================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Monday, August 31, 2026 - 10:05 AM EDT ================================================================ McKesson confirms a third-party breach as ShinyHunters counts down its extortion clock, while attackers increasingly turn AI coding tools and commodity infostealers against their targets. CONTENTS: Emerging Trends and Key Updates | Security | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Attackers are turning AI coding tools against their owners, with the Russian-speaking Aurora crew driving Cursor to break into at least 10 target networks. see: Aurora Ransomware Deploys Cursor AI * [UPDATE (new)] Commodity infostealers lifting live login sessions forced Anthropic to log affected Claude users out en masse and strip their stored payment data. see: Anthropic Locks Out Claude Users * [UPDATE (new)] McKesson confirmed a third-party intrusion detected August 25 as ShinyHunters' extortion deadline nears over hundreds of millions of stolen records. see: McKesson Confirms Third-Party Breach * [TREND] Fresh critical bugs hit ServiceNow and a Ruby on Rails file-read flaw, while Silver Fox's ValleyRAT hides inside a signed QN Wallpaper tool. see: Critical Flaws in ServiceNow and Ruby on Rails; ValleyRAT Masquerades as Adware * [TREND] Reading pieces probe AI's finances, with Zitron mocking the circular money flow among Nvidia and labs and Newport questioning the shaky footing behind record IPOs. see: Premium: The Hater's Guide To Circular Financing (Part One); Has AI Gone Rogue? * [UPDATE (new)] Around town, Weiss Furniture closes after 107 years, KDKA warns of midweek heat and wind storms, and the Mister Rogers finale turns 25. see: Weiss Furniture Closing After 107 Years; Midweek Heat and Wind Storm Threat; Mister Rogers Finale Turns 25 SECURITY ---------------------------------------------------------------- 1. MCKESSON CONFIRMS THIRD-PARTY BREACH Data Breaches · [breach, extortion, healthcare] Latest developments: McKesson told the SEC it detected the intrusion on August 25, 2026, and now warns of service degradation as ShinyHunters' extortion deadline nears. McKesson, the largest U.S. pharmaceutical distributor, supplies drugs and medical products to pharmacies, hospitals, and clinics; attackers reached data through an unnamed third-party application, and ShinyHunters claims it took 284 million records. Customers and partners should brace for downstream disruption and watch for phishing that leans on the stolen data. - SecurityWeek: https://www.securityweek.com/mckesson-confirms-data-breach-as-attacker-deadline-looms/ - The Record: https://therecord.media/mckesson-cyberattack-ransomware-pharma - Help Net Security: https://www.helpnetsecurity.com/2026/08/31/healthcare-company-mckesson-data-breach/ 2. ANTHROPIC LOCKS OUT CLAUDE USERS AI Security · [infostealer, ai, account-takeover] Latest developments: Anthropic began logging affected users out and stripping stored payment data, and named the culprits—Vidar, Lumma, StealC, RedLine, and Acreed on Windows plus Atomic Stealer on a handful of Macs. Infostealer malware on customers' PCs lifted active Claude login sessions, letting attackers seize accounts and drain usage. The malware rides in on unofficial downloads; affected users should scan their machines, reset credentials, and re-authenticate. - SecurityWeek: https://www.securityweek.com/anthropic-warns-claude-users-of-infostealer-malware-infections/ - Help Net Security: https://www.helpnetsecurity.com/2026/08/31/claude-accounts-compromised-through-infostealer/ - BleepingComputer: https://www.bleepingcomputer.com/news/artificial-intelligence/anthropic-warns-infostealer-malware-is-hijacking-claude-sessions-to-drain-usage/ 3. CRITICAL FLAWS IN SERVICENOW AND RUBY ON RAILS Vulnerabilities and Exploits · [patch, rce, code-injection] Latest developments: ServiceNow patched three critical code-injection flaws that let attackers run arbitrary code and tamper with data, and