================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Sunday, August 23, 2026 - 8:04 AM EDT ================================================================ Researchers dismantled Windows 11's toughest defenses in software alone as supply-chain malware colonized Android cars and pro-Ukraine hackers burrowed into Russian technology firms. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Attackers keep moving upstream in the software supply chain, planting malware in DoFun car head-unit updaters while thousands of still-live AWS keys and CI/CD pipelines stay exposed. see: Android Car Head Unit Malware; Exposed AWS Keys and CI/CD Supply Chain * [TREND] Credential theft is outlasting the reset, as the iAuthFlow V2 kit quietly registers attacker-controlled passkeys that survive victims' password changes and session revocation. see: Passkey-Abusing Phishing Toolkit iAuthFlow V2 * [TREND] The Russia-Ukraine war keeps bleeding into cyberspace, with pro-Ukraine group Black Spark claiming a month inside Russian monitoring firm Microolap and its EtherSensor traffic-analysis platform. see: Pro-Ukraine Hackers Breach Russian Firms * [UPDATE (new)] University of Birmingham and Durham researchers showed some of Windows 11's strongest defenses can be knocked down through software alone once an attacker already holds privileged access. see: Windows 11 Security Defenses Bypassed * [UPDATE (new)] The 50% U.S. tariffs took effect Saturday on about $20 billion of Canadian goods, as Prime Minister Mark Carney said President Trump had 'miscalculated' by escalating. see: U.S.-Canada Trade War Takes Effect * [TREND] Around Pittsburgh, Squirrel Hill gains a fully kosher market as charter-school vaccine gaps amid measles and a final first day at closing schools draw scrutiny. see: Kosher Market Opens on Murray Avenue; Charter Schools' Vaccine Enforcement Gaps; Last First Day at Closing Schools SECURITY ---------------------------------------------------------------- 1. WINDOWS 11 SECURITY DEFENSES BYPASSED Vulnerabilities and Exploits · [vulnerability, windows] Latest developments: Researchers at the University of Birmingham and Durham University showed how to knock down some of Windows 11's strongest protections through software alone, without opening or modifying the target machine, once an attacker already holds privileged access. The technique defeats hardware-backed Windows 11 defenses after an intruder gains privileged access, undercutting protections many enterprises lean on; administrators should tighten privilege escalation controls and monitor for local compromise. - Help Net Security: https://www.helpnetsecurity.com/2026/08/23/week-in-review-records-allegedly-stolen-from-azure-tenants-medusa-ransomware-hits-500-orgs/ 2. ANDROID CAR HEAD UNIT MALWARE Ransomware and Cybercrime · [malware, supply-chain, botnet] Latest developments: Kaspersky, which found the threat in June 2026, detailed a supply-chain campaign that plants malware in Android vehicle head-unit firmware built by DoFun and spreads through the units' built-in update apps to run a multi-stage downloader. The malware enlists compromised car infotainment systems into a proxy botnet and drives ad fraud; owners and installers of DoFun-firmware head units should treat built-in updaters as an infection vector. - BleepingComputer: https://www.bleepingcomputer.com/news/security/hackers-infect-android-car-head-units-with-proxy-botnet-malware/ - The Hacker News: https://thehackernews.com/2026/08/android-car-malware-spreads-through.html 3. PRO-UKRAINE HACKERS BREACH RUSSIAN FIRMS Nation-State Activity · [hacktivism, apt] Latest developments: Russian network-monitoring firm Microolap confirmed a cyberattack after the pro-Ukraine group Black Spark claimed it spent more than a month inside the company's systems, including its EtherSensor traffic-analysis platform, as Ukraine paired cyber and drone strikes against a Russian ecommerce giant. Pro-Ukraine hacktivists are penetrating Russian technology and commerce companies and lingering for weeks; Russian operators of EtherSensor and similar network tooling face intrusion and data theft. - The Record: https://therecord.media/russian-network-monitoring-firm-confirms-cyberattack-claimed-by-pro-ukraine-group - Wired Security: https://www.wired.com/story/security-news-this-week-your-expired-visa-card-could-be-zombiefied-to-make-contactless-payments/ 4. EXPOSED AWS KEYS AND CI/CD SUPPLY CHAIN Data Breaches · [cloud, credentials, supply-chain] Latest developments: BleepingComputer reported that more than 9,300 AWS access keys leaked publicly between August 2022 and August 2026 remain active and valid, handing full control of corporate accounts, as