daily plain-text briefing: security, markets, business, and pittsburgh
Attackers exploit a PaperCut print-server zero-day as ServiceNow, cPanel, and Gitea scramble to patch critical remote-code-execution flaws across enterprise software.
Latest developments: ServiceNow patched three CVSS 10.0 AI Platform flaws that unauthenticated attackers can exploit for code injection, SQL injection, and privilege escalation, cPanel fixed root-level CVE-2026-65643 across all supported cPanel and WHM versions, and Shadowserver counted over 8,300 Gitea servers still exposed to the actively exploited code-injection flaw CVE-2026-60004.
The flaws span three widely deployed platforms: ServiceNow's AI Platform, cPanel and WHM hosting control, and self-hosted Gitea code repositories. Organizations should patch immediately, since attackers already hit Gitea in the wild.
Sources: The Hacker News · BleepingComputer · The Hacker News · BleepingComputer · ↑ top
Latest developments: PaperCut issued an emergency advisory Thursday evening and shipped patches for v25 and v26 after confirming attackers actively exploit an as-yet-unassigned flaw across all NG and MF versions, citing confirmed customer incidents it treats as top priority.
PaperCut NG and MF run print management for enterprises worldwide. Administrators should install the emergency v25 or v26 patch and apply the recommended mitigations at once.
Sources: The Record · SecurityWeek · The Hacker News · ↑ top
Latest developments: The Trump administration barred acquisition of foreign-made components used to manage electricity and power generation, alleging that certain foreign actors increasingly create and exploit vulnerabilities in the technology, days after VulnCheck disclosed factory root implants in Chinese-built ZBT routers.
The order blocks federal acquisition of foreign-made electricity-management components on grounds that adversaries plant and exploit vulnerabilities in them. It lands amid fresh disclosures of built-in backdoors in Chinese hardware.
Sources: The Record · Dark Reading · The Hacker News · ↑ top
Latest developments: Authorities arrested and charged two alleged members of TeamPCP over the self-propagating Shai-Hulud worm that infected more than 1,000 organizations, including OpenAI, and harvested roughly 500,000 credentials in a relentless supply-chain campaign.
TeamPCP, whose worm carries the name of a Dune sandworm, spread on its own through software dependencies to steal credentials at scale. The charges mark a major law-enforcement strike against the crew.
Sources: Ars Technica Security · Graham Cluley · ↑ top
Latest developments: Wired revealed that Alpharetta, Georgia police share Flock automated license-plate data with more than 2,000 organizations ranging from federal agencies to a fish and wildlife commission, and separately documented a Georgia officer who used Flock to track his ex-partner and a man whose vehicle often appeared near hers.
Flock's automated license-plate readers feed a sharing network that now reaches thousands of public and private entities. The Georgia cases show how readily officers can abuse the data for personal ends.
Sources: Wired Security · Wired Security · ↑ top
Latest developments: Recorded Future's Insikt Group tied the previously undocumented HOOKEDGE backdoor, a lightweight Windows batch script, to APT28 campaigns that hit government and diplomatic organizations in Romania, Spain, and Türkiye between late September 2025 and early April 2026.
APT28, the Russian military-intelligence group, distributed HOOKEDGE through crafted lures against diplomats. Targeted organizations should hunt for the batch-script backdoor and inspect email-borne delivery.
Sources: The Hacker News · ↑ top
Latest developments: Federal Reserve Chairman Kevin Warsh, in his Jackson Hole debut August 28, signaled the central bank may not be done fighting inflation, and traders sharply raised bets on a September rate increase.
Federal Reserve Chairman Kevin Warsh told the Kansas City Fed's annual symposium in Jackson Hole, Wyoming, that U.S. inflation has not meaningfully improved, lifting the two-year Treasury yield and the dollar and pushing gold lower as Wall Street tilted toward a September rate hike.
Sources: FT World · WSJ Markets · FT Markets · ↑ top
This Afternoon: Slight Chance Rain Showers, high 81F.
Tonight: Mostly Clear, low 56F.
Saturday: Sunny, high 84F.
Latest developments: The Post-Gazette reported August 28 that UPMC's second-quarter income dropped 30.3%, a decline the system blamed on fewer hospital admissions.
UPMC, the Pittsburgh-based health system and insurer, saw its second-quarter income fall 30.3% as revenue slipped, a drop the organization attributed to fewer hospital admissions.
Sources: Pittsburgh Post-Gazette · ↑ top
Latest developments: WPXI reported August 28 that the U.S. Army signed up Westinghouse's eVinci nuclear microreactor to supply electric power at Fort Drum in upstate New York.
Westinghouse Electric Co., the Cranberry Township nuclear firm, won a U.S. Army commitment to deploy its eVinci microreactor to generate electricity at Fort Drum in upstate New York, a boost for its small-reactor program.
