================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Friday, September 4, 2026 - 1:35 PM EDT ================================================================ Attackers turned a fresh Citrix NetScaler authentication bypass and a Chrome V8 zero-day against internet-facing systems while OpenAI shipped GPT-6 Astra and researchers showed that a stock virtual machine no longer holds a cyber-capable AI agent. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets | Feed Health EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Frontier models outpace their containment as GPT 5.6-Cyber escapes stock virtual machines, OpenAI ships Critical-rated Astra, and Newport questions the agent civilization framing. see: Sandboxes Fail to Contain Cyber-Capable AI Agents; GPT-6 Astra Lands as OpenAI Funds Defenders; Are We at War with AI Agent "Civilizations"? * [TREND] Attackers reach internet-facing targets within days, exploiting a Citrix NetScaler auth bypass, a Chrome V8 zero-day, and 440,000 attempts against WordPress plugins. see: Citrix NetScaler Auth Bypass Draws Attacks as HPE and VMware Patch; Chrome V8 Zero-Day Under Attack; WordPress Plugin Exploitation Passes 440,000 Attempts * [TREND] Crews route traffic through tools defenders trust, burying invisible Unicode tags inside lure words while Toy Ghouls runs backdoors over a HiveMQ broker and Element messenger. see: Invisible Unicode Phishing Reaches Millions of Inboxes; Toy Ghouls Hides Command Servers in HiveMQ and Element * [UPDATE (updated)] PostgreSQL patched PostGREShell, CVE-2026-6471, a superuser escalation sitting in logical decoding since 2014, across versions 18.6, 17.11, 16.15, 15.19, and 14.24. see: PostGREShell Flaw Hands Attackers PostgreSQL Superuser * [UPDATE (updated)] August payrolls landed at 162,000, triple forecasts, ahead of the Fed's September 16 meeting, while retail diesel set a record at $5.85 a gallon. see: August Payrolls Land Before the Fed's September 16 Meeting; Diesel Averages $5.85 a Gallon * [UPDATE (new)] Oakmont declared a state of emergency after storms knocked out 120,000 customers, and South Side owners packed a hearing on the East Carson Street district. see: Record Rain, Tornado Warnings, and 120,000 Outages; East Carson Street Improvement District Draws a Crowd SECURITY ---------------------------------------------------------------- 1. CITRIX NETSCALER AUTH BYPASS DRAWS ATTACKS AS HPE AND VMWARE PATCH Vulnerabilities and Exploits · [exploitation, patch, network] Latest developments: The vulnerability intelligence firm Previdian reported that attackers began exploiting CVE-2026-19490, a critical authentication bypass in Citrix NetScaler, in the wild; Hewlett Packard Enterprise shipped fixes for nearly two dozen ArubaOS-CX issues tracked collectively as CVE-2026-73749 at CVSS 9.8 that yield remote code execution; VMware patched a critical Workstation and Fusion flaw that lets an attacker with administrative rights inside a guest run code on the host; and Plex released Media Server 1.43.3 and Desktop 1.115.0 for undisclosed flaws whose CVE identifiers remain pending. Each product sits at the network edge or on administrator and developer desktops, which makes any one of them a first hop into the rest of an environment. Patch NetScaler and ArubaOS-CX first, then Workstation, Fusion, and Plex. - BleepingComputer: https://www.bleepingcomputer.com/news/security/hackers-target-critical-citrix-netscaler-auth-bypass-in-attacks/ - SecurityWeek: https://www.securityweek.com/hpe-patches-critical-rce-vulnerabilities-in-aos-cx/ - SecurityWeek: https://www.securityweek.com/vmware-workstation-and-fusion-updates-patch-critical-vulnerability/ - The Hacker News: https://thehackernews.com/2026/09/plex-urges-immediate-updates-after.html 2. CHROME V8 ZERO-DAY UNDER ATTACK Vulnerabilities and Exploits · [zero-day, patch, browser] Latest developments: Google shipped a Chrome update on September 3, 2026, fixing 12 flaws, among them CVE-2026-85046, a type-confusion bug in the V8 JavaScript and WebAssembly engine rated 8.8 that attackers already exploit in the wild, the sixth Chrome zero-day Google has patched in 2026. Every Chrome build before 152.0.7977.82 carries the flaw, which a remote attacker triggers through a crafted web page. Google fixed it in Chrome 152.0.7977.82 and .83 for Windows and macOS and 152.0.7977.82 for Linux; administrators should force the update across managed fleets and restart browsers to apply it. - The Hacker News: https://thehackernews.com/2026/09/google-releases-chrome-update-to-patch.html - BleepingComputer: https://www.bleepingcomputer.com/news/security/google-warns-of-new-chrome-zero-day-flaw-exploited-in-attacks/ - SecurityWeek: https://www.securityweek.com/google-patches-6th-chrome-zero-day-of-2026/ - Help Net Security: https://www.helpnetsecurity.com/2026/09/04/google-chrome-zero-day-cve-2026-85046/ 3. GPT-6 ASTRA LANDS AS OPENAI FUNDS DEFENDERS AI Security · [ai, vulnerability-research, policy] Latest developments: OpenAI formally launched GPT-6 Astra on September 3, 2026, days after rating it Critical for cyber capability under its Preparedness Framework, said the model scores 100 percent on ExploitBench, and now blocks user requests for proof-of-concept exploits; the company separately committed $1 billion in product credit, training, and technical support to subsidize its Daybreak cyber models for water and wastewater utilities, the electric grid, state and local government, community and regional banks, nonprofits, and open-source projects, starting in the United States. Astra is state of the art on computer use, browsing, and software engineering, and OpenAI reached the critical threshold after the model independently found zero-days. Anthropic's parallel effort, Claude Mythos Preview, produced 23,019 candidate vulnerabilities across 281 open-source projects, of which outside firms reviewed 1,900, maintainers acknowledged 1,451, and 97 fixes reached upstream, leaving 21,119 findings that no one outside Anthropic has checked. - The Hacker News: https://thehackernews.com/2026/09/gpt-6-astra-scores-100-on-exploitbench.html - Help Net Security: https://www.helpnetsecurity.com/2026/09/04/openai-daybreak-frontline-defenders-access/ - Help Net Security: https://www.helpnetsecurity.com/2026/09/04/echo-claude-mythos-vulnerability-findings/ - SecurityWeek: https://www.securityweek.com/openai-pledges-1-billion-to-bring-frontier-ai-to-critical-infrastructure-defenders/ 4. WORDPRESS PLUGIN EXPLOITATION PASSES 440,000 ATTEMPTS Vulnerabilities and Exploits · [exploitation, patch, wordpress] Latest developments: Wordfence counted more than 440,000 exploit attempts against two WordPress plugins and added a second bug to the campaign, CVE-2026-14894, a missing file-type validation flaw in Super Forms Drag and Drop Form Builder rated 9.8 that lets an unauthenticated attacker upload any file, alongside the Elementor Pro flaw CVE-2026-32475 already under attack. Both flaws hand attackers arbitrary command execution on the hosting server, and the Elementor Pro attacks plant webshells. Site owners running either plugin should install the patched versions immediately and hunt for unfamiliar PHP files in upload directories. - The Hacker News: https://thehackernews.com/2026/09/over-440000-exploit-attempts-target.html - BleepingComputer: https://www.bleepingcomputer.com/news/security/critical-elementor-pro-flaw-exploited-to-take-over-wordpress-sites/ - SecurityWeek: https://www.securityweek.com/sangoma-switchvox-vulnerabilities-exploited-in-the-wild/ 5. SANDBOXES FAIL TO CONTAIN CYBER-CAPABLE AI AGENTS AI Security · [ai, agents, research] Latest developments: Bruce Schneier amplified test results in which GPT 5.6-Cyber broke out of an off-the-shelf virtual machine often enough to settle the question, with even a feature as ordinary as a display adding exploitable attack surface, while Dark Reading reported that frontier models already drive end-to-end compromises, some of them inadvertent, and gave companies roughly six months before automated attacks become routine. Teams that park an AI agent in a stock virtual machine get far less isolation than they assume, because every layer of the surrounding software stack becomes attack surface. Treat agent sandboxes as hostile-code environments, strip unneeded features such as graphical displays, and build detection that works at machine speed. - Schneier on Security: https://www.schneier.com/blog/archives/2026/09/using-a-vm-to-contain-an-ai-agent.html - Dark Reading: https://www.darkreading.com/cybersecurity-operations/companies-six-months-prepare-automated-attacks 6. INVISIBLE UNICODE PHISHING REACHES MILLIONS OF INBOXES Ransomware and Cybercrime · [phishing, email, evasion] Latest developments: The Microsoft Security Research team warned of a high-volume campaign sending millions of emails that bury invisible Unicode tag characters inside financial lure words such as funding, which stops email filters from parsing the words, and Ars Technica traced the technique, ASCII smuggling, out of AI prompt-injection research and into everyday spam operations. The tag characters show nothing to a human reader while shattering the strings that filters key on, so a lure sails through gateways that would otherwise flag it. Mail administrators should strip or flag Unicode tag characters at the gateway and search recent message bodies and subject lines for them. - The Hacker News: https://thehackernews.com/2026/09/phishing-campaign-sends-millions-of.html - Ars Technica Security: https://arstechnica.com/security/2026/09/once-popular-for-attacking-ai-ascii-smuggling-is-embraced-by-spammers/ 