================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Thursday, August 27, 2026 - 7:06 AM EDT ================================================================ CISA flagged six actively exploited vulnerabilities led by a Citrix NetScaler flaw as Meta agreed to an $18 billion settlement over teen social media harms. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [UPDATE (new)] CISA added six actively exploited flaws to its Known Exploited Vulnerabilities catalog, led by the Citrix NetScaler memory-overflow bug CVE-2026-8452, with a August 29 federal patch deadline. see: Citrix NetScaler Flaw Joins Six-Bug KEV Wave * [TREND] Named crews struck government and critical targets, as Qilin claimed the ATF breach, pro-Russian Server Killers disrupted Norway's digital services, and Dark Caracal deployed GoCaracal in Venezuela. see: Qilin Ransomware Hits the ATF; Pro-Russian Server Killers Strike Norway; Dark Caracal Deploys GoCaracal in Venezuela * [UPDATE (new)] Meta agreed to a settlement worth up to $18 billion with 52 state and territory attorneys general over Facebook and Instagram designs built to hook teenagers. see: Meta's $18 Billion Teen-Safety Settlement * [TREND] Generative AI keeps underdelivering for attackers, as OpenAI dismantled a Cambodia-based ChatGPT scam network and Unit 42 found only 12 of 405 AI-linked malware samples workable. see: AI's Uneven Payoff for Attackers * [TREND] AI skeptics filled the Reading list, with Zitron's manifesto against the industry's economics, Newport doubting rogue-AI panic over shaky lab finances, and Thompson eyeing Nvidia pressure. see: The AI Hater's Manifesto; Has AI Gone Rogue?; Apple Updates Mini and Studio, AI Computers, OpenAI Jalapeño * [TREND] Federal-money strains squeezed Western Pennsylvania, as Troy Hill's ARPA-funded rec center stalled and a Head Start overhaul alarmed families, while RFK Jr. disputed Lancaster County measles deaths. see: Troy Hill Rec Center Stalled Five Years On; Head Start Overhaul Alarms Western Pa. Families; RFK Jr. Questions Pennsylvania Measles Deaths SECURITY ---------------------------------------------------------------- 1. CITRIX NETSCALER FLAW JOINS SIX-BUG KEV WAVE Vulnerabilities and Exploits · [patch, exploit] Latest developments: CISA added six actively exploited flaws to its Known Exploited Vulnerabilities catalog on August 26, 2026, led by Citrix NetScaler ADC and Gateway memory-overflow bug CVE-2026-8452, and gave federal agencies until August 29 to patch it, as attackers separately began exploiting a critical Gitea code-injection flaw and a Microsoft SharePoint remote-code-execution chain through public proof-of-concept code. The KEV additions also cover Microsoft SQL Server remote-code-execution flaw CVE-2019-1068 and Linux kernel privilege-escalation bugs; Citrix disclosed CVE-2026-8452 on June 30, 2026. Administrators running NetScaler, Gitea, or unpatched SharePoint should apply fixes immediately. - Help Net Security: https://www.helpnetsecurity.com/2026/08/27/netscaler-adc-gateway-cve-2026-8452/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/cisa-hackers-now-exploiting-citrix-netscaler-rce-flaw-in-attacks/ - The Hacker News: https://thehackernews.com/2026/08/cisa-adds-six-exploited-flaws-to-kev.html - BleepingComputer: https://www.bleepingcomputer.com/news/security/hackers-now-exploit-critical-gitea-flaw-in-code-injection-attacks/ 2. DARK CARACAL DEPLOYS GOCARACAL IN VENEZUELA Nation-State Activity · [apt, malware, espionage] Latest developments: Arctic Wolf tied a previously undocumented Go-based malware framework, GoCaracal, with medium confidence to the Dark Caracal espionage group, which deployed it during a June 2026 intrusion at a Venezuelan communications organization. GoCaracal hands operators remote shell access, payload execution, browser-data theft, keylogging, and remote desktop control, and pulls a replacement command-and-control address from an Ethereum smart contract to survive takedowns. - The Hacker News: https://thehackernews.com/2026/08/gocaracal-malware-uses-ethereum-smart.html - Dark Reading: https://www.darkreading.com/cyberattacks-data-breaches/dark-caracal-adds-new-malware-cyber-espionage-arsenal 3. AI'S UNEVEN PAYOFF FOR ATTACKERS AI Security · [ai, cybercrime] Latest developments: OpenAI disrupted a Cambodia-based network that ran romance, cryptocurrency, and spot-gold investment scams through ChatGPT, while Palo Alto Networks Unit 42 reported that of 405 AI-linked malware samples it analyzed, only 12 reached production endpoints. The findings show generative AI speeds attacker research, scripting, and persona-building while rarely lifting the success rate of the resulting malware. Defenders should weigh AI's operational reality against the marketing. - Schneier on Security: https://www.schneier.com/blog/archives/2026/08/llm-based-social-engineering-scams.html - SecurityWeek: https://www.securityweek.com/ai-speeds-up-malware-development-not-its-success-rate-analysis/ 4. QILIN RANSOMWARE HITS THE ATF Ransomware and Cybercrime · [ransomware, breach] Latest