Machine-scale vulnerability discovery arrived in force as OpenAI shipped GPT-6 Astra and Anthropic left 21,119 Claude-found bugs unreviewed, while attackers hammered a live Chrome zero-day, two WordPress plugins, and a 12-year-old PostgreSQL flaw.
Emerging Trends and Key Updates
- Trend OpenAI's GPT-6 Astra scores 100 percent on ExploitBench as Greg Brockman defends its alignment work and researchers find AI coding agents fetching unregistered packages from poisoned llms.txt files.
- Trend Attackers logged more than 440,000 exploit attempts against Super Forms and Elementor Pro while Google patched an actively exploited Chrome V8 zero-day, CVE-2026-85046.
- Trend Token catalogued 39 ways around passkey enrollment, syncing, and recovery the same week the G7 and CISA told organizations to begin post-quantum migration now.
- Update · new PostGREShell, CVE-2026-6471, turns 12-year-old PostgreSQL replication access into permanent superuser control, and France's CNIL fined Hopital prive de la Loire 500,000 euros over 727,000 records.
- Update · new Oakmont declared an emergency as storms left 120,000 without power, Sheriff Kevin Kraus pulled deputies from hospital guard duty, and a mail voting appeal reached the Supreme Court.
- Update · updated U.S. retail diesel hit a record $5.85 a gallon on the Iran war's supply disruption, while August payrolls came in at 162,000, triple what economists expected.
Security
1. GPT-6 Astra Lands as OpenAI Funds Defenders
Latest developments: OpenAI formally launched GPT-6 Astra on September 3, 2026, days after rating it Critical for cyber capability under its Preparedness Framework, said the model scores 100 percent on ExploitBench, and now blocks user requests for proof-of-concept exploits; the company separately committed $1 billion in product credit, training, and technical support to subsidize its Daybreak cyber models for water and wastewater utilities, the electric grid, state and local government, community and regional banks, nonprofits, and open-source projects, starting in the United States.
read more
Astra is state of the art on computer use, browsing, and software engineering, and OpenAI reached the critical threshold after the model independently found zero-days. Anthropic's parallel effort, Claude Mythos Preview, produced 23,019 candidate vulnerabilities across 281 open-source projects, of which outside firms reviewed 1,900, maintainers acknowledged 1,451, and 97 fixes reached upstream, leaving 21,119 findings that no one outside Anthropic has checked.
Sources: The Hacker News · Help Net Security · Help Net Security · Dark Reading · ↑ top
2. Chrome V8 Zero-Day Under Attack
Latest developments: Google shipped a Chrome update on September 3, 2026, fixing 12 flaws, among them CVE-2026-85046, a type-confusion bug in the V8 JavaScript and WebAssembly engine rated 8.8 that attackers already exploit in the wild, the sixth Chrome zero-day Google has patched in 2026.
read more
Every Chrome build before 152.0.7977.82 carries the flaw, which a remote attacker triggers through a crafted web page. Google fixed it in Chrome 152.0.7977.82 and .83 for Windows and macOS and 152.0.7977.82 for Linux; administrators should force the update across managed fleets and restart browsers to apply it.
Sources: The Hacker News · BleepingComputer · SecurityWeek · Help Net Security · ↑ top
3. WordPress Plugin Exploitation Passes 440,000 Attempts
Latest developments: Wordfence counted more than 440,000 exploit attempts against two WordPress plugins and added a second bug to the campaign, CVE-2026-14894, a missing file-type validation flaw in Super Forms Drag and Drop Form Builder rated 9.8 that lets an unauthenticated attacker upload any file, alongside the Elementor Pro flaw CVE-2026-32475 already under attack.
read more
Both flaws hand attackers arbitrary command execution on the hosting server, and the Elementor Pro attacks plant webshells. Site owners running either plugin should install the patched versions immediately and hunt for unfamiliar PHP files in upload directories.
Sources: The Hacker News · BleepingComputer · SecurityWeek · ↑ top
4. ICE and Flock Turn Purchase and Camera Data on Protesters
Latest developments: Homeland Security Investigations served the outdoor retailer REI with a subpoena demanding the identities of everyone who bought a particular green beanie over the past two years, part of a dragnet hunt for protesters who entered a Minnesota church in March 2026, and 404 Media obtained a Flock Safety webinar that teaches police how to use the company's camera network to surveil protests, parades, fireworks shows, and bike races.
read more
The REI subpoena treats a common retail purchase as an identifier and asks a merchant to convert its customer list into an investigative lead. Retailers and camera-network customers face growing pressure to hand over records that tie ordinary transactions and vehicle movements to political activity.
