================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Wednesday, August 26, 2026 - 10:07 AM EDT ================================================================ CISA revealed that Iran-linked hackers probed more than 100 internet-exposed U.S. water systems in July as the Treasury layered fresh sanctions on the same actors. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] As TRACE moves to standardize agent attestation, essayists debate whether the AI boom is overhyped, whether models have gone rogue, and how Apple's chips pressure Nvidia. see: TRACE Standardizes AI Agent Attestation; The AI Hater's Manifesto; Has AI Gone Rogue?; Apple Updates Mini and Studio, AI Computers, OpenAI Jalapeño * [TREND] Phishing-as-a-service crews industrialized credential theft, with AnonyMousKIT's exposed 506-domain supply chain and NovaCookies renting adversary-in-the-middle kits for Microsoft logins. see: Phishing-as-a-Service Kits Automate Credential Theft * [UPDATE (new)] CISA tied July probes of more than 100 internet-exposed U.S. water systems to Iran-linked actors, days after fresh Treasury sanctions. see: Iran-Linked Hackers Probe U.S. Water Systems * [UPDATE (new)] Fresh disclosures piled up, from max-severity Ubiquiti and Kaltura bugs to SLEEPWALKER, a stealthy packet-triggered Windows backdoor. see: Max-Severity Flaws in Ubiquiti, Kaltura, Adobe, and Nvidia; SLEEPWALKER Packet-Triggered Windows Backdoor * [UPDATE (new)] Meta agreed to a $16.7 billion child-safety settlement as Canada imposed retaliatory duties on $20 billion of goods amid Trump's widening trade war. see: Meta's $16.7 Billion Child-Safety Settlement; Canada Retaliates in Widening U.S. Trade War SECURITY ---------------------------------------------------------------- 1. PHISHING-AS-A-SERVICE KITS AUTOMATE CREDENTIAL THEFT Ransomware and Cybercrime · [phishing, credential-theft, mfa-bypass] Latest developments: SOCRadar unraveled AnonyMousKIT's reseller supply chain of 506 domains and 168 storefront brands after basic coding errors exposed its production logs, while Dark Reading detailed NovaCookies, an adversary-in-the-middle kit renting Microsoft 365 session theft for $320 a month, and Zimperium flagged fake recruiters using browser-in-the-browser lures to harvest corporate passwords. Rentable phishing platforms lower the bar for credential and session theft. AnonyMousKIT uses rented AI voice agents to call iPhone theft victims posing as Apple Support and pull passcodes needed to remove Activation Lock, NovaCookies steals live M365 sessions past MFA, and recruitment scams target enterprise logins on mobile. Enforce phishing-resistant authentication and monitor for session-token abuse. - BleepingComputer: https://www.bleepingcomputer.com/news/security/anonymouskit-phaas-uses-voice-ai-agents-to-phish-iphone-passcodes/ - The Hacker News: https://thehackernews.com/2026/08/fake-apple-support-ai-calls-target.html - Dark Reading: https://www.darkreading.com/endpoint-security/novacookies-steals-microsoft-365-sessions-320-a-month - Help Net Security: https://www.helpnetsecurity.com/2026/08/26/recruitment-scam-corporate-passwords-mobile/ 2. MAX-SEVERITY FLAWS IN UBIQUITI, KALTURA, ADOBE, AND NVIDIA Vulnerabilities and Exploits · [patch, rce, zero-day] Latest developments: Ubiquiti patched three maximum-severity bugs that remote attackers can exploit without privileges, the CERT Coordination Center disclosed two unpatched Kaltura mwEmbed deserialization flaws, CVE-2026-19913 and CVE-2026-19912, that permit unauthenticated file reads and code execution, and Adobe and Nvidia each shipped advisories fixing critical vulnerabilities. A fresh wave of high-impact flaws spans network gear, video players, and creative and GPU software. The Kaltura mwEmbedLoader.php bugs remain unpatched and let remote attackers read arbitrary files and run code. Patch Ubiquiti, Adobe, and Nvidia immediately, and restrict access to exposed Kaltura players until a fix ships. - BleepingComputer: https://www.bleepingcomputer.com/news/security/ubiquiti-patches-three-max-severity-security-vulnerabilities/ - The Hacker News: https://thehackernews.com/2026/08/unpatched-kaltura-mwembed-flaws-could.html - SecurityWeek: https://www.securityweek.com/adobe-and-nvidia-patch-dozens-of-vulnerabilities/ 3. FLOCK SURVEILLANCE DRAWS FELONY CHARGES AND DENIALS Policy and Regulation · [surveillance, privacy, policy] Latest developments: Police devised sting operations using 3D-printed decoy Flock cameras and charged a man with three felonies for breaking one, while 404 Media reported that Flock Chief Executive Garrett Langley told officers its earlier story about police tracking a woman who self-administered an abortion was false. Flock's automated license-plate-reader network is generating legal and political friction as departments protect the cameras with decoys and sting charges and the company disputes reporting on abusive queries. Separately, ICE