================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Monday, August 10, 2026 - 7:06 AM EDT ================================================================ OpenAI paused development of its next model, Astra, after finding it could reach critical offensive-cybersecurity capability, even as CISA confirmed active exploitation of a Progress LoadMaster flaw and hackers pivoted through a private APN to sabotage a second Polish energy plant. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Frontier labs increasingly treat their own models as cyber risks, with OpenAI pausing Astra over hacking prowess and Anthropic defaulting Claude Code to AI review. see: OpenAI Pauses Astra Over Critical Cyber Capabilities; Anthropic Makes AI Review the Default in Claude Code * [TREND] Attackers keep finding unconventional footholds in Europe, pivoting through a private APN to sabotage a Polish energy plant and cracking Belgian eID software two million people rely on. see: Hackers Sabotage Second Polish Energy Facility; Critical Flaws in Belgian eID Software * [TREND] Malicious code keeps slipping into developer toolchains, as fake Solidity Pro VS Code extensions drained crypto wallets while GitHub expanded Dependabot malware alerts across eight ecosystems. see: Malicious Solidity Pro Extensions and Wider Malware Alerts * [UPDATE (new)] CISA warned that attackers are actively exploiting the critical Progress LoadMaster command injection flaw CVE-2026-8037 and urged immediate patching. see: Progress LoadMaster Flaw Now Actively Exploited * [UPDATE (new)] Locally, WTAE declared an Alert Day for Monday storms as Little Italy Days returns to Bloomfield and Sea Monkey opens in the Strip District. see: Alert Day: Severe Storms Monday in Western Pennsylvania; Little Italy Days Returns to Bloomfield August 13; Sea Monkey Opens in the Strip District SECURITY ---------------------------------------------------------------- 1. OPENAI PAUSES ASTRA OVER CRITICAL CYBER CAPABILITIES AI Security · [ai, policy] Latest developments: OpenAI paused internal activities involving its upcoming model Astra after an evaluation found it advanced far enough in agentic coding and cybersecurity that the company could not rule out its reaching the critical capability level under its Preparedness Framework. Astra showed major gains in autonomous coding and offensive security work; OpenAI is adding isolation and other safeguards for higher-capability models before any deployment. - Help Net Security: https://www.helpnetsecurity.com/2026/08/10/openai-astra-critical-cyber-capabilities/ - The Hacker News: https://thehackernews.com/2026/08/openais-next-ai-model-astra-shows-cyber.html 2. PROGRESS LOADMASTER FLAW NOW ACTIVELY EXPLOITED Vulnerabilities and Exploits · [exploit, patch] Latest developments: CISA warned that attackers are now actively exploiting the critical Progress Kemp LoadMaster command injection flaw, CVE-2026-8037, and urged immediate patching, escalating a bug it added to its Known Exploited Vulnerabilities catalog days earlier. The flaw lets unauthenticated remote attackers run arbitrary commands on LoadMaster load balancers. Progress customers should apply the fix now. - BleepingComputer: https://www.bleepingcomputer.com/news/security/cisa-warns-of-critical-progress-loadmaster-flaw-exploited-in-attacks/ - SecurityWeek: https://www.securityweek.com/cisa-urges-immediate-patching-of-exploited-progress-loadmaster-vulnerability/ 3. MALICIOUS SOLIDITY PRO EXTENSIONS AND WIDER MALWARE ALERTS Software Supply Chain · [supply-chain, malware, cryptocurrency] Latest developments: The Hacker News flagged a malicious Solidity Pro VS Code extension, published as helper-beeps.solidity-pro and web3devtoolsx.solidity-pro, that plants a browser wallet and credential stealer, the same day GitHub expanded Dependabot malware alerts from npm alone to eight ecosystems including PyPI, Maven, RubyGems, NuGet, Go, crates.io, and PHP Composer. The rogue extensions, now pulled from Open VSX, targeted cryptocurrency developers; GitHub's Advisory Database now ingests OpenSSF malicious-package reports to warn across more languages. Developers should verify extension and package sources before installing. - The Hacker News: https://thehackernews.com/2026/08/solidity-pro-vs-code-extensions-steal.html - Help Net Security: https://www.helpnetsecurity.com/2026/08/10/github-dependabot-malware-alerts/ 4. ANTHROPIC MAKES AI REVIEW THE DEFAULT IN CLAUDE CODE AI Security · [ai] Latest developments: Anthropic will make auto mode, in which an AI reviews Claude Code's actions, the default for new Pro, Max, and Team sessions starting August 14, citing a test of 1,053 paid professionals where human review caught 13.6 percent of dangerous commands against auto mode's 89 percent. Auto mode lets a model vet the commands another Claude instance runs and stays optional on Claude Enterprise. The change follows evidence that human reviewers miss most risky agent actions. - Help Net Security: https://www.helpnetsecurity.com/2026/08/10/anthropic-claude-code-auto-mode/ 5. HACKERS SABOTAGE SECOND POLISH ENERGY FACILITY Critical Infrastructure Security · [ics, apt] Latest developments: CERT.PL reported that attackers pivoted through a private access point name to sabotage a second Polish energy facility, calling it the first known instance of a private APN serving as an attack vector. A private APN is a carrier-provisioned mobile network segment; the attackers rode it to reach operational systems at the plant. Energy operators depending on private cellular access should audit and segment those links. - SecurityWeek: https://www.securityweek.com/novel-private-apn-pivot-let-hackers-sabotage-second-polish-energy-facility/ 6. CRITICAL FLAWS IN BELGIAN EID SOFTWARE Vulnerabilities and Exploits · [vulnerability, patch] Latest developments: Researchers disclosed critical vulnerabilities in the electronic identity software that roughly 2 million Belgians use, affecting eight of Belgium's ten largest banks and more than 60 government agencies. The eID middleware authenticates citizens to banking and government services; the flaws undermine that identity check across much of Belgium's financial and public sector. Affected institutions should update. - SecurityWeek: https://www.securityweek.com/critical-flaws-discovered-in-belgian-eid-software-used-by-2-million-people/ BUSINESS AND POLITICS ---------------------------------------------------------------- * Ukrainian Drone Strike Hits Russian Refinery, Kills 13 Latest developments: Ukraine mounted one of its deadliest strikes on Russian soil since 2022, its drones hitting an oil refinery in Nizhnekamsk deep inside Tatarstan. A Ukrainian drone attack on Nizhnekamsk, an oil-refining city in Russia's Tatarstan region far from the front, killed 13 people and struck the refinery, ranking among the highest tolls from any single Ukrainian strike since Russia's 2022 invasion. - Financial Times: https://www.ft.com/content/ad0602c3-224f-422c-b052-ff96e2f9054c?syn-25a6b1a6=1 PITTSBURGH ---------------------------------------------------------------- Weather: Today: Chance Showers And Thunderstorms then Showers And Thunderstorms, high 86F. Tonight: Chance Showers And Thunderstorms then Showers And Thunderstorms Likely, low 69F. Tuesday: Chance Showers And Thunderstorms, high 84F. Business: * Original Pittsburgh Winery Closes August 15 Latest developments: The Original Pittsburgh Winery fixed August 15 as its final day and booked a full slate of farewell shows, firming up the closure it announced July 24. Co-owners Tim Gaber and Anthony Jardine will close the Original Pittsburgh Winery, a live-music venue, for good on August 15; the shutdown has rippled through the city's music community, and Gaber's own band, the Buzz Poets, plays among the closing shows. - NEXTpittsburgh: https://nextpittsburgh.com/latest-news/the-original-pittsburgh-winery-closes-for-good-this-week/ * Sea Monkey Opens in the Strip District Latest developments: Sea Monkey, a hybrid of restaurant, cocktail bar, and nightclub, opened as the newest dining destination in the Strip District. Sea Monkey, a new Strip District spot that blends dining, craft cocktails, and a late-night club under one roof, has opened, Pittsburgh City Paper reports, drawing notice for its food and its shifting atmosphere. - Pittsburgh City Paper: https://www.pghcitypaper.com/food-drink/sea-monkey-eat-sea-monkey-club/ * Pitt Navigates Higher-Education Headwinds in Gabel's Year 4 Latest developments: As Chancellor Joan Gabel begins her fourth year, the Post-Gazette detailed how the University of Pittsburgh is absorbing federal research cuts and broader pressure on higher education. The University of Pittsburgh, led by Chancellor Joan Gabel, is contending with lost federal research money and the funding and enrollment strains squeezing universities nationwide as she enters her fourth year running the school. - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/education/2026/08/10/university-of-pittsburgh-joan-gabel/stories/202608060051 Around town: * Alert Day: Severe Storms Monday in Western Pennsylvania Latest developments: WTAE declared an Alert Day for Monday, August 10, warning of strong-to-severe thunderstorms across Western Pennsylvania. Forecasters at WTAE issued an Alert Day for Monday, August 10, expecting strong to severe thunderstorms across Western Pennsylvania. - WTAE: https://www.wtae.com/article/alert-day-strong-to-severe-storms-for-western-pa/73388962 * Westmoreland Weighs Tax Rebates for Volunteer Responders Latest developments: Westmoreland County commissioners proposed $250 annual property-tax rebates for volunteer firefighters and ambulance crews starting in 2028. Westmoreland County commissioners pitched a plan giving volunteer firefighters and ambulance personnel a $250 annual property-tax rebate beginning in 2028, meant to reward and retain the county's emergency volunteers. - TribLive: https://triblive.com/local/westmoreland/westmoreland-commissioners-pitch-tax-rebates-for-volunteer-first-responders/ * Wildfire Smoke Compounds Pittsburgh's Industrial Pollution Latest developments: PublicSource examined how Canadian wildfire smoke, which pushed Allegheny County's air quality into the hazardous range on July 16, layers onto the region's