================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Tuesday, August 4, 2026 - 10:05 AM EDT ================================================================ Autonomous AI turned decisively offensive as Palo Alto Networks' NOVA system surfaced more than 14,000 open-source vulnerabilities while misconfigured AI agents spilled secrets from meeting rooms to code repositories. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Frontier AI cut both ways as Palo Alto's NOVA surfaced 14,000 unknown flaws while a tl;dv Firebase misconfiguration and Google's pulled ADK workflows turned AI helpers into leaks. see: Frontier AI Industrializes Zero-Day Discovery; AI Agents and Assistants Spill Secrets * [TREND] Social engineering outpaced technical controls as device-code phishing spiked 1,500% and adversaries abused Cloudflare Workers and Vercel to slip past multifactor authentication. see: Social Engineering and MFA-Bypass Phishing Surge * [UPDATE (new)] New disclosures piled up with Forescout's 15 TP-Link Omada flaws and cPanel's 9.4-rated CVE-2026-58048, while Switzerland's BIT reported roughly 200 accounts compromised via SharePoint. see: TP-Link Omada and cPanel Flaws; Swiss Federal IT Agency Breach * [UPDATE (new)] Apple mounted a fresh legal challenge to British demands to bypass Advanced Data Protection, aiming to keep end-to-end encrypted iCloud accounts closed to the government. see: Apple Fights UK iCloud Access Demand * [TREND] Commentators reweighed AI's real economics as Thompson read Microsoft's efficiency payoff, Zitron warned model costs are climbing fast, and Newport downplayed OpenAI 'rogue' fears. see: Microsoft Earnings, Microsoft vs. Meta, The Efficiency Payoff; Premium: AI Is Getting Way Too Expensive; Did OpenAI's New Model "Go Rogue"? SECURITY ---------------------------------------------------------------- 1. SOCIAL ENGINEERING AND MFA-BYPASS PHISHING SURGE Ransomware and Cybercrime · [phishing, mfa, scam] Latest developments: Dark Reading reported device-code phishing rose 1,500% and vishing doubled across 2026, Kaspersky detailed adversary-in-the-middle phishing that abuses Cloudflare Workers, Vercel, Netlify, GitHub Pages, and IPFS to bypass multifactor authentication, and fresh scams impersonate American Express with a fake child-exploitation accusation and the IRS with bogus Digital Asset Compliance Portal letters. Attackers lean on social engineering and legitimate cloud hosting to defeat MFA and entrenched controls while leaving little evidence; consumers face fake fraud calls and crypto-tax letters designed to panic them into paying. - Dark Reading: https://www.darkreading.com/cybersecurity-analytics/device-code-phishing-vishing-doubles - Securelist (Kaspersky): https://securelist.com/cloud-platforms-in-phishing/120832/ - Frank on Fraud: https://frankonfraud.com/your-credit-card-has-been-used-in-a-crime-scam-spreads/ - Graham Cluley: https://www.bitdefender.com/en-us/blog/hotforsecurity/fake-irs-letters-cryptocurrency 2. AI AGENTS AND ASSISTANTS SPILL SECRETS AI Security · [ai, agents, breach] Latest developments: Dark Reading found a Google Firebase misconfiguration in the tl;dv meeting notetaker that lets any user query other users' meetings and join their calls, Google deleted three workflows from its Agent Development Kit after Pillar Security showed a malicious GitHub issue could trigger a privileged code-fixing agent, and SecurityWeek detailed weaponized email AI assistants that impersonate employees and hijack executive accounts. Built-in AI assistants and agent frameworks leak data and privileged actions through weak defaults and prompt injection; affected products span tl;dv, Google's ADK, and email chatbots, so buyers must govern agent permissions like human accounts. - Dark Reading: https://www.darkreading.com/application-security/ai-notetaker-spy-government-corporate-video-calls - The Hacker News: https://thehackernews.com/2026/08/google-deletes-3-adk-ai-workflows-after.html - SecurityWeek: https://www.securityweek.com/weaponized-email-ai-assistants-could-help-attackers-hijack-accounts/ 3. FRONTIER AI INDUSTRIALIZES ZERO-DAY DISCOVERY AI Security · [ai, zero-day, vulnerability] Latest developments: Palo Alto Networks' Unit 42 ran its NOVA system across the open-source software supply chain and surfaced more than 14,000 previously unknown vulnerabilities, while The Hacker News described the shift to vibe hacking that turns frontier models into a tireless junior hacker for any adversary. Autonomous AI now finds and exploits software flaws at industrial scale, severing the old link between attacker expertise and offensive capability and flooding defenders with findings faster than they can patch. - Unit 42 (Palo Alto): https://unit42.paloaltonetworks.com/frontier-ai-vulnerability-burst/ - The Hacker News: https://thehackernews.com/2026/08/when-vibe-hacking-turns-ai-into-junior.html 4. TP-LINK OMADA AND CPANEL FLAWS Vulnerabilities and Exploits · [vulnerability, patch] Latest