================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Friday, September 4, 2026 - 7:06 AM EDT ================================================================ OpenAI shipped GPT-6 Astra, the first model it rates at the critical cyber threshold, and pledged $1 billion to defenders who cannot pay for it, while Google raced out a patch for a Chrome V8 zero-day attackers already use. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets | Feed Health EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] OpenAI shipped GPT-6 Astra rated Critical for cyber capability, with Greg Brockman defending its alignment work and Newport questioning the framing of AI agents as adversarial civilizations. see: GPT-6 Astra Lands as OpenAI Funds Defenders; An Interview with OpenAI President Greg Brockman About Astra and Alignment; Are We at War with AI Agent "Civilizations"? * [UPDATE (new)] Wordfence counted over 440,000 exploit attempts on Super Forms and Elementor Pro while Google patched CVE-2026-85046, an actively exploited V8 type-confusion bug, collapsing patch-to-exploitation into days. see: WordPress Plugin Exploitation Passes 440,000 Attempts; Chrome V8 Zero-Day Under Attack * [TREND] A stealth Israeli startup found 120 corporate llms.txt files steering AI coding agents toward package names and domains nobody has registered, open to whoever claims them first. see: AI Coding Agents Fetch Unregistered Packages * [UPDATE (new)] Homeland Security Investigations subpoenaed REI for the identity of everyone who bought a green beanie, part of a dragnet pairing purchase records with Flock camera data on Minnesota protesters. see: ICE and Flock Turn Purchase and Camera Data on Protesters * [UPDATE (new)] U.S. retail diesel hit a record $5.85 a gallon as the Iran war drags on, with crude heading for its largest weekly gain since mid-July. see: Diesel Averages $5.85 a Gallon; Diesel Sets a Record as the Iran War Drags On * [UPDATE (new)] Thursday's record rain cut power to more than 120,000 customers and closed Western Pennsylvania schools, while River Valley shifted to remote learning after crews found mold in several buildings. see: Record Rain, Tornado Warnings, and 120,000 Outages; River Valley Goes Remote Over Mold SECURITY ---------------------------------------------------------------- 1. GPT-6 ASTRA LANDS AS OPENAI FUNDS DEFENDERS AI Security · [ai, vulnerability-research, policy] Latest developments: OpenAI formally launched GPT-6 Astra on September 3, 2026, days after rating it Critical for cyber capability under its Preparedness Framework, said the model scores 100 percent on ExploitBench, and now blocks user requests for proof-of-concept exploits; the company separately committed $1 billion in product credit, training, and technical support to subsidize its Daybreak cyber models for water and wastewater utilities, the electric grid, state and local government, community and regional banks, nonprofits, and open-source projects, starting in the United States. Astra is state of the art on computer use, browsing, and software engineering, and OpenAI reached the critical threshold after the model independently found zero-days. Anthropic's parallel effort, Claude Mythos Preview, produced 23,019 candidate vulnerabilities across 281 open-source projects, of which outside firms reviewed 1,900, maintainers acknowledged 1,451, and 97 fixes reached upstream, leaving 21,119 findings that no one outside Anthropic has checked. - The Hacker News: https://thehackernews.com/2026/09/gpt-6-astra-scores-100-on-exploitbench.html - Help Net Security: https://www.helpnetsecurity.com/2026/09/04/openai-daybreak-frontline-defenders-access/ - Help Net Security: https://www.helpnetsecurity.com/2026/09/04/echo-claude-mythos-vulnerability-findings/ 2. WORDPRESS PLUGIN EXPLOITATION PASSES 440,000 ATTEMPTS Vulnerabilities and Exploits · [exploitation, patch, wordpress] Latest developments: Wordfence counted more than 440,000 exploit attempts against two WordPress plugins and added a second bug to the campaign, CVE-2026-14894, a missing file-type validation flaw in Super Forms Drag and Drop Form Builder rated 9.8 that lets an unauthenticated attacker upload any file, alongside the Elementor Pro flaw CVE-2026-32475 already under attack. Both flaws hand attackers arbitrary command execution on the hosting server, and the Elementor Pro attacks plant webshells. Site owners