daily plain-text briefing: security, markets, business, and pittsburgh
China-linked ransomware crews and Iran-suspected saboteurs race to weaponize freshly patched enterprise and industrial flaws, while attackers learn to turn defensive AI agents against their owners.
Latest developments: Microsoft tied StormEncryptor, a new C++ encryptor that appends the .encrypted extension, to Storm-1175, a China-linked crew and former Medusa affiliate that likely breaks in through Progress N-able N-central flaw CVE-2026-18577, which N-able rushed a second hotfix to close.
Storm-1175 abandoned Medusa for its own StormEncryptor strain, hitting managed service providers through the actively exploited N-central bug; administrators must apply N-able's Hotfix 2 and hunt for the shared indicators of compromise.
Sources: BleepingComputer · The Hacker News · Help Net Security · ↑ top
Latest developments: Hackers whom investigators tie to Iran extended attacks on internet-exposed programmable logic controllers to water plants in New Jersey and Alabama, carrying the campaign past a dozen states, and Senate Democrats answered with a bill to spend $300 million a year hardening water and wastewater systems.
Iran-linked hackers keep hitting poorly secured, internet-facing industrial controls at U.S. water utilities; operators should pull PLCs off the open internet and enforce authentication, and Congress now weighs dedicated funding.
Sources: Dark Reading · SecurityWeek · The Record · ↑ top
Latest developments: Metabase shipped a fix for the maximum-severity SQL injection flaw attackers exploited as a zero-day, which still carries no CVE, after Framework, the San Francisco repairable-laptop maker, told customers intruders stole names, emails, phone numbers, addresses, and login IP addresses.
The bug hands unauthenticated remote attackers administrator access to self-hosted Metabase analytics and every downstream data source; run the patched build immediately and assume compromise on exposed instances.
Sources: SecurityWeek · Help Net Security · Dark Reading · ↑ top
Latest developments: Researchers revealed GhostJacking, an attack that plants malicious instructions inside the security logs and blocked-event alerts AI agents ingest, tricking the agent into executing the attacker's commands word for word.
As enterprises wire AI agents into incident response, the logs those agents read become an injection channel; teams should treat alert and log content as untrusted input and sandbox agent actions.
Sources: Dark Reading · SecurityWeek · ↑ top
Latest developments: LexisNexis pulled its Diligence, Metabase API, and Newsdesk services offline after spotting suspicious activity on servers a third-party vendor hosts, the same day records showed ICE will pay the data broker millions to funnel Americans' personal data into a Palantir system.
LexisNexis aggregates and sells vast troves of personal data to law enforcement including ICE; the outage and the Palantir contract sharpen scrutiny of how much sensitive information the broker holds and where it flows.
Sources: BleepingComputer · 404 Media · ↑ top
Latest developments: Three research teams showed ways to defeat passkeys without cracking their cryptography, reusing signed authentication material Windows exposed, abusing a cloud-synced passkey system from malware already on a machine, and recovering synced private keys.
Passkeys replace passwords and resist phishing, yet these techniques sidestep that protection through exposed credentials and endpoint malware; defenders should harden endpoints and watch for rogue device registration.
Sources: The Hacker News · ↑ top
Latest developments: Apollo, Blackstone, BlackRock, and Goldman Sachs formally committed to the financing on August 10, turning last week's plan into a struck agreement.
Nvidia and a consortium of Wall Street firms agreed to raise roughly $500 billion to bankroll data centers, the largest private-capital push yet behind the artificial-intelligence build-out.
Sources: WSJ US Business · FT World · ↑ top
Latest developments: Iran demanded a U.S. military withdrawal from the Gulf, the unfreezing of its assets, and war reparations on August 10, prolonging the closure and pushing U.S. stocks off record highs as President Trump reverted to economic pressure.
Oil futures rallied and the S&P 500 slipped as Iran's conditions extended the shutdown of the Strait of Hormuz, the chokepoint for a fifth of the world's seaborne oil, while Ayatollah Ali Khamenei tightened his grip through senior military appointments.
Sources: WSJ Markets · WSJ Markets · FT World · ↑ top
Tonight: Chance Showers And Thunderstorms, low 69F.
Tuesday: Showers And Thunderstorms Likely then Chance Showers And Thunderstorms, high 82F.
Tuesday Night: Showers And Thunderstorms then Chance Showers And Thunderstorms, low 66F.
