daily plain-text briefing: security, markets, business, and pittsburgh
Australian police charged two alleged TeamPCP members over the longest-running open-source supply-chain spree as PaperCut disclosed an actively exploited zero-day and the White House moved to bar foreign-made power-grid gear.
Latest developments: The Australian Federal Police, working with the FBI and Western Australia Police Force, arrested Louis Michael Gaebler, 23, of Mandurah and Ruben Ian Thomson, 21, of Cottesloe, who appeared in Perth Magistrates Court on August 27, 2026 facing 14 combined offences over TeamPCP, the group tied to the Shai-Hulud worm, roughly 500,000 stolen credentials, and the March 2026 compromise of the Trivy and Checkmarx KICS scanners and the LiteLLM AI gateway.
TeamPCP planted malicious code in open-source software, then rode a self-propagating worm to breach more than 1,000 organizations worldwide, including OpenAI. Developers should audit dependencies and rotate exposed credentials.
Sources: Krebs on Security · The Hacker News · Graham Cluley · The Record · ↑ top
Latest developments: PaperCut warned that attackers are actively exploiting an unassigned zero-day affecting every version of its PaperCut NG and PaperCut MF print-management software, and it shipped an emergency patch for v25 and v26 while citing confirmed customer incidents it treats with the highest priority.
PaperCut NG and MF run printing for offices, schools, and other organizations, making the flaw a broad exposure. Administrators should apply the emergency patch and interim mitigations immediately.
Sources: The Hacker News · SecurityWeek · BleepingComputer · Help Net Security · ↑ top
Latest developments: New records show the Alpharetta, Georgia police sharing Flock automated license-plate reader data with more than 2,000 organizations, from federal agencies to a fish and wildlife commission, while separate investigations caught a Georgia officer querying the system to track his ex-lover and a Florida sheriff's deputy using it to stalk his ex.
Flock's license-plate reader network links thousands of agencies and lets individual officers trace vehicle movements nationwide. The cases show thin oversight of mass surveillance data and its misuse.
Sources: Wired Security · Wired Security · 404 Media · ↑ top
Latest developments: ServiceNow patched three maximum-severity AI Platform vulnerabilities that enable code injection, SQL injection, and privilege escalation, and cPanel fixed critical CVE-2026-65643 in domain-parking and addon-domain handling, a flaw that lets one hosting customer execute code as root across all supported cPanel and WHM versions.
Both bugs hand attackers deep control, whole servers for cPanel hosts and enterprise workflows for ServiceNow. Administrators should apply the vendor patches now.
Sources: BleepingComputer · The Hacker News · ↑ top
Latest developments: Recorded Future's Insikt Group tied a previously undocumented lightweight Windows batch-script backdoor called HOOKEDGE to Russia's APT28, deployed against government and diplomatic organizations in Romania, Spain, and Türkiye between late September 2025 and early April 2026, as a new survey found German companies reporting a rise in Chinese and Russian intrusions.
APT28, linked to Russian military intelligence, keeps expanding its European espionage toolkit. Government and diplomatic bodies should hunt for the batch-script implant and tighten monitoring.
Sources: The Hacker News · The Record · ↑ top
Latest developments: President Trump signed executive order 14420 banning federal acquisition of foreign-made components used to generate and manage electricity, widening scrutiny of industrial control systems on the claim that certain foreign actors increasingly create and exploit vulnerabilities in the technology.
The order targets bulk-power-system hardware over fears of embedded backdoors that enable cyber sabotage. Utilities and their suppliers face new sourcing restrictions on grid equipment.
Sources: The Record · SecurityWeek · ↑ top
Latest developments: Federal Reserve Chairman Kevin Warsh delivers his first Jackson Hole keynote at 10 a.m. Eastern today as global bond yields climb and Germany's 10-year Bund hits a 15-year high.
Kevin Warsh, in his debut as Federal Reserve chairman, addresses the Kansas City Fed's Jackson Hole symposium under pressure from rising Treasury yields, elevated energy prices tied to the Iran war, and Fed officials warning on inflation; the 10-year Bund yield reached a 15-year high hours before he spoke.
Sources: WSJ Markets · WSJ Markets · ↑ top
Today: Patchy Fog then Mostly Sunny, high 81F.
Tonight: Mostly Clear, low 57F.
