================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Wednesday, September 2, 2026 - 1:35 PM EDT ================================================================ Attackers chained two SonicWall SMA 1000 zero-days into unauthenticated remote code execution while a BGP hijack poisoned Virtualizor updates, putting the network edge and the software supply chain under assault at once. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets | Feed Health EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Internet-facing gateways took the brunt of the day's exploitation, from SonicWall SMA1000 zero-days chained in attacks to active SQL injection in Sangoma Switchvox and exposed Cleo Harmony servers. see: SonicWall SMA1000 Zero-Days Chained in Attacks; Switchvox, Cleo, and GeoNetwork Flaws Open Servers * [TREND] Attackers keep moving upstream into trusted plumbing, hijacking BGP routes to poison Virtualizor updates, weaponizing Git configs against AI coding agents, and planting booby-trapped packages on Packagist. see: BGP Hijack Poisons Virtualizor and Softaculous Updates; Malicious Git Configs Hijack AI Coding Agents; StreamRat and Malicious Packagist Packages Hit Mobile Users * [TREND] AI now sits on both sides of the fight, with Anthropic and Palo Alto Networks selling machine-speed defenses while Newport weighs autonomous agents framed as hostile civilizations. see: AI-Speed Attacks Drive New Enterprise Safeguards; Are We at War with AI Agent "Civilizations"? * [UPDATE (new)] Two fresh victim disclosures: the FBI flagged OAuth consent phishing aimed at prominent individuals and their families, and Aesto Health said a December breach exposed 9.5 million patients. see: FBI Warns of OAuth Consent Phishing; Aesto Health Breach Exposes 9.5 Million Patients * [UPDATE (new)] Israeli forces seized a senior Hamas militant in a daylight raid deep inside Gaza despite U.S. pressure to slow attacks, straining the ceasefire. see: Israeli Raid Strains Gaza Ceasefire * [UPDATE (new)] Locally, Mario Lemieux sold his last Penguins stake, Clairton forfeited its football home opener, and Robert F. Kennedy Jr. disputed Pennsylvania's measles deaths as possibly fabricated. see: Lemieux Sells His Last Penguins Stake; Clairton Forfeits Its Home Opener; Kennedy Disputes Pennsylvania Measles Deaths SECURITY ---------------------------------------------------------------- 1. SONICWALL SMA1000 ZERO-DAYS CHAINED IN ATTACKS Vulnerabilities and Exploits · [zero-day, vpn, patch] Latest developments: SonicWall shipped updates for two zero-days its own researchers William Perry and Adam Babis found in Secure Mobile Access 1000 appliances—CVE-2026-83548, a pre-authentication server-side request forgery in the Appliance Management Console rated a perfect 10.0, and CVE-2026-83549—and confirmed attackers already chain the pair for unauthenticated remote code execution, a finding Sophos corroborated. SMA 1000 appliances serve as SSL VPN gateways for medium and large enterprises, government agencies, and managed security service providers, putting the flaws directly on the network edge. Administrators should patch immediately and hunt for compromise on any internet-facing instance. - The Hacker News: https://thehackernews.com/2026/09/attackers-exploit-two-sonicwall-sma.html - BleepingComputer: https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-actively-exploited-sma1000-zero-day-flaws/ - Sophos News: https://www.sophos.com/en-us/blog/sonicwall-83548-83549 - Help Net Security: https://www.helpnetsecurity.com/2026/09/02/sonicwall-sma-1000-cve-2026-83548-cve-2026-83549-zero-day-attacks/ 2. SWITCHVOX, CLEO, AND GEONETWORK FLAWS OPEN SERVERS Vulnerabilities and Exploits · [exploitation, patch, rce] Latest developments: A threat actor began exploiting CVE-2026-9586, a critical unauthenticated SQL injection in Sangoma Switchvox SMB Edition 8.3 rated 9.3, to plant reverse shells on internet-exposed VoIP systems, and CISA added that bug to its Known Exploited Vulnerabilities catalog alongside six others, among them JFrog Artifactory's CVE-2026-82329, LiteLLM's CVE-2026-59822, Kestra OSS command injection CVE-2026-49869, and Starlette request smuggling CVE-2026-48710; a public exploit also landed for a Cleo Harmony authentication bypass that abuses argument bearer manipulation, and GeoNetwork detailed two bugs that chain into unauthenticated remote code execution on the geospatial catalog behind many government geoportals. All three products sit on the