daily plain-text briefing: security, markets, business, and pittsburgh
Attackers piled onto freshly disclosed enterprise flaws in Microsoft SharePoint, Cisco firewalls, and VMware vCenter as a stealth operation quietly drained Salesforce and ServiceNow data worldwide for 17 months.
Latest developments: Hackers began weaponizing Rapid7's proof-of-concept for SharePoint flaw CVE-2026-55040 within a day of its Tuesday release, extending a wave in which Cisco ASA and FTD CVE-2026-20349 crash firewalls remotely and VMware vCenter CVE-2026-59310 grants persistent code execution.
Three widely deployed enterprise products now face live attacks: Microsoft SharePoint Server, Cisco Secure Firewall ASA and Threat Defense, and Broadcom VMware vCenter. Apply the vendor patches immediately and hunt for signs of prior compromise.
Sources: BleepingComputer · The Hacker News · The Hacker News · ↑ top
Latest developments: Adobe shipped fixes for three CVSS 10.0 bugs led by ColdFusion operating-system command injection CVE-2026-48362, SonicWall patched critical unauthenticated remote code-execution flaws in its discontinued GMS platform, and Ivanti closed remotely exploitable Endpoint Manager defects that leak external SQL credentials.
A fresh round of perfect and near-perfect severity flaws hits Adobe ColdFusion, Commerce, and Campaign Classic, SonicWall GMS, and Ivanti EPM, several allowing unauthenticated code execution. Administrators should patch or retire the affected servers, especially internet-facing ColdFusion and GMS installs.
Sources: The Hacker News · SecurityWeek · SecurityWeek · ↑ top
Latest developments: Check Point tied the fresh Windows zero-day to Lazarus's Operation Dream Job, in which the North Korean crew poses as recruiters, ships trojanized PDF software carrying a Lockheed Martin job decoy, and installs the ForestTiger backdoor against defense targets, and CISA gave federal agencies two weeks to patch.
Lazarus lures IT and defense-sector workers with fabricated job openings, then chains a full-control Windows zero-day into persistent access. Defense contractors and their suppliers should patch the flagged Microsoft bug and treat unsolicited recruiter attachments as hostile.
Sources: Help Net Security · SecurityWeek · The Record · ↑ top
Latest developments: Wired reported researchers can open an exterior hatch on a Boeing 737 in under 60 seconds, plug in a coin-sized device, and redirect the autopilot or sabotage the flight plan, while Delta Air Lines and FBI Atlanta opened a probe into a rogue Wi-Fi network and deauthentication attack aboard a Las Vegas-to-Atlanta flight carrying DEF CON attendees.
New work exposes physical and wireless attack paths against commercial aviation, from a hardware implant that hijacks a 737's autopilot to a fake hotspot that knocked passengers off in-flight Wi-Fi. No arrests have followed the Delta incident, and the FBI's Atlanta field office continues to investigate.
Sources: Wired Security · BleepingComputer · Ars Technica Security · ↑ top
Latest developments: Reco disclosed City-Forum, a campaign that abuses unauthenticated guest access to quietly enumerate and exfiltrate data from Salesforce and ServiceNow tenants worldwide for 17 months, run from a rented German server tied to a domain first registered in 2002.
The operators pull records through portals configured to allow guest users, a design many administrators leave open by default. Organizations should audit guest permissions on both platforms and lock down public-facing communities.
Sources: Help Net Security · SecurityWeek · ↑ top
Latest developments: Researchers showed that the encrypted reasoning objects OpenAI, Anthropic, and Google pass between reasoning-API calls can be replayed from one session into another, letting a weaker model decode a stronger model's hidden reasoning and recover API keys and passwords from session logs.
The flaw sits in how the three providers carry hidden chain-of-thought between calls, exposing internal reasoning and embedded secrets. Teams building on these reasoning APIs should rotate any keys handled inside prompts and watch vendor advisories for fixes.
Sources: The Hacker News · ↑ top
Latest developments: The July consumer-price index rose 3.4% year over year, matching forecasts, as falling gasoline prices offset lingering fallout from the Iran war.
