================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Monday, August 10, 2026 - 10:06 AM EDT ================================================================ Two actively exploited zero-days—Metabase, which already breached laptop maker Framework, and N-able's N-central, now feeding China-linked ransomware—anchor a day that also brought Iran-linked water attacks and passkey-defeating research. CONTENTS: Emerging Trends and Key Updates | Security | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Nation-state crews are weaponizing trusted infrastructure, with China-linked actors turning N-able's N-central into a ransomware launchpad while Iran-linked hackers hit water controls in New Jersey and Alabama. see: N-able N-central Feeds China-Linked Ransomware; Iran-Linked Water Attacks Reach New Jersey and Alabama * [UPDATE (new)] A Metabase zero-day let attackers seize admin control and exfiltrate customer names, addresses, and login IP data from laptop maker Framework before any patch existed. see: Metabase Zero-Day Patched After Framework Breach * [TREND] Three research teams cracked phishing-resistant passkeys, replaying signed authentication material and extracting cloud-synced private keys via malware already sitting on a victim's Windows machine. see: New Passkey Attacks Bypass Phishing-Resistant MFA * [UPDATE (new)] Fresh third-party breaches hit gaming and data brokers, as Valve notified European Steam hardware buyers after CEVA Logistics was compromised and LexisNexis pulled products offline. see: Breaches Hit Valve Steam Hardware and LexisNexis * [TREND] SecurityWeek detailed Ghostjacking, where an AI agent executes attacker commands planted word-for-word inside the log or alert that recorded a blocked request. see: Ghostjacking Turns AI Agents Malicious * [UPDATE (new)] Locally, forecasters extended a severe-weather and flash flooding threat through midweek as Pittsburgh's Original Pittsburgh Winery closes for good this week. see: Severe Storms, Flash Flooding Through Midweek; Original Pittsburgh Winery Closes This Week SECURITY ---------------------------------------------------------------- 1. METABASE ZERO-DAY PATCHED AFTER FRAMEWORK BREACH Vulnerabilities and Exploits · [zero-day, patch, breach] Latest developments: Metabase shipped a fix for the zero-day that lets unauthenticated remote attackers seize administrative control, and Framework told customers the intruders took names, email addresses, phone numbers, physical addresses, and login IP addresses, sparing payment and order records. Metabase's self-hosted business intelligence software carried a flaw granting unauthenticated attackers admin access; San Francisco laptop maker Framework counts among the confirmed victims. Operators should apply the patch at once and audit administrator access logs. - Help Net Security: https://www.helpnetsecurity.com/2026/08/10/metabase-zero-day-framework-tally-kilo-code/ - SecurityWeek: https://www.securityweek.com/metabase-patches-vulnerability-exploited-as-zero-day/ 2. N-ABLE N-CENTRAL FEEDS CHINA-LINKED RANSOMWARE Vulnerabilities and Exploits · [apt, ransomware, patch] Latest developments: Microsoft tied the ongoing exploitation of N-able CVE-2026-18577 to a China-linked actor turning N-central into a ransomware launchpad, and N-able shipped a mandatory Hotfix 2 that supersedes the first and adds fresh indicators of compromise. N-able's N-central remote monitoring and management platform, popular with managed service providers, carries an actively exploited command-injection flaw a China-linked actor now uses to plant ransomware. MSPs must apply Hotfix 2 even after Hotfix 1 and hunt for the shared indicators of compromise. - The Record: https://therecord.media/china-hackers-ransomware-microsoft - Help Net Security: https://www.helpnetsecurity.com/2026/08/10/cve-2026-18577-n-central-hotfix-2-msps/ 3. BREACHES HIT VALVE STEAM HARDWARE AND LEXISNEXIS Data Breaches · [breach, supply-chain] Latest developments: Valve began notifying European Steam hardware buyers that thieves stole their data by breaching shipping partner CEVA Logistics, while LexisNexis pulled its Diligence, Metabase API, and Newsdesk products offline after detecting suspicious activity