Unit 42 warned attackers increasingly target CI/CD pipelines and developer tools over application code. Long-exposed cloud credentials still unlock corporate AWS accounts, and the software development lifecycle itself has become the target; organizations should rotate and revoke stale keys and lock down developer pipelines. - BleepingComputer: https://www.bleepingcomputer.com/news/security/hundreds-of-leaked-aws-keys-give-full-control-over-corporate-accounts/ - Unit 42 (Palo Alto): https://unit42.paloaltonetworks.com/sdlc-supply-chain/ 5. CISA STAFFING CUTS INVESTIGATION Policy and Regulation · [policy] Latest developments: Lawmakers called for a formal investigation into how recent CISA staffing cuts have hit the agency and whether it has replaced the expertise it lost. Congress wants to measure the operational damage from CISA workforce reductions even as cash-strapped local governments already scramble for cyber defense help. - The Record: https://therecord.media/lawmakers-call-for-investigation-into-impact-of-cisa-cuts - Dark Reading: https://www.darkreading.com/cyber-risk/cyber-pros-help-city-hall 6. PASSKEY-ABUSING PHISHING TOOLKIT IAUTHFLOW V2 Ransomware and Cybercrime · [phishing, passkeys] Latest developments: Researchers detailed iAuthFlow V2, a phishing toolkit that registers an attacker-controlled passkey during account takeover so intruders keep access even after victims change passwords and revoke active sessions. The kit converts passkeys into a persistence mechanism that survives standard incident response; defenders should audit and remove unrecognized registered passkeys after any suspected account compromise. - SecurityWeek: https://www.securityweek.com/new-phishing-toolkit-uses-passkeys-to-maintain-access-after-password-resets/ BUSINESS AND POLITICS ---------------------------------------------------------------- * U.S.-Canada Trade War Takes Effect Latest developments: The 50% U.S. tariffs went live early Saturday, August 22, on about $20 billion of Canadian goods, and Prime Minister Mark Carney told Canadians that President Trump 'miscalculated' by escalating. Negotiations between Washington and Ottawa collapsed Friday night after U.S. Trade Representative Jamieson Greer said Canada walked away from agreed terms, and Carney pledged to match the levies dollar for dollar starting September 8, opening a tariff war between two G7 allies. - WSJ World News: https://www.wsj.com/economy/trade/canada-announces-new-post-labor-day-tariffs-ef1de8e1?mod=rss_worldnews - FT World: https://www.ft.com/content/e3b5c236-bd5f-45c2-8ddf-5279a7375d3f?syn-25a6b1a6=1 - WSJ World News: https://www.wsj.com/economy/trade/u-s-to-impose-50-tariffs-on-some-canadian-goods-after-failed-talks-d1510425?mod=rss_worldnews PITTSBURGH ---------------------------------------------------------------- Weather: Today: Mostly Sunny, high 75F. Tonight: Partly Cloudy then Slight Chance Rain Showers, low 57F. Monday: Sunny, high 73F. Business: * Kosher Market Opens on Murray Avenue Latest developments: The Post-Gazette reported August 23 that a new kosher market on Murray Avenue in Squirrel Hill will stock entirely kosher goods after a monthslong dispute over the store. Murray's Avenue Market in Pittsburgh's Squirrel Hill neighborhood, the city's traditional Jewish commercial heart, resolved a months-long fight to reopen as a fully kosher grocery. - Pittsburgh Post-Gazette: https://www.post-gazette.com/business/career-workplace/2026/08/23/murrays-avenue-market-kosher-pittsburgh/stories/202608230050 Around town: * Kelly Draws Challenger Justin Wagner Latest developments: TribLive reported August 23 that U.S. Representative Mike Kelly, seeking a ninth term, faces Democrat Justin Wagner in his Western Pennsylvania district. Mike Kelly, the second-longest-tenured member of Pennsylvania's congressional delegation, will defend his seat against Justin Wagner in the northwestern district anchored around Butler and Erie counties. - TribLive: https://triblive.com/local/regional/mike-kelly-faces-challenge-from-justin-wagner-in-western-pa-congressional-district/ * Last First Day at Closing Schools Latest developments: The Post-Gazette reported August 23 that thousands of Pittsburgh Public Schools students are starting their final first day of classes at buildings the district plans to shut. Pittsburgh Public Schools opened the new year at several schools slated for closure, marking the last opening day for students and staff at those buildings before the district consolidates. - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/education/2026/08/23/pittsburgh-public-schools-closures-1/stories/202608200046 * Charter Schools' Vaccine Enforcement Gaps Latest developments: A Post-Gazette investigation published August 23 found that weak vaccination enforcement in Pennsylvania charter schools leaves thousands of children unprotected as measles spreads. The reporting lands as Allegheny County confirmed its first measles case since 2019, showing charter schools across the state track and enforce required immunizations far less rigorously than traditional public schools. - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/health/2026/08/23/pennsylvania-vaccine-measles-charter-schools/stories/202608210052 SPORTS ---------------------------------------------------------------- Around the Teams: * Porter Contract and Ramsey Injury Latest developments: The Post-Gazette's Steelers notes August 23 laid out the latest on cornerback Joey Porter Jr.'s contract situation and Jalen Ramsey's injury status. The Steelers are weighing Porter's next deal as the Pittsburgh native enters a pivotal season, while veteran defensive back Jalen Ramsey's health is drawing attention heading toward the opener. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/08/23/nfl-news-joey-porter-contract-jalen-ramsey-injury/stories/202608220047 * Hiles Warns Against Four Quarterbacks Latest developments: Post-Gazette columnist Noah Hiles argued August 22 that keeping four quarterbacks in 2026 would be a mistake for the Steelers. Hiles wrote that carrying Aaron Rodgers, Mason Rudolph, Will Howard, and Drew Allar on the roster wastes a spot the Steelers need elsewhere, and the team should trim the group before the season. - Post-Gazette Steelers: https://www.post-gazette.com/sports/columns/2026/08/22/nfl-steelers-quarterbacks-aaron-rodgers-mason-rudolph-will-howard-drew-allar/stories/202608220031 * Cherington Nears 1,000 Games Latest developments: A Post-Gazette analysis August 21 marked Ben Cherington approaching 1,000 games as Pirates general manager by tracing seven straight losing seasons under owner Bob Nutting. The piece charts how Cherington's rebuild has failed to produce a winning club since he took over in 2019, framing the milestone against the franchise's long slide. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/08/21/mlb-analysis-ben-cherington-bob-nutting/stories/202608200068 Team USA: * NWSL Midseason Player Rankings Latest developments: ESPN published its ranking of the 25 best NWSL players August 22, two-thirds through the 2026 season, weighing United States internationals Trinity Rodman and Rose Lavelle for the top spot. The list gauges the current form of American women's national team regulars in the NWSL, the domestic league that supplies most of the U.S. roster, ahead of the next international window. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49663588/nwsl-top-25-best-players-2026-reranked-again-rodman-lavelle-wilson * Ranking USMNT's Premier League Careers Latest developments: ESPN ranked the best Premier League careers by U.S. men's national team players August 21 as the 2026-27 English season opened with several Americans set for big minutes. The list places Christian Pulisic, goalkeeper Brad Friedel, and Clint Dempsey among the top American performers in England's top flight, a guide for fans following USMNT stars after the summer World Cup. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49659024/christian-pulisic-brad-friedel-clint-dempsey-11-best-premier-league-careers-usmnt-history READING ---------------------------------------------------------------- * Stratechery -- Apple Settles With E.U., U.S. App Store Fees, ATT Rules in Germany Ben Thompson argues Apple's App Store is finally accepting lower fees after regulatory pressure, and the EU should count the outcome as a win even though it arrived late. https://stratechery.com/2026/apple-settles-with-e-u-u-s-app-store-fees-att-rules-in-germany/ * Ed Zitron -- What Happens If OpenAI Dies? Zitron games out the fallout of an OpenAI collapse, tracing how the company's failure would ripple through the AI industry, its investors, and the broader tech economy that has bet on it. https://www.wheresyoured.at/what-happens-if-openai-dies/ * Cal Newport -- On AI Coding and Its Discontents Newport uses a converted AI-skeptic engineer's account to weigh what AI coding tools actually change about software work, and where the enthusiasm outruns the reality. https://calnewport.com/on-ai-coding-and-its-discontents/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,692.07 ▼ -0.9% Dow 53,260.49 ▼ -1.0% Nasdaq 26,302.67 ▼ -1.2% EUR/USD 1.1640 ▲ +0.8% GBP/USD 1.3575 ▲ +0.6% USD/JPY 159.00 ▼ -0.2% ================================================================ Generated 2026-08-23 08:04 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================