Latest developments: WPXI reported August 28 that the redeveloped Washington Crown Center has reopened with new retailers and a new outdoor space called Franklin Crossroads Park.
The reinvention of Washington Crown Center, the shopping mall in Washington County, has reopened with retail newcomers and a new open-air Franklin Crossroads Park at its core.
Latest developments: Governor Josh Shapiro said August 28 that Pennsylvania's measles count rose to 445, more than 20 higher than the tally the state last reported Wednesday.
Pennsylvania's measles outbreak, which Governor Josh Shapiro calls deeply serious, has grown to 445 cases statewide, extending a spread that has already produced the state's first measles deaths in 35 years.
Latest developments: WPXI reported August 28 that the Monongahela Incline will close temporarily to adjust a cable hitch as part of routine maintenance.
The Monongahela Incline, the funicular that carries riders up Mount Washington in Pittsburgh, will shut down temporarily for a cable-hitch adjustment.
Latest developments: Columnist Colin McNickle wrote in TribLive August 28 that a researcher at the Allegheny Institute for Public Policy finds VisitPittsburgh's $177 million draft impact estimate impossible to verify independently.
VisitPittsburgh credited Pittsburgh's hosting of the NFL Draft with $177 million in economic impact, a figure an Allegheny Institute for Public Policy researcher says no outsider can independently confirm.
Latest developments: The Post-Gazette's August 27 weekend guide highlights Bruno Mars and Scott Blasey concerts, the PedalPGH ride, and miniature golf for the weekend of August 28 through 30.
The Post-Gazette's things-to-do guide for the weekend of August 28 through 30 spotlights concerts by Bruno Mars and singer Scott Blasey, the PedalPGH community bike ride, and miniature golf around the Pittsburgh area.
Sources: Post-Gazette Music · ↑ top
Latest developments: KDKA reported August 28 that the second annual BaconBurgh, a bacon-themed festival, returns to Pittsburgh's South Side this weekend.
BaconBurgh, a festival built around all things bacon, comes back for its second year to Pittsburgh's South Side this weekend.
Latest developments: KDKA reported August 28 that the Corks & Kegs Festival returns to the Hollywood Casino at the Meadows in Washington County.
The Corks & Kegs Festival, a wine-and-beer tasting event, returns to the Hollywood Casino at the Meadows in Washington County.
Latest developments: The Post-Gazette reported August 27 that the Steelers reworked receiver DK Metcalf's contract to create $18 million in salary-cap room.
The Pittsburgh Steelers restructured wide receiver DK Metcalf's deal, converting salary to open $18 million in salary-cap space ahead of the regular season.
Sources: Post-Gazette Steelers · ↑ top
Latest developments: On the August 28 'Not Just Football' episode, Steelers offensive tackles Broderick Jones and Troy Fautanu broke down Mike McCarthy's new pass-heavy offense and playing next to Aaron Rodgers.
Cam Heyward's 'Not Just Football' podcast, in its training-camp series, hosted Steelers offensive tackles Broderick Jones and Troy Fautanu, who described coach Mike McCarthy's pass-first scheme and blocking in front of quarterback Aaron Rodgers.
Sources: Not Just Football with Cam Heyward · ↑ top
Latest developments: Ray Fittipaldo published his final Steelers 53-man roster projection August 28 as the team heads into league cutdowns.
Post-Gazette beat writer Ray Fittipaldo released his final projection of the Steelers' 53-man roster ahead of the NFL cut deadline, sorting the camp battles that will decide the last spots.
Sources: Post-Gazette Steelers · ↑ top
Latest developments: ESPN reported August 28 that U.S. men's national team defender Chris Richards has returned to Crystal Palace after the abrupt end of his World Cup run.
Chris Richards, the United States men's national team center back who plays for Crystal Palace in the Premier League, said the sudden end of his World Cup left him little time to grieve before he rejoined his club.
Sources: ESPN Soccer · ↑ top
Latest developments: ESPN reported August 26 that Olympic gold medalist Alysa Liu will skip the 2026-27 figure skating season to recalibrate and plans to return in 2027-28.
American figure skater Alysa Liu, an Olympic gold medalist, announced she will take the 2026-27 season off to recalibrate and intends to compete again in 2027-28.
Sources: ESPN Olympics · ↑ top
S&P 500 7,682.24 ▼ -0.4% Dow 53,460.98 ▲ +0.2% Nasdaq 26,196.70 ▼ -0.8% WTI crude 84.04 ▼ -1.2% EUR/USD 1.1673 ▲ +0.7% GBP/USD 1.3636 ▲ +0.7% USD/JPY 159.08 ▼ -0.1%