================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Saturday, August 29, 2026 - 8:06 AM EDT ================================================================ AI companies warn that machine-accelerated vulnerability discovery will trigger a cybersecurity 'apocalypse' within months, even as mass exploitation of unpatched servers and crypto-draining campaigns intensify. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] AI companies warn of a coming vulnpocalypse as AI-accelerated flaw hunting floods bug bounty programs and drives payouts down across the industry. see: AI-Driven Vulnerability Discovery Reprices the Bug Bounty Economy * [TREND] Thieves drained six blockchains through a Cosmos EVM balance flaw while 19 Chrome and Edge extensions siphoned cryptocurrency from unwary wallets. see: Cosmos EVM Flaw Drains Six Blockchains; 19 Chrome and Edge Extensions Drain Crypto Wallets * [UPDATE (new)] More than 8,300 internet-exposed Gitea servers remain unpatched against CVE-2026-60004 as attackers run ongoing remote-code-execution attacks. see: Over 8,300 Gitea Servers Await a Patch * [TREND] The Reading list circles Nvidia's exposure, with Ben Thompson weighing Apple and OpenAI hardware, Zitron skewering circular financing, and Newport questioning shaky AI labs. see: Apple Updates Mini and Studio, AI Computers, OpenAI Jalapeño; Premium: The Hater's Guide To Circular Financing (Part One); Has AI Gone Rogue? * [UPDATE (new)] The Steelers cleared $18 million by restructuring DK Metcalf's deal as Ray Fittipaldo published his final 53-man projection before Sunday's cutdown. see: Steelers Clear $18 Million Restructuring Metcalf; Fittipaldo Projects Final 53 Before Cut Day SECURITY ---------------------------------------------------------------- 1. AI-DRIVEN VULNERABILITY DISCOVERY REPRICES THE BUG BOUNTY ECONOMY AI Security · [ai, vulnerabilities] Latest developments: Wired reported AI companies warning that a cybersecurity apocalypse arrives within months as AI tools accelerate flaw discovery, and Dark Reading found the resulting flood of AI-generated reports, the so-called vulnpocalypse, driving down bug bounty payouts and squeezing independent researchers. AI systems now surface software vulnerabilities faster than the pipelines built to triage and patch them, per Action1's analysis, and the surge outpaces defenders who must correlate multiple intelligence feeds while eroding the pay that sustains independent bug hunters. - Wired Security: https://www.wired.com/story/security-news-this-week-the-cybersecurity-apocalypse-is-coming-in-months-ai-giants-warn/ - Dark Reading: https://www.darkreading.com/vulnerabilities-threats/vulnpocalypse-repricing-bug-bounty-economy - BleepingComputer: https://www.bleepingcomputer.com/news/security/ai-is-accelerating-vulnerability-discovery-can-defenders-keep-up/ 2. MICROSOFT DETAILS TERMINALFIX CLICKFIX CAMPAIGN Ransomware and Cybercrime · [malware, clickfix] Latest developments: Microsoft Threat Intelligence analyzed TerminalFix, a ClickFix campaign that uses fake CAPTCHA prompts and DLL sideloading through a multistage intrusion to deploy a reverse tunnel, and published detections and hunting guidance. ClickFix lures trick users into running malicious commands under the guise of a CAPTCHA; TerminalFix layers DLL sideloading and a reverse tunnel for stealthy remote access. Defenders should apply Microsoft's detections. - Microsoft Security Blog: https://www.microsoft.com/en-us/security/blog/2026/08/28/terminalfix-campaign-deploys-reverse-tunnel-through-multistage-intrusion/ 3. COSMOS EVM FLAW DRAINS SIX BLOCKCHAINS Vulnerabilities and Exploits · [blockchain, zero-day, exploit] Latest developments: Cosmos Labs warned that attackers exploited a critical balance-handling flaw in the shared Cosmos EVM module, tracked as GHSA-7g4w-cg88-2cq2, to drain funds from six blockchains between August 20 and August 25, 2026, after Cosmos Labs already knew every chain running the module carried the bug. The Cosmos EVM module underpins many interoperable blockchains; the critical flaw hits versions below 0.6.2 and shipped without a CVE identifier, CVSS score, or weakness class. Operators must upgrade at once. - The Hacker News: https://thehackernews.com/2026/08/cosmos-evm-flaw-exploited-after-cosmos.html 4. OVER 8,300 GITEA SERVERS AWAIT A PATCH Vulnerabilities and Exploits · [patch, exploit] Latest developments: The Shadowserver Foundation counted more than 8,300 internet-exposed Gitea instances still unpatched against code-injection flaw CVE-2026-60004, which attackers exploit in ongoing remote-code-execution attacks. Gitea, a self-hosted Git service, carries CVE-2026-60004, a critical code-injection hole CISA cataloged as exploited on August 25, 2026; administrators must