internet edge at small businesses, file-transfer operations, and government agencies. Switchvox operators should hunt for compromise now, Cleo users should apply the vendor fix, and GeoNetwork administrators should move to version 4.4.12 or 4.2.17, released July 8, 2026. - The Hacker News: https://thehackernews.com/2026/09/attackers-exploit-critical-switchvox.html - CISA Advisories: https://www.cisa.gov/news-events/alerts/2026/09/02/cisa-adds-seven-known-exploited-vulnerabilities-catalog - SecurityWeek: https://www.securityweek.com/exploit-published-for-fresh-cleo-harmony-vulnerability/ - The Hacker News: https://thehackernews.com/2026/09/geonetwork-fixes-unauthenticated-rce.html 3. BGP HIJACK POISONS VIRTUALIZOR AND SOFTACULOUS UPDATES Vulnerabilities and Exploits · [supply-chain, bgp, malware] Latest developments: Virtualizor disclosed that attackers hijacked Border Gateway Protocol routing for Softaculous's update servers, presented a technically valid TLS certificate for the domains, and delivered a booby-trapped Virtualizor package that planted persistent root access, with one hosting provider finding 5 of 34 checked hypervisors compromised in a window that opened August 28, 2026, at 20:57. Virtualizor is VPS management software from Softaculous that runs on hypervisors, and the routing attack turned its update channel into a malware delivery pipe; operators should audit hypervisors for compromise and rebuild affected hosts. - The Hacker News: https://thehackernews.com/2026/09/bgp-hijack-delivers-malicious.html - SecurityWeek: https://www.securityweek.com/malicious-virtualizor-update-served-via-bgp-hijacking/ - Ars Technica Security: https://arstechnica.com/security/2026/09/well-executed-bgp-attack-uses-hijacked-ips-to-infect-real-networks/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/hackers-push-malicious-virtualizor-update-in-bgp-hijacking-attack/ 4. SALITY BOTNET DISRUPTED AFTER 23 YEARS Ransomware and Cybercrime · [botnet, takedown, malware] Latest developments: The Justice Department announced that authorities in the United States, Bulgaria, Hungary, and Romania, working with CrowdStrike and the Shadowserver Foundation, executed a takedown on August 31, 2026, manipulating Sality's peer lists and seizing its payload URLs to sever more than 15,000 infected machines from their operator. Sality surfaced in 2003 as a file-infecting virus and grew into a peer-to-peer botnet that rented infected Windows machines for further malware delivery. Owners of affected computers should scan for and remove file-infector remnants, since the sinkhole stops new payloads without cleaning hosts. - The Record: https://therecord.media/sality-botnet-cyber-doj - The Hacker News: https://thehackernews.com/2026/09/authorities-turn-salitys-p2p-network.html - Help Net Security: https://www.helpnetsecurity.com/2026/09/02/sality-botnet-disruption-crowdstrike-law-enforcement/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/sality-botnet-infrastructure-dismantled-in-joint-global-takedown/ 5. AI-SPEED ATTACKS DRIVE NEW ENTERPRISE SAFEGUARDS AI Security · [ai, agentic, defense] Latest developments: Anthropic unveiled Enterprise Frontier Safeguards, pairing zero data retention with automated misuse monitoring, Palo Alto Networks acquired the AI agent platform Console alongside 34% revenue growth, Sevii extended its detection-and-response platform to contain AI-driven attacks within minutes, and Unit 42 published its investigation of autonomous agents that breached an enterprise network in hours. As attackers wield AI agents to compromise networks at machine speed, security vendors are fielding autonomous defenses and misuse controls; enterprises should inventory AI usage and lock down agent credentials. - SecurityWeek: https://www.securityweek.com/anthropic-details-response-to-security-incidents-unveils-enterprise-safeguards/ - Unit 42 (Palo Alto): https://unit42.paloaltonetworks.com/ai-assisted-cyber-attack-inside-a-unit-42-investigation/ - SecurityWeek: https://www.securityweek.com/openais-astra-becomes-first-model-to-cross-critical-cybersecurity-threshold/ - SecurityWeek: https://www.securityweek.com/palo-alto-networks-acquires-ai-agent-platform-console/ 6. AESTO HEALTH BREACH EXPOSES 9.5 MILLION PATIENTS Data Breaches · [breach, healthcare] Latest developments: Aesto LLC, which operates as Aesto Health, told federal regulators this week that a cyberattack in December 2025 leaked sensitive information on more than 9.5 million people. Aesto