================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Wednesday, August 26, 2026 - 7:37 PM EDT ================================================================ The FBI dismantled China's QTFY proxy infrastructure that breached NASA, the Federal Reserve, and the Senate, as Iranian groups pressed water utilities and a wave of maximum-severity flaws surfaced. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] The FBI's seizure of China's QTFY proxy network and Group-IB's tracking of IRGC-linked Nimbus Manticore backdoors underscore Western pressure on rented state-hacker infrastructure. see: FBI Disrupts China's QTFY Proxy Infrastructure; Iranian Espionage and Water Utility Attacks Expand * [TREND] Microsoft flagged attackers abusing exposed LiteLLM gateways for credential theft and cryptomining, turning AI plumbing itself into the prize rather than just a route in. see: Attackers Target AI Gateways and Infrastructure * [UPDATE (new)] Ubiquiti, the Avada WordPress theme, and Kaltura all disclosed critical remote-code-execution flaws as NovaCookies phishing kits hijack authenticated Microsoft 365 sessions. see: Fresh Maximum-Severity Vulnerabilities Pile Up; New Phishing-as-a-Service Toolkits Harvest Sessions * [UPDATE (new)] Boston Scientific told the SEC a cyberattack knocked out IT systems and disrupted its shipment processes worldwide. see: Boston Scientific Cyberattack Disrupts Shipments * [TREND] Nvidia's record quarter cooled AI-spending fears even as skeptics sharpened their case in the AI Hater's Manifesto and debated whether models have gone rogue. see: Nvidia's Blowout Quarter Cools AI-Spending Fears; The AI Hater's Manifesto; Has AI Gone Rogue? * [TREND] Westmoreland County logged its first measles case even as its county fair winds down and a $45 million turnpike interchange advances without a start date. see: Measles Reaches Westmoreland County; Westmoreland Fair Winds Down Its Final Days; Westmoreland Turnpike Interchange Priced at $45 Million SECURITY ---------------------------------------------------------------- 1. FBI DISRUPTS CHINA'S QTFY PROXY INFRASTRUCTURE Nation-State Activity · [apt, nation-state, takedown] Latest developments: The Justice Department attributed the QScan and QTRouter platforms to QTFY, a Chinese state-sponsored group employed by Nanjing Xinjiuwei Network Technology Company, and named NASA among the victims alongside the Federal Reserve, the Senate, and the Justice Department. QScan and QTRouter let QTFY scan, infect, and route through IoT devices to reach US federal agencies and industries before the FBI seized the infrastructure. Organizations should patch exposed IoT devices and hunt for unexplained proxy traffic. - Wired Security: https://www.wired.com/story/fbi-disrupts-chinese-proxy-tools-used-in-mass-hacking-of-us-agencies-and-infrastructure/ - The Hacker News: https://thehackernews.com/2026/08/fbi-disrupts-china-linked-qtfy.html - The Record: https://therecord.media/qscan-qtrouter-us-takedown-alleged-china-hacking-tools - BleepingComputer: https://www.bleepingcomputer.com/news/security/fbi-disrupts-proxy-network-enabling-chinese-espionage-operations/ 2. FRESH MAXIMUM-SEVERITY VULNERABILITIES PILE UP Vulnerabilities and Exploits · [patch, rce, zero-day] Latest developments: Ubiquiti patched three maximum-severity flaws that unauthenticated attackers exploit remotely, the Avada WordPress theme disclosed a zero-click remote-code-execution chain, CERT/CC flagged two unpatched Kaltura mwEmbed deserialization bugs CVE-2026-19913 and CVE-2026-19912, researchers unveiled GPUThor, a Rowhammer attack that beats NVIDIA ECC protection for root access, and CISA added six actively exploited vulnerabilities to its catalog. New critical flaws span Ubiquiti gear, the Avada WordPress theme, Kaltura's video player, and NVIDIA GPUs, several unpatched or exploitable without authentication. Administrators should apply available patches promptly and pull vulnerable systems off the public internet. - BleepingComputer: https://www.bleepingcomputer.com/news/security/ubiquiti-patches-three-max-severity-security-vulnerabilities/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/critical-avada-wordpress-theme-flaw-enables-zero-click-rce/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/new-gputhor-attack-defeats-nvidia-ecc-protection-for-root-access/ - CISA Advisories: https://www.cisa.gov/news-events/alerts/2026/08/26/cisa-adds-six-known-exploited-vulnerabilities-catalog 3. IRANIAN ESPIONAGE AND WATER UTILITY ATTACKS EXPAND Nation-State Activity · [apt, critical-infrastructure, nation-state] Latest developments: Group-IB