CERT Polska warns that attackers are seizing full administrative control of internet-exposed MikroTik routers over SSH without supplying any credentials, in a campaign running since September 2, 2026.
Quiet day: only 43 security items in the last 48 hours.
Emerging Trends and Key Updates
- Trend Unauthenticated takeover of internet-facing MikroTik routers, following the Citrix NetScaler bypass CVE-2026-19490, puts edge gear atop the exposure list alongside Broadcom's critical VMware Workstation overflow.
- Trend REVSTEALER modules that Elastic Security Labs found switch off Windows Update and Microsoft Defender to run a cryptocurrency miner, outliving the stealer that dropped them.
- Trend Token's catalog of 39 passkey compromise methods targets enrollment, recovery, synced credentials, and prompts, leaving FIDO2 cryptography intact but shifting the burden onto enterprises rolling out passwordless login.
- Update · new Witkoff and Jared Kushner carried a peace proposal into Kyiv a day after Putin hosted them, as OPEC froze October output and Trump's approval hit a low.
- Update · new Locally, ICE vans could serve as mobile detention centers, a judge and TribLive pressed Allegheny County on pensions, and the Pittsburgh Soul Food Festival ran downtown.
- Trend AI's self-dealing economics drew fresh scrutiny as Zitron traced circular financing between Nvidia and OpenAI, Ben Thompson interviewed Greg Brockman, and Newport disputed agent civilization framing.
Security
1. MikroTik Routers Fall to Unauthenticated SSH Attacks
Latest developments: CERT Polska published an attack warning on September 5, 2026, reporting that attackers take full administrative control of MikroTik routers whose SSH service answers from the internet, with no authentication required and successful compromises dating to at least September 2, 2026.
read more
MikroTik routers sit at the edge of small-business, hosting, and branch-office networks, so administrative control hands an attacker traffic interception and a pivot into everything behind the device. CERT Polska has released no victim count; pull SSH off the public internet, limit management access to known addresses, and audit routers for added accounts, scripts, and scheduled tasks.
Sources: The Hacker News · ↑ top
2. REVSTEALER Modules Kill Defender and Mine Crypto
Latest developments: Elastic Security Labs documented four previously unreported programs that ride along with REVSTEALER, an emerging Windows information stealer, and stay on the machine after the stealer deletes itself, among them ProManager, WinUpdate, and SoftManager; one of the four disables Windows Update and Microsoft Defender before launching a cryptocurrency miner.
read more
REVSTEALER harvests credentials and then erases its own binary, which has masked the persistent modules that remain behind on Windows hosts. Treat a REVSTEALER hit as an ongoing compromise, check whether Windows Update and Defender have been turned off, and hunt for the named components.
Sources: The Hacker News · ↑ top
3. Critical VMware Workstation and Fusion Overflow
Latest developments: Broadcom assigned the critical desktop hypervisor bug CVE-2026-59346 at CVSS 9.3, an integer overflow that a local attacker holding elevated privileges inside a guest exploits to run arbitrary code, and shipped fixes for it alongside a second Workstation and Fusion flaw.
read more
VMware Workstation and Fusion run on developer, researcher, and analyst desktops, where malware analysts rely on the guest boundary to hold. Apply the Broadcom updates, and stop treating an off-the-shelf virtual machine as containment for hostile code.
Sources: The Hacker News · ↑ top
4. Researchers Catalog 39 Passkey Attacks
Latest developments: The authentication vendor Token published 39 documented methods for compromising passkey-based logins, all of which abuse authentication prompts, synced credentials, enrollment, and account recovery while leaving FIDO2 cryptography intact.
read more
Passkeys close off password phishing and credential stuffing, and the surrounding workflows still decide who gets in. Organizations deploying passwordless authentication should harden enrollment and recovery paths, restrict credential syncing across devices, and treat prompt approval as an attackable step.
Sources: BleepingComputer · ↑ top
5. Kremlin Hardens Data Centers Against Drones
Latest developments: The Kremlin has imposed new physical security requirements on Russian data center operators, whose facilities cluster in regions that Ukrainian drone strikes now reach.
read more
Russia concentrates its commercial and government computing in a handful of geographic areas, and drone range has turned that concentration into a resilience problem that firewalls do nothing about. The rules push operators toward physical hardening of buildings, power, and perimeter.
