================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Tuesday, September 1, 2026 - 7:35 PM EDT ================================================================ OpenAI's plan to release a model rated for critical cyber abilities crystallized a day when artificial intelligence turned decisively offensive, even as a dark-web service put 153 million drivers licenses up for sale. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Frontier models turned offensive as OpenAI readied its Astra model and Forescout pushed Claude to port a PLC exploit, while Newport reweighs AI agents 'at war' with defenders. see: AI Crosses Into Offensive Cyber Capabilities; Are We at War with AI Agent "Civilizations"? * [TREND] Attackers leaned on trust and unpatched tools, with ClickFix lures and Teams vishing opening doors while 22,000 Exchange servers and JFrog Artifactory sit under active exploitation. see: ClickFix and Vishing Dominate Initial Access; Enterprise and Developer Tools Under Active Exploitation * [TREND] State and criminal crews widened their reach as China's Fire Ant weaponized Cisco routers, Breeze Comet drove Brazilian payment fraud, and a service peddled 153 million drivers licenses. see: China's Fire Ant Turns Cisco Routers Into Attack Platform; Brazilian Payment Fraud: Breeze Comet and Guildma; FBI Probes Sale of 153 Million Drivers Licenses * [UPDATE (new)] Fresh U.S. strikes on Iran pushed crude back to $90 and deepened a global bond sell-off, driving Treasury yields to session highs. see: U.S. Escalates Strikes on Iran; Global Bond Sell-Off Deepens * [UPDATE (new)] Pittsburgh's 2026 deficit swelled to $30 million even as PRT landed an $82.8 million grant for new T trains, and measles exposures surfaced at UPMC Children's Hospital. see: Pittsburgh Budget Deficit Swells to $30M; PRT Wins $82.8M Grant for T Train Replacement; Measles Exposure at UPMC Children's Hospital SECURITY ---------------------------------------------------------------- 1. ENTERPRISE AND DEVELOPER TOOLS UNDER ACTIVE EXPLOITATION Vulnerabilities and Exploits · [patch, exploit, credential-theft] Latest developments: Nearly 22,000 internet-exposed Microsoft Exchange servers remain unpatched against a high-severity authentication bypass that hijacks every mailbox, watchTowr caught attackers minting admin tokens through JFrog Artifactory's CVE-2026-82329 days after disclosure, Langflow's CVE-2026-0768 exploitation now harvests OpenAI and AWS keys, and the freshly patched PaperCut zero-days drive data-theft attacks. A run of internet-facing developer and enterprise platforms faces rapid post-disclosure exploitation for admin access and credential theft; administrators should patch Exchange, Artifactory, Langflow, and PaperCut immediately. - BleepingComputer: https://www.bleepingcomputer.com/news/security/nearly-22-000-microsoft-exchange-servers-vulnerable-to-hijack-attacks/ - The Hacker News: https://thehackernews.com/2026/09/attackers-exploit-critical-jfrog.html - BleepingComputer: https://www.bleepingcomputer.com/news/security/critical-langflow-flaw-exploited-to-steal-openai-and-aws-keys/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/recently-patched-papercut-zero-days-used-in-data-theft-attacks/ 2. CLICKFIX AND VISHING DOMINATE INITIAL ACCESS Ransomware and Cybercrime · [clickfix, phishing, social-engineering] Latest developments: Unit 42 exposed Spring Ring, a January-to-April 2026 campaign that spun up fake IT-support accounts on Microsoft Teams to reach more than 150 employees at over 10 companies, a separate ClickFix operation compromised 31 organizations and hid its command server on the Polygon blockchain through EtherHiding, and phishing actors abused the Faronics Deploy admin platform to plant ScreenConnect. Attackers lean on human trust and legitimate remote-management tools rather than software exploits to breach networks; train staff to distrust unsolicited support contacts and terminal commands, and lock down remote-access installs. - Help Net Security: https://www.helpnetsecurity.com/2026/09/01/spring-ring-vishing-campaign-microsoft-teams/ - Dark Reading: https://www.darkreading.com/endpoint-security/clickfix-campaign-comprises-31-orgs-abuses-polygon-blockchain - BleepingComputer: https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/ - The