on servers a third-party vendor runs. Two data incidents trace to third-party vendors: Valve's Steam hardware customer data left through logistics partner CEVA Logistics, and LexisNexis suspended three services over unusual activity on an outside vendor's servers. Affected customers should watch for phishing tied to the exposed contact details. - BleepingComputer: https://www.bleepingcomputer.com/news/security/valve-notifies-steam-hardware-customers-of-a-data-breach/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/lexisnexis-shuts-down-services-after-suspicious-activity-on-servers/ 4. NEW PASSKEY ATTACKS BYPASS PHISHING-RESISTANT MFA Vulnerabilities and Exploits · [mfa, research, identity] Latest developments: Three separate research teams defeated passkey protections by reusing signed authentication material that Windows exposed, extracting cloud-synced private keys from malware already on the victim's machine, and sidestepping phishing-resistant multifactor checks. Passkeys promise phishing-resistant logins that replace reusable passwords, yet researchers showed malware on a compromised Windows machine can reuse signed authentication material and pull synced private keys. Defenders should treat endpoint compromise as passkey compromise. - The Hacker News: https://thehackernews.com/2026/08/new-passkey-attacks-can-recover-synced.html 5. IRAN-LINKED WATER ATTACKS REACH NEW JERSEY AND ALABAMA Critical Infrastructure Security · [ics, apt, critical-infrastructure] Latest developments: New Jersey and Alabama joined at least a dozen states where hackers linked to Iran targeted industrial control systems at water facilities, widening a campaign that earlier hit Minnesota, Clayton County, Georgia, and South Dakota. Iran-linked hackers reached the industrial control systems running drinking-water utilities across at least a dozen states, now including New Jersey and Alabama. Water operators should segment and lock down any internet-exposed control systems. - SecurityWeek: https://www.securityweek.com/new-jersey-alabama-join-states-targeted-in-water-cyberattacks/ 6. GHOSTJACKING TURNS AI AGENTS MALICIOUS AI Security · [ai, prompt-injection] Latest developments: SecurityWeek detailed Ghostjacking, in which an AI agent runs attacker commands planted word-for-word inside the log or alert that recorded a blocked request. Ghostjacking poisons the logs and alerts that security systems generate, so an AI agent reading a record of a blocked request executes the attacker's embedded instructions. Teams deploying autonomous agents should sanitize log and alert text before an agent acts on it. - SecurityWeek: https://www.securityweek.com/ghostjacking-attack-uses-poisoned-logs-to-turn-ai-agents-bad/ PITTSBURGH ---------------------------------------------------------------- Weather: Today: Chance Showers And Thunderstorms then Showers And Thunderstorms, high 86F. Tonight: Chance Showers And Thunderstorms then Showers And Thunderstorms Likely, low 69F. Tuesday: Chance Showers And Thunderstorms, high 84F. Business: * Original Pittsburgh Winery Closes This Week Latest developments: The venue enters its final week, closing for good August 15, and NEXTpittsburgh detailed how the loss is reverberating through the city's live-music scene. The Original Pittsburgh Winery, a music venue run by co-owners Tim Gaber and Anthony Jardine, shuts down August 15 after announcing the decision July 24, and it is playing a full slate of farewell shows on the way out, including sets by Gaber's band, the Buzz Poets. - NEXTpittsburgh: https://nextpittsburgh.com/latest-news/the-original-pittsburgh-winery-closes-for-good-this-week/ * Mauro's Corner Exxon Marks 30 Years in Penn Hills Latest developments: TribLive reported Mauro's Corner Exxon reached its 30th year serving Penn Hills. Mauro's Corner Exxon, a gas station and neighborhood fixture in Penn Hills, marked three decades in business, functioning as a local gathering spot well beyond the fuel pumps. - TribLive: https://triblive.com/local/penn-hills/mauros-corner-exxon-celebrates-30-years-of-serving-penn-hills/ Around town: * Severe Storms, Flash Flooding Through Midweek Latest developments: Forecasters extended the severe-weather and flooding threat