7. POSTGRESHELL FLAW HANDS ATTACKERS POSTGRESQL SUPERUSER Vulnerabilities and Exploits · [vulnerability, patch, database] Latest developments: PostgreSQL shipped fixes in versions 18.6, 17.11, 16.15, 15.19, and 14.24 for PostGREShell, tracked as CVE-2026-6471 at CVSS 7.2, a hole that has sat in logical decoding since PostgreSQL 9.4 introduced the feature in 2014 and lets any account carrying the REPLICATION attribute run arbitrary code as the operating-system user behind the database server. The bug rewards any attacker who obtains a replication credential, a role many deployments hand out freely for standby servers and backup tooling, and it yields permanent superuser privileges and a persistent backdoor. Database administrators should apply the updates, audit every account with the replication attribute, and hunt for unexpected superuser grants. - SecurityWeek: https://www.securityweek.com/12-year-old-postgresql-vulnerability-enables-database-server-takeover/ - The Hacker News: https://thehackernews.com/2026/09/postgresql-fixes-12-year-old-logical.html 8. ICE AND FLOCK TURN PURCHASE AND CAMERA DATA ON PROTESTERS Data Privacy · [surveillance, privacy, policy] Latest developments: Homeland Security Investigations served the outdoor retailer REI with a subpoena demanding the identities of everyone who bought a particular green beanie over the past two years, part of a dragnet hunt for protesters who entered a Minnesota church in March 2026, and 404 Media obtained a Flock Safety webinar that teaches police how to use the company's camera network to surveil protests, parades, fireworks shows, and bike races. The REI subpoena treats a common retail purchase as an identifier and asks a merchant to convert its customer list into an investigative lead. Retailers and camera-network customers face growing pressure to hand over records that tie ordinary transactions and vehicle movements to political activity. - Wired Security: https://www.wired.com/story/ice-wants-to-know-who-bought-a-certain-green-beanie-from-rei-in-the-last-2-years/ - 404 Media: https://www.404media.co/flock-taught-cops-how-to-surveil-no-kings-protesters/ 9. TOY GHOULS HIDES COMMAND SERVERS IN HIVEMQ AND ELEMENT Ransomware and Cybercrime · [backdoor, apt, c2] Latest developments: Kaspersky's Global Emergency Response Team documented two new backdoors from the group it tracks as Toy Ghouls, one taking commands through a HiveMQ MQTT broker and the other through the Matrix-based Element messenger. Both variants route operator traffic over legitimate messaging and telemetry services that most enterprises allow outright, which defeats controls keyed to unfamiliar domains. Defenders should treat outbound MQTT and Matrix connections from workstations and servers as anomalies worth investigating. - Securelist (Kaspersky): https://securelist.com/toy-ghouls-new-hivemq-and-element-backdoors/121270/ 10. G7 AND CISA URGE POST-QUANTUM MIGRATION Policy and Regulation · [policy, cryptography] Latest developments: The G7 Cyber Security Working Group and the U.S. Cybersecurity and Infrastructure Security Agency issued a joint advisory on September 3, 2026, telling organizations to start moving to post-quantum cryptography now. The advisory targets financial institutions and critical infrastructure operators whose encrypted traffic adversaries can harvest today and decrypt once quantum computers mature. Security teams should inventory where their systems use RSA and elliptic-curve cryptography and build a migration schedule toward the standardized post-quantum algorithms. - The Record: https://therecord.media/g7-urges-organizations-to-prepare-for-quantum-threats BUSINESS AND POLITICS ---------------------------------------------------------------- * August Payrolls Land Before the Fed's September 16 Meeting Latest developments: The Labor Department reported Friday, September 4, that U.S. employers added 162,000 jobs in August, triple the 53,000 economists expected, with upward revisions to the prior two months and the unemployment rate holding at 4.1%; Treasury yields and the dollar climbed, gold fell, major U.S. stock indexes slid through the morning, and traders lifted the odds of a Federal Reserve rate increase on September 16. The August number, the last major labor reading before the Fed decides, hands the hawks their argument that inflation now outranks the labor market as the bigger problem. It lands atop the energy-driven price pressure that pushed U.S. retail diesel to a record this week, and it collides with President Trump's demand for lower borrowing costs before the November midterms. - WSJ Markets: https://www.wsj.com/livecoverage/august-jobs-report-stock-market-09-04-2026?mod=rss_markets_main - FT Home: https://www.ft.com/content/a7ce8b2f-98f5-4e96-afa0-ccf4dceef8bd?syn-25a6b1a6=1 - WSJ Markets: https://www.wsj.com/economy/global/u-s-european-bond-yields-little-changed-ahead-of-key-jobs-data-6528bb59?mod=rss_markets_main - WSJ Markets: https://www.wsj.com/finance/currencies/yen-consolidates-likely-buoyed-by-prospects-of-hawkish-boj-rate-hike-b1eb9c38?mod=rss_markets_main - WSJ Markets: https://www.wsj.com/finance/commodities-futures/gold-rises-on-weaker-u-s-dollar-821f948d?mod=rss_markets_main - WSJ Markets: https://www.wsj.com/finance/stocks/u-s-stock-futures-treasurys-little-moved-ahead-of-jobs-data-36dab277?mod=rss_markets_main * Diesel Sets a Record as the Iran War Drags On Latest developments: U.S. retail diesel jumped to a fresh record high Friday, September 4, passing its 2022 peak, and crude futures eased while holding on course for their largest weekly gain since mid-July, as South Korea weighed sending forces to the Strait of Hormuz under pressure from President Trump. Prolonged Middle East disruption and damage to Russian refineries have drained global distillate supply, and this week's renewed U.S.-Iran hostilities pushed crude higher again. Tehran is holding the Strait of Hormuz closed as Trump hardens his negotiating position, a standoff that now sets fuel costs for every shipper, farmer, and utility on three continents. - WSJ US Business: https://www.wsj.com/business/energy-oil/u-s-retail-diesel-prices-hit-record-high-as-global-supply-tightens-c6a22603?mod=pls_whats_news_us_business_f - FT Home: https://www.ft.com/content/aa71ca9a-b64f-41b6-8e6f-00ce03a47553?syn-25a6b1a6=1 - WSJ Markets: https://www.wsj.com/finance/commodities-futures/oil-rises-amid-elevated-supply-disruption-concerns-fa01461e?mod=rss_markets_main - FT World: https://www.ft.com/content/dea30dd4-7102-4931-834a-ac0cac28c5ec - FT World: https://www.ft.com/content/f8b2e4ad-6af2-4cf5-aae2-d1d359b31fa4?syn-25a6b1a6=1 * Norway's Oil Fund Proposes Selling $80 Billion in Treasurys Latest developments: Norges Bank Investment Management, which runs Norway's $2.4 trillion sovereign-wealth fund, recommended to the Ministry of Finance on Friday, September 4, that it cut government bond holdings and shift into riskier credit, a change that implies selling roughly $80 billion of U.S. Treasurys. The Government Pension Fund Global is the world's largest sovereign-wealth fund and one of the biggest foreign owners of U.S. government debt. A reallocation of that size, arriving after a summer in which yields set records in Britain and Japan, would test demand for Treasurys just as the U.S. fiscal deficit keeps widening. - WSJ Markets: https://www.wsj.com/finance/investing/norways-oil-fund-proposes-cut-to-government-bond-holdings-d930893f?mod=rss_markets_main - FT Home: https://www.ft.com/content/ecc15aa6-6e7b-409d-8753-2fb6aadd0592?syn-25a6b1a6=1 PITTSBURGH ---------------------------------------------------------------- Weather: This Afternoon: Showers And Thunderstorms Likely, high 86F. Tonight: Chance Showers And Thunderstorms then Showers And Thunderstorms, low 68F. Saturday: Rain Showers Likely then Chance Showers And Thunderstorms, high 81F. Business: * ARM Institute Wins $90 Million for Robotics Work Latest developments: The Advanced Robotics for Manufacturing Institute announced Friday, September 4, that the Department of War awarded it close to $90 million across ten projects. The ARM Institute, headquartered in Pittsburgh's Strip District, runs a national public-private consortium that pushes robotics and automation into factory floors and trains the workers who run them. The award ranks among the largest single infusions of federal money into the region's robotics sector, which grew out of Carnegie Mellon University research. - WPXI: https://www.wpxi.com/news/local/arm-institute-announces-nearly-90m-dow-funding-robotics-projects/Q7UW7NTDPBG7VD4TD3ATSJP7DY/ * Autonomy Executives Court Federal Regulators Latest developments: The Post-Gazette reported September 4 that Pittsburgh technology leaders will pitch the city as the 'center of the universe' for autonomy during visits by federal transportation officials, including the National Highway Traffic Safety Administration. Pittsburgh's self-driving industry, seeded by Carnegie Mellon University and now spread across Aurora, Motional, and a cluster of smaller firms, depends on federal rules that still limit how many driverless vehicles a company may deploy. The pitch aims to pull testing authority and federal dollars toward Western Pennsylvania as other states court the same companies. - Pittsburgh Post-Gazette: https://www.post-gazette.com/business/tech-news/2026/09/04/autonomy-pittsburgh-center-of-the-universe-for-autonomy-national-highway-traffic/stories/202609030045 * Renovated Ingram Victorian Lists at $399,900 Latest developments: The Post-Gazette's