documented IRGC-linked Nimbus Manticore adding a TWOSTROKE-like backdoor and an SSH tunneler as it ranked among the most active Iranian groups of 2026, The Record tracked a separate Iranian group standing up fresh servers across Europe and the Middle East, and CISA reported attackers hit more than 100 internet-exposed water systems in July. Nimbus Manticore, tied to Iran's Islamic Revolutionary Guard Corps, runs espionage across the Middle East and Europe with new backdoors, while separate Iranian actors targeted US drinking-water systems. Water and infrastructure operators should cut internet exposure and follow CISA's new guidance. - The Hacker News: https://thehackernews.com/2026/08/nimbus-manticore-expands-toolset-with.html - The Record: https://therecord.media/iran-linked-hackers-expand-infrastructure-europe-middle-east - SecurityWeek: https://www.securityweek.com/cisa-over-100-internet-exposed-water-systems-targeted-in-july-cyberattacks/ 4. NEW PHISHING-AS-A-SERVICE TOOLKITS HARVEST SESSIONS Ransomware and Cybercrime · [phishing, credential-theft, cybercrime] Latest developments: Island detailed NovaCookies, a $320-a-month adversary-in-the-middle kit that abuses genuine Docusign notifications to hijack authenticated Microsoft 365 sessions, and Zimperium exposed scammers impersonating well-known companies' recruiters who use browser-in-the-browser overlays to steal corporate passwords on mobile. NovaCookies rents session-stealing adversary-in-the-middle phishing for $320 a month, and recruitment scammers deploy fake browser windows to capture corporate logins. Organizations should enforce phishing-resistant multifactor authentication and train staff to distrust unsolicited scheduling and signature prompts. - The Hacker News: https://thehackernews.com/2026/08/novacookies-campaigns-abuse-genuine.html - Dark Reading: https://www.darkreading.com/endpoint-security/novacookies-steals-microsoft-365-sessions-320-a-month - Help Net Security: https://www.helpnetsecurity.com/2026/08/26/recruitment-scam-corporate-passwords-mobile/ 5. ATTACKERS TARGET AI GATEWAYS AND INFRASTRUCTURE AI Security · [ai, cryptomining, cloud] Latest developments: Microsoft Threat Intelligence detailed attackers exploiting exposed LiteLLM gateways to harvest credentials, persist, and mine cryptocurrency, Wired pressed OpenAI over unanswered questions in its Hugging Face breach debrief, and the Linux Foundation took on TRACE, a hardware-backed runtime-attestation specification for AI agents from AMD, Intel, Microsoft, and OPAQUE. As organizations expose AI gateways and deploy autonomous agents, attackers hit the control plane itself for credentials and cryptomining while the industry builds attestation standards. Security teams should lock down and monitor AI gateways the way they treat any internet-facing service. - Microsoft Security Blog: https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/ - Wired Security: https://www.wired.com/story/openais-hugging-face-hack-debrief-raises-more-questions-than-it-answers/ - Help Net Security: https://www.helpnetsecurity.com/2026/08/26/the-linux-foundation-trace-ai-agent-security/ 6. BOSTON SCIENTIFIC CYBERATTACK DISRUPTS SHIPMENTS Data Breaches · [breach, healthcare] Latest developments: Boston Scientific told the SEC it discovered the intrusion Tuesday and said the attack knocked out IT systems and disrupted shipment processes worldwide. Medical-device maker Boston Scientific suffered a cyberattack that disrupted IT systems and product shipments globally and filed disclosure documents with the SEC. The company is working to restore operations. - The Record: https://therecord.media/boston-scientific-cyberattack-disrupts-shipment-processes - BleepingComputer: https://www.bleepingcomputer.com/news/security/boston-scientific-says-cyberattack-disrupted-operations-globally/ BUSINESS AND POLITICS ---------------------------------------------------------------- * Nvidia's Blowout Quarter Cools AI-Spending Fears Latest developments: Nvidia reported record quarterly sales of $96.2 billion after Wednesday's close and projected roughly 70% revenue growth next year, with its data-center division up 117% from a year earlier. Nvidia, the world's most valuable company and the bellwether of the artificial-intelligence buildout, told investors on August 26 that chip demand is accelerating, easing weeks of market anxiety over whether AI capital spending had peaked. - WSJ Markets: https://www.wsj.com/tech/nvidia-earnings-q2-2027-nvda-stock-8983c8d1?mod=rss_markets_main - FT Home: https://www.ft.com/content/72908915-5e4a-457c-8c3a-aee8917a664a?syn-25a6b1a6=1 * CIA Director Warns Russia Against Attacking NATO Latest developments: The Wall Street Journal reported August 26 that CIA Director John Ratcliffe's surprise Moscow trip this week carried a warning against striking NATO, prompted by new U.S. intelligence that President Vladimir Putin could launch a limited assault. John Ratcliffe made the first visit by a U.S. spy chief to Moscow since Russia's 2022 invasion of Ukraine, delivering a warning that Russia should not attack a NATO member after fresh American intelligence assessments flagged the risk of a limited Russian assault on the alliance. - WSJ World News: https://www.wsj.com/politics/policy/cia-chiefs-surprise-moscow-trip-was-to-warn-russia-not-to-attack-nato-c2d997f3?mod=rss_worldnews - FT World: https://www.ft.com/content/d7b89b34-8961-484d-b776-707520e942c5?syn-25a6b1a6=1 PITTSBURGH ---------------------------------------------------------------- Weather: Tonight: Partly Cloudy, low 63F. Thursday: Scattered Showers And Thunderstorms, high 83F. Thursday Night: Scattered Showers And Thunderstorms then Partly Cloudy, low 63F. Business: * Chatham University Hires Top Fundraiser Latest developments: Chatham University named Michael Braxton its new top fundraiser, TribLive reported August 26. Chatham University, the private school in Pittsburgh's Shadyside neighborhood, will look to Michael Braxton to grow philanthropic donations and community engagement, work he says the university can expand despite the financial pressures squeezing higher education. - TribLive: https://triblive.com/news/education-classroom/chatham-university-names-michael-braxton-new-top-fundraiser/ * Westmoreland Turnpike Interchange Priced at $45 Million Latest developments: WTAE reported August 26 that the planned interchange will cost about $45 million and take close to five years, though it still has no start date. The Pennsylvania Turnpike Commission's new interchange with State Route 981 in Mount Pleasant Township, Westmoreland County, which the commission recently added to its capital plan, now carries a roughly $45 million price tag and a five-year construction horizon. - WTAE: https://www.wtae.com/article/turnpike-interchange-project-westmoreland-county/73536200 Around town: * Measles Reaches Westmoreland County Latest developments: The Pennsylvania Department of Health confirmed Westmoreland County's first measles case of the year on August 26. Westmoreland County recorded its first measles case of 2026 as the statewide outbreak—already nearing 400 cases and responsible for two deaths in Lancaster County, Pennsylvania's first measles deaths since 1991—keeps spreading across the region. - WPXI: https://www.wpxi.com/news/local/pennsylvania-department-health-reports-first-case-measles-westmoreland-county-this-year/FREAXSBB5JAWXNIVT2S3OSNFHY/ - WTAE: https://www.wtae.com/article/westmoreland-county-confirms-1st-case-of-measles/73536584 * Pittsburgh International Auctions Lost-and-Found Items Latest developments: Pittsburgh International Airport's annual lost-and-found auction, run by Joe R. Pyle Auctions, held its preview August 26 at a warehouse in Washington, Pennsylvania. Items travelers left behind at Pittsburgh International Airport over the past year—an electric bicycle, knock-off Rolexes, a rice cooker, even vehicles—go up for bid in the airport's yearly auction, held by Joe R. Pyle Auctions at a Washington County warehouse. - KDKA: https://www.cbsnews.com/pittsburgh/news/pittsburgh-international-airport-lost-and-found-auction-2026/ - TribLive: https://triblive.com/local/regional/pittsburgh-international-bids-farewell-to-lost-and-found-items-at-annual-auction/ * Water Authority's Late Chemical Notice Draws Complaints Latest developments: The Wilkinsburg-Penn Joint Water Authority sent customers letters about a high chemical level found in one of its basins back in May, prompting complaints about the months-long delay, WPXI reported August 26. The Wilkinsburg-Penn Joint Water Authority notified customers only recently about an elevated chemical level detected in one of its water basins in May, and customers now want answers about why the warning took months to arrive. - WPXI: https://www.wpxi.com/news/local/local-water-authority-sends-letters-about-high-chemical-level-months-later-customers-want-answers/D7MJFFWMSBD6ZN2AFWGELBBXIU/ Events: * Strawberry Way Gets New Public Art Latest developments: TribLive reported August 26 that the colorful street painting on Downtown Pittsburgh's Strawberry Way will be replaced next month with a new design, with chances for the public to help paint it. Downtown Pittsburgh's Strawberry Way, the