================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Friday, August 28, 2026 - 7:05 AM EDT ================================================================ Australian police charged two alleged TeamPCP members over the longest-running open-source supply-chain spree as PaperCut disclosed an actively exploited zero-day and the White House moved to bar foreign-made power-grid gear. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Attackers are actively exploiting a PaperCut print-server zero-day while ServiceNow and cPanel rush fixes for maximum-severity code-injection and privilege-escalation flaws. see: PaperCut NG/MF Zero-Day Under Active Attack; Max-Severity Flaws in ServiceNow and cPanel * [TREND] Russia's APT28 deployed the new HOOKEDGE backdoor against European governments as Trump banned foreign-made power-grid gear over fears of hidden backdoors in critical hardware. see: APT28 HOOKEDGE Backdoor Hits European Governments; Trump Bans Foreign-Made Power-Grid Gear * [UPDATE (new)] Australian Federal Police, the FBI, and Western Australia forces charged two men over TeamPCP, the crew behind the longest-running open-source supply-chain campaign. see: TeamPCP Supply-Chain Hackers Charged in Australia * [TREND] Alpharetta, Georgia police shared Flock license-plate data with over 2,000 organizations while officers weaponized the network to stalk exes, exposing unchecked vehicle surveillance. see: Flock Surveillance Network Abused by Police * [TREND] Ed Zitron's anti-AI manifesto, Cal Newport's rogue-AI question, and Ben Thompson framing Apple and OpenAI hardware as Nvidia pressure headline the day's AI skepticism. see: The AI Hater's Manifesto; Has AI Gone Rogue?; Apple Updates Mini and Studio, AI Computers, OpenAI Jalapeño * [TREND] Around town, Big Beaver residents packed a meeting to fight a racetrack data center while West Mifflin parents vented over new busing contractor Krise Transportation. see: Big Beaver Fights Racetrack Data Center; West Mifflin Busing Town Hall SECURITY ---------------------------------------------------------------- 1. TEAMPCP SUPPLY-CHAIN HACKERS CHARGED IN AUSTRALIA Ransomware and Cybercrime · [supply-chain, arrest, breach] Latest developments: The Australian Federal Police, working with the FBI and Western Australia Police Force, arrested Louis Michael Gaebler, 23, of Mandurah and Ruben Ian Thomson, 21, of Cottesloe, who appeared in Perth Magistrates Court on August 27, 2026 facing 14 combined offences over TeamPCP, the group tied to the Shai-Hulud worm, roughly 500,000 stolen credentials, and the March 2026 compromise of the Trivy and Checkmarx KICS scanners and the LiteLLM AI gateway. TeamPCP planted malicious code in open-source software, then rode a self-propagating worm to breach more than 1,000 organizations worldwide, including OpenAI. Developers should audit dependencies and rotate exposed credentials. - Krebs on Security: https://krebsonsecurity.com/2026/08/two-alleged-teampcp-hackers-arrested-in-australia/ - The Hacker News: https://thehackernews.com/2026/08/alleged-teampcp-hackers-charged-in.html - Graham Cluley: https://www.bitdefender.com/en-us/blog/hotforsecurity/shai-hulud-hackers-charged-teampcps - The Record: https://therecord.media/australia-teampcp-hackers-arrested 2. PAPERCUT NG/MF ZERO-DAY UNDER ACTIVE ATTACK Vulnerabilities and Exploits · [zero-day, patch, rce] Latest developments: PaperCut warned that attackers are actively exploiting an unassigned zero-day affecting every version of its PaperCut NG and PaperCut MF print-management software, and it shipped an emergency patch for v25 and v26 while citing confirmed customer incidents it treats with the highest priority. PaperCut NG and MF run printing for offices, schools, and other organizations, making the flaw a broad exposure. Administrators should apply the emergency patch and interim mitigations immediately. - The Hacker News: https://thehackernews.com/2026/08/papercut-zero-day-exploited-in-attacks.html - SecurityWeek: https://www.securityweek.com/papercut-releases-emergency-patch-for-exploited-zero-day/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/papercut-warns-of-ng-mf-flaw-exploited-in-zero-day-attacks/ - Help Net Security: https://www.helpnetsecurity.com/2026/08/27/papercut-ng-mf-vulnerability-attack/ 3. FLOCK SURVEILLANCE NETWORK ABUSED BY POLICE Surveillance and Privacy · [surveillance, privacy, policy] Latest developments: New records show the Alpharetta, Georgia police sharing Flock automated license-plate reader data with more than 2,000 organizations, from federal agencies to a fish and wildlife commission, while separate investigations caught a Georgia officer querying the system to track his ex-lover and a Florida sheriff's deputy using it to stalk his ex. Flock's license-plate reader network links thousands of agencies and lets individual officers trace vehicle movements nationwide. The cases show thin oversight of mass surveillance data and its misuse. - Wired Security: https://www.wired.com/story/how-an-atlanta-suburb-ended-up-sharing-flock-data-with-more-than-2000-organizations/ - Wired Security: https://www.wired.com/story/a-georgia-cop-used-flock-to-track-2-other-cops-his-ex-and-her-friend/ - 404 Media: https://www.404media.co/florida-deputy-of-the-year-used-flock-to-stalk-ex-held-gun-in-her-mouth-did-a-nazi-salute/ 4. MAX-SEVERITY FLAWS IN SERVICENOW AND CPANEL Vulnerabilities and Exploits · [patch, rce, privilege-escalation] Latest developments: ServiceNow patched three maximum-severity AI Platform vulnerabilities that enable code injection, SQL injection, and privilege escalation, and cPanel fixed critical CVE-2026-65643 in domain-parking and addon-domain handling, a flaw that lets one hosting customer execute code as root across all supported cPanel and WHM versions. Both bugs hand attackers deep control, whole servers for cPanel hosts and enterprise workflows for ServiceNow. Administrators should apply the vendor patches now. - BleepingComputer: https://www.bleepingcomputer.com/news/security/servicenow-warns-of-three-max-severity-security-vulnerabilities/ - The Hacker News: https://thehackernews.com/2026/08/critical-cpanel-flaw-could-let-one.html 5. APT28 HOOKEDGE BACKDOOR HITS EUROPEAN GOVERNMENTS Nation-State Activity · [apt, espionage, nation-state] Latest developments: Recorded Future's Insikt Group tied a previously undocumented lightweight Windows batch-script backdoor called HOOKEDGE to Russia's APT28, deployed against government and diplomatic organizations in Romania, Spain, and Türkiye between late September 2025 and early April 2026, as a new survey found German companies reporting a rise in Chinese and Russian intrusions. APT28, linked to Russian military intelligence, keeps expanding its European espionage toolkit. Government and diplomatic bodies should hunt for the batch-script implant and tighten monitoring. - The Hacker News: https://thehackernews.com/2026/08/apt28-linked-hookedge-backdoor-targets.html - The Record: https://therecord.media/germany-cyberattacks-china-russia 6. TRUMP BANS FOREIGN-MADE POWER-GRID GEAR Policy and Regulation · [policy, ics, critical-infrastructure] Latest developments: President Trump signed executive order 14420 banning federal acquisition of foreign-made components used to generate and manage electricity, widening scrutiny of industrial control systems on the claim that certain foreign actors increasingly create and exploit vulnerabilities in the technology. The order targets bulk-power-system hardware over fears of embedded backdoors that enable cyber sabotage. Utilities and their suppliers face new sourcing restrictions on grid equipment. - The Record: https://therecord.media/trump-cyber-electricity-parts - SecurityWeek: https://www.securityweek.com/trump-order-aims-to-block-foreign-backdoors-in-us-power-grid-gear/ BUSINESS AND POLITICS ---------------------------------------------------------------- * Warsh's Jackson Hole Debut Amid Rising Yields Latest developments: Federal Reserve Chairman Kevin Warsh delivers his first Jackson Hole keynote at 10 a.m. Eastern today as global bond yields climb and Germany's 10-year Bund hits a 15-year