researchers flagged active targeting of a Ruby on Rails arbitrary-file-read bug dubbed KindaRails2Shell that leaks secrets and enables remote code execution. Two heavily deployed enterprise platforms carry fresh critical bugs. ServiceNow administrators should apply the vendor fixes at once, and Rails operators should patch KindaRails2Shell before attackers pivot from reading files to executing code. - SecurityWeek: https://www.securityweek.com/servicenow-patches-3-critical-code-injection-vulnerabilities/ - SecurityWeek: https://www.securityweek.com/critical-ruby-on-rails-vulnerability-in-attackers-crosshairs/ 4. VALLEYRAT MASQUERADES AS ADWARE Ransomware and Cybercrime · [backdoor, malware, apt] Latest developments: Kaspersky detailed the Silver Fox group distributing the ValleyRAT backdoor disguised as QN Wallpaper, a genuine signed Chinese desktop-wallpaper tool, and running it under a trusted process to slip past the antivirus exclusions users grant such software. Silver Fox, a China-linked actor, targets Chinese-speaking victims by abusing the whitelist trust users extend to signed adware to plant a remote-access backdoor. Users should shun unofficial downloads and scrutinize signed adware before excluding it from scans. - The Hacker News: https://thehackernews.com/2026/08/valleyrat-backdoor-hides-in-signed.html - Securelist (Kaspersky): https://securelist.com/valleyrat-backdoor-adware/121175/ 5. NIGERIAN CYBERCRIMINALS FACE US CHARGES Ransomware and Cybercrime · [cybercrime, sextortion, arrest] Latest developments: The U.S. extradited two Nigerian men on Thursday to face sextortion charges tied to the deaths of two teenage victims in Mississippi and North Carolina, and investigators Erin West and Paul Raffile traveled to Nigeria and tracked a separate scammer to his doorstep. The cases show rising cross-border accountability for West African financial-sextortion crews that target minors and extort victims online. Parents and platforms should treat sudden intimate-image demands as a hallmark of these schemes. - BleepingComputer: https://www.bleepingcomputer.com/news/security/nigerians-charged-US-over-sextortion-deaths-of-us-teens/ - 404 Media: https://www.404media.co/how-cyber-sleuths-tracked-a-nigerian-scammer-to-his-doorstep/ 6. AURORA RANSOMWARE DEPLOYS CURSOR AI Ransomware and Cybercrime · [ransomware, ai] Latest developments: CloudSEK and Gambit Security found the Russian-speaking Aurora ransomware crew driving the Cursor AI coding assistant to break into at least 10 target networks, mapping the activity from exposed infrastructure the group left online. Aurora, also written Aur0ra, marks a move toward attackers wielding AI coding assistants operationally rather than merely as bait. Defenders should watch developer tooling for anomalous automated network activity. - The Hacker News: https://thehackernews.com/2026/08/aurora-ransomware-operators-use-cursor.html PITTSBURGH ---------------------------------------------------------------- Weather: Today: Scattered Rain Showers then Isolated Showers And Thunderstorms, high 87F. Tonight: Mostly Cloudy, low 72F. Tuesday: Mostly Sunny then Scattered Showers And Thunderstorms, high 92F. Business: * Weiss Furniture Closing After 107 Years Latest developments: WPXI reported today that Weiss Furniture will shut permanently after a final liquidation sale. Weiss Furniture, the family-owned retailer that has sold furniture in Latrobe for 107 years, is closing for good, ending more than a century of business in the Westmoreland County town. - WPXI: https://www.wpxi.com/news/local/weiss-furniture-latrobe-closing-after-107-years/TVPTLYQQOBEA5OEJWIQQLZ7YPI/ * Cyclosporiasis Scare Lifts Local Lettuce Sales Latest developments: The Post-Gazette reported today that fear of the cyclosporiasis parasite has pushed Pittsburgh-area shoppers toward regional lettuce growers. Worry over cyclosporiasis, an intestinal parasite tied to imported produce, has boosted sales for Pittsburgh-region lettuce growers as