================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Wednesday, September 2, 2026 - 7:36 PM EDT ================================================================ SonicWall's SMA 1000 VPN appliances fell to two chained zero-days while a BGP hijack poisoned Virtualizor updates and police severed the 23-year-old Sality botnet from its operators. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets | Feed Health EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] SonicWall patched two exploited SMA 1000 zero-days as attackers turned a Sangoma Switchvox SQL injection into reverse shells, with CISA adding seven exploited bugs in one day. see: SonicWall SMA1000 Zero-Days Chained in Attacks; Switchvox, Cleo, and GeoNetwork Flaws Open Servers * [TREND] Criminals are poisoning trusted delivery channels, hijacking BGP routes for Softaculous updates and standing up fake vendor download pages whose installers disable Windows Update and weaken Defender. see: BGP Hijack Poisons Virtualizor and Softaculous Updates; Fake Installers and Malicious Apache Modules * [TREND] Google opened early access to Gemini 3.8 Flash Cyber for governments, while Manifold Security showed a repository's Git config can make Claude or Cursor run attacker code. see: AI-Speed Attacks Drive New Enterprise Safeguards; Malicious Git Configs Hijack AI Coding Agents * [UPDATE (new)] Mayor Corey O'Connor warned Pittsburgh's finances are worse than known, UPMC is closing its Shadyside integrative medicine center, and officials flagged a measles exposure at New Stanton. see: O'Connor Says City Finances Are Worse Than Known; UPMC Closes Its Integrative Medicine Center; Measles Exposure at New Stanton Turnpike Plaza * [UPDATE (updated)] Josh Shapiro and Stacy Garrity called for a statewide Flock camera ban as severe thunderstorms and 100-degree heat cut power to thousands in Allegheny County. see: Police Surveillance Tools Draw Privacy Pushback; Heat and Severe Storms Hit Western Pennsylvania * [UPDATE (new)] Roman Wilson has climbed out of the doghouse and won Aaron Rodgers' trust, while the Pirates, playoff odds fading, still insist anything can happen. see: Roman Wilson Earns Rodgers' Trust; Pirates Cling to 'Anything Can Happen' SECURITY ---------------------------------------------------------------- 1. SONICWALL SMA1000 ZERO-DAYS CHAINED IN ATTACKS Vulnerabilities and Exploits · [zero-day, vpn, patch] Latest developments: SonicWall shipped updates for two zero-days its own researchers William Perry and Adam Babis found in Secure Mobile Access 1000 appliances—CVE-2026-83548, a pre-authentication server-side request forgery in the Appliance Management Console rated a perfect 10.0, and CVE-2026-83549—and confirmed attackers already chain the pair for unauthenticated remote code execution, a finding Sophos corroborated. SMA 1000 appliances serve as SSL VPN gateways for medium and large enterprises, government agencies, and managed security service providers, putting the flaws directly on the network edge. Administrators should patch immediately and hunt for compromise on any internet-facing instance. - The Hacker News: https://thehackernews.com/2026/09/attackers-exploit-two-sonicwall-sma.html - BleepingComputer: https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-actively-exploited-sma1000-zero-day-flaws/ - Sophos News: https://www.sophos.com/en-us/blog/sonicwall-83548-83549 - Help Net Security: https://www.helpnetsecurity.com/2026/09/02/sonicwall-sma-1000-cve-2026-83548-cve-2026-83549-zero-day-attacks/ 2. SWITCHVOX, CLEO, AND GEONETWORK FLAWS OPEN SERVERS Vulnerabilities and Exploits · [exploitation, patch, rce] Latest developments: A threat actor began exploiting CVE-2026-9586, a critical unauthenticated SQL injection in Sangoma Switchvox SMB Edition 8.3 rated 9.3, to plant reverse shells on internet-exposed VoIP systems; CISA added that bug to its Known Exploited Vulnerabilities catalog alongside six others, among them JFrog Artifactory's CVE-2026-82329, which attackers now abuse to forge administrative tokens, LiteLLM's CVE-2026-59822, Kestra OSS command injection CVE-2026-49869, and Starlette request smuggling CVE-2026-48710; and an SQL injection hole in the All-in-One WP Migration and Backup plugin left millions of WordPress sites open to unauthenticated remote code execution. These products sit on the internet edge at small businesses, file-transfer operations, hosting providers, and government agencies. Switchvox operators should hunt for compromise now, WordPress administrators should update the migration plugin, Cleo Harmony users should apply the vendor fix for the authentication bypass a public exploit now targets, and GeoNetwork administrators should move to version 4.4.12 or 4.2.17, released July 8, 2026. - The Hacker News: https://thehackernews.com/2026/09/attackers-exploit-critical-switchvox.html - CISA Advisories: https://www.cisa.gov/news-events/alerts/2026/09/02/cisa-adds-seven-known-exploited-vulnerabilities-catalog - BleepingComputer: https://www.bleepingcomputer.com/news/security/wordpress-backup-plugin-flaw-exposes-millions-of-sites-to-takeover-attacks/ - SecurityWeek: https://www.securityweek.com/exploit-published-for-fresh-cleo-harmony-vulnerability/ 3. BGP HIJACK