running either plugin should install the patched versions immediately and hunt for unfamiliar PHP files in upload directories. - The Hacker News: https://thehackernews.com/2026/09/over-440000-exploit-attempts-target.html - BleepingComputer: https://www.bleepingcomputer.com/news/security/critical-elementor-pro-flaw-exploited-to-take-over-wordpress-sites/ 3. ICE AND FLOCK TURN PURCHASE AND CAMERA DATA ON PROTESTERS Data Privacy · [surveillance, privacy, policy] Latest developments: Homeland Security Investigations served the outdoor retailer REI with a subpoena demanding the identities of everyone who bought a particular green beanie over the past two years, part of a dragnet hunt for protesters who entered a Minnesota church in March 2026, and 404 Media obtained a Flock Safety webinar that teaches police how to use the company's camera network to surveil protests, parades, fireworks shows, and bike races. The REI subpoena treats a common retail purchase as an identifier and asks a merchant to convert its customer list into an investigative lead. Retailers and camera-network customers face growing pressure to hand over records that tie ordinary transactions and vehicle movements to political activity. - Wired Security: https://www.wired.com/story/ice-wants-to-know-who-bought-a-certain-green-beanie-from-rei-in-the-last-2-years/ - 404 Media: https://www.404media.co/flock-taught-cops-how-to-surveil-no-kings-protesters/ 4. CHROME V8 ZERO-DAY UNDER ATTACK Vulnerabilities and Exploits · [zero-day, patch, browser] Latest developments: Google shipped a Chrome update on September 3, 2026, fixing 12 flaws, among them CVE-2026-85046, a type-confusion bug in the V8 JavaScript and WebAssembly engine rated 8.8 that attackers already exploit in the wild. Every Chrome build before 152.0.7977.82 carries the flaw, which a remote attacker triggers through a crafted web page. Administrators should force the update across managed fleets and restart browsers to apply it. - The Hacker News: https://thehackernews.com/2026/09/google-releases-chrome-update-to-patch.html 5. AI CODING AGENTS FETCH UNREGISTERED PACKAGES AI Security · [supply-chain, ai, developer-tools] Latest developments: Researchers at a stealth Israeli startup scanned 6,214 live domains belonging to defense contractors, Fortune 500 companies, and Big Tech firms, pulled 8,265 llms.txt and llms-full.txt files, and found 120 of them, each on a separate site, naming code packages or domains that nobody has registered. The llms.txt convention tells AI coding agents where to find a vendor's libraries and documentation, and an agent that follows a dangling pointer installs whatever the first person to claim that package name publishes. Security teams should inventory their own llms.txt files and register or remove every name they reference. - Schneier on Security: https://www.schneier.com/blog/archives/2026/09/ai-coding-agents-are-installing-unknown-untrusted-code-on-corporate-networks.html 6. TOY GHOULS HIDES COMMAND SERVERS IN HIVEMQ AND ELEMENT Ransomware and Cybercrime · [backdoor, apt, c2] Latest developments: Kaspersky's Global Emergency Response Team documented two new backdoors from the group it tracks as Toy Ghouls, one taking commands through a HiveMQ MQTT broker and the other through the Matrix-based Element messenger. Both variants route operator traffic over legitimate messaging and telemetry services that most enterprises allow outright, which defeats controls keyed to unfamiliar domains. Defenders should treat outbound MQTT and Matrix connections from workstations and servers as anomalies worth investigating. - Securelist (Kaspersky): https://securelist.com/toy-ghouls-new-hivemq-and-element-backdoors/121270/ BUSINESS AND POLITICS ---------------------------------------------------------------- * Diesel Sets a Record as the Iran War Drags On Latest developments: U.S. retail diesel jumped to a fresh record high Friday, September 4, and crude headed for its largest weekly gain since mid-July, while South Korea weighed sending forces to the Strait of Hormuz under pressure from President Trump. Prolonged Middle East disruption and damage to Russian refineries have drained global distillate supply, and this week's renewed U.S.