daily plain-text briefing: security, markets, business, and pittsburgh
CISA revealed that Iran-linked hackers probed more than 100 internet-exposed U.S. water systems in July as the Treasury layered fresh sanctions on the same actors.
Latest developments: SOCRadar unraveled AnonyMousKIT's reseller supply chain of 506 domains and 168 storefront brands after basic coding errors exposed its production logs, while Dark Reading detailed NovaCookies, an adversary-in-the-middle kit renting Microsoft 365 session theft for $320 a month, and Zimperium flagged fake recruiters using browser-in-the-browser lures to harvest corporate passwords.
Rentable phishing platforms lower the bar for credential and session theft. AnonyMousKIT uses rented AI voice agents to call iPhone theft victims posing as Apple Support and pull passcodes needed to remove Activation Lock, NovaCookies steals live M365 sessions past MFA, and recruitment scams target enterprise logins on mobile. Enforce phishing-resistant authentication and monitor for session-token abuse.
Sources: BleepingComputer · The Hacker News · Dark Reading · Help Net Security · ↑ top
Latest developments: Ubiquiti patched three maximum-severity bugs that remote attackers can exploit without privileges, the CERT Coordination Center disclosed two unpatched Kaltura mwEmbed deserialization flaws, CVE-2026-19913 and CVE-2026-19912, that permit unauthenticated file reads and code execution, and Adobe and Nvidia each shipped advisories fixing critical vulnerabilities.
A fresh wave of high-impact flaws spans network gear, video players, and creative and GPU software. The Kaltura mwEmbedLoader.php bugs remain unpatched and let remote attackers read arbitrary files and run code. Patch Ubiquiti, Adobe, and Nvidia immediately, and restrict access to exposed Kaltura players until a fix ships.
Sources: BleepingComputer · The Hacker News · SecurityWeek · ↑ top
Latest developments: Police devised sting operations using 3D-printed decoy Flock cameras and charged a man with three felonies for breaking one, while 404 Media reported that Flock Chief Executive Garrett Langley told officers its earlier story about police tracking a woman who self-administered an abortion was false.
Flock's automated license-plate-reader network is generating legal and political friction as departments protect the cameras with decoys and sting charges and the company disputes reporting on abusive queries. Separately, ICE is seeking a federal contractor to handle national voter registration and history files it frames as fraud detection.
Sources: 404 Media · 404 Media · 404 Media · ↑ top
Latest developments: CISA disclosed that attackers targeted more than 100 internet-exposed water systems during July, tied the activity to Iran-linked actors, and published guidance on cutting internet exposure days after the Treasury's fresh sanctions.
The U.S. Treasury sanctioned Iranian cyber actors for critical-infrastructure breaches, and CISA now urges water utilities to pull human-machine interfaces and controllers off the public internet. Operators should segment operational-technology networks and enforce strong authentication.
Sources: SecurityWeek · The Hacker News · ↑ top
Latest developments: The Linux Foundation took governance of TRACE, a hardware-backed runtime-evidence specification contributed by OPAQUE and built with AMD, Intel, Microsoft, and the Technology Innovation Institute, to create a standard evidence layer for autonomous AI agents and confidential workloads.
TRACE, short for Trust, Runtime Attestation and Compliance Evidence, aims to give organizations verifiable governance records as they deploy increasingly autonomous agents and open-weight models. The open standard lands as vendors race to secure agent behavior, alongside NVIDIA's SkillSpector scanner for AI agent skills.
Sources: Help Net Security · SecurityWeek · ↑ top
Latest developments: An independent malware researcher documented SLEEPWALKER, a previously unreported Windows backdoor that lies inert in memory until a specifically crafted network packet arrives, then executes commands written in its own 23-instruction language.
SLEEPWALKER is an unsigned 64-bit Windows DLL of 59,904 bytes built to be side-loaded into a legitimate process, where it waits for a trigger packet before running its custom bytecode. Its packet-gated dormancy defeats sandbox timers and network scanning, so defenders should hunt for suspicious side-loading and unexpected listening behavior.