POISONS VIRTUALIZOR AND SOFTACULOUS UPDATES Vulnerabilities and Exploits · [supply-chain, bgp, malware] Latest developments: Virtualizor disclosed that attackers hijacked Border Gateway Protocol routing for Softaculous's update servers, presented a technically valid TLS certificate for the domains, and delivered a booby-trapped Virtualizor package that planted persistent root access, with one hosting provider finding 5 of 34 checked hypervisors compromised in a window that opened August 28, 2026, at 20:57. Virtualizor is VPS management software from Softaculous that runs on hypervisors, and the routing attack turned its update channel into a malware delivery pipe; operators should audit hypervisors for compromise and rebuild affected hosts. - The Hacker News: https://thehackernews.com/2026/09/bgp-hijack-delivers-malicious.html - SecurityWeek: https://www.securityweek.com/malicious-virtualizor-update-served-via-bgp-hijacking/ - Ars Technica Security: https://arstechnica.com/security/2026/09/well-executed-bgp-attack-uses-hijacked-ips-to-infect-real-networks/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/hackers-push-malicious-virtualizor-update-in-bgp-hijacking-attack/ 4. SALITY BOTNET DISRUPTED AFTER 23 YEARS Ransomware and Cybercrime · [botnet, takedown, malware] Latest developments: The Justice Department announced that authorities in the United States, Bulgaria, Hungary, and Romania, working with CrowdStrike and the Shadowserver Foundation, executed a takedown on August 31, 2026, manipulating Sality's peer lists and seizing its payload URLs to sever more than 15,000 infected machines from their operator. Sality surfaced in 2003 as a file-infecting virus and grew into a peer-to-peer botnet that rented infected Windows machines for further malware delivery. Owners of affected computers should scan for and remove file-infector remnants, since the sinkhole stops new payloads without cleaning hosts. - The Record: https://therecord.media/sality-botnet-cyber-doj - The Hacker News: https://thehackernews.com/2026/09/authorities-turn-salitys-p2p-network.html - Help Net Security: https://www.helpnetsecurity.com/2026/09/02/sality-botnet-disruption-crowdstrike-law-enforcement/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/sality-botnet-infrastructure-dismantled-in-joint-global-takedown/ 5. AI-SPEED ATTACKS DRIVE NEW ENTERPRISE SAFEGUARDS AI Security · [ai, agentic, defense] Latest developments: Google released Gemini 3.8 Flash Cyber, its most capable security model, and opened early access through a new Fairwind Program for governments, healthcare providers, and telecommunications operators; Anthropic unveiled Enterprise Frontier Safeguards, pairing zero data retention with automated misuse monitoring; OpenAI's Astra became the first model the company rates as crossing the critical cyber threshold after it independently found zero-days; and Unit 42 published its investigation of autonomous agents that breached an enterprise network in hours. As attackers wield AI agents to compromise networks at machine speed, security vendors are fielding autonomous defenses and misuse controls; enterprises should inventory AI usage and lock down agent credentials. - The Hacker News: https://thehackernews.com/2026/09/google-anthropic-and-openai-unveil.html - SecurityWeek: https://www.securityweek.com/anthropic-details-response-to-security-incidents-unveils-enterprise-safeguards/ - Unit 42 (Palo Alto): https://unit42.paloaltonetworks.com/ai-assisted-cyber-attack-inside-a-unit-42-investigation/ - SecurityWeek: https://www.securityweek.com/openais-astra-becomes-first-model-to-cross-critical-cybersecurity-threshold/ 6. FAKE INSTALLERS AND MALICIOUS APACHE MODULES Ransomware and Cybercrime · [malware, seo-poisoning, web] Latest developments: Microsoft detailed an active campaign whose bogus software-download sites impersonate trusted vendors and ship installers that disable Windows Update and weaken Microsoft Defender, hitting organizations across several industries, mostly the China-based operations of multinationals and Chinese-speaking users, while Check Point Research tied a Chinese-speaking crew it calls Gambling Goblin to malicious Apache modules planted since mid-2025 on web servers of Brazilian government and educational institutions to divert visitors toward gambling and sports-betting pages. Both operations subvert channels users trust: search-driven software downloads and official web servers. Security teams should distribute software only from vetted internal repositories and audit Apache module directories on public-facing hosts. - The Hacker News: https://thehackernews.com/2026/09/fake-software-installers-disable.html - The Hacker News: https://thehackernews.com/2026/09/malicious-apache-modules-hijack.html 7. AESTO HEALTH BREACH EXPOSES 9.5 MILLION PATIENTS Data Breaches · [breach, healthcare] Latest developments: Aesto LLC, which operates as Aesto Health, told federal regulators this week that a cyberattack in December 2025 leaked sensitive information on more than 9.5 million people. Aesto Health runs medical record retrieval and release-of-information systems for hospitals and clinics, so the exposed data spans patients across many provider organizations. Affected individuals