================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Friday, August 7, 2026 - 7:35 PM EDT ================================================================ Attackers exploited a Metabase SQL injection zero-day to breach Framework and Tally as a vishing and social-engineering wave struck Wall Street firms, Levi Strauss, and North Carolina's ports. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Attackers keep beating tech by working the humans, as UNC6671 callers impersonate IT help desks on personal phones and con artists trick three Levi Strauss employees into surrendering corporate data. see: UNC6671 Vishing Extortion Rebrands as BlackFile Splinters; Levi Strauss and North Carolina Ports Confirm Attacks * [TREND] Decades-old code keeps yielding fresh compromises, from an 18-year-old Linux SCTP flaw that grants root to a Metabase SQL injection zero-day that breached Framework and Tally. see: New Critical Bugs Span WordPress, Linux, and LoadMaster; Metabase SQL Injection Zero-Day Breaches Framework and Tally * [TREND] Criminals now let AI generate the camouflage, flooding npm with nearly 800 typosquatted packages that all drop a cross-platform remote access trojan and infostealer. see: Malicious npm Flood and TeamPCP's Long History * [UPDATE (new)] The Senate confirmed NTIA official Adam Cassady as cyber ambassador-at-large just as the EU AI Act's Article 50 transparency rules approach enforcement. see: Senate Confirms Cyber Ambassador as EU AI Act Nears Enforcement * [UPDATE (new)] Slow-moving downpours triggered flash flooding Friday, stranding about a dozen vehicles on Rodi Road in Penn Hills and swamping roads in Greensburg and Finleyville. see: Flash Flooding Swamps Roads Across the Region * [TREND] At Steelers camp, the team is banking on Michael Pittman to settle its No. 2 receiver question while linebackers Payton Wilson and Patrick Queen build growing rapport. see: Steelers Bank on Pittman as No. 2 Receiver; Wilson-Queen Partnership Pays Off at Linebacker SECURITY ---------------------------------------------------------------- 1. NEW CRITICAL BUGS SPAN WORDPRESS, LINUX, AND LOADMASTER Vulnerabilities and Exploits · [patch, vulnerability, zero-day] Latest developments: WordPress patched a pre-authentication reflected XSS, CVE-2026-64638 at CVSS 8.9, that pwn.ai chained into PHP code execution and that affects every version; Tencent researchers turned an 18-year-old Linux SCTP use-after-free into root and a container escape, fixed in kernels 7.1.6, 6.18.42, 6.12.101, and 6.6.148; CISA added Progress LoadMaster command injection CVE-2026-8037 to its Known Exploited Vulnerabilities catalog; and Microsoft, Apple, and Chrome 151 shipped fresh fixes. A dense batch of high-severity flaws hit web, operating-system, and load-balancer software, one already under active exploitation. Administrators should prioritize the LoadMaster and WordPress fixes and update older Linux kernels running SCTP. - The Hacker News: https://thehackernews.com/2026/08/new-wordpress-pre-auth-xss-could-lead.html - The Hacker News: https://thehackernews.com/2026/08/18-year-old-linux-sctp-flaw-could-let.html - CISA Advisories: https://www.cisa.gov/news-events/alerts/2026/08/07/cisa-adds-one-known-exploited-vulnerability-catalog - SecurityWeek: https://www.securityweek.com/microsoft-apple-release-fresh-security-updates/ 2. UNC6671 VISHING EXTORTION REBRANDS AS BLACKFILE SPLINTERS Ransomware and Cybercrime · [extortion, vishing, cybercrime] Latest developments: SecurityWeek and The Hacker News reported that UNC6671, which first called itself BlackFile, has expanded into the Redact, Pink, Helix, and Falcon brands and now calls employees on their personal phones, posing as IT help desk staff running urgent security migrations to steal SaaS data. UNC6671 is a data-extortion crew hitting financial services, private equity, and professional services firms through voice phishing. Verify any help-desk request for credentials or migration steps through a separate, trusted channel. - SecurityWeek: https://www.securityweek.com/vishing-extortion-group-unc6671-rebrands-after-making-millions/ - The Hacker News: https://thehackernews.com/2026/08/unc6671-vishing-attacks-target-personal.html 3. LEVI STRAUSS AND NORTH