Sources: The Record · ↑ top
Business and Politics
Trump Envoys Carry Peace Proposal Into Kyiv
Latest developments: Steve Witkoff and Jared Kushner landed in Kyiv on Sunday, September 6, their first official visit to Ukraine, a day after Vladimir Putin received them at the Kremlin.
read more
The two envoys brought a U.S. peace proposal to Moscow on September 5, and Russia and Ukraine paused air strikes on each other's capitals for the duration of the trip; Ukrainian officials rate the odds of a breakthrough as low, and John Sawers, the former MI6 chief, told the FT Weekend Festival that substantive talks may not open until next year and that lasting peace stays out of reach while Putin holds office.
Sources: FT Home · FT World · FT World · ↑ top
OPEC and Allies Freeze October Output
Latest developments: OPEC and its allies agreed Sunday, September 6, to hold oil production steady in October, ending a run of six straight monthly increases.
read more
The cartel's pause lands with the six-month U.S.-Iran war still closing on the Strait of Hormuz, where U.S. Navy divers and robots have run night missions to clear mines and American forces struck three Iranian oil tankers on September 5; U.S. retail diesel set a record $5.85 a gallon on September 4, and any further supply loss now meets a group that has stopped adding barrels.
Sources: WSJ US Business · FT Home · FT World · ↑ top
Trump Approval Hits an All-Time Low
Latest developments: The Financial Times published a poll Sunday, September 6, putting President Trump's approval rating at the lowest of his presidency, with voters' anxiety about the economy dragging down him and his party weeks before the midterm elections.
read more
The FT reading follows the Franklin & Marshall College Poll that put Trump at 27% in Pennsylvania, and it arrives as the money moves: MAGA Inc and Elon Musk's America PAC are pouring millions into House and Senate races to hold Republican control of Congress, including a $10 million MAGA Inc ad buy for Texas Senate candidate Ken Paxton, the group's largest spend of the cycle.
Sources: FT Home · FT Home · WSJ Politics · ↑ top
Pittsburgh
Weather
Today: Sunny, high 80F.
Tonight: Mostly Clear, low 58F.
Labor Day: Sunny, high 81F.
Business
Allegheny County Pension Deficit
Latest developments: TribLive's editorial board argued Sunday, September 6, that Allegheny County can no longer defer its pension problem, three days after a judge told the county the same thing.
read more
A judge ruled Thursday, September 3, that state law obliges Allegheny County to keep its employee pension system actuarially sound, then declined to order specific steps to close a deficit of roughly $1.4 billion and gave the county time to fix it itself.
Grocery Bills Drive a Canning Revival
Latest developments: TribLive reported Sunday, September 6, that home canning is growing across Western Pennsylvania as families put up the late-summer harvest to hold down grocery costs.
read more
Canning season now runs through Western Pennsylvania kitchens, and the people doing it describe control over their own food supply as nonnegotiable, a household response to food prices that also shows up in the region's farm stands and hardware aisles.
Around Town
ICE Detention Goes Mobile in Pennsylvania
Latest developments: The Post-Gazette reported Sunday, September 6, how Immigration and Customs Enforcement vans could function as mobile detention centers in Pennsylvania.
read more
ICE is turning vehicles into holding space, a shift that would let the agency detain people in Pennsylvania without a fixed facility and that changes where and how long detention happens in the state.
Sources: Pittsburgh Post-Gazette · ↑ top
Hammill Challenges Steele in the 33rd
Latest developments: TribLive laid out Sunday, September 6, the matchup between Republican Mike Hammill and Democratic incumbent Mandy Steele for the state House seat in the 33rd Legislative District.
read more
Both candidates live in the Lower Valley, and the district they are running to represent stretches from Aspinwall along the Allegheny River to Harrison, one of the Allegheny County seats on the November ballot.
Events
Pittsburgh Soul Food Festival Downtown
Latest developments: WPXI reported Saturday evening, September 5, that the seventh annual Pittsburgh Soul Food Festival is running downtown through the Labor Day weekend after Thursday's storms threatened it.
read more
The Pittsburgh Soul Food Festival, in its seventh year, takes over downtown Pittsburgh across the Labor Day holiday weekend of September 5 through 7, 2026, with food vendors and music.