should watch for medical identity fraud and freeze credit files. - The Record: https://therecord.media/health-data-aesto-cyberattack-leak - BleepingComputer: https://www.bleepingcomputer.com/news/security/aesto-health-says-data-breach-affects-over-95-million-patients/ 8. STREAMRAT AND MALICIOUS PACKAGIST PACKAGES HIT MOBILE USERS Ransomware and Cybercrime · [mobile, malvertising, trojan] Latest developments: ThreatFabric detailed StreamRat, a new Android banking trojan that fake TV-streaming ads on Meta pushed to Spanish speakers, reaching an estimated 570,950 European Union accounts and handing operators near-total device control, while researchers flagged 13 malicious Composer theme packages on Packagist that inject JavaScript into Vietnamese movie and comic streaming sites to deploy spyware that steals crypto wallet seeds from unpatched iPhones. Two malvertising and supply-chain campaigns took aim at phones, StreamRat at Spanish-speaking Android users and the Packagist packages at iOS visitors; users should install apps only from official stores and keep devices patched. - The Hacker News: https://thehackernews.com/2026/09/meta-ads-push-streamrat-android-trojan.html - The Hacker News: https://thehackernews.com/2026/09/13-malicious-packagist-packages-target.html 9. MALICIOUS GIT CONFIGS HIJACK AI CODING AGENTS AI Security · [ai, supply-chain, agentic] Latest developments: Manifold Security disclosed eight flaws across seven command-line AI coding agents, among them Claude, Codex, and Cursor, in which a repository's own Git configuration names a command that the agent executes as the user, outside its sandbox and without an approval prompt, and four of the eight remained unpatched at publication. Cloning an attacker-controlled repository is enough to trigger the code execution, so the risk lands on any developer who points an agent at untrusted source. Teams should update agents where fixes exist and treat repository clones as untrusted input. - The Hacker News: https://thehackernews.com/2026/09/malicious-git-configs-can-make-claude.html 10. FBI WARNS OF OAUTH CONSENT PHISHING Ransomware and Cybercrime · [phishing, fbi, account-takeover] Latest developments: The FBI's Internet Crime Complaint Center warned that attackers have run OAuth consent phishing since late 2025 against prominent individuals, their relatives, and their personal contacts, tricking targets into granting an application persistent access to private email and files without ever capturing a password. OAuth consent phishing survives password changes because the victim authorizes the attacker's app directly. Users should review and revoke third-party app permissions on their email and cloud accounts, and administrators should restrict which apps employees can consent to. - Help Net Security: https://www.helpnetsecurity.com/2026/09/02/oauth-consent-phishing-fbi-warning/ BUSINESS AND POLITICS ---------------------------------------------------------------- * Israeli Raid Strains Gaza Ceasefire Latest developments: Israeli forces seized a senior Hamas militant in a daylight raid deep inside the Gaza Strip on September 2, using drone cover and moving ahead despite U.S. pressure to slow attacks. The operation cuts against President Trump's peace plan and endangers an already shaky truce in Gaza at a moment when U.S.-Iran fighting holds Brent crude above $95 a barrel and pushes government borrowing costs to multiyear highs across Europe, Japan, and the United States. - WSJ World News: https://www.wsj.com/world/middle-east/in-daylight-raid-backed-by-drones-israel-seizes-senior-hamas-militant-ed404b0b?mod=rss_worldnews * Google Keeps Its Ad Tech Business Latest developments: A federal judge ruled September 2 that Google must end practices that depress ad rates for web publishers, and declined to force a divestiture of its ad exchange and related technology. The remedy ruling leaves intact the advertising-technology stack the Justice Department had asked a court to break up, sparing Alphabet the structural penalty that web publishers and rival ad-tech firms sought while imposing conduct limits on how Google prices and routes display advertising. - WSJ US Business: https://www.wsj.com/business/media/google-avoids-breakup-of-dominant-ad-tech-business-0eb492c0?mod=pls_whats_news_us_business_f - FT Home: https://www.ft.com/content/75c3179a-5c42-42fd-94e9-6f0c3dfc0c70?syn-25a6b1a6=1 * Chevron Commits $7 Billion to Venezuela Latest developments: Chevron pledged September 2 to invest $7 billion to double output from its Venezuelan joint ventures, and Italy's ENI along with the smaller U.S. producers Primavera and Aspect Holdings signed production deals of their own in Caracas the same day. The commitment turns President Trump's Venezuela pact into hard capital spending, putting the largest American oil producer at the center of a White House push to lift Venezuelan production at a moment when U.S.-Iran hostilities have driven Brent crude above $95 a barrel. - FT World: https://www.ft.com/content/a76721db-36e1-4198-aad8-8c90137aace9?syn-25a6b1a6=1 - WSJ US Business: https://www.wsj.com/business/energy-oil/chevron-readies-plans-to-invest-7-billion-double-production-in-venezuela-3a66530e?mod=pls_whats_news_us_business_f * Bond Rout Pauses as Oil Retreats from $95 Latest developments: Oil futures rose for a third straight session on renewed U.S.