================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Tuesday, September 1, 2026 - 7:06 AM EDT ================================================================ Attackers escalate PaperCut zero-day exploitation into data theft and remote-access footholds while a 9.5-million-record healthcare breach and a wave of AI-targeted intrusions widen the day's damage. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Enterprise software is falling within days of disclosure, as PaperCut zero-days escalate to data theft while JFrog Artifactory, Langflow, and Rails flaws draw active exploitation. see: PaperCut Zero-Days Escalate to Data Theft; Critical Flaws Exploited Across JFrog, Langflow, and Rails * [TREND] Attackers are treating AI as both target and weapon, draining $600,000 in METR credits and using ESET's GuardBreaker nuclear-weapon prompt to trip an LLM's safety filters. see: Attacks Turn on AI Systems and Agents * [TREND] Chinese and Iranian espionage crews are burrowing into edge devices, with Fire Ant turning a Cisco router into a listening post and Mirage Kitten deploying fresh backdoors. see: Chinese and Iranian Espionage Crews Expand * [UPDATE (new)] Ransomware crews are pressing victims, as Berlin refuses Rhysida's extortion over a city breach while Nutex Health and Aesto Health disclosed stolen patient data. see: Berlin Ties Breach to Rhysida Ransomware; Fresh Healthcare Data Breaches * [TREND] Global markets are rattled as Japan's 10-year yield hit a three-decade high and UK borrowing costs the highest since 2008, while renewed U.S.-Iran strikes lifted crude. see: Global Bond Sell-Off Deepens; Renewed U.S.-Iran Strikes Lift Oil * [TREND] Commentators are scrutinizing the AI boom, with Ben Thompson on Nvidia's earnings, Ed Zitron on circular financing, and Cal Newport questioning AI agent 'civilizations.' see: Nvidia Earnings, Dollars Per Gigawatt, Open and Hugging Face; Premium: The Hater's Guide To Circular Financing (Part One); Are We at War with AI Agent "Civilizations"? SECURITY ---------------------------------------------------------------- 1. PAPERCUT ZERO-DAYS ESCALATE TO DATA THEFT Vulnerabilities and Exploits · [zero-day, patch, exploit] Latest developments: CISA added PaperCut NG and MF flaws CVE-2026-81578 and CVE-2026-82078 to its Known Exploited Vulnerabilities catalog as attackers moved from initial compromise into data theft and covertly installed legitimate remote-access software on the servers they controlled. PaperCut NG and MF print-management servers exposed to the internet face active attacks that PaperCut Software first warned of on August 27, 2026; administrators should restrict web access to the application server and apply the patches at once. - BleepingComputer: https://www.bleepingcomputer.com/news/security/recently-patched-papercut-zero-days-used-in-data-theft-attacks/ - SecurityWeek: https://www.securityweek.com/papercut-exploitation-escalates-to-active-intrusions/ - Help Net Security: https://www.helpnetsecurity.com/2026/08/31/papercut-attack-remote-access-tools/ - CISA Advisories: https://www.cisa.gov/news-events/alerts/2026/08/31/cisa-adds-two-known-exploited-vulnerabilities-catalog 2. CRITICAL FLAWS EXPLOITED ACROSS JFROG, LANGFLOW, AND RAILS Vulnerabilities and Exploits · [patch, vulnerability, exploit] Latest developments: VulnCheck reported active exploitation of critical Langflow flaw CVE-2026-0768 and Ruby on Rails flaw CVE-2026-66066 for credential probing and command-and-control, exploitation of JFrog Artifactory authentication-bypass CVE-2026-82329 began days after its disclosure, WatchGuard patched three critical Fireware OS iked remote-code-execution flaws, and ServiceNow fixed three critical code-injection bugs. A cluster of critical remote-code-execution and authentication-bypass flaws hit developer, network, and enterprise platforms, several already under attack; administrators should patch JFrog Artifactory, Langflow, Rails, WatchGuard Fireware, and ServiceNow without delay. - SecurityWeek: https://www.securityweek.com/critical-jfrog-artifactory-vulnerability-reportedly-exploited-in-the-wild/ - The Hacker News: https://thehackernews.com/2026/09/attackers-exploit-critical-langflow-and.html - SecurityWeek: https://www.securityweek.com/watchguard-patches-critical-vulnerabilities/ - SecurityWeek: https://www.securityweek.com/servicenow-patches-3-critical-code-injection-vulnerabilities/ 3. ATTACKS TURN ON AI