MikroTik has shipped a patch for the SSH authentication bypass attackers have exploited since at least September 2, 2026, and the SANS Internet Storm Center now tells router owners to assume compromise, because patched devices still carry the accounts attackers added.
Quiet day: only 17 security items in the last 48 hours.
Emerging Trends and Key Updates
- Trend Attackers who own MikroTik routers through unauthenticated SSH leave rogue accounts behind, much as REVSTEALER's four modules keep killing Defender and mining crypto after the stealer deletes itself.
- Trend Token's catalog of 39 passkey attacks leaves FIDO2 cryptography intact while abusing enrollment and recovery, and Broadcom patched CVE-2026-59346, an overflow a privileged guest user exploits.
- Update · new Steve Witkoff and Jared Kushner carried a peace proposal to Zelenskyy in Kyiv a day after Putin hosted them, and the AfD took first place in Saxony-Anhalt.
- Update · new Fetterman apologized for his text to Children's Hospital of Philadelphia, Allegheny County reopened its renovated McKeesport health office, and Panda Fest debuts at Station Square on September 18.
- Update · new The U.S. women edged Italy 55-52 in Berlin for a 32nd straight World Cup win, the U20 team lost in Lodz, and Reyna scored for Strasbourg.
- Update · new Paul Skenes threw 5 1/3 scoreless innings against the Angels at PNC Park for his first win since July 19, ending a seven-start drought.
Security
1. MikroTik Routers Fall to Unauthenticated SSH Attacks
Latest developments: MikroTik released a patch late last week for the SSH authentication bypass, and the SANS Internet Storm Center reported on September 6, 2026 that administrators should assume compromise, because attackers add new accounts to the devices to keep access after the patch goes on.
read more
MikroTik routers sit at the edge of small-business, hosting, and branch-office networks, so administrative control hands an attacker traffic interception and a pivot into everything behind the device. CERT Polska, which published the attack warning on September 5, 2026 and dated successful compromises to at least September 2, 2026, has released no victim count; install the patch, pull SSH off the public internet, limit management access to known addresses, and audit routers for added accounts, scripts, and scheduled tasks.
Sources: The Hacker News · SANS Internet Storm Center · ↑ top
2. REVSTEALER Modules Kill Defender and Mine Crypto
Latest developments: Elastic Security Labs documented four previously unreported programs that ride along with REVSTEALER, an emerging Windows information stealer, and stay on the machine after the stealer deletes itself, among them ProManager, WinUpdate, and SoftManager; one of the four disables Windows Update and Microsoft Defender before launching a cryptocurrency miner.
read more
REVSTEALER harvests credentials and then erases its own binary, which has masked the persistent modules that remain behind on Windows hosts. Treat a REVSTEALER hit as an ongoing compromise, check whether Windows Update and Defender have been turned off, and hunt for the named components.
Sources: The Hacker News · ↑ top
3. Researchers Catalog 39 Passkey Attacks
Latest developments: The authentication vendor Token published 39 documented methods for compromising passkey-based logins, all of which abuse authentication prompts, synced credentials, enrollment, and account recovery while leaving FIDO2 cryptography intact.
read more
Passkeys close off password phishing and credential stuffing, and the surrounding workflows still decide who gets in. Organizations deploying passwordless authentication should harden enrollment and recovery paths, restrict credential syncing across devices, and treat prompt approval as an attackable step.
Sources: BleepingComputer · ↑ top
4. Kremlin Hardens Data Centers Against Drones
Latest developments: The Kremlin has imposed new physical security requirements on Russian data center operators, whose facilities cluster in regions that Ukrainian drone strikes now reach.
read more
Russia concentrates its commercial and government computing in a handful of geographic areas, and drone range has turned that concentration into a resilience problem that firewalls do nothing about. The rules push operators toward physical hardening of buildings, power, and perimeter.
Sources: The Record · ↑ top
5. Critical VMware Workstation and Fusion Overflow
Latest developments: Broadcom assigned the critical desktop hypervisor bug CVE-2026-59346 at CVSS 9.3, an integer overflow that a local attacker holding elevated privileges inside a guest exploits to run arbitrary code, and shipped fixes for it alongside a second Workstation and Fusion flaw.
read more
VMware Workstation and Fusion run on developer, researcher, and analyst desktops, where malware analysts rely on the guest boundary to hold. Apply the Broadcom updates, and stop treating an off-the-shelf virtual machine as containment for hostile code.