-Iran strikes, and the Treasury selloff stalled as U.S. stocks closed higher Wednesday, September 2, with Europe now short of stored natural gas heading into winter on a bet the Iran war ends soon. Renewed U.S.-Iran fighting pushed crude toward $95 a barrel and European natural gas to its highest level since the end of 2022, lifting the 10-year Bund to a 2011 high, gilts to a 2007 high, Japan's 10-year yield to a 30-year peak, and U.S. 10-year borrowing costs to their highest since 2023, stoking inflation and rate-hike fears before markets partly steadied. - WSJ Markets: https://www.wsj.com/livecoverage/stock-market-today-dow-sp-500-nasdaq-09-02-2026?mod=rss_markets_main - WSJ Markets: https://www.wsj.com/finance/investing/oil-hovers-close-to-95-as-middle-east-conflict-further-pressures-bonds-877d8321?mod=rss_markets_main - WSJ US Business: https://www.wsj.com/finance/commodities-futures/european-gas-at-highest-level-since-end-of-2022-on-u-s-iran-hostilities-f6d51d99?mod=pls_whats_news_us_business_f - FT World: https://www.ft.com/content/c557ccc2-9fe7-4725-8a1c-c40a0948e8d3?syn-25a6b1a6=1 - WSJ Markets: https://www.wsj.com/finance/commodities-futures/oil-rises-amid-growing-u-s-iran-hostilities-e12fa4f2?mod=rss_markets_main - WSJ World News: https://www.wsj.com/finance/commodities-futures/winter-is-approaching-and-europe-is-running-low-on-natural-gas-ee52167a?mod=rss_worldnews PITTSBURGH ---------------------------------------------------------------- Weather: Tonight: Scattered Showers And Thunderstorms then Partly Cloudy, low 73F. Thursday: Chance Showers And Thunderstorms, high 91F. Thursday Night: Chance Showers And Thunderstorms then Showers And Thunderstorms Likely, low 71F. Business: * O'Connor Says City Finances Are Worse Than Known Latest developments: Mayor Corey O'Connor said Wednesday, September 2, that Pittsburgh's financial picture runs far more dire than previously known, telling residents his administration is sounding the alarm a day after budget officials raised the 2026 deficit projection to $30 million. Pittsburgh's budget office already expects a $30 million shortfall this year, and the mayor's warning sets up a fight over spending and revenue as the city writes its next budget. - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/politics-local/2026/09/02/oconnor-pittsburgh-budget-deficit-projection/stories/202609020077 * UPMC Closes Its Integrative Medicine Center Latest developments: UPMC confirmed Wednesday, September 2, that it will shut the Center for Integrative Medicine in Shadyside after more than 25 years. The center provides acupuncture, chiropractic therapy, and medical hypnosis, and its closing ends a quarter-century experiment by the region's largest hospital system in folding those practices into conventional care. - TribLive: https://triblive.com/news/health-now/upmc-to-shutter-shadyside-center-focused-on-natural-healing-practices/ * Lemieux Sells His Last Penguins Stake Latest developments: Mario Lemieux sold his remaining minority shares in the Pittsburgh Penguins, KDKA reported September 2, leaving him without an ownership stake for the first time since 1999. Lemieux, the Hall of Fame center who won two Stanley Cups as a Penguins player, bought the franchise in 1999 and kept a minority position after Fenway Sports Group took control; his exit ends 27 years in which the team's most identifiable figure sat on the ownership side. - KDKA: https://www.cbsnews.com/pittsburgh/news/mario-lemieux-sells-remaining-shares-in-penguins/ * WVU Medicine Clears Path for Independence Health Deal Latest developments: West Virginia University Health System accepted the conditions Pennsylvania Attorney General Dave Sunday set on its acquisition of Independence Health System, TribLive reported September 2, advancing a deal that had stalled over the future of the hospitals involved. Under the settlement, WVU Medicine must keep every newly acquired Western Pennsylvania hospital open for at least five years, a commitment aimed at protecting communities served by Independence Health System, the region's Westmoreland- and Butler-area hospital operator. - TribLive: https://triblive.com/local/westmoreland/pa-attorney-general-announces-deal-for-wvu-health-acquisition-of-independence-health/ * Pittsburgh International Airport Earns LEED Gold Latest developments: The U.S. Green Building Council awarded LEED Gold certification this week to Pittsburgh International Airport's new terminal and its customer service building, and the airport's new Terminal Garage took Parksmart Gold certification. The certifications validate the sustainability engineering built into the terminal that opened as the centerpiece of the airport's multibillion-dollar modernization in Findlay Township, covering energy, water, and materials performance across the terminal, the customer service building, and the parking garage. - Pittsburgh Magazine: https://www.pittsburghmagazine.com/pittsburgh-international-airport-environmental-sustainability-leed-gold-certification-2026/ * U.S.