================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Sunday, August 9, 2026 - 8:06 AM EDT ================================================================ Attackers weaponized Atlassian's Rovo AI to siphon enterprise data as maximum-severity zero-days in Metabase, N-able, and Progress LoadMaster fell to active exploitation. CONTENTS: Emerging Trends and Key Updates | Security | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Attackers weaponized enterprise AI as Varonis's RovoBlast turned Atlassian's Rovo against Confluence and Jira, while a 6,000-fix study found AI-generated patches fail about half the time. see: RovoBlast Turns Atlassian's Rovo AI Against Enterprise Data; AI-Generated Patches Fail Half the Time * [TREND] Maximum-severity zero-days in Metabase, N-able N-central, and Progress Kemp LoadMaster sit under live exploitation, letting intruders reach managed systems faster than defenders can patch. see: Metabase, N-able, and LoadMaster Fall to Active Exploitation * [TREND] Fresh intrusions hit a healthcare software vendor, military parts maker IEH Corporation, and Switzerland's federal IT office, showing no sector escapes data-theft crews. see: Breaches Strike Healthcare, Military, and Swiss Government * [UPDATE (new)] PortSwigger's Gareth Heyes unveiled new CSS attacks that break Outlook, Gmail, Proton Mail, and Yahoo Mail defenses to steal passwords and tokens. see: CSS Attacks Break Major Webmail Defenses * [UPDATE (new)] A New Mexico judge ordered Meta to pay $567 million in the state's child online safety case, earmarking $420 million to treat harmed youth. see: New Mexico Fines Meta $567 Million Over Child Safety * [TREND] AI's business narrative dominated commentary as Zitron pressed his bearish NVIDIA case, Ben Thompson read Google's earnings, and Newport weighed whether an OpenAI model went rogue. see: Premium: The Hater's Guide To NVIDIA (Part 2); Google Earnings, The Frontier Case, Amazon Earnings; Did OpenAI's New Model "Go Rogue"? SECURITY ---------------------------------------------------------------- 1. METABASE, N-ABLE, AND LOADMASTER FALL TO ACTIVE EXPLOITATION Vulnerabilities and Exploits · [zero-day, exploit, patch] Latest developments: Metabase confirmed its unauthenticated SQL injection flaw carries a maximum CVSS 10.0 and grants admin access as a zero-day, N-able shipped N-central Hotfix 2 after attackers reached managed systems and persisted, and Progress Kemp LoadMaster CVE-2026-8037 entered CISA's catalog following 792 reported exploit attempts. Three widely deployed enterprise tools face live attacks: Metabase business intelligence, already breaching Framework and Tally; N-able N-central remote monitoring; and Progress Kemp LoadMaster load balancers, hit by a CVSS 9.6 command injection. Patch all three immediately. - The Hacker News: https://thehackernews.com/2026/08/metabase-zero-day-exploited-in-wild.html - The Hacker News: https://thehackernews.com/2026/08/n-central-attackers-reach-managed.html - The Hacker News: https://thehackernews.com/2026/08/progress-kemp-loadmaster-flaw-hits-cisa.html - BleepingComputer: https://www.bleepingcomputer.com/news/security/framework-tally-disclose-metabase-data-theft-attacks/ 2. ROVOBLAST TURNS ATLASSIAN'S ROVO AI AGAINST ENTERPRISE DATA AI Security · [ai, prompt-injection, vulnerability] Latest developments: Varonis disclosed RovoBlast, a one-click method that abused Atlassian's Rovo assistant to steal Confluence, Jira, and SharePoint data, while PromptArmor independently reached the same theft by hiding instructions in a file Rovo read. Atlassian's Rovo AI assistant reads Confluence, Jira, and SharePoint on a signed-in user's behalf. Attackers plant hidden instructions in content Rovo ingests, then exfiltrate any data the user can reach; Atlassian confirms only one of the two attack routes closed. Restrict Rovo's data access and untrusted inputs. - SecurityWeek: https://www.securityweek.com/critical-one-click-vulnerability-in-atlassians-rovo-ai-exposed-enterprise-data/ - The Hacker News: https://thehackernews.com/2026/08/atlassian-rovo-can-be-tricked-into.html 3. CSS ATTACKS BREAK MAJOR WEBMAIL DEFENSES Vulnerabilities and Exploits · [vulnerability, email] Latest developments: PortSwigger researcher Gareth Heyes revealed new CSS attacks that let email content escape its message boundary across Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail to steal passwords and tokens. The techniques manipulate the webmail interface from inside a rendered message to capture passwords, hijack third-party accounts, leak tokens, seize trusted UI actions, and manipulate AI tools that read email. Webmail providers must sanitize CSS in message rendering. - The Hacker News: https://thehackernews.com/2026/08/new-css-attacks-can-break-webmail.html 4. BREACHES STRIKE HEALTHCARE, MILITARY, AND SWISS GOVERNMENT Data Breaches · [breach] Latest developments: Unlimited Technology Systems said an October 2025 breach