================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Thursday, August 20, 2026 - 7:08 AM EDT ================================================================ Federal agencies detailed AI-assisted attacks on Siemens industrial controllers the same day Cisco Talos exposed a Chinese crew wiring agentic AI into its post-compromise operations, marking AI's arrival across the full attack lifecycle. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Attackers are weaving AI through every stage of intrusion, from scripts aimed at Siemens controllers to the agentic tooling UAT-10147 now pairs with its new SPECTRE implant. see: AI-Assisted Attacks on Siemens S7 PLCs; UAT-10147 Deploys SPECTRE Implant * [TREND] Defenders keep losing the disclosure-to-exploit race as Zimbra, GitLab, and Elementor Pro flaws all drew active attacks within days of their fixes. see: Critical Flaws Exploited Soon After Disclosure * [TREND] Identity is the soft way in, with Huntress logging a 155-fold surge in password-spraying that fired over 81 million login attempts by abusing legacy authentication. see: Password Spraying Surges 155-Fold * [UPDATE (new)] Cl0p expanded its PTC Windchill extortion list past 40 victims, adding Fiserv, Zebra, and Largan Precision to earlier-named Shell and Philips. see: Cl0p Names 40-Plus Windchill Victims * [UPDATE (new)] OpenAI paused reinforcement-learning training and added sandboxing and 30-minute alerting after the Hugging Face incident and its Astra model's advanced cyber capabilities. see: OpenAI Overhauls Model Security * [UPDATE (new)] Hempfield Area School District will become the first to launch an AI-driven weapon detection system next month, built with a Carnegie Mellon scientist. see: Hempfield to Deploy AI Weapon Detection SECURITY ---------------------------------------------------------------- 1. AI-ASSISTED ATTACKS ON SIEMENS S7 PLCS Critical Infrastructure Security · [critical-infrastructure, ics, ai] Latest developments: CISA, the NSA, FBI, Department of Energy, and Environmental Protection Agency published joint advisory AA26-231A, laying out top mitigations and warning that the targeting reaches past Siemens to every internet-exposed programmable logic controller. Threat actors use AI-generated scripts to exploit known flaws in internet-facing Siemens S7 Series programmable logic controllers that run pumps, valves, and machinery across water, energy, and manufacturing sites. Operators should inventory S7 devices, pull them off the public internet, and apply the advisory's mitigations. - CISA Advisories: https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-231a - The Record: https://therecord.media/nsa-fbi-warns-of-hackers-using-ai-generated-tools-critical-infrastructure - Help Net Security: https://www.helpnetsecurity.com/2026/08/20/usa-ai-attacks-siemens-s7-plcs-critical-infrastructure/ - SecurityWeek: https://www.securityweek.com/hackers-using-ai-to-target-siemens-plcs-in-critical-us-sectors/ 2. CRITICAL FLAWS EXPLOITED SOON AFTER DISCLOSURE Vulnerabilities and Exploits · [patch, exploit, vulnerability] Latest developments: CERT Polska caught attackers exploiting a critical Zimbra Collaboration remote-code-execution flaw, GitLab's unauthenticated CVE-2026-19478 fell under attack days after its fix, the Elementor Pro plugin's CVE-2026-32475 opened WordPress sites to unauthenticated code execution, and Citrix warned that its patched NetScaler authentication bypass invites imminent exploitation. A run of high-severity flaws across Zimbra, GitLab, Citrix NetScaler, and Elementor Pro drew attacks within days of disclosure, and Rapid7 counted 8,539 high- and critical-severity disclosures in the second quarter, double the prior year. Administrators should patch these products now. - BleepingComputer: https://www.bleepingcomputer.com/news/security/critical-zimbra-rce-flaw-now-actively-exploited-in-attacks/ - SecurityWeek: https://www.securityweek.com/critical-gitlab-flaw-exploited-shortly-after-disclosure/ - SecurityWeek: https://www.securityweek.com/exploitation-expected-for-critical-authentication-bypass-patched-in-citrix-netscaler/ - The Hacker News: https://thehackernews.com/2026/08/elementor-pro-flaw-could-let.html 3. OPENAI