developments: Forescout disclosed 15 new vulnerabilities in TP-Link's Omada networking ecosystem whose zero-touch-provisioning chain hands attackers full network takeover, and cPanel patched CVE-2026-58048, a 9.4-rated flaw that let an authenticated hosting customer run SQL as the database root. Fresh chains in widely deployed network gear and hosting control panels cross privilege boundaries that separate customers from administrators; operators should apply the TP-Link Omada and cPanel updates now. - SecurityWeek: https://www.securityweek.com/tp-link-omada-ztp-vulnerabilities-chain-into-full-network-takeover/ - The Hacker News: https://thehackernews.com/2026/08/new-cpanel-critical-flaw-could-let.html 5. SWISS FEDERAL IT AGENCY BREACH Data Breaches · [breach, patch, nation-state] Latest developments: Switzerland's Federal Office for Information Technology and Communications, the BIT, said its specialists detected anomalies on on-premises Microsoft servers and that intruders compromised roughly 200 accounts, with SharePoint vulnerabilities the suspected entry point. The BIT runs shared IT for Swiss federal agencies and could not confirm how the hackers got in. Organizations running on-premises SharePoint should patch immediately and hunt for signs of compromise. - The Record: https://therecord.media/swiss-bit-foitt-hacked-possibly-sharepoint-vulnerabilities 6. APPLE FIGHTS UK ICLOUD ACCESS DEMAND Policy and Regulation · [policy, encryption, privacy] Latest developments: Apple is mounting a new legal challenge to British demands for a way around its Advanced Data Protection feature, seeking to keep users' end-to-end encrypted iCloud accounts closed to the government. The United Kingdom has pressed Apple for backdoor access to encrypted iCloud data through a technical capability notice; Apple's renewed challenge tests how far a government can compel a company to weaken encryption. - The Record: https://therecord.media/apple-uk-tcn-icloud-new-legal-challenge BUSINESS AND POLITICS ---------------------------------------------------------------- * Bessent Says Strait of Hormuz Deal Is Near Latest developments: Treasury Secretary Scott Bessent said an Iran-Oman arrangement to reopen the Strait of Hormuz to shipping is imminent and Brent crude fell 4%, even as a fresh strike on a cargo ship in the strait left the opening in doubt. Iranian and Omani negotiators reached a temporary arrangement to restore tanker traffic through the Strait of Hormuz, the chokepoint for roughly a fifth of the world's oil, easing a war now in its sixth month; Saudi Aramco posted a $33 billion quarterly profit on elevated crude prices. - FT World: https://www.ft.com/content/1ed68c71-e1e8-4ae5-a965-5380cbdeaa22?syn-25a6b1a6=1 - WSJ World News: https://www.wsj.com/world/middle-east/hormuz-opening-uncertain-after-new-strike-hurdles-in-talks-e2dfd2ce - WSJ US Business: https://www.wsj.com/business/energy-oil/saudi-aramco-profit-jumps-33-on-higher-oil-prices-amid-iran-war-3ae028ce?mod=pls_whats_news_us_business_f PITTSBURGH ---------------------------------------------------------------- Weather: Today: Sunny, high 87F. Tonight: Partly Cloudy, low 68F. Wednesday: Partly Sunny then Scattered Showers And Thunderstorms, high 88F. Business: * Wayfair to Open First Pennsylvania Store Latest developments: Wayfair will open its first Pennsylvania store, a 95,000-square-foot showroom, at the North Hills Village shopping center on McKnight Road in 2027. The online furniture retailer Wayfair picked Pittsburgh's North Hills for its first physical store in the state, a 95,000-square-foot space along McKnight Road that the company will organize by room and style. - KDKA: https://www.cbsnews.com/pittsburgh/news/wayfair-north-hills-pittsburgh-first-pennsylvania-location/ * Citizens Live at the Wylie Hires Ahead of Opening Latest developments: Live Nation's Citizens Live at the Wylie, the music venue under construction on Wylie Avenue in the Hill District, began recruiting workers ahead of its opening. Citizens Live at the Wylie, the new Live Nation concert hall rising on Wylie Avenue in Pittsburgh's Hill District, opened hiring as it nears completion. - TribLive: https://triblive.com/local/morning-roundup-citizens-live-at-the-wylie-seeks-workers-fight-breaks-out-at-tacos-and-tequila-festival/ Around town: * Bethel Park Delays School Start for New Elementary Latest developments: The Bethel Park School District pushed its 2026-2027 first day back two days to align with the opening of the district's new elementary school. Bethel Park School District in the South Hills moved the start of classes for all students, adding a two-day delay to coincide with the debut of its new elementary building. - WTAE: https://www.wtae.com/article/bethel-park-2026-2027-school-start-new-elementary-school/73338688 * Ligonier Township Farmland Placed in Preservation Latest developments: Scott Tomlinson placed 35 acres of Clark Hollow farmland his family has held in Ligonier Township since