================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Saturday, August 29, 2026 - 7:38 PM EDT ================================================================ Prosecutors charged two alleged TeamPCP operators over the Shai-Hulud supply-chain worm as maximum-severity flaws hit ServiceNow, WordPress, and cPanel. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Maximum-severity unauthenticated code-execution flaws piled up as ServiceNow patched three CVSS 10.0 bugs in its AI Platform while Wordfence and cPanel disclosed critical WordPress holes. see: Three CVSS 10.0 Flaws Hit ServiceNow AI Platform; Critical WordPress and cPanel Server Flaws * [TREND] State-aligned operators kept probing the West as Russia's APT28 deployed its HOOKEDGE backdoor against European foreign ministries while suspected North Korean workers infiltrated sales and medical jobs. see: APT28 HOOKEDGE Backdoor Hits European Governments; North Korean Workers Expand Beyond IT * [UPDATE (new)] Authorities charged two alleged TeamPCP members over the self-propagating Shai-Hulud worm that hit more than 1,000 organizations, harvested 500,000 credentials, and reached OpenAI. see: TeamPCP Members Charged Over Shai-Hulud Worm * [TREND] AI's finances drew fresh scrutiny as Zitron dissected circular financing among Nvidia and the labs, Newport questioned 'rogue' AI hype, and Ben Thompson weighed Apple's bets. see: Premium: The Hater's Guide To Circular Financing (Part One); Has AI Gone Rogue?; Apple Updates Mini and Studio, AI Computers, OpenAI Jalapeño * [UPDATE (new)] Local infrastructure faltered as Ligonier Valley closed every school for mold remediation and a water main break flooded homes across Baldwin Borough on Saturday. see: Ligonier Valley Closes Every School for Mold; Water Main Break Floods Baldwin Homes * [UPDATE (new)] The Steelers traded offensive tackle Broderick Jones and a fourth-round pick to the Dallas Cowboys for third- and sixth-round picks. see: Steelers Trade Broderick Jones to Cowboys SECURITY ---------------------------------------------------------------- 1. CRITICAL WORDPRESS AND CPANEL SERVER FLAWS Vulnerabilities and Exploits · [patch, rce, wordpress] Latest developments: Wordfence and Patchstack disclosed five critical flaws across the WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP, topped by authentication-bypass bug CVE-2026-76581 at CVSS 9.8, while cPanel patched CVE-2026-65643, which lets a single hosting customer seize root on the whole server. The WordPress bugs enable authentication bypass, account takeover, and arbitrary code execution on affected sites. The cPanel flaw touches all supported versions of cPanel and WHM through domain-parking and addon-domain features, turning one tenant into root over every site on a shared server. - The Hacker News: https://thehackernews.com/2026/08/five-critical-wordpress-plugin-and.html - The Hacker News: https://thehackernews.com/2026/08/critical-cpanel-flaw-could-let-one.html - BleepingComputer: https://www.bleepingcomputer.com/news/security/givewp-wordpress-donation-plugin-flaw-lets-hackers-execute-server-commands/ 2. TEAMPCP MEMBERS CHARGED OVER SHAI-HULUD WORM Ransomware and Cybercrime · [supply-chain, arrest, worm] Latest developments: Authorities arrested and charged two alleged members of the hacking group TeamPCP, tying them to the self-propagating Shai-Hulud worm that infected more than 1,000 organizations, harvested 500,000 credentials, and reached OpenAI. TeamPCP ran a relentless supply-chain campaign whose Shai-Hulud worm, named for the Dune sandworm, spread automatically to steal credentials from victims worldwide. The charges mark the first named suspects in a spree that hit OpenAI and thousands of other targets. - Ars Technica Security: https://arstechnica.com/security/2026/08/authorities-arrest-2-alleged-members-of-prolific-hacking-group-teampcp/ - Graham Cluley: https://www.bitdefender.com/en-us/blog/hotforsecurity/shai-hulud-hackers-charged-teampcps 3. THREE CVSS 10.0 FLAWS HIT SERVICENOW AI PLATFORM Vulnerabilities and Exploits · [patch, rce, sql-injection] Latest developments: ServiceNow patched four flaws in its AI Platform, three rated a perfect 10.0, that let an unauthenticated attacker run code, inject SQL, and escalate privileges in certain configurations. ServiceNow pushed the fix to its hosted instances and handed it to partners and self-hosted customers, who now carry the burden of patching. Organizations running the platform on their own infrastructure face unauthenticated code and SQL execution until they apply the update. - The Hacker News: https://thehackernews.com/2026/08/three-cvss-100-servicenow-flaws-could.html - BleepingComputer: https://www.bleepingcomputer.com/news/security/servicenow-warns-of-three-max-severity-security-vulnerabilities/ 4. ANDROID 17 ADDS OS-WIDE ENCRYPTED CLIENT HELLO Data Privacy · [privacy, mobile, encryption] Latest developments: Google announced that Android 17 will carry system-wide Encrypted Client Hello, hiding the domain names of sites a user visits from network operators and eavesdroppers, alongside new cellular and home-network privacy defenses. ECH closes a gap that leaves visited domains visible even over HTTPS, blocking the profiling and tracking that carriers and snoops build from that data. The batch also hardens Android against Wi-Fi tracking and cellular vulnerabilities. - The Hacker News: https://thehackernews.com/2026/08/android-17-adds-os-wide-ech-to-hide.html - Help Net Security: https://www.helpnetsecurity.com/2026/08/28/android-17-network-security-features/ 5. APT28 HOOKEDGE BACKDOOR HITS EUROPEAN GOVERNMENTS Nation-State Activity · [apt, espionage, backdoor] Latest developments: Recorded Future's Insikt Group tied a previously undocumented backdoor called HOOKEDGE, a lightweight Windows batch script, to Russia's APT28 in campaigns against government and diplomatic organizations in Romania, Spain, and Türkiye from late September 2025 through early April 2026. HOOKEDGE arrives through targeted delivery and gives APT28 persistent access to foreign ministries and government networks. The disclosure extends the group's long-running espionage push across European Union member states. - The Hacker News: https://thehackernews.com/2026/08/apt28-linked-hookedge-backdoor-targets.html 6. NORTH KOREAN WORKERS EXPAND BEYOND IT Nation-State Activity · [apt, fraud, insider] Latest developments: Huntress investigations identified suspected North Korean remote workers hired into sales, marketing, and medical roles, broadening a fraud scheme that once centered on information-technology jobs. DPRK operatives trick companies into hiring them under false identities and often perform the work, funneling wages back to the regime. The widening job range strains detection, since defenders can no longer watch only technical hires. - Help Net Security: https://www.helpnetsecurity.com/2026/08/28/north-korean-remote-workers-jobs-sales-and-marketing/ BUSINESS AND POLITICS ---------------------------------------------------------------- * U.S.-Venezuela Oil Deal Draws Fire at Home and Abroad Latest developments: Venezuela's opposition and Maduro-government hardliners both denounced the pact on August 29, the opposition calling it potentially illegal and loyalists casting it as a betrayal, while the White House offered no detail beyond Trump's social-media post. President Trump's announced joint venture would hand the United States control of much of Venezuela's proven reserves—roughly 65 billion barrels, about a fifth of the country's oil—which he says will lower American gasoline prices; analysts warn the arrangement gives Washington and Caracas a shared reason to forestall a democratic transition. - FT: https://www.ft.com/content/b3c98ca2-fe67-459d-89ff-4728993110b7?syn-25a6b1a6=1 - The Economist: https://www.economist.com/the-americas/2026/08/29/americas-murky-deal-to-secure-a-fifth-of-venezuelas-oil * Warsh Opens Door to Rate Hikes at Jackson Hole Latest developments: Federal Reserve Chair Kevin Warsh's Jackson Hole address, parsed in Saturday takeaways August 29, raised the stakes for the central bank's next meeting and set him on a collision course with President Trump, who wants lower borrowing costs before the November midterms. Warsh used the Kansas City Fed's symposium to renew his inflation-fighting credentials and chart a forward-looking approach signaling that rates may rise in coming months, a shift markets read as putting a September increase in play. - FT: https://www.ft.com/content/4319c6b7-5a25-41a7-836f-ca068ac4fe60?syn-25a6b1a6=1 - FT: https://www.ft.com/content/69452aea-cee0-47de-be8a-dc790fed3db1?syn-25a6b1a6=1 PITTSBURGH ---------------------------------------------------------------- Weather: Tonight: Partly Cloudy, low 65F. Sunday: Mostly Sunny, high 88F. Sunday Night: Mostly Cloudy then Slight Chance Rain Showers, low 69F. Business: * Wholey's Holds 8th Annual Lobster Grab Latest developments: Robert Wholey & Co. ran its eighth annual lobster grab on August 29. Wholey's Market, the seafood institution anchoring Pittsburgh's Strip District, held its eighth annual lobster grab, a recurring promotion that pulls crowds into the historic fishmonger. - Pittsburgh Post-Gazette: https://www.post-gazette.com/local/city/2026/08/29/wholeys-market-lobster-grab/stories/202608300087 Around town: * Ligonier Valley Closes Every School for Mold Latest developments: The Ligonier Valley School District will shut