Sources: The Hacker News · ↑ top
Business and Politics
AfD Wins Saxony-Anhalt
Latest developments: The Alternative for Germany took first place in Sunday's Saxony-Anhalt state election on September 6, the best result the party has ever recorded, and finished short of a parliamentary majority.
read more
Exit polls put the AfD near a 44% plurality in the eastern German state, leaving the mainstream parties to decide whether to let a hard-right party form a state government for the first time since World War II; the outcome weakens Chancellor Friedrich Merz and marks the crumbling of Germany's political center.
Sources: FT Home · WSJ World News · The Economist · ↑ top
Trump Envoys Carry Peace Proposal Into Kyiv
Latest developments: Steve Witkoff and Jared Kushner met Volodymyr Zelenskyy in Kyiv on Sunday, September 6, a day after Vladimir Putin received them at the Kremlin.
read more
The two envoys brought a U.S. peace proposal to Moscow on September 5, and Russia and Ukraine paused air strikes on each other's capitals for the duration of the trip; Ukrainian officials rate the odds of a breakthrough as low, and John Sawers, the former MI6 chief, told the FT Weekend Festival that substantive talks may not open until next year and that lasting peace stays out of reach while Putin holds office.
Sources: FT Home · FT World · FT World · ↑ top
OPEC and Allies Freeze October Output
Latest developments: OPEC and its allies agreed Sunday, September 6, to hold oil production steady in October, ending a run of six straight monthly increases.
read more
The cartel's pause lands with the six-month U.S.-Iran war still closing on the Strait of Hormuz, where U.S. Navy divers and robots have run night missions to clear mines and American forces struck three Iranian oil tankers on September 5; U.S. retail diesel set a record $5.85 a gallon on September 4, and any further supply loss now meets a group that has stopped adding barrels.
Sources: WSJ US Business · FT World · FT Markets · ↑ top
Trump Approval Hits an All-Time Low
Latest developments: The Financial Times published a poll Sunday, September 6, putting President Trump's approval rating at the lowest of his presidency, with voters' anxiety about the economy dragging down him and his party weeks before the midterm elections.
read more
The FT reading follows the Franklin & Marshall College Poll that put Trump at 27% in Pennsylvania, and it arrives as the money moves: MAGA Inc and Elon Musk's America PAC are pouring millions into House and Senate races to hold Republican control of Congress, including a $10 million MAGA Inc ad buy for Texas Senate candidate Ken Paxton, the group's largest spend of the cycle.
Sources: FT Home · FT Home · WSJ Politics · ↑ top
Pittsburgh
Weather
Tonight: Mostly Clear, low 58F.
Labor Day: Sunny, high 81F.
Monday Night: Mostly Clear, low 58F.
Business
Allegheny County Pension Deficit
Latest developments: TribLive's editorial board argued Sunday, September 6, that Allegheny County can no longer defer its pension problem, three days after a judge told the county the same thing.
read more
A judge ruled Thursday, September 3, that state law obliges Allegheny County to keep its employee pension system actuarially sound, then declined to order specific steps to close a deficit of roughly $1.4 billion and gave the county time to fix it itself.
Grocery Bills Drive a Canning Revival
Latest developments: TribLive reported Sunday, September 6, that home canning is growing across Western Pennsylvania as families put up the late-summer harvest to hold down grocery costs.
read more
Canning season now runs through Western Pennsylvania kitchens, and the people doing it describe control over their own food supply as nonnegotiable, a household response to food prices that also shows up in the region's farm stands and hardware aisles.
Around Town
Fetterman Apologizes for CHOP Text
Latest developments: U.S. Senator John Fetterman told CNN this weekend that a curt text message he sent rejecting Children's Hospital of Philadelphia leaders' concerns about Medicaid cuts was a "dumb joke," and he called the Wall Street Journal story that reported it "a hit piece," TribLive reported Sunday, September 6.
read more
Fetterman, the Braddock Democrat, has drawn fire from anonymous staff and Senate leaks over his positions, and the apology to the Philadelphia children's hospital lands as Medicaid cuts work their way through Pennsylvania health systems.
