================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Thursday, August 27, 2026 - 1:35 PM EDT ================================================================ Two Australians face charges as the alleged core of TeamPCP's record software supply-chain spree, while zero-days in PaperCut and Citrix NetScaler and a Qilin breach of the ATF keep defenders scrambling. CONTENTS: Emerging Trends and Key Updates | Security | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Poisoned open-source scanners landed TeamPCP suspects in an Australian court while researchers found Claude, Codex, and Hermes recommending installs for unowned packages. see: TeamPCP Supply-Chain Hackers Charged in Australia; AI Coding Assistants Open New Attack Paths * [UPDATE (new)] Attackers are exploiting every PaperCut NG and MF print server while CISA added Citrix NetScaler bug CVE-2026-8452 to its Known Exploited Vulnerabilities catalog. see: Zero-Days Hit PaperCut and NetScaler * [TREND] Nation-state pressure mounted as Chinese and Russian services targeted German firms, Qilin ransomware breached the ATF, and Trump's order hunted foreign grid backdoors. see: Chinese and Russian State Threats Broaden; Qilin Ransomware Breaches the ATF; Trump Order Targets Foreign Backdoors in Grid Gear * [TREND] AI skepticism dominated the Reading list as Ed Zitron's manifesto, Cal Newport's rogue-AI reckoning, and Ben Thompson's Nvidia read all questioned the boom. see: The AI Hater's Manifesto; Has AI Gone Rogue?; Apple Updates Mini and Studio, AI Computers, OpenAI Jalapeño * [UPDATE (new)] Around town the Steelers restructured DK Metcalf's contract for cap space and American Airlines plotted one-stop international routes through Pittsburgh International. see: Steelers Restructure DK Metcalf's Contract for Cap Space; American Airlines Plans International Flights Through Pittsburgh SECURITY ---------------------------------------------------------------- 1. TEAMPCP SUPPLY-CHAIN HACKERS CHARGED IN AUSTRALIA Ransomware and Cybercrime · [supply-chain, arrest] Latest developments: The Australian Federal Police, the FBI, and Western Australia Police tied Louis Michael Gaebler, 23, of Mandurah and Ruben Ian Thomson, 21, of Cottesloe to the March 2026 poisoning of the open-source scanners Trivy and Checkmarx KICS and the LiteLLM AI gateway, which Krebs called the longest-running software supply-chain spree on record. TeamPCP planted malicious code in widely used open-source developer tools and rode it into organizations worldwide; the two men face 14 combined offences in Perth Magistrates Court after their August 26, 2026 arrest. - Krebs on Security: https://krebsonsecurity.com/2026/08/two-alleged-teampcp-hackers-arrested-in-australia/ - The Hacker News: https://thehackernews.com/2026/08/alleged-teampcp-hackers-charged-in.html - BleepingComputer: https://www.bleepingcomputer.com/news/security/australia-arrests-alleged-teampcp-hackers-behind-supply-chain-attacks/ - Help Net Security: https://www.helpnetsecurity.com/2026/08/27/alleged-teampcp-hackers-arrested-australia/ 2. ZERO-DAYS HIT PAPERCUT AND NETSCALER Vulnerabilities and Exploits · [zero-day, patch, kev] Latest developments: PaperCut confirmed attackers are exploiting an unspecified flaw in every version of its NG and MF print servers, while CISA added Citrix NetScaler ADC and Gateway bug CVE-2026-8452 to its Known Exploited Vulnerabilities catalog and ordered federal agencies to patch by August 29, 2026, one of six flaws it flagged as actively exploited. Two enterprise mainstays fell under live attack the same day; separately, Vercel patched two critical unauthenticated remote-code-execution holes in Next.js, one via crafted AVIF images and one, CVE-2026-75604, through Windows path traversal. Patch immediately. - BleepingComputer: https://www.bleepingcomputer.com/news/security/papercut-warns-of-ng-mf-flaw-exploited-in-zero-day-attacks/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/cisa-hackers-now-exploiting-citrix-netscaler-rce-flaw-in-attacks/ - The Hacker News: https://thehackernews.com/2026/08/cisa-adds-six-exploited-flaws-to-kev.html - The Hacker News: https://thehackernews.com/2026/08/nextjs-patches-critical-avif-and.html 3. CHINESE AND RUSSIAN STATE THREATS BROADEN Nation-State Activity · [apt, nation-state, espionage] Latest developments: A new survey of Germany's private sector found foreign intelligence services, mostly Chinese and Russian, increasingly behind attacks on German companies, as the pro-Russian group Server Killers claimed a major hit on Norway's public digital services and US prosecutors charged student Weiheng Zeng with photographing American aircraft for a suspected Chinese official. The activity spans espionage, sabotage, and disruption against Europe and the United States; separately, a Finnish appeals court revived the case against officers of the tanker Eagle S over Baltic undersea cable breaks. - The Record: https://therecord.media/germany-cyberattacks-china-russia - SecurityWeek: https://www.securityweek.com/pro-russian-hackers-claim-responsibility-for-major-cyberattack-on-norways-public-digital-services/ - 404 Media: https://www.404media.co/a-student-said-he-was-a-hobby-plane-spotter-he-was-allegedly-taking-photos-for-the-chinese-government/ - The Record: https://therecord.media/finland-appeals-court-revives-case-against-eagle-s 4. QILIN RANSOMWARE BREACHES THE ATF Ransomware and Cybercrime · [ransomware, breach] Latest developments: The Bureau of Alcohol, Tobacco, Firearms and Explosives confirmed a major incident after the Qilin ransomware gang claimed it breached a system holding information on the agency's investigation targets. Qilin runs a prolific ransomware-and-extortion operation; the ATF enforces US firearms and explosives law, and a breach of its case systems could expose confidential investigation targets. The agency is investigating. - The Record: https://therecord.media/doj-atf-cyberattack-qilin-ransomware - BleepingComputer: https://www.bleepingcomputer.com/news/security/atf-confirms-major-incident-after-recent-qilin-breach-claims/ 5. AI CODING ASSISTANTS OPEN NEW ATTACK PATHS AI Security · [ai, supply-chain, prompt-injection] Latest developments: Researchers counted 227 install commands in corporate documentation pointing at packages nobody owns, recommended by Claude, Codex, and Hermes and open to attacker registration, while Mindguard showed Amazon's Kiro IDE could be tricked through prompt injection to exfiltrate data via Kiro Powers. AI coding assistants that suggest package installs and act on untrusted input hand attackers fresh footholds inside developer environments; teams should audit generated install commands and restrict agent permissions. - Ars Technica Security: https://arstechnica.com/security/2026/08/claude-codex-and-hermes-installed-unowned-code-inside-corporate-networks/ - The Hacker News: https://thehackernews.com/2026/08/amazon-kiro-prompt-injection-can.html 6. TRUMP ORDER TARGETS FOREIGN BACKDOORS IN GRID GEAR Policy and Regulation · [policy, ics, critical-infrastructure] Latest developments: President Trump signed executive order 14420, which widens federal scrutiny of industrial control systems in the US power grid over fears that foreign-made equipment could conceal sabotage backdoors. The order directs agencies to vet industrial control systems and grid components for hidden foreign access, extending earlier supply-chain security efforts across the power sector. - SecurityWeek: https://www.securityweek.com/trump-order-aims-to-block-foreign-backdoors-in-us-power-grid-gear/ PITTSBURGH ---------------------------------------------------------------- Weather: This Afternoon: Slight Chance Showers And Thunderstorms, high 83F. Tonight: Chance Showers And Thunderstorms then Patchy Fog, low 64F. Friday: Patchy Fog then Mostly Sunny, high 82F. Business: * American Airlines Plans International Flights Through Pittsburgh Latest developments: American Airlines announced August 27 new one-stop international routes flying through Pittsburgh International Airport beginning summer 2027. American