SYSTEMS AND AGENTS AI Security · [ai, prompt-injection, apt] Latest developments: METR disclosed that attackers stole an API key and burned about $600,000 in AI credits, ESET detailed the GuardBreaker technique in which Russia-aligned UAC-0099 plants a nuclear-weapon prompt in malware to trip an LLM's safety filters and block AI-assisted analysis of a Ukrainian target, and GreyNoise caught scanners impersonating OpenAI, Anthropic, and Perplexity crawlers to hunt exposed credentials. Threat actors now steal AI credentials, poison model inputs, and mimic AI crawlers; organizations running frontier models and AI agents should guard API keys as privileged secrets and validate crawler traffic. - The Hacker News: https://thehackernews.com/2026/09/attackers-steal-metr-api-key-and.html - The Hacker News: https://thehackernews.com/2026/09/russia-aligned-uac-0099-plants-nuclear.html - Help Net Security: https://www.helpnetsecurity.com/2026/08/31/ai-crawlers-scan-exposed-credentials/ - Schneier on Security: https://www.schneier.com/blog/archives/2026/08/hiding-prompt-injection-in-legal-filing.html 4. BERLIN TIES BREACH TO RHYSIDA RANSOMWARE Ransomware and Cybercrime · [ransomware, extortion, breach] Latest developments: The Rhysida ransomware gang listed Berlin on its data-leak site, and Governing Mayor Kai Wegner and Interior Senator Iris Spranger confirmed after an emergency Senate session at the Rotes Rathaus that the city refuses the extortion demand. Hackers breached Berlin's administrative network in mid-August 2026 and stole government data; the state government named Rhysida as the culprit and rejected the ransom. - Help Net Security: https://www.helpnetsecurity.com/2026/09/01/berlin-data-breach-rhysida-ransomware/ - The Record: https://therecord.media/berlin-says-it-wont-pay-ransom-after-hackers-steal-gov-data - BleepingComputer: https://www.bleepingcomputer.com/news/security/berlin-confirms-data-theft-after-rhysida-ransomware-attack-claims/ 5. FRESH HEALTHCARE DATA BREACHES Data Breaches · [breach, healthcare, ransomware] Latest developments: A ransomware gang claimed Nutex Health, which told the SEC that hackers accessed patient, employee, provider, and financial information, and healthcare technology firm Aesto Health said hackers stole personal and health data from its AWS infrastructure, affecting 9.5 million people. Two more healthcare organizations disclosed intrusions exposing patient and health records; affected patients should watch for identity theft and fraud tied to leaked medical and financial data. - SecurityWeek: https://www.securityweek.com/ransomware-gang-claims-nutex-health-data-breach/ - SecurityWeek: https://www.securityweek.com/9-5-million-impacted-by-aesto-health-data-breach/ 6. CHINESE AND IRANIAN ESPIONAGE CREWS EXPAND Nation-State Activity · [apt, espionage] Latest developments: Researchers caught Chinese group Fire Ant abusing an unexplained GRE tunnel on a Cisco IOS XR router to turn it into a covert spying platform, and Kaspersky tied Mirage Kitten to new backdoors NodeRabbit and PollCat in attacks on aviation and FinTech targets across the Middle East and Africa. State-linked actors keep colonizing network edge devices and specialized sectors; defenders should audit router tunnel interfaces and hunt for the NodeRabbit and PollCat implants in aviation and financial-technology environments. - BleepingComputer: https://www.bleepingcomputer.com/news/security/chinese-fire-ant-hackers-turn-cisco-routers-into-spying-platforms/ - Securelist (Kaspersky): https://securelist.com/mirage-kitten-new-backdoors-noderabbit-pollcat/121244/ BUSINESS AND POLITICS ---------------------------------------------------------------- * Global Bond Sell-Off Deepens Latest developments: Japan's 10-year yield hit 3.00% on September 1, its highest in three decades, and UK borrowing costs reached their highest since 2008 as the rout spread across major markets. A synchronized sell-off in government bonds drove yields higher worldwide on September 1, fed by climbing oil prices and inflation fears, lifting the odds of rate increases from the Federal Reserve and European Central Bank and dragging down stock futures and gold. - FT Markets: https://www.ft.com/content/e6f5f97a-b199-444e-aaec-b8199359b08e?syn-25a6b1a6=1 - WSJ Markets: https://www.wsj.com/economy/global/global-bond-yields-surge-as-oil-prices-fuel-inflation-worries-ef5c0192?mod=rss_markets_main - WSJ Markets: https://www.wsj.com/finance/investing/asia-u-s-bond-yields-rise-as-oil-prices-stoke-inflation-fears-e56e99d7?mod=rss_markets_main * Renewed U.S.