OVERHAULS MODEL SECURITY AI Security · [ai, policy] Latest developments: OpenAI paused reinforcement-learning training for two weeks and added sandboxing, 30-minute alerting, and wider monitoring after the Hugging Face incident and its Astra model's advanced cyber capabilities, and previewed Private Safety Processing to spot misuse without staff reading user content, even as a separate outage blocked ChatGPT logins and signups on August 20. OpenAI is tightening controls on frontier models—sandboxed training, rapid alerts, paused runs—to prevent a repeat of the Hugging Face compromise and to contain the Astra model. Its Private Safety Processing preview aims to flag abuse while restricting employee access to the underlying data. - SecurityWeek: https://www.securityweek.com/openai-overhauls-model-security-with-sandboxing-30-minute-alerts-and-training-pauses/ - The Hacker News: https://thehackernews.com/2026/08/openai-pauses-frontier-rl-training-as.html - Help Net Security: https://www.helpnetsecurity.com/2026/08/20/openai-private-safety-processing-zdr/ - BleepingComputer: https://www.bleepingcomputer.com/news/artificial-intelligence/openai-confirms-chatgpt-is-down-as-logins-and-signups-fail/ 4. UAT-10147 DEPLOYS SPECTRE IMPLANT Ransomware and Cybercrime · [malware, apt, ai] Latest developments: Cisco Talos exposed UAT-10147, a Chinese-speaking cybercrime group that spreads a new cross-platform implant named SPECTRE—carrying a Linux rootkit, bring-your-own-vulnerable-driver EDR bypass, and credential theft—and threads agentic AI into its post-compromise work against vulnerable web servers. UAT-10147 compromises exposed web servers, plants the BadIIS module, and runs SPECTRE for process injection, credential theft, and kernel-level evasion across Windows and Linux. Talos ties the crew to agentic-AI-driven post-exploitation, a first for commodity intrusion tooling. - Cisco Talos: https://blog.talosintelligence.com/uat-10147-deploys-spectre-a-cross-platform-implant-with-linux-rootkit-and-byovd-capabilities/ - Cisco Talos: https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/ 5. PASSWORD SPRAYING SURGES 155-FOLD Identity Security · [identity, mfa, phishing] Latest developments: Huntress logged a 155-fold jump in password-spraying attacks in the first half of 2026, including one campaign that fired more than 81 million login attempts in two weeks by abusing legacy authentication and multifactor gaps. Attackers are hammering login flows that still permit legacy authentication or leave some paths outside multifactor coverage. Unit 42 separately warned that intruders abuse trusted collaboration tools for identity phishing and credential theft. Enterprises should kill legacy auth and enforce MFA on every path. - BleepingComputer: https://www.bleepingcomputer.com/news/security/password-spraying-attacks-surge-155x-as-hackers-exploit-mfa-gaps/ - Unit 42 (Palo Alto): https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ 6. CL0P NAMES 40-PLUS WINDCHILL VICTIMS Ransomware and Cybercrime · [ransomware, breach, extortion] Latest developments: Cl0p listed more than 40 victims of its PTC Windchill data-theft campaign, adding Fiserv, Zebra, Mindray, and Largan Precision to the earlier-named Shell and Philips. The Cl0p ransomware gang exploited a flaw in PTC Windchill product-lifecycle-management software to steal data from dozens of large manufacturers and financial firms, then posted them on its leak site. Windchill operators should patch and hunt for intrusion. - SecurityWeek: https://www.securityweek.com/cl0p-ransomware-group-names-over-40-victims-of-ptc-windchill-campaign/ BUSINESS AND POLITICS ---------------------------------------------------------------- * Trump Launches Economic Campaign to Crush Iran Latest developments: Trump announced August 20 a new drive to isolate and crush Iran's economy, threatening what he called an "economic D-Day," while the United Arab Emirates suspended its commercial ties with Tehran. President Trump vowed to strangle Iran's economy as the Strait of Hormuz standoff hardened; the UAE, long Tehran's crucial trading hub, cut off commercial ties, and oil climbed a fifth straight day with Brent near $93 a barrel. - FT World: https://www.ft.com/content/785aafd1-705a-47da-b016-032d66e449c0?syn-25a6b1a6=1 - WSJ Markets: https://www.wsj.com/risk-compliance-journal/the-morning-risk-report-trump-threatens-iran-with-economic-d-day-933ca34a?mod=rss_markets_main - WSJ Markets: https://www.wsj.com/finance/commodities-futures/oil-edges-higher-amid-lingering-middle-east-tensions-77c883a9?mod=rss_markets_main * U.S. Debt Tops $40 Trillion as Bessent Steadies Bonds Latest developments: Federal debt crossed $40 trillion as Treasury Secretary Scott Bessent's buyback push lifted bond prices a second day, though analysts warned the relief may prove short-lived. United States government debt reached $40 trillion; Bessent's move to ramp up buybacks of longer-dated Treasurys lifted bonds and stocks and held the dollar near its lows, even as two new studies found investors growing less willing to accept low yields for Treasurys' safety. - WSJ Markets: https://www.wsj.com/world/u-s-debt-soars-and-scott-bessent-steps-in-as-americas-bond-trader-in-chief-41f04971?mod=rss_markets_main - WSJ Markets: https://www.wsj.com/business/bonds-strengthen-further-dollar-holds-near-lows-after-treasury-intervention-2692dd07?mod=rss_markets_main - WSJ Markets: https://www.wsj.com/finance/investing/the-treasury-markets-coveted-status-as-a-safe-haven-is-fading-c68fed93?mod=rss_markets_main PITTSBURGH ---------------------------------------------------------------- Weather: Today: Showers And Thunderstorms, high 77F. Tonight: Slight Chance Rain Showers then Partly Cloudy, low 62F. Friday: Mostly Sunny then Slight Chance Showers And Thunderstorms, high 81F. Business: * Skill Games Face October Deadline Latest developments: Veteran clubs and businesses rallied in Springdale and Brackenridge on August 19, pressing Harrisburg to legalize and tax skill games before the Pennsylvania Supreme Court's October 13 ban takes effect. The Pennsylvania Supreme Court ruled the roughly 70,000 skill-game machines in taverns, social clubs, and corner stores illegal as of October 13; the Brackenridge American Legion and other veteran groups want state legislators to legalize and tax them first. The machines' spread traces to a single arranged seizure at a Beaver County social club. - KDKA: https://www.cbsnews.com/pittsburgh/news/veteran-clubs-businesses-support-skill-games-pennsylvania/ - TribLive: https://triblive.com/news/pennsylvania/70000-pa-skill-games-trace-roots-to-this-one-controlled-buy/ - WPXI: https://www.wpxi.com/news/local/dozens-rally-favor-skill-games-pennsylvania-after-supreme-court-ruling/JR3QYQYWINDDLEYPVEIPQTCKQI/ * Hempfield to Deploy AI Weapon Detection Latest developments: The Hempfield Area School District will become the first district to launch an AI-driven weapon detection system next month, one built with help from a Carnegie Mellon University scientist. Hempfield Area, in Westmoreland County, plans to roll out the novel AI weapon-detection technology in September, developed with a Carnegie Mellon University researcher, in what officials call the future of school safety. - TribLive: https://triblive.com/local/westmoreland/the-future-of-school-safety-hempfield-area-to-launch-novel-weapon-detection-system-next-month/ Around town: * Sewickley Backs Herbst House Preservation Latest developments: Sewickley council voted August 19 to preserve the Herbst House, again ruling the former Catholic convent and school structurally salvageable. Sewickley officials said the Herbst House—a former Catholic convent and school in the Allegheny County borough—can be saved, and the council voted in favor of preserving it. - TribLive: https://triblive.com/local/sewickley/sewickley-council-votes-in-favor-of-herbst-house-preservation/ * PennDOT Closes Layton Bridge for New Span Latest developments: PennDOT closed the Layton Bridge on August 18 to set beams for its replacement span. PennDOT shut the Layton Bridge, which carries Route 4038 over the Youghiogheny River in Perry, Fayette County, while crews set beams for the new span. - TribLive: https://triblive.com/local/regional/penndot-closes-layton-bridge-while-beams-are-set-for-new-span-over-yough-river/ Events: * Weekend Guide: Josh Turner in Concert Latest developments: The Post-Gazette's August 20 weekend guide highlights a