Health runs medical record retrieval and release-of-information systems for hospitals and clinics, so the exposed data spans patients across many provider organizations. Affected individuals should watch for medical identity fraud and freeze credit files. - The Record: https://therecord.media/health-data-aesto-cyberattack-leak - BleepingComputer: https://www.bleepingcomputer.com/news/security/aesto-health-says-data-breach-affects-over-95-million-patients/ 7. STREAMRAT AND MALICIOUS PACKAGIST PACKAGES HIT MOBILE USERS Ransomware and Cybercrime · [mobile, malvertising, trojan] Latest developments: ThreatFabric detailed StreamRat, a new Android banking trojan that fake TV-streaming ads on Meta pushed to Spanish speakers, reaching an estimated 570,950 European Union accounts and handing operators near-total device control, while researchers flagged 13 malicious Composer theme packages on Packagist that inject JavaScript into Vietnamese movie and comic streaming sites to deploy spyware that steals crypto wallet seeds from unpatched iPhones. Two malvertising and supply-chain campaigns took aim at phones, StreamRat at Spanish-speaking Android users and the Packagist packages at iOS visitors; users should install apps only from official stores and keep devices patched. - The Hacker News: https://thehackernews.com/2026/09/meta-ads-push-streamrat-android-trojan.html - The Hacker News: https://thehackernews.com/2026/09/13-malicious-packagist-packages-target.html 8. MALICIOUS GIT CONFIGS HIJACK AI CODING AGENTS AI Security · [ai, supply-chain, agentic] Latest developments: Manifold Security disclosed eight flaws across seven command-line AI coding agents, among them Claude, Codex, and Cursor, in which a repository's own Git configuration names a command that the agent executes as the user, outside its sandbox and without an approval prompt, and four of the eight remained unpatched at publication. Cloning an attacker-controlled repository is enough to trigger the code execution, so the risk lands on any developer who points an agent at untrusted source. Teams should update agents where fixes exist and treat repository clones as untrusted input. - The Hacker News: https://thehackernews.com/2026/09/malicious-git-configs-can-make-claude.html 9. FBI WARNS OF OAUTH CONSENT PHISHING Ransomware and Cybercrime · [phishing, fbi, account-takeover] Latest developments: The FBI's Internet Crime Complaint Center warned that attackers have run OAuth consent phishing since late 2025 against prominent individuals, their relatives, and their personal contacts, tricking targets into granting an application persistent access to private email and files without ever capturing a password. OAuth consent phishing survives password changes because the victim authorizes the attacker's app directly. Users should review and revoke third-party app permissions on their email and cloud accounts, and administrators should restrict which apps employees can consent to. - Help Net Security: https://www.helpnetsecurity.com/2026/09/02/oauth-consent-phishing-fbi-warning/ 10. DROPBOX ACCOUNTS HIJACKED THROUGH LENOVO FLAW Data Breaches · [breach, account-takeover] Latest developments: Dropbox began warning some customers that an unauthorized party reached their accounts by abusing a flaw in Lenovo's email verification process to register fraudulent Lenovo IDs. The account takeovers chained a weakness in Lenovo's identity system into Dropbox access; affected users should reset credentials and turn on multi-factor authentication. - BleepingComputer: https://www.bleepingcomputer.com/news/security/dropbox-accounts-breached-through-lenovo-email-verification-flaw/ BUSINESS AND POLITICS ---------------------------------------------------------------- * Israeli Raid Strains Gaza Ceasefire Latest developments: Israeli forces seized a senior Hamas militant in a daylight raid deep inside the Gaza Strip on September 2, using drone cover and moving ahead despite U.S. pressure to slow attacks. The operation cuts against President Trump's peace plan and endangers an already shaky truce in Gaza at a moment when U.S.