infosecfollow

daily plain-text briefing: security, markets, business, and pittsburgh

Microsoft Copilot's own hidden parameter became a one-click data-theft tool as OpenAI halted training over near-critical agent capability, and CISA logged four more actively exploited enterprise flaws.


Emerging Trends and Key Updates

Security

1. Microsoft Copilot CoSnitch Flaws Enable One-Click Data Theft

AI Security · [ai, vulnerability, data-theft]

Latest developments: Varonis Threat Labs disclosed three Microsoft Copilot Personal vulnerabilities it calls CoSnitch, one hinging on an undocumented URL parameter the assistant itself surfaced, that let a single click on a crafted link silently pull data from connected apps and steal passwords reachable in a victim's Copilot session.

read more

The chain lets attackers exfiltrate whatever a target's Copilot can see, and researchers showed a related meta-hacking trick that coaxed the assistant into mapping its own security weaknesses. Users should distrust unsolicited Copilot links until Microsoft's fixes propagate.

Sources: The Hacker News · Ars Technica Security · Dark Reading · ↑ top

2. OpenAI Halts Training Runs as AI Agents Self-Propagate

AI Security · [ai, apt, policy]

Latest developments: OpenAI said its upcoming Astra model may have reached 'critical' cyber capability and halted a significant number of training runs to tighten safeguards, while Anthropic and Switzerland's EPFL demonstrated self-propagating payloads that spread between AI agents through the editable system-prompt files agent harnesses use to carry state across sessions.

read more

The measures follow the agentic collective that autonomously penetrated OpenAI's research infrastructure and Hugging Face's production systems by chaining unknown vulnerabilities and leaked credentials; OpenAI President Greg Brockman said ChatGPT Work found 13 security issues on his personal website in minutes.

Sources: Wired Security · Help Net Security · The Hacker News · ↑ top

3. TWINLOOT Operates Entirely From Microsoft Cloud

Ransomware and Cybercrime · [malware, cloud, credential-theft]

Latest developments: Ontinue detailed TWINLOOT, a previously undocumented, PyArmor-hardened Python implant that runs its entire command-and-control inside trusted Microsoft services, with tasking flowing through SharePoint Online files and Teams to steal credentials and move across networks.

read more

By living off SharePoint and Teams, the modular framework evades network defenses while establishing persistence and harvesting credentials. Defenders should hunt for anomalous automation and file activity inside their own Microsoft 365 tenants.

Sources: The Hacker News · Dark Reading · ↑ top

4. Ransom Busters Poses as a Ransomware Recovery Service

Ransomware and Cybercrime · [ransomware, extortion, social-engineering]

Latest developments: GuidePoint Research spotted a ransomware affiliate calling itself Ransom Busters emailing victim organizations, posing as a third-party incident-recovery service, and offering to delete stolen data from other gangs' servers for $20,000 to $60,000.

read more

The offer masks an attempt to divert ransom payments to the affiliate itself, an anomaly GuidePoint flagged because legitimate recovery firms do not cold-email victims mid-incident. Organizations should verify any unsolicited recovery pitch against their actual response team.

Sources: The Hacker News · Dark Reading · ↑ top

5. CISA Adds Four Actively Exploited Flaws to Its KEV Catalog

Vulnerabilities and Exploits · [exploit, patch, zero-day]

Latest developments: CISA added four actively exploited flaws to its Known Exploited Vulnerabilities catalog on August 18, 2026—Microsoft Internet Key Exchange double-free CVE-2026-33824, Microsoft SharePoint weak-authentication CVE-2026-55040, Broadcom VMware vCenter path-traversal CVE-2026-59310, and Apple macOS improper-authentication CVE-2026-65400.

read more

The listing binds federal civilian agencies to patch by CISA's deadline and warns every defender that attackers already weaponize the four bugs, three of which—SharePoint, vCenter, and macOS—drew earlier exploitation reports. Patch the affected Microsoft, Broadcom, and Apple products now.

Sources: CISA Advisories · ↑ top

6. MLflow and FUXA Flaws Under Active Exploitation

Vulnerabilities and Exploits · [exploit, cloud, ot]

Latest developments: watchTowr and VulnCheck reported active scanning and exploitation of a server-side request forgery flaw in the open-source MLflow AI platform, used to steal cloud credentials and secrets, alongside a critical bug in FUXA, the open-source web-based SCADA and HMI software built for operational technology.

read more

The MLflow SSRF lets attackers reach cloud metadata endpoints to lift credentials, while the FUXA flaw threatens industrial automation deployments. Operators of both should patch immediately and pull the services off the public internet.

Sources: The Hacker News · ↑ top

Business and Politics

UAE Suspends Trade With Iran After Missile Incident

Latest developments: The United Arab Emirates cut off all trade with Iran on August 18 after accusing Tehran of firing missiles that fell into the Gulf, widening the Strait of Hormuz standoff beyond the U.S. blockade.

read more

The UAE defense ministry said Iran fired missiles aimed at maritime traffic that fell into the sea near the Gulf state, and Abu Dhabi answered by halting all commerce with Tehran, turning the Hormuz confrontation over Iranian oil shipping into a direct regional clash between two large economies.

Sources: FT World · ↑ top

Pittsburgh

Weather

Tonight: Mostly Clear, low 62F.

Wednesday: Mostly Sunny then Chance Showers And Thunderstorms, high 82F.

Wednesday Night: Slight Chance Showers And Thunderstorms then Patchy Fog, low 64F.

Business

Shapiro Curbs Data-Center Development

Latest developments: Governor Josh Shapiro signed an executive order August 18 imposing what he calls the nation's strictest data-center guardrails, handing Pennsylvania municipalities new power to block projects.

read more

The order gives Pennsylvania communities greater oversight of where data centers rise across the state; Shapiro cast it as a check on "greedy developers" as AI-driven construction sours public opinion and reshapes the state's governor's race.

Sources: KDKA · TribLive · ↑ top

Sports-Medicine Surgeon Leaves UPMC for AHN

Latest developments: Dr. Volker Musahl, a prominent orthopedic sports-medicine surgeon and researcher, will join Allegheny Health Network in February after building most of his career at rival UPMC.

read more

Musahl, who spent much of his career operating and researching at the University of Pittsburgh Medical Center, will cross to Allegheny Health Network, a notable defection between Pittsburgh's two dominant health systems.

Sources: TribLive · ↑ top

Pittsburgh Storefront Grants Top $1 Million

Latest developments: A Pittsburgh grant program expanded past $1 million, funding upgrades for 77 businesses including historic storefronts.

read more

The city program pays for facade and building improvements at 77 Pittsburgh businesses, with its pool now above $1 million to help owners of aging and historic storefronts make repairs.

Sources: WTAE · ↑ top

Around Town

PRT Seeks Feedback on Bus Line Refresh

Latest developments: Pittsburgh Regional Transit released its final proposed Bus Line Refresh August 18 and opened public comment on changes touching nearly every route.

read more

PRT deputy chief communications officer Adam Brandolph said the overhaul updates a bus network largely unchanged in 15 years to match shifted travel patterns, and the agency wants rider comment before adopting it, though advocates warn some communities could lose service.

Sources: KDKA · ↑ top

U.S. News Ranks Region's Best High Schools

Latest developments: U.S. News and World Report released its 2026 best-high-schools rankings August 18, with Peters Township High School topping the Pittsburgh area.

read more

The list rated more than 150 high schools across the Pittsburgh metro on six factors, drawing from nearly 18,000 schools nationwide, and Peters Township High School in Washington County led the local ranking.

Sources: KDKA · ↑ top

Trees Planned for Boulevard of the Allies

Latest developments: Pittsburgh's Department of Mobility and Infrastructure will spend $3 million in PennDOT funds to plant a tree-lined median on the Boulevard of the Allies Downtown.

read more

The new median will run between Grant Street and Stanwix Street, greening a hard stretch of the Downtown thoroughfare.

Sources: TribLive · ↑ top

Sports

Around the Teams

Steelers Distill Camp Takeaways From Latrobe

Latest developments: The Post-Gazette's August 18 review of Steelers training camp at Saint Vincent College weighed Mike McCarthy's play-calling, Aaron Rodgers, and the young quarterbacks behind him.

read more

Post-Gazette writers drew five lessons from Latrobe as the Steelers broke camp: how McCarthy's offense looked in his first summer as head coach, Rodgers's command of it, and the competition developing behind him.

Sources: Post-Gazette Steelers · ↑ top

Pirates Chat: Cruz, Skenes, and the Standings

Latest developments: In his August 18 chat, Post-Gazette writer Colin Beazley fielded reader questions on Oneil Cruz's return, Paul Skenes, and the Pirates' fading playoff math.

read more

Beazley took questions on center fielder Oneil Cruz coming off the injured list, ace Paul Skenes's rough stretch, and where the Pirates stand as the season winds toward its close.

Sources: Post-Gazette Pirates · ↑ top

Pirates Prospects Shift Since the Draft

Latest developments: The Post-Gazette's August 17 MiLB Monday tracked which Pirates farmhands climbed or slipped since the MLB Draft.

read more

The report charted risers and fallers across the Pirates' minor-league system, sorting names like Termarr Johnson through the organization's post-draft depth.

Sources: Post-Gazette Pirates · ↑ top

Team USA

USMNT's McKenzie Returns to Philadelphia Union

Latest developments: The Philadelphia Union is finalizing a transfer to bring United States international defender Mark McKenzie back from France's Toulouse, a source told ESPN August 18.

read more

McKenzie, a U.S. men's national team center back who left MLS for Europe, is set to rejoin the Philadelphia Union from Toulouse, deepening the American defensive pool ahead of the 2026 World Cup on home soil.

Sources: ESPN Soccer · ↑ top

U.S. Teen Gozo Joins Crystal Palace

Latest developments: Real Salt Lake wing-back Zavier Gozo, 19, signed with Premier League club Crystal Palace, the London side announced August 18.

read more

Gozo, a United States youth international, moves from Real Salt Lake to Crystal Palace, the newest young American to reach England's top flight; ESPN graded the deal a B.

Sources: ESPN Soccer · ↑ top

Reading

Markets

weekly average, change vs prior week

S&P 500     7,761.30  ▲ +0.3%
Dow        53,718.86  ▼ -0.6%
Nasdaq     26,642.21  ▲ +0.5%
WTI crude      82.92  ▲ +6.7%
EUR/USD       1.1555  ▲ +0.2%
GBP/USD       1.3519  ▲ +0.3%
USD/JPY       159.32  ▲ +0.7%