================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Sunday, August 30, 2026 - 8:06 AM EDT ================================================================ AI leaders warned a cybersecurity apocalypse could arrive within months as automated bug-hunting flooded defenses, while live campaigns drained six blockchains, seeded crypto-stealing browser extensions, and turned fake CAPTCHAs into reverse-tunnel backdoors. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] AI leaders warn machine-generated bug reports are triggering a Vulnpocalypse that floods bounty programs and collapses the payouts independent researchers rely on. see: AI-Driven Vulnerability Discovery and the Vulnpocalypse * [TREND] Crypto theft ran on parallel tracks, draining six chains through a Cosmos EVM balance flaw while wallet-stealing code hid in 19 Chrome and Edge extensions. see: Cosmos EVM Fund Drain; Crypto-Draining Chrome and Edge Extensions * [TREND] Microsoft's TerminalFix variant steers victims through fake Cloudflare CAPTCHA prompts into Windows Terminal and PowerShell to sideload a DLL and open a reverse tunnel. see: TerminalFix ClickFix Campaign * [UPDATE (new)] Shadowserver counted over 8,300 unpatched Gitea servers exposed to CVE-2026-60004, the code-injection flaw CISA just added to its Known Exploited Vulnerabilities catalog. see: Gitea Servers Exposed to Active RCE * [TREND] Reading pieces question the AI boom's foundations, from Zitron's circular financing loop to Apple and OpenAI hardware pressuring Nvidia and Newport's doubts about rogue models. see: Premium: The Hater's Guide To Circular Financing (Part One); Apple Updates Mini and Studio, AI Computers, OpenAI Jalapeño; Has AI Gone Rogue? * [UPDATE (new)] The Steelers restructured DK Metcalf for $18M in cap space as Fittipaldo set his final 53-man roster and Hiles urged firing Pirates GM Cherington. see: Steelers Restructure Metcalf for $18M in Cap Space; Fittipaldo's Final 53-Man Roster Projection; Hiles Calls for Pirates to Fire Cherington SECURITY ---------------------------------------------------------------- 1. TERMINALFIX CLICKFIX CAMPAIGN Ransomware and Cybercrime · [clickfix, malware, phishing] Latest developments: Microsoft Threat Intelligence disclosed TerminalFix, a ClickFix variant that moves victims from the Windows Run dialog to Windows Terminal or PowerShell, then chains fake Cloudflare CAPTCHA prompts, DLL sideloading, and a reverse tunnel through a multistage intrusion. TerminalFix tricks users into pasting malicious commands into a terminal, raising the odds that complex payloads run, and establishes a reverse tunnel for remote control. Microsoft published detections and hunting guidance; block unexpected terminal execution and distrust CAPTCHA prompts that demand pasted commands. - The Hacker News: https://thehackernews.com/2026/08/terminalfix-uses-fake-cloudflare.html - Microsoft Security Blog: https://www.microsoft.com/en-us/security/blog/2026/08/28/terminalfix-campaign-deploys-reverse-tunnel-through-multistage-intrusion/ 2. AI-DRIVEN VULNERABILITY DISCOVERY AND THE VULNPOCALYPSE AI Security · [ai, vulnerability, bug-bounty] Latest developments: AI industry leaders warned a cybersecurity apocalypse could land within months as machine-generated bug reports flooded bounty programs, and Dark Reading reported the surge pushes down the payouts independent researchers depend on. AI systems now surface software flaws faster than vendors triage, enrich, and patch them, repricing bug-bounty markets and pressuring defenders while firms weigh agentic red teaming and penetration testing. Security teams should correlate multiple intelligence feeds and shorten remediation cycles. - Wired Security: https://www.wired.com/story/security-news-this-week-the-cybersecurity-apocalypse-is-coming-in-months-ai-giants-warn/ - Dark Reading: https://www.darkreading.com/vulnerabilities-threats/vulnpocalypse-repricing-bug-bounty-economy - BleepingComputer: https://www.bleepingcomputer.com/news/security/ai-is-accelerating-vulnerability-discovery-can-defenders-keep-up/ - Dark Reading: https://www.darkreading.com/cybersecurity-operations/offensive-security-investments-surge-ai-threats-increase 3. CRYPTO-DRAINING CHROME AND EDGE EXTENSIONS Ransomware and Cybercrime · [cryptocurrency, browser, malware] Latest developments: Socket researcher Karlo Zanki uncovered 18 Google Chrome extensions and one Microsoft Edge extension, all published over the past six months, that share code and tradecraft to steal wallet secrets and drain cryptocurrency. The 19 extensions carried wallet-stealing and crypto-draining capabilities and reached users through the official browser stores. Remove the flagged add-ons and rotate any wallet credentials that touched them. - The Hacker News: https://thehackernews.com/2026/08/19-chrome-and-edge-extensions-found.html 4. ENTERPRISE CHAT APPS FUEL CHINA FRAUD WAVE Ransomware and Cybercrime · [fraud, social-engineering] Latest developments: Wired reported that fraudsters abuse Microsoft Teams and Cisco Webex to pose as trusted contacts and trick Chinese victims into transferring large sums, fueling a surge of complaints. Scammers exploit the implicit trust of enterprise collaboration platforms to run financial cons at scale against users in China. Verify payment requests through a separate channel and restrict external chat contact. - Wired Security: https://www.wired.com/story/microsoft-teams-is-becoming-a-haven-for-chinese-scammers/ 5. COSMOS EVM FUND DRAIN Vulnerabilities and Exploits · [exploit, cryptocurrency, zero-day] Latest developments: Cosmos Labs warned that attackers exploited a critical balance-handling flaw in the shared Cosmos EVM module, tracked as GHSA-7g4w-cg88-2cq2, to drain funds from six blockchains between August 20 and August 25, 2026. The bug hits Cosmos EVM versions below 0.6.2 and shipped without a CVE identifier, weakness class, or CVSS score even though Cosmos Labs knew every chain running the module was vulnerable. Operators should upgrade at once and audit balances. - The Hacker News: https://thehackernews.com/2026/08/cosmos-evm-flaw-exploited-after-cosmos.html 6. GITEA SERVERS EXPOSED TO ACTIVE RCE Vulnerabilities and Exploits · [patch, rce, kev] Latest developments: Shadowserver counted more than 8,300 internet-exposed Gitea instances still unpatched against CVE-2026-60004, the code-injection flaw CISA added to its Known Exploited Vulnerabilities catalog on August 25, 2026, as remote-code-execution attacks continue. The flaw lets attackers run code on self-hosted Gitea git servers, and thousands stay open weeks after the fix shipped. Administrators should patch to the latest release and pull management interfaces off the public internet. - BleepingComputer: https://www.bleepingcomputer.com/news/security/over-8-300-gitea-servers-vulnerable-to-code-execution-attacks/ BUSINESS AND POLITICS ---------------------------------------------------------------- * U.S. Secures Stake in Venezuela's Oil Latest developments: The Wall Street Journal detailed August 30 how the pact would hand the Pentagon a direct stake in Venezuela's oil, the first look at the joint venture's structure since Trump's announcement. President Trump said the United States and Venezuela formed a joint venture giving Washington rights to roughly 65 billion barrels—about a fifth of Venezuela's proven reserves—with the Pentagon holding an interest; Trump says the deal will lower U.S. gasoline prices, while both Maduro loyalists and the opposition condemn it as looting and foreign meddling. - WSJ World News: https://www.wsj.com/business/energy-oil/inside-trumps-plan-to-give-the-pentagon-a-stake-in-venezuelas-oil-riches-f054cdc2?mod=rss_worldnews - FT World: https://www.ft.com/content/2f88581f-4fbc-46a2-8127-830bb630c2f2?syn-25a6b1a6=1 - The Economist: https://www.economist.com/the-americas/2026/08/29/americas-murky-deal-to-secure-a-fifth-of-venezuelas-oil * Rising Yields Lift G7 Debt Costs as Fed Turns Hawkish Latest developments: The Financial Times reported August 30 that bond yields climbing since the U.S.-Iran war have added tens of billions to Group of Seven debt-servicing costs, with U.S. jobs data this week set to test the Fed's new hawkish stance. Higher government bond yields across the Group of Seven have added tens of billions of dollars in annual financing costs since the U.S.