U.S. consumer prices climbed 3.4% in the year through July as pump prices declined, and the dollar and Treasury yields slipped after the reading while stocks opened higher, the print keeping Federal Reserve rate-cut hopes alive even as the Iran war reverberates through the economy.
Sources: FT World · WSJ Markets · ↑ top
Latest developments: OPEC again lowered its 2026 global oil-demand growth forecast as talks to reopen the Strait of Hormuz stalled, and crude futures fell on the absence of any imminent deal.
The Organization of the Petroleum Exporting Countries cut its forecast for global oil-demand growth for a second time, citing the closed Strait of Hormuz and Red Sea risks that keep choking supply; the waterway carries roughly a fifth of the world's oil, and its shutdown amid the Iran war has left crude volatile.
Sources: WSJ US Business · WSJ Markets · ↑ top
Today: Mostly Cloudy then Slight Chance Showers And Thunderstorms, high 83F.
Tonight: Chance Showers And Thunderstorms, low 68F.
Thursday: Patchy Fog then Chance Showers And Thunderstorms, high 84F.
Latest developments: The Post-Gazette reported that Pennsylvania quietly enacted a law undermining a state court decision governing ownership of lucrative underground mineral rights.
Pennsylvania passed legislation that undercuts a recent court ruling on who owns valuable oil-and-gas mineral rights, a shift that reshapes who collects royalties from the deposits beneath Western Pennsylvania land.
Sources: Pittsburgh Post-Gazette · ↑ top
Latest developments: Pittsburgh Restaurant Week returned with discounted and special-menu meals at dozens of area restaurants, WPXI reported.
Pittsburgh Restaurant Week is running deals at dozens of restaurants across the region, the recurring promotion that draws diners to participating kitchens with lower-priced and prix-fixe menus.
Latest developments: Indiana Township officials said a third phase of accessibility upgrades will extend a wheelchair-friendly sidewalk through Emmerling Park.
Indiana Township is expanding a wheelchair-friendly walkway into its third phase at Emmerling Park, opening more of the site's 120 acres to visitors who use wheelchairs.
Latest developments: The Monessen City School District tabled a motion that would let Adelphoi run a behavioral program in the middle school's sixth-grade wing.
The Monessen City School District held off on a proposal to give the Adelphoi youth-services agency classrooms in the middle school's sixth-grade wing for a behavioral program, WTAE reported.
Latest developments: Forecasters said the Perseid meteor shower peaks the night of Wednesday, August 12, with the display lingering into late August.
The annual Perseid meteor shower reaches its peak over Western Pennsylvania on the night of Wednesday, August 12, and stays visible through the end of the month, WPXI reported.
Latest developments: WPXI reported the 26th annual Little Italy Days runs Thursday, August 13, through Sunday, August 16, along Liberty Avenue in Bloomfield.
The 26th annual Little Italy Days brings food vendors, music, and Italian-American culture to Liberty Avenue in Pittsburgh's Bloomfield neighborhood from Thursday, August 13, through Sunday, August 16.
Latest developments: Paul Skenes told the Post-Gazette he is unsure why the Pirates are not playing up to their standard as the second-half slide deepens.
Pirates ace Paul Skenes said he cannot explain why Pittsburgh has stopped playing to its standard as the club's second-half losing streak drops it further in the National League Central, per the Post-Gazette.
Sources: Post-Gazette Pirates · ↑ top
Latest developments: Youri Tielemans said FIFA's decision to suspend United States forward Folarin Balogun's red card helped inspire Belgium in their World Cup knockout tie against the U.S., ESPN reported.
Belgium midfielder Youri Tielemans said FIFA's surprise move to overturn Folarin Balogun's red card fired up his side in their World Cup knockout match against the United States men's national team, a call that drew scrutiny to the officiating in the U.S. co-hosted tournament.
Sources: ESPN Soccer · ↑ top
S&P 500 7,734.49 ▲ +2.9% Dow 54,007.80 ▲ +2.5% Nasdaq 26,490.64 ▲ +3.9% WTI crude 79.20 ▼ -3.1% EUR/USD 1.1543 ▲ +0.5% GBP/USD 1.3476 ▲ +0.5% USD/JPY 158.15 ▼ -1.5%