Airlines will give Pittsburgh International Airport travelers one-stop connections to overseas destinations starting in summer 2027, widening the airport's international reach. - WPXI: https://www.wpxi.com/news/local/american-airlines-adds-new-1-stop-international-flights-through-pittsburgh-airport-summer-2027/PEUBH46T7ZAULBL2FTTFDJCCKE/ * Butler County Liquor Licenses Grow Scarce and Costly Latest developments: WPXI reported August 27 that grocers opening new Butler County stores keep colliding with the steep cost and scarcity of the county's liquor licenses. Grocers such as Gary Sippel find liquor licenses in Butler County both rare and expensive, a squeeze that dictates which new stores can sell beer and wine. - WPXI: https://www.wpxi.com/news/local/new-grocery-stores-highlight-cost-scarcity-butler-county-liquor-licenses/NHE6734PFNA4LF4RKWYIAJZIJU/ * Ascender Names Anneliese Martinez Executive Director Latest developments: Ascender, the East Liberty business incubator, named Anneliese Martinez its executive director August 27, six months after its former chief executive stepped down. Ascender, a nonprofit business incubator in Pittsburgh's East Liberty neighborhood, hired Anneliese Martinez as executive director, filling a post left empty for half a year. - WPXI: https://www.wpxi.com/news/local/east-liberty-nonprofit-ascender-names-new-executive-director/4FQ2YJPD5BA5XIUE4YZY5EY2ZY/ Around town: * Steel Center Technical School Reopens After $36M Overhaul Latest developments: State and local leaders marked the grand reopening August 27 of the renovated Steel Center for Career and Technical Education in Jefferson Hills after three years of work. The Steel Center for Career and Technical Education in Jefferson Hills finished a $36 million renovation, adding classrooms and programs for more than 1,000 Mon Valley students drawn from 11 school districts, and welcomes them back next week. - WPXI: https://www.wpxi.com/news/local/steel-center-technical-school-reopens-jefferson-hills-following-36m-makeover/Z5V53MXVVJB5JN4INQJZGR3LJA/ * Allegheny County Bans Balloons in All Nine Parks Latest developments: Allegheny County imposed an immediate ban on balloons across all nine of its county parks, WPXI reported August 27. Allegheny County barred balloons from all nine county parks under a policy that took effect immediately. - WPXI: https://www.wpxi.com/news/local/allegheny-county-bans-balloons-all-9-parks/56O6CPH47RFB5GQ72PTQRW3CQE/ * Lancaster Coroner Disputes State's Measles Death Count Latest developments: The Lancaster County coroner said August 27 his office has confirmed no measles-associated deaths, contradicting the Pennsylvania Department of Health's report of two. The Pennsylvania Department of Health said two people in Lancaster County died of causes associated with measles, the state's first such deaths since 1991, while Lancaster County's coroner countered that his office has confirmed none, opening a public rift over the count. - TribLive: https://triblive.com/news/pennsylvania/lancaster-county-coroner-contradicts-state-health-department-on-measles-related-deaths/ Events: * Kickoff and Rib Festival Returns to the North Shore Latest developments: Acrisure Stadium announced August 27 that its annual Kickoff and Rib Festival runs Thursday, September 3, through Monday, September 7, on Pittsburgh's North Shore. The Acrisure Stadium Kickoff and Rib Festival brings national barbecue pitmasters, live music, and Pitt football's first home game to Pittsburgh's North Shore over Labor Day weekend, running Thursday, September 3, through Monday, September 7, 2026. - KDKA: https://www.cbsnews.com/pittsburgh/news/2026-acrisure-stadium-ribfest-pittsburgh/ * The Frick Builds September Around French Moderns Latest developments: Pittsburgh Magazine detailed August 27 the September lineup at The Frick Pittsburgh, built around its French Moderns exhibition. The Frick Pittsburgh in Point Breeze centers its September programming on French Moderns: Matisse/Renoir/Degas, on view through October 1, with guided tours