developments: The Bureau of Alcohol, Tobacco, Firearms and Explosives confirmed on August 27, 2026 that attackers compromised one of its systems, validating breach claims the Qilin ransomware gang posted days earlier. The ATF, which enforces US firearms and explosives law, called the intrusion a major incident. The agency has not detailed what data Qilin accessed. - BleepingComputer: https://www.bleepingcomputer.com/news/security/atf-confirms-major-incident-after-recent-qilin-breach-claims/ 5. PRO-RUSSIAN SERVER KILLERS STRIKE NORWAY Nation-State Activity · [hacktivism, nation-state] Latest developments: The pro-Russian hacker group Server Killers claimed responsibility for a major cyberattack that disrupted Norway's public digital services on August 27, 2026. The incident hit government-run online services Norwegian citizens rely on. Pro-Russian crews have steadily targeted European public infrastructure over Ukraine-related grievances. - SecurityWeek: https://www.securityweek.com/pro-russian-hackers-claim-responsibility-for-major-cyberattack-on-norways-public-digital-services/ 6. META'S $18 BILLION TEEN-SAFETY SETTLEMENT Policy and Regulation · [policy, privacy] Latest developments: Meta agreed on August 26, 2026 to a settlement worth up to about $18 billion with a bipartisan coalition of 52 state and territory attorneys general, resolving claims that it engineered Facebook and Instagram to hook children and teenagers on compulsive use. The deal, the largest of its kind, requires new privacy and safety protections across Meta's products for minors. Parents, regulators, and educators gain court-backed leverage over how the platforms treat young users. - The Record: https://therecord.media/meta-settlement-children-online-safety-social-media - BleepingComputer: https://www.bleepingcomputer.com/news/technology/meta-agrees-to-18-billion-settlement-over-teen-social-media-harms/ BUSINESS AND POLITICS ---------------------------------------------------------------- * European Sovereign Bonds Under Strain Latest developments: France has overtaken Italy as European bond investors' biggest worry, with Paris's borrowing costs holding above Rome's through the summer ahead of a contested budget and 2027 elections. Long-dated government debt in France, Italy, the United Kingdom, and Japan has drawn the heaviest selling pressure of the summer as investors reprice heavy debt loads, a strain that runs deeper abroad than in U.S. Treasurys and now tests finance ministries across the continent. - WSJ Markets: https://www.wsj.com/economy/global/think-treasurys-are-having-a-rough-summer-its-even-uglier-abroad-7224cf70?mod=rss_markets_main - FT World: https://www.ft.com/content/2b780776-d8f3-4bd3-9daa-f601b5d4206a?syn-25a6b1a6=1 PITTSBURGH ---------------------------------------------------------------- Weather: Today: Scattered Showers And Thunderstorms, high 83F. Tonight: Isolated Showers And Thunderstorms then Areas Of Fog, low 63F. Friday: Areas Of Fog then Mostly Sunny, high 83F. Business: * Pittsburgh and Ohio Cities Trade Places Latest developments: In an August 27 Post-Gazette column, Brandon McGinley argued that the relative economic fortunes of Pittsburgh and its Ohio peers—Cleveland, Cincinnati, and Columbus—may now be reversing. McGinley weighed job growth and economic development across the region, contending that Pittsburgh could be gaining ground on the three larger Ohio metros of Cleveland, Cincinnati, and Columbus. - Pittsburgh Post-Gazette: https://www.post-gazette.com/local/city/2026/08/27/ohio-economic-development-jobs-cleveland-cincinnati-columbus/stories/202608270003 * Rostraver Senior Housing Breaks Ground Latest developments: The Westmoreland County Housing Authority began construction August 27 on a low-income senior housing complex in Rostraver Township, targeting completion by next summer. The Westmoreland County Housing Authority's new low-income senior housing project in Rostraver Township, its next major construction undertaking, expects to open as soon as summer 2027 and adds another affordable-housing option for older residents. - TribLive: https://triblive.com/local/westmoreland/housing-authority-kicks-off-construction-of-rostraver-senior-housing-complex/ Around town: * RFK Jr. Questions Pennsylvania Measles Deaths Latest developments: Pennsylvania health officials said August 26 that a newborn from Lancaster County was one of the state's two measles-related deaths, as U.S. Health Secretary Robert F. Kennedy Jr. questioned whether those deaths were 'fabricated.' The two unvaccinated Lancaster County residents whose deaths the state tied to measles—its first such deaths since 1991—included a newborn baby, Pennsylvania health officials disclosed, drawing a public challenge from Health and Human Services Secretary Robert F. Kennedy Jr., who questioned whether the deaths were real. - TribLive: https://triblive.com/news/pennsylvania/newborn-baby-was-1-of-pa-s-2-measles-related-deaths-state-says-as-rfk-questions-whether-they-were-fabricated/ * Troy Hill Rec Center Stalled Five Years