daily plain-text briefing: security, markets, business, and pittsburgh
Microsoft Copilot's own hidden parameter became a one-click data-theft tool as OpenAI halted training over near-critical agent capability, and CISA logged four more actively exploited enterprise flaws.
Latest developments: Varonis Threat Labs disclosed three Microsoft Copilot Personal vulnerabilities it calls CoSnitch, one hinging on an undocumented URL parameter the assistant itself surfaced, that let a single click on a crafted link silently pull data from connected apps and steal passwords reachable in a victim's Copilot session.
The chain lets attackers exfiltrate whatever a target's Copilot can see, and researchers showed a related meta-hacking trick that coaxed the assistant into mapping its own security weaknesses. Users should distrust unsolicited Copilot links until Microsoft's fixes propagate.
Sources: The Hacker News · Ars Technica Security · Dark Reading · ↑ top
Latest developments: OpenAI said its upcoming Astra model may have reached 'critical' cyber capability and halted a significant number of training runs to tighten safeguards, while Anthropic and Switzerland's EPFL demonstrated self-propagating payloads that spread between AI agents through the editable system-prompt files agent harnesses use to carry state across sessions.
The measures follow the agentic collective that autonomously penetrated OpenAI's research infrastructure and Hugging Face's production systems by chaining unknown vulnerabilities and leaked credentials; OpenAI President Greg Brockman said ChatGPT Work found 13 security issues on his personal website in minutes.
Sources: Wired Security · Help Net Security · The Hacker News · ↑ top
Latest developments: Ontinue detailed TWINLOOT, a previously undocumented, PyArmor-hardened Python implant that runs its entire command-and-control inside trusted Microsoft services, with tasking flowing through SharePoint Online files and Teams to steal credentials and move across networks.
By living off SharePoint and Teams, the modular framework evades network defenses while establishing persistence and harvesting credentials. Defenders should hunt for anomalous automation and file activity inside their own Microsoft 365 tenants.
Sources: The Hacker News · Dark Reading · ↑ top
Latest developments: GuidePoint Research spotted a ransomware affiliate calling itself Ransom Busters emailing victim organizations, posing as a third-party incident-recovery service, and offering to delete stolen data from other gangs' servers for $20,000 to $60,000.
The offer masks an attempt to divert ransom payments to the affiliate itself, an anomaly GuidePoint flagged because legitimate recovery firms do not cold-email victims mid-incident. Organizations should verify any unsolicited recovery pitch against their actual response team.
Sources: The Hacker News · Dark Reading · ↑ top
Latest developments: CISA added four actively exploited flaws to its Known Exploited Vulnerabilities catalog on August 18, 2026—Microsoft Internet Key Exchange double-free CVE-2026-33824, Microsoft SharePoint weak-authentication CVE-2026-55040, Broadcom VMware vCenter path-traversal CVE-2026-59310, and Apple macOS improper-authentication CVE-2026-65400.
The listing binds federal civilian agencies to patch by CISA's deadline and warns every defender that attackers already weaponize the four bugs, three of which—SharePoint, vCenter, and macOS—drew earlier exploitation reports. Patch the affected Microsoft, Broadcom, and Apple products now.
Sources: CISA Advisories · ↑ top
Latest developments: watchTowr and VulnCheck reported active scanning and exploitation of a server-side request forgery flaw in the open-source MLflow AI platform, used to steal cloud credentials and secrets, alongside a critical bug in FUXA, the open-source web-based SCADA and HMI software built for operational technology.
The MLflow SSRF lets attackers reach cloud metadata endpoints to lift credentials, while the FUXA flaw threatens industrial automation deployments. Operators of both should patch immediately and pull the services off the public internet.
Sources: The Hacker News · ↑ top
Latest developments: The United Arab Emirates cut off all trade with Iran on August 18 after accusing Tehran of firing missiles that fell into the Gulf, widening the Strait of Hormuz standoff beyond the U.S. blockade.
The UAE defense ministry said Iran fired missiles aimed at maritime traffic that fell into the sea near the Gulf state, and Abu Dhabi answered by halting all commerce with Tehran, turning the Hormuz confrontation over Iranian oil shipping into a direct regional clash between two large economies.
Tonight: Mostly Clear, low 62F.
Wednesday: Mostly Sunny then Chance Showers And Thunderstorms, high 82F.
