daily plain-text briefing: security, markets, business, and pittsburgh
Attackers actively exploit an N-able N-central authentication bypass to seize managed endpoints as INC ransomware roots SonicWall VPN appliances and Iran's water-system campaign spreads to seven states.
Latest developments: N-able confirmed its first fix was incomplete and shipped build 2026.3.1.7 on August 2 as the first safe version after attackers used a patch bypass to take over N-central servers and reach the customer endpoints behind them.
CVE-2026-18577 is an authentication bypass in N-able N-central, the remote monitoring and management platform managed service providers run to control customer fleets; attackers gain remote administrative access to servers and the managed endpoints they reach. N-central operators should update to build 2026.3.1.7 and hunt for intrusions.
Sources: The Hacker News · BleepingComputer · Help Net Security · SecurityWeek · ↑ top
Latest developments: Resecurity named INC Ransomware the dominant actor exploiting recently disclosed SonicWall SMA 1000 flaws, accelerating attacks since the start of August 2026 and posting multiple victims to its data leak site.
SonicWall Secure Mobile Access 1000-series VPN appliances carry recently disclosed vulnerabilities that the INC Ransomware gang exploits for root access and lateral movement into corporate networks. Organizations running SMA 1000 appliances should patch immediately and check for compromise.
Sources: The Hacker News · SecurityWeek · ↑ top
Latest developments: The ExfilSquad group leaked contact details of more than 100,000 U.K. police officers, staff, and criminal justice professionals stolen from the Police National Legal Database and published the data on the dark web.
The Police National Legal Database, a U.K. legal-reference service, suffered a breach identified July 26 that exposed names, organizations, and work email addresses of police officers, government partners, and customers. Affected personnel face heightened phishing and impersonation risk.
Sources: BleepingComputer · The Hacker News · ↑ top
Latest developments: Unit 42 detailed three attack paths—Pass-ta-key, Silver Pass-ta-key, and Golden Pass-ta-key—that let malware running as an ordinary Windows user sign into passkey-protected accounts through Chrome's Google Password Manager cloud authenticator with no fingerprint, PIN, or on-screen prompt, the strongest variant stealing the master key.
Chrome's Google Password Manager doubles as a cloud authenticator for passkeys; Unit 42 showed local malware can abuse it to take over passkey-protected accounts silently. The finding follows Unit 42's separate report that unvalidated User Verified flags downgrade passkey multifactor authentication to a single factor.
Sources: The Hacker News · ↑ top
Latest developments: SecurityWeek reported that the Iran-linked campaign against U.S. water systems reaches at least six states beyond Minnesota, including Michigan, South Dakota, and Georgia.
Iran-linked attackers target internet-exposed controls at small U.S. community water utilities, changing passwords and locking out operators. CISA urges the water and wastewater sector to pull exposed programmable logic controllers offline.
Sources: SecurityWeek · ↑ top
Latest developments: Researchers disclosed three high-severity flaws in Hugging Face's Diffusers library that let crafted model repositories bypass the trust_remote_code safeguard and silently run arbitrary code on machines loading them.
Diffusers is a widely used library for running AI image and diffusion models; the flaws let a malicious model repository execute code despite trust_remote_code, the protection meant to stop unreviewed code from running, opening the AI supply chain to compromise. Users should update.
Sources: The Hacker News · ↑ top
Latest developments: Japanese finance minister Satsuki Katayama confirmed Tokyo will again intervene jointly with Washington to steady the yen, extending the coordinated action the U.S. Treasury began July 31.
Satsuki Katayama, Japan's finance minister, said Tokyo and the U.S. Treasury stand ready to intervene together in currency markets to counter disorderly moves in the yen, building on the New York Fed's July 31 dollar sales, Washington's first intervention to support the currency.
This Afternoon: Sunny, high 80F.
Tonight: Clear then Patchy Fog, low 58F.
Tuesday: Patchy Fog then Sunny, high 86F.
Latest developments: Wayfair confirmed it will open its first Pennsylvania brick-and-mortar store in the Pittsburgh region, growing a physical footprint that now numbers three stores nationwide.
Online furniture retailer Wayfair, which runs just three physical stores, chose the Pittsburgh area for its first Pennsylvania storefront as it adds locations across the country.
Sources: Pittsburgh Post-Gazette · WTAE · ↑ top
Latest developments: A state-of-the-neighborhood review found the Strip District added 16 businesses over the past year, its strongest run of new openings since 2022, even as large-scale development cools.
Pittsburgh's Strip District gained 16 new businesses in the past year, its best showing since 2022, as the neighborhood shifts from a construction boom toward a retail boost, WPXI reported.
Latest developments: John Scalo took over as president of Burns & Scalo, the Pittsburgh roofing firm marking its 70th year in business.
John Scalo became president of Burns & Scalo, the family roofing company celebrating 70 years in the Pittsburgh region.
Latest developments: Health officials reported the first two deaths tied to the region's cyclosporiasis outbreak, an escalation from the 35 infections and two hospitalizations Allegheny County counted a week ago.
Two people have died in the cyclosporiasis outbreak that has sickened dozens across the region, health officials said Monday, the first fatalities in the parasitic-infection cluster the Pennsylvania Department of Health has tracked.
Latest developments: Pittsburgh began offering free public transit to 750 city employees, a program officials hope will lift downtown foot traffic as workers return in person.
Pittsburgh will provide free public transportation to 750 city employees, an initiative city officials say should also boost downtown activity as more staff return to in-person work.
Latest developments: Pennsylvania senators John Fetterman and Dave McCormick joined two colleagues to introduce the Spotted Lanternfly Research and Development Act, aimed at the invasive insect spreading across the state.
U.S. senators John Fetterman and Dave McCormick of Pennsylvania co-sponsored the bipartisan Spotted Lanternfly Research and Development Act, which would make the crop-threatening invasive insect a high-priority research initiative for the National Institute of Food and Agriculture.
Latest developments: The Canonsburg Educational and Cultural Institute announced Pittsburgh rock band The Clarks will headline the first concert at the new Canon Theatre on Saturday, October 24.
Pittsburgh rock band The Clarks will play the inaugural concert at the Canon Theatre, the region's newest entertainment venue in Canonsburg, on Saturday, October 24, 2026.
Pirates (56-57)
Sun Aug 2 · Pirates 2 · Reds 10 · Final
Burns wins 12th straight decision, Stewart hits 24th HR, as Reds beat Pirates 10-2
Up Next · Pirates @ Brewers · Mon Aug 3, 7:40 PM
Latest developments: Post-Gazette's Noah Hiles named receiver Roman Wilson the Steeler with the most to gain at training camp, fighting for snaps in a crowded room.
Post-Gazette columnist Noah Hiles wrote that third-year receiver Roman Wilson has the most to gain at Steelers camp, needing to carve out targets behind DK Metcalf and Michael Pittman Jr. and past newcomer Germie Bernard.
Sources: Post-Gazette Steelers · ↑ top
S&P 500 7,417.09 ▼ -0.5% Dow 52,248.93 ▲ +0.5% Nasdaq 24,949.59 ▼ -1.9% WTI crude 82.92 ▼ -5.0% EUR/USD 1.1428 ▲ +0.2% GBP/USD 1.3351 ▼ -0.3% USD/JPY 162.95 = -0.0%