Sources: Wired Security · 404 Media · ↑ top
5. PostGREShell Flaw Hands Attackers PostgreSQL Superuser
Latest developments: Researchers disclosed PostGREShell, tracked as CVE-2026-6471, a 12-year-old PostgreSQL vulnerability that converts low-level replication access into code execution on the database server, permanent superuser privileges, and a persistent backdoor.
read more
The bug rewards any attacker who obtains a replication credential, a role many deployments hand out freely for standby servers and backup tooling. Database administrators should apply the PostgreSQL updates, audit every account carrying the replication attribute, and hunt for unexpected superuser grants.
Sources: SecurityWeek · ↑ top
6. Toy Ghouls Hides Command Servers in HiveMQ and Element
Latest developments: Kaspersky's Global Emergency Response Team documented two new backdoors from the group it tracks as Toy Ghouls, one taking commands through a HiveMQ MQTT broker and the other through the Matrix-based Element messenger.
read more
Both variants route operator traffic over legitimate messaging and telemetry services that most enterprises allow outright, which defeats controls keyed to unfamiliar domains. Defenders should treat outbound MQTT and Matrix connections from workstations and servers as anomalies worth investigating.
Sources: Securelist (Kaspersky) · ↑ top
7. G7 and CISA Urge Post-Quantum Migration
Latest developments: The G7 Cyber Security Working Group and the U.S. Cybersecurity and Infrastructure Security Agency issued a joint advisory on September 3, 2026, telling organizations to start moving to post-quantum cryptography now.
read more
The advisory targets financial institutions and critical infrastructure operators whose encrypted traffic adversaries can harvest today and decrypt once quantum computers mature. Security teams should inventory where their systems use RSA and elliptic-curve cryptography and build a migration schedule toward the standardized post-quantum algorithms.
Sources: The Record · ↑ top
8. Researchers Catalog 39 Attacks on Passkeys
Latest developments: The authentication vendor Token published 39 methods for compromising passkey-based logins, every one of them working around the FIDO2 cryptography rather than against it, by abusing authentication prompts, synced credentials, enrollment, and account recovery.
read more
Passkeys kill password phishing and credential stuffing, and they leave the trust boundaries on either side of the cryptographic handshake intact for attackers to work. Identity teams should harden passkey enrollment and recovery paths, which remain the weakest link in most rollouts.
Sources: BleepingComputer · ↑ top
9. AI Coding Agents Fetch Unregistered Packages
Latest developments: Researchers at a stealth Israeli startup scanned 6,214 live domains belonging to defense contractors, Fortune 500 companies, and Big Tech firms, pulled 8,265 llms.txt and llms-full.txt files, and found 120 of them, each on a separate site, naming code packages or domains that nobody has registered.
read more
The llms.txt convention tells AI coding agents where to find a vendor's libraries and documentation, and an agent that follows a dangling pointer installs whatever the first person to claim that package name publishes. Security teams should inventory their own llms.txt files and register or remove every name they reference.
Sources: Schneier on Security · ↑ top
10. CNIL Fines Hopital Prive de la Loire Over 727,000-Record Breach
Latest developments: France's data protection authority, the Commission Nationale de l'Informatique et des Libertes, fined Hopital prive de la Loire 500,000 euros, about $580,000, for failing to adequately protect the data of patients and their relatives after a breach exposed 727,000 people.
read more
The penalty puts a price on weak security controls at a single private hospital and signals how European regulators will treat health data losses. Healthcare operators should expect scrutiny of access controls and log retention alongside breach notification.
Sources: BleepingComputer · ↑ top
Business and Politics
August Payrolls Land Before the Fed's September 16 Meeting
Latest developments: The Labor Department reported Friday, September 4, that U.S. employers added 162,000 jobs in August, triple the 53,000 economists expected, with upward revisions to the prior two months and the unemployment rate holding at 4.1%; Treasury yields and the dollar climbed, gold fell, and traders lifted the odds of a Federal Reserve rate increase on September 16.
read more
The August number, the last major labor reading before the Fed decides, hands the hawks their argument that inflation now outranks the labor market as the bigger problem. It lands atop the energy-driven price pressure that pushed U.S. retail diesel to a record this week, and it collides with President Trump's demand for lower borrowing costs before the November midterms.