CAROLINA PORTS CONFIRM ATTACKS Data Breaches · [breach, social-engineering] Latest developments: Levi Strauss & Co. said hackers socially engineered three employees to reach and steal corporate data from their machines, and the North Carolina State Ports Authority confirmed a cyberattack that disrupted IT systems and slowed operations at the Port of Wilmington, the Port of Morehead City, and the Charlotte Inland Port. Two unrelated incidents show attackers pairing employee manipulation with operational disruption. Levi Strauss lost corporate files to social engineering; North Carolina's ports saw cargo handling slow while responders worked to restore systems. - BleepingComputer: https://www.bleepingcomputer.com/news/security/levi-strauss-and-co-says-hackers-stole-corporate-data-in-cyberattack/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/north-carolina-ports-confirms-cyberattack-disrupting-operations/ 4. MALICIOUS NPM FLOOD AND TEAMPCP'S LONG HISTORY Software Supply Chain · [supply-chain, malware] Latest developments: OpenSourceMalware researcher Paul flagged nearly 800 npm packages using AI-generated typosquatted names that all deliver a cross-platform remote access trojan and infostealer to Windows, macOS, and Linux, while a separate analysis tied the TeamPCP actor's supply-chain campaign back to Redis server attacks running since 2020. Attackers keep abusing npm's open publishing to seed convincing package names at scale, and TeamPCP shows how long a group can compromise internet-facing infrastructure before pivoting to the supply chain. Pin and audit dependencies rather than trusting names. - The Hacker News: https://thehackernews.com/2026/08/nearly-800-malicious-npm-packages.html - The Hacker News: https://thehackernews.com/2026/08/teampcp-linked-to-redis-attacks-dating.html 5. SENATE CONFIRMS CYBER AMBASSADOR AS EU AI ACT NEARS ENFORCEMENT Policy and Regulation · [policy] Latest developments: The Senate confirmed NTIA official Adam Cassady as the State Department's ambassador-at-large for cyber policy, the second person to hold the post, while Veeam Field CTO Edwin Weijdema said the EU AI Act's Article 50 transparency rules will likely produce corrective orders more often than large fines in their first year. Washington filled its top cyber-diplomacy role as Europe prepares to enforce AI transparency obligations, including rules on when an AI agent counts as interacting with a person. Enterprises should map where their AI systems disclose themselves to users. - The Record: https://therecord.media/adam-cassady-confirmed-senate-cyber-ambassador - Help Net Security: https://www.helpnetsecurity.com/2026/08/07/edwin-weijdema-veeam-eu-ai-act-transparency/ 6. METABASE SQL INJECTION ZERO-DAY BREACHES FRAMEWORK AND TALLY Vulnerabilities and Exploits · [zero-day, vulnerability, breach] Latest developments: BleepingComputer reported that attackers exploited a critical Metabase SQL injection zero-day to hit self-hosted instances and steal data, naming laptop maker Framework and accounting app Tally among the victims. Metabase is a widely deployed open-source business-intelligence tool; the flaw let attackers pull data directly from customer instances. Organizations running Metabase should patch immediately and hunt for signs of compromise. - BleepingComputer: https://www.bleepingcomputer.com/news/security/framework-tally-disclose-metabase-data-theft-attacks/ BUSINESS AND POLITICS ---------------------------------------------------------------- * Trump Moves Again to Oust Fed Governor Cook Latest developments: The White House sent Lisa Cook a letter this week demanding she answer mortgage-fraud allegations, reopening the removal fight the Supreme Court blocked in June 2026. President Trump revived his push to fire Federal Reserve governor Lisa Cook over mortgage-fraud allegations she denies, reigniting a fight over central-bank independence months after the Supreme Court let her keep her seat while the case proceeds. - WSJ Politics: https://www.wsj.com/politics/white-house-revives-attempt-to-fire-fed-governor-lisa-cook-9341c88e?mod=rss_socialpoliticsfeed - FT World: https://www.ft.com/content/0012c7c9-fb31-4c90-a2e7-e65bd4629b22?syn-25a6b1a6=1 * Saudi Arabia, Turkey, and Pakistan Sign Defense Pact Latest developments: Saudi Arabia, Turkey, and Pakistan signed a mutual defense pact, a new security bloc forming in the wake of the Iran war. Saudi Arabia, Turkey, and nuclear-armed Pakistan signed a defense pact, a realignment that reflects the scramble for new security arrangements across the Middle East after the Iran war and a cooling toward the U.S.