daily plain-text briefing: security, markets, business, and pittsburgh
The FBI dismantled China's QTFY proxy infrastructure that breached NASA, the Federal Reserve, and the Senate, as Iranian groups pressed water utilities and a wave of maximum-severity flaws surfaced.
Latest developments: The Justice Department attributed the QScan and QTRouter platforms to QTFY, a Chinese state-sponsored group employed by Nanjing Xinjiuwei Network Technology Company, and named NASA among the victims alongside the Federal Reserve, the Senate, and the Justice Department.
QScan and QTRouter let QTFY scan, infect, and route through IoT devices to reach US federal agencies and industries before the FBI seized the infrastructure. Organizations should patch exposed IoT devices and hunt for unexplained proxy traffic.
Sources: Wired Security · The Hacker News · The Record · BleepingComputer · ↑ top
Latest developments: Ubiquiti patched three maximum-severity flaws that unauthenticated attackers exploit remotely, the Avada WordPress theme disclosed a zero-click remote-code-execution chain, CERT/CC flagged two unpatched Kaltura mwEmbed deserialization bugs CVE-2026-19913 and CVE-2026-19912, researchers unveiled GPUThor, a Rowhammer attack that beats NVIDIA ECC protection for root access, and CISA added six actively exploited vulnerabilities to its catalog.
New critical flaws span Ubiquiti gear, the Avada WordPress theme, Kaltura's video player, and NVIDIA GPUs, several unpatched or exploitable without authentication. Administrators should apply available patches promptly and pull vulnerable systems off the public internet.
Sources: BleepingComputer · BleepingComputer · BleepingComputer · CISA Advisories · ↑ top
Latest developments: Group-IB documented IRGC-linked Nimbus Manticore adding a TWOSTROKE-like backdoor and an SSH tunneler as it ranked among the most active Iranian groups of 2026, The Record tracked a separate Iranian group standing up fresh servers across Europe and the Middle East, and CISA reported attackers hit more than 100 internet-exposed water systems in July.
Nimbus Manticore, tied to Iran's Islamic Revolutionary Guard Corps, runs espionage across the Middle East and Europe with new backdoors, while separate Iranian actors targeted US drinking-water systems. Water and infrastructure operators should cut internet exposure and follow CISA's new guidance.
Sources: The Hacker News · The Record · SecurityWeek · ↑ top
Latest developments: Island detailed NovaCookies, a $320-a-month adversary-in-the-middle kit that abuses genuine Docusign notifications to hijack authenticated Microsoft 365 sessions, and Zimperium exposed scammers impersonating well-known companies' recruiters who use browser-in-the-browser overlays to steal corporate passwords on mobile.
NovaCookies rents session-stealing adversary-in-the-middle phishing for $320 a month, and recruitment scammers deploy fake browser windows to capture corporate logins. Organizations should enforce phishing-resistant multifactor authentication and train staff to distrust unsolicited scheduling and signature prompts.
Sources: The Hacker News · Dark Reading · Help Net Security · ↑ top
Latest developments: Microsoft Threat Intelligence detailed attackers exploiting exposed LiteLLM gateways to harvest credentials, persist, and mine cryptocurrency, Wired pressed OpenAI over unanswered questions in its Hugging Face breach debrief, and the Linux Foundation took on TRACE, a hardware-backed runtime-attestation specification for AI agents from AMD, Intel, Microsoft, and OPAQUE.
As organizations expose AI gateways and deploy autonomous agents, attackers hit the control plane itself for credentials and cryptomining while the industry builds attestation standards. Security teams should lock down and monitor AI gateways the way they treat any internet-facing service.
Sources: Microsoft Security Blog · Wired Security · Help Net Security · ↑ top
Latest developments: Boston Scientific told the SEC it discovered the intrusion Tuesday and said the attack knocked out IT systems and disrupted shipment processes worldwide.
Medical-device maker Boston Scientific suffered a cyberattack that disrupted IT systems and product shipments globally and filed disclosure documents with the SEC. The company is working to restore operations.
Sources: The Record · BleepingComputer · ↑ top
Latest developments: Nvidia reported record quarterly sales of $96.2 billion after Wednesday's close and projected roughly 70% revenue growth next year, with its data-center division up 117% from a year earlier.
Nvidia, the world's most valuable company and the bellwether of the artificial-intelligence buildout, told investors on August 26 that chip demand is accelerating, easing weeks of market anxiety over whether AI capital spending had peaked.
Sources: WSJ Markets · FT Home · ↑ top
Latest developments: The Wall Street Journal reported August 26 that CIA Director John Ratcliffe's surprise Moscow trip this week carried a warning against striking NATO, prompted by new U.S. intelligence that President Vladimir Putin could launch a limited assault.
John Ratcliffe made the first visit by a U.S. spy chief to Moscow since Russia's 2022 invasion of Ukraine, delivering a warning that Russia should not attack a NATO member after fresh American intelligence assessments flagged the risk of a limited Russian assault on the alliance.