all its buildings starting Monday, August 31, to begin mold remediation, widening a problem that had already closed three classrooms at R.K. Mellon Elementary. The Westmoreland County district, which serves Ligonier and surrounding communities, said positive mold tests forced the closure of every building for cleanup, disrupting the opening weeks of the school year. - WTAE: https://www.wtae.com/article/ligonier-valley-school-district-westmoreland-county/73560120 * Water Main Break Floods Baldwin Homes Latest developments: A large water main break early Saturday, August 29, sent water across two streets in Baldwin Borough, damaging homes, with a contractor helping affected residents. The break in Baldwin Borough, in Allegheny County's South Hills, flooded a roadway and several homes before crews and a contractor responded. - WTAE: https://www.wtae.com/article/water-main-break-baldwin-borough-allegheny-county/73559978 - WPXI: https://www.wpxi.com/news/local/water-main-break-floods-homes-roadway-baldwin/ZH7L6T6IHBADJPM6I3RIHVDVBU/ * Poll Shows Fetterman Losing Pennsylvania Democrats Latest developments: A poll reported August 29 found John Fetterman's support among Pennsylvania Democrats sliding further even as his backing among Republicans rose. Fetterman, elected Pennsylvania's junior U.S. senator in 2022, has watched his standing with the state's Democratic base steadily deteriorate, a rift the latest Post-Gazette survey widens. - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/politics-state/2026/08/29/fetterman-poll-democrats-republican-support/stories/202608300088 SPORTS ---------------------------------------------------------------- Around the Teams: * Steelers Trade Broderick Jones to Cowboys Latest developments: ESPN's Adam Schefter reported August 29 that the Steelers dealt offensive tackle Broderick Jones and a fourth-round pick to the Dallas Cowboys for third- and sixth-round picks. Jones, 25, the Steelers' 2023 first-round pick—14th overall out of Georgia—made 38 career starts and had recently landed on injured reserve, and Pittsburgh moved the former top pick as it settled its offensive line for the season. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/08/29/steelers-first-round-pick-broderick-jones-cowboys/stories/202608290043 * Konnor Griffin Starts Rehab Assignment Latest developments: The Pirates said August 29 that rookie shortstop Konnor Griffin will begin a rehab assignment with Double-A Altoona on Sunday, August 30. Griffin, the Pirates' top prospect, takes the first step toward a return as the club's offense sputters through the second half of the season. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/08/29/pirates-konnor-griffin-rehab-altoona-indianapolis/stories/202608290034 * Steelers' Pull Toward Iowa Players Latest developments: A Post-Gazette feature published August 29 examined why general manager Omar Khan and the Steelers keep drafting and signing Iowa Hawkeyes. The piece traces Pittsburgh's pipeline from Iowa City—defensive lineman Yahya Black and lineman Gennings Dunker among them—arguing the Hawkeyes' pro-style development and toughness match the Steelers' identity beyond the shared black and gold. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/08/29/iowa-hawkeyes-yahya-black-omar-khan-gennings-dunker/stories/202608270058 READING ---------------------------------------------------------------- * Ed Zitron -- Premium: The Hater's Guide To Circular Financing (Part One) Zitron dissects the circular money flows binding AI's biggest players—Nvidia funding the labs that turn around and buy its chips—arguing these arrangements inflate the appearance of health across the AI boom. https://www.wheresyoured.at/premium-the-haters-guide-to-circular-financing-part-one/ * Stratechery -- Apple Updates Mini and Studio, AI Computers, OpenAI Jalapeño Ben Thompson reads Apple's refreshed Mac mini and Studio alongside OpenAI's hardware announcement as two very different bets that both apply pressure on Nvidia's grip on AI computing. https://stratechery.com/2026/apple-updates-mini-and-studio-ai-computers-openai-jalapeno/ * Cal Newport -- Has AI Gone Rogue? Newport pushes back on breathless coverage of AI models 'going rogue,' arguing the summer's real story is the shaky financial footing of the AI labs racing toward record IPOs. https://calnewport.com/has-ai-gone-rogue/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,689.72 = -0.0% Dow 53,517.57 ▲ +0.5% Nasdaq 26,241.09 ▼ -0.2% WTI crude 84.04 ▼ -1.2% EUR/USD 1.1648 ▲ +0.1% GBP/USD 1.3603 = +0.0% USD/JPY 159.40 ▲ +0.3% ================================================================ Generated 2026-08-29 19:38 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================