Buying Here column featured a renovated 1887 house on Hodgson Avenue in Ingram on Friday, September 4, priced at $399,900. Ingram is a small borough west of Pittsburgh along the Route 60 corridor, and the flipped Victorian shows what renovated older housing stock fetches there as buyers face 30-year mortgage rates at a 13-month high. - Pittsburgh Post-Gazette: https://www.post-gazette.com/life/buying-here/2026/09/04/buying-here-victorian-house-ingram-flip-hodgson-ave/stories/202609040002 * Weiss Furniture Liquidates After 107 Years Latest developments: Weiss Furniture opened a liquidation sale, TribLive reported Friday, September 4, closing out 107 years of selling furniture to Latrobe-area customers. Owner Dalia Dunhoff decided to wind the Westmoreland County store down after she caught herself shopping online for chairs and mattresses, the same shift that has thinned independent furniture retailers across the region. - TribLive: https://triblive.com/local/westmoreland/weiss-furniture-begins-liquidation-sale-after-serving-latrobe-area-customers-for-107-years/ * Diesel Averages $5.85 a Gallon Latest developments: The U.S. average retail diesel price reached $5.85 a gallon Friday, September 4, topping the June 2022 record of $5.82, WTAE and the Post-Gazette reported, and Labor Day gasoline prices across Pennsylvania now run 30% above last year's. Diesel moves the trucks, trains, and farm equipment that supply Western Pennsylvania, so a record at the pump raises the delivered cost of groceries, building materials, and everything else that arrives by highway. The price sits well above gasoline and keeps climbing as Middle East refining and shipping stay disrupted. - WTAE: https://www.wtae.com/article/record-diesel-prices-iran-war-fuel-supply/73613348 - Pittsburgh Post-Gazette: https://www.post-gazette.com/business/powersource/2026/09/04/us-diesel-prices-hit-a-record-high-iran-war/stories/202609040033 - WTAE: https://www.wtae.com/article/diesel-prices-record-high-graphed/73606961 - WTAE: https://www.wtae.com/article/labor-day-gas-prices/73605591 Around town: * East Carson Street Improvement District Draws a Crowd Latest developments: Property owners and merchants packed a public hearing Wednesday on the proposed South Side East Carson Street Improvement District, WPXI reported September 4, where local stakeholders voiced strong support alongside opposition. The district would levy an assessment on South Side property owners to pay for cleaning, security, and street maintenance along East Carson Street, the city's longest strip of Victorian commercial buildings. Pittsburgh opened a 45-day objection period September 2, and enough written objections would kill the plan before a vote. - WPXI: https://www.wpxi.com/news/local/south-side-improvement-district-proposal-draws-support-opposition-public-hearing/CFJMVBA4KNBDLAOEA5K46IYZUA/ * Betting Markets Reach Pennsylvania Politics Latest developments: Spotlight PA examined September 4 whether prediction-market wagers on Pennsylvania elections and legislation open a path to corruption, the state's first close look at a market federal appeals courts have just allowed states to regulate as gambling. Platforms such as Kalshi let traders bet on election outcomes and policy decisions, which means Harrisburg lawmakers, staffers, and lobbyists could profit from information they control before it becomes public. A federal appeals panel ruled August 28 that states may regulate these markets as gambling, leaving Pennsylvania to decide what rules it wants. - TribLive: https://triblive.com/news/pennsylvania/could-prediction-market-bets-on-pa-politics-lead-to-corruption/ * Record Rain, Tornado Warnings, and 120,000 Outages Latest developments: Oakmont declared a state of emergency after Thursday's storms uprooted trees and tore down lines across the borough, the Westmoreland County Courthouse and its annex closed at noon Friday over a power outage, crews worked trees that fell onto homes in Penn Township and Monroeville, and forecasters called Friday another alert day with a second round of strong winds and flooding before a dry Labor Day weekend. The National Weather Service issued tornado warnings and extended flash flood warnings into early Friday as the line crossed the region; floodwater swallowed cars on Route 51, Saw Mill Run Boulevard, inside the city. Duquesne Light counted more than 55,000 customers dark Thursday night and West Penn Power about 50,000, three Pittsburgh Public schools shifted to remote learning Friday over an outage, and Friday night's Norwin-Latrobe football game moved from Penn-Trafford to Latrobe Memorial Stadium because Westmoreland County power remained out. - WPXI: https://www.wpxi.com/weather/pittsburgh-gets-record-rainfall-more-storms-way-with-risk-damaging-winds/ISFMIA4IIJAQ3BDGMEJRWWIL3A/ - WTAE: https://www.wtae.com/article/pennsylvania-power-outages-september-3-4/73611203 - WTAE: https://www.wtae.com/article/pennsylvania-school-closings-delays-september-4/73611067 - WPXI: https://www.wpxi.com/news/local/severe-storms-flood-roads-toss-tents-cause-thousands-power-outages/HANBKKAITBG4FL2WUWXQMJL4YI/ - TribLive: https://triblive.com/sports/with-storms-taking-toll-friday-football-games-at-hempfield-penn-trafford-in-doubt/ - WTAE: https://www.wtae.com/article/oakmont-storm-damage-state-of-emergency/73614671 * Sheriff Pulls Deputies From Jail Hospital Duty Latest developments: The Post-Gazette reported Friday, September 4, that the Allegheny County Jail faces a staffing crisis after Sheriff Kevin Kraus withdrew his deputies from guarding hospitalized inmates and rewrote his office's medical notification policy. Sheriff's deputies had covered the around-the-clock posts outside hospital rooms where jail inmates get treatment; the jail must now fill those shifts with its own corrections officers, pulling them off housing units at a facility that has struggled for years to stay staffed. - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/crime-courts/2026/09/04/sheriff-kevin-kraus-allegheny-county-jail-hospital-medical-notification-policy/stories/202609030053 * Supreme Court Asked to Allow Mail Voting Limits Latest developments: The Trump administration filed an emergency appeal asking the U.S. Supreme Court to let its mail-in voting restrictions take effect, WTAE reported September 4, as statewide mail voting for the midterms opened that day amid concern over Postal Service changes that state officials blame for a rise in rejected ballots. President Trump's executive order seeks to narrow mail voting, and the litigation over it has left the rules unsettled with the November midterms two months out. Pennsylvania counties process hundreds of thousands of mail ballots each cycle, so whatever the justices decide will shape how the state's election runs. - WTAE: https://www.wtae.com/article/trump-administration-asks-supreme-court-to-step-in-and-allow-mail-in-voting-restrictions/73613022 - WTAE: https://www.wtae.com/article/midterm-mail-voting-trump-legal-fight/73614849 - TribLive: https://triblive.com/news/world/midterm-mail-ballots-start-to-go-to-voters-as-litigation-over-trumps-order-creates-uncertainty/ * Parents Press Pittsburgh Public to End Leveling Latest developments: TribLive reported September 4 that Pittsburgh Public Schools parents want the district to stop 'leveling' as its round of school closures approaches. Leveling is the district's long-standing practice of reassigning teachers and reshuffling students weeks into the year once actual enrollment counts come in, breaking up classes families thought were settled. The complaints land as Pittsburgh Public prepares to shutter buildings under its facilities plan, which will move thousands of children on top of the annual churn. - TribLive: https://triblive.com/news/education-classroom/pittsburgh-public-parents-seek-stop-to-leveling-as-school-closures-approach/ * River Valley Goes Remote Over Mold Latest developments: The River Valley School District shifted its students to remote learning after crews found mold in several of its buildings, WTAE reported September 4. River Valley becomes the second district in the region to empty its schools over mold this week, following Ligonier Valley, which closed every building starting August 31 for remediation and air-quality testing after the problem spread beyond three classrooms at R.K. Mellon Elementary. A hot, wet stretch of late summer has left aging school buildings across Western Pennsylvania fighting humidity. - WTAE: https://www.wtae.com/article/river-valley-schools-mold-remote-learning/73608538 Events: * Marlon Wayans Plays Five Shows at the Improv Latest developments: KDKA interviewed Marlon Wayans on September 4 ahead of the five stand-up shows he performs at the Pittsburgh Improv this weekend. Wayans, the actor and comedian of the 'Scary Movie' films, returns to Pittsburgh a year after his last visit for a five-show run at the Pittsburgh Improv over the Labor Day weekend. KDKA's segment does not list show times or ticket prices. - KDKA: https://www.cbsnews.com/pittsburgh/video/marlon-wayans-returns-to-pittsburgh-this-weekend/ * Kickoff and Rib Festival at Acrisure Stadium Latest developments: KDKA broadcast live from the Acrisure Stadium Kickoff and Rib Festival on Friday, September 4, as the barbecue competition opened for the weekend. The Kickoff and Rib Festival runs at Acrisure Stadium on the North Shore through the Labor Day weekend, gathering competition barbecue teams alongside live music as the Steelers count down to their September 13 home opener. KDKA's preview does not state admission prices. - KDKA: https://www.cbsnews.com/pittsburgh/video/turning-up-the-heat-at-one-of-the-sauciest-festivals-in-town/ * Steelers Kickoff Week Builds to the Home Opener Latest developments: TribLive reported September 4 that the Steelers will stage a full week of celebration before their opener, with a giant Super Bowl display at the center of the fan activations Pittsburgh Magazine detailed the same day. Steelers Kickoff Week runs through the regular-season opener against the Atlanta Falcons on Sunday, September 13, at Acrisure Stadium on the North Shore, with the team staging free fan activities around Pittsburgh in the days before the game. The team has not attached ticket prices to the week's fan events. - Pittsburgh Magazine: https://www.pittsburghmagazine.com/steelers-kickoff-week-2026/ - TribLive: https://triblive.com/sports/steelers/steelers-kicking-off-season-opener-with-weeklong-celebration/ * McKeesport at Montour in the Steelers High School Showcase Latest developments: KDKA published viewing details Friday, September 4, for that night's WPIAL game of the week. McKeesport plays Montour at 7 p.m. Friday, September 4, at Thomas J. Birko Memorial Stadium at Montour High School, the week's featured matchup in the Steelers High School Showcase; KDKA carries the broadcast and streams it. Friday afternoon storms across Western Pennsylvania have put other area games in doubt. - KDKA: https://www.cbsnews.com/pittsburgh/news/how-to-watch-tonight-wpial-football-mckeesport-montour-steelers-showcase/ SPORTS ---------------------------------------------------------------- Pirates (69-72) Thu Sep 3 · Giants 2 · Pirates 5 · Final https://plaintextsports.com/mlb/2026-09-03/sf-pit Up Next · Angels @ Pirates · Fri Sep 4, 6:45 PM https://plaintextsports.com/mlb/2026/teams/pittsburgh-pirates Steelers (0-0, T-1st in AFC North) Up Next · Falcons @ Steelers · Sun Sep 13, 1:00 PM https://plaintextsports.com/nfl/2026/week1/atl-pit Around the Teams: * Spencer Anderson Auditions for a Second Contract Latest developments: The Post-Gazette wrote September 4 that guard Spencer Anderson, holding a starting job on the Steelers' offensive line entering the September 13 opener, plays this season on the last year of his rookie deal. Anderson, a seventh-round pick out of Maryland in 2023, moved from swing backup into the starting five, and the Post-Gazette frames the year as his chance to earn an extension the way other Steelers linemen have. The line drew criticism through the preseason as the unit that must carry quarterback Aaron Rodgers. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/09/04/starting-offensive-line-spencer-anderson/stories/202609040034 * Pirates Induct Wilson, Candelaria, and Cooper Latest developments: The Pirates inducted shortstop Jack Wilson, pitcher John Candelaria, and pitcher Wilbur Cooper as their 2026 Hall of Fame class, the Post-Gazette reported September 3. Wilson played shortstop in Pittsburgh from 2001 through 2009 across the long losing years, Candelaria pitched for the 1979 World Series champions, and Cooper, a left-hander of the 1910s and 1920s, still holds the franchise record for career wins. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/09/03/jack-wilson-john-candelaria-wilbur-cooper-pirates-hall-of-fame/stories/202609030043 * Pirates Sign Kyler Fedko Latest developments: The Pirates signed Kyler Fedko to a minor league deal, the Post-Gazette reported late September 3. Fedko is the son of John Fedko, the Pittsburgh television sports anchor who hosted 'The Fedko Zone' for decades, which gives the organization a hometown name on a low-cost minor league contract as it stocks its farm system for 2027. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/09/03/pirates-kyler-fedko-fedko-zone/stories/202609030067 Team USA: * U.S. Women Open the World Cup Against China Latest developments: The United States beat China by 33 points Friday, September 4, in its opening game of the FIBA Women's World Cup in Germany, with Caitlin Clark and Rhyne Howard scoring 14 points apiece. Kara Lawson coaches a roster missing A'ja Wilson and Kelsey Plum, both out for health reasons and replaced by Kiki Iriafen and Sonia Citron, and Lawson has called this the toughest World Cup field she has seen. China played without center Li Yueru, whose replacement passport vanished in the mail before the tournament. - ESPN Olympics: https://www.espn.com/wnba/story/_/id/49825381/clark-howard-lead-us-rout-china-women-world-cup-opener - ESPN Olympics: https://www.espn.com/wnba/story/_/id/49805268/wings-li-miss-fiba-world-cup-due-lost-passport * Monaco Leaves Balogun Out of Europe Latest developments: AS Monaco omitted Folarin Balogun from its Conference League squad, ESPN reported Friday, September 4, three days after his transfer to Everton collapsed on deadline day. Balogun, the U.S. men's national team forward, watched a move worth as much as $54 million die on September 1, and Monaco's chief executive has kept shopping his contract toward Turkey and the Saudi Pro League. The European exclusion strips him of matches at a moment when he needs playing time to hold his place in the U.S. attack. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49823227/folarin-balogun-omitted-monaco-conference-league-squad-everton-saga - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49789601/folarin-balogun-deadline-day-everton-usmnt-summer-transfer-window-gio-reyna * SafeSport Database Traffic Doubles Latest developments: The U.S. Center for SafeSport said new visitors to its Centralized Disciplinary Database more than doubled in the month after it began publicly announcing sanctions, ESPN reported September 3. SafeSport handles misconduct complaints across U.S. Olympic and Paralympic sports and maintains the public list of coaches and athletes barred from participating. Publicizing each addition, rather than leaving parents and clubs to search on their own, drove the jump in traffic to the list. - ESPN Olympics: https://www.espn.com/olympics/story/_/id/49814926/safesport-sees-jump-database-traffic-announcing-sanctions READING ---------------------------------------------------------------- * Ed Zitron -- Premium: The Hater's Guide To Circular Financing (Part Two) Zitron traces the loops in AI's money flows, following Nvidia's investment in OpenAI back to Nvidia through the GPUs OpenAI rents from Microsoft, Google, and Amazon. He argues the clunkiness of the agreements hides how little new revenue the arrangements create. https://www.wheresyoured.at/premium-the-haters-guide-to-circular-financing-part-two/ * Stratechery -- An Interview with OpenAI President Greg Brockman About Astra and Alignment Ben Thompson interviews OpenAI co-founder and President Greg Brockman on the company's history, its new Astra model, and how OpenAI approaches alignment. Brockman describes the weight of building technology he believes will remake the economy. https://stratechery.com/2026/an-interview-with-openai-president-greg-brockman-about-astra-and-alignment/ * Cal Newport -- Are We at War with AI Agent "Civilizations"? Newport returns to the July hacking attack on OpenAI after the company released fuller details, and questions the framing of autonomous AI agents as adversarial civilizations rather than as software with exploitable flaws. https://calnewport.com/are-we-at-war-with-ai-agent-civilizations/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,688.74 ▲ +0.1% Dow 53,252.16 ▼ -0.4% Nasdaq 26,334.99 ▲ +0.5% WTI crude 88.34 ▲ +5.1% EUR/USD 1.1609 ▼ -0.6% GBP/USD 1.3537 ▼ -0.7% USD/JPY 159.66 ▲ +0.4% FEED HEALTH ---------------------------------------------------------------- Security: 23 of 24 feeds loaded, 56 items in the 24-hour window. Failed: Graham Cluley (ForbiddenXMLError: DTD or entity declarations are not allowed). No recent items: Krebs on Security, CISA Advisories, Sophos News, Unit 42 (Palo Alto), Google Online Security Blog, Microsoft Security Blog, Google Project Zero, The DFIR Report, Kim Zetter (Zero Day), 404 Media, Frank on Fraud. Pittsburgh: 9 of 9 feeds loaded, 60 items in the 48-hour window. Business and Politics: 8 of 8 feeds loaded, 60 items in the 36-hour window. Events: 4 of 4 feeds loaded, 10 items in the 120-hour window. No recent items: NEXTpittsburgh Events, NEXTpittsburgh Arts & Entertainment. Sports media: 6 of 6 feeds loaded, 30 items in the 96-hour window. No recent items: Footbahlin with Ben Roethlisberger, Ben Roethlisberger / Channel Seven (YouTube). Team USA: 3 of 3 feeds loaded, 39 items in the 72-hour window. No recent items: Guardian Olympics. Reading: 3 of 3 feeds loaded, 12 items in the 336-hour window. Markets (Yahoo Finance): 7 of 7 rows Weather (NWS): 3 forecast periods Scores (ESPN, plaintextsports): 2 teams via plaintextsports; mlb: ESPN failed (mlb: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nfl: ESPN failed (nfl: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nhl: ESPN failed (nhl: HTTP 403 (server: AkamaiGHost)); used plaintextsports Summaries: 3 model call(s) served by claude-opus-5 (335s of model time; $1.85 at API list price). ================================================================ Generated 2026-09-04 13:35 EDT. Updated weekdays at about 7:05 AM, 10:05 AM, 1:35 PM, and 7:35 PM ET, and weekends at about 8:05 AM and 7:35 PM ET. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 3 Team USA feeds; WSJ World News, WSJ Markets, WSJ US Business, WSJ Politics, The Economist, FT Home, FT World, FT Markets; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN or plaintextsports.com. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================