================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Monday, August 10, 2026 - 7:36 PM EDT ================================================================ China-linked ransomware crews and Iran-suspected saboteurs race to weaponize freshly patched enterprise and industrial flaws, while attackers learn to turn defensive AI agents against their owners. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Researchers unveiled GhostJacking, which hides commands inside the security logs and blocked-event alerts that AI agents ingest, hijacking the very tools meant to catch intruders. see: GhostJacking Turns AI Agents Against Defenders * [TREND] Iran spans infrastructure and markets as suspected operatives hit water-utility controllers in New Jersey and Alabama while Tehran's hardened Hormuz demands push oil higher. see: Water Utility Attacks Widen, Iran Suspected; Oil Surges as Iran Hardens Hormuz Demands * [TREND] Ransomware crews keep weaponizing fresh flaws, as China-linked Storm-1175 drops StormEncryptor through the N-central bug while a patched Metabase zero-day powered the Framework customer-data theft. see: StormEncryptor Ransomware Hits via N-central Flaw; Metabase Zero-Day Patched After Framework Breach * [UPDATE (new)] Surveillance-data exposure deepened after LexisNexis pulled services offline over a vendor breach the same day records showed ICE will pay the broker millions for Americans' personal data. see: LexisNexis Breach and ICE Data Pipeline * [UPDATE (new)] Passkeys took a hit as three teams showed ways to defeat them without breaking the cryptography, reusing Windows-signed material and recovering cloud-synced credentials. see: New Attacks Undercut Passkey Protections * [UPDATE (new)] Nvidia turned last week's plan into a struck $500 billion deal as Apollo, Blackstone, BlackRock, and Goldman Sachs committed the AI financing on August 10. see: Nvidia and Wall Street Strike $500 Billion AI Deal SECURITY ---------------------------------------------------------------- 1. STORMENCRYPTOR RANSOMWARE HITS VIA N-CENTRAL FLAW Ransomware and Cybercrime · [ransomware, china, patch] Latest developments: Microsoft tied StormEncryptor, a new C++ encryptor that appends the .encrypted extension, to Storm-1175, a China-linked crew and former Medusa affiliate that likely breaks in through Progress N-able N-central flaw CVE-2026-18577, which N-able rushed a second hotfix to close. Storm-1175 abandoned Medusa for its own StormEncryptor strain, hitting managed service providers through the actively exploited N-central bug; administrators must apply N-able's Hotfix 2 and hunt for the shared indicators of compromise. - BleepingComputer: https://www.bleepingcomputer.com/news/security/new-stormencryptor-ransomware-used-by-former-medusa-affiliate/ - The Hacker News: https://thehackernews.com/2026/08/china-linked-hackers-deploy-new.html - Help Net Security: https://www.helpnetsecurity.com/2026/08/10/cve-2026-18577-n-central-hotfix-2-msps/ 2. WATER UTILITY ATTACKS WIDEN, IRAN SUSPECTED Critical Infrastructure Security · [ics, nation-state, policy] Latest developments: Hackers whom investigators tie to Iran extended attacks on internet-exposed programmable logic controllers to water plants in New Jersey and Alabama, carrying the campaign past a dozen states, and Senate Democrats answered with a bill to spend $300 million a year hardening water and wastewater systems. Iran-linked hackers keep hitting poorly secured, internet-facing industrial controls at U.S. water utilities; operators should pull PLCs off the open internet and enforce authentication, and Congress now weighs dedicated funding. - Dark Reading: https://www.darkreading.com/ics-ot-security/multistate-water-system-attacks-widen-iran-suspected - SecurityWeek: https://www.securityweek.com/new-jersey-alabama-join-states-targeted-in-water-cyberattacks/ - The Record: https://therecord.media/senate-water-cybersecurity-legislation 3. METABASE ZERO-DAY PATCHED AFTER FRAMEWORK BREACH Vulnerabilities and Exploits · [zero-day, patch, breach] Latest developments: Metabase shipped a fix for the maximum-severity SQL injection flaw attackers exploited as a zero-day, which still carries no CVE, after Framework, the San Francisco repairable-laptop maker, told customers