Hacker News: https://thehackernews.com/2026/09/threat-actors-dont-want-better-attacks.html 3. AI CROSSES INTO OFFENSIVE CYBER CAPABILITIES AI Security · [ai, policy, zero-day] Latest developments: OpenAI told select partners it will grant early access to Astra, its first model it rates as carrying critical cyber abilities, so they can shore up defenses; Forescout researchers drove Claude to port a WAGO PLC remote-code-execution exploit between models in hours for a few hundred dollars; and Financial Stability Board chair Andrew Bailey warned that frontier-AI cyber risk poses the most immediate concern to the global financial system. Capable models now accelerate exploit development and offensive operations, pressuring defenders across critical infrastructure and finance to harden systems before adversaries adopt the same tools. - Wired Security: https://www.wired.com/story/openai-astra-first-ai-model-with-critical-cyber-abilities/ - SecurityWeek: https://www.securityweek.com/experiment-porting-a-plc-exploit-with-ai-takes-hours-and-hundreds-of-dollars/ - The Record: https://therecord.media/cyber-risk-from-frontier-ai-most-immediate-concern-to-global-finance 4. BRAZILIAN PAYMENT FRAUD: BREEZE COMET AND GUILDMA Ransomware and Cybercrime · [fraud, banking, malware] Latest developments: Google Threat Intelligence Group and Mandiant unmasked Breeze Comet, formerly tracked as UNC5669, a financially motivated crew that has manipulated Brazilian payment and banking software to push hundreds of fraudulent transfers since 2024, while the SANS Internet Storm Center dissected fresh Guildma, also called Astaroth, infections arriving through Brazilian Portuguese email. Two campaigns hammer Brazil's financial, retail, and e-commerce sectors, one draining accounts by subverting banking systems and the other spreading banking malware by email; regional institutions should tighten transaction monitoring and email defenses. - The Hacker News: https://thehackernews.com/2026/09/breeze-comet-executes-hundreds-of.html - SANS Internet Storm Center: https://isc.sans.edu/diary/rss/33300 5. FBI PROBES SALE OF 153 MILLION DRIVERS LICENSES Data Breaches · [breach, identity-theft] Latest developments: KrebsOnSecurity reported that a dark-web identity-theft service launched this week sells digital scans of more than 153 million US and Canadian drivers licenses, apparently siphoned from a widely used Louisiana identity-verification company, and that the FBI's New Orleans field office has opened a probe. The service peddles license images tied to a mainstream identity-verification firm, exposing tens of millions to identity theft; affected residents should freeze credit and watch financial accounts. - Krebs on Security: https://krebsonsecurity.com/2026/09/fbi-probes-service-selling-153m-drivers-licenses/ 6. CHINA'S FIRE ANT TURNS CISCO ROUTERS INTO ATTACK PLATFORM Nation-State Activity · [apt, china, espionage] Latest developments: Researchers detailed Fire Ant, a China-nexus campaign that compromised Cisco routers and pivoted through them to launch further intrusions, describing an operation that broke the trust layer downstream systems depend on rather than merely breaching individual hosts. Fire Ant plants itself in edge routers to reach protected internal targets while blending into trusted network paths; operators should audit router firmware, management access, and unexpected traffic pivots. - The Record: https://therecord.media/router-hacks-fire-ant-group-china BUSINESS AND POLITICS ---------------------------------------------------------------- * U.S. Escalates Strikes on Iran Latest developments: The U.S. military launched fresh strikes on Iranian targets today, sending WTI crude back to $90 and driving Treasury yields to the day's highs as President Trump warned Iran it would be hit at a much harder level if it retaliated. Trump ordered the strikes in response to Iran's attempts to mine the Strait of Hormuz and target American servicemembers, and he summoned oil refiners to the White House as soaring diesel prices threatened a fresh inflationary spiral. - WSJ World News: https://www.wsj.com/world/middle-east/iran-strikes-us-1d263f3f?mod=rss_worldnews - FT Markets: https://www.ft.com/content/c557ccc2-9fe7-4725-8a1c-c40a0948e8d3?syn-25a6b1a6=1 - WSJ Markets: https://www.wsj.com/finance/commodities-futures/oil-rises-on-prospect-for-prolonged-supply-disruptions-in-middle-east-2b9b6919?mod=rss_markets_main * Global Bond Sell-Off Deepens Latest developments: The rout intensified today as the oil spike from the Iran strikes became the inflationary trigger driving yields to session highs, with Europe's bond markets suffering a post-holiday shock on top of the earlier U.K. and Japanese records. U.K. borrowing costs hit their highest since 2008 and Japanese yields reached peaks unseen since the 1990s, lifting the cost of money for governments, home buyers, and credit-card holders and heaping pressure on debt-laden treasuries worldwide. - WSJ Markets: https://www.wsj.com/finance/investing/bond-yields-around-the-world-soar-in-challenge-to-government-borrowing-c519c53f?mod=rss_markets_main - FT Markets: https://www.ft.com/content/e6f5f97a-b199-444e-aaec-b8199359b08e?syn-25a6b1a6=1 - WSJ Markets: https://www.wsj.com/finance/investing/oil-prices-push-global-bond-market-closer-to-the-edge-13135ed4?mod=rss_markets_main PITTSBURGH ---------------------------------------------------------------- Weather: Tonight: Chance Showers And Thunderstorms, low 73F. Wednesday: Slight Chance Showers And Thunderstorms, high 93F. Wednesday Night: Chance Showers And Thunderstorms, low 73F. Business: * Pittsburgh Budget Deficit Swells to $30M Latest developments: Pittsburgh budget officials said Tuesday, September 1, that they now expect the city's 2026 deficit to reach $30 million, larger than earlier projections. The widening shortfall deepens fiscal strain on the city's general fund as the year plays out, forcing officials to revise their earlier estimate upward. - TribLive: https://triblive.com/local/projected-2026-pittsburgh-budget-deficit-swells-to-30m/ * Sunday Touts Retail-Crime Section at Cranberry Walmart Latest developments: Attorney General Dave Sunday visited the Walmart in Cranberry Township on Tuesday, September 1, to highlight his office's new organized retail crime section. Sunday said Pennsylvania businesses should not have to fight organized retail crime alone as his office ramps up investigation and prosecution of increasingly sophisticated theft and fraud at stores. - KDKA: https://www.cbsnews.com/pittsburgh/news/attorney-general-organized-retail-crime-section/ Around town: * PRT Wins $82.8M Grant for T Train Replacement Latest developments: Pittsburgh Regional Transit will receive an $82.8 million grant to jump-start replacement of its aging T light-rail trains, the agency said Tuesday, September 1. The money launches a long-planned effort to replace Pittsburgh Regional Transit's light-rail fleet serving Downtown, the South Hills, and the North Shore. - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/transportation/2026/09/01/pittsburgh-regional-transit-train-replacement/stories/202609010061 * Measles Exposure at UPMC Children's Hospital Latest developments: Two people tested positive for measles after visiting UPMC Children's Hospital of Pittsburgh last week, prompting the Allegheny County Health Department to warn of possible exposures in several areas of the hospital. The county clarified that it has no data showing any Allegheny County resident has measles, since cases are attributed to a patient's county of residence; this marks the second potential exposure at the Lawrenceville children's hospital in a month, amid a statewide outbreak. - TribLive: https://triblive.com/news/health-now/2-test-positive-for-measles-after-visiting-upmc-childrens-hospital-of-pittsburgh/ - WPXI: https://www.wpxi.com/news/local/allegheny-county-says-theres-no-data-that-resident-has-measles-what-would-happen-if-anyone-did/RWSMEA2WFBDBTMSL7PHKWNZVGQ/ * Franklin & Marshall Poll Shows Trump at 27% Latest developments: The latest Franklin & Marshall College Poll put President Trump's job-approval rating at 27%, down 12 points from March and the lowest for any president heading into a midterm in 20 years. The Lancaster-based survey signals eroding support in Pennsylvania as the November midterm elections approach. - TribLive: https://triblive.com/news/pennsylvania/poll-trumps-job-approval-going-into-midterms-lower-than-any-president-in-20-years/ SPORTS ---------------------------------------------------------------- Around the Teams: * Porter Noncommittal on Week 1 Amid Contract Talks Latest developments: Cornerback Joey Porter Jr. returned to Steelers practice Tuesday, September 1, beginning a ramp-up, and declined to commit to playing the season opener unless he and the team reach a new deal. The Post-Gazette reported that Porter left his Week 1 status open as contract negotiations continue; on the team's SNR Drive, Matt Williamson and Wes Uhler walked through the ramp-up process and GM Omar Khan's remarks on it. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/09/01/joey-porter-practice-contract-negotiations/stories/202609010047 - Pittsburgh Steelers (YouTube): https://www.youtube.com/watch?v=OnDKSBrs71M * Pirates Add Eisert, Bethancourt for September Latest developments: The Pirates added reliever Brandon Eisert and catcher Christian Bethancourt to their expanded September roster, the Post-Gazette reported Tuesday, September 1. The Post-Gazette detailed the reasoning behind the call-ups as the Pirates round out their roster for the final month of the season. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/09/01/brandon-eisert-christian-bethancourt-september-callups/stories/202609010029 * Beat Writers Map Pirates' September Storylines Latest developments: The Post-Gazette laid out five September storylines to follow even as the Pirates' postseason hopes dwindle, spotlighting prospects Rafael Flores and Braxton Ashcraft. The column framed the season's final month around player evaluations, including catcher Rafael Flores and pitcher Braxton Ashcraft, as Pittsburgh plays out the string. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/09/01/september-storylines-rafael-flores-braxton-ashcraft/stories/202609010019 Team USA: * Balogun's Everton Move Goes to the Wire Latest developments: Everton filed a deal sheet with the Premier League seeking a two-hour extension to the transfer deadline to complete a move for U.S. forward Folarin Balogun, with the deal potentially reaching $54 million, ESPN reported. Everton submitted a £35 million ($47.5m) offer for the AS Monaco striker; the deadline-day scramble followed Iliman Ndiaye's £88 million departure to Manchester City, which cleared room for Balogun at Goodison Park. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49783677/everton-deal-usmnt-forward-folarin-balogun-sources - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49795948/everton-need-extension-folarin-balogun-deal * Southampton Loans Downs to St. Louis City Latest developments: St. Louis City SC is set to acquire U.S. forward Damion Downs on loan from English Championship side Southampton, a source with direct knowledge confirmed to ESPN. The loan brings the young United States international to Major League Soccer's St. Louis City SC for the season. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49785118/southampton-loans-usmnt-downs-st-louis READING ---------------------------------------------------------------- * Ed Zitron -- Hyperscale Normalization Zitron argues that the press and markets have normalized the enormous, unsustainable capital spending of the hyperscale cloud giants on AI infrastructure, treating extraordinary outlays as routine business. https://www.wheresyoured.at/hyperscale-normalization/ * Stratechery -- Nvidia Earnings, Dollars Per Gigawatt, Open and Hugging Face Ben Thompson reads Nvidia's blowout-yet-boring earnings through the frame of dollars per gigawatt and open models, arguing that every move the company makes aims to keep the AI market fragmented rather than letting it consolidate. https://stratechery.com/2026/nvidia-earnings-dollars-per-gigawatt-open-and-hugging-face/ * Cal Newport -- Are We at War with AI Agent "Civilizations"? Newport revisits OpenAI's fuller disclosures about its July hacking attack and questions the framing of autonomous AI agents as adversarial 'civilizations' at war with human systems. https://calnewport.com/are-we-at-war-with-ai-agent-civilizations/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,684.59 ▼ -0.1% Dow 53,442.76 ▲ +0.3% Nasdaq 26,234.79 ▼ -0.3% WTI crude 83.46 ▼ -3.1% EUR/USD 1.1639 ▼ -0.2% GBP/USD 1.3586 ▼ -0.2% USD/JPY 159.53 ▲ +0.4% ================================================================ Generated 2026-09-01 19:35 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================