================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Monday, August 24, 2026 - 10:05 AM EDT ================================================================ Suspected Iranian hackers knocked a British power plant offline for four days, pushing nation-state cyber operations past espionage into physical sabotage of critical infrastructure. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Suspected Iranian operators escalated from espionage to sabotage, taking a British power plant offline four days alongside a coordinated strike on 30-plus US water utilities. see: Iran-Linked UK Power Plant Shutdown * [TREND] Ransomware crews like Gunra exploit unpatched VPNs while new brokers WordlistLoader and SynkLoader sell access, as mid-market firms absorb 73% of disclosed extortion incidents. see: Gunra Ransomware Campaign; WordlistLoader and SynkLoader Access Brokers * [UPDATE (new)] Open-source infrastructure keeps shipping critical holes, from a Keycloak flaw handing over any account via CVE-2026-18963 to 91 fresh fixes in the Spring framework. see: Critical Keycloak Account-Takeover Flaw * [TREND] Trump lifted U.S. tariffs on Canadian cars and steel to 50%, and WTAE mapped which everyday goods could climb for area shoppers as Ottawa's retaliation looms. see: U.S. Raises Canada Auto and Steel Tariffs to 50%; Tariffs Threaten Everyday Prices in the Region * [TREND] This week's reads reframe AI around business reality, from the shaky finances of AI labs and OpenAI's collapse risk to why agentic security favors attackers. see: Has AI Gone Rogue?; What Happens If OpenAI Dies?; Autonomy and Innovation * [UPDATE (new)] China-nexus operators ran Operation QUICSILVER against Myanmar government and IT targets, using graduation-invitation lures to drop the QUICAgent Go backdoor. see: Operation QUICSILVER Hits Myanmar SECURITY ---------------------------------------------------------------- 1. IRAN-LINKED UK POWER PLANT SHUTDOWN Nation-State Activity · [apt, critical-infrastructure] Latest developments: Fresh reporting ties the four-day July 2026 outage to a broader wave, placing it alongside a coordinated attack that hit more than 30 US community water utilities around the same time and raising fears of repeatable strikes on Britain's distributed grid. Suspected Iranian hackers took a British power plant offline for four days in July 2026, per sources cited by The Telegraph, causing real-world operational disruption and exposing the fragility of the country's critical infrastructure. - SecurityWeek: https://www.securityweek.com/iran-linked-hackers-shut-down-uk-power-plant-for-four-days/ - Help Net Security: https://www.helpnetsecurity.com/2026/08/24/uk-power-plant-cyberattack/ 2. CRITICAL KEYCLOAK ACCOUNT-TAKEOVER FLAW Vulnerabilities and Exploits · [vulnerability, patch] Latest developments: Red Hat and the Keycloak project patched CVE-2026-18963, a CVSS 9.1 flaw that lets an unauthenticated remote attacker force a password reset and seize any account, while the Spring application framework shipped fixes for 91 more vulnerabilities. Keycloak is a widely deployed open-source identity and access management server; the password-reset bug hands attackers full account takeover, so administrators should apply the Red Hat and Keycloak patches immediately. - The Hacker News: https://thehackernews.com/2026/08/critical-keycloak-password-reset-flaw.html - SecurityWeek: https://www.securityweek.com/91-vulnerabilities-patched-in-spring-application-framework/ 3. GUNRA RANSOMWARE CAMPAIGN Ransomware and Cybercrime · [ransomware, extortion] Latest developments: Fortra detailed Gunra, a gang exploiting unpatched VPNs and firewalls to steal data, encrypt systems, and extort victims across healthcare, finance, and manufacturing, as Black Kite reported mid-market companies absorbing 73% of disclosed ransomware incidents from January 2023 through June 2026. Gunra breaks in through unpatched perimeter devices to run double-extortion attacks; the gang and its peers increasingly target mid-market firms earning $10 million to $1 billion, so patching internet-facing VPNs and firewalls is the priority defense. - Graham Cluley: https://www.fortra.com/blog/gunra-ransomware-what-you-need-know - Help Net Security: https://www.helpnetsecurity.com/2026/08/24/black-kite-mid-market-ransomware-risk-report/ 4. OPERATION QUICSILVER HITS MYANMAR Nation-State Activity · [apt, espionage] Latest developments: Seqrite Labs exposed