daily plain-text briefing: security, markets, business, and pittsburgh
More than 9,300 leaked AWS keys sit live in the wild and a new phishing kit plants attacker-controlled passkeys, showing that stolen credentials now outlast every password reset.
Latest developments: SecurityWeek on August 22, 2026 spotlighted a persistent Grandoreiro banking-trojan campaign running across Latin America and Europe, joining the spyware-equipped Manic and the expanded ToxicPanda 2.0 documented earlier this week.
Grandoreiro is a long-running Latin American banking trojan that steals online-banking credentials and now strikes European victims. Banks and users should watch for malicious installer lures and enforce transaction verification.
Sources: SecurityWeek · ↑ top
Latest developments: BleepingComputer reported on August 21, 2026 that more than 9,300 AWS access keys exposed publicly between August 2022 and August 2026 stay active and valid, granting anyone who finds them full control over corporate accounts, as Palo Alto Networks' Unit 42 warned that attackers now hit CI/CD pipelines and developer tools rather than application code.
Developers leak long-lived AWS keys in public repositories, build artifacts, and code, and the keys open broad access to cloud accounts. Rotate exposed keys, move to short-lived credentials, and scan pipelines and artifacts for secrets.
Sources: BleepingComputer · Unit 42 (Palo Alto) · ↑ top
Latest developments: Microolap confirmed on August 21, 2026 the cyberattack that the pro-Ukraine group Black Spark claimed a day earlier, saying intruders spent more than a month inside its network and reached internal systems including EtherSensor, its network traffic-analysis platform.
Black Spark, a pro-Ukraine hacking crew, penetrated Russian network-monitoring vendor Microolap and accessed its EtherSensor traffic-analysis product. The intrusion pushes the cyber front of the Russia-Ukraine war into Russian security-tooling suppliers.
Sources: The Record · ↑ top
Latest developments: Researchers detailed iAuthFlow V2, a phishing toolkit that registers an attacker-controlled passkey during the login flow, granting persistent access that survives password changes and revoked sessions.
iAuthFlow V2 abuses passkey enrollment to hold a foothold after victims reset credentials. Defenders should audit passkey and security-key registrations and alert on any new authenticator enrollment.
Sources: SecurityWeek · ↑ top
Latest developments: The Hacker News reported on August 21, 2026 that Kaspersky, which found the threat in June 2026, detailed a new malware family infecting Android vehicle head-unit firmware built by DoFun, spreading through the units' built-in updaters to deliver a multi-stage downloader for ad fraud and a proxy botnet.
The malware rides DoFun-made Android head-unit firmware updaters in vehicles, then pulls payloads that commit ad fraud and enroll the units into a proxy botnet. Automakers and integrators should vet head-unit update channels and firmware sources.
Sources: The Hacker News · ↑ top
Latest developments: U.S. lawmakers on August 21, 2026 called for an investigation into how staffing cuts at the Cybersecurity and Infrastructure Security Agency have affected its mission, saying little is known about the lost expertise or whether the agency has replaced it.
Members of Congress want a formal review of CISA workforce reductions and their operational fallout. The push raises concern that thinned staffing weakens federal cyberdefense coordination.
Sources: The Record · ↑ top
Latest developments: The 50% tariffs took effect early Saturday, August 22, after negotiations collapsed Friday night, and Ottawa immediately promised matching duties on American products.
The United States imposed 50% tariffs on roughly $20 billion of Canadian goods after last-ditch talks failed; Prime Minister Mark Carney rejected the terms as unfair, and Canada vowed retaliatory tariffs on U.S. imports, deepening the rupture between the two allies.
Sources: WSJ World News · FT World · ↑ top
Today: Patchy Fog then Chance Showers And Thunderstorms, high 82F.
Tonight: Showers And Thunderstorms Likely then Showers And Thunderstorms, low 62F.
Sunday: Chance Rain Showers then Slight Chance Showers And Thunderstorms, high 74F.
Latest developments: Okane, a three-story Japanese restaurant, opened in Downtown Pittsburgh on August 15 and hosted a preview of its rooftop menu.
Okane, a new three-story Japanese restaurant, opened Downtown, serving dishes such as a salmon "cigar" on its rooftop level, adding to the city center's dining scene.
Latest developments: Western Pennsylvania developers and officials weighed in on Governor Josh Shapiro's executive order restricting data centers, and contractor Alex Paris said he is not much concerned.
Governor Josh Shapiro's executive order imposing statewide guardrails on data-center development drew reaction across Western Pennsylvania from builders, local officials, and environmental groups, with contractor Alex Paris downplaying its effect on his projects.
Latest developments: Days after the special election, residents and analysts debated whether Democrat Brandon Dukes's win over Republican Scott Timko in traditionally Republican Butler County signals a broader shift.
Democrat Brandon Dukes captured a Pennsylvania House seat centered on Cranberry Township, Butler County, defeating Republican Scott Timko in a deep-red area, an upset locals like Susan Collier read as a possible sign of changing politics.
Latest developments: Parents told TribLive that Pittsburgh Public Schools' proposed school-closures plan could disrupt special education services their children depend on.
Pittsburgh Public Schools' plan to close buildings drew warnings from families that special education services would suffer, with one parent noting a child who can go from mildly sniffly to hospitalized within a single day.
Latest developments: In the first days of the school year, West Mifflin Area School District parents complained of bus rides stretching beyond an hour.
Transportation troubles hit the opening days of school in the West Mifflin Area School District, where parents said students endured bus rides exceeding an hour.
Latest developments: Coach Mike McCarthy said he has seen enough of Mason Rudolph and set his quarterback plan for the preseason finale against the Buffalo Bills, while Post-Gazette columnist Noah Hiles argued keeping four quarterbacks would be a mistake.
The Steelers hold Aaron Rodgers, veteran Mason Rudolph, and young passers Will Howard and Drew Allar; Howard and Allar struggled in the preseason loss to the New York Jets, though McCarthy said that will not alter how he evaluates them heading into the finale.
Sources: Post-Gazette Steelers · Post-Gazette Steelers · ↑ top
Latest developments: A Post-Gazette analysis marks general manager Ben Cherington approaching 1,000 games running the Pirates and traces the seven losing seasons under owner Bob Nutting.
The Pittsburgh Pirates are about to reach 1,000 games under general manager Ben Cherington, hired in 2019, a stretch of seven straight losing campaigns that the Post-Gazette broke down season by season.
Sources: Post-Gazette Pirates · ↑ top
Latest developments: Cam Heyward's "Not Just Football" posted the second episode of its training-camp series, featuring defensive tackles Keeanu Benton and Sebastian Joseph-Day.
On "Not Just Football," Steelers captain Cam Heyward and co-host Hayden welcomed defensive linemen Keeanu Benton and Sebastian Joseph-Day to talk about the coming season and camp.
Sources: Not Just Football with Cam Heyward · ↑ top
S&P 500 7,692.07 ▼ -0.9% Dow 53,260.49 ▼ -1.0% Nasdaq 26,302.67 ▼ -1.2% WTI crude 86.03 ▲ +4.3% EUR/USD 1.1640 ▲ +0.8% GBP/USD 1.3596 ▲ +0.6% USD/JPY 159.00 ▼ -0.2%