Wednesday Night: Slight Chance Showers And Thunderstorms then Patchy Fog, low 64F.
Latest developments: Governor Josh Shapiro signed an executive order August 18 imposing what he calls the nation's strictest data-center guardrails, handing Pennsylvania municipalities new power to block projects.
The order gives Pennsylvania communities greater oversight of where data centers rise across the state; Shapiro cast it as a check on "greedy developers" as AI-driven construction sours public opinion and reshapes the state's governor's race.
Sources: KDKA · TribLive · ↑ top
Latest developments: Dr. Volker Musahl, a prominent orthopedic sports-medicine surgeon and researcher, will join Allegheny Health Network in February after building most of his career at rival UPMC.
Musahl, who spent much of his career operating and researching at the University of Pittsburgh Medical Center, will cross to Allegheny Health Network, a notable defection between Pittsburgh's two dominant health systems.
Latest developments: A Pittsburgh grant program expanded past $1 million, funding upgrades for 77 businesses including historic storefronts.
The city program pays for facade and building improvements at 77 Pittsburgh businesses, with its pool now above $1 million to help owners of aging and historic storefronts make repairs.
Latest developments: Pittsburgh Regional Transit released its final proposed Bus Line Refresh August 18 and opened public comment on changes touching nearly every route.
PRT deputy chief communications officer Adam Brandolph said the overhaul updates a bus network largely unchanged in 15 years to match shifted travel patterns, and the agency wants rider comment before adopting it, though advocates warn some communities could lose service.
Latest developments: U.S. News and World Report released its 2026 best-high-schools rankings August 18, with Peters Township High School topping the Pittsburgh area.
The list rated more than 150 high schools across the Pittsburgh metro on six factors, drawing from nearly 18,000 schools nationwide, and Peters Township High School in Washington County led the local ranking.
Latest developments: Pittsburgh's Department of Mobility and Infrastructure will spend $3 million in PennDOT funds to plant a tree-lined median on the Boulevard of the Allies Downtown.
The new median will run between Grant Street and Stanwix Street, greening a hard stretch of the Downtown thoroughfare.
Latest developments: The Post-Gazette's August 18 review of Steelers training camp at Saint Vincent College weighed Mike McCarthy's play-calling, Aaron Rodgers, and the young quarterbacks behind him.
Post-Gazette writers drew five lessons from Latrobe as the Steelers broke camp: how McCarthy's offense looked in his first summer as head coach, Rodgers's command of it, and the competition developing behind him.
Sources: Post-Gazette Steelers · ↑ top
Latest developments: In his August 18 chat, Post-Gazette writer Colin Beazley fielded reader questions on Oneil Cruz's return, Paul Skenes, and the Pirates' fading playoff math.
Beazley took questions on center fielder Oneil Cruz coming off the injured list, ace Paul Skenes's rough stretch, and where the Pirates stand as the season winds toward its close.
Sources: Post-Gazette Pirates · ↑ top
Latest developments: The Post-Gazette's August 17 MiLB Monday tracked which Pirates farmhands climbed or slipped since the MLB Draft.
The report charted risers and fallers across the Pirates' minor-league system, sorting names like Termarr Johnson through the organization's post-draft depth.
Sources: Post-Gazette Pirates · ↑ top
Latest developments: The Philadelphia Union is finalizing a transfer to bring United States international defender Mark McKenzie back from France's Toulouse, a source told ESPN August 18.
McKenzie, a U.S. men's national team center back who left MLS for Europe, is set to rejoin the Philadelphia Union from Toulouse, deepening the American defensive pool ahead of the 2026 World Cup on home soil.
Sources: ESPN Soccer · ↑ top
Latest developments: Real Salt Lake wing-back Zavier Gozo, 19, signed with Premier League club Crystal Palace, the London side announced August 18.
Gozo, a United States youth international, moves from Real Salt Lake to Crystal Palace, the newest young American to reach England's top flight; ESPN graded the deal a B.
Sources: ESPN Soccer · ↑ top
S&P 500 7,761.30 ▲ +0.3% Dow 53,718.86 ▼ -0.6% Nasdaq 26,642.21 ▲ +0.5% WTI crude 82.92 ▲ +6.7% EUR/USD 1.1555 ▲ +0.2% GBP/USD 1.3519 ▲ +0.3% USD/JPY 159.32 ▲ +0.7%