Sources: WSJ World News · FT World · ↑ top
Tonight: Partly Cloudy, low 63F.
Thursday: Scattered Showers And Thunderstorms, high 83F.
Thursday Night: Scattered Showers And Thunderstorms then Partly Cloudy, low 63F.
Latest developments: Chatham University named Michael Braxton its new top fundraiser, TribLive reported August 26.
Chatham University, the private school in Pittsburgh's Shadyside neighborhood, will look to Michael Braxton to grow philanthropic donations and community engagement, work he says the university can expand despite the financial pressures squeezing higher education.
Latest developments: WTAE reported August 26 that the planned interchange will cost about $45 million and take close to five years, though it still has no start date.
The Pennsylvania Turnpike Commission's new interchange with State Route 981 in Mount Pleasant Township, Westmoreland County, which the commission recently added to its capital plan, now carries a roughly $45 million price tag and a five-year construction horizon.
Latest developments: The Pennsylvania Department of Health confirmed Westmoreland County's first measles case of the year on August 26.
Westmoreland County recorded its first measles case of 2026 as the statewide outbreak—already nearing 400 cases and responsible for two deaths in Lancaster County, Pennsylvania's first measles deaths since 1991—keeps spreading across the region.
Latest developments: Pittsburgh International Airport's annual lost-and-found auction, run by Joe R. Pyle Auctions, held its preview August 26 at a warehouse in Washington, Pennsylvania.
Items travelers left behind at Pittsburgh International Airport over the past year—an electric bicycle, knock-off Rolexes, a rice cooker, even vehicles—go up for bid in the airport's yearly auction, held by Joe R. Pyle Auctions at a Washington County warehouse.
Sources: KDKA · TribLive · ↑ top
Latest developments: The Wilkinsburg-Penn Joint Water Authority sent customers letters about a high chemical level found in one of its basins back in May, prompting complaints about the months-long delay, WPXI reported August 26.
The Wilkinsburg-Penn Joint Water Authority notified customers only recently about an elevated chemical level detected in one of its water basins in May, and customers now want answers about why the warning took months to arrive.
Latest developments: TribLive reported August 26 that the colorful street painting on Downtown Pittsburgh's Strawberry Way will be replaced next month with a new design, with chances for the public to help paint it.
Downtown Pittsburgh's Strawberry Way, the pedestrian lane known for the swirling multicolor art on its pavement, will get a fresh design next month, and organizers plan to invite the public to join the painting.
Latest developments: The Pittsburgh Parks Conservancy opened its inaugural Drawn to Nature Art Contest, inviting Allegheny County students to depict how they experience the natural world, TribLive reported August 26.
The Pittsburgh Parks Conservancy's first Drawn to Nature Art Contest invites Allegheny County students to submit artwork showing how they experience the natural world.
Latest developments: KDKA reported August 26 that the Westmoreland Fair has three days left, running through the weekend with a tractor-driving competition, grandstand events, and free entertainment.
The Westmoreland Fair, the county's big annual gathering with a carnival, livestock shows, grandstand events, and free entertainment, enters its final three days as of Wednesday, August 26, fair vice president Randy Gillis said.
Latest developments: The Pirates said catcher Endy Rodriguez underwent season-ending surgery August 26 to repair the labrum in his left hip, with a seven-to-nine-month recovery.
Pittsburgh Pirates catcher Endy Rodriguez, whose career has run through a string of injuries, had his left hip labrum repaired by Dr. Thomas Byrd and will need roughly seven to nine months before resuming baseball activities.
Sources: Post-Gazette Pirates · ↑ top
Latest developments: A Post-Gazette breakdown August 26 named the specific jobs on the line in Thursday's finale against Buffalo, including an offensive-tackle battle between Dylan Cook and Max Iheanachor and continued reps for quarterbacks Drew Allar and Will Howard.
The Pittsburgh Steelers close the preseason Thursday against the Buffalo Bills with starting jobs and roster spots hanging on the game, offensive tackles Dylan Cook and Max Iheanachor among the players auditioning alongside young quarterbacks Drew Allar and Will Howard.
Sources: Post-Gazette Steelers · ↑ top
Latest developments: ESPN profiled August 26 the U.S. men's national team's brightest under-21 prospects bound for Europe, noting Zavier Gozo already left MLS for the Premier League at age 19.
With Zavier Gozo having moved from MLS to the Premier League at 19, ESPN identified the next wave of under-21 American players likely to head to European clubs, a pipeline feeding the United States men's national team as it prepares to co-host the 2026 World Cup.
Sources: ESPN Soccer · ↑ top
S&P 500 7,670.73 ▼ -1.1% Dow 53,298.77 ▼ -0.6% Nasdaq 26,142.04 ▼ -1.8% WTI crude 85.62 ▲ +2.8% EUR/USD 1.1677 ▲ +1.0% GBP/USD 1.3636 ▲ +0.8% USD/JPY 158.89 ▼ -0.3%