daily plain-text briefing: security, markets, business, and pittsburgh
Germany's cabinet and the Trump White House both moved to legalize offensive hacking, as attackers pressed a national ID flaw, fresh phishing kits, and account takeovers.
Latest developments: Germany's cabinet approved legislation that would let its intelligence agencies hack foreign systems, sabotage adversaries' supply chains, and feed false information to extremists inside Germany in the biggest overhaul of the country's postwar spy laws, while President Donald Trump signed a memo directing the National Coordination Center to open a program where private security firms apply to hack foreign cybercrime gangs under contracts that may carry a forfeitable $1 million bond.
Two Western governments moved the same week to legitimize offensive cyber operations long reserved for spy agencies, blurring lines between state action and private hack-back and raising retaliation risk for enterprises caught in the middle.
Sources: The Record · BleepingComputer · The Record · SecurityWeek · ↑ top
Latest developments: WordPress 7.0.4 patched a remote code execution flaw that attackers holding author-level or higher permissions could exploit through malicious PostScript files, and Wireshark 4.6.8 fixed 28 bugs, nine of them in file parsers that fire the moment someone opens a booby-trapped capture file.
Both tools run in vast deployments, and the Wireshark parser flaws need no network access to trigger, so administrators should update WordPress installations and analyzer builds promptly.
Sources: SecurityWeek · Help Net Security · ↑ top
Latest developments: Cisco Talos exposed JWR, an undocumented phishing framework its developer branded internally, built to convincingly impersonate the checkout and login pages of major payment and shopping platforms, as the Greatness phishing-as-a-service platform mounted attacks that need no fake website, riding a real Microsoft login page and a moment of misplaced trust.
New phishing toolkits strip away the telltale signs defenders train users to spot, cloning legitimate payment and login pages so victims surrender credentials with no suspicious URL in sight.
Sources: Cisco Talos · Graham Cluley · ↑ top
Latest developments: Researchers found severe vulnerabilities in a browser extension underpinning Belgium's electronic ID trust framework that fully compromise it and open citizen accounts to remote code execution.
Belgium's national eID logs citizens into government and banking services through a browser extension, and the flaws let attackers run code and hijack accounts; the case spotlights broader risk in security-critical browser extensions.
Sources: Dark Reading · ↑ top
Latest developments: Kaspersky detailed a new Armored Likho campaign that poses as fundraising appeals and drops a fresh Still Toolkit built to steal Telegram data and eavesdrop on victims.
Armored Likho is a cyber-espionage group whose latest lures masquerade as charity fundraising to install malware that harvests Telegram messages and monitors targets.
Sources: Securelist (Kaspersky) · ↑ top
Latest developments: The FBI issued an alert that criminals use leaked passwords, social engineering, and spoofed social media sites to hijack adults' and children's online accounts, steal sexually explicit images and videos, and sell them online.
The bureau urged strong unique passwords, multifactor authentication, and caution with unsolicited messages, warning that families with minors face particular risk.
Sources: The Record · BleepingComputer · ↑ top
Latest developments: Crude futures fell Thursday after days of gains, with Washington and Tehran each claiming control of the Strait of Hormuz and shipping through the waterway still throttled.
Traffic through the Strait of Hormuz, the chokepoint for roughly a fifth of the world's seaborne oil, remains limited amid the U.S.-Iran standoff; shippers told the Wall Street Journal they doubt President Trump's assertion that the passage has reopened.
Sources: WSJ Markets · WSJ US Business · ↑ top
Today: Partly Sunny, high 84F.
Tonight: Mostly Cloudy then Patchy Fog, low 67F.
Friday: Patchy Fog then Chance Showers And Thunderstorms, high 83F.
Latest developments: Wegmans held the groundbreaking Thursday for its first western Pennsylvania store, a Cranberry Township location it says will create about 450 jobs and open in 2027.
The New York grocer is building at the Cool Springs development in Cranberry Township, Butler County, near the Pittsburgh Penguins' UPMC Lemieux Sports Complex, marking its entry into the Pittsburgh grocery market.
Latest developments: The first phase of the $28 million restoration of the New Granada Theater in the Hill District finished, and backers held a ribbon-cutting Wednesday with the University of Pittsburgh as anchor tenant.
The New Granada Theater on Centre Avenue, once a jazz landmark in Pittsburgh's Hill District, lit its restored marquee again; Pitt opened a community engagement center inside the building as the project's anchor.
Latest developments: The University of Pittsburgh barred students from parking or storing electric scooters anywhere on campus, including dorm rooms, under a new policy carrying impound fees that start at $100.
The rule covers Pitt's Oakland campus and student housing; violators risk having their scooters impounded and paying fees beginning at $100.
Latest developments: Single-lane restrictions and rolling stoppages will hit the Fort Pitt and Liberty tunnels on Sunday for survey work, weather permitting.
The Fort Pitt Tunnel and Liberty Tunnel funnel heavy commuter traffic into downtown Pittsburgh from the south and west; drivers should expect delays through both on Sunday.
Latest developments: Luke Combs will bring his My Kinda Saturday Night Tour to Acrisure Stadium on Saturday, May 8, 2027, his first Pittsburgh show since he sold out the same stadium in 2023.
Country star Luke Combs plays Acrisure Stadium on Pittsburgh's North Shore on Saturday, May 8, 2027; the tour opens April 3 in Arlington, Texas, and wraps in late June in California.
Latest developments: The Post-Gazette reports rookie defensive lineman Gabriel Rubio, a stout run defender out of Notre Dame, is emerging in camp with a real shot at the Steelers' 53-man roster.
Gabriel Rubio, a run-stuffing lineman from Notre Dame, has drawn notice at Steelers training camp at Saint Vincent College in Latrobe and could play his way onto the final roster.
Sources: Post-Gazette Steelers · ↑ top
Latest developments: The Pirates transferred Oneil Cruz's injury rehab assignment to Double-A Altoona, where he went hitless in his first game there.
Oneil Cruz, among the Pirates' most electric hitters, is working back from injury through the minor leagues; Pittsburgh shifted his rehab to the Altoona Curve.
Sources: Post-Gazette Pirates · ↑ top
S&P 500 7,739.48 ▲ +1.9% Dow 53,892.03 ▲ +1.2% Nasdaq 26,535.65 ▲ +3.3% WTI crude 80.81 ▲ +1.1% EUR/USD 1.1546 ▲ +0.3% GBP/USD 1.3487 ▲ +0.4% USD/JPY 158.46 ▼ -0.5%