Operation QUICSILVER, a China-nexus espionage campaign using graduation-ceremony invitation lures to drop a Go backdoor called QUICAgent on Myanmar government and information-technology targets. QUICSILVER phishes Myanmar's public sector with themed decoys that install the QUICAgent backdoor for persistent access; Seqrite assesses a China-aligned actor with moderate confidence. - The Hacker News: https://thehackernews.com/2026/08/operation-quicsilver-targets-myanmar.html 5. WORDLISTLOADER AND SYNKLOADER ACCESS BROKERS Ransomware and Cybercrime · [malware, stealer] Latest developments: Gen Digital flagged two new loaders that likely sell access to ransomware groups: WordlistLoader delivers Amatera Stealer through ClearFake campaigns and ClickFix fake-captcha lures, and SynkLoader phishes Windows passwords for next-stage payloads. WordlistLoader and SynkLoader operate as initial-access malware, dropping the Amatera information stealer and harvesting credentials to hand ransomware affiliates a foothold; the ClickFix lure tricks users into pasting attacker commands themselves. - The Hacker News: https://thehackernews.com/2026/08/wordlistloader-delivers-amatera-via.html 6. UBER'S 825 MILLION EURO GDPR FINE Policy and Regulation · [policy, gdpr, privacy] Latest developments: The Dutch Data Protection Authority fined Uber 825 million euros, nearly $1 billion, for violating the EU's General Data Protection Regulation through automated suspensions of driver accounts. The Netherlands' privacy regulator found Uber's algorithmic account suspensions breached GDPR protections around automated decision-making, one of the largest data-protection penalties on record and a warning to firms running consequential automated systems on personal data. - SecurityWeek: https://www.securityweek.com/uber-fined-nearly-1-billion-by-dutch-regulators-over-automated-suspensions-of-driver-accounts/ BUSINESS AND POLITICS ---------------------------------------------------------------- * U.S. Raises Canada Auto and Steel Tariffs to 50% Latest developments: President Trump said August 24 the United States will lift tariffs on Canadian cars and steel to 50%, a fresh escalation beyond the levies and retaliation already reported. Trump moved to raise U.S. tariffs on Canadian automobiles and steel to 50%, deepening the trade war with Prime Minister Mark Carney's government after talks between Washington and Ottawa collapsed and Canada set its own post-Labor-Day retaliation. - FT World: https://www.ft.com/content/52978bad-2b91-41e3-be94-7fb6776fbb91 - WSJ US Business: https://www.wsj.com/logistics-report/u-s-canada-trade-talks-fail-7c8cdc47?mod=pls_whats_news_us_business_f PITTSBURGH ---------------------------------------------------------------- Weather: Today: Mostly Sunny, high 73F. Tonight: Partly Cloudy, low 58F. Tuesday: Mostly Sunny, high 78F. Business: * Tariffs Threaten Everyday Prices in the Region Latest developments: With 50% U.S. tariffs on Canadian exports now in effect and Ottawa's retaliation looming, WTAE laid out August 24 which everyday goods could climb in price for area shoppers. WTAE reported that a range of everyday consumer goods could grow more expensive across the Pittsburgh region if Canada retaliates for the 50% U.S. tariffs on Canadian exports that just took effect. - WTAE: https://www.wtae.com/article/us-canada-tariffs-everyday-prices/73508160 * Buc-ee's Sues Ohio Mini Mart Over Beaver Logo Latest developments: KDKA reported August 24 that Texas chain Buc-ee's filed a trademark-infringement suit against Beaver's Mini Mart in Beavercreek, Ohio, over its beaver logo, stirring a regional backlash. Buc-ee's Ltd., the Texas convenience-store chain known for its buck-toothed beaver mascot, sued Beaver's Mini Mart in Beavercreek, Ohio, for trademark infringement, and supporters across Ohio rallied to the small store's defense. - KDKA: https://www.cbsnews.com/pittsburgh/news/buc-ees-chain-draws-outcry-in-ohio-for-launching-fight-over-a-mini-marts-beaver-logo/ Around town: * Water Main Break Buckles West End Road Latest developments: A water main broke overnight August 24 at Chartiers Avenue and Steuben Street in Pittsburgh's West End, buckling the road and cutting service to about 32 customers. A large water main break at Chartiers Avenue and Steuben Street in the Elliott section of Pittsburgh's West End buckled the roadway and closed it to traffic, leaving roughly 32 customers without water service. - WPXI: https://www.wpxi.com/news/local/water-main-break-buckles-roadway-pittsburghs-elliot-neighborhood/2FKSJW52TRCUDGNEMKM6EOQDRU/ - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/transportation/2026/08/24/pittsburgh-water-main-break-chartiers-steuben/stories/202608240024 * Oakmont Allows Limited Deer Hunting in Dark Hollow Woods Latest developments: Oakmont Council amended the borough code to permit limited hunting in Dark Hollow Woods under its newly adopted deer-management program. Oakmont Council voted to amend the borough's code to allow limited deer hunting in Dark Hollow Woods, aligning the ordinance with the deer-management program the borough recently adopted. - TribLive: https://triblive.com/local/valley-news-dispatch/oakmont-council-passes-ordinance-amendment-to-allow-limited-deer-hunting-in-dark-hollow-woods/ * Pittsburgh Arlington Builds on Its Turnaround Latest developments: TribLive reported August 24 that Pittsburgh Arlington PreK-8, long one of the district's most troubled schools, aims to sustain last year's academic gains as classes resume. Pittsburgh Arlington PreK-8, a Pittsburgh Public Schools building where learning and working had grown overwhelming for years, turned its performance around last school year, and its staff intends to keep the momentum going. - TribLive: https://triblive.com/news/education-classroom/once-troubled-pittsburgh-arlington-turned-around-last-school-year-theyre-determined-to-keep-the-momentum/ SPORTS ---------------------------------------------------------------- Around the Teams: * Steelers Track Porter Contract, Ramsey Injury Latest developments: The Post-Gazette reported August 23 on the state of cornerback Joey Porter Jr.'s contract talks and the status of Jalen Ramsey's injury. In its Steelers notes, the Post-Gazette laid out where matters stand on a possible new deal for cornerback Joey Porter Jr. and on the injury sidelining veteran defensive back Jalen Ramsey as the regular season nears. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/08/23/nfl-news-joey-porter-contract-jalen-ramsey-injury/stories/202608220047 * Not Just Football Breaks Down the Receiver Room Latest developments: Cam Heyward's 'Not Just Football' posted the third training-camp episode August 24, hosting wide receivers Roman Wilson, Germie Bernard, and Michael Pittman Jr. On episode three of the 'Not Just Football' training-camp series, Cam Heyward and Hayden Walsh talked with Steelers wide receivers Roman Wilson, Germie Bernard, and Michael Pittman Jr. about life in the receiver room, with the show posting new camp episodes Monday, Wednesday, and Friday. - Not Just Football with Cam Heyward: https://www.youtube.com/watch?v=OUo1oDhbUqs * Flores Aims to Vindicate the Bednar Trade Latest developments: The Post-Gazette profiled catcher Rafael Flores Jr. on August 24 and his drive to prove the David Bednar trade paid off for the Pirates. Post-Gazette's Off The Bat detailed catcher Rafael Flores Jr.'s effort to show the Pirates' David Bednar trade was worth it, as he pushes for a role down the stretch of the season. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/08/24/pirates-rafael-flores-david-bednar-catching-postseason/stories/202608240006 READING ---------------------------------------------------------------- * Cal Newport -- Has AI Gone Rogue? Newport argues the real AI story of the summer is the shaky financial footing of the AI labs chasing record-breaking IPOs, a business reality that matters more than sensational fears about the technology going rogue. https://calnewport.com/has-ai-gone-rogue/ * Stratechery -- Autonomy and Innovation Ben Thompson argues that incentives favor offense in agentic cybersecurity, the same dynamic that over the long run will constrain incumbents and give startups an opening. https://stratechery.com/2026/autonomy-and-innovation/ * Ed Zitron -- What Happens If OpenAI Dies? Zitron games out the consequences for the broader AI industry and its backers if OpenAI were to collapse under its financial strains. https://www.wheresyoured.at/what-happens-if-openai-dies/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,692.07 ▼ -0.9% Dow 53,260.49 ▼ -1.0% Nasdaq 26,302.67 ▼ -1.2% WTI crude 86.03 ▲ +4.3% EUR/USD 1.1620 ▲ +0.7% GBP/USD 1.3575 ▲ +0.6% USD/JPY 159.05 = +0.0% ================================================================ Generated 2026-08-24 10:05 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================