================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Friday, August 14, 2026 - 10:05 AM EDT ================================================================ Attackers pounced on a max-severity SAP Commerce Cloud flaw within three days of its patch as France's tax agency and oil giant Shell confronted fresh data-theft claims. CONTENTS: Emerging Trends and Key Updates | Security | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Data theft led the day as France's tax agency confirmed a breach one hacker ties to 600,000 victims and Shell probed Clop's 89-gigabyte extortion claim. see: France Tax Breach and Shell Clop Claim * [TREND] Defenders' tooling became the attack surface as Trivy scanner drove a 2,500-organization compromise, while attackers hit a max-severity SAP Commerce Cloud flaw three days after patching. see: Trivy Scanner Drives 2,500-Org Compromise; SAP Commerce Cloud Flaw Under Active Exploitation * [TREND] Cryptographic deadlines advanced as Google Cloud set a 2029 post-quantum roadmap and AWS Certificate Manager moved to phase out email-validated renewals. see: Compliance and Post-Quantum Deadlines Advance * [UPDATE (new)] Cyera agreed to buy Oasis Security for $1 billion to fuse data and identity security into one control plane for AI agents. see: Cyera Buys Oasis for AI Agent Identity Control * [UPDATE (new)] Flock Safety will require its Audit Assistance abuse-flagging feature and cut most license-plate retention to seven days after officer-misuse scandals. see: Flock Tightens License-Plate Privacy Controls * [TREND] Around Pennsylvania, the state funded free menstrual products in schools, the Game Commission is ending its Deputy Warden Program, and North Allegheny opens August 18. see: Pennsylvania Funds Free Menstrual Products in Schools; Pennsylvania Game Commission Ends Deputy Warden Program; North Allegheny Opens 2026-27 Year August 18 SECURITY ---------------------------------------------------------------- 1. COMPLIANCE AND POST-QUANTUM DEADLINES ADVANCE Policy and Regulation · [policy, encryption, compliance] Latest developments: Google Cloud published a post-quantum cryptography roadmap targeting 2029 readiness with milestones in 2027 and 2028, AWS Certificate Manager set 2027 to phase out email-validated certificate renewals ahead of the CA/Browser Forum's March 15, 2028 cutoff, and Europe opened 17 draft Cyber Resilience Act standards for comment. The moves push enterprises toward quantum-resistant encryption, stronger certificate validation, and Cyber Resilience Act conformity, whose connected-product rules bind manufacturers by the end of 2027. - SecurityWeek: https://www.securityweek.com/google-cloud-sets-out-post-quantum-roadmap-with-2029-readiness-goal/ - Help Net Security: https://www.helpnetsecurity.com/2026/08/14/aws-certificate-manager-email-validation/ - Help Net Security: https://www.helpnetsecurity.com/2026/08/14/etsi-cyber-resilience-act-standards/ 2. FRANCE TAX BREACH AND SHELL CLOP CLAIM Data Breaches · [breach, ransomware, extortion] Latest developments: France confirmed intruders reached the Directorate General of Public Finances in late June by stealing or misusing an identity, while a hacker claims 600,000 victims, and Shell opened an investigation after the Clop gang claimed it stole 89 gigabytes of data. France's tax authority, the DGFiP, is probing the June intrusion, and oil giant Shell is examining Clop's extortion claim; neither has confirmed the full scope. - The Record: https://therecord.media/french-tax-authority-dgfip-confirms-data-breach - BleepingComputer: https://www.bleepingcomputer.com/news/security/shell-investigates-potential-incident-after-clop-data-theft-claims/ 3. SAP COMMERCE CLOUD FLAW UNDER ACTIVE EXPLOITATION Vulnerabilities and Exploits · [vulnerability, exploit, patch] Latest developments: Threat intelligence firm Defused reports attackers began targeting a maximum-severity SAP Commerce Cloud remote code execution flaw just three days after SAP patched it. The vulnerability lets attackers run code on SAP Commerce Cloud e-commerce deployments; administrators should apply SAP's fix immediately. - BleepingComputer: https://www.bleepingcomputer.com/news/security/max-severity-sap-commerce-cloud-flaw-now-targeted-in-attacks/ 4. TRIVY SCANNER DRIVES 2,500-ORG COMPROMISE Software Supply Chain · [supply-chain, breach] Latest developments: SecurityWeek reports the open-source scanner Trivy drove the compromise of 2,500 organizations, with over 95 percent of them exposed before the malicious LiteLLM packages first blamed ever appeared. Investigators traced the mass compromise to Trivy exposure across enterprises; affected organizations should review how they deploy the scanner. - SecurityWeek: https://www.securityweek.com/trivy-not-litellm-behind-the-2500-org-compromise/ 5. CYERA BUYS OASIS FOR AI AGENT IDENTITY CONTROL AI Security · [ai, identity, m&a] Latest developments: Cyera agreed to buy Oasis Security for $1 billion to merge data security and identity into one control plane for AI agents, redefining privileged access around business context in place of static roles. The deal targets the governance gap as enterprises deploy autonomous AI agents that need scoped, monitored access to data and systems. - Dark Reading: https://www.darkreading.com/identity-access-management-security/cyera-oasis-security-acquisition-ai-agent-control 6. FLOCK TIGHTENS LICENSE-PLATE PRIVACY CONTROLS Policy and Regulation · [privacy, surveillance, policy] Latest developments: Flock Safety will require every customer to turn on its Audit Assistance feature for flagging abnormal searches and will hold most license-plate data for only seven days, answering scandals over officer abuse. Flock Safety runs a nationwide automated license-plate reader network used by police departments; the new controls follow