-Iran fighting holds Brent crude above $95 a barrel and pushes government borrowing costs to multiyear highs across Europe, Japan, and the United States. - WSJ World News: https://www.wsj.com/world/middle-east/in-daylight-raid-backed-by-drones-israel-seizes-senior-hamas-militant-ed404b0b?mod=rss_worldnews * Google Keeps Its Ad Tech Business Latest developments: A federal judge ruled September 2 that Google must end practices that depress ad rates for web publishers, and declined to force a divestiture of its ad exchange and related technology. The remedy ruling leaves intact the advertising-technology stack the Justice Department had asked a court to break up, sparing Alphabet the structural penalty that web publishers and rival ad-tech firms sought while imposing conduct limits on how Google prices and routes display advertising. - WSJ US Business: https://www.wsj.com/business/media/google-avoids-breakup-of-dominant-ad-tech-business-0eb492c0?mod=pls_whats_news_us_business_f * Chevron Commits $7 Billion to Venezuela Latest developments: Chevron pledged September 2 to invest $7 billion to double output from its Venezuelan joint ventures, with executives from several other oil-and-gas companies expected to sign production deals in Caracas later the same day. The commitment turns President Trump's Venezuela pact into hard capital spending, putting the largest American oil producer at the center of a White House push to lift Venezuelan production at a moment when U.S.-Iran hostilities have driven Brent crude above $95 a barrel. - FT World: https://www.ft.com/content/a76721db-36e1-4198-aad8-8c90137aace9?syn-25a6b1a6=1 - WSJ US Business: https://www.wsj.com/business/energy-oil/chevron-readies-plans-to-invest-7-billion-double-production-in-venezuela-3a66530e?mod=pls_whats_news_us_business_f * Bond Rout Pauses as Oil Retreats from $95 Latest developments: Fresh U.S. strikes on Iran overnight drove Treasury yields to the day's highs and lifted Brent back above $95 a barrel after government data showed U.S. commercial crude stocks fell 4.5 million barrels last week against an expected 300,000-barrel draw; the Treasury selloff then paused and U.S. stocks rose Wednesday afternoon, September 2. Renewed U.S.-Iran fighting pushed crude toward $95 a barrel and European natural gas to its highest level since the end of 2022, lifting the 10-year Bund to a 2011 high, gilts to a 2007 high, Japan's 10-year yield to a 30-year peak, and U.S. 10-year borrowing costs to their highest since 2023, stoking inflation and rate-hike fears before markets partly steadied. - WSJ Markets: https://www.wsj.com/livecoverage/stock-market-today-dow-sp-500-nasdaq-09-02-2026?mod=rss_markets_main - WSJ Markets: https://www.wsj.com/finance/investing/oil-hovers-close-to-95-as-middle-east-conflict-further-pressures-bonds-877d8321?mod=rss_markets_main - WSJ US Business: https://www.wsj.com/finance/commodities-futures/european-gas-at-highest-level-since-end-of-2022-on-u-s-iran-hostilities-f6d51d99?mod=pls_whats_news_us_business_f - FT World: https://www.ft.com/content/c557ccc2-9fe7-4725-8a1c-c40a0948e8d3?syn-25a6b1a6=1 - WSJ Markets: https://www.wsj.com/finance/commodities-futures/oil-rises-amid-growing-u-s-iran-hostilities-e12fa4f2?mod=rss_markets_main PITTSBURGH ---------------------------------------------------------------- Weather: This Afternoon: Mostly Sunny, high 92F. Tonight: Partly Cloudy, low 73F. Thursday: Chance Showers And Thunderstorms, high 91F. Business: * Lemieux Sells His Last Penguins Stake Latest developments: Mario Lemieux sold his remaining minority shares in the Pittsburgh Penguins, KDKA reported September 2, leaving him without an ownership stake for the first time since 1999. Lemieux, the Hall of Fame center who won two Stanley Cups as a Penguins player, bought the franchise in 1999 and kept a minority position after Fenway Sports Group took control; his exit ends 27 years in which the team's most identifiable figure sat on the ownership side. - KDKA: https://www.cbsnews.com/pittsburgh/news/mario-lemieux-sells-remaining-shares-in-penguins/ * WVU Medicine Clears Path for Independence Health Deal Latest developments: West Virginia University Health System accepted the conditions Pennsylvania Attorney General Dave Sunday set on its acquisition of Independence Health System, TribLive reported September 2, advancing a deal that had stalled over the future of the hospitals involved. Under the settlement, WVU Medicine must keep every newly acquired Western Pennsylvania hospital open for at least five years, a commitment aimed at protecting communities served by Independence Health System, the region's Westmoreland- and Butler-area hospital operator. - TribLive: https://triblive.com/local/westmoreland/pa-attorney-general-announces-deal-for-wvu-health-acquisition-of-independence-health/ * Pittsburgh International Airport Earns LEED Gold Latest