-Iran hostilities pushed crude higher again. Tehran is holding the Strait of Hormuz closed as Trump hardens his negotiating position, a standoff that now sets fuel costs for every shipper, farmer, and utility on three continents. - WSJ US Business: https://www.wsj.com/business/energy-oil/u-s-retail-diesel-prices-hit-record-high-as-global-supply-tightens-c6a22603?mod=pls_whats_news_us_business_f - WSJ Markets: https://www.wsj.com/finance/commodities-futures/oil-rises-amid-elevated-supply-disruption-concerns-fa01461e?mod=rss_markets_main - FT World: https://www.ft.com/content/dea30dd4-7102-4931-834a-ac0cac28c5ec - FT World: https://www.ft.com/content/f8b2e4ad-6af2-4cf5-aae2-d1d359b31fa4?syn-25a6b1a6=1 * Norway's Oil Fund Proposes Selling $80 Billion in Treasurys Latest developments: Norges Bank Investment Management, which runs Norway's $2.4 trillion sovereign-wealth fund, recommended to the Ministry of Finance on Friday, September 4, that it cut government bond holdings and shift into riskier credit, a change that implies selling roughly $80 billion of U.S. Treasurys. The Government Pension Fund Global is the world's largest sovereign-wealth fund and one of the biggest foreign owners of U.S. government debt. A reallocation of that size, arriving after a summer in which yields set records in Britain and Japan, would test demand for Treasurys just as the U.S. fiscal deficit keeps widening. - WSJ Markets: https://www.wsj.com/finance/investing/norways-oil-fund-proposes-cut-to-government-bond-holdings-d930893f?mod=rss_markets_main - FT Home: https://www.ft.com/content/ecc15aa6-6e7b-409d-8753-2fb6aadd0592?syn-25a6b1a6=1 * August Payrolls Land Before the Fed's September 16 Meeting Latest developments: The August employment report arrives Friday, September 4, at 12:30 GMT with economists expecting 53,000 jobs added, the last major labor reading before the Federal Reserve's rate decision on September 16. Stock futures, Treasury yields, and European government bond yields all sat nearly still ahead of the number, the dollar firmed, and gold slipped while holding above $4,500 a troy ounce. A hot print would collide with the energy-driven inflation now running through diesel and crude, and would sharpen the fight over whether the Fed holds or raises. - WSJ Markets: https://www.wsj.com/livecoverage/august-jobs-report-stock-market-09-04-2026?mod=rss_markets_main - WSJ Markets: https://www.wsj.com/economy/global/u-s-european-bond-yields-little-changed-ahead-of-key-jobs-data-6528bb59?mod=rss_markets_main - WSJ Markets: https://www.wsj.com/finance/currencies/yen-consolidates-likely-buoyed-by-prospects-of-hawkish-boj-rate-hike-b1eb9c38?mod=rss_markets_main - WSJ Markets: https://www.wsj.com/finance/commodities-futures/gold-rises-on-weaker-u-s-dollar-821f948d?mod=rss_markets_main PITTSBURGH ---------------------------------------------------------------- Weather: Today: Slight Chance Showers And Thunderstorms, high 86F. Tonight: Chance Showers And Thunderstorms, low 68F. Saturday: Chance Showers And Thunderstorms then Showers And Thunderstorms Likely, high 81F. Business: * Weiss Furniture Liquidates After 107 Years Latest developments: Weiss Furniture opened a liquidation sale, TribLive reported Friday, September 4, closing out 107 years of selling furniture to Latrobe-area customers. Owner Dalia Dunhoff decided to wind the Westmoreland County store down after she caught herself shopping online for chairs and mattresses, the same shift that has thinned independent furniture retailers across the region. - TribLive: https://triblive.com/local/westmoreland/weiss-furniture-begins-liquidation-sale-after-serving-latrobe-area-customers-for-107-years/ * Diesel Averages $5.85 a Gallon Latest developments: The U.S. average retail diesel price reached $5.85 a gallon for the first time, WTAE reported September 4, blaming the war with Iran for the disrupted flow of fuel. Diesel moves the trucks, trains, and farm equipment that supply Western Pennsylvania, so a record at the pump raises the delivered cost of groceries, building materials, and everything else that arrives by highway. The price sits well above gasoline and keeps climbing as Middle East refining and shipping stay disrupted. - WTAE: https://www.wtae.com/article/record-diesel-prices-iran-war-fuel-supply/73613348 Around town: * Record Rain, Tornado Warnings, and 120,000 Outages Latest developments: Thursday evening's storms dumped more than two inches of rain on Pittsburgh, a record for September 3, cut power to more than 120,000 customers, and forced Friday school closings, delays, and