-Canada Trade War Threatens Car Prices Latest developments: KDKA reported September 2 that the newly escalated trade war between the United States and Canada could raise new- and used-car prices across several brands, with Kelley Blue Book advising Pittsburgh-area buyers to move soon. Tariffs tied to the U.S.-Canada dispute threaten to push up vehicle costs for local buyers, adding to a car market where new and used prices have already climbed for months. - KDKA: https://www.cbsnews.com/pittsburgh/news/car-buying-costs-and-tariffs-trade-war-canada/ * Dick's Diner Marks 80 Years in Murrysville Latest developments: The Post-Gazette profiled September 2 Dick's Diner in Murrysville as the Westmoreland County restaurant reaches its 80th year serving comfort food. Dick's Diner, a fixture along Route 22 in Murrysville, has dished up breakfast and comfort food for eight decades, drawing regulars who describe the place as coming home. - Pittsburgh Post-Gazette: https://www.post-gazette.com/life/food/2026/09/02/dicks-diner-murrysville/stories/202609060006 Around town: * Measles Exposure at New Stanton Turnpike Plaza Latest developments: The Pennsylvania Department of Health said September 2 that an out-of-state visitor who later tested positive for measles stopped at the westbound New Stanton Service Plaza on the Pennsylvania Turnpike in Westmoreland County, exposing travelers there. The warning extends an outbreak that began in Lancaster County and has already reached Westmoreland County and UPMC Children's Hospital of Pittsburgh, and it puts an interstate rest stop on the list of exposure sites state health officials are tracking. - WTAE: https://www.wtae.com/article/travelers-potential-exposure-measles-pa-turnpike-westmoreland-county/73597055 - TribLive: https://triblive.com/local/westmoreland/visitor-at-new-stanton-turnpike-plaza-may-have-exposed-others-to-measles/ * South Side Improvement District Enters Objection Period Latest developments: Pittsburgh opened a 45-day objection period Wednesday, September 2, letting property owners inside a proposed South Side neighborhood improvement district register opposition before a vote on creating it. A neighborhood improvement district would assess South Side property owners to pay for services such as cleaning, safety, and streetscape work along the East Carson Street corridor; owners who object during the window can block or reshape the plan. - TribLive: https://triblive.com/local/pittsburgh-launches-45-day-objection-period-before-vote-on-south-side-improvement-district/ * Police Surveillance Tools Draw Privacy Pushback Latest developments: Governor Josh Shapiro and state Treasurer Stacy Garrity called September 2 for a statewide ban on Flock cameras, whose license-plate readers feed vehicle movements into a national database that police departments across the region now query. Police credit automated license-plate readers with identifying three Texas men who robbed Wendy's restaurants in Monroeville, Penn Hills, Scott Township, and Peters Township along with a McDonald's; civil-liberties critics counter that the growing surveillance network reaches too far into private life. - TribLive: https://triblive.com/news/pennsylvania/shapiro-garrity-call-for-ban-on-flock-cameras-in-pennsylvania/ - KDKA: https://www.cbsnews.com/pittsburgh/news/surveillance-technology-flock-debate/ * Heat and Severe Storms Hit Western Pennsylvania Latest developments: The National Weather Service put most of Western Pennsylvania under a severe thunderstorm watch Wednesday afternoon, September 2, after the heat index passed 100 degrees, and Duquesne Light reported more than 6,000 Allegheny County customers without power. The storms land on the third day of the Allegheny County code red heat advisory that runs September 1 through 3, the same stretch that pushed 35 Pittsburgh Public Schools buildings to remote learning and extended city rec-center hours; KDKA meteorologist Mary Ours expects strong storms again Thursday. - WTAE: https://www.wtae.com/article/western-pennsylvania-heat-advisory-severe-storms/73591307 - WTAE: https://www.wtae.com/article/duquesne-light-power-outage-allegheny-county-wednesday-sept-1/73597806 - KDKA: https://www.cbsnews.com/pittsburgh/video/strong-storms-possible-in-the-pittsburgh-area-on-wednesday-and-thursday-first-alert-weather/ * Kennedy Disputes Pennsylvania Measles Deaths Latest developments: WTAE laid out the dispute September 2 over Pennsylvania's announcement of the first U.S. measles-associated deaths of 2026, which U.S. Health Secretary Robert F. Kennedy Jr. has called possibly 'fabricated.' Pennsylvania health officials tied the deaths to the state's outbreak, which has spread from Lancaster County as far west as Westmoreland County, and Governor Josh Shapiro has defended the state's count against Kennedy, who questions how health departments classify a measles-associated death. - WTAE: https://www.wtae.com/article/measles-associated-deaths-dissecting-the-dispute/73590335 * Clairton Forfeits Its Home Opener Latest developments: Clairton, the defending PIAA state football champion, will forfeit Friday's varsity home opener against Steel Valley over what the program called a personnel matter, WTAE and the Post-Gazette reported September 2. The forfeit hands Steel Valley a Week 2 win without a snap and sidelines one of