intruders stole names, emails, phone numbers, addresses, and login IP addresses. The bug hands unauthenticated remote attackers administrator access to self-hosted Metabase analytics and every downstream data source; run the patched build immediately and assume compromise on exposed instances. - SecurityWeek: https://www.securityweek.com/metabase-patches-vulnerability-exploited-as-zero-day/ - Help Net Security: https://www.helpnetsecurity.com/2026/08/10/metabase-zero-day-framework-tally-kilo-code/ - Dark Reading: https://www.darkreading.com/vulnerabilities-threats/metabase-sql-zero-day-attacks-wide-blast-radius 4. GHOSTJACKING TURNS AI AGENTS AGAINST DEFENDERS AI Security · [ai, prompt-injection] Latest developments: Researchers revealed GhostJacking, an attack that plants malicious instructions inside the security logs and blocked-event alerts AI agents ingest, tricking the agent into executing the attacker's commands word for word. As enterprises wire AI agents into incident response, the logs those agents read become an injection channel; teams should treat alert and log content as untrusted input and sandbox agent actions. - Dark Reading: https://www.darkreading.com/cyber-risk/ghostjacking-identity-governance-gaps-ai-agents - SecurityWeek: https://www.securityweek.com/ghostjacking-attack-uses-poisoned-logs-to-turn-ai-agents-bad/ 5. LEXISNEXIS BREACH AND ICE DATA PIPELINE Data Breaches · [breach, surveillance] Latest developments: LexisNexis pulled its Diligence, Metabase API, and Newsdesk services offline after spotting suspicious activity on servers a third-party vendor hosts, the same day records showed ICE will pay the data broker millions to funnel Americans' personal data into a Palantir system. LexisNexis aggregates and sells vast troves of personal data to law enforcement including ICE; the outage and the Palantir contract sharpen scrutiny of how much sensitive information the broker holds and where it flows. - BleepingComputer: https://www.bleepingcomputer.com/news/security/lexisnexis-shuts-down-services-after-suspicious-activity-on-servers/ - 404 Media: https://www.404media.co/ice-to-pay-lexisnexis-millions-for-data-to-feed-to-palantir/ 6. NEW ATTACKS UNDERCUT PASSKEY PROTECTIONS Vulnerabilities and Exploits · [mfa, identity] Latest developments: Three research teams showed ways to defeat passkeys without cracking their cryptography, reusing signed authentication material Windows exposed, abusing a cloud-synced passkey system from malware already on a machine, and recovering synced private keys. Passkeys replace passwords and resist phishing, yet these techniques sidestep that protection through exposed credentials and endpoint malware; defenders should harden endpoints and watch for rogue device registration. - The Hacker News: https://thehackernews.com/2026/08/new-passkey-attacks-can-recover-synced.html BUSINESS AND POLITICS ---------------------------------------------------------------- * Nvidia and Wall Street Strike $500 Billion AI Deal Latest developments: Apollo, Blackstone, BlackRock, and Goldman Sachs formally committed to the financing on August 10, turning last week's plan into a struck agreement. Nvidia and a consortium of Wall Street firms agreed to raise roughly $500 billion to bankroll data centers, the largest private-capital push yet behind the artificial-intelligence build-out. - WSJ US Business: https://www.wsj.com/business/deals/nvidia-wall-street-firms-strike-ai-financing-deal-targeting-500-billion-c50377db?mod=pls_whats_news_us_business_f - FT World: https://www.ft.com/content/98a8fd17-15b6-4f67-9cb4-825722b11348?syn-25a6b1a6=1 * Oil Surges as Iran Hardens Hormuz Demands Latest developments: Iran demanded a U.S. military withdrawal from the Gulf, the unfreezing of its assets, and war reparations on August 10, prolonging the closure and pushing U.S. stocks off record highs as President Trump reverted to economic pressure. Oil futures rallied and the S&P 500 slipped as Iran's conditions extended the shutdown of the Strait of Hormuz, the chokepoint for a fifth of the world's seaborne oil, while Ayatollah Ali Khamenei tightened his grip through senior military appointments. - WSJ Markets: https://www.wsj.com/finance/commodities-futures/oil-rises-amid-growing-doubts-over-strait-of-hormuzs-reopening-6e42507b?mod=rss_markets_main - WSJ Markets: https://www.wsj.com/finance/stocks/u-s-stocks-fall-as-hopes-for-strait-of-hormuz-reopening-are-dashed-again-03a4915a?mod=rss_markets_main - FT World: https://www.ft.com/content/34299f83-9c49-4332-9d0f-d4f369d7a233?syn-25a6b1a6=1 PITTSBURGH ---------------------------------------------------------------- Weather: Tonight: Chance Showers And Thunderstorms, low 69F. Tuesday: Showers And Thunderstorms Likely then Chance Showers And Thunderstorms, high 82F. Tuesday Night: Showers And Thunderstorms then Chance Showers And Thunderstorms, low 66F. Business: * Federal Investigators Fault U.S. Steel Over Clairton Blast Latest developments: The U.S. Chemical Safety Board released its findings on August 10, concluding preventable safety and management failures caused the 2025 Clairton Coke Works explosion. Federal investigators concluded U.S. Steel could have prevented the 2025 explosion at its Clairton Coke Works in Allegheny County, citing multiple lapses at the largest coke plant in the region. - WTAE: https://www.wtae.com/article/clairton-coke-works-explosion-csb-report/73394860 - Pittsburgh Post-Gazette: https://www.post-gazette.com/business/powersource/2026/08/10/us-steel-clairton-coke-works-explosion-report/stories/202608100052 * Sherwin-Williams Fined for Beaver County Air Violations Latest developments: The Pennsylvania Department of Environmental Protection and Sherwin-Williams signed a consent order carrying a $124,700 penalty and corrective steps after air-pollution violations. Sherwin-Williams will pay $124,700 and fix violations of the Air Pollution Control Act at its manufacturing plant in Rochester, Beaver County, after residents said the air smelled of chemicals like nail-polish remover inside their homes. - KDKA: https://www.cbsnews.com/pittsburgh/news/sherwin-williams-dep-agreement-air-quality-violations/ Around town: * Allegheny County Confronts Pension Shortfall Latest developments: KDKA reported August 10 that the county must contribute $100 million a year for 20 years to close its underfunded pension and has yet to decide how to pay. Allegheny County faces a $100-million annual bill for two decades to shore up its underfunded employee pension, and it is searching for answers before turning to taxpayers. - KDKA: https://www.cbsnews.com/pittsburgh/video/allegheny-county-searches-for-answers-to-fix-underfunded-pension/ * Pennsylvania Teacher Shortage Deepens Latest developments: KDKA reported August 10 that Pennsylvania awarded 65% fewer teaching certificates this year than it did a decade ago, a decline a researcher called severe. Pennsylvania's teacher shortage is squeezing school districts as the state issues 65% fewer teaching certificates than it did ten years ago. - KDKA: https://www.cbsnews.com/pittsburgh/video/researcher-calls-pennsylvanias-teacher-shortage-severe/ * Heavy Rain and Flooding Threaten Western Pennsylvania Latest developments: Forecasters declared Tuesday, August 11, an Alert Day, with rounds of heavy rain capable of dropping up to four inches and flooding lingering through Thursday. Western Pennsylvania faces strong-to-severe storms and flash flooding this week, with residents in Greensburg pressing for safety changes after recent flooding. - WTAE: https://www.wtae.com/article/western-pennsylvania-flash-flooding-damaging-wind-alert/73390515 - WTAE: https://www.wtae.com/article/alert-day-strong-to-severe-storms-for-western-pa/73388962 Events: * Whiskey Rebellion Anniversary at Braddock's Battlefield Museum Latest developments: KDKA reported August 10 that the museum will hold its anniversary fundraiser Wednesday, August 12. Braddock's Battlefield History Museum marks the 232nd anniversary of the Whiskey Rebellion on Wednesday, August 12, near North Braddock, with whiskey tastings from local and statewide distilleries, historical reenactments, and food trucks; proceeds preserve the site. - KDKA: https://www.cbsnews.com/pittsburgh/news/braddocks-battlefield-history-museum-fundraiser-whiskey-rebellion/ * Original Pittsburgh Winery Plays Final Shows Latest developments: NEXTpittsburgh reported August 10 that the venue's final week of concerts runs through its August 15 closing. The Original Pittsburgh Winery closes for good August 