top
Latest developments: Sweetwater Center for the Arts holds a free opening reception for two new exhibitions on Thursday, July 30.
The Sweetwater Center for the Arts, 200 Broad Street in Sewickley, hosts a free opening reception for "During Naptime" and "Interior Kaleidoscope" on Thursday, July 30 from 6 to 8 p.m.; the shows run through September 11.
Sources: Pittsburgh City Paper · ↑ top
Pirates (55-54)
Wed Jul 29 · Diamondbacks 3 · Pirates 0 · Final
Rodríguez goes 8 innings, Moreno hits 2-run homer as Diamondbacks blank Pirates 3-0
Up Next · Pirates @ Reds · Thu Jul 30, 7:10 PM
Latest developments: One day before the July 31 trade deadline, the Post-Gazette laid out five clubs the Pirates could partner with and named pieces in play, including Luke Weaver, Jo Adell, Kirby Yates, and Camilo Doval.
With the July 31 Major League Baseball trade deadline looming, the Post-Gazette sketched five potential trade partners for the Pirates and the players who could change hands as general manager Ben Cherington sizes up the market.
Sources: Post-Gazette Pirates · ↑ top
Latest developments: At Steelers camp in Latrobe, veteran Mason Rudolph said he is comfortable in the quarterback competition as Will Howard and Drew Allar develop behind Aaron Rodgers.
The Post-Gazette reported from Saint Vincent College that Mason Rudolph, back for another Steelers stint, feels settled in a quarterback room head coach Mike McCarthy is building around starter Aaron Rodgers, with young passers Will Howard and Drew Allar working to develop.
Sources: Post-Gazette Steelers · ↑ top
Latest developments: On the latest 'Not Just Football,' host Cam Heyward and former teammate Ryan Clark revisited Clark once calling a young Heyward a 'bust,' along with Antonio Brown and old locker-room stories.
'Not Just Football,' the podcast hosted by Steelers defensive lineman Cam Heyward, welcomed former teammate and ESPN analyst Ryan Clark, who recounted a tense early moment with a rookie Heyward, dubbing him a 'bust' at the time, and swapped tales about Antonio Brown and the Steelers locker room.
Sources: Not Just Football with Cam Heyward · ↑ top
Latest developments: U.S. Soccer president Cindy Parlow Cone said July 29, before the MLS All-Star Game, that talks to extend Mauricio Pochettino as U.S. men's coach are "going well" and an announcement is coming soon.
The United States Soccer Federation must settle whether Mauricio Pochettino stays on as men's national team manager after the Americans' round-of-16 exit at the 2026 World Cup, and Parlow Cone signaled a resolution is close.
Sources: ESPN Soccer · ↑ top
Latest developments: Caeleb Dressel won the 100-meter freestyle at the USA Swimming National Championships on July 28 in his fastest time since the 2024 Olympic trials.
Former Olympic champion Caeleb Dressel opened the USA Swimming National Championships with a 100-meter freestyle victory, his quickest swim in the event since the 2024 trials, a promising marker on the road to the 2028 Los Angeles Games.
Sources: ESPN Olympics · ↑ top
Latest developments: The U.S. Biathlon board voted July 29 to push back its planned merger with U.S. Ski & Snowboard to review the details after opposition from its community.
U.S. Biathlon, weighing whether to move under U.S. Ski & Snowboard to boost revenue and performance, delayed the decision after pushback from athletes and members, slowing a rare consolidation of Olympic sport organizations.
Sources: ESPN Olympics · ↑ top
S&P 500 7,395.68 ▼ -1.2% Dow 52,042.09 ▼ -0.3% Nasdaq 24,873.09 ▼ -3.2% WTI crude 85.57 ▲ +2.7% EUR/USD 1.1388 ▼ -0.4% GBP/USD 1.3323 ▼ -1.0% USD/JPY 163.63 ▲ +0.7%