================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Thursday, August 20, 2026 - 7:36 PM EDT ================================================================ A build-time supply-chain attack on three widely used Rust crates leads a day of attackers subverting trusted software, from multiplying Android banking trojans to an encrypted prompt-injection flaw that leaks Grok chats. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] A hijacked maintainer account poisoned three Rust crates on crates.io with a build-script infostealer, the latest open-source registry attack running malware during compilation. see: Rust Supply-Chain Attack Poisons Crates * [TREND] Attackers are turning trusted platforms into leaks, with Adversa AI's injection making Grok spill user data and Russian clusters abusing Google OAuth and WhatsApp linking to hijack accounts. see: Cryptographic Context Injection Leaks Grok Chats; Russian Clusters Abuse OAuth and WhatsApp * [TREND] Android banking trojans are multiplying, with Manic relaying stolen data through nearby infected phones and ToxicPanda 2.0 harvesting PINs across more than 140 financial apps. see: Android Banking Trojans Multiply * [UPDATE (new)] CISA added TrueConf Server bugs CVE-2026-72529 and CVE-2026-72530 to its KEV catalog as researchers disclosed a critical Elementor Pro file-upload flaw. see: New Critical Flaws and KEV Additions * [UPDATE (new)] Pittsburgh saw its first measles case since 2019 confirmed at UPMC Children's Hospital, while DA Stephen Zappala said millions appear to be missing from the city's finances. see: Measles Reaches Allegheny County; DA Probes Missing Millions in Pittsburgh Finances * [UPDATE (new)] Treasury Secretary Bessent's buyback failed to halt a bond selloff, Allegheny County's pension fund faces a $1.4 billion gap, and PRT began its $58 million Panhandle Bridge rehab. see: Treasury Buyback Bid Fails to Halt Bond Selloff; Allegheny County Pension Fund Faces $1.4 Billion Gap; PRT Starts $58 Million Panhandle Bridge Rehab SECURITY ---------------------------------------------------------------- 1. NEW CRITICAL FLAWS AND KEV ADDITIONS Vulnerabilities and Exploits · [patch, exploited] Latest developments: CISA added TrueConf Server flaws CVE-2026-72529 and CVE-2026-72530 to its Known Exploited Vulnerabilities catalog on August 20, 2026, as researchers disclosed Elementor Pro's CVSS 9.0 file-upload bug CVE-2026-32475 and a CVSS 9.4 chain in NASA/JPL's AIT-GUI that lets unauthenticated attackers issue spacecraft commands, and Cisco patched critical Crosswork and Secure Workload holes. A fresh batch of critical flaws spans video conferencing, WordPress, spacecraft ground software, and Cisco management tools; prioritize the actively exploited TrueConf bugs and patch the RCE-capable Elementor Pro plugin. - CISA Advisories: https://www.cisa.gov/news-events/alerts/2026/08/20/cisa-adds-two-known-exploited-vulnerabilities-catalog - The Hacker News: https://thehackernews.com/2026/08/elementor-pro-flaw-could-let.html - The Hacker News: https://thehackernews.com/2026/08/nasa-ait-gui-flaws-could-let.html - SecurityWeek: https://www.securityweek.com/cisco-patches-critical-crosswork-secure-workload-vulnerabilities/ 2. ANDROID BANKING TROJANS MULTIPLY Ransomware and Cybercrime · [malware, android] Latest developments: Researchers detailed Manic, which targets Ukrainian banks and Russian and European financial institutions and falls back to relaying stolen data through nearby infected devices when a phone sits offline, while Zimperium zLabs documented ToxicPanda 2.0 wielding 167 remote commands and PIN harvesting across more than 140 banking and cryptocurrency apps. Android banking malware is proliferating—Manic, ToxicPanda 2.0, GoldDigger, and a revived Grandoreiro campaign in Mexico—adding on-device fraud and novel exfiltration; users should install apps only from official stores and scrutinize accessibility-permission requests. - The Hacker News: https://thehackernews.com/2026/08/manic-android-malware-exfiltrates-data.html - The Hacker News: https://thehackernews.com/2026/08/toxicpanda-20-and-golddigger-expand.html - BleepingComputer: https://www.bleepingcomputer.com/news/security/new-manic-android-malware-can-exfiltrate-data-through-nearby-devices/ - Dark Reading: https://www.darkreading.com/cyberattacks-data-breaches/grandoreiro-resurfaces-mexico-campaign 3. RUST SUPPLY-CHAIN ATTACK POISONS CRATES Vulnerabilities and Exploits · [supply-chain, malware] Latest developments: The Rust Project deleted arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9 from crates.io on August 20, 2026 after a hijacked maintainer account slipped in a typosquatted dependency whose build script fetched and ran an infostealer during compilation. The three crates together draw 245 million downloads, so the malware executed on developers' machines at build time across the Rust ecosystem; teams should audit recent builds and pin known-good versions. - The Hacker News: https://thehackernews.com/2026/08/rust-supply-chain-attack-puts-build.html - BleepingComputer: https://www.bleepingcomputer.com/news/security/hackers-poison-arrayref-rust-crate-to-push-infostealer-malware/ 4. CRYPTOGRAPHIC CONTEXT INJECTION LEAKS GROK CHATS AI Security · [ai, data-theft] Latest developments: Adversa AI disclosed Cryptographic Context Injection, which hides encrypted malicious instructions inside a web page so that when a user asks Grok to summarize it, xAI's chatbot ships the person's name, approximate location, subscription tier, and conversation prompts to an attacker-controlled server. Encoding the payload defeats Grok's safety guardrails and exposes user data through an ordinary summarize request; treat AI assistants that browse untrusted pages as an exfiltration channel. - The Hacker News: https://thehackernews.com/2026/08/new-cryptographic-context-injection.html - Ars Technica Security: https://arstechnica.com/security/2026/08/grok-exfiltrates-user-data-when-malicious-instructions-are-encrypted/ 5. POLICE HIDE FLOCK CAMERA SURVEILLANCE Policy and Regulation · [policy, surveillance] Latest developments: A leaked Wapello County, Iowa policy instructs officers never to mention automated license plate reader use to drivers or in reports, exposing how police conceal Flock camera surveillance, while a satirical 'Darth Vader' speaker mocked the technology at a San Diego city council meeting. Flock's license plate readers spread across US jurisdictions with little public disclosure, raising accountability and privacy concerns; the secrecy policy shows departments hiding the tool from the people they surveil and from courts. - Schneier on Security: https://www.schneier.com/blog/archives/2026/08/police-are-hiding-their-use-of-flock-surveillance-cameras.html - 404 Media: https://www.404media.co/darth-vader-spoke-in-support-of-flock-at-san-diego-city-council-meeting/ 6. RUSSIAN CLUSTERS ABUSE OAUTH AND WHATSAPP Nation-State Activity · [apt, espionage] Latest developments: Investigators tied three suspected Russian espionage clusters—UNC6293, UNC7005, and UNC5976—to abuse of Google OAuth flows and WhatsApp device linking to hijack accounts of academics, aerospace and defense workers, government staff, and think-tank researchers across Europe and the United States. The actors ride legitimate authentication flows, so multifactor prompts and OAuth consent screens become the attack surface; scrutinize unexpected device-linking and app-authorization requests. - The Hacker News: https://thehackernews.com/2026/08/suspected-russian-hackers-abuse-google.html BUSINESS AND POLITICS ---------------------------------------------------------------- * Treasury Buyback Bid Fails to Halt Bond Selloff Latest developments: A second straight day of falling stocks and rising long-bond yields on August 20 showed investors had brushed off Treasury Secretary Scott Bessent's buyback pledge as too small, and the turmoil rattled quantitative and momentum funds already unsettled by the AI-stock selloff. The Treasury Department, under Secretary Scott Bessent, promised August 19 to at least double its buybacks of long-dated bonds to arrest a selloff that had driven 30-year yields to their highest since 2001; on August 20 those yields climbed again and the S&P 500 fell as investors judged the purchases too small to matter. - FT Markets: https://www.ft.com/content/0c01cdd9-93e8-469c-8f09-a6d68c91fbc3?syn-25a6b1a6=1 - WSJ Markets: https://www.wsj.com/finance/stocks/u-s-stocks-and-bonds-slide-brushing-off-treasurys-buyback-plans-57ced23b?mod=rss_markets_main - FT Markets: https://www.ft.com/content/150aa8bf-54d1-448f-bdc9-14152ce3d76c PITTSBURGH ---------------------------------------------------------------- Weather: Tonight: Slight Chance Rain Showers then Patchy Fog, low 60F. Friday: Patchy Fog then Sunny, high 81F. Friday Night: Mostly Clear then Patchy Fog, low 63F. Business: * Allegheny County Pension Fund Faces $1.4 Billion Gap Latest developments: County Executive Sara Innamorato said August 20 her administration will stop deferring the shortfall, telling the retirement board it must find roughly $100 million to keep the fund from running dry. Allegheny County's employee pension fund carries a $1.4 billion shortfall that will drain it without large cash infusions, and the county's retirement board, whose members say they inherited the problem, is weighing how to raise the roughly $100 million the fund needs. - KDKA: https://www.cbsnews.com/pittsburgh/news/allegheny-county-pension-update/ * PRT Starts $58 Million Panhandle Bridge Rehab Latest developments: Pittsburgh Regional Transit began preparatory work August 20 on the century-old Panhandle Bridge ahead of a nearly three-year, $58 million rehabilitation. The Panhandle Bridge carries light-rail trains over the Monongahela River between Station Square and First Avenue Downtown; Pittsburgh Regional Transit will spend $58 million over nearly three years rebuilding the more-than-hundred-year-old span. - TribLive: https://triblive.com/local/pittsburgh-historic-transit-bridge-set-for-nearly-3-years-worth-of-repairs/ - WPXI: https://www.wpxi.com/news/local/pittsburgh-regional-transit-begins-prep-work-panhandle-bridge-58m-rehab-project/Y5JDT4MPCJB57P5WFLTGBZC66U/ Around town: * Measles Reaches Allegheny County Latest developments: UPMC confirmed August 20 that an unvaccinated patient tested positive for measles at UPMC Children's Hospital of Pittsburgh, the county's first case since 2019. An unvaccinated patient who visited the UPMC Children's Hospital of Pittsburgh emergency department on August 12 tested positive for measles, the first case in Allegheny County since 2019; UPMC and the Allegheny County Health Department said they have notified everyone who may have been exposed and see no ongoing risk at the hospital. - KDKA: https://www.cbsnews.com/pittsburgh/news/pittsburgh-allegheny-county-measles-upmc-childrens-hospital/ - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/health/2026/08/20/measles-allegheny-county/stories/202608200066 * DA Probes Missing Millions in Pittsburgh Finances Latest developments: Allegheny County District Attorney Stephen Zappala said August 20 that an investigation into the city of Pittsburgh's finances, advanced by a search warrant, indicates millions of dollars appear to be missing. Allegheny County District Attorney Stephen Zappala disclosed an investigation into the city of Pittsburgh's finances in which, he said, millions of dollars appear to be missing, a probe backed by a search warrant. - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/politics-local/2026/08/20/pittsburgh-finances-search-warrant/stories/202608200062 * Study Confirms Chemical Exposure in East Palestine Latest developments: Researchers reported that 74% of urine samples collected after the February 2023 Norfolk Southern derailment in East Palestine, Ohio, showed vinyl chloride exposure. More than three years after a Norfolk Southern train derailed and burned in East Palestine, Ohio, just across the Pennsylvania line, researchers found vinyl chloride exposure in 74% of urine samples taken from area residents, early evidence of the health toll from chemicals released into the air, water, and soil. - KDKA: https://www.cbsnews.com/pittsburgh/news/east-palestine-train-derailment-urine-samples/ Events: * Bernard Purdie at Pittsburgh International Jazz Festival Latest developments: The Post-Gazette previewed drummer Bernard Purdie's coming appearance at the Pittsburgh International Jazz Festival. The drummer Bernard Purdie, known for a signature