-Iran Strikes Lift Oil Latest developments: The United States and Iran returned to tit-for-tat strikes, pushing crude higher on September 1 and reviving fears of a prolonged conflict choking Persian Gulf supply. Fresh fighting between American and Iranian forces deepened supply risks around the Strait of Hormuz, driving oil prices up and feeding the global inflation and bond-market anxiety that hit equities and travel and industrial stocks. - WSJ World News: https://www.wsj.com/finance/commodities-futures/oil-prices-rise-as-renewed-u-s-iran-fighting-deepens-hormuz-supply-risks-3a35f63a?mod=rss_worldnews - WSJ Markets: https://www.wsj.com/finance/commodities-futures/oil-rises-on-prospect-for-prolonged-supply-disruptions-in-middle-east-2b9b6919?mod=rss_markets_main PITTSBURGH ---------------------------------------------------------------- Weather: Today: Slight Chance Showers And Thunderstorms, high 91F. Tonight: Chance Showers And Thunderstorms, low 73F. Wednesday: Chance Showers And Thunderstorms then Slight Chance Showers And Thunderstorms, high 93F. Business: * Ligonier Township Regulates Data Centers Latest developments: Ligonier Township adopted a data-center ordinance, joining a growing list of Westmoreland County communities, even as officials floated revisions moments after passing it. Ligonier Township, in Westmoreland County, approved zoning rules governing data centers, part of a regional wave of municipalities moving to control the AI-driven build-out. - TribLive: https://triblive.com/local/westmoreland/ligonier-township-adopts-data-center-rules-with-revisions-planned/ * Prime Data Centers Faces Packed Hanover Hearing Latest developments: A packed crowd turned out for a hearing on Prime Data Centers' bid to build at Starpointe Business Park in Hanover Township. Prime Data Centers, a Dallas company, is seeking approval of two conditional-use applications to develop a data center at Starpointe Business Park in Hanover Township, Washington County. - WPXI: https://www.wpxi.com/news/local/hearing-over-plans-build-data-center-hanover-township-draws-packed-crowd/E2NZMIHHQZBXLDAKDD2XB4HQYA/ Around town: * PPS Families Brace for 12 School Closures Latest developments: As classes resume, PublicSource detailed how Pittsburgh Public Schools families are bracing for new teachers, class sizes, and cultures ahead of 12 closures set for next year or beyond. Pittsburgh Public Schools plans to close 12 schools starting next year, forcing many families into reassignment to unfamiliar buildings across the district. - PublicSource: https://www.publicsource.org/pps-parents-school-closures/ * Severe Storms Prompt Wednesday First Alert Day Latest developments: Forecasters declared Wednesday, September 2, a First Alert Weather Day, warning of strong winds and a tornado risk, with storm chances running through Friday. The Pittsburgh region faces storm chances beginning September 1 and lasting through Friday, September 4, with Wednesday flagged for strong winds and possible tornadoes. - KDKA: https://www.cbsnews.com/pittsburgh/news/storm-chances-will-be-in-place-for-the-pittsburgh-area-today/ * Pittsburgh's Nepalese Community Mourns Flood Dead Latest developments: Post-Gazette columnist Brandon McGinley wrote that catastrophic Himalayan flooding, which has killed more than 1,000 across Nepal and China, hits home for Pittsburgh's Nepalese community as it gathers for a vigil. Pittsburgh's Nepalese community is holding a vigil as flooding in Nepal and China leaves over 1,000 dead and thousands missing. - Pittsburgh Post-Gazette: https://www.post-gazette.com/local/city/2026/09/01/nepal-flood-pittsburgh-vigil/stories/202609010004 Events: * 'BURNBABYBURN!' Premieres at August Wilson House Latest developments: TribLive's reviewer praised the world premiere of 'BURNBABYBURN!,' co-produced by Pittsburgh Playwrights Theatre Company and the August Wilson House. Pittsburgh Playwrights Theatre Company and the August Wilson House, in the Hill District, are staging the world premiere of 'BURNBABYBURN!,' drawing strong reviews. - TribLive: https://triblive.com/aande/theater-arts/review-pittsburgh-playwrights-stuns-with-world-premier-of-burnbabyburn-at-the-august-wilson-house/ * Merged Pittsburgh Theaters Become Confluence Theater Latest developments: Pittsburgh