McKeesport Health Office Reopens Renovated
Latest developments: Allegheny County officials marked the completion of renovations Sunday, September 6, at the county Health Department office at 339 Fifth Avenue in McKeesport.
read more
The rebuilt office consolidates the department's services in the Mon Valley under one roof, giving McKeesport-area residents a single county public health location.
ICE Detention Goes Mobile in Pennsylvania
Latest developments: The Post-Gazette reported Sunday, September 6, how Immigration and Customs Enforcement vans could function as mobile detention centers in Pennsylvania.
read more
ICE is turning vehicles into holding space, a shift that would let the agency detain people in Pennsylvania without a fixed facility and that changes where and how long detention happens in the state.
Sources: Pittsburgh Post-Gazette · ↑ top
Hammill Challenges Steele in the 33rd
Latest developments: TribLive laid out Sunday, September 6, the matchup between Republican Mike Hammill and Democratic incumbent Mandy Steele for the state House seat in the 33rd Legislative District.
read more
Both candidates live in the Lower Valley, and the district they are running to represent stretches from Aspinwall along the Allegheny River to Harrison, one of the Allegheny County seats on the November ballot.
Events
Panda Fest Comes to Station Square
Latest developments: WPXI reported Sunday, September 6, that Panda Fest will make its Pittsburgh debut September 18 through September 20.
read more
Panda Fest, an Asian street food festival, runs Friday, September 18, through Sunday, September 20, 2026, in the Station Square parking lot on Pittsburgh's South Shore.
Pittsburgh Soul Food Festival Downtown
Latest developments: WPXI reported Saturday evening, September 5, that the seventh annual Pittsburgh Soul Food Festival is running downtown through the Labor Day weekend after Thursday's storms threatened it.
read more
The Pittsburgh Soul Food Festival, in its seventh year, takes over downtown Pittsburgh across the Labor Day holiday weekend of September 5 through 7, 2026, with food vendors and music.
Sports
Pirates (71-73)
Sat Sep 5 · Angels 6 · Pirates 1 · Final
Sun Sep 6 · Angels 0 · Pirates 1 · Final
Up Next · Pirates @ White Sox · Tue Sep 8, 7:40 PM
Steelers (0-0, T-1st in AFC North)
Up Next · Falcons @ Steelers · Sun Sep 13, 1:00 PM
Around the Teams
Skenes Ends a Seven-Start Winless Run
Latest developments: The Post-Gazette reported Sunday, September 6, that Paul Skenes collected his first win since July 19, throwing 5 1/3 scoreless innings against the Los Angeles Angels at PNC Park and ending a seven-start stretch without one.
read more
Skenes, the Pirates' ace, had gone more than six weeks without a decision in his favor despite the run prevention behind him; catcher Henry Davis supplied the offense with a solo home run, and the club heads to the Chicago White Sox on Tuesday to open a six-game road trip.
Sources: Post-Gazette Pirates · ↑ top
Left-Handers Keep Silencing the Pirates
Latest developments: The Post-Gazette wrote Saturday night, September 5, that the Pirates' season-long trouble with left-handed starting pitching surfaced again against the Los Angeles Angels at PNC Park.
read more
Angels left-hander Yusei Kikuchi held Pittsburgh to almost nothing while rookie right-hander Braxton Ashcraft started for the Pirates, and the lineup, Bryan Reynolds included, extended a pattern that has followed the club all year against left-handed starters.
Sources: Post-Gazette Pirates · ↑ top
Team USA
U.S. Women Survive Italy in Berlin
Latest developments: The United States beat Italy 55-52 on Sunday, September 6, in Berlin, its closest FIBA Women's World Cup game in two decades, pushing the American winning streak in World Cup play to 32 games.
read more
Kara Lawson's team, playing without A'ja Wilson and Kelsey Plum, followed its 33-point opening win over China with a three-point escape against Italy, a result that keeps intact a streak stretching back more than 20 years.