On Latest developments: PublicSource reported August 27 that Troy Hill's Cowley recreation center remains mothballed five years after a $6 million pledge, with the federal ARPA relief money meant to fund it now dwindled. Pittsburgh's Troy Hill neighborhood is still waiting for a promised recreation center at the shuttered Cowley building, five years after officials committed $6 million; the federal American Rescue Plan Act money intended to pay for it has run down, leaving the project unbuilt. - PublicSource: https://www.publicsource.org/troy-hill-cowley-rec-center-arpa-funding/ * Head Start Overhaul Alarms Western Pa. Families Latest developments: TribLive reported August 27 that Western Pennsylvania Head Start providers and parents are sounding the alarm over the Trump administration's proposed regulatory overhaul of the federal early-childhood program. Pittsburgh parent Lauren Stuparitz, who credits Head Start with transforming her neurodivergent son's development, joined Western Pennsylvania providers warning that the Trump administration's sweeping proposed rule changes threaten the future of the federal preschool program. - TribLive: https://triblive.com/local/regional/western-pa-head-start-providers-parents-sound-alarm-over-trump-administrations-proposed-program-overhaul/ Events: * Bruno Mars Headlines Weekend Concerts Latest developments: The Post-Gazette's August 27 weekend guide spotlights concerts by Bruno Mars and Clarks frontman Scott Blasey and the PedalPGH cycling ride among things to do around Pittsburgh this weekend. The Post-Gazette's roundup of the weekend of August 28-30 features a Bruno Mars concert, a show by Clarks frontman Scott Blasey, the PedalPGH community bike ride, and miniature golf among Pittsburgh-area outings. - Pittsburgh Post-Gazette: https://www.post-gazette.com/life/recreation/2026/08/27/yinz-out-things-to-do-in-and-around-pittsburgh-this-weekend/stories/202608240032 SPORTS ---------------------------------------------------------------- Around the Teams: * Roethlisberger Talks Preseason Reality Check Latest developments: On episode 136 of 'Footbahlin with Ben Roethlisberger,' released August 25, Ben Roethlisberger worked through the Steelers' second preseason game against the New York Jets and what actually matters afterward. Ben Roethlisberger used his 'Footbahlin' podcast to caution that a bad preseason box score, such as the Steelers' showing against the New York Jets, says little about the regular season, sorting the good from the bad while plugging Mel Blount's youth-home golf tournament. - Footbahlin with Ben Roethlisberger: https://www.buzzsprout.com/2062616/episodes/19699821-big-ben-talks-preseason-reality-check-the-good-and-the-bad-from-week-2-vs-the-jets-ep-136.mp3 * Kuntz and Boswell Take Over Heyward Podcast Latest developments: Cam Heyward's 'Not Just Football' released a training-camp episode August 26 with long snapper Christian Kuntz guest-hosting alongside kicker Chris Boswell and Heyward. In the latest 'Not Just Football' training-camp episode, Steelers long snapper Christian Kuntz took over hosting duties and drew in kicker Chris Boswell and host Cam Heyward for what the show billed its wildest installment yet. - Not Just Football with Cam Heyward: https://www.youtube.com/watch?v=j9KEDydyPqs Team USA: * Alysa Liu Sits Out Figure Skating Season Latest developments: Olympic champion Alysa Liu announced August 25 that she will skip the 2026-27 figure skating season to 'recalibrate,' planning to return in 2027-28. American figure skater Alysa Liu, an Olympic gold medalist, said she will take the coming 2026-27 season off to recalibrate and intends to compete again in the 2027-28 season. - ESPN Olympics: https://www.espn.com/olympics/story/_/id/49726515/alysa-liu-skipping-26-27-skating-season-recalibrate READING ---------------------------------------------------------------- * Stratechery -- Apple Updates Mini and Studio, AI Computers, OpenAI Jalapeño Ben Thompson argues that Apple's refreshed Mac mini and Studio and OpenAI's new hardware, though completely different announcements, both amount to competitive pressure on Nvidia. https://stratechery.com/2026/apple-updates-mini-and-studio-ai-computers-openai-jalapeno/ * Ed Zitron -- The AI Hater's Manifesto Zitron lays out a sweeping case against the AI industry's hype and economics, a manifesto for skeptics of the technology's claimed value. https://www.wheresyoured.at/the-ai-haters-manifesto/ * Cal Newport -- Has AI Gone Rogue? Newport contends the real AI story of the summer is the shaky financial position of the labs chasing record IPOs, weighing that against alarmist 'rogue AI' headlines. https://calnewport.com/has-ai-gone-rogue/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,664.27 ▼ -1.1% Dow 53,298.93 ▼ -0.5% Nasdaq 26,101.86 ▼ -1.7% WTI crude 84.90 ▲ +1.3% EUR/USD 1.1677 ▲ +1.0% GBP/USD 1.3636 ▲ +0.8% USD/JPY 158.89 ▼ -0.3% ================================================================ Generated 2026-08-27 07:06 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================