Public Theater and Pittsburgh CLO revealed the merged company's name, Confluence Theater of Pittsburgh, and laid out a plan for going forward. Pittsburgh Public Theater and Pittsburgh CLO have completed their merger and will operate as Confluence Theater of Pittsburgh. - Post-Gazette Arts & Entertainment: https://www.post-gazette.com/ae/theater-dance/2026/08/31/confluence-theater-pittsburgh-name-merge-public-clo/stories/202608310026 * Splotter Con Returns for Third Year Latest developments: Pittsburgh City Paper previewed the third annual Splotter Con, a Pittsburgh tabletop gaming convention built around community over competition. Splotter Con, a Pittsburgh tabletop gaming convention now in its third year, gathers board-game enthusiasts with an emphasis on camaraderie. - Pittsburgh City Paper: https://www.pghcitypaper.com/arts-entertainment-2/splotter-con-doesnt-play-when-it-comes-to-tabletop-games/ * 'Forever Young' Dylan Tribute Documentary at Lindsay Theater Latest developments: A new documentary captures a Bob Dylan tribute by Pittsburgh musicians Joe Grushecky and Billy Price, screening at the Lindsay Theater. The documentary 'Forever Young' chronicles a Bob Dylan tribute performance by Pittsburgh artists Joe Grushecky and Billy Price, showing at the Lindsay Theater. - Post-Gazette Arts & Entertainment: https://www.post-gazette.com/ae/music/2026/08/27/forever-young-bob-dylan-documentary-joe-grushecky-billy-price-lindsay-theater/stories/202608270049 SPORTS ---------------------------------------------------------------- Around the Teams: * Watt and Steelers Edge Room Talk Camp Latest developments: On Not Just Football, Cam Heyward hosted the outside-linebacker group—T.J. Watt, Alex Highsmith, Nick Herbig, and Jack Sawyer—to break down offseason contracts and life under the new defense. Cam Heyward's Not Just Football podcast featured Steelers pass rushers T.J. Watt, Alex Highsmith, Nick Herbig, and Jack Sawyer discussing training camp, their contracts, and adjusting to a new defensive system. - Not Just Football with Cam Heyward: https://www.youtube.com/watch?v=ANB7ezXcv3w * Hiles Calls for Pirates to Fire Cherington Latest developments: Post-Gazette columnist Noah Hiles argued the Pirates should clean house, starting by firing general manager Ben Cherington. Noah Hiles of the Post-Gazette wrote that the Pittsburgh Pirates need sweeping change, urging the dismissal of general manager Ben Cherington and pointing at team president Travis Williams. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/08/30/fire-ben-cherington-travis-williams/stories/202608300073 Team USA: * Stoke City Nears Deal for USMNT's McGlynn Latest developments: Stoke City entered the final stages of signing U.S. midfielder Jack McGlynn from the Houston Dynamo for a fee that could reach $5.5 million. Stoke City is closing on a transfer for United States international midfielder Jack McGlynn from the Houston Dynamo, a deal worth up to $5.5 million with add-ons. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49784197/stoke-city-deal-usmnt-mcglynn-houston-dynamo-sources READING ---------------------------------------------------------------- * Stratechery -- Nvidia Earnings, Dollars Per Gigawatt, Open and Hugging Face Ben Thompson argues Nvidia's blockbuster earnings were at once remarkable and boring, reflecting the company's drive to keep the AI world from consolidating around any single buyer. https://stratechery.com/2026/nvidia-earnings-dollars-per-gigawatt-open-and-hugging-face/ * Cal Newport -- Are We at War with AI Agent "Civilizations"? Cal Newport revisits OpenAI's July hacking incident and newly disclosed details, questioning the framing of autonomous AI agents as adversarial 'civilizations.' https://calnewport.com/are-we-at-war-with-ai-agent-civilizations/ * Ed Zitron -- Premium: The Hater's Guide To Circular Financing (Part One) Ed Zitron dissects the circular financing propping up the AI industry, skewering how Nvidia funds the AI labs that then buy its chips. https://www.wheresyoured.at/premium-the-haters-guide-to-circular-financing-part-one/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,684.59 ▼ -0.1% Dow 53,442.76 ▲ +0.3% Nasdaq 26,234.79 ▼ -0.3% WTI crude 83.46 ▼ -3.1% GBP/USD 1.3604 ▲ +0.1% USD/JPY 159.41 ▲ +0.3% ================================================================ Generated 2026-09-01 07:06 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================