pedestrian lane known for the swirling multicolor art on its pavement, will get a fresh design next month, and organizers plan to invite the public to join the painting. - TribLive: https://triblive.com/local/new-art-installation-featuring-chances-for-public-to-paint-planned-for-downtowns-strawberry-way/ * Parks Conservancy Launches Youth Art Contest Latest developments: The Pittsburgh Parks Conservancy opened its inaugural Drawn to Nature Art Contest, inviting Allegheny County students to depict how they experience the natural world, TribLive reported August 26. The Pittsburgh Parks Conservancy's first Drawn to Nature Art Contest invites Allegheny County students to submit artwork showing how they experience the natural world. - TribLive: https://triblive.com/news/education-classroom/pittsburgh-parks-conservancy-hosts-allegheny-county-youth-art-contest/ * Westmoreland Fair Winds Down Its Final Days Latest developments: KDKA reported August 26 that the Westmoreland Fair has three days left, running through the weekend with a tractor-driving competition, grandstand events, and free entertainment. The Westmoreland Fair, the county's big annual gathering with a carnival, livestock shows, grandstand events, and free entertainment, enters its final three days as of Wednesday, August 26, fair vice president Randy Gillis said. - KDKA: https://www.cbsnews.com/pittsburgh/news/westmoreland-fair-2026-cost-time/ SPORTS ---------------------------------------------------------------- Around the Teams: * Pirates Lose Endy Rodriguez to Hip Surgery Latest developments: The Pirates said catcher Endy Rodriguez underwent season-ending surgery August 26 to repair the labrum in his left hip, with a seven-to-nine-month recovery. Pittsburgh Pirates catcher Endy Rodriguez, whose career has run through a string of injuries, had his left hip labrum repaired by Dr. Thomas Byrd and will need roughly seven to nine months before resuming baseball activities. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/08/26/pirates-endy-rodriguez-mlb-catcher-injury/stories/202608260036 * Roster Battles Headline Steelers' Preseason Finale Latest developments: A Post-Gazette breakdown August 26 named the specific jobs on the line in Thursday's finale against Buffalo, including an offensive-tackle battle between Dylan Cook and Max Iheanachor and continued reps for quarterbacks Drew Allar and Will Howard. The Pittsburgh Steelers close the preseason Thursday against the Buffalo Bills with starting jobs and roster spots hanging on the game, offensive tackles Dylan Cook and Max Iheanachor among the players auditioning alongside young quarterbacks Drew Allar and Will Howard. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/08/26/steelers-preseason-bills-dylan-cook-max-iheanachor-allar-howard/stories/202608260033 Team USA: * USMNT's Next U21 Prospects Eye Europe Latest developments: ESPN profiled August 26 the U.S. men's national team's brightest under-21 prospects bound for Europe, noting Zavier Gozo already left MLS for the Premier League at age 19. With Zavier Gozo having moved from MLS to the Premier League at 19, ESPN identified the next wave of under-21 American players likely to head to European clubs, a pipeline feeding the United States men's national team as it prepares to co-host the 2026 World Cup. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49724390/who-united-states-brightest-21-prospects-bound-europe READING ---------------------------------------------------------------- * Stratechery -- Apple Updates Mini and Studio, AI Computers, OpenAI Jalapeño Ben Thompson argues that Apple's refreshed Mini and Studio and OpenAI's separate hardware move are two very different bets that both add pressure on Nvidia. https://stratechery.com/2026/apple-updates-mini-and-studio-ai-computers-openai-jalapeno/ * Ed Zitron -- The AI Hater's Manifesto Zitron sets out a manifesto for AI skeptics, making the case against the industry's hype and its inflated economics. https://www.wheresyoured.at/the-ai-haters-manifesto/ * Cal Newport -- Has AI Gone Rogue? Newport weighs recent claims of AI models behaving unpredictably against the shakier financial reality of the AI labs chasing record-breaking IPOs. https://calnewport.com/has-ai-gone-rogue/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,670.73 ▼ -1.1% Dow 53,298.77 ▼ -0.6% Nasdaq 26,142.04 ▼ -1.8% WTI crude 85.62 ▲ +2.8% EUR/USD 1.1677 ▲ +1.0% GBP/USD 1.3636 ▲ +0.8% USD/JPY 158.89 ▼ -0.3% ================================================================ Generated 2026-08-26 19:37 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================