developments: The U.S. Green Building Council awarded LEED Gold certification this week to Pittsburgh International Airport's new terminal and its customer service building, and the airport's new Terminal Garage took Parksmart Gold certification. The certifications validate the sustainability engineering built into the terminal that opened as the centerpiece of the airport's multibillion-dollar modernization in Findlay Township, covering energy, water, and materials performance across the terminal, the customer service building, and the parking garage. - Pittsburgh Magazine: https://www.pittsburghmagazine.com/pittsburgh-international-airport-environmental-sustainability-leed-gold-certification-2026/ * U.S.-Canada Trade War Threatens Car Prices Latest developments: KDKA reported September 2 that the newly escalated trade war between the United States and Canada could raise new- and used-car prices across several brands, with Kelley Blue Book advising Pittsburgh-area buyers to move soon. Tariffs tied to the U.S.-Canada dispute threaten to push up vehicle costs for local buyers, adding to a car market where new and used prices have already climbed for months. - KDKA: https://www.cbsnews.com/pittsburgh/news/car-buying-costs-and-tariffs-trade-war-canada/ * Dick's Diner Marks 80 Years in Murrysville Latest developments: The Post-Gazette profiled September 2 Dick's Diner in Murrysville as the Westmoreland County restaurant reaches its 80th year serving comfort food. Dick's Diner, a fixture along Route 22 in Murrysville, has dished up breakfast and comfort food for eight decades, drawing regulars who describe the place as coming home. - Pittsburgh Post-Gazette: https://www.post-gazette.com/life/food/2026/09/02/dicks-diner-murrysville/stories/202609060006 Around town: * Kennedy Disputes Pennsylvania Measles Deaths Latest developments: WTAE laid out the dispute September 2 over Pennsylvania's announcement of the first U.S. measles-associated deaths of 2026, which U.S. Health Secretary Robert F. Kennedy Jr. has called possibly 'fabricated.' Pennsylvania health officials tied the deaths to the state's outbreak, which has spread from Lancaster County as far west as Westmoreland County, and Governor Josh Shapiro has defended the state's count against Kennedy, who questions how health departments classify a measles-associated death. - WTAE: https://www.wtae.com/article/measles-associated-deaths-dissecting-the-dispute/73590335 * Clairton Forfeits Its Home Opener Latest developments: Clairton, the defending PIAA state football champion, will forfeit Friday's varsity home opener against Steel Valley over what the program called a personnel matter, WTAE and the Post-Gazette reported September 2. The forfeit hands Steel Valley a Week 2 win without a snap and sidelines one of Western Pennsylvania's most decorated small-school programs at the start of its title defense. - WTAE: https://www.wtae.com/article/clairton-football-forfeit-steel-valley/73594237 - Pittsburgh Post-Gazette: https://www.post-gazette.com/sports/high-school-football/2026/09/02/clairton-forfeit-wayne-wade-personnel-matter/stories/202609020041 * Heat and Severe Storms Hit Western Pennsylvania Latest developments: WTAE declared Wednesday, September 2, an Alert Day, with the heat index climbing past 100 degrees before thunderstorms carrying damaging winds and large hail move across the region; KDKA meteorologist Mary Ours expects strong storms again Thursday. The storms land on the third day of the Allegheny County code red heat advisory that runs September 1 through 3, the same stretch that pushed 35 Pittsburgh Public Schools buildings to remote learning and extended city rec-center hours. - WTAE: https://www.wtae.com/article/western-pennsylvania-heat-advisory-severe-storms/73591307 - KDKA: https://www.cbsnews.com/pittsburgh/video/strong-storms-possible-in-the-pittsburgh-area-on-wednesday-and-thursday-first-alert-weather/ * Pittsburgh Wins $200,000 State Grant for Parks Latest developments: The City of Pittsburgh received a $200,000 state grant, WPXI reported September 2, to pay for athletic-field upgrades, new water fountains, and trail-connectivity planning across several of the city's eastern neighborhoods. The award funds small-scale recreation work city budget officials would otherwise struggle to cover as Pittsburgh stares at a 2026 deficit its budget office now puts at $30 million. - WPXI: https://www.wpxi.com/news/local/city-pittsburgh-receives-200k-state-grant-fund-field-upgrades-new-water-fountains/XTDYYM4X2FH2HKFW7ID4GCLDXM/ * Penn State Fraternity Cocaine Ring in Court Latest developments: A judge granted bail September 2 to Agostino Abbatiello, the alleged ringleader held since he surrendered last month, and a former Penn State student testified that Abbatiello called himself 'the godfather' and that cocaine sat in plain view in a fraternity room. Prosecutors charged fourteen people, among them Agostino Abbatiello, Thomas Robinson, Paul Robinson, Muhammad Huraibi, Robert Zanolla, and Seth Beardsley, over a cocaine operation run out of two Penn State University fraternities; preliminary hearings are running at the Centre County Courthouse in Bellefonte, and one defendant's father, a prominent Pittsburgh attorney, also faces charges. - KDKA: https://www.cbsnews.com/pittsburgh/news/penn-state-fraternity-brothers-cocaine-ring-suspects-court-appearances/ - WTAE: https://www.wtae.com/article/penn-state-fraternity-cocaine-trafficking-court/73591469 * Police Surveillance Tools Draw Privacy Pushback Latest developments: KDKA reported September 2 that as departments across the region lean on Flock cameras, drones, and license-plate readers, civil-liberties critics warn the tools reach too far into private life. Police credit automated license-plate readers with identifying three Texas men who robbed Wendy's restaurants in Monroeville, Penn Hills, Scott Township, and Peters Township along with a McDonald's; critics counter that the growing surveillance network can violate privacy and civil rights. - KDKA: https://www.cbsnews.com/pittsburgh/news/surveillance-technology-flock-debate/ * Beaver County Group Recycles Bikes Latest developments: The Post-Gazette profiled September 2 Communicycle, a Beaver County group that repairs and recycles bicycles for children and adults. Communicycle collects, fixes, and redistributes used bikes across Beaver County, keeping serviceable bicycles out of landfills and putting them under riders who need them. - Pittsburgh Post-Gazette: https://www.post-gazette.com/life/goodness/2026/09/02/communicycle-beaver-county-recycling-bikes/stories/202609020003 Events: * A Soulful Taste of the Burgh Latest developments: KDKA previewed 'A Soulful Taste of the Burgh' on September 2, a soul food festival set for Labor Day weekend in downtown Pittsburgh. The festival brings soul food vendors to downtown Pittsburgh over Labor Day weekend, and KDKA's Pittsburgh Today Live sampled dishes on the air ahead of it. - KDKA: https://www.cbsnews.com/pittsburgh/video/a-soulful-taste-of-the-burgh-to-take-place-over-labor-day-weekend-in-downtown-pittsburgh/ * Dylan Tribute Documentary Screens at The Lindsay Latest developments: KDKA aired an interview September 2 with Pittsburgh musicians Billy Price and Joe Grushecky about the documentary of their Bob Dylan tribute concert, which gets its first screening at The Lindsay Theater. 'Forever Young: A Bob Dylan Tribute' captures the single night last year when Price and Grushecky shared a stage, and The Lindsay Theater is showing the film for the first time. - KDKA: https://www.cbsnews.com/pittsburgh/video/forever-young-a-bob-dylan-tribute/ * Rock Against Cancer Returns to Pine Latest developments: TribLive announced September 2 the lineup for this year's Rock Against Cancer in Pine Township, a benefit concert for the Pittsburgh nonprofit Cancer Bridges. The bill pairs Genevieve Carlson & Friends and the three-part harmonies of Buckingham Prep with Stealing Time, a cover band devoted to Bruce Springsteen, Tom Petty, and Steely Dan, and the Southern-rock and blues act The Hip Waders; proceeds go to Cancer Bridges, which supports cancer patients and their families. - TribLive: https://triblive.com/aande/music/rock-against-cancer-returns-to-pine-to-benefit-cancer-bridges/ * Music on the Mezz Returns to Iron City Distillery Latest developments: Iron City Distillery announced its 2026 Music on the Mezz concert series September 2, with two Pittsburgh acts opening and closing the run. Music on the Mezz brings live music to the mezzanine at Iron City Distillery, the whiskey maker that revived the Iron City name, and the 2026 edition bookends its schedule with a pair of well-known Pittsburgh bands. - TribLive: https://triblive.com/local/valley-news-dispatch/iron-city-distilling-to-kick-off-2026-music-on-the-mezz-concert-series/ * Merged Theater Names Itself Confluence Latest developments: The merger of Pittsburgh Public Theater and Pittsburgh CLO now has a name, Confluence