reports of officers misusing the system. - The Record: https://therecord.media/flock-safety-audit-assistance-police-departments PITTSBURGH ---------------------------------------------------------------- Weather: Today: Slight Chance Showers And Thunderstorms, high 82F. Tonight: Partly Cloudy, low 66F. Saturday: Mostly Sunny, high 86F. Business: * Leetsdale Faith-Based Boxing Gym Falls Through Latest developments: TribLive reported August 14 that organizers pulled the plan after they could not satisfy Leetsdale borough ordinances. A proposed faith-based boxing gym in Leetsdale, a borough in Allegheny County's Sewickley area, will not open; the organizers abandoned the project after finding no way to comply with borough ordinances. - TribLive: https://triblive.com/local/sewickley/proposed-leetsdale-boxing-club-no-longer-happening/ * Derry Pool Rebounds on Higher Lifeguard Pay Latest developments: TribLive reported August 14 that the Derry Community Pool ran a smooth 2026 season after raising lifeguard pay. Derry Borough Mayor Nathan Bundy said the Derry Community Pool in Westmoreland County operated smoothly all summer on strong attendance and higher lifeguard wages, reversing 2025, when a lifeguard shortage forced the pool to close on several days. - TribLive: https://triblive.com/local/westmoreland/derry-community-pool-bounces-back-from-lifeguard-shortage-with-higher-pay-strong-attendance/ Around town: * Pennsylvania Funds Free Menstrual Products in Schools Latest developments: WTAE reported August 14 that Pennsylvania will spend $9 million over three years to place free menstrual products in schools. Pennsylvania is directing $9 million over the next three years to supply free menstrual products in its public schools, a program the state frames as attacking "period poverty" among students. - WTAE: https://www.wtae.com/article/pennsylvania-schools-receive-funding-free-menstrual-products/73435425 * Pennsylvania Game Commission Ends Deputy Warden Program Latest developments: WPXI reported August 14 that the Pennsylvania Game Commission will officially end its Deputy Game Warden Program on September 1. The Pennsylvania Game Commission is closing its Deputy Game Warden Program, which embedded volunteer deputies within law enforcement, effective September 1, 2026. - WPXI: https://www.wpxi.com/news/local/pennsylvania-game-commission-ending-deputy-game-warden-program-with-law-enforcement/R77ZHY6EVJGQRAY4G6EWZCZFD4/ * North Allegheny Opens 2026-27 Year August 18 Latest developments: TribLive reported August 14 that North Allegheny School District begins classes August 18 with a larger student body. North Allegheny School District, north of Pittsburgh, starts its 2026-27 school year on August 18, 2026, adding enrollment along with new and returning staff. - TribLive: https://triblive.com/news/education-classroom/its-back-to-school-time-at-north-allegheny-heres-whats-new-for-2026-27/ SPORTS ---------------------------------------------------------------- Around the Teams: * Steelers Quarterbacks Impress in Preseason Debut Latest developments: Post-Gazette and TribLive coverage August 13-14 praised Drew Allar, Will Howard, and Mason Rudolph and the new-look passing attack after Aaron Rodgers sat out. With Aaron Rodgers resting, quarterbacks Drew Allar, Will Howard, and Mason Rudolph each moved the Steelers' offense in Mike McCarthy's preseason opener against Green Bay; Post-Gazette columnist Noah Hiles wrote the team's new passing scheme made a strong first impression, and TribLive said the Allar hype train had left the station. - Post-Gazette: https://www.post-gazette.com/sports/steelers/2026/08/13/steelers-got-an-impressive-and-encouraging-look-at-their-qbs-n-preseason-victory/stories/202608130032 - Post-Gazette: https://www.post-gazette.com/sports/steelers/2026/08/13/noah-hiles-new-passing-scheme-made-a-strong-first-impression/stories/202608130034 * Rookie Germie Bernard Shines in NFL Debut Latest developments: The Post-Gazette reported August 14 that rookie receiver Germie Bernard made plays and "doesn't blink" in his first NFL action. Steelers rookie wide receiver Germie Bernard drew praise for a composed preseason debut against the Packers, catching passes and settling into the offense without visible nerves, the Post-Gazette reported. - Post-Gazette: https://www.post-gazette.com/sports/steelers/2026/08/14/nfl-steelers-receiver-germie-bernard-preseason/stories/202608140010 READING ---------------------------------------------------------------- * Stratechery -- Anthropic's Watermarking, How It (Probably) Works, Worse Than It Seems Ben Thompson argues that Anthropic's move to watermark AI output in response to the European Union's AI law is a mistake, chiefly on philosophical grounds, and that the mechanism works worse than its backers claim. https://stratechery.com/2026/anthropics-watermarking-how-it-probably-works-worse-than-it-seems/ * Ed Zitron -- Don't Look Up Zitron argues that investors, executives, and the press keep refusing to confront mounting warning signs around the AI buildout, extending his running case that the sector rests on unsustainable spending. https://www.wheresyoured.at/dont-look-up/ * Cal Newport -- On AI Coding and Its Discontents Newport uses the account of a senior Silicon Valley engineer, a self-described AI skeptic turned convert, to weigh what AI coding tools actually change about software work and where their limits lie. https://calnewport.com/on-ai-coding-and-its-discontents/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,757.29 ▲ +1.5% Dow 53,883.00 ▲ +0.5% Nasdaq 26,626.59 ▲ +2.0% WTI crude 81.61 ▲ +3.7% EUR/USD 1.1540 ▲ +0.1% GBP/USD 1.3493 ▲ +0.2% USD/JPY 158.81 ▲ +0.4% ================================================================ Generated 2026-08-14 10:05 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================