daily plain-text briefing: security, markets, business, and pittsburgh
Microsoft's August update closed as many as 421 flaws, among them an already-exploited Windows kernel zero-day, while AI agents surfaced fresh critical bugs in SharePoint and cellular network cores.
Latest developments: Microsoft's August rollout fixed as many as 421 CVEs, 62 rated critical, and closed CVE-2026-68820, a use-after-free in the afd.sys WinSock kernel driver that attackers already exploit to escalate to SYSTEM, plus two publicly disclosed zero-days and critical QUIC and DNS Server remote code execution bugs.
The afd.sys flaw lets code already running on a Windows machine gain SYSTEM privileges, and CISA added it to its Known Exploited Vulnerabilities catalog, so administrators should apply that update first among the month's massive volume.
Sources: Krebs on Security · BleepingComputer · The Hacker News · SecurityWeek · ↑ top
Latest developments: Researchers used an AI agent to build an unauthenticated remote code execution chain in Microsoft SharePoint, CVE-2026-55040 at CVSS 9.1, while Nanyang Technological University turned AI agents on 4G and 5G core software and found 84 previously unknown flaws, 81 now carrying CVEs with 23 still unfixed, and a public AI tool located the patched Zoom annotation zero-click bug in under 20 prompts.
AI-assisted vulnerability discovery is moving from research to routine, exposing flaws in SharePoint Subscription Edition, 2019, and 2016, in cellular network cores where one bug hijacks a subscriber's data session, and in Zoom's screen-sharing feature.
Sources: The Hacker News · Help Net Security · Wired Security · ↑ top
Latest developments: Tomasz Piotr Lisowski and Marius Muench of the University of Birmingham, working with Kristian Covic of Fuzzware, showed that a compromised SIM card can issue commands built into the cellular spec to 26 tested phones and modules, stealing files, downgrading connections to 2G, and running code inside the modems of electric-vehicle chargers, industrial routers, and car telematics units.
The attack abuses a legitimate function of the cellular standard, so a malicious or hijacked SIM can take over the device holding it; cellular IoT gear faces the most exposure.
Sources: Help Net Security · The Hacker News · ↑ top
Latest developments: The Microsoft Threat Intelligence team detailed how the DeadLock gang runs victim communications and its data-leak operation across Polygon smart contracts and the Session messaging network, a decentralized recovery ecosystem the crew built to survive infrastructure seizures.
DeadLock stores and delivers extortion resources through blockchain-backed services that resist takedown, echoing the Kimwolf botnet's Ethereum-based command routing and a broader shift by cybercriminals toward decentralized channels.
Sources: BleepingComputer · The Hacker News · ↑ top
Latest developments: CERT-UA tied a social-engineering campaign running since at least May to UAC-0145, a subgroup of Russia's Sandworm, also called APT44, that poses as recruiters to trick Ukrainian IT professionals into installing a trojanized WireGuard VPN client that runs attacker commands.
The fake job offers deliver a malicious VPN installer to system administrators and IT staff; Sandworm is the destructive GRU-linked unit behind years of attacks on Ukraine.
Sources: BleepingComputer · The Hacker News · ↑ top
Latest developments: Security researchers stood up a sham cryptocurrency startup, advertised developer jobs, and hired three people they believe are North Korean operatives, recording every company-issued virtual machine to document the tradecraft, including a first hire who claimed Pasadena, Texas, then produced a California driver's license and a New York bank account.
The sting turns North Korea's remote-worker infiltration scheme into a field study, handing hiring teams concrete red flags; the operatives use stolen or mismatched identity documents to land Western tech jobs.
Sources: The Hacker News · ↑ top
Latest developments: A U.S. military helicopter fired Hellfire missiles at a Panama-flagged vessel that ignored repeated warnings to honor Washington's blockade of Iranian ports, U.S. Central Command said—the first reported shots enforcing the blockade.
The United States is blockading Iran's ports as Tehran keeps the Strait of Hormuz closed and demands a U.S. withdrawal from the Gulf plus war reparations; Brent crude climbed for a fifth straight session and U.S. stocks slid a second day as traders doubt a quick reopening ahead of Wednesday's inflation data.
Sources: WSJ World News · FT Markets · WSJ Markets · ↑ top
Latest developments: The yen gave back its gains Tuesday as the U.S.-led intervention in Japan's bond market wore off, leaving the WSJ Dollar Index flat at 96.15.
Washington has stepped into Japan's sovereign bond market to prop up the yen, an unusual cross-border intervention now losing force as the currency weakens again—a development that bears on funding and rate conditions worldwide.
Sources: WSJ Markets · FT Markets · ↑ top
Tonight: Showers And Thunderstorms Likely, low 64F.
Wednesday: Patchy Fog then Slight Chance Showers And Thunderstorms, high 82F.