Theater of Pittsburgh, and a plan for its combined operations, the Post-Gazette reported August 31. Confluence Theater of Pittsburgh unites the city's flagship nonprofit drama company with its big musical-theater producer, consolidating two of the region's largest stage organizations under one banner and one season. - Post-Gazette Arts & Entertainment: https://www.post-gazette.com/ae/theater-dance/2026/08/31/confluence-theater-pittsburgh-name-merge-public-clo/stories/202608310026 SPORTS ---------------------------------------------------------------- Pirates (68-71) Tue Sep 1 · Giants 12 · Pirates 13 · Final https://plaintextsports.com/mlb/2026-09-01/sf-pit Up Next · Giants @ Pirates · Wed Sep 2, 6:40 PM https://plaintextsports.com/mlb/2026-09-02/sf-pit Steelers (0-0, T-1st in AFC North) Up Next · Falcons @ Steelers · Sun Sep 13, 1:00 PM https://plaintextsports.com/nfl/2026/week1/atl-pit Around the Teams: * Rudolph and Wilson Swap Camp Stories on Not Just Football Latest developments: Cam Heyward's September 2 training-camp episode gathered wide receiver Ben Skowronek, quarterback Mason Rudolph, and linebackers Cole Holcomb and Payton Wilson for a double round of camp stories. Heyward and co-host Hayden Heyward run new Not Just Football training-camp episodes every Monday, Wednesday, and Friday, working through the Steelers roster position group by position group; this installment paired Skowronek and Rudolph with the inside linebackers. - Not Just Football with Cam Heyward: https://www.youtube.com/watch?v=F3NLG4oldF0 * Dulac Fields Questions on Rodgers and McCarthy Latest developments: Post-Gazette beat writer Gerry Dulac held his Steelers chat September 2, taking reader questions on quarterback Aaron Rodgers and head coach Mike McCarthy less than two weeks before the opener. Dulac's weekly chat is the Post-Gazette's main channel for Steelers roster and scheme questions, and this one landed the day after McCarthy met the media and general manager Omar Khan explained why all 10 of the team's draft picks made the 53-man roster. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/09/02/nfl-live-chat-aaron-rodgers-mike-mccarthy/stories/202609020030 * Edge Room Talks Contracts on Not Just Football Latest developments: On Cam Heyward's Not Just Football training-camp episode, outside linebackers T.J. Watt, Alex Highsmith, Nick Herbig, and Jack Sawyer broke down their offseason contracts and life under the Steelers' new defensive system. Heyward and his co-host gathered the Steelers' edge crew—Watt, Highsmith, Herbig, and Sawyer—for a camp episode covering the group's deals, the scheme change on defense, and a round of edge-room superlatives. - Not Just Football with Cam Heyward: https://www.youtube.com/watch?v=ANB7ezXcv3w * Hiles Calls for Pirates to Clean House Latest developments: Post-Gazette writer Noah Hiles argued August 30 that the Pirates should overhaul the front office, starting by firing general manager Ben Cherington. With the Pirates fading from contention, Hiles made the case in the Post-Gazette that the franchise needs sweeping change at the top, naming general manager Ben Cherington and team president Travis Williams. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/08/30/fire-ben-cherington-travis-williams/stories/202608300073 Team USA: * Davis-Woodhall Suffers a Concussion Latest developments: ESPN reported September 2 that Tara Davis-Woodhall, the Olympic and world long-jump champion, sustained a concussion last week in a head-on collision while driving to a training session. Davis-Woodhall took long jump gold at the 2024 Paris Olympics and added the world title, and the head injury interrupts the training block of one of the strongest American track and field medal prospects. - ESPN Olympics: https://www.espn.com/olympics/trackandfield/story/_/id/49804966/olympic-champ-davis-woodhall-suffers-concussion-auto-accident * Monaco Still Trying to Move Balogun Latest developments: AS Monaco's chief executive said September 2 that the club continues to shop Folarin Balogun's contract after his $45 million transfer to Everton collapsed, leaving the U.S. forward weighing possible moves to Turkey or the Saudi Pro League this week. Balogun, a striker in the U.S. men's national team pool with the World Cup on home soil approaching, stayed at Monaco when the Everton deal died on deadline day, and the club now wants his wages off its books through one of the transfer windows still open outside the major European leagues. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49803814/monaco-ceo-looking-folarin-balogun-transfer-failed-everton-move * Lawson Calls the Women's World Cup the Toughest Yet Latest developments: U.S. coach Kara Lawson said September 1 that this edition of the FIBA Women's World Cup is the most challenging field she has seen. Lawson takes the U.S. into the tournament without A'ja Wilson and Kelsey Plum, both out for health reasons, with Kiki Iriafen and Sonia Citron called in as replacements; Plum will also miss the rest of the 2026 WNBA season for the Phoenix Mercury. - ESPN Olympics: https://www.espn.com/wnba/story/_/id/49794975/us-coach-kara-lawson-calls-world-cup-most-challenging * USMNT Summer Transfer Window Closes Flat Latest developments: With the window shut, ESPN's Jeff Carlisle recapped September 2 that Folarin Balogun's deadline-day U-turn killed his Everton move and left him at AS Monaco, while Gio Reyna's switch to Strasbourg stands as a last chance to revive his career. The 2026 summer window closed on an underwhelming stretch for U.S. men's national team players: Balogun stayed at Monaco after scrapping a £40 million move to Everton, and Reyna joined Strasbourg hoping to rebuild his form ahead of the World Cup the United States co-hosts. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49789601/folarin-balogun-deadline-day-everton-usmnt-summer-transfer-window-gio-reyna READING ---------------------------------------------------------------- * Stratechery -- Fable 5.1, Enterprise Frontier Safeguards Ben Thompson covers the release of Fable 5.1, noting that its maker fully scrapped the contested data-retention policy in the interim and arguing that heavier caching amounts to a win-win for the company and its customers. https://stratechery.com/2026/fable-5-1-enterprise-frontier-safeguards/ * Ed Zitron -- Hyperscale Normalization In his latest premium newsletter, Zitron scrutinizes how the hyperscalers' enormous AI infrastructure spending has come to be treated as normal, pressing on the underlying economics. https://www.wheresyoured.at/hyperscale-normalization/ * Cal Newport -- Are We at War with AI Agent "Civilizations"? Newport returns to the July OpenAI hacking episode, weighing OpenAI's newly released details and the framing of autonomous AI agents as hostile 'civilizations.' https://calnewport.com/are-we-at-war-with-ai-agent-civilizations/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,680.32 ▲ +0.1% Dow 53,312.70 ▲ +0.1% Nasdaq 26,258.70 ▲ +0.3% WTI crude 85.03 ▼ -0.7% EUR/USD 1.1639 ▼ -0.2% GBP/USD 1.3586 ▼ -0.2% USD/JPY 159.53 ▲ +0.4% FEED HEALTH ---------------------------------------------------------------- Security: 24 of 24 feeds loaded, 72 items in the 24-hour window. No recent items: Securelist (Kaspersky), Google Online Security Blog, Cisco Talos, Google Project Zero, The DFIR Report, Kim Zetter (Zero Day), Frank on Fraud. Pittsburgh: 9 of 9 feeds loaded, 60 items in the 48-hour window. No recent items: NEXTpittsburgh. Business and Politics: 8 of 8 feeds loaded, 60 items in the 36-hour window. Events: 4 of 4 feeds loaded, 6 items in the 120-hour window. No recent items: NEXTpittsburgh Events, NEXTpittsburgh Arts & Entertainment. Sports media: 6 of 6 feeds loaded, 29 items in the 96-hour window. No recent items: Footbahlin with Ben Roethlisberger, Ben Roethlisberger / Channel Seven (YouTube). Team USA: 3 of 3 feeds loaded, 29 items in the 72-hour window. Reading: 3 of 3 feeds loaded, 12 items in the 336-hour window. Markets (Yahoo Finance): 7 of 7 rows Weather (NWS): 3 forecast periods Scores (ESPN, plaintextsports): 2 teams via plaintextsports; mlb: ESPN failed (mlb: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nfl: ESPN failed (nfl: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nhl: ESPN failed (nhl: HTTP 403 (server: AkamaiGHost)); used plaintextsports Summaries: 3 model call(s) served by claude-opus-5 (315s of model time; $1.80 at API list price). ================================================================ Generated 2026-09-02 13:35 EDT. Updated weekdays at about 7:05 AM, 10:05 AM, 1:35 PM, and 7:35 PM ET, and weekends at about 8:05 AM and 7:35 PM ET. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 3 Team USA feeds; WSJ World News, WSJ Markets, WSJ US Business, WSJ Politics, The Economist, FT Home, FT World, FT Markets; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN or plaintextsports.com. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================