daily plain-text briefing: security, markets, business, and pittsburgh
A stealthy 17-month campaign quietly siphoning Salesforce and ServiceNow data worldwide anchors a day dominated by attackers exploiting fresh enterprise flaws faster than defenders can patch.
Latest developments: Reco disclosed today that a campaign it calls City-Forum has quietly pulled records from Salesforce Experience Cloud and ServiceNow customer portals worldwide since at least March 2025, abusing unauthenticated guest access with custom tooling and continuing still.
The operators run from a rented German server tied to city-forum.com, a domain registered in 2002 and abandoned, enumerating then exfiltrating any record an anonymous guest user can reach across many industries; Reco urges administrators to audit and restrict guest permissions on both platforms.
Sources: BleepingComputer · Help Net Security · SecurityWeek · Dark Reading · ↑ top
Latest developments: Attackers began exploiting four freshly disclosed enterprise bugs today: Broadcom VMware vCenter directory-traversal CVE-2026-59310 at CVSS 9.8 for persistent remote code execution, Cisco ASA and FTD HTTP flaw CVE-2026-20349 at CVSS 8.6 for remote denial of service, a critical Microsoft SharePoint bug driven by Rapid7's just-published proof of concept, and Adobe Commerce and Magento flaw CVE-2026-71362 for customer-account hijacking.
The four span Broadcom, Cisco, Microsoft, and Adobe and hand attackers code execution, denial of service, and account takeover; every vendor has shipped a fix, and administrators should apply each one at once.
Sources: The Hacker News · The Hacker News · BleepingComputer · BleepingComputer · ↑ top
Latest developments: Wired reported that security researchers built a coin-sized device which, plugged into an exterior hatch of a Boeing 737 in under 60 seconds, redirects the aircraft's autopilot or rewrites its flight plan, and FBI Atlanta confirmed it is investigating a fake Wi-Fi hotspot attack, which observers suspect traces to the DEF CON crowd, against a Delta flight.
The Boeing technique needs brief physical access to an external maintenance hatch, and the Delta incident spoofed an in-cabin Wi-Fi hotspot to lure passengers; the FBI has made no arrests as it probes the hotspot case.
Sources: Wired Security · Ars Technica Security · ↑ top
Latest developments: Researchers found 737 free VPN and proxy extensions across at least 40 Chrome Web Store developer accounts, together carrying 75,486 installs, that impersonate well-known services and quietly route browsing through SOCKS5 proxies a single provider runs, mainly targeting Russian-speaking users chasing blocked sites.
Of the set, 274 extensions impersonate 66 legitimate brands while funneling every request through one operator's proxy infrastructure; users should pull any VPN extension that does not come from the vendor's own listing.
Sources: BleepingComputer · The Hacker News · ↑ top
Latest developments: Researchers disclosed a flaw in how OpenAI, Anthropic, and Google carry hidden chain-of-thought between reasoning API calls, letting a block minted in one session replay into another and surrender internal reasoning along with API keys and passwords sitting in session logs.
The encrypted reasoning objects the providers pass between calls held recoverable secrets, so replayed blocks leak credentials organizations never expected in a model's plumbing; teams should rotate exposed keys and treat reasoning traces as sensitive data.
Sources: The Hacker News · ↑ top
Latest developments: BleepingComputer detailed WindRelay, a new Android NFC-relay malware that runs alongside the SpyNote remote administration tool to capture live payment-card data, relay it to attackers in real time, and take out loans in victims' names.
WindRelay grabs tap-to-pay card details for instant fraudulent purchases while SpyNote hands attackers full remote control of the phone; Android users should shun sideloaded apps and strip NFC and accessibility permissions from unknown software.
Sources: BleepingComputer · ↑ top
Latest developments: July consumer prices rose 3.4% year over year, a slight cooldown that hands the Federal Reserve more room before its next rate decision.
US inflation eased to 3.4% in July as falling petrol prices offset lingering fallout from the Iran war, giving Federal Reserve Chair Kevin Warsh time to hold rates steady amid weak jobs numbers and pressure from President Trump.