Wednesday Night: Chance Showers And Thunderstorms, low 66F.
Latest developments: WTAE and TribLive reported August 11 that a new kosher grocery will occupy the vacant former Rite Aid at Forbes and Murray avenues.
A kosher grocery store will open at the busy Forbes and Murray intersection in Pittsburgh's Squirrel Hill, taking over a shuttered Rite Aid, a real estate firm said.
Sources: WTAE · TribLive · ↑ top
Latest developments: A Westmoreland County Airport Authority official said Tuesday that Spirit Airlines' departure will cost as much as $300,000 in revenue through the end of this year.
Spirit Airlines ended commercial service at Arnold Palmer Regional Airport in Unity Township, and the Westmoreland County Airport Authority now projects a shortfall of up to $300,000 for the rest of 2026.
Latest developments: TribLive reported August 11 that the Pittsburgh Downtown Partnership wants the city to tap a special downtown tax district to fund office-to-housing conversions.
The Pittsburgh Downtown Partnership, a nonprofit community development group, is urging the city to steer money generated by a special tax district toward converting underused downtown offices into housing and other uses.
Latest developments: KDKA reported August 11 that 32% of Pittsburgh Public Schools students were chronically absent last year, and A+ Schools is delivering supply-filled backpacks to Arlington families to cut barriers before classes resume.
Pittsburgh Public Schools calls chronic absenteeism its biggest challenge after 32% of students missed 18 or more days last year; with the school year weeks away, the advocacy group A+ Schools is bringing backpacks to incoming Arlington kindergartners' parents.
Latest developments: KDKA reported August 11 that Pittsburgh Water is moving its lead line replacement work into Bloomfield, Shadyside, Central Lawrenceville, and Highland Park.
Pittsburgh Water will replace public and private lead service lines in Bloomfield, Shadyside, Central Lawrenceville, and Highland Park, the second-to-last group of neighborhoods in a years-long citywide project, and will hold sessions for residents to ask questions.
Latest developments: The Allegheny County Health Department's medical director urged parents August 11 to follow the childhood MMR schedule, pushing back against President Trump's new executive order directing the Justice Department to challenge state vaccine exemption laws.
As measles cases rise and the school year nears, the Allegheny County Health Department's medical director recommended the measles, mumps, and rubella vaccine for children, countering a Trump executive order that tells the Justice Department to contest state vaccination requirements.
Sources: TribLive · WTAE · ↑ top
Latest developments: WPXI reported August 11 that crowds keep turning out for the Butler Farm Show despite repeated rain.
The annual Butler Farm Show continues in Butler County through Saturday, August 15, drawing steady attendance through a rainy week.
Latest developments: The Post-Gazette reported August 11 that quarterback Aaron Rodgers called the preseason "not real football" and saw no advantage to playing in Thursday's opener.
Aaron Rodgers, in his 22nd NFL season, told reporters the preseason is "not real football" and expects little from suiting up Thursday, while embracing a mentor role for the Steelers' younger passers Will Howard and Mason Rudolph.
Sources: Post-Gazette Steelers · ↑ top
Latest developments: The Post-Gazette reported August 11 that rookie running back Eli Heidenreich prepares for his preseason debut at Acrisure Stadium, drawing on teammates who also arrived as long shots.
Eli Heidenreich, the Navy midshipman the Steelers drafted from his hometown, faces his first game at Acrisure Stadium looking to convert draft-day sentiment into a roster spot, taking inspiration from Pittsburgh players who broke in as underdogs.
Sources: Post-Gazette Steelers · ↑ top
Latest developments: Post-Gazette columnist Noah Hiles argued August 10 that late-season fades have become the Pirates' defining trait as the club slides again.
Noah Hiles wrote that the Pirates do late-season collapses better than anything else, tracing a pattern that runs through the Clint Hurdle, Derek Shelton, and Don Kelly years as Pittsburgh's playoff hopes fade once more.
Sources: Post-Gazette Pirates · ↑ top
Latest developments: The Portland Thorns announced August 11 that United States and Thorns midfielder Olivia Moultrie tore her ACL and will miss the rest of the 2026 NWSL season.
Olivia Moultrie, a rising USWNT midfielder, will sit out the remainder of the 2026 season after tearing her ACL, a setback that clouds her push toward the 2027 Women's World Cup in Brazil.
Sources: ESPN Soccer · ↑ top
S&P 500 7,736.16 ▲ +3.8% Dow 54,066.60 ▲ +3.1% Nasdaq 26,518.55 ▲ +5.5% WTI crude 77.72 ▼ -5.8% EUR/USD 1.1543 ▲ +0.5% GBP/USD 1.3476 ▲ +0.5% USD/JPY 158.15 ▼ -1.5%