Western Pennsylvania's most decorated small-school programs at the start of its title defense. - WTAE: https://www.wtae.com/article/clairton-football-forfeit-steel-valley/73594237 - Pittsburgh Post-Gazette: https://www.post-gazette.com/sports/high-school-football/2026/09/02/clairton-forfeit-wayne-wade-personnel-matter/stories/202609020041 * Pittsburgh Wins $200,000 State Grant for Parks Latest developments: The City of Pittsburgh received a $200,000 state grant, WPXI reported September 2, to pay for athletic-field upgrades, new water fountains, and trail-connectivity planning across several of the city's eastern neighborhoods. The award funds small-scale recreation work city budget officials would otherwise struggle to cover as Pittsburgh stares at a 2026 deficit its budget office now puts at $30 million. - WPXI: https://www.wpxi.com/news/local/city-pittsburgh-receives-200k-state-grant-fund-field-upgrades-new-water-fountains/XTDYYM4X2FH2HKFW7ID4GCLDXM/ * Penn State Fraternity Cocaine Ring in Court Latest developments: A judge granted bail September 2 to Agostino Abbatiello, the alleged ringleader held since he surrendered last month, and a former Penn State student testified that Abbatiello called himself 'the godfather' and that cocaine sat in plain view in a fraternity room. Prosecutors charged fourteen people, among them Agostino Abbatiello, Thomas Robinson, Paul Robinson, Muhammad Huraibi, Robert Zanolla, and Seth Beardsley, over a cocaine operation run out of two Penn State University fraternities; preliminary hearings are running at the Centre County Courthouse in Bellefonte, and one defendant's father, a prominent Pittsburgh attorney, also faces charges. - KDKA: https://www.cbsnews.com/pittsburgh/news/penn-state-fraternity-brothers-cocaine-ring-suspects-court-appearances/ - WTAE: https://www.wtae.com/article/penn-state-fraternity-cocaine-trafficking-court/73591469 Events: * Palace Theatre Turns 100 Latest developments: Supporters of The Palace Theatre in Greensburg marked the venue's 100th year as an entertainment house, TribLive reported September 2, with Greensburg Mayor Robb Bell among those recounting what the theater has meant to generations of local children. The Palace Theatre, Westmoreland County's landmark downtown Greensburg stage, has booked concerts, comedy, and touring shows for a century and still anchors the county's live-entertainment calendar. - TribLive: https://triblive.com/local/westmoreland/palace-theatre-supporters-celebrate-100-years-as-entertainment-venue/ * A Soulful Taste of the Burgh Latest developments: KDKA previewed 'A Soulful Taste of the Burgh' on September 2, a soul food festival set for Labor Day weekend in downtown Pittsburgh. The festival brings soul food vendors to downtown Pittsburgh over Labor Day weekend, and KDKA's Pittsburgh Today Live sampled dishes on the air ahead of it. - KDKA: https://www.cbsnews.com/pittsburgh/video/a-soulful-taste-of-the-burgh-to-take-place-over-labor-day-weekend-in-downtown-pittsburgh/ * Dylan Tribute Documentary Screens at The Lindsay Latest developments: KDKA aired an interview September 2 with Pittsburgh musicians Billy Price and Joe Grushecky about the documentary of their Bob Dylan tribute concert, which gets its first screening at The Lindsay Theater. 'Forever Young: A Bob Dylan Tribute' captures the single night last year when Price and Grushecky shared a stage, and The Lindsay Theater is showing the film for the first time. - KDKA: https://www.cbsnews.com/pittsburgh/video/forever-young-a-bob-dylan-tribute/ * Rock Against Cancer Returns to Pine Latest developments: TribLive announced September 2 the lineup for this year's Rock Against Cancer in Pine Township, a benefit concert for the Pittsburgh nonprofit Cancer Bridges. The bill pairs Genevieve Carlson & Friends and the three-part harmonies of Buckingham Prep with Stealing Time, a cover band devoted to Bruce Springsteen, Tom Petty, and Steely Dan, and the Southern-rock and blues act The Hip Waders; proceeds go to Cancer Bridges, which supports cancer patients and their families. - TribLive: https://triblive.com/aande/music/rock-against-cancer-returns-to-pine-to-benefit-cancer-bridges/ * Music on the Mezz Returns to Iron City Distillery Latest developments: Iron City Distillery announced its 2026 Music on the Mezz concert series September 2, with two Pittsburgh acts opening and closing the run. Music on the Mezz brings live music to the mezzanine at Iron City Distillery, the whiskey maker that revived the Iron City name, and the 2026 edition bookends its schedule with a pair of well-known Pittsburgh bands. - TribLive: https://triblive.com/local/valley-news-dispatch/iron-city-distilling-to-kick-off-2026-music-on-the-mezz-concert-series/ * Merged Theater Names Itself Confluence Latest developments: The merger of Pittsburgh Public Theater and Pittsburgh CLO now has a name, Confluence Theater of Pittsburgh, and a plan for its combined operations, the Post-Gazette reported August 31. Confluence Theater of Pittsburgh unites the city's flagship nonprofit drama company with its big musical-theater producer, consolidating two of the region's largest stage organizations under one banner and one season. - Post-Gazette Arts & Entertainment: https://www.post-gazette.com/ae/theater-dance/2026/08/31/confluence-theater-pittsburgh-name-merge-public-clo/stories/202608310026 SPORTS ---------------------------------------------------------------- Pirates (68-71) Tue Sep 1 · Giants 12 · Pirates 13 · Final https://plaintextsports.com/mlb/2026-09-01/sf-pit Up Next · Giants @ Pirates · Thu Sep 3, 12:35 PM https://plaintextsports.com/mlb/2026-09-03/sf-pit Steelers (0-0, T-1st in AFC North) Up Next · Falcons @ Steelers · Sun Sep 13, 1:00 PM https://plaintextsports.com/nfl/2026/week1/atl-pit Around the Teams: * Roman Wilson Earns Rodgers' Trust Latest developments: The Post-Gazette reported September 2 that receiver Roman Wilson has climbed out of the doghouse and won quarterback Aaron Rodgers' trust, with Rodgers meeting the media the same day after practice. Wilson, the Steelers' 2024 third-round pick out of Michigan, lost most of his rookie season to injury and struggled to hold a role; his connection with Rodgers now positions him in the passing game less than two weeks before the opener. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/09/02/roman-wilson-trust-aaron-rodgers/stories/202609020034 - Pittsburgh Steelers (YouTube): https://www.youtube.com/watch?v=DhCIWFzGOFg * Pirates Cling to 'Anything Can Happen' Latest developments: With playoff odds fading in the final weeks, Pirates players including infielder Brandon Lowe told the Post-Gazette September 2 that they still see a path. The Pirates enter September on the outside of the National League race after an offense that collapsed following the All-Star break, and the clubhouse is publicly refusing to write off the season. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/09/02/brandon-lowe-playoff-chances-hope/stories/202609020035 * Rudolph and Wilson Swap Camp Stories on Not Just Football Latest developments: Cam Heyward's September 2 training-camp episode gathered wide receiver Ben Skowronek, quarterback Mason Rudolph, and linebackers Cole Holcomb and Payton Wilson for a double round of camp stories. Heyward and co-host Hayden Heyward run new Not Just Football training-camp episodes every Monday, Wednesday, and Friday, working through the Steelers roster position group by position group; this installment paired Skowronek and Rudolph with the inside linebackers. - Not Just Football with Cam Heyward: https://www.youtube.com/watch?v=F3NLG4oldF0 * Dulac Fields Questions on Rodgers and McCarthy Latest developments: Post-Gazette beat writer Gerry Dulac held his Steelers chat September 2, taking reader questions on quarterback Aaron Rodgers and head coach Mike McCarthy less than two weeks before the opener. Dulac's weekly chat is the Post-Gazette's main channel for Steelers roster and scheme questions, and this one landed the day after McCarthy met the media and general manager Omar Khan explained why all 10 of the team's draft picks made the 53-man roster. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/09/02/nfl-live-chat-aaron-rodgers-mike-mccarthy/stories/202609020030 * Edge Room Talks Contracts on Not Just Football Latest developments: On Cam Heyward's Not Just Football training-camp episode, outside linebackers T.J. Watt, Alex Highsmith, Nick Herbig, and Jack Sawyer broke down their offseason contracts and life under the Steelers' new defensive system. Heyward and his co-host gathered the Steelers' edge crew—Watt, Highsmith, Herbig, and Sawyer—for a camp episode covering the group's deals, the scheme change on defense, and a round of edge-room superlatives. - Not Just Football with Cam Heyward: https://www.youtube.com/watch?v=ANB7ezXcv3w * Hiles Calls for Pirates to Clean House Latest developments: Post-Gazette writer Noah Hiles argued August 30 that the Pirates should overhaul the front office, starting by firing general manager Ben Cherington. With the Pirates fading from contention, Hiles made the case in the Post-Gazette that the franchise needs sweeping change at the top, naming general manager Ben Cherington and team president Travis Williams. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/08/30/fire-ben-cherington-travis-williams/stories/202608300073 Team USA: * Jordan Chiles Aims for the 2028 Olympics Latest developments: ESPN reported September 2 that two-time Olympian Jordan Chiles is returning to elite gymnastics with the goal of competing at the Los Angeles Games in 2028. Chiles won team gold with the United States in Paris in 2024 and team silver in Tokyo in 2021, and her comeback puts one of the sport's most recognizable American athletes back in the qualifying pipeline for a home Olympics. - ESPN Olympics: https://www.espn.com/olympics/story/_/id/49806419/jordan-chiles-returning-elite-gymnastics-competition * Davis-Woodhall Suffers a Concussion Latest developments: ESPN reported September 2 that Tara Davis-Woodhall, the Olympic and world long-jump champion, sustained a concussion last week in a head-on collision while driving to a training session. Davis-Woodhall took long jump gold at the 2024 Paris Olympics and added the world title, and the head injury interrupts the training block of one of the strongest American track and field medal prospects. - ESPN Olympics: https://www.espn.com/olympics/trackandfield/story/_/id/49804966/olympic-champ-davis-woodhall-suffers-concussion-auto-accident * Monaco Still Trying to Move Balogun Latest developments: AS Monaco's chief executive said September 2 that the club continues to shop Folarin Balogun's contract after his $45 million transfer to Everton collapsed, leaving the U.S. forward weighing possible moves to Turkey or the Saudi Pro League this week. Balogun, a striker in the U.S. men's national team pool with the World Cup on home soil approaching, stayed at Monaco when the Everton deal died on deadline day, and the club now wants his wages off its books through one of the transfer windows still open outside the major European leagues. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49803814/monaco-ceo-looking-folarin-balogun-transfer-failed-everton-move * Lawson Calls the Women's World Cup the Toughest Yet Latest developments: U.S. coach Kara Lawson said September 1 that this edition of the FIBA Women's World Cup is the most challenging field she has seen. Lawson takes the U.S. into the tournament without A'ja Wilson and Kelsey Plum, both out for health reasons, with Kiki Iriafen and Sonia Citron called in as replacements; Plum will also miss the rest of the 2026 WNBA season for the Phoenix Mercury. - ESPN Olympics: https://www.espn.com/wnba/story/_/id/49794975/us-coach-kara-lawson-calls-world-cup-most-challenging * USMNT Summer Transfer Window Closes Flat Latest developments: With the window shut, ESPN's Jeff Carlisle recapped September 2 that Folarin Balogun's deadline-day U-turn killed his Everton move and left him at AS Monaco, while Gio Reyna's switch to Strasbourg stands as a last chance to revive his career. The 2026 summer window closed on an underwhelming stretch for U.S. men's national team players: Balogun stayed at Monaco after scrapping a £40 million move to Everton, and Reyna joined Strasbourg hoping to rebuild his form ahead of the World Cup the United States co-hosts. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49789601/folarin-balogun-deadline-day-everton-usmnt-summer-transfer-window-gio-reyna READING ---------------------------------------------------------------- * Stratechery -- Fable 5.1, Enterprise Frontier Safeguards Ben Thompson covers the release of Fable 5.1, noting that its maker fully scrapped the contested data-retention policy in the interim and arguing that heavier caching amounts to a win-win for the company and its customers. https://stratechery.com/2026/fable-5-1-enterprise-frontier-safeguards/ * Ed Zitron -- Hyperscale Normalization In his latest premium newsletter, Zitron scrutinizes how the hyperscalers' enormous AI infrastructure spending has come to be treated as normal, pressing on the underlying economics. https://www.wheresyoured.at/hyperscale-normalization/ * Cal Newport -- Are We at War with AI Agent "Civilizations"? Newport returns to the July OpenAI hacking episode, weighing OpenAI's newly released details and the framing of autonomous AI agents as hostile 'civilizations.' https://calnewport.com/are-we-at-war-with-ai-agent-civilizations/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,678.18 ▲ +0.1% Dow 53,209.61 ▼ -0.2% Nasdaq 26,272.01 ▲ +0.5% WTI crude 85.03 ▼ -0.7% EUR/USD 1.1623 ▼ -0.5% GBP/USD 1.3560 ▼ -0.6% USD/JPY 159.73 ▲ +0.5% FEED HEALTH ---------------------------------------------------------------- Security: 24 of 24 feeds loaded, 68 items in the 24-hour window. No recent items: Krebs on Security, Securelist (Kaspersky), Google Online Security Blog, Cisco Talos, Microsoft Security Blog, Google Project Zero, The DFIR Report, Kim Zetter (Zero Day), Frank on Fraud, Wired Security. Pittsburgh: 9 of 9 feeds loaded, 60 items in the 48-hour window. No recent items: NEXTpittsburgh. Business and Politics: 8 of 8 feeds loaded, 60 items in the 36-hour window. Events: 4 of 4 feeds loaded, 7 items in the 120-hour window. No recent items: NEXTpittsburgh Events, NEXTpittsburgh Arts & Entertainment. Sports media: 6 of 6 feeds loaded, 30 items in the 96-hour window. No recent items: Footbahlin with Ben Roethlisberger, Ben Roethlisberger / Channel Seven (YouTube). Team USA: 3 of 3 feeds loaded, 31 items in the 72-hour window. Reading: 3 of 3 feeds loaded, 12 items in the 336-hour window. Markets (Yahoo Finance): 7 of 7 rows Weather (NWS): 3 forecast periods Scores (ESPN, plaintextsports): 2 teams via plaintextsports; mlb: ESPN failed (mlb: HTTP 403 (server: AkamaiGHost)); used plaintextsports; mlb: 1 plaintextsports rows not understood; nfl: ESPN failed (nfl: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nhl: ESPN failed (nhl: HTTP 403 (server: AkamaiGHost)); used plaintextsports Summaries: 3 model call(s) served by claude-opus-5 (388s of model time; $1.98 at API list price). ================================================================ Generated 2026-09-02 19:36 EDT. Updated weekdays at about 7:05 AM, 10:05 AM, 1:35 PM, and 7:35 PM ET, and weekends at about 8:05 AM and 7:35 PM ET. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 3 Team USA feeds; WSJ World News, WSJ Markets, WSJ US Business, WSJ Politics, The Economist, FT Home, FT World, FT Markets; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN or plaintextsports.com. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================