Tonight: Scattered Rain Showers, low 68F.
Thursday: Partly Sunny then Slight Chance Showers And Thunderstorms, high 84F.
Thursday Night: Slight Chance Showers And Thunderstorms then Patchy Fog, low 65F.
Latest developments: Sportico's 2026 franchise rankings pegged the Pittsburgh Steelers at $8.7 billion, placing them in the NFL's middle tier.
Sportico's annual valuations put the Steelers at $8.7 billion, ranking the Rooney-owned franchise in the middle of the league's 32 teams.
Latest developments: A real estate firm identified the incoming kosher grocery at the vacant Forbes and Murray Rite Aid as Murray Avenue Market.
Murray Avenue Market, a new kosher grocery, will occupy the vacant former Rite Aid at Forbes and Murray avenues in Pittsburgh's Squirrel Hill.
Latest developments: Merchants along Rochester's $7 million roadway reconstruction say the work is cutting into sales.
A $7 million road project in Rochester, Beaver County, is hurting local businesses, among them The Hilltop restaurant, which reopened in February 2025 after its own long closure.
Latest developments: Pittsburgh International Airport confirmed it will remove two of its moving walkways, so travelers walk farther to their gates.
Pittsburgh International Airport plans to take out two of its people movers, adding walking distance for passengers heading to and from gates.
Latest developments: A new audit found Pittsburgh's Urban Redevelopment Authority could not document how it spent federal American Rescue Plan Act relief money.
An audit of Pittsburgh's COVID relief spending flagged missing documentation at the Urban Redevelopment Authority, which distributed the city's American Rescue Plan Act funds.
Sources: Pittsburgh Post-Gazette · ↑ top
Latest developments: Environmental groups reported that more than half of monitored Pennsylvania waterways showed unsafe E. coli levels last year.
More than half of monitored Pennsylvania streams and rivers, Pittsburgh's Saw Mill Run among them, carried unsafe E. coli last year, a problem driven by sewage overflow from aging infrastructure.
Latest developments: After another loss to the Miami Marlins, ace Paul Skenes said he is unsure why the Pirates are not playing up to their standard as the second-half slide deepens.
Post-Gazette beat coverage quoted Pirates pitcher Paul Skenes puzzling over the team's second-half collapse and its failure to meet its own standard.
Sources: Pittsburgh Post-Gazette · ↑ top
Latest developments: The Post-Gazette detailed how new defensive coordinator Patrick Graham plans to deploy and disguise the Steelers' outside linebackers.
A Post-Gazette training-camp breakdown examined Patrick Graham's scheme for edge rushers T.J. Watt, Alex Highsmith, and Nick Herbig, built on pre-snap disguises.
Sources: Pittsburgh Post-Gazette · ↑ top
Latest developments: Ahead of Thursday's preseason opener at Acrisure Stadium, Ray Fittipaldo's chat had Aaron Rodgers sitting and the backup quarterbacks auditioning.
The Steelers open the preseason Thursday at Acrisure Stadium; Ray Fittipaldo's live chat covered Aaron Rodgers skipping the game and backups Mason Rudolph and Will Howard taking the reps.
Sources: Pittsburgh Post-Gazette · ↑ top
Latest developments: Olympic gold medalist Hezly Rivera, 18, rallied from fourth on the final day to win her second straight US women's all-around title on August 10.
Hezly Rivera, an 18-year-old Olympic gold medalist, captured back-to-back US women's gymnastics national championships, coming from fourth place with four poised routines on the closing day.
S&P 500 7,734.49 ▲ +2.9% Dow 54,007.80 ▲ +2.5% Nasdaq 26,490.64 ▲ +3.9% WTI crude 79.20 ▼ -3.1% EUR/USD 1.1546 ▲ +0.3% GBP/USD 1.3487 ▲ +0.4% USD/JPY 158.46 ▼ -0.5%