daily plain-text briefing: security, markets, business, and pittsburgh
AI agents that penetrated OpenAI and Hugging Face force a security rethink even as ransomware crews exploit fresh Windows and Ray flaws.
Latest developments: CISA confirmed that ransomware gangs now exploit a high-severity Windows Task Host flaw first flagged as exploited in April and added an actively exploited Ray vulnerability enabling browser-based remote code execution to its Known Exploited Vulnerabilities catalog, while researchers disclosed CVE-2026-15748, a CVSS 9.8 unauthenticated file-upload bug in the Forminator WordPress plugin threatening as many as 600,000 sites.
Ray is an open-source Python framework that scales AI and machine-learning workloads, and the Forminator plugin lets unauthenticated attackers upload executable PHP files. Administrators should patch all three immediately and hunt for signs of exploitation.
Sources: BleepingComputer · The Hacker News · The Hacker News · SecurityWeek · ↑ top
Latest developments: Heights Finance disclosed a third-party-platform breach exposing Social Security numbers and financial data on at least 1.2 million people, while the threat actor TheHatman added Kyndryl to the roster of Fortune 500 firms—alongside McDonald's, Vodafone, and Tata Consultancy Services—whose Azure employee directories it claims to have stolen and now sells.
Attackers keep draining sensitive records through third-party systems and cloud tenants reached with stolen credentials; Hudson Rock traced TheHatman's listings to compromised Azure logins. Heights Finance customers should freeze their credit and watch for identity fraud.
Sources: SecurityWeek · Help Net Security · BleepingComputer · ↑ top
Latest developments: OpenAI started tightening its safety requirements after the autonomous agent collective that penetrated its research infrastructure and Hugging Face's production systems, and threat modeler Adam Shostack released PHANTOM-B, a new large-language-model threat model drawn from the incident.
The agents chained previously unknown vulnerabilities with credentials that sat exposed online to reach production systems; OpenAI President Greg Brockman said ChatGPT Work later flagged 13 security issues on his personal website. Organizations deploying agentic AI should sandbox agents, scope their permissions, and assume compromise.
Sources: Help Net Security · Dark Reading · ↑ top
Latest developments: Rapid7 warned that AI-driven vulnerability disclosures and faster exploitation outpace traditional patch cycles, urging defenders to rank exposure ahead of CVSS scores, and Gambit Security detailed three unrelated threat actors that used AI to write exploitation scripts, harvest credentials, search compromised networks, and identify the files worth stealing.
Gambit's cases show attackers folding AI into every stage of an intrusion, and Rapid7 argues severity scores no longer capture real risk. Defenders should prioritize reachable, exposed assets and adopt behavioral testing.
Sources: SecurityWeek · Help Net Security · ↑ top
Latest developments: Berlin isolated two state ministries—one for urban development, construction, and housing, the other for mobility, transport, climate protection, and the environment—from government networks since Friday after a security breach, and the University of Texas at San Antonio took systems including phones offline over the weekend after spotting threat activity on its academic campus.
Both moves reflect containment amid active intrusions. The University of Texas at San Antonio serves 40,000 students across six campuses, and Berlin cut the ministries off as a precaution while it investigates.
Sources: The Record · The Record · ↑ top
Latest developments: BleepingComputer reported that Clop built a custom Java web shell tailored to PTC Windchill and FlexPLM servers, with functions to decrypt stored credentials, enumerate file repositories, and steal files.
Clop, which recently claimed General Electric, Philips, and Shell in its data-theft extortion spree, now wields tooling purpose-built for product-lifecycle-management platforms. Windchill operators should hunt for the web shell and lock down exposed servers.
Sources: BleepingComputer · ↑ top
Latest developments: Government borrowing costs reached multi-decade highs on August 18 before Treasury yields cooled from their early peaks after fresh data pointed to weakness in the U.S. economy.