-brokered Abraham Accords. - WSJ World News: https://www.wsj.com/world/middle-east/saudi-arabia-turkey-and-pakistan-sign-defense-pact-ba80d84d?mod=rss_worldnews PITTSBURGH ---------------------------------------------------------------- Weather: Tonight: Chance Showers And Thunderstorms, low 69F. Saturday: Showers And Thunderstorms Likely then Chance Showers And Thunderstorms, high 85F. Saturday Night: Chance Showers And Thunderstorms then Partly Cloudy, low 69F. Business: * Steelers Night Practice to Pump $200K Into Latrobe Latest developments: Organizers say the Steelers' Saturday practice under the lights at Latrobe Memorial Stadium will raise about $200,000 for the city of Latrobe and the Greater Latrobe School District. The Pittsburgh Steelers leave Saint Vincent College for their annual night practice August 8 at the 75-year-old Latrobe Memorial Stadium, an event organizers expect to generate roughly $200,000 for Latrobe and its school district. - KDKA: https://www.cbsnews.com/pittsburgh/news/pittsburgh-steelers-night-practice-latrobe/ * Omni William Penn Marks Housekeeper's 50 Years Latest developments: The Omni William Penn Hotel honored housekeeping employee Dee Dee Gowder for 50 years of service with a celebration. The Omni William Penn Hotel in downtown Pittsburgh celebrated housekeeper Dee Dee Gowder for a half-century on the job, a rare span of tenure in the hospitality trade. - KDKA: https://www.cbsnews.com/pittsburgh/video/pittsburgh-hotel-employee-honored-for-50-years-of-service/ Around town: * Flash Flooding Swamps Roads Across the Region Latest developments: Slow-moving downpours triggered flash flooding Friday, stranding about a dozen vehicles on Rodi Road in Penn Hills and flooding roads in Greensburg and Finleyville. Heavy Friday rain flooded roads across Western Pennsylvania under a flood warning spanning multiple counties, submerging part of Rodi Road in Penn Hills where about a dozen vehicles stalled, flooding streets in Greensburg, and covering Mingo Church Road in Finleyville, Washington County. - WTAE: https://www.wtae.com/article/flash-flooding-on-rodi-road-in-penn-hills/73379370 - WTAE: https://www.wtae.com/article/flooding-strikes-westmoreland-county/73379874 - WTAE: https://www.wtae.com/article/pittsburgh-weather-heavy-rain-storms-possible/73375361 * Smithfield Street Bridge Lane Restrictions Next Week Latest developments: The Smithfield Street Bridge will run lane restrictions in both directions Monday through Friday next week. The Smithfield Street Bridge, which connects downtown Pittsburgh and the South Side, faces lane restrictions in each direction from Monday through Friday next week. - TribLive: https://triblive.com/local/regional/traffic-roundup-smithfield-street-bridge-restrictions-coming-next-week/ * Great Allegheny Passage Closure Extended Two Weeks Latest developments: Boulders threatening a Mon Valley section pushed the closure of a popular Great Allegheny Passage segment two weeks longer than planned. A key Mon Valley segment of the Great Allegheny Passage will stay closed two extra weeks after boulders threatened the route, extending a shutdown on one of the Pittsburgh region's most-used trails for cyclists and walkers. - TribLive: https://triblive.com/local/great-allegheny-passage-closure-extended-for-2-weeks/ - Pittsburgh Post-Gazette: https://www.post-gazette.com/life/outdoors/2026/08/07/great-allegheny-passage-closure-update/stories/202608060050 Events: * Lúnasa Celtic Festival Saturday Latest developments: The Lúnasa Celtic festival comes to Pittsburgh on Saturday, August 8. Lúnasa: A Celtic Festival Cultivating the Light of Abundance, a Celtic celebration, takes place Saturday, August 8, in Pittsburgh. - KDKA: https://www.cbsnews.com/pittsburgh/video/lunasa-a-celtic-festival-cultivating-the-light-of-abundance-is-in-pittsburgh/ SPORTS ---------------------------------------------------------------- Around