groove behind decades of soul and R&B records, will play the Pittsburgh International Jazz Festival. - Post-Gazette Music: https://www.post-gazette.com/ae/music/2026/08/20/bernard-purdie-drummer-pittsburgh-international-jazz-festival/stories/202608040031 * BurnBabyBurn at the August Wilson House Latest developments: The Post-Gazette profiled playwright A.K. Payne ahead of the Pittsburgh Playwrights staging of her play BurnBabyBurn. Pittsburgh playwright A.K. Payne's BurnBabyBurn, a work in which she searches for a grandmother she never knew, is staged by Pittsburgh Playwrights at the August Wilson House in the Hill District. - Post-Gazette Arts & Entertainment: https://www.post-gazette.com/ae/theater-dance/2026/08/20/burnbabyburn-a-k-payne-pittsburgh-playwrights-august-wilson-house/stories/202608200011 * Mary Lou Williams Puppet Show for Kids Latest developments: The Post-Gazette highlighted a puppet show introducing children to Pittsburgh jazz great Mary Lou Williams. A puppet show, "Jazz Heart," teaches children about Mary Lou Williams, the Pittsburgh-raised pianist and composer known as the "Queen of Jazz." - Post-Gazette Music: https://www.post-gazette.com/life/goodness/2026/08/19/mary-lou-williams-jazz-heart-puppet-show-pittsburgh/stories/202608180006 SPORTS ---------------------------------------------------------------- Around the Teams: * Steelers' Interior Line Central to Graham's Defense Latest developments: A Post-Gazette breakdown August 20 detailed why coordinator Patrick Graham's scheme hinges on Keeanu Benton, Derrick Harmon, and Cam Heyward controlling the line of scrimmage. The Post-Gazette reported that defensive coordinator Patrick Graham's plan leans on the Steelers' interior linemen—Keeanu Benton, Derrick Harmon, and Cam Heyward—calling their play up front critical to what the defense wants to do. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/08/20/graham-keeanu-benton-derrick-harmon-heyward-dline-defense/stories/202608200027 * Pirates' Hassell Works to Rebuild His Career Latest developments: The Post-Gazette profiled outfielder Robert Hassell III's effort to revive his career with the Pirates. Robert Hassell III, once a top prospect the San Diego Padres sent to Washington in the 2022 Juan Soto trade, is trying to rebuild his career with the Pittsburgh Pirates, the Post-Gazette reported. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/08/20/hassell-soto-trade-prospect-career/stories/202608200013 Team USA: * Aaronson Signs New Leeds Contract Latest developments: Leeds United announced August 20 that United States attacker Brenden Aaronson signed a new three-year contract. United States men's national team attacker Brenden Aaronson agreed to a three-year deal keeping him at Premier League club Leeds United, the team said August 20. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49673737/usmnt-aaronson-new-3-year-deal-leeds-united READING ---------------------------------------------------------------- * Stratechery -- Apple Settles With E.U., U.S. App Store Fees, ATT Rules in Germany Ben Thompson argues Apple's App Store is finally accepting lower fees under E.U. and U.S. pressure, and that the E.U. should count the belated changes as a win for its regulatory work. https://stratechery.com/2026/apple-settles-with-e-u-u-s-app-store-fees-att-rules-in-germany/ * Ed Zitron -- What Happens If OpenAI Dies? Ed Zitron games out the fallout for the AI industry, its data-center commitments, and its backers if OpenAI were to collapse. https://www.wheresyoured.at/what-happens-if-openai-dies/ * Cal Newport -- On AI Coding and Its Discontents Cal Newport examines a self-described AI skeptic won over by coding tools and weighs what the technology genuinely changes for the work of software engineers. https://calnewport.com/on-ai-coding-and-its-discontents/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,745.91 ▲ +0.1% Dow 53,567.73 ▼ -0.6% Nasdaq 26,559.58 ▲ +0.1% WTI crude 83.78 ▲ +3.7% EUR/USD 1.1588 ▲ +0.4% GBP/USD 1.3546 ▲ +0.4% USD/JPY 159.16 ▲ +0.2% ================================================================ Generated 2026-08-20 19:36 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================