high. Kevin Warsh, in his debut as Federal Reserve chairman, addresses the Kansas City Fed's Jackson Hole symposium under pressure from rising Treasury yields, elevated energy prices tied to the Iran war, and Fed officials warning on inflation; the 10-year Bund yield reached a 15-year high hours before he spoke. - WSJ Markets: https://www.wsj.com/finance/investing/global-bond-yields-rise-ahead-of-feds-warsh-speech-10-year-bund-yield-hits-15-year-high-c7ac0da3?mod=rss_markets_main - WSJ Markets: https://www.wsj.com/livecoverage/stock-market-today-jackson-hole-08-28-2026?mod=rss_markets_main PITTSBURGH ---------------------------------------------------------------- Weather: Today: Patchy Fog then Mostly Sunny, high 81F. Tonight: Mostly Clear, low 57F. Saturday: Sunny, high 83F. Business: * Pittsburgh Wealth Manager Expands to Aspen Latest developments: The Post-Gazette reported August 28 that Pittsburgh wealth manager DBR is moving into the Aspen, Colorado, market. DBR, a Pittsburgh wealth management firm, is setting its sights on Colorado with an expansion into Aspen, pushing its business beyond Western Pennsylvania. - Pittsburgh Post-Gazette: https://www.post-gazette.com/business/money/2026/08/28/dbr-wealth-manager-pittsburgh-aspen/stories/202608280014 * Former SCI Greensburg Site Eyed for Warehouses Latest developments: TribLive reported August 28 that developers want the former state prison property for warehouse space and Hempfield officials are weighing a rezoning. As demolition wraps at the former State Correctional Institution Greensburg, developers have expressed interest in building warehouses on the site, and Hempfield Township officials are looking at changing the zoning rules to allow it. - TribLive: https://triblive.com/local/westmoreland/developers-express-interest-in-former-state-prison-site-for-warehouse-space/ Around town: * West Mifflin Busing Town Hall Latest developments: West Mifflin Area School District and its new contractor Krise Transportation met parents at the first of three town halls Thursday, August 27, where frustration ran high. West Mifflin Area School District's school year opened with chronic bus delays; parents say the district sends them to newly hired contractor Krise Transportation, which draws the routes, and they left Thursday's meeting without clear answers. - KDKA: https://www.cbsnews.com/pittsburgh/news/west-mifflin-bus-transportation-meeting/ - WTAE: https://www.wtae.com/article/west-mifflin-families-frustrations-ongoing-bus-issues-town-hall/73549418 * Big Beaver Fights Racetrack Data Center Latest developments: Big Beaver residents packed another meeting Thursday, August 27, to oppose a data center proposed for a former racetrack in Beaver County. A developer wants to convert a former racetrack in Big Beaver, Beaver County, into a data center, and neighbors have turned out at repeated meetings to make clear they oppose the plan. - WPXI: https://www.wpxi.com/news/local/big-beaver-residents-attend-another-meeting-oppose-data-center-being-built-former-racetrack/KWQPAFN7TNDBHCSMPEEHGVDO34/ * Churchill Breaks Ground on Inclusive Playground Latest developments: The Borough of Churchill held a groundbreaking August 27 for the Blackridge Community All-Inclusive Playground. Churchill Borough broke ground on the Blackridge Community All-Inclusive Playground, an accessible play space in the eastern Allegheny County suburb. - WPXI: https://www.wpxi.com/news/local/churchill-borough-breaks-ground-new-all-inclusive-playground/AYTLMUJ66VEKTGF2SRZXPKJLGY/ Events: * Weekend Concerts and PedalPGH Latest developments: The Post-Gazette's August 27 weekend guide for August 28-30 spotlights a Bruno Mars concert, a Scott Blasey performance, the PedalPGH ride, and miniature golf. The Post-Gazette's things-to-do roundup for the weekend of August 28-30 highlights a Bruno Mars concert, a solo show by The Clarks' Scott Blasey, the citywide PedalPGH cycling event, and miniature golf around Pittsburgh. - Post-Gazette Music: https://www.post-gazette.com/life/recreation/2026/08/27/yinz-out-things-to-do-in-and-around-pittsburgh-this-weekend/stories/202608240032 * Audubon Bird Migration Events Latest developments: TribLive reported August 28 that the Audubon Society will host fall migration-watching events in Fox Chapel and Buffalo Township over the coming weeks. The Audubon Society is marking the annual fall bird migration with events in Fox Chapel and Buffalo Township, where enthusiasts can track warblers, hawks, and ruby-throated hummingbirds heading south. - TribLive: https://triblive.com/local/valley-news-dispatch/audubon-society-to-mark-annual-bird-migrations-with-events-in-fox-chapel-buffalo-township/ SPORTS ---------------------------------------------------------------- Around the Teams: * Steelers Restructure DK Metcalf's Deal Latest developments: The Steelers created about $18 million in salary cap space August 27 by restructuring wide receiver DK Metcalf's contract. Pittsburgh reworked receiver DK Metcalf's contract to open roughly $18 million in cap room, handing general manager Omar Khan added flexibility heading into the regular season. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/08/27/dk-metcalf-contract-cap-space-restructure/stories/202608270042 * Tackles Talk McCarthy's Offense on 'Not Just Football' Latest developments: On Cam Heyward's 'Not Just Football' training-camp episode released August 28, tackles Broderick Jones and Troy Fautanu broke down Mike McCarthy's new pass-heavy offense. Steelers offensive tackles Broderick Jones and Troy Fautanu joined Cam Heyward on 'Not Just Football' to discuss coach Mike McCarthy's pass-heavy scheme, blocking for quarterback Aaron Rodgers, and life in the offensive-line room. - Not Just Football with Cam Heyward: https://www.youtube.com/watch?v=4zRLofCgId4 Team USA: * Richards Moves Past U.S. World Cup Exit Latest developments: ESPN profiled August 28 how U.S. men's national team defender Chris Richards is processing the Americans' abrupt 2026 World Cup exit while returning to Crystal Palace. Chris Richards, the USMNT center back who plays for Crystal Palace, called this home World Cup a lifelong dream; its early end left him little time to grieve before rejoining the Premier League grind. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49732248/that-lifelong-dream-done-usmnt-chris-richards-puts-world-cup-heartbreak-focus-palace-premier-league * Alysa Liu Sits Out Skating Season Latest developments: Olympic gold medalist Alysa Liu announced August 26 she will skip the 2026-27 figure skating season to recalibrate and plans to return in 2027-28. Alysa Liu, the American figure skater who won Olympic gold, is stepping away for the 2026-27 season to recalibrate, aiming to return to competition for 2027-28. - ESPN Olympics: https://www.espn.com/olympics/story/_/id/49726515/alysa-liu-skipping-26-27-skating-season-recalibrate READING ---------------------------------------------------------------- * Stratechery -- Apple Updates Mini and Studio, AI Computers, OpenAI Jalapeño Ben Thompson argues Apple's refreshed Mac mini and Studio and OpenAI's new hardware both amount to mounting pressure on Nvidia as AI computing spreads to the desktop. https://stratechery.com/2026/apple-updates-mini-and-studio-ai-computers-openai-jalapeno/ * Ed Zitron -- The AI Hater's Manifesto Ed Zitron lays out a sweeping case against the AI industry's hype, shaky economics, and boosters, making his argument for full-throated AI skepticism. https://www.wheresyoured.at/the-ai-haters-manifesto/ * Cal Newport -- Has AI Gone Rogue? Cal Newport weighs the summer's alarming stories of misbehaving AI against the uncertain finances of the labs chasing record IPOs, questioning how rogue the technology really is. https://calnewport.com/has-ai-gone-rogue/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,682.24 ▼ -0.4% Dow 53,460.98 ▲ +0.2% Nasdaq 26,196.70 ▼ -0.8% WTI crude 84.04 ▼ -1.2% EUR/USD 1.1673 ▲ +0.7% GBP/USD 1.3636 ▲ +0.7% USD/JPY 159.08 ▼ -0.1% ================================================================ Generated 2026-08-28 07:05 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================