Sources: ESPN Olympics · ↑ top
Italy Beats the U.S. U20 Women
Latest developments: The United States lost its opening match at the U20 Women's World Cup on Sunday, September 6, falling 2-1 to Italy in Lodz, Poland.
read more
The defeat leaves the young Americans in an early hole in a difficult group at the tournament in Poland, with the rest of their group stage ahead.
Sources: ESPN Soccer · ↑ top
Reyna Scores His First for Strasbourg
Latest developments: Giovanni Reyna scored his first goal since joining Strasbourg on Sunday, September 6, as the club beat Troyes 6-2 in Ligue 1.
read more
Reyna, the U.S. men's national team midfielder, moved to Strasbourg in the summer window after his time at Borussia Dortmund ran down, a transfer ESPN framed as a last chance to revive his career.
Sources: ESPN Soccer · ↑ top
Cavan Sullivan Passes Freddy Adu
Latest developments: Cavan Sullivan, the 16-year-old Philadelphia Union midfielder, scored in a third straight Major League Soccer match, breaking a record Freddy Adu set, ESPN reported early Sunday, September 6.
read more
Sullivan, whom the Union signed as the youngest player in league history and who is bound for Manchester City, is now the youngest player to score in three consecutive MLS games, a mark Adu had held since his own teenage debut with D.C. United.
Sources: ESPN Soccer · ↑ top
Reading
- Ed Zitron — Premium: The Hater's Guide To Circular Financing (Part Two). Zitron traces the loops in AI financing—Nvidia funds OpenAI, which spends the money renting Nvidia GPUs back from Microsoft, Google, and Amazon—and argues the arrangements manufacture revenue that returns to its source.
- Stratechery — An Interview with OpenAI President Greg Brockman About Astra and Alignment. Ben Thompson interviews OpenAI co-founder and President Greg Brockman on the company's history, its Astra model, the mechanics of alignment, and what Brockman calls the weight of building the future.
- Cal Newport — Are We at War with AI Agent "Civilizations"?. Newport returns to July's OpenAI hacking attack after the company released more detail, and pushes back on the framing of autonomous agent swarms as rival civilizations at war with us.
Markets
S&P 500 7,690.10 = +0.0% Dow 53,223.02 ▼ -0.6% Nasdaq 26,355.91 ▲ +0.4% WTI crude 89.95 ▲ +8.0% EUR/USD 1.1603 ▼ -0.5% GBP/USD 1.3524 ▼ -0.8% USD/JPY 158.93 ▼ -0.2%
Feed Health
Security: 24 of 24 feeds loaded, 17 items in the 48-hour window. No recent items: Krebs on Security, Schneier on Security, Dark Reading, CISA Advisories, The Record, Ars Technica Security, Securelist (Kaspersky), Sophos News, Unit 42 (Palo Alto), Google Online Security Blog, Cisco Talos, Graham Cluley, Microsoft Security Blog, Google Project Zero, The DFIR Report, Kim Zetter (Zero Day), Frank on Fraud.
Pittsburgh: 9 of 9 feeds loaded, 60 items in the 48-hour window. No recent items: PublicSource, Pittsburgh City Paper, NEXTpittsburgh, Pittsburgh Magazine.
Business and Politics: 8 of 8 feeds loaded, 58 items in the 36-hour window.
Events: 4 of 4 feeds loaded, 8 items in the 120-hour window. No recent items: NEXTpittsburgh Events, NEXTpittsburgh Arts & Entertainment.
Sports media: 6 of 6 feeds loaded, 26 items in the 96-hour window. No recent items: Footbahlin with Ben Roethlisberger, Ben Roethlisberger / Channel Seven (YouTube).
Team USA: 3 of 3 feeds loaded, 23 items in the 72-hour window. No recent items: Guardian Olympics.
Reading: 3 of 3 feeds loaded, 12 items in the 336-hour window.
Markets (Yahoo Finance): 7 of 7 rows
Weather (NWS): 3 forecast periods
Scores (ESPN, plaintextsports): 2 teams via plaintextsports; mlb: ESPN failed (mlb: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nfl: ESPN failed (nfl: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nhl: ESPN failed (nhl: HTTP 403 (server: AkamaiGHost)); used plaintextsports
Summaries: 3 model call(s) served by claude-opus-5 (200s of model time; $1.35 at API list price).