through Wednesday and Thursday, warning of up to 4 inches of rain, after declaring Monday, August 10, an Alert Day. WTAE and KDKA warn of rounds of heavy rain, damaging wind, flash flooding, and possible tornadoes and hail across Western Pennsylvania, with August 10 and Tuesday both First Alert weather days; Pittsburgh has already logged 3.32 inches of rain in the month's first nine days. - WTAE: https://www.wtae.com/article/western-pennsylvania-flash-flooding-damaging-wind-alert/73390515 - KDKA: https://www.cbsnews.com/pittsburgh/news/strong-winds-and-flooding-will-be-possible-today-for-the-pittsburgh-area/ * Pittsburgh Suburbs Move to Regulate E-Bikes Latest developments: TribLive reported that a growing number of Pittsburgh-area municipalities are passing ordinances to regulate electric-bike use. Municipalities across the Pittsburgh region are enacting ordinances governing e-bikes, responding to safety concerns as the bikes proliferate on local streets and trails, TribLive reported. - TribLive: https://triblive.com/local/valley-news-dispatch/e-bike-regulations-becoming-popular-in-pittsburgh-suburbs/ SPORTS ---------------------------------------------------------------- Around the Teams: * Pirates Rebuild Bullpen Around Luke Weaver Latest developments: The Post-Gazette's 'Off The Bat' examined the Pirates' bullpen rebuild, arguing there is no blueprint for it after the trade-deadline overhaul. The Pittsburgh Post-Gazette analyzed how the Pirates are rebuilding their relief corps around deadline pickup Luke Weaver, a right-hander acquired from the New York Mets, describing an effort without an obvious model. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/08/10/pirates-trade-deadline-bullpen-rebuild-luke-weaver/stories/202608080036 * Broderick Jones, Drew Allar Bounce Back Under the Lights Latest developments: Post-Gazette camp observers reported bounce-back showings from tackle Broderick Jones and quarterback Drew Allar at the Steelers' Saturday night practice in Latrobe. At the Steelers' Saturday night training-camp practice, offensive tackle Broderick Jones and quarterback Drew Allar rebounded with strong performances, the Post-Gazette's camp observations noted. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/08/08/steelers-training-camp-broderick-allar-tonyan-pittman/stories/202608070080 * Rookie Nowakowski Chases Special-Teams Role Latest developments: The Post-Gazette reported that rookie Riley Nowakowski is working to earn coaches' trust in an expected special-teams role at Steelers camp. Steelers rookie Riley Nowakowski is trying to earn a spot on special teams, telling the Post-Gazette from training camp that gaining the coaches' trust is his path onto the roster. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/08/09/nfl-steelers-riley-nowakowski-special-teams-training-camp/stories/202608090045 READING ---------------------------------------------------------------- * Cal Newport -- On AI Coding and Its Discontents Newport examines the tensions around AI-assisted software development, opening with a senior Silicon Valley engineer who moved from skeptic to convert, and weighs what these coding tools actually deliver. https://calnewport.com/on-ai-coding-and-its-discontents/ * Stratechery -- Apple Earnings, More on Amazon's Earnings Ben Thompson argues Apple's earnings and stock are constrained by chip shortages rather than memory, then extends his read on Amazon's results and Andy Jassy's market analysis. https://stratechery.com/2026/apple-earnings-more-on-amazons-earnings/ * Ed Zitron -- Premium: The Hater's Guide To NVIDIA (Part 2) Zitron presses his bearish case against NVIDIA, mocking the company's repeated insistence that it is nothing like Enron, WorldCom, or Lucent as a self-defeating Streisand effect. https://www.wheresyoured.at/premium-the-haters-guide-to-nvidia-part-2/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,705.63 ▲ +3.9% Dow 53,907.09 ▲ +3.2% Nasdaq 26,380.26 ▲ +5.7% WTI crude 77.36 ▼ -6.7% EUR/USD 1.1533 ▲ +0.9% GBP/USD 1.3459 ▲ +0.8% USD/JPY 157.76 ▼ -3.2% ================================================================ Generated 2026-08-10 10:06 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================