and activities across the museum and gardens. - Pittsburgh Magazine: https://www.pittsburghmagazine.com/here-are-all-the-events-happening-this-september-at-the-frick/ * Weekend Guide Spotlights Bruno Mars and PedalPGH Latest developments: The Post-Gazette's August 27 weekend roundup features Bruno Mars and Scott Blasey concerts, the PedalPGH bike ride, and miniature golf among things to do around Pittsburgh this weekend. The Post-Gazette's weekend guide points Pittsburghers toward concerts by Bruno Mars and the Clarks singer Scott Blasey, the PedalPGH cycling ride, and miniature golf for the weekend of August 28 to 30, 2026. - Post-Gazette Music: https://www.post-gazette.com/life/recreation/2026/08/27/yinz-out-things-to-do-in-and-around-pittsburgh-this-weekend/stories/202608240032 SPORTS ---------------------------------------------------------------- Around the Teams: * Steelers Restructure DK Metcalf's Contract for Cap Space Latest developments: The Steelers restructured receiver DK Metcalf's contract August 27, converting base salary into a signing bonus and freeing nearly $18 million in 2026 cap space. The Pittsburgh Steelers reworked DK Metcalf's deal to create almost $18 million in 2026 salary-cap room, a move the Post-Gazette and NFL insider Field Yates reported as the team clears space ahead of the season. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/08/27/dk-metcalf-contract-cap-space-restructure/stories/202608270042 * Boswell and Kuntz Take Over Cam Heyward's Podcast Latest developments: Cam Heyward's 'Not Just Football' released a training-camp episode August 26 with long snapper Christian Kuntz hosting alongside kicker Chris Boswell. On Cam Heyward's 'Not Just Football' podcast, Steelers long snapper Christian Kuntz took over hosting for a training-camp episode joined by kicker Chris Boswell and Heyward, turning the focus to the specialists' room. - Not Just Football with Cam Heyward: https://www.youtube.com/watch?v=j9KEDydyPqs Team USA: * Alysa Liu Sits Out the Figure Skating Season Latest developments: Olympic gold medalist Alysa Liu announced she will skip the 2026-27 figure skating season to recalibrate and plans a return in 2027-28. American figure skater Alysa Liu, an Olympic gold medalist, will take the 2026-27 season off to recalibrate, telling ESPN she intends to return for 2027-28. - ESPN Olympics: https://www.espn.com/olympics/story/_/id/49726515/alysa-liu-skipping-26-27-skating-season-recalibrate * Julian Hall Re-Signs With the New York Red Bulls Latest developments: The New York Red Bulls announced striker Julian Hall signed a new four-year contract. The New York Red Bulls of Major League Soccer locked up American teenage striker Julian Hall, a United States youth international, to a four-year deal. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49742361/julian-hall-signs-new-four-year-deal-new-york-red-bulls READING ---------------------------------------------------------------- * Stratechery -- Apple Updates Mini and Studio, AI Computers, OpenAI Jalapeño Ben Thompson argues Apple's refreshed Mac mini and Studio and OpenAI's own hardware push both amount to fresh pressure on Nvidia. https://stratechery.com/2026/apple-updates-mini-and-studio-ai-computers-openai-jalapeno/ * Ed Zitron -- The AI Hater's Manifesto Ed Zitron lays out a sweeping case against the AI industry's hype, shaky economics, and its boosters. https://www.wheresyoured.at/the-ai-haters-manifesto/ * Cal Newport -- Has AI Gone Rogue? Cal Newport weighs the summer's alarming AI anecdotes against what he sees as the shakier financial reality facing the leading AI labs eyeing record IPOs. https://calnewport.com/has-ai-gone-rogue/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,664.27 ▼ -1.1% Dow 53,298.93 ▼ -0.5% Nasdaq 26,101.86 ▼ -1.7% WTI crude 84.90 ▲ +1.3% EUR/USD 1.1677 ▲ +1.0% GBP/USD 1.3636 ▲ +0.8% USD/JPY 158.89 ▼ -0.3% ================================================================ Generated 2026-08-27 13:35 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================