is seeking a federal contractor to handle national voter registration and history files it frames as fraud detection. - 404 Media: https://www.404media.co/man-charged-with-3-felonies-for-breaking-3d-printed-decoy-flock-camera/ - 404 Media: https://www.404media.co/flocks-ceo-is-lying-to-cops-about-404-medias-reporting-on-abortion-case/ - 404 Media: https://www.404media.co/ice-wants-the-countrys-voter-data/ 4. IRAN-LINKED HACKERS PROBE U.S. WATER SYSTEMS Critical Infrastructure Security · [apt, critical-infrastructure, policy] Latest developments: CISA disclosed that attackers targeted more than 100 internet-exposed water systems during July, tied the activity to Iran-linked actors, and published guidance on cutting internet exposure days after the Treasury's fresh sanctions. The U.S. Treasury sanctioned Iranian cyber actors for critical-infrastructure breaches, and CISA now urges water utilities to pull human-machine interfaces and controllers off the public internet. Operators should segment operational-technology networks and enforce strong authentication. - SecurityWeek: https://www.securityweek.com/cisa-over-100-internet-exposed-water-systems-targeted-in-july-cyberattacks/ - The Hacker News: https://thehackernews.com/2026/08/us-sanctions-iran-linked-hackers-behind.html 5. TRACE STANDARDIZES AI AGENT ATTESTATION AI Security · [ai, policy, standards] Latest developments: The Linux Foundation took governance of TRACE, a hardware-backed runtime-evidence specification contributed by OPAQUE and built with AMD, Intel, Microsoft, and the Technology Innovation Institute, to create a standard evidence layer for autonomous AI agents and confidential workloads. TRACE, short for Trust, Runtime Attestation and Compliance Evidence, aims to give organizations verifiable governance records as they deploy increasingly autonomous agents and open-weight models. The open standard lands as vendors race to secure agent behavior, alongside NVIDIA's SkillSpector scanner for AI agent skills. - Help Net Security: https://www.helpnetsecurity.com/2026/08/26/the-linux-foundation-trace-ai-agent-security/ - SecurityWeek: https://www.securityweek.com/linux-foundation-to-govern-trace-an-open-standard-for-ai-runtime-attestation/ 6. SLEEPWALKER PACKET-TRIGGERED WINDOWS BACKDOOR Ransomware and Cybercrime · [malware, backdoor] Latest developments: An independent malware researcher documented SLEEPWALKER, a previously unreported Windows backdoor that lies inert in memory until a specifically crafted network packet arrives, then executes commands written in its own 23-instruction language. SLEEPWALKER is an unsigned 64-bit Windows DLL of 59,904 bytes built to be side-loaded into a legitimate process, where it waits for a trigger packet before running its custom bytecode. Its packet-gated dormancy defeats sandbox timers and network scanning, so defenders should hunt for suspicious side-loading and unexpected listening behavior. - The Hacker News: https://thehackernews.com/2026/08/newly-sleepwalker-backdoor-waits-for.html BUSINESS AND POLITICS ---------------------------------------------------------------- * Canada Retaliates in Widening U.S. Trade War Latest developments: Canada imposed new retaliatory duties ranging from 15% to 50% on about $20 billion of U.S. goods, and President Trump threatened to raise tariffs on Canadian-built vehicles to 50%. The confrontation between Ottawa and Washington deepened after 50% U.S. tariffs took effect, and Canada's countermeasures alongside Trump's auto-tariff threat now squeeze automakers in Detroit and Ontario while pushing up costs across the border. - WSJ US Business: https://www.wsj.com/cfo-journal/intuits-cfo-on-the-tough-choice-to-lower-guidance-a01785b5?mod=pls_whats_news_us_business_f - WSJ World News: https://www.wsj.com/business/autos/detroit-needs-canada-more-than-the-rest-of-the-u-s-does-82643b92?mod=rss_worldnews * Meta's $16.7 Billion Child-Safety Settlement Latest developments: Meta agreed to pay up to $16.7 billion and add child-safety measures to Facebook and Instagram, settling state attorneys general claims just as the trial opened in California. The accord ends litigation alleging Meta designed addictive platforms that harmed young people's mental health; state attorneys general brought the case, and the payout ranks among the largest settlements of its kind. - FT World: https://www.ft.com/content/21dcbd96-ee57-445c-a9ba-0938c49b91c0?syn-25a6b1a6=1 - WSJ Markets: https://www.wsj.com/livecoverage/nvidia-earnings-stock-market-today-08-26-2026?mod=rss_markets_main PITTSBURGH ---------------------------------------------------------------- Weather: Today: Partly Sunny, high 81F. Tonight: Partly Cloudy, low 64F. Thursday: Chance Showers And Thunderstorms, high 84F. Business: * PennDOT Signs Rattle Pittsburgh Drivers Latest developments: PennDOT posted advisory signs warning of road closures along major Pittsburgh routes, including Carson