-Iran war began, straining public finances; Federal Reserve Chair Kevin Warsh's Jackson Hole signal that rates could rise has put the central bank on a collision course with President Trump before November's midterms, and Friday's U.S. jobs report will test whether that stance holds. - FT World: https://www.ft.com/content/bbe90db5-64ac-441d-87e4-e984c5ef8629?syn-25a6b1a6=1 - FT World: https://www.ft.com/content/c2682d2b-c5a4-4f98-8f04-cf93883fb9b6?syn-25a6b1a6=1 PITTSBURGH ---------------------------------------------------------------- Weather: Today: Mostly Sunny, high 85F. Tonight: Mostly Cloudy, low 69F. Monday: Partly Sunny, high 90F. Business: * Miners Sue Core Natural Resources Over Safety Retaliation Latest developments: Two miners filed suit against Core Natural Resources, saying the company punished them for raising safety concerns at its Bailey mine, the Post-Gazette reported August 30. Two miners sued Core Natural Resources, the coal producer that runs the Bailey mine in southwestern Pennsylvania, alleging the company retaliated against them after they flagged safety problems underground. - Pittsburgh Post-Gazette: https://www.post-gazette.com/business/powersource/2026/08/30/mine-core-natural-resources-bailey-death-wolfe/stories/202608290006 * Pittsburgh Startup Debuts Pothole-Patching Rovers Latest developments: The Post-Gazette reported August 30 that Silly Surfacing, a Pittsburgh startup, has unveiled autonomous rovers built to repair potholes. Silly Surfacing, a Pittsburgh startup, introduced road-repairing robot rovers designed to automate pothole patching, part of the city's growing cluster of robotics and autonomy ventures. - Pittsburgh Post-Gazette: https://www.post-gazette.com/business/tech-news/2026/08/30/pittsburgh-potholes-silly-surfacing-robots/stories/202608210055 * Jerry's Records Marks 50 Years Latest developments: Jerry's Records, the Squirrel Hill used-vinyl shop, celebrated five decades in business this weekend, WPXI reported August 30. Jerry's Records, a fixture of Pittsburgh's Squirrel Hill neighborhood, reached its 50th year selling used vinyl, one of the region's longest-running independent record stores. - WPXI: https://www.wpxi.com/news/local/jerrys-records-squirrel-hill-celebrates-50-years-business/NUYZAF47XZAZDMVT7YB3TFAC7A/ Around town: * Harrison's Sheldon Park to Shift to Section 8 Latest developments: The Sheldon Park apartments in Harrison will likely convert from public housing to Section 8, potentially clearing the way for renovations, TribLive reported August 30. The Sheldon Park apartments in Harrison, a public-housing complex, are set to switch to Section 8 vouchers, a change that could open the door to renovations, though a final decision and timeline remain unset. - TribLive: https://triblive.com/local/valley-news-dispatch/sheldon-park-in-harrison-likely-to-switch-from-public-housing-to-section-8-renovations-could-follow/ * Carnegie Library's Love Your Library Drive Latest developments: PublicSource highlighted August 30 the September Love Your Library campaign supporting Carnegie Library of Pittsburgh. Carnegie Library of Pittsburgh's annual Love Your Library campaign runs through September across Allegheny County, asking patrons to donate to the system, with organizers spotlighting readers who credit the branches with steadying their lives. - PublicSource: https://www.publicsource.org/love-your-library-september-allegheny-county-carnegie-library-pittsburgh-donate-reading/ * Penn State Students Help Ready NASA's Roman Telescope Latest developments: NASA launched the Nancy Grace Roman Space Telescope on Sunday, August 30, carrying instrumentation work done by Penn State students, WPXI reported. A group of Penn State students helped prepare NASA's Nancy Grace Roman Space Telescope, which lifted off August 30 to hunt for planets around other stars, probe dark energy, and survey the cosmos. - WPXI: https://www.wpxi.com/news/local/penn-state-students-helped-prepare-powerful-nancy-grace-roman-space-telescope/HULYWEHAOBCWXNFLMPKGQBFNWY/ SPORTS ---------------------------------------------------------------- Around the Teams: * Hiles Calls for Pirates to Fire Cherington Latest developments: Post-Gazette writer Noah Hiles argued August 30 that the Pirates should clean house, starting by firing general manager Ben Cherington and president Travis Williams. Noah Hiles of the Post-Gazette wrote that the Pirates' collapse warrants a front-office overhaul, naming general manager Ben Cherington and team president Travis Williams as the places to start. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/08/30/fire-ben-cherington-travis-williams/stories/202608300073 * Steelers Restructure Metcalf for $18M in Cap Space Latest developments: The Post-Gazette reported August 27 that the Steelers restructured receiver DK Metcalf's contract to create about $18 million in salary-cap room. The Pittsburgh Steelers reworked wide receiver DK Metcalf's deal to open roughly $18 million in cap space, giving general manager Omar Khan added flexibility heading into the regular season. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/08/27/dk-metcalf-contract-cap-space-restructure/stories/202608270042 * Fittipaldo's Final 53-Man Roster Projection Latest developments: Ray Fittipaldo published his final Steelers 53-man roster projection August 28 ahead of the league's cut-down deadline. Post-Gazette beat writer Ray Fittipaldo laid out his last projection of the Steelers' 53-man roster before cuts, weighing the camp battles that would decide who survives the deadline. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/08/28/steelers-roster-projection-camp-cuts/stories/202608280041 Team USA: * Cavan Sullivan Sets MLS Teen Record Latest developments: Cavan Sullivan scored August 29 to become the first 16-year-old in MLS history with goal contributions in four consecutive matches. Cavan Sullivan, the 16-year-old Philadelphia Union midfielder, found the net for a second straight game and became the youngest player in Major League Soccer history to record goal contributions in four consecutive matches. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49768706/cavan-sullivan-philadelphia-union-mls-history * Chris Richards Regroups After USMNT's World Cup Exit Latest developments: Chris Richards told ESPN he has refocused on Crystal Palace and the Premier League after the U.S. men's World Cup run ended. Chris Richards, the U.S. men's national team defender who plays for Crystal Palace, said the abrupt end of his World Cup on home soil left little time to grieve before he returned to the Premier League season. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49732248/that-lifelong-dream-done-usmnt-chris-richards-puts-world-cup-heartbreak-focus-palace-premier-league READING ---------------------------------------------------------------- * Ed Zitron -- Premium: The Hater's Guide To Circular Financing (Part One) Zitron argues the AI boom rests on circular financing, with Nvidia funding the labs that then buy its GPUs, and mocks the arrangement as a fragile loop dressed up as growth. https://www.wheresyoured.at/premium-the-haters-guide-to-circular-financing-part-one/ * Stratechery -- Apple Updates Mini and Studio, AI Computers, OpenAI Jalapeño Ben Thompson argues Apple's updated Mac mini and Studio and OpenAI's new hardware announcements, though wholly different, both apply mounting pressure on Nvidia. https://stratechery.com/2026/apple-updates-mini-and-studio-ai-computers-openai-jalapeno/ * Cal Newport -- Has AI Gone Rogue? Newport weighs recent claims that AI models are going rogue and contends the summer's real story is the shaky financial position of the AI labs chasing record IPOs. https://calnewport.com/has-ai-gone-rogue/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,689.72 = -0.0% Dow 53,517.57 ▲ +0.5% Nasdaq 26,241.09 ▼ -0.2% WTI crude 83.31 ▼ -3.2% EUR/USD 1.1648 ▲ +0.1% GBP/USD 1.3627 ▲ +0.4% USD/JPY 159.40 ▲ +0.3% ================================================================ Generated 2026-08-30 08:06 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================