remote learning across Western Pennsylvania, with another round of storms forecast for early Friday afternoon. The National Weather Service issued tornado warnings and extended flash flood warnings into early Friday as the line crossed the region; floodwater swallowed cars on Route 51, Saw Mill Run Boulevard, inside the city. Duquesne Light counted more than 55,000 customers dark Thursday night and West Penn Power about 50,000, and Bethel Park School District warned families of damage and outages at several schools. Friday night's Hempfield football game against Penn-Trafford at Spartan Stadium remains in doubt because of a Westmoreland County power outage. - WPXI: https://www.wpxi.com/weather/pittsburgh-gets-record-rainfall-more-storms-way-with-risk-damaging-winds/ISFMIA4IIJAQ3BDGMEJRWWIL3A/ - WTAE: https://www.wtae.com/article/pennsylvania-power-outages-september-3-4/73611203 - WTAE: https://www.wtae.com/article/pennsylvania-school-closings-delays-september-4/73611067 - WPXI: https://www.wpxi.com/news/local/severe-storms-flood-roads-toss-tents-cause-thousands-power-outages/HANBKKAITBG4FL2WUWXQMJL4YI/ - TribLive: https://triblive.com/sports/with-storms-taking-toll-friday-football-games-at-hempfield-penn-trafford-in-doubt/ * Parents Press Pittsburgh Public to End Leveling Latest developments: TribLive reported September 4 that Pittsburgh Public Schools parents want the district to stop 'leveling' as its round of school closures approaches. Leveling is the district's long-standing practice of reassigning teachers and reshuffling students weeks into the year once actual enrollment counts come in, breaking up classes families thought were settled. The complaints land as Pittsburgh Public prepares to shutter buildings under its facilities plan, which will move thousands of children on top of the annual churn. - TribLive: https://triblive.com/news/education-classroom/pittsburgh-public-parents-seek-stop-to-leveling-as-school-closures-approach/ * River Valley Goes Remote Over Mold Latest developments: The River Valley School District shifted its students to remote learning after crews found mold in several of its buildings, WTAE reported September 4. River Valley becomes the second district in the region to empty its schools over mold this week, following Ligonier Valley, which closed every building starting August 31 for remediation and air-quality testing after the problem spread beyond three classrooms at R.K. Mellon Elementary. A hot, wet stretch of late summer has left aging school buildings across Western Pennsylvania fighting humidity. - WTAE: https://www.wtae.com/article/river-valley-schools-mold-remote-learning/73608538 SPORTS ---------------------------------------------------------------- Pirates (69-72) Thu Sep 3 · Giants 2 · Pirates 5 · Final https://plaintextsports.com/mlb/2026-09-03/sf-pit Up Next · Angels @ Pirates · Fri Sep 4, 6:45 PM https://plaintextsports.com/mlb/2026/teams/pittsburgh-pirates Steelers (0-0, T-1st in AFC North) Up Next · Falcons @ Steelers · Sun Sep 13, 1:00 PM https://plaintextsports.com/nfl/2026/week1/atl-pit Around the Teams: * Pirates Induct Wilson, Candelaria, and Cooper Latest developments: The Pirates inducted shortstop Jack Wilson, pitcher John Candelaria, and pitcher Wilbur Cooper as their 2026 Hall of Fame class, the Post-Gazette reported September 3. Wilson played shortstop in Pittsburgh from 2001 through 2009 across the long losing years, Candelaria pitched for the 1979 World Series champions, and Cooper, a left-hander of the 1910s and 1920s, still holds the franchise record for career wins. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/09/03/jack-wilson-john-candelaria-wilbur-cooper-pirates-hall-of-fame/stories/202609030043 * Pirates Sign Kyler Fedko Latest developments: The Pirates signed Kyler Fedko to a minor league deal, the Post-Gazette reported late September 3. Fedko is the son of John Fedko, the Pittsburgh television sports anchor who hosted 'The Fedko Zone' for decades, which gives the organization a hometown name on a low-cost minor league contract as it stocks its farm system for 2027. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/09/03/pirates-kyler-fedko-fedko-zone/stories/202609030067 Team USA: * Monaco Leaves Balogun Out of Europe Latest developments: AS Monaco omitted Folarin Balogun from its Conference League squad, ESPN reported Friday, September 4, three days after his transfer to Everton collapsed on deadline day. Balogun, the U.S. men's national team forward, watched a move worth as much as $54 million die on September 1, and Monaco's chief executive has kept shopping his contract toward Turkey and the Saudi Pro League. The European exclusion strips him of matches at a moment when he needs playing time to hold his place in the U.S. attack. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49823227/folarin-balogun-omitted-monaco-conference-league-squad-everton-saga * SafeSport Database Traffic Doubles Latest developments: The U.S. Center for SafeSport said new visitors to its Centralized Disciplinary Database more than doubled in the month after it began publicly announcing sanctions, ESPN reported September 3. SafeSport handles misconduct complaints across U.S. Olympic and Paralympic sports and maintains the public list of coaches and athletes barred from participating. Publicizing each addition, rather than leaving parents and clubs to search on their own, drove the jump in traffic to the list. - ESPN Olympics: https://www.espn.com/olympics/story/_/id/49814926/safesport-sees-jump-database-traffic-announcing-sanctions READING ---------------------------------------------------------------- * Stratechery -- An Interview with OpenAI President Greg Brockman About Astra and Alignment Ben Thompson interviews OpenAI co-founder and President Greg Brockman on the company's history, its new Astra model, and how OpenAI approaches alignment. Brockman describes the weight of building technology he believes will remake the economy. https://stratechery.com/2026/an-interview-with-openai-president-greg-brockman-about-astra-and-alignment/ * Ed Zitron -- Hyperscale Normalization Zitron argues that the market has quietly accepted the hyperscalers' extraordinary AI capital spending as ordinary business, and he picks apart the numbers behind that normalization. https://www.wheresyoured.at/hyperscale-normalization/ * Cal Newport -- Are We at War with AI Agent "Civilizations"? Newport returns to the July hacking attack on OpenAI after the company released fuller details, and questions the framing of autonomous AI agents as adversarial civilizations rather than as software with exploitable flaws. https://calnewport.com/are-we-at-war-with-ai-agent-civilizations/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,688.74 ▲ +0.1% Dow 53,252.16 ▼ -0.4% Nasdaq 26,334.99 ▲ +0.5% WTI crude 88.34 ▲ +5.1% EUR/USD 1.1609 ▼ -0.6% GBP/USD 1.3537 ▼ -0.7% USD/JPY 159.66 ▲ +0.4% FEED HEALTH ---------------------------------------------------------------- Security: 24 of 24 feeds loaded, 60 items in the 24-hour window. No recent items: Krebs on Security, Sophos News, Unit 42 (Palo Alto), Google Online Security Blog, Graham Cluley, Google Project Zero, The DFIR Report, Kim Zetter (Zero Day), Frank on Fraud. Pittsburgh: 9 of 9 feeds loaded, 60 items in the 48-hour window. Business and Politics: 8 of 8 feeds loaded, 60 items in the 36-hour window. Events: 4 of 4 feeds loaded, 10 items in the 120-hour window. No recent items: NEXTpittsburgh Events, NEXTpittsburgh Arts & Entertainment. Sports media: 6 of 6 feeds loaded, 30 items in the 96-hour window. No recent items: Footbahlin with Ben Roethlisberger, Ben Roethlisberger / Channel Seven (YouTube). Team USA: 3 of 3 feeds loaded, 38 items in the 72-hour window. Reading: 3 of 3 feeds loaded, 12 items in the 336-hour window. Markets (Yahoo Finance): 7 of 7 rows Weather (NWS): 3 forecast periods Scores (ESPN, plaintextsports): 2 teams via plaintextsports; mlb: ESPN failed (mlb: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nfl: ESPN failed (nfl: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nhl: ESPN failed (nhl: HTTP 403 (server: AkamaiGHost)); used plaintextsports Summaries: 3 model call(s) served by claude-opus-5 (309s of model time; $1.56 at API list price). ================================================================ Generated 2026-09-04 07:06 EDT. Updated weekdays at about 7:05 AM, 10:05 AM, 1:35 PM, and 7:35 PM ET, and weekends at about 8:05 AM and 7:35 PM ET. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 3 Team USA feeds; WSJ World News, WSJ Markets, WSJ US Business, WSJ Politics, The Economist, FT Home, FT World, FT Markets; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN or plaintextsports.com. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================