Street, confusing commuters even though the work runs only overnight next week. KDKA reported that PennDOT's signs for two upcoming projects carry the word "closed," alarming drivers along corridors such as Carson Street; the agency says each closure lasts a single night next week. - KDKA: https://www.cbsnews.com/pittsburgh/news/penndot-projects-signs-concerns-drivers-impacts-long-lasting/ * Doubts Over Trump's Beef-Import Plan Latest developments: The Post-Gazette reported that President Trump's push to import more beef to ease record U.S. prices drew skepticism it will meaningfully lower grocery costs. As American beef prices sit near record highs, the Post-Gazette examined Trump's deal to bring in more foreign beef and the ranchers and analysts questioning whether it reaches consumers. - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/politics-nation/2026/08/26/trump-beef-deal-imports-expensive-prices/stories/202608260029 Around town: * West Mifflin Moves to Fix Bus Delays Latest developments: The West Mifflin Area School District said it is coordinating with its busing contractor to correct routes that ran hours late and skipped stops on the first day of school. After buses ran hours behind schedule and missed stops when the year opened, the West Mifflin Area School District told WTAE it is working with the company that runs its service to fix the failures. - WTAE: https://www.wtae.com/article/west-mifflin-bus-delay-concerns-update-august-25-2026/73524381 * Leechburg Adds Homeschool Hybrid Program Latest developments: TribLive reported a Christian homeschool hybrid program will open in Leechburg, giving home-schooled children part-time in-person instruction. A new hybrid Christian program is coming to Leechburg, offering families who home-school their children scheduled in-person classes alongside their at-home lessons. - TribLive: https://triblive.com/local/valley-news-dispatch/help-for-home-schooled-kids-coming-to-leechburg-under-hybrid-model/ * CCAC Professor Sets World Record Latest developments: TribLive reported that Francis Maxin, a Community College of Allegheny County microbiology professor, earned the Guinness World Record for the longest science-teaching career by a man. The Community College of Allegheny County said microbiology professor Francis Maxin now holds the Guinness World Record for the longest career as a male science instructor. - TribLive: https://triblive.com/news/education-classroom/ccac-microbiology-professor-awarded-guinness-world-record-in-teaching/ SPORTS ---------------------------------------------------------------- Around the Teams: * Blanco Jr. Powers Up at Greensboro Latest developments: The Post-Gazette's MiLB Monday spotlighted Pirates prospect Tony Blanco Jr. showing big power at High-A Greensboro. In its farm-system roundup, the Post-Gazette reported that outfield prospect Tony Blanco Jr. is displaying huge power for the Pirates' High-A affiliate in Greensboro. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/08/24/prospects-blanco-jebb-rembert-harrington-florentino/stories/202608230090 Team USA: * USMNT's Next Wave Bound for Europe Latest developments: ESPN profiled the U.S. men's national team's brightest under-21 prospects headed abroad, noting 19-year-old Zavier Gozo already left MLS for the Premier League. ESPN surveyed the young Americans likely to follow winger Zavier Gozo from MLS to Europe, mapping the next generation of the U.S. men's national team ahead of the 2026 World Cup. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49724390/who-united-states-brightest-21-prospects-bound-europe READING ---------------------------------------------------------------- * Stratechery -- Apple Updates Mini and Studio, AI Computers, OpenAI Jalapeño Ben Thompson argues that Apple's refreshed Mini and Studio machines and OpenAI's separate hardware move, though different in aim, both apply fresh pressure to Nvidia's dominance in AI computing. https://stratechery.com/2026/apple-updates-mini-and-studio-ai-computers-openai-jalapeno/ * Ed Zitron -- The AI Hater's Manifesto Zitron mounts a defense of AI skeptics, casting the technology's loudest critics as clear-eyed observers of an overhyped, overvalued industry rather than reflexive naysayers. https://www.wheresyoured.at/the-ai-haters-manifesto/ * Cal Newport -- Has AI Gone Rogue? Newport weighs the summer's alarming stories of AI misbehavior against the shakier real story of AI labs' uncertain finances as they chase record IPOs, questioning how rogue the technology truly is. https://calnewport.com/has-ai-gone-rogue/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,670.73 ▼ -1.1% Dow 53,298.77 ▼ -0.6% Nasdaq 26,142.04 ▼ -1.8% WTI crude 85.62 ▲ +2.8% EUR/USD 1.1658 ▲ +0.9% GBP/USD 1.3614 ▲ +0.7% USD/JPY 158.95 ▼ -0.2% ================================================================ Generated 2026-08-26 10:07 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================