15 after a run of farewell concerts, including a set by co-owner Tim Gaber's band, the Buzz Poets; Gaber and co-owner Anthony Jardine urged fans to visit before the doors shut. - NEXTpittsburgh Arts & Entertainment: https://nextpittsburgh.com/latest-news/the-original-pittsburgh-winery-closes-for-good-this-week/ * 2027 Pittsburgh Marathon Registration Opens This Week Latest developments: TribLive reported August 10 that sign-ups for the 2027 Pittsburgh Marathon open this week. Registration for the 2027 Pittsburgh Marathon opens this week for runners planning next spring's race. - TribLive: https://triblive.com/sports/2027-pittsburgh-marathon-registration-to-open-this-week/ SPORTS ---------------------------------------------------------------- Around the Teams: * Steelers Await Return of Three Defensive Starters Latest developments: The Post-Gazette reported August 10 that the trio remains sidelined ten days into camp. The Steelers are still without cornerback Joey Porter Jr., cornerback Jalen Ramsey, and safety DeShon Elliott at training camp, and the new coaching staff says it is not worried about the injuries. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/08/10/porter-jalen-ramsey-deshon-elliott-injury-graham-trainingcamp/stories/202608100018 * Pirates Rebuild Bullpen Without a Blueprint Latest developments: The Post-Gazette's Off The Bat column on August 10 assessed how the deadline additions reshape the relief corps. The Post-Gazette examined the Pirates' bullpen overhaul after general manager Ben Cherington added right-hander Luke Weaver at the trade deadline, arguing no clear model exists for rebuilding a relief corps midseason. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/08/10/pirates-trade-deadline-bullpen-rebuild-luke-weaver/stories/202608080036 * Heyward Reflects on Troy Polamalu Latest developments: The Not Just Football episode posted August 10. On his Not Just Football podcast, Steelers defensive lineman Cam Heyward broke down what set Hall of Fame safety Troy Polamalu apart from every other player. - Not Just Football with Cam Heyward: https://www.youtube.com/watch?v=p_z-jWOZTGM Team USA: * Richard Wins First U.S. Men's Gymnastics Title Latest developments: ESPN reported the victory August 9 at the U.S. championships. Frederick Richard captured his first U.S. men's all-around gymnastics championship, cementing his standing as leader of the American men's program two years before the 2028 Los Angeles Olympics. - ESPN Olympics: https://www.espn.com/olympics/gymnastics/story/_/id/49565148/frederick-richard-wins-first-us-gymnastics-title-la-games-sight * U.S. 1,500m Champion Banned for Blood Doping Latest developments: USADA announced the sanction August 10. USADA stripped Jonah Koech of his 2025 U.S. 1,500-meter title and handed him a three-year ban for blood doping. - ESPN Olympics: https://www.espn.com/olympics/trackandfield/story/_/id/49577091/jonah-koech-loses-title-given-3-year-ban-blood-doping READING ---------------------------------------------------------------- * Cal Newport -- On AI Coding and Its Discontents Newport weighs the promise and the limits of AI coding tools through the account of a senior Silicon Valley engineer turned believer, questioning how much they truly change the work of software engineering. https://calnewport.com/on-ai-coding-and-its-discontents/ * Stratechery -- Apple Earnings, More on Amazon's Earnings Ben Thompson argues chip shortages cap Apple's earnings and stock, then extends his read of Amazon's results and Andy Jassy's market analysis. https://stratechery.com/2026/apple-earnings-more-on-amazons-earnings/ * Ed Zitron -- Premium: The Hater's Guide To NVIDIA (Part 2) Zitron continues his skeptical dissection of NVIDIA, needling the company's own insistence that it bears no resemblance to Enron, WorldCom, or Lucent. https://www.wheresyoured.at/premium-the-haters-guide-to-nvidia-part-2/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,705.63 ▲ +3.9% Dow 53,907.09 ▲ +3.2% Nasdaq 26,380.26 ▲ +5.7% WTI crude 77.36 ▼ -6.7% EUR/USD 1.1536 ▲ +0.7% GBP/USD 1.3459 ▲ +0.6% USD/JPY 157.82 ▼ -2.4% ================================================================ Generated 2026-08-10 19:36 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================