hit 3.8 million people, IEH Corporation, which builds parts for military satellites, missiles, and fighter jets, disclosed a phishing-driven mailbox breach to the SEC, and Switzerland's Federal Office of Information Technology, Systems and Telecommunication reported hackers exploited its SharePoint servers to compromise about 200 accounts. Three unrelated intrusions surfaced across healthcare software, defense manufacturing, and government IT. Affected organizations should force credential resets and review third-party and SharePoint exposure. - BleepingComputer: https://www.bleepingcomputer.com/news/security/unlimited-technology-systems-breach-impacts-38-million-people/ - The Record: https://therecord.media/military-device-manufacturer-discloses-cyber-incident - Help Net Security: https://www.helpnetsecurity.com/2026/08/07/swiss-government-microsoft-sharepoint-vulnerabilities/ 5. AI-GENERATED PATCHES FAIL HALF THE TIME AI Security · [ai, patch] Latest developments: A study of more than 6,000 patches found AI-generated fixes fail roughly half the time, and even successful ones introduce new bugs, break other functionality, or remain open to bypass. The research undercuts hopes that large language models can autonomously close vulnerabilities and warns teams to keep human review on any machine-written patch before merging. - Dark Reading: https://www.darkreading.com/application-security/ai-generated-patches-fail-half-time 6. NEW MEXICO FINES META $567 MILLION OVER CHILD SAFETY Policy and Regulation · [policy] Latest developments: A New Mexico judge ordered Meta to pay $567 million in the state's child online safety case, carving out $420 million to treat New Mexico youth harmed on its platforms. The ruling creates a fund to mitigate social media harms to minors and marks a large state-level penalty over child safety, signaling rising legal exposure for platforms over youth mental health. - The Record: https://therecord.media/new-mexico-judge-orders-meta-567-million-kids-safety PITTSBURGH ---------------------------------------------------------------- Weather: Today: Sunny, high 88F. Tonight: Partly Cloudy then Slight Chance Showers And Thunderstorms, low 70F. Monday: Chance Showers And Thunderstorms then Showers And Thunderstorms, high 87F. Business: * Pitt Tests Spinal Stimulation for Stroke Arms Latest developments: University of Pittsburgh researchers reported a milestone in a study that stimulates the spinal cord to restore arm movement after stroke. University of Pittsburgh researchers are running a study that applies spinal cord stimulation to reconnect the brain and limb, aiming to help stroke survivors regain arm and hand movement. - TribLive: https://triblive.com/news/health-now/university-of-pittsburgh-study-uses-spinal-cord-stimulation-to-improve-arm-movement-after-stroke/ * Westmoreland Contractor Charged With Fraud Latest developments: Prosecutors charged Larry Wing with home-improvement fraud. Larry Wing, 41, a contractor from Westmoreland County, faces home-improvement fraud charges after taking more than $13,000 for remodeling projects he never completed. - WTAE: https://www.wtae.com/article/westmoreland-county-contractor-charged-with-home-improvement-fraud/73384413 * Seven Springs Princess Cakes Endure Latest developments: TribLive traced how the Seven Springs resort's princess cake became a lasting Western Pennsylvania tradition. The princess cake, a fruit-filled specialty born at the Seven Springs Mountain Resort in the Laurel Highlands, remains in demand across Western Pennsylvania decades after the ski resort first served it. - TribLive: https://triblive.com/local/regional/how-seven-springs-famous-princess-cakes-became-a-western-pa-tradition/ Around town: * Severe Storms, Then Days of Flooding Rain Latest developments: Forecasters flagged Monday, August 10, as a severe weather alert day, with Tuesday and Wednesday as flooding impact days. Meteorologists at KDKA and WTAE expect strong to severe storms across Western Pennsylvania on Monday, August 10, some arriving overnight, followed by heavy rain and flooding through Tuesday and Wednesday. - WTAE: https://www.wtae.com/article/western-pa-braces-for-active-week-with-flooding-and-severe-threats/73384703 - KDKA: https://www.cbsnews.com/pittsburgh/news/sunday-in-pittsburgh-has-hot-comfortable-weather-before-monday-storms/ * Duquesne Weighs School Merger With McKeesport Latest developments: Duquesne residents pressed to be heard as officials consider merging their district with McKeesport Area. Residents of Duquesne want a voice as officials weigh combining the Duquesne City School District with the McKeesport Area School District in Allegheny County. - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/education/2026/08/09/duquesne-mckeesport-school-meeting/stories/202608070058 * Powerball Jackpot Climbs to $905 Million Latest developments: Saturday's drawing produced no winner, lifting Monday's jackpot to an estimated $905 million. No ticket matched all six numbers in Saturday's $863.8 million Powerball drawing, the year's largest so far, pushing the August 10 jackpot to an estimated $905 million with a cash value of $391.9 million—the eighth-largest in the game's history. - KDKA: https://www.cbsnews.com/pittsburgh/news/powerball-856-million-largest-drawing-of-the-year/ - WTAE: https://www.wtae.com/article/did-anyone-win-the-856-million-powerball-jackpot/73384078 Events: * Little Italy Days Returns to Bloomfield Latest developments: WPXI previewed the 26th annual Little Italy Days, opening Thursday, August 13, with music, bocce, and food. The 26th annual Little Italy Days, a street festival built around live music, bocce, and food, returns to Pittsburgh's Bloomfield neighborhood beginning Thursday, August 13. - WPXI: https://www.wpxi.com/news/local/music-bocce-food-little-italy-days-returning-soon-pittsburghs-bloomfield-neighborhood/RZA2KS6STVEF3KOTMWPBTPK4NI/ SPORTS ---------------------------------------------------------------- Around the Teams: * Jones, Allar Rebound at Night Practice Latest developments: At the Steelers' Saturday night practice at Latrobe, Post-Gazette observers saw left tackle Broderick Jones and quarterback Drew Allar bounce back. The Steelers held their annual night practice at Latrobe Memorial Stadium on Saturday under new coach Mike McCarthy, where Post-Gazette camp observers noted bounce-back performances from left tackle Broderick Jones and quarterback Drew Allar under the lights. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/08/08/steelers-training-camp-broderick-allar-tonyan-pittman/stories/202608070080 * Nowakowski Chases Special Teams Role Latest developments: Rookie Riley Nowakowski said he is working to earn trust in an expected special teams role. Steelers rookie Riley Nowakowski told the Post-Gazette he is trying to earn the coaching staff's trust in his expected special teams role at training camp. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/08/09/nfl-steelers-riley-nowakowski-special-teams-training-camp/stories/202608090045 Team USA: * Richard Wins First U.S. Men's Gymnastics Title Latest developments: Frederick Richard captured his first U.S. men's all-around gymnastics championship. Frederick Richard won his first U.S. men's all-around title at the national gymnastics championships, cementing his standing as the leader of the American men's program two years before the 2028 Los Angeles Olympics. - ESPN Olympics: https://www.espn.com/olympics/gymnastics/story/_/id/49565148/frederick-richard-wins-first-us-gymnastics-title-la-games-sight * Blakely, Pease Lead U.S. Women's Gymnastics Latest developments: Skye Blakely and Claire Pease tied for the lead after the opening night of the U.S. women's gymnastics championships. Skye Blakely and Claire Pease shared the lead after the first night of the U.S. women's gymnastics championships, opening the meet even at the top. - ESPN Olympics: https://www.espn.com/olympics/gymnastics/story/_/id/49558173/skye-blakely-claire-pease-share-early-lead-us-gymnastics-nationals * Trump Honors Winter Olympians at White House Latest developments: President Trump hosted dozens of U.S. Winter Olympians and Paralympians at a White House reception. President Donald Trump welcomed dozens of American Winter Olympians and Paralympians to the White House for a reception celebrating their performances at the Milan Cortina Games held earlier in 2026. - ESPN Olympics: https://www.espn.com/olympics/story/_/id/49549072/president-trump-celebrates-winter-olympians-paralympians READING ---------------------------------------------------------------- * Ed Zitron -- Premium: The Hater's Guide To NVIDIA (Part 2) Zitron extends his bearish case against NVIDIA, arguing the company's repeated insistence that it resembles neither Enron, WorldCom, nor Lucent only invites the comparison through the Streisand Effect. https://www.wheresyoured.at/premium-the-haters-guide-to-nvidia-part-2/ * Stratechery -- Google Earnings, The Frontier Case, Amazon Earnings Ben Thompson reads Google's earnings as confirmation of its Anthropic hedge and credits Amazon chief Andy Jassy with explaining why both companies' heavy AI capital spending is justifiable. https://stratechery.com/2026/google-earnings-the-frontier-case-amazon-earnings/ * Cal Newport -- Did OpenAI's New Model "Go Rogue"? Newport examines a Hugging Face infrastructure intrusion and the claim that an OpenAI model went rogue, weighing how much the alarming framing actually holds up. https://calnewport.com/did-openais-new-model-go-rogue/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,705.63 ▲ +3.9% Dow 53,907.09 ▲ +3.2% Nasdaq 26,380.26 ▲ +5.7% WTI crude 77.36 ▼ -6.7% EUR/USD 1.1537 ▲ +0.7% GBP/USD 1.3459 ▲ +0.8% USD/JPY 157.80 ▼ -2.4% ================================================================ Generated 2026-08-09 08:06 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================