Sources: The Hacker News · ↑ top
Latest developments: Canada imposed new retaliatory duties ranging from 15% to 50% on about $20 billion of U.S. goods, and President Trump threatened to raise tariffs on Canadian-built vehicles to 50%.
The confrontation between Ottawa and Washington deepened after 50% U.S. tariffs took effect, and Canada's countermeasures alongside Trump's auto-tariff threat now squeeze automakers in Detroit and Ontario while pushing up costs across the border.
Sources: WSJ US Business · WSJ World News · ↑ top
Latest developments: Meta agreed to pay up to $16.7 billion and add child-safety measures to Facebook and Instagram, settling state attorneys general claims just as the trial opened in California.
The accord ends litigation alleging Meta designed addictive platforms that harmed young people's mental health; state attorneys general brought the case, and the payout ranks among the largest settlements of its kind.
Sources: FT World · WSJ Markets · ↑ top
Today: Partly Sunny, high 81F.
Tonight: Partly Cloudy, low 64F.
Thursday: Chance Showers And Thunderstorms, high 84F.
Latest developments: PennDOT posted advisory signs warning of road closures along major Pittsburgh routes, including Carson Street, confusing commuters even though the work runs only overnight next week.
KDKA reported that PennDOT's signs for two upcoming projects carry the word "closed," alarming drivers along corridors such as Carson Street; the agency says each closure lasts a single night next week.
Latest developments: The Post-Gazette reported that President Trump's push to import more beef to ease record U.S. prices drew skepticism it will meaningfully lower grocery costs.
As American beef prices sit near record highs, the Post-Gazette examined Trump's deal to bring in more foreign beef and the ranchers and analysts questioning whether it reaches consumers.
Sources: Pittsburgh Post-Gazette · ↑ top
Latest developments: The West Mifflin Area School District said it is coordinating with its busing contractor to correct routes that ran hours late and skipped stops on the first day of school.
After buses ran hours behind schedule and missed stops when the year opened, the West Mifflin Area School District told WTAE it is working with the company that runs its service to fix the failures.
Latest developments: TribLive reported a Christian homeschool hybrid program will open in Leechburg, giving home-schooled children part-time in-person instruction.
A new hybrid Christian program is coming to Leechburg, offering families who home-school their children scheduled in-person classes alongside their at-home lessons.
Latest developments: TribLive reported that Francis Maxin, a Community College of Allegheny County microbiology professor, earned the Guinness World Record for the longest science-teaching career by a man.
The Community College of Allegheny County said microbiology professor Francis Maxin now holds the Guinness World Record for the longest career as a male science instructor.
Latest developments: The Post-Gazette's MiLB Monday spotlighted Pirates prospect Tony Blanco Jr. showing big power at High-A Greensboro.
In its farm-system roundup, the Post-Gazette reported that outfield prospect Tony Blanco Jr. is displaying huge power for the Pirates' High-A affiliate in Greensboro.
Sources: Post-Gazette Pirates · ↑ top
Latest developments: ESPN profiled the U.S. men's national team's brightest under-21 prospects headed abroad, noting 19-year-old Zavier Gozo already left MLS for the Premier League.
ESPN surveyed the young Americans likely to follow winger Zavier Gozo from MLS to Europe, mapping the next generation of the U.S. men's national team ahead of the 2026 World Cup.
Sources: ESPN Soccer · ↑ top
S&P 500 7,670.73 ▼ -1.1% Dow 53,298.77 ▼ -0.6% Nasdaq 26,142.04 ▼ -1.8% WTI crude 85.62 ▲ +2.8% EUR/USD 1.1658 ▲ +0.9% GBP/USD 1.3614 ▲ +0.7% USD/JPY 158.95 ▼ -0.2%