daily plain-text briefing: security, markets, business, and pittsburgh
AI assistants and unpatched enterprise software both became data-theft channels, as the RovoBlast method turned Atlassian Rovo against corporate wikis and an unauthenticated Metabase zero-day hit maximum severity in active attacks.
Latest developments: Metabase warned that a maximum-severity SQL injection zero-day carrying a CVSS 10.0 and no CVE identifier lets an unauthenticated remote attacker gain admin access and steal data, with Framework and Tally among the victims; N-able shipped N-central Hotfix 2 after attackers reached managed systems and established persistence; and CISA added Progress Kemp LoadMaster command injection CVE-2026-8037 at CVSS 9.6 to its Known Exploited Vulnerabilities catalog after 792 reported exploit attempts.
Three widely deployed enterprise products—Metabase business intelligence software, N-able's N-central remote monitoring platform, and Progress Kemp LoadMaster load balancers—face in-the-wild attacks that reach data and grant administrative control. Administrators should apply the latest hotfixes at once and hunt their environments for signs of intrusion and persistence.
Sources: The Hacker News · The Hacker News · The Hacker News · BleepingComputer · ↑ top
Latest developments: Varonis researchers detailed RovoBlast, a one-click method that makes Atlassian's Rovo assistant collect Confluence, Jira, and SharePoint data a signed-in user can reach and ship it to an outside server, and PromptArmor independently reproduced the behavior by hiding instructions in content Rovo reads, including an uploaded file, with only one of the two exploitation routes confirmed closed.
Atlassian's Rovo AI assistant follows attacker-planted instructions embedded in the documents and files it processes, letting it exfiltrate any data the logged-in user can access across Confluence, Jira, and SharePoint. Organizations running Rovo should confirm Atlassian's fix and audit assistant activity for anomalous data pulls.
Sources: SecurityWeek · The Hacker News · ↑ top
Latest developments: The National Rural Water Association teamed with the DEF CON offshoot Franklin to launch the Water Watch Center, a program that gives cash-strapped utilities monitoring and expertise as water-utility intrusions spread across a dozen states.
Rural water systems, long short on budget and staff, gain a shared cybersecurity monitoring effort aimed at rising attacks on their control networks. Utilities can join the Water Watch Center to get threat intelligence and incident support they could not fund alone.
Sources: The Record · Wired Security · ↑ top
Latest developments: PortSwigger researcher Gareth Heyes showed that CSS styling inside an email can escape its message boundary and manipulate the surrounding webmail interface across Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail, capturing passwords, taking over third-party accounts, leaking tokens, hijacking trusted interface actions, and manipulating AI tools that read email.
New techniques weaponize styling code hidden in a message to seize control of trusted interface actions in every major webmail client. Providers must tighten CSS sanitization, and users should treat unexpected login prompts that appear inside webmail with suspicion.
Sources: The Hacker News · ↑ top
Latest developments: Switzerland's Federal Office of Information Technology, Systems and Telecommunication (BIT) said hackers exploited Microsoft SharePoint server vulnerabilities and compromised roughly 200 account credentials before BIT spotted the activity on July 28 and cut internet access; healthcare software maker Unlimited Technology Systems reported an October 2025 breach affecting more than 3.8 million people; and IEH Corporation, which builds connectors for military satellites, missiles, and fighter jets, disclosed to the SEC a cyberattack it discovered on August 4.
Government, healthcare, and defense-supplier networks each lost data or credentials in newly disclosed incidents, with IEH Corporation's role in military satellites, missiles, and fighter jets raising national-security stakes. Affected organizations should force credential resets, patch exposed SharePoint servers, and review third-party cloud access.
Sources: Help Net Security · BleepingComputer · The Record · ↑ top
Latest developments: A Dark Reading study of more than 6,000 AI-generated patches found that half fail outright and that even the working ones introduce fresh bugs, break other functionality, or leave a bypass open.
Automated fixes produced by AI tools carry a high failure rate and frequently create new problems, undercutting the rush to hand vulnerability remediation to machines. Security teams should treat AI-suggested patches as drafts and test them before deployment.
Sources: Dark Reading · ↑ top
Latest developments: July payroll data landed far weaker than expected Friday, with surprise job losses cutting the odds of a Federal Reserve rate hike next month and sending stocks to a fresh high.
U.S. stocks closed at a record August 7 after the July employment report showed surprise job losses, giving the Federal Reserve reason to hold interest rates steady; the S&P 500 and Nasdaq capped their best week since April.
Sources: WSJ Markets · WSJ Markets · ↑ top
Latest developments: A U.S. naval interdiction has stalled Iran's crude exports and idled the Kharg Island terminal, and Tehran now vows to bar U.S. Navy ships from the Strait of Hormuz.
Naval interdiction appears to be halting tankers carrying Iranian crude, leaving the Kharg Island export terminal idle, while Iran, in Strait of Hormuz talks, threatens to block U.S. Navy passage and push American forces out of the Gulf.
Sources: FT Markets · WSJ World News · ↑ top
Latest developments: The Senate confirmed Todd Blanche as attorney general early Saturday on a 50-49 vote, installing a trusted Trump ally atop the Justice Department.
Todd Blanche, President Trump's former personal attorney, won confirmation as U.S. attorney general after a contentious fight that centered on his willingness to bend the Justice Department to Trump's interests.
Sources: WSJ Politics · FT World · ↑ top
Today: Chance Showers And Thunderstorms, high 86F.
Tonight: Chance Showers And Thunderstorms then Showers And Thunderstorms Likely, low 68F.
Sunday: Mostly Sunny, high 87F.