existing industrial pollution. Smoke from Canadian wildfires drove Allegheny County's air quality into the maroon hazardous range on July 16, and PublicSource reports that Pittsburgh's industrial emissions compound the health risk each time such smoke returns. - PublicSource: https://www.publicsource.org/pittsburgh-air-pollution-health-risk-elevated-wildfire-smoke/ Events: * Little Italy Days Returns to Bloomfield August 13 Latest developments: Little Italy Days returns to Bloomfield opening Thursday, August 13, and Pittsburgh Magazine detailed a lineup of more than 30 performers, a Miss Little Italy pageant, and a celebrity bocce challenge. The 26th annual Little Italy Days, the Italian street festival in Pittsburgh's Bloomfield neighborhood, opens Thursday, August 13, with more than 30 performers and events, a Q&A with the actor who played Vito on 'The Sopranos,' a family Miss Little Italy pageant, a celebrity bocce challenge pitting local politicians against media personalities, and pizza from Caliente. - Pittsburgh Magazine: https://www.pittsburghmagazine.com/7-things-to-do-in-august/ SPORTS ---------------------------------------------------------------- Around the Teams: * Steelers Bet Big on Rebuilt Offensive Line Latest developments: The Post-Gazette laid out the Steelers' heavy draft investment in the offensive line as camp opens, spotlighting the picks General Manager Omar Khan spent to rebuild it. General Manager Omar Khan has poured high draft picks into the Steelers' offensive line around Troy Fautanu, Broderick Jones, Zach Frazier, and Mason McCormick, and the Post-Gazette weighed whether that spending will finally steady a long-troubled unit. - Pittsburgh Post-Gazette: https://www.post-gazette.com/sports/steelers/2026/08/10/oline-offensive-line-khan-fautanu-broderick-mccormick-frazier/stories/202608080016 * Hiles: Late-Season Collapses Are the Pirates' Habit Latest developments: Post-Gazette columnist Noah Hiles wrote that late-season collapses have become the Pirates' defining pattern as their wild-card hopes fade. Post-Gazette columnist Noah Hiles argued that the Pirates specialize in late-season fades, tracing the pattern across the Clint Hurdle, Derek Shelton, and Don Kelly eras as this year's playoff chase slips away. - Pittsburgh Post-Gazette: https://www.post-gazette.com/sports/columns/2026/08/10/pirates-mlb-don-kelly-derek-shelton-clint-hurdle/stories/202608080034 Team USA: * Mexico Tops U.S. in Concacaf U20 Final Latest developments: Mexico beat the United States 2-0 at Estadio Azteca on Sunday, August 9, to win a second straight Concacaf U20 championship after a contested red card. Mexico defeated the United States 2-0 at Estadio Azteca in Mexico City on Sunday to capture its second consecutive Concacaf Under-20 championship, a result ESPN said turned on a questionable red card against the U.S. side. - ESPN: https://www.espn.com/soccer/story/_/id/49571657/mexico-beats-us-concacaf-u20-final * Rivera, Richard Win U.S. Gymnastics Titles Latest developments: Hezly Rivera won her second straight U.S. women's all-around title on Sunday, August 9, while Frederick Richard captured his first U.S. men's all-around crown. Olympic gold medalist Hezly Rivera, 18, rallied from fourth on the final night to win her second consecutive U.S. women's all-around gymnastics title, and Frederick Richard took his first U.S. men's all-around crown, casting both as leaders heading toward the 2028 Los Angeles Olympics. - ESPN: https://www.espn.com/olympics/gymnastics/story/_/id/49571409/olympic-gold-medalist-hezly-rivera-rallies-capture-second-straight-us-women-gymnastics-title - ESPN: https://www.espn.com/olympics/gymnastics/story/_/id/49565148/frederick-richard-wins-first-us-gymnastics-title-la-games-sight READING ---------------------------------------------------------------- * Cal Newport -- On AI Coding and Its Discontents Newport weighs the promise and the backlash around AI-assisted software development, opening with a Silicon Valley engineer who turned from AI skeptic to convert, to gauge how much the tools truly change the work of coding. https://calnewport.com/on-ai-coding-and-its-discontents/ * Stratechery -- Apple Earnings, More on Amazon's Earnings Ben Thompson argues chip shortages, more than memory supply, cap Apple's earnings and stock, then extends his analysis of Amazon's results and Andy Jassy's read of the market. https://stratechery.com/2026/apple-earnings-more-on-amazons-earnings/ * Ed Zitron -- Premium: The Hater's Guide To NVIDIA (Part 2) Zitron presses his skeptical case against NVIDIA, arguing that the company's insistence it resembles nothing like Enron, WorldCom, or Lucent only invites the comparison it wants to escape. https://www.wheresyoured.at/premium-the-haters-guide-to-nvidia-part-2/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,705.63 ▲ +3.9% Dow 53,907.09 ▲ +3.2% Nasdaq 26,380.26 ▲ +5.7% WTI crude 77.36 ▼ -6.7% EUR/USD 1.1533 ▲ +0.9% GBP/USD 1.3459 ▲ +0.8% USD/JPY 157.76 ▼ -3.2% ================================================================ Generated 2026-08-10 07:06 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================