Sports
Pirates (70-73)
Sat Sep 5 · Angels 6 · Pirates 1 · Final
Up Next · Angels @ Pirates · Sun Sep 6, 1:35 PM
Steelers (0-0, T-1st in AFC North)
Up Next · Falcons @ Steelers · Sun Sep 13, 1:00 PM
Around the Teams
Left-Handers Keep Silencing the Pirates
Latest developments: The Post-Gazette wrote Saturday night, September 5, that the Pirates' season-long trouble with left-handed starting pitching surfaced again against the Los Angeles Angels at PNC Park.
read more
Angels left-hander Yusei Kikuchi held Pittsburgh to almost nothing while rookie right-hander Braxton Ashcraft started for the Pirates, and the lineup, Bryan Reynolds included, extended a pattern that has followed the club all year against left-handed starters.
Sources: Post-Gazette Pirates · ↑ top
Team USA
Cavan Sullivan Passes Freddy Adu
Latest developments: Cavan Sullivan, the 16-year-old Philadelphia Union midfielder, scored in a third straight Major League Soccer match, breaking a record Freddy Adu set, ESPN reported early Sunday, September 6.
read more
Sullivan, whom the Union signed as the youngest player in league history and who is bound for Manchester City, is now the youngest player to score in three consecutive MLS games, a mark Adu had held since his own teenage debut with D.C. United.
Sources: ESPN Soccer · ↑ top
Reading
- Ed Zitron — Premium: The Hater's Guide To Circular Financing (Part Two). Zitron traces the loops in AI financing—Nvidia funds OpenAI, which spends the money renting Nvidia GPUs back from Microsoft, Google, and Amazon—and argues the arrangements manufacture revenue that returns to its source.
- Stratechery — An Interview with OpenAI President Greg Brockman About Astra and Alignment. Ben Thompson interviews OpenAI co-founder and President Greg Brockman on the company's history, its Astra model, the mechanics of alignment, and what Brockman calls the weight of building the future.
- Cal Newport — Are We at War with AI Agent "Civilizations"?. Newport returns to July's OpenAI hacking attack after the company released more detail, and pushes back on the framing of autonomous agent swarms as rival civilizations at war with us.
Markets
S&P 500 7,690.10 = +0.0% Dow 53,223.02 ▼ -0.6% Nasdaq 26,355.91 ▲ +0.4% WTI crude 89.95 ▲ +8.0% EUR/USD 1.1610 ▼ -0.3% GBP/USD 1.3520 ▼ -0.6% USD/JPY 158.15 ▼ -0.8%
Feed Health
Security: 24 of 24 feeds loaded, 43 items in the 48-hour window. No recent items: Krebs on Security, CISA Advisories, Securelist (Kaspersky), Sophos News, Unit 42 (Palo Alto), Google Online Security Blog, Cisco Talos, Graham Cluley, Google Project Zero, The DFIR Report, Kim Zetter (Zero Day), Frank on Fraud.
Pittsburgh: 9 of 9 feeds loaded, 60 items in the 48-hour window. No recent items: NEXTpittsburgh.
Business and Politics: 8 of 8 feeds loaded, 56 items in the 36-hour window.
Events: 4 of 4 feeds loaded, 10 items in the 120-hour window. No recent items: NEXTpittsburgh Events, NEXTpittsburgh Arts & Entertainment.
Sports media: 6 of 6 feeds loaded, 30 items in the 96-hour window. No recent items: Footbahlin with Ben Roethlisberger, Ben Roethlisberger / Channel Seven (YouTube).
Team USA: 3 of 3 feeds loaded, 25 items in the 72-hour window. No recent items: Guardian Olympics.
Reading: 3 of 3 feeds loaded, 12 items in the 336-hour window.
Markets (Yahoo Finance): 7 of 7 rows
Weather (NWS): 3 forecast periods
Scores (ESPN, plaintextsports): 2 teams via plaintextsports; mlb: ESPN failed (mlb: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nfl: ESPN failed (nfl: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nhl: ESPN failed (nhl: HTTP 403 (server: AkamaiGHost)); used plaintextsports
Summaries: 3 model call(s) served by claude-opus-5 (290s of model time; $1.48 at API list price).