customers seek local supply, though growers question whether the bump will hold. - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/health/2026/08/31/cyclosporiasis-pittsburgh-lettuce-growers/stories/202608280061 Around town: * Midweek Heat and Wind Storm Threat Latest developments: KDKA's First Alert team said today it expects to issue First Alert Days for Tuesday through Thursday, September 1 to 3, as heat builds and wind storm chances rise across the Pittsburgh area. After passing morning showers, the Pittsburgh region faces warming temperatures and a midweek threat of damaging wind storms, with KDKA meteorologists flagging possible First Alert Days from Tuesday through Friday. - KDKA: https://www.cbsnews.com/pittsburgh/news/sunny-conditions-expected-today-for-the-pittsburgh-area-after-passing-morning-showers/ * Mister Rogers Finale Turns 25 Latest developments: TribLive marked today, August 31, as the 25th anniversary of the premiere of the final original episode of 'Mister Rogers' Neighborhood.' The last original episode of 'Mister Rogers' Neighborhood,' filmed at WQED's Oakland studios, first aired August 31, 2001, a quarter-century ago today. - TribLive: https://triblive.com/aande/movies-tv/tv-talk-its-been-25-years-since-the-last-original-episode-of-mister-rogers-neighborhood-first-aired/ SPORTS ---------------------------------------------------------------- Around the Teams: * Pirates Starters Defend Coach Bill Murphy Latest developments: In today's Off The Bat, the Post-Gazette asked whether pitching coach Bill Murphy caused the rotation's regression, and starters said no. The Pittsburgh Pirates' starting rotation has slipped this season, and the Post-Gazette's Off The Bat weighed whether pitching coach Bill Murphy deserves blame; pitchers Paul Skenes, Bubba Chandler, and Braxton Ashcraft defended him. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/08/31/pirates-bill-murphy-paul-skenes-bubba-chandler-braxton-ashcraft/stories/202608310005 Team USA: * Richards Moves Past World Cup Exit Latest developments: ESPN reported that U.S. men's national team defender Chris Richards has refocused on Crystal Palace after the Americans' early exit from the World Cup they co-hosted. Chris Richards, the U.S. men's national team center back who plays for Crystal Palace, told ESPN he had little time to grieve the United States' abrupt World Cup exit before returning to Premier League duty. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49732248/that-lifelong-dream-done-usmnt-chris-richards-puts-world-cup-heartbreak-focus-palace-premier-league READING ---------------------------------------------------------------- * Stratechery -- Meta Settles, A Framework For Regulating Content, The Rest of Big Tech Ben Thompson argues Meta's content settlement makes sense for every party, then uses it to sketch a framework for regulating technology while explaining why every such solution still feels off. https://stratechery.com/2026/meta-settles-a-framework-for-regulating-content-the-rest-of-big-tech/ * Ed Zitron -- Premium: The Hater's Guide To Circular Financing (Part One) In a satirical takedown, Zitron dissects the circular flow of money among Nvidia, AI labs, and their backers, arguing the arrangement inflates valuations across the industry. https://www.wheresyoured.at/premium-the-haters-guide-to-circular-financing-part-one/ * Cal Newport -- Has AI Gone Rogue? Newport contends the real AI story of the summer is the shaky financial footing of the labs chasing record IPOs, questioning the distance between technology hype and business reality. https://calnewport.com/has-ai-gone-rogue/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,689.72 = -0.0% Dow 53,517.57 ▲ +0.5% Nasdaq 26,241.09 ▼ -0.2% WTI crude 83.31 ▼ -3.2% EUR/USD 1.1667 ▲ +0.4% GBP/USD 1.3627 ▲ +0.4% USD/JPY 159.17 ▲ +0.1% ================================================================ Generated 2026-08-31 10:05 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================