the 1870s under permanent protection from development. In Westmoreland County's Ligonier Township, Scott Tomlinson protected 35 acres of family farmland in Clark Hollow, owned since the 1870s, against future development. - TribLive: https://triblive.com/local/westmoreland/ligonier-township-farmland-protected-for-generations/ * Federal Funding Expands EV Charging in Pennsylvania Latest developments: Pennsylvania's small towns will receive the newest wave of federal funding to build electric-vehicle charging stations, the Post-Gazette reported. A fresh round of federal money will install electric-vehicle chargers in small towns across Pennsylvania, extending the state's charging network beyond its cities. - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/transportation/2026/08/04/pennsylvania-ev-charging-stations/stories/202608040019 Events: * Kitty Bingo Benefits Cat Rescue Latest developments: Kitty Queen Cat Rescue holds its charity Kitty Bingo on Friday, August 7, with seating starting at 7:05 p.m. Kitty Bingo, a charity bingo night benefiting Kitty Queen Cat Rescue's North Hills shelter, runs Friday, August 7; seating begins at 7:05 p.m. before the first ball drops, and tickets cost $25 and include a bingo card. - Pittsburgh Magazine: https://www.pittsburghmagazine.com/things-to-do-this-weekend-in-pittsburgh/ SPORTS ---------------------------------------------------------------- Pirates (57-57) Mon Aug 3 · Pirates 4 · Brewers 3 · Final Horwitz drives in 3 runs, Pirates defeat Brewers for the 6th time in 7 games this season https://plaintextsports.com/mlb/2026-08-03/pit-mil Up Next · Pirates @ Brewers · Tue Aug 4, 7:40 PM https://plaintextsports.com/mlb/2026-08-04/pit-mil Around the Teams: * Young Steelers Starters Bank on Continuity Latest developments: Returning offensive starters told the Post-Gazette that keeping the same nucleus around quarterback Aaron Rodgers should pay off in 2026. The Post-Gazette reported that younger Steelers offensive starters, tight end Pat Freiermuth, tackle Troy Fautanu, guard Mason McCormick, and center Zach Frazier among them, believe a stable core around Aaron Rodgers will lift the offense this season. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/08/04/nfl-trainingcamp-freiermuth-fautanu-mccormick-frazier-rodgers/stories/202608040010 * Jaquan Brisker Comes Home to the Steelers Latest developments: Safety Jaquan Brisker told the Post-Gazette he is settling in with his hometown Steelers after four seasons with the Chicago Bears, and his family packed the training-camp stands. Gateway High School and Penn State safety Jaquan Brisker, signed by Pittsburgh after four years with the Chicago Bears, said 'I'm actually a Steeler' as his family filled the Saint Vincent College camp stands to welcome the Western Pennsylvania native home. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/08/03/jaquan-brisker-gateway-nfl-safety-lackawanna-wpial-psu/stories/202607310053 Team USA: * Gio Reyna Signs With Strasbourg Latest developments: United States midfielder Gio Reyna completed a transfer to Ligue 1's Strasbourg from Borussia Mönchengladbach, which ESPN graded a B-. USMNT attacker Gio Reyna moved to French club Strasbourg from the Bundesliga's Borussia Mönchengladbach, joining a pipeline of young American players in Ligue 1. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49527707/gio-reyna-usmnt-strasbourg-borussia-monchengladbach-bundesliga-ligue-1-transfers - ESPN Soccer: https://www.espn.com/soccer/story/_/id/48990955/summer-transfer-window-grading-big-signings-mens-soccer READING ---------------------------------------------------------------- * Stratechery -- Microsoft Earnings, Microsoft vs. Meta, The Efficiency Payoff Ben Thompson reads Microsoft's strong quarter as a sign of strategic clarity, lower costs, and tangible AI applications, and argues the reasons behind that efficiency payoff are more unsettling than they first appear. https://stratechery.com/2026/microsoft-earnings-microsoft-vs-meta-the-efficiency-payoff/ * Ed Zitron -- Premium: AI Is Getting Way Too Expensive Zitron argues that the actual cost of running large language models is climbing fast enough to undercut the industry's theoretical claims about productivity gains and displaced jobs. https://www.wheresyoured.at/premium-ai-is-getting-way-too-expensive/ * Cal Newport -- Did OpenAI's New Model "Go Rogue"? Newport examines the intrusion into Hugging Face's infrastructure and argues that alarming 'rogue AI' framing overstates what a system that simply follows its programming actually did. https://calnewport.com/did-openais-new-model-go-rogue/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,454.56 ▲ +0.1% Dow 52,442.59 ▲ +0.7% Nasdaq 25,145.96 ▼ -0.7% WTI crude 82.46 ▼ -5.4% EUR/USD 1.1458 ▲ +0.5% GBP/USD 1.3379 ▲ +0.1% USD/JPY 161.74 ▼ -0.9% ================================================================ Generated 2026-08-04 10:05 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================