Sources: WSJ Markets · FT Home · WSJ Markets · WSJ Markets · WSJ Markets · ↑ top
Diesel Sets a Record as the Iran War Drags On
Latest developments: U.S. retail diesel jumped to a fresh record high Friday, September 4, passing its 2022 peak, and crude futures eased while holding on course for their largest weekly gain since mid-July, as South Korea weighed sending forces to the Strait of Hormuz under pressure from President Trump.
read more
Prolonged Middle East disruption and damage to Russian refineries have drained global distillate supply, and this week's renewed U.S.-Iran hostilities pushed crude higher again. Tehran is holding the Strait of Hormuz closed as Trump hardens his negotiating position, a standoff that now sets fuel costs for every shipper, farmer, and utility on three continents.
Sources: WSJ US Business · FT Home · WSJ Markets · FT World · FT World · ↑ top
Norway's Oil Fund Proposes Selling $80 Billion in Treasurys
Latest developments: Norges Bank Investment Management, which runs Norway's $2.4 trillion sovereign-wealth fund, recommended to the Ministry of Finance on Friday, September 4, that it cut government bond holdings and shift into riskier credit, a change that implies selling roughly $80 billion of U.S. Treasurys.
read more
The Government Pension Fund Global is the world's largest sovereign-wealth fund and one of the biggest foreign owners of U.S. government debt. A reallocation of that size, arriving after a summer in which yields set records in Britain and Japan, would test demand for Treasurys just as the U.S. fiscal deficit keeps widening.
Sources: WSJ Markets · FT Home · ↑ top
Pittsburgh
Weather
Today: Slight Chance Showers And Thunderstorms, high 86F.
Tonight: Chance Showers And Thunderstorms, low 68F.
Saturday: Patchy Fog, high 81F.
Business
Renovated Ingram Victorian Lists at $399,900
Latest developments: The Post-Gazette's Buying Here column featured a renovated 1887 house on Hodgson Avenue in Ingram on Friday, September 4, priced at $399,900.
read more
Ingram is a small borough west of Pittsburgh along the Route 60 corridor, and the flipped Victorian shows what renovated older housing stock fetches there as buyers face 30-year mortgage rates at a 13-month high.
Sources: Pittsburgh Post-Gazette · ↑ top
Weiss Furniture Liquidates After 107 Years
Latest developments: Weiss Furniture opened a liquidation sale, TribLive reported Friday, September 4, closing out 107 years of selling furniture to Latrobe-area customers.
read more
Owner Dalia Dunhoff decided to wind the Westmoreland County store down after she caught herself shopping online for chairs and mattresses, the same shift that has thinned independent furniture retailers across the region.
Diesel Averages $5.85 a Gallon
Latest developments: The U.S. average retail diesel price reached $5.85 a gallon for the first time, WTAE and the Post-Gazette reported September 4, blaming the war with Iran for the disrupted flow of fuel.
read more
Diesel moves the trucks, trains, and farm equipment that supply Western Pennsylvania, so a record at the pump raises the delivered cost of groceries, building materials, and everything else that arrives by highway. The price sits well above gasoline and keeps climbing as Middle East refining and shipping stay disrupted.
Sources: WTAE · Pittsburgh Post-Gazette · ↑ top
Around Town
Sheriff Pulls Deputies From Jail Hospital Duty
Latest developments: The Post-Gazette reported Friday, September 4, that the Allegheny County Jail faces a staffing crisis after Sheriff Kevin Kraus withdrew his deputies from guarding hospitalized inmates and rewrote his office's medical notification policy.
read more
Sheriff's deputies had covered the around-the-clock posts outside hospital rooms where jail inmates get treatment; the jail must now fill those shifts with its own corrections officers, pulling them off housing units at a facility that has struggled for years to stay staffed.