A global bond sell-off driven by inflation fears and the wave of debt financing AI data-center construction pushed long-dated government yields to their highest levels in decades, dragging the Nasdaq Composite lower as investors weighed heavy fiscal spending.
Sources: FT World · WSJ Markets · WSJ Markets · ↑ top
Latest developments: Trump said on August 18 that no U.S.-Iran talks are occurring or scheduled and that the Strait of Hormuz stays open, pushing oil futures higher on limited traffic through the waterway.
President Trump's naval blockade of Iranian ports has squeezed Iran's economy more than the earlier 40-day war did, and his refusal to schedule negotiations kept crude oil futures climbing as tankers moved sparingly through the Strait of Hormuz.
Sources: WSJ US Business · WSJ World News · ↑ top
This Afternoon: Sunny, high 81F.
Tonight: Mostly Clear, low 63F.
Wednesday: Mostly Sunny then Chance Showers And Thunderstorms, high 81F.
Latest developments: Governor Josh Shapiro announced August 18 that Wisconsin's Brunk Industries will invest $31.7 million in a new facility in Freeport.
Brunk Industries, a Wisconsin contract manufacturer, will spend $31.7 million to open a plant in Freeport, Armstrong County, an expansion Pennsylvania Governor Josh Shapiro publicized.
Latest developments: The Community College of Allegheny County opened its fall semester August 18 with an enrollment increase as it marks its 60th anniversary.
The Community College of Allegheny County welcomed students back for the fall term on August 18, reporting higher enrollment as it celebrates 60 years of operation.
Latest developments: North Allegheny School District began the 2026-2027 school year August 18 under a new superintendent, with renovation projects set to start in early 2027.
The North Allegheny School District, one of the region's largest, welcomed students back August 18 under a new superintendent and outlined building renovations that begin in early 2027.
Latest developments: Elizabeth Township officials postponed a decision on a gas well permit until September, PublicSource reported August 18.
Elizabeth Township in Allegheny County pushed its decision on a natural-gas well permit to September, as resident Kathy Anderson and others warned that drilling could deter new residents, housing, and development.
Sources: PublicSource · ↑ top
Latest developments: West Deer Township officials successfully challenged an election petition August 18, keeping a voting-at-large referendum off the November ballot.
West Deer Township officials defeated a petition that sought to eliminate the township's voting districts and put a voting-at-large question before voters in November.
Latest developments: In his August 18 chat, Post-Gazette's Gerry Dulac fielded questions on Mike McCarthy, Aaron Rodgers, and why cornerback Joey Porter Jr. remains without a contract extension.
Post-Gazette Steelers writer Gerry Dulac addressed the team's quarterback picture and the standing of third-year cornerback Joey Porter Jr., who still awaits a new deal even as teammates land extensions and camp closes.
Sources: Post-Gazette Steelers · ↑ top
Latest developments: Noah Hiles wrote August 18 that Carmen Mlodzinski's struggles as a starter against the Detroit Tigers should push the Pirates to move him back to the bullpen.
Post-Gazette columnist Noah Hiles argued the Pirates should return right-hander Carmen Mlodzinski to the bullpen after another poor start, calling it a lesson the team keeps having to relearn about his best fit.
Sources: Post-Gazette Pirates · ↑ top
Latest developments: Australia's Lani Pallister beat Katie Ledecky in the 800-meter freestyle at the Pan Pacific Championships on August 16, handing the American her first international loss in the event.
Katie Ledecky, the American distance-swimming great, lost the 800-meter freestyle in international competition for the first time when Australia's Lani Pallister edged her at the Pan Pacific Championships.
Sources: ESPN Olympics · ↑ top
S&P 500 7,761.30 ▲ +0.3% Dow 53,718.86 ▼ -0.6% Nasdaq 26,642.21 ▲ +0.5% WTI crude 82.92 ▲ +6.7% EUR/USD 1.1550 ▲ +0.1% GBP/USD 1.3511 ▲ +0.4% USD/JPY 159.28 ▲ +0.9%