update immediately to shut out remote code execution. - BleepingComputer: https://www.bleepingcomputer.com/news/security/over-8-300-gitea-servers-vulnerable-to-code-execution-attacks/ 5. UNITREE G1 HUMANOID ROBOT ROOT RCE FLAWS Vulnerabilities and Exploits · [rce, iot] Latest developments: Security researcher Olivier Laflamme disclosed two independent root remote-code-execution chains in the Unitree G1 EDU humanoid robot, tracked as CVE-2026-76639 and CVE-2026-76640, one of them reaching root on the robot's Locomotion PC over Bluetooth Low Energy. The Unitree G1 EDU is a programmable humanoid research robot; the flaws hand an attacker root control, including a network-adjacent path through its chat_go and bashrunner components. Owners await patches. - The Hacker News: https://thehackernews.com/2026/08/two-unitree-g1-edu-humanoid-robot-flaws.html 6. 19 CHROME AND EDGE EXTENSIONS DRAIN CRYPTO WALLETS Ransomware and Cybercrime · [crypto, malware] Latest developments: Socket researcher Karlo Zanki uncovered a cluster of 18 Google Chrome extensions and one Microsoft Edge extension that surfaced over the past six months and share code and tradecraft to steal wallet secrets and drain cryptocurrency. The malicious browser extensions harvest wallet keys and siphon funds from anyone who installs them; users should remove the add-ons and audit every extension they run. - The Hacker News: https://thehackernews.com/2026/08/19-chrome-and-edge-extensions-found.html BUSINESS AND POLITICS ---------------------------------------------------------------- * Warsh Puts September Rate Hike in Play Latest developments: Federal Reserve Chairman Kevin Warsh signaled August 28 that the central bank's inflation fight remains unfinished, moving traders to price in a possible September rate increase. Warsh's hawkish turn lifted Treasury yields and pushed U.S. stocks lower as investors abandoned bets on easing, with the Fed chairman stressing that inflation still runs above the central bank's target. - WSJ Markets: https://www.wsj.com/finance/investing/markets-brace-for-possible-rate-hike-after-kevin-warshs-hawkish-turn-f2611e6f?mod=rss_markets_main - WSJ Markets: https://www.wsj.com/finance/investing/u-s-stocks-fall-after-warsh-speech-boosts-bond-yields-c96bb5da?mod=rss_markets_main * U.S. to Take Control of Venezuelan Oil Reserves Latest developments: President Trump said August 28 that a joint venture will hand the United States control of 65 billion barrels of Venezuelan oil. The arrangement gives Washington authority over much of Venezuela's proven crude reserves, the largest in the world, and Trump said it would substantially lower gasoline prices across the United States. - FT Markets: https://www.ft.com/content/2f88581f-4fbc-46a2-8127-830bb630c2f2?syn-25a6b1a6=1 - WSJ US Business: https://www.wsj.com/business/energy-oil/trump-administration-in-advanced-talks-for-stake-in-venezuelan-oil-fields-819546d3?mod=pls_whats_news_us_business_f PITTSBURGH ---------------------------------------------------------------- Weather: Today: Sunny, high 84F. Tonight: Partly Cloudy, low 64F. Sunday: Mostly Sunny, high 88F. Business: * Miss Megan's Kitchen Opens in Vandergrift Latest developments: Miss Megan's Kitchen opened in downtown Vandergrift, adding an affordable home-cooking spot to the Westmoreland County borough's business district. The new eatery brings affordable, made-from-scratch home cooking to downtown Vandergrift, the latest storefront to fill the small Kiskiminetas Valley business district. - TribLive: https://triblive.com/local/valley-news-dispatch/affordable-fresh-home-cooking-debuts-at-miss-megans-kitchen-in-vandergrift/ Around town: * Summer Lee, Hayes Set for PA-12 Rematch Latest developments: Democratic U.S. Representative Summer Lee will face Republican James Hayes again as she seeks a third term in Pennsylvania's 12th Congressional District. The rematch pits incumbent Summer Lee against challenger James Hayes in the deep-blue 12th District, which covers much of Pittsburgh and stretches into Westmoreland County. - TribLive: https://triblive.com/local/westmoreland/summer-lee-james-hayes-set-for-rematch-in-pa-s-12th-congressional-district/ * Allegheny County Subsidized Housing Sits in Limbo Latest developments: TribLive reported August 29 that tenants at some Allegheny County subsidized properties endure deteriorating conditions while the buildings sit in ownership limbo. Renters including Patrice Aaron describe neglect and overgrowth at subsidized properties across Allegheny County whose uncertain ownership has stalled repairs and maintenance. - TribLive: https://triblive.com/news/health-now/tenants-endure-deteriorating-conditions-as-some-allegheny-co-subsidized-properties-sit-in-limbo/ * CCAC Instructor Sets Teaching