Latest developments: Dick's Sporting Goods opened a House of Sport store on Route 30 in Greensburg on Friday, with former Steeler Ryan Shazier cutting the ribbon.
Dick's Sporting Goods opened a House of Sport location on Route 30 in Greensburg featuring a climbing wall, golf simulator bays, and a multi-sport cage for baseball, softball, lacrosse, and soccer; former Steelers linebacker Ryan Shazier helped cut the ribbon.
Latest developments: With the Paramount+ series 'Mayor of Kingstown' heading into its final season and Apple TV's 'Nocturne' set for October 30, local crews see few major shoots ahead.
TribLive reports Pittsburgh faces a lull in major film and television production; the locally filmed 'Mayor of Kingstown' streams its final season this fall and the locally shot 'Nocturne' debuts on Apple TV October 30, leaving crews and observers wondering what comes next.
Latest developments: The Westmoreland Museum of American Art in Greensburg reports visitor engagement up 142%, bucking a national museum attendance slump.
The Westmoreland Museum of American Art in Greensburg has boosted attendance 142% at a time when many museums still trail pre-pandemic numbers and struggle with fundraising, TribLive reports.
Latest developments: PennDOT laid out a plan for this fall to curb flooding in the Parkway East's Downtown 'bathtub,' the below-grade stretch that floods from the Monongahela River.
PennDOT will move this fall to address chronic flooding in the Parkway East's so-called 'bathtub,' the below-street section of highway in Downtown Pittsburgh that fills during severe storms from the adjacent Monongahela River.
Latest developments: Two Greensburg businesses filed a more than $2.4 million lawsuit against the Westmoreland County Housing Authority over water main breaks that shut them for months last year.
Two Greensburg businesses forced to close for months by water main breaks last year have sued the Westmoreland County Housing Authority for more than $2.4 million, TribLive reports.
Latest developments: Pittsburgh has withheld a permit to demolish a fire-damaged Mount Washington church amid a dispute over the demolition's timing, a city council member says.
The city of Pittsburgh has not issued a demolition permit for a burned church on Mount Washington because the city and the property owner disagree over when the work should occur, a city council member told WTAE.
Latest developments: Steel City Con, the pop-culture and collectibles convention, headlines the weekend's lineup through Sunday, August 9.
Steel City Con runs the weekend of August 6-9 around Pittsburgh, drawing collectors and cosplayers; NEXTpittsburgh lists it among more than a dozen things to do, alongside the Barrel & Flow Fest of Black-owned brewing.
Sources: NEXTpittsburgh Events · ↑ top
Latest developments: The annual St. Margaret Mary Parish Festival of Friendship holds its final evening Saturday, August 8, in Lower Burrell after opening Friday night.
The St. Margaret Mary Parish Festival of Friendship, a community fair, continues Saturday evening, August 8, in Lower Burrell.
Latest developments: Grammy-nominated musician Travis Malloy, a Stanton Heights native, returns to Pittsburgh for two sold-out homecoming concerts.
Travis Malloy, who grew up in Stanton Heights and has earned Grammy nominations, plays two sold-out homecoming shows in Pittsburgh, the Post-Gazette reports.
Sources: Post-Gazette Music · ↑ top
Latest developments: The Pirates released designated hitter Marcell Ozuna, cutting their losses on a free-agent signing.
The Pittsburgh Pirates released veteran designated hitter Marcell Ozuna, ending what the Post-Gazette called a disastrous free-agent signing.
Sources: Post-Gazette Pirates · ↑ top
Latest developments: Steelers top pick Max Iheanachor will stay out of practice until next week with an injury, a setback after his strong start in pads.
The Post-Gazette reports Steelers top draft pick, offensive lineman Max Iheanachor, will not return to practice until next week because of an injury, days after he held up well against the team's top edge rushers at Saint Vincent College.
Sources: Post-Gazette Steelers · ↑ top
Latest developments: In the Steelers' first goal-line drills of camp, defensive linemen Derrick Harmon and Yahya Black stuffed the offense, the Post-Gazette's camp notes said.
The Post-Gazette's training camp notes credited defensive linemen Derrick Harmon and Yahya Black with winning the Steelers' first goal-line battle at Saint Vincent College.
Sources: Post-Gazette Steelers · ↑ top
Latest developments: Olympian Fred Richard leads the men after Day 1 of the U.S. gymnastics championships, while Skye Blakely and Claire Pease share the women's lead.
The U.S. national gymnastics championships opened this week, with Olympian Fred Richard atop the men's standings after the first day and Skye Blakely and Claire Pease tied for the women's lead.
Sources: ESPN Olympics · ESPN Olympics · ↑ top
Latest developments: U.S. women's coach Emma Hayes said she is 'delighted' Mauricio Pochettino signed a new four-year deal to stay as U.S. men's coach.
Emma Hayes, coach of the U.S. women's national team, praised the decision to keep Mauricio Pochettino for four more years, saying his continuity can help raise the level of soccer in the United States.
Sources: ESPN Soccer · ↑ top
Latest developments: President Trump welcomed dozens of U.S. Winter Olympians and Paralympians to the White House to honor their Milan-Cortina performances.
President Trump hosted dozens of American Winter Olympians and Paralympians at a White House reception celebrating their results at the Milan-Cortina Games held earlier in 2026.
Sources: ESPN Olympics · ↑ top
S&P 500 7,705.63 ▲ +3.9% Dow 53,907.09 ▲ +3.2% Nasdaq 26,380.26 ▲ +5.7% WTI crude 77.36 ▼ -6.7% EUR/USD 1.1537 ▲ +0.7% GBP/USD 1.3459 ▲ +0.6% USD/JPY 157.80 ▼ -2.4%