Sources: Pittsburgh Post-Gazette · ↑ top
Supreme Court Asked to Allow Mail Voting Limits
Latest developments: The Trump administration filed an emergency appeal asking the U.S. Supreme Court to let its mail-in voting restrictions take effect, WTAE reported September 4, as the first mail ballots of the midterm cycle began reaching voters that day.
read more
President Trump's executive order seeks to narrow mail voting, and the litigation over it has left the rules unsettled with the November midterms two months out. Pennsylvania counties process hundreds of thousands of mail ballots each cycle, so whatever the justices decide will shape how the state's election runs.
Record Rain, Tornado Warnings, and 120,000 Outages
Latest developments: Oakmont declared a state of emergency after Thursday's storms uprooted trees and tore down lines across the borough, three Pittsburgh Public schools shifted to remote learning Friday over a power outage, crews pulled stranded drivers from flash flooding in Westmoreland County, and forecasters expect one more round of storms early Friday afternoon before a dry, comfortable Labor Day weekend.
read more
The National Weather Service issued tornado warnings and extended flash flood warnings into early Friday as the line crossed the region; floodwater swallowed cars on Route 51, Saw Mill Run Boulevard, inside the city. Duquesne Light counted more than 55,000 customers dark Thursday night and West Penn Power about 50,000, and Bethel Park School District warned families of damage and outages at several schools. Friday night's Hempfield football game against Penn-Trafford at Spartan Stadium remains in doubt because of a Westmoreland County power outage.
Sources: WPXI · WTAE · WTAE · WPXI · TribLive · WTAE · ↑ top
Parents Press Pittsburgh Public to End Leveling
Latest developments: TribLive reported September 4 that Pittsburgh Public Schools parents want the district to stop 'leveling' as its round of school closures approaches.
read more
Leveling is the district's long-standing practice of reassigning teachers and reshuffling students weeks into the year once actual enrollment counts come in, breaking up classes families thought were settled. The complaints land as Pittsburgh Public prepares to shutter buildings under its facilities plan, which will move thousands of children on top of the annual churn.
River Valley Goes Remote Over Mold
Latest developments: The River Valley School District shifted its students to remote learning after crews found mold in several of its buildings, WTAE reported September 4.
read more
River Valley becomes the second district in the region to empty its schools over mold this week, following Ligonier Valley, which closed every building starting August 31 for remediation and air-quality testing after the problem spread beyond three classrooms at R.K. Mellon Elementary. A hot, wet stretch of late summer has left aging school buildings across Western Pennsylvania fighting humidity.
Events
Steelers Kickoff Week Builds to the Home Opener
Latest developments: Pittsburgh Magazine laid out the Steelers Kickoff Week schedule Friday, September 4, detailing the fan activations the team has planned around the city.
read more
Steelers Kickoff Week runs through the regular-season opener against the Atlanta Falcons on Sunday, September 13, at Acrisure Stadium on the North Shore, with the team staging free fan activities around Pittsburgh in the days before the game. Pittsburgh Magazine lists the schedule; the team has not attached ticket prices to the week's fan events.
Sources: Pittsburgh Magazine · ↑ top
McKeesport at Montour in the Steelers High School Showcase
Latest developments: KDKA published viewing details Friday, September 4, for that night's WPIAL game of the week.
read more
McKeesport plays Montour at 7 p.m. Friday, September 4, at Thomas J. Birko Memorial Stadium at Montour High School, the week's featured matchup in the Steelers High School Showcase; KDKA carries the broadcast and streams it. Friday afternoon storms across Western Pennsylvania have put other area games in doubt.
Sports
Pirates (69-72)
Thu Sep 3 · Giants 2 · Pirates 5 · Final
Up Next · Angels @ Pirates · Fri Sep 4, 6:45 PM
Steelers (0-0, T-1st in AFC North)
Up Next · Falcons @ Steelers · Sun Sep 13, 1:00 PM
Around the Teams
Pirates Induct Wilson, Candelaria, and Cooper
Latest developments: The Pirates inducted shortstop Jack Wilson, pitcher John Candelaria, and pitcher Wilbur Cooper as their 2026 Hall of Fame class, the Post-Gazette reported September 3.
read more
Wilson played shortstop in Pittsburgh from 2001 through 2009 across the long losing years, Candelaria pitched for the 1979 World Series champions, and Cooper, a left-hander of the 1910s and 1920s, still holds the franchise record for career wins.
