================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Sunday, September 6, 2026 - 7:34 PM EDT ================================================================ MikroTik has shipped a patch for the SSH authentication bypass attackers have exploited since at least September 2, 2026, and the SANS Internet Storm Center now tells router owners to assume compromise, because patched devices still carry the accounts attackers added. Quiet day: only 17 security items in the last 48 hours. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets | Feed Health EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Attackers who own MikroTik routers through unauthenticated SSH leave rogue accounts behind, much as REVSTEALER's four modules keep killing Defender and mining crypto after the stealer deletes itself. see: MikroTik Routers Fall to Unauthenticated SSH Attacks; REVSTEALER Modules Kill Defender and Mine Crypto * [TREND] Token's catalog of 39 passkey attacks leaves FIDO2 cryptography intact while abusing enrollment and recovery, and Broadcom patched CVE-2026-59346, an overflow a privileged guest user exploits. see: Researchers Catalog 39 Passkey Attacks; Critical VMware Workstation and Fusion Overflow * [UPDATE (new)] Steve Witkoff and Jared Kushner carried a peace proposal to Zelenskyy in Kyiv a day after Putin hosted them, and the AfD took first place in Saxony-Anhalt. see: Trump Envoys Carry Peace Proposal Into Kyiv; AfD Wins Saxony-Anhalt * [UPDATE (new)] Fetterman apologized for his text to Children's Hospital of Philadelphia, Allegheny County reopened its renovated McKeesport health office, and Panda Fest debuts at Station Square on September 18. see: Fetterman Apologizes for CHOP Text; McKeesport Health Office Reopens Renovated; Panda Fest Comes to Station Square * [UPDATE (new)] The U.S. women edged Italy 55-52 in Berlin for a 32nd straight World Cup win, the U20 team lost in Lodz, and Reyna scored for Strasbourg. see: U.S. Women Survive Italy in Berlin; Italy Beats the U.S. U20 Women; Reyna Scores His First for Strasbourg * [UPDATE (new)] Paul Skenes threw 5 1/3 scoreless innings against the Angels at PNC Park for his first win since July 19, ending a seven-start drought. see: Skenes Ends a Seven-Start Winless Run SECURITY ---------------------------------------------------------------- 1. MIKROTIK ROUTERS FALL TO UNAUTHENTICATED SSH ATTACKS Vulnerabilities and Exploits · [exploit, network, zero-day] Latest developments: MikroTik released a patch late last week for the SSH authentication bypass, and the SANS Internet Storm Center reported on September 6, 2026 that administrators should assume compromise, because attackers add new accounts to the devices to keep access after the patch goes on. MikroTik routers sit at the edge of small-business, hosting, and branch-office networks, so administrative control hands an attacker traffic interception and a pivot into everything behind the device. CERT Polska, which published the attack warning on September 5, 2026 and dated successful compromises to at least September 2, 2026, has released no victim count; install the patch, pull SSH off the public internet, limit management access to known addresses, and audit routers for added accounts, scripts, and scheduled tasks. - The Hacker News: https://thehackernews.com/2026/09/attackers-hijack-mikrotik-routers.html - SANS Internet Storm Center: https://isc.sans.edu/diary/rss/33314 2. REVSTEALER MODULES KILL DEFENDER AND MINE CRYPTO Ransomware and Cybercrime · [malware, cryptomining] Latest developments: Elastic Security Labs documented four previously unreported programs that ride along with REVSTEALER, an emerging Windows information stealer, and stay on the machine after the stealer deletes itself, among them ProManager, WinUpdate, and SoftManager; one of the four disables Windows Update and Microsoft Defender before launching a cryptocurrency miner. REVSTEALER harvests credentials and then erases its own binary, which has masked the persistent modules that remain behind on Windows hosts. Treat a REVSTEALER hit as an ongoing compromise, check whether Windows Update and Defender have been turned off, and hunt for the named components. - The Hacker News: https://thehackernews.com/2026/09/four-revstealer-linked-modules-disable.html 3. RESEARCHERS CATALOG 39 PASSKEY ATTACKS Identity and Access Management · [authentication, research] Latest developments: The authentication vendor Token published 39 documented methods for compromising passkey-based logins, all of which abuse authentication prompts, synced credentials, enrollment, and account recovery while leaving FIDO2 cryptography intact. Passkeys close off password phishing and credential stuffing, and the surrounding workflows still decide who gets in. Organizations deploying passwordless authentication should harden enrollment and recovery paths, restrict credential syncing across devices, and treat prompt approval as an attackable step. - BleepingComputer: https://www.bleepingcomputer.com/news/security/39-new-methods-that-compromise-passkey-authentication/ 4. KREMLIN HARDENS DATA CENTERS AGAINST DRONES Nation-State Activity · [policy, critical infrastructure] Latest developments: The Kremlin has imposed new physical security requirements on Russian data center operators, whose facilities cluster in regions that Ukrainian drone strikes now reach. Russia concentrates its commercial and government computing in a handful of geographic areas, and drone range has turned that concentration into a resilience problem that firewalls do nothing about. The rules push operators toward physical hardening of buildings, power, and perimeter. - The Record: https://therecord.media/russia-data-centers-ukraine-drone-threats 5. CRITICAL VMWARE WORKSTATION AND FUSION OVERFLOW Vulnerabilities and Exploits · [patch, virtualization] Latest developments: Broadcom assigned the critical desktop hypervisor bug CVE-2026-59346 at CVSS 9.3, an integer overflow that a local attacker holding elevated privileges inside a guest exploits to run arbitrary code, and shipped fixes for it alongside a second Workstation and Fusion flaw. VMware Workstation and Fusion run on developer, researcher, and analyst desktops, where malware analysts rely on the guest boundary to hold. Apply the Broadcom updates, and stop treating an off-the-shelf virtual machine as containment for hostile code. - The Hacker News: https://thehackernews.com/2026/09/critical-vmware-workstation-and-fusion.html BUSINESS AND POLITICS ---------------------------------------------------------------- * AfD Wins Saxony-Anhalt Latest developments: The Alternative for Germany took first place in Sunday's Saxony-Anhalt state election on September 6, the best result the party has ever recorded, and finished short of a parliamentary majority. Exit polls put the AfD near a 44% plurality in the eastern German state, leaving the mainstream parties to decide whether to let a hard-right party form a state government for the first time since World War II; the outcome weakens Chancellor Friedrich Merz and marks the crumbling of Germany's political center. - FT Home: https://www.ft.com/content/a0229455-1822-4de8-ad2f-7453577d95cd?syn-25a6b1a6=1 - WSJ World News: https://www.wsj.com/world/europe/germanys-right-wing-populists-on-course-for-historic-victory-56662408?mod=rss_worldnews - The Economist: https://www.economist.com/europe/2026/09/06/the-alternative-for-germany-has-won-its-best-ever-election-result * Trump Envoys Carry Peace Proposal Into Kyiv Latest developments: Steve Witkoff and Jared Kushner met Volodymyr Zelenskyy in Kyiv on Sunday, September 6, a day after Vladimir Putin received them at the Kremlin. The two envoys brought a U.S. peace proposal to Moscow on September 5, and Russia and Ukraine paused air strikes on each other's capitals for the duration of the trip; Ukrainian officials rate the odds of a breakthrough as low, and John Sawers, the former MI6 chief, told the FT Weekend Festival that substantive talks may not open until next year and that lasting peace stays out of reach while Putin holds office. - FT Home: https://www.ft.com/content/1e2d9db0-cb2c-4c79-942b-f0aff960e4c5 - FT World: https://www.ft.com/content/9ae2c655-bcf7-4ef2-9a9b-0855248d06a0?syn-25a6b1a6=1 - FT World: https://www.ft.com/content/4826a106-9cd4-45bc-8436-69e2519d0205 * OPEC and Allies Freeze October Output Latest developments: OPEC and its allies agreed Sunday, September 6, to hold oil production steady in October, ending a run of six straight monthly increases. The cartel's pause lands with the six-month U.S.-Iran war still closing on the Strait of Hormuz, where U.S. Navy divers and robots have run night missions to clear mines and American forces struck three Iranian oil tankers on September 5; U.S. retail diesel set a record $5.85 a gallon on September 4, and any further supply loss now meets a group that has stopped adding barrels. - WSJ US Business: https://www.wsj.com/business/energy-oil/opec-allies-agree-to-keep-oil-output-steady-in-october-c7fceb83?mod=pls_whats_news_us_business_f - FT World: https://www.ft.com/content/04031dbe-7412-441e-8aaa-89a9ee6c7439?syn-25a6b1a6=1 - FT Markets: https://www.ft.com/content/7c7c07db-cde5-474d-9a20-8e2c2f273d4e?syn-25a6b1a6=1 * Trump Approval Hits an All-Time Low Latest developments: The Financial Times published a poll Sunday, September 6, putting President Trump's approval rating at the lowest of his presidency, with voters' anxiety about the economy dragging down him and his party weeks before the midterm elections. The FT reading follows the Franklin & Marshall College Poll that put Trump at 27% in Pennsylvania, and it arrives as the money moves: MAGA Inc and Elon Musk's America PAC are pouring millions into House and Senate races to hold Republican control of Congress, including a $10 million MAGA Inc ad buy for Texas Senate candidate Ken Paxton, the group's largest spend of the cycle. - FT Home: https://www.ft.com/content/9bcce1fa-997e-49f2-9530-f1255e4cb28b?syn-25a6b1a6=1 - FT Home: https://www.ft.com/content/d8fa06e5-5929-47c9-815c-47d2221fc9e9?syn-25a6b1a6=1 - WSJ Politics: https://www.wsj.com/politics/elections/trump-aligned-group-pouring-money-into-texas-for-ken-paxton-00778eec?mod=rss_socialpoliticsfeed PITTSBURGH ---------------------------------------------------------------- Weather: Tonight: Mostly Clear, low 58F. Labor Day: Sunny, high 81F