the Teams: * Steelers Bank on Pittman as No. 2 Receiver Latest developments: The Post-Gazette and TribLive report the Steelers are counting on Michael Pittman Jr. to settle their long No. 2 receiver question, praising his 'combat catch' ability despite a quiet camp start. The Pittsburgh Steelers are counting on newcomer Michael Pittman Jr. to fill a long-vacant No. 2 receiver role, and the Post-Gazette and TribLive credit his contested-catch, 'combat catch' strength even after he opened training camp in Latrobe quietly. - Pittsburgh Post-Gazette: https://www.post-gazette.com/sports/steelers/2026/08/07/pittman-rodgers-colts-flacco-ryan-rivers/stories/202608070046 * Wilson-Queen Partnership Pays Off at Linebacker Latest developments: The Post-Gazette reports the growing rapport between linebackers Payton Wilson and Patrick Queen is paying dividends at training camp. The Pittsburgh Steelers' inside linebacker pairing of Payton Wilson and Patrick Queen has built a chemistry the Post-Gazette says is translating into sharper play at camp in Latrobe. - Pittsburgh Post-Gazette: https://www.post-gazette.com/sports/steelers/2026/08/07/payton-wilson-queen-trainingcamp-linebackers/stories/202608070009 * Pirates Give Josh Harrison a Fitting Sendoff Latest developments: Post-Gazette columnist Noah Hiles writes the Pirates are giving longtime infielder Josh Harrison the career ending he deserved. Pittsburgh Post-Gazette columnist Noah Hiles argues the Pirates, under owner Bob Nutting, are giving fan-favorite infielder Josh Harrison the send-off his career earned. - Pittsburgh Post-Gazette: https://www.post-gazette.com/sports/columns/2026/08/07/mlb-pirates-josh-harrison-bob-nutting/stories/202608070049 Team USA: * USMNT Stalls Under Pochettino Despite New Deal Latest developments: ESPN assesses that the U.S. men's national team has not meaningfully improved under Mauricio Pochettino and questions whether his new contract will change that. ESPN judged that the United States men's national team has shown little improvement since hiring Mauricio Pochettino, casting doubt on his freshly signed extension through the 2030 World Cup as the U.S. prepares to co-host the 2026 tournament with Canada and Mexico. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49546977/usmnt-not-improved-pochettino-new-contract-coach-extension-2026 * U.S. Players Land New Clubs in Summer Window Latest developments: ESPN graded American players' summer moves, handing defender Arfsten a B+ for his transfer to Middlesbrough. ESPN graded the summer transfers of United States men's national team players, giving Arfsten a B+ for his move to Middlesbrough as several Americans found new clubs during the 2026 window. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49531065/usmnt-summer-transfers-grading-major-american-players-signings READING ---------------------------------------------------------------- * Ed Zitron -- Premium: The Hater's Guide To NVIDIA (Part 2) Zitron extends his skeptical case against NVIDIA, arguing the company's insistence that it resembles neither Enron, WorldCom, nor Lucent invites exactly that comparison through the Streisand Effect. https://www.wheresyoured.at/premium-the-haters-guide-to-nvidia-part-2/ * Stratechery -- Google Earnings, The Frontier Case, Amazon Earnings Ben Thompson reads Google's earnings as confirming its Anthropic hedge and credits Amazon CEO Andy Jassy with explaining why both companies' heavy AI capital spending is justifiable. https://stratechery.com/2026/google-earnings-the-frontier-case-amazon-earnings/ * Cal Newport -- Did OpenAI's New Model "Go Rogue"? Newport examines an intrusion into Hugging Face's production infrastructure and weighs claims that an OpenAI model acted autonomously, separating the hype from what the evidence supports. https://calnewport.com/did-openais-new-model-go-rogue/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,652.05 ▲ +3.4% Dow 53,596.71 ▲ +2.8% Nasdaq 26,116.91 ▲ +5.0% WTI crude 78.66 ▼ -6.2% EUR/USD 1.1533 ▲ +0.9% GBP/USD 1.3459 ▲ +0.8% USD/JPY 157.76 ▼ -3.2% ================================================================ Generated 2026-08-07 19:35 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================