Sources: Post-Gazette Pirates · ↑ top
Pirates Sign Kyler Fedko
Latest developments: The Pirates signed Kyler Fedko to a minor league deal, the Post-Gazette reported late September 3.
read more
Fedko is the son of John Fedko, the Pittsburgh television sports anchor who hosted 'The Fedko Zone' for decades, which gives the organization a hometown name on a low-cost minor league contract as it stocks its farm system for 2027.
Sources: Post-Gazette Pirates · ↑ top
Team USA
Monaco Leaves Balogun Out of Europe
Latest developments: AS Monaco omitted Folarin Balogun from its Conference League squad, ESPN reported Friday, September 4, three days after his transfer to Everton collapsed on deadline day.
read more
Balogun, the U.S. men's national team forward, watched a move worth as much as $54 million die on September 1, and Monaco's chief executive has kept shopping his contract toward Turkey and the Saudi Pro League. The European exclusion strips him of matches at a moment when he needs playing time to hold his place in the U.S. attack.
Sources: ESPN Soccer · ↑ top
SafeSport Database Traffic Doubles
Latest developments: The U.S. Center for SafeSport said new visitors to its Centralized Disciplinary Database more than doubled in the month after it began publicly announcing sanctions, ESPN reported September 3.
read more
SafeSport handles misconduct complaints across U.S. Olympic and Paralympic sports and maintains the public list of coaches and athletes barred from participating. Publicizing each addition, rather than leaving parents and clubs to search on their own, drove the jump in traffic to the list.
Sources: ESPN Olympics · ↑ top
Reading
- Stratechery — An Interview with OpenAI President Greg Brockman About Astra and Alignment. Ben Thompson interviews OpenAI co-founder and President Greg Brockman on the company's history, its new Astra model, and how OpenAI approaches alignment. Brockman describes the weight of building technology he believes will remake the economy.
- Ed Zitron — Hyperscale Normalization. Zitron argues that the market has quietly accepted the hyperscalers' extraordinary AI capital spending as ordinary business, and he picks apart the numbers behind that normalization.
- Cal Newport — Are We at War with AI Agent "Civilizations"?. Newport returns to the July hacking attack on OpenAI after the company released fuller details, and questions the framing of autonomous AI agents as adversarial civilizations rather than as software with exploitable flaws.
Markets
S&P 500 7,688.74 ▲ +0.1% Dow 53,252.16 ▼ -0.4% Nasdaq 26,334.99 ▲ +0.5% WTI crude 88.34 ▲ +5.1% EUR/USD 1.1609 ▼ -0.6% GBP/USD 1.3537 ▼ -0.7% USD/JPY 159.66 ▲ +0.4%
Feed Health
Security: 23 of 24 feeds loaded, 54 items in the 24-hour window. Failed: Graham Cluley (ForbiddenXMLError: DTD or entity declarations are not allowed). No recent items: Krebs on Security, CISA Advisories, Sophos News, Unit 42 (Palo Alto), Google Online Security Blog, Google Project Zero, The DFIR Report, Kim Zetter (Zero Day), Frank on Fraud.
Pittsburgh: 9 of 9 feeds loaded, 60 items in the 48-hour window.
Business and Politics: 8 of 8 feeds loaded, 60 items in the 36-hour window.
Events: 4 of 4 feeds loaded, 10 items in the 120-hour window. No recent items: NEXTpittsburgh Events, NEXTpittsburgh Arts & Entertainment.
Sports media: 6 of 6 feeds loaded, 30 items in the 96-hour window. No recent items: Footbahlin with Ben Roethlisberger, Ben Roethlisberger / Channel Seven (YouTube).
Team USA: 3 of 3 feeds loaded, 40 items in the 72-hour window.
Reading: 3 of 3 feeds loaded, 12 items in the 336-hour window.
Markets (Yahoo Finance): 7 of 7 rows
Weather (NWS): 3 forecast periods
Scores (ESPN, plaintextsports): 2 teams via plaintextsports; mlb: ESPN failed (mlb: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nfl: ESPN failed (nfl: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nhl: ESPN failed (nhl: HTTP 403 (server: AkamaiGHost)); used plaintextsports
Summaries: 3 model call(s) served by claude-opus-5 (313s of model time; $1.74 at API list price).