World Record Latest developments: Francis Maxin earned a Guinness World Record for teaching 60 years at the Community College of Allegheny County, the Post-Gazette reported August 29. Maxin has taught at the Community College of Allegheny County for six decades, a tenure Guinness World Records now certifies as the longest of its kind. - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/education/2026/08/29/ccac-francis-maxin-community-college-guinness/stories/202608270069 Events: * Concerts and Rides Around Town This Weekend Latest developments: The Post-Gazette's weekend guide points to Bruno Mars and Scott Blasey concerts, the PedalPGH bike ride, and miniature golf around Pittsburgh for the weekend of August 29 and 30. Bruno Mars and singer Scott Blasey headline concerts, cyclists take on the PedalPGH ride through the city, and mini-golf outings fill out the things-to-do slate across Pittsburgh this weekend. - Post-Gazette Arts & Entertainment: https://www.post-gazette.com/life/recreation/2026/08/27/yinz-out-things-to-do-in-and-around-pittsburgh-this-weekend/stories/202608240032 SPORTS ---------------------------------------------------------------- Around the Teams: * Steelers Clear $18 Million Restructuring Metcalf Latest developments: The Steelers created $18 million in salary-cap space August 27 by restructuring receiver DK Metcalf's contract. Pittsburgh converted much of DK Metcalf's salary into a signing bonus to free up $18 million under the cap, giving the front office room to maneuver as the regular season nears. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/08/27/dk-metcalf-contract-cap-space-restructure/stories/202608270042 * Tackles Talk Rodgers on 'Not Just Football' Latest developments: On Cam Heyward's 'Not Just Football,' offensive tackles Broderick Jones and Troy Fautanu broke down Mike McCarthy's pass-heavy offense and life protecting Aaron Rodgers. The training-camp episode featured Steelers tackles Broderick Jones and Troy Fautanu discussing McCarthy's new pass-first scheme, blocking alongside quarterback Aaron Rodgers, and the personalities inside the offensive-line room. - Not Just Football with Cam Heyward: https://www.youtube.com/watch?v=4zRLofCgId4 * Fittipaldo Projects Final 53 Before Cut Day Latest developments: Beat writer Ray Fittipaldo released his final Steelers 53-man roster projection August 28 ahead of Sunday's 6 p.m. cutdown deadline. With cuts due Sunday at 6 p.m., Fittipaldo forecast which players survive after the preseason finale in Buffalo, while Matt Williamson and Wes Uhler laid out their own roster predictions on SNR Drive. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/08/28/steelers-roster-projection-camp-cuts/stories/202608280041 - Pittsburgh Steelers (YouTube): https://www.youtube.com/watch?v=U0MQJEKbPnE Team USA: * Richards Returns to Palace After World Cup Exit Latest developments: U.S. men's national team defender Chris Richards spoke about moving past the Americans' abrupt World Cup exit as he rejoined Crystal Palace for the Premier League season. Richards, who called playing in this World Cup a lifelong dream, had little time to grieve the U.S. team's early elimination before returning to Crystal Palace in England's top flight. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49732248/that-lifelong-dream-done-usmnt-chris-richards-puts-world-cup-heartbreak-focus-palace-premier-league READING ---------------------------------------------------------------- * Stratechery -- Apple Updates Mini and Studio, AI Computers, OpenAI Jalapeño Ben Thompson argues that Apple's refreshed Mac mini and Studio and OpenAI's new hardware, though very different announcements, both point to mounting competitive pressure on Nvidia. https://stratechery.com/2026/apple-updates-mini-and-studio-ai-computers-openai-jalapeno/ * Ed Zitron -- Premium: The Hater's Guide To Circular Financing (Part One) Zitron dissects the circular financing binding Nvidia and the AI labs, skewering arrangements in which chipmakers and model builders prop up one another's revenue. https://www.wheresyoured.at/premium-the-haters-guide-to-circular-financing-part-one/ * Cal Newport -- Has AI Gone Rogue? Newport contends the real AI story of the summer is the shaky financial position of the labs chasing record IPOs, and questions the breathless framing of the technology going rogue. https://calnewport.com/has-ai-gone-rogue/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,682.24 ▼ -0.4% Dow 53,460.98 ▲ +0.2% Nasdaq 26,196.70 ▼ -0.8% WTI crude 84.04 ▼ -1.2% EUR/USD 1.1648 ▲ +0.1% GBP/USD 1.3603 = +0.0% USD/JPY 159.40 ▲ +0.3% ================================================================ Generated 2026-08-29 08:06 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================