Saturday: Sunny, high 83F.
Latest developments: The Post-Gazette reported August 28 that Pittsburgh wealth manager DBR is moving into the Aspen, Colorado, market.
DBR, a Pittsburgh wealth management firm, is setting its sights on Colorado with an expansion into Aspen, pushing its business beyond Western Pennsylvania.
Sources: Pittsburgh Post-Gazette · ↑ top
Latest developments: TribLive reported August 28 that developers want the former state prison property for warehouse space and Hempfield officials are weighing a rezoning.
As demolition wraps at the former State Correctional Institution Greensburg, developers have expressed interest in building warehouses on the site, and Hempfield Township officials are looking at changing the zoning rules to allow it.
Latest developments: West Mifflin Area School District and its new contractor Krise Transportation met parents at the first of three town halls Thursday, August 27, where frustration ran high.
West Mifflin Area School District's school year opened with chronic bus delays; parents say the district sends them to newly hired contractor Krise Transportation, which draws the routes, and they left Thursday's meeting without clear answers.
Latest developments: Big Beaver residents packed another meeting Thursday, August 27, to oppose a data center proposed for a former racetrack in Beaver County.
A developer wants to convert a former racetrack in Big Beaver, Beaver County, into a data center, and neighbors have turned out at repeated meetings to make clear they oppose the plan.
Latest developments: The Borough of Churchill held a groundbreaking August 27 for the Blackridge Community All-Inclusive Playground.
Churchill Borough broke ground on the Blackridge Community All-Inclusive Playground, an accessible play space in the eastern Allegheny County suburb.
Latest developments: The Post-Gazette's August 27 weekend guide for August 28-30 spotlights a Bruno Mars concert, a Scott Blasey performance, the PedalPGH ride, and miniature golf.
The Post-Gazette's things-to-do roundup for the weekend of August 28-30 highlights a Bruno Mars concert, a solo show by The Clarks' Scott Blasey, the citywide PedalPGH cycling event, and miniature golf around Pittsburgh.
Sources: Post-Gazette Music · ↑ top
Latest developments: TribLive reported August 28 that the Audubon Society will host fall migration-watching events in Fox Chapel and Buffalo Township over the coming weeks.
The Audubon Society is marking the annual fall bird migration with events in Fox Chapel and Buffalo Township, where enthusiasts can track warblers, hawks, and ruby-throated hummingbirds heading south.
Latest developments: The Steelers created about $18 million in salary cap space August 27 by restructuring wide receiver DK Metcalf's contract.
Pittsburgh reworked receiver DK Metcalf's contract to open roughly $18 million in cap room, handing general manager Omar Khan added flexibility heading into the regular season.
Sources: Post-Gazette Steelers · ↑ top
Latest developments: On Cam Heyward's 'Not Just Football' training-camp episode released August 28, tackles Broderick Jones and Troy Fautanu broke down Mike McCarthy's new pass-heavy offense.
Steelers offensive tackles Broderick Jones and Troy Fautanu joined Cam Heyward on 'Not Just Football' to discuss coach Mike McCarthy's pass-heavy scheme, blocking for quarterback Aaron Rodgers, and life in the offensive-line room.
Sources: Not Just Football with Cam Heyward · ↑ top
Latest developments: ESPN profiled August 28 how U.S. men's national team defender Chris Richards is processing the Americans' abrupt 2026 World Cup exit while returning to Crystal Palace.
Chris Richards, the USMNT center back who plays for Crystal Palace, called this home World Cup a lifelong dream; its early end left him little time to grieve before rejoining the Premier League grind.
Sources: ESPN Soccer · ↑ top
Latest developments: Olympic gold medalist Alysa Liu announced August 26 she will skip the 2026-27 figure skating season to recalibrate and plans to return in 2027-28.
Alysa Liu, the American figure skater who won Olympic gold, is stepping away for the 2026-27 season to recalibrate, aiming to return to competition for 2027-28.
Sources: ESPN Olympics · ↑ top
S&P 500 7,682.24 ▼ -0.4% Dow 53,460.98 ▲ +0.2% Nasdaq 26,196.70 ▼ -0.8% WTI crude 84.04 ▼ -1.2% EUR/USD 1.1673 ▲ +0.7% GBP/USD 1.3636 ▲ +0.7% USD/JPY 159.08 ▼ -0.1%