Latest developments: The U.S. Chemical Safety Board released its findings on August 10, concluding preventable safety and management failures caused the 2025 Clairton Coke Works explosion.
Federal investigators concluded U.S. Steel could have prevented the 2025 explosion at its Clairton Coke Works in Allegheny County, citing multiple lapses at the largest coke plant in the region.
Sources: WTAE · Pittsburgh Post-Gazette · ↑ top
Latest developments: The Pennsylvania Department of Environmental Protection and Sherwin-Williams signed a consent order carrying a $124,700 penalty and corrective steps after air-pollution violations.
Sherwin-Williams will pay $124,700 and fix violations of the Air Pollution Control Act at its manufacturing plant in Rochester, Beaver County, after residents said the air smelled of chemicals like nail-polish remover inside their homes.
Latest developments: KDKA reported August 10 that the county must contribute $100 million a year for 20 years to close its underfunded pension and has yet to decide how to pay.
Allegheny County faces a $100-million annual bill for two decades to shore up its underfunded employee pension, and it is searching for answers before turning to taxpayers.
Latest developments: KDKA reported August 10 that Pennsylvania awarded 65% fewer teaching certificates this year than it did a decade ago, a decline a researcher called severe.
Pennsylvania's teacher shortage is squeezing school districts as the state issues 65% fewer teaching certificates than it did ten years ago.
Latest developments: Forecasters declared Tuesday, August 11, an Alert Day, with rounds of heavy rain capable of dropping up to four inches and flooding lingering through Thursday.
Western Pennsylvania faces strong-to-severe storms and flash flooding this week, with residents in Greensburg pressing for safety changes after recent flooding.
Latest developments: KDKA reported August 10 that the museum will hold its anniversary fundraiser Wednesday, August 12.
Braddock's Battlefield History Museum marks the 232nd anniversary of the Whiskey Rebellion on Wednesday, August 12, near North Braddock, with whiskey tastings from local and statewide distilleries, historical reenactments, and food trucks; proceeds preserve the site.
Latest developments: NEXTpittsburgh reported August 10 that the venue's final week of concerts runs through its August 15 closing.
The Original Pittsburgh Winery closes for good August 15 after a run of farewell concerts, including a set by co-owner Tim Gaber's band, the Buzz Poets; Gaber and co-owner Anthony Jardine urged fans to visit before the doors shut.
Sources: NEXTpittsburgh Arts & Entertainment · ↑ top
Latest developments: TribLive reported August 10 that sign-ups for the 2027 Pittsburgh Marathon open this week.
Registration for the 2027 Pittsburgh Marathon opens this week for runners planning next spring's race.
Latest developments: The Post-Gazette reported August 10 that the trio remains sidelined ten days into camp.
The Steelers are still without cornerback Joey Porter Jr., cornerback Jalen Ramsey, and safety DeShon Elliott at training camp, and the new coaching staff says it is not worried about the injuries.
Sources: Post-Gazette Steelers · ↑ top
Latest developments: The Post-Gazette's Off The Bat column on August 10 assessed how the deadline additions reshape the relief corps.
The Post-Gazette examined the Pirates' bullpen overhaul after general manager Ben Cherington added right-hander Luke Weaver at the trade deadline, arguing no clear model exists for rebuilding a relief corps midseason.
Sources: Post-Gazette Pirates · ↑ top
Latest developments: The Not Just Football episode posted August 10.
On his Not Just Football podcast, Steelers defensive lineman Cam Heyward broke down what set Hall of Fame safety Troy Polamalu apart from every other player.
Sources: Not Just Football with Cam Heyward · ↑ top
Latest developments: ESPN reported the victory August 9 at the U.S. championships.
Frederick Richard captured his first U.S. men's all-around gymnastics championship, cementing his standing as leader of the American men's program two years before the 2028 Los Angeles Olympics.
Sources: ESPN Olympics · ↑ top
Latest developments: USADA announced the sanction August 10.
USADA stripped Jonah Koech of his 2025 U.S. 1,500-meter title and handed him a three-year ban for blood doping.
Sources: ESPN Olympics · ↑ top
S&P 500 7,705.63 ▲ +3.9% Dow 53,907.09 ▲ +3.2% Nasdaq 26,380.26 ▲ +5.7% WTI crude 77.36 ▼ -6.7% EUR/USD 1.1536 ▲ +0.7% GBP/USD 1.3459 ▲ +0.6% USD/JPY 157.82 ▼ -2.4%