Josh Turner concert and a vintage "base ball" game among Pittsburgh-area things to do. Country singer Josh Turner performs this weekend and a vintage "base ball" game is on the calendar, among the outings the Post-Gazette's roundup lists in and around Pittsburgh. - Pittsburgh Post-Gazette: https://www.post-gazette.com/life/recreation/2026/08/20/things-to-do-this-weekend-pittsburgh-9/stories/202608200005 * City Paper's Week Ahead, Aug. 20-26 Latest developments: Pittsburgh City Paper published its top events for Thursday, August 20 through Wednesday, August 26. Pittsburgh City Paper's week-ahead guide flags a packed punk music festival, a neighborhood cat tour, and a honky-tonk block party among the city's top events from August 20 to 26. - Pittsburgh City Paper: https://www.pghcitypaper.com/listings/this-weeks-top-events/pittsburghs-top-events-thu-aug-20-wed-aug-26/ SPORTS ---------------------------------------------------------------- Around the Teams: * Rudolph Praises Steelers' Young QBs Latest developments: Quarterback Mason Rudolph said he is "jealous" of young passers Drew Allar and Will Howard and praised head coach Mike McCarthy, as Ray Fittipaldo published his first 53-man roster projection. On TribLive's "First Call," Steelers quarterback Mason Rudolph lauded Mike McCarthy and the young quarterbacks behind him, Drew Allar and Will Howard, who take center stage in Friday's preseason game against the New York Jets; Post-Gazette writer Ray Fittipaldo mapped his opening 53-man roster. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/08/19/53man-roster-projection-nfl-preseason-kaleb-allar-howard/stories/202608190004 - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/08/19/nfl-news-allar-howard-rudolph-rodgers-mccarthy-preseason/stories/202608190034 * Heyward's Podcast Launches Camp Series Latest developments: Cam Heyward's "Not Just Football" podcast began a training-camp series August 19, opening with teammates DeShon Elliott and Patrick Queen. Steelers defensive lineman Cam Heyward and co-host Hayden started a Not Just Football training-camp series posting Monday, Wednesday, and Friday; the first episode featured safety DeShon Elliott and linebacker Patrick Queen, who riffed on building their ideal Steelers defender. - Not Just Football with Cam Heyward: https://www.youtube.com/watch?v=ZQGSMsozME4 - Not Just Football with Cam Heyward: https://www.youtube.com/shorts/07JvKlLK6jY Team USA: * Pulisic Back in Milan Training Latest developments: Christian Pulisic returned to AC Milan training August 18, his first session since the injury that helped end the United States' World Cup run in the round of 16. United States star Christian Pulisic rejoined AC Milan for training after recovering from the injury he suffered as the U.S. exited the 2026 World Cup in the round of 16. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49660572/christian-pulisic-injury-milan-training-usa-world-cup-injury READING ---------------------------------------------------------------- * Stratechery -- Apple Settles With E.U., U.S. App Store Fees, ATT Rules in Germany Argues Apple's App Store is finally accepting the reality of lower fees, and that the European Union should count the outcome a win even though it arrived late. https://stratechery.com/2026/apple-settles-with-e-u-u-s-app-store-fees-att-rules-in-germany/ * Ed Zitron -- What Happens If OpenAI Dies? Contends OpenAI sits on shaky financial ground and games out the fallout for the AI industry, its investors, and the data-center buildout should the company collapse. https://www.wheresyoured.at/what-happens-if-openai-dies/ * Cal Newport -- On AI Coding and Its Discontents Uses a converted AI-skeptic engineer's account to weigh how much AI coding tools genuinely reshape the daily work of software development. https://calnewport.com/on-ai-coding-and-its-discontents/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,745.91 ▲ +0.1% Dow 53,567.73 ▼ -0.6% Nasdaq 26,559.58 ▲ +0.1% WTI crude 83.78 ▲ +3.7% EUR/USD 1.1562 ▲ +0.2% GBP/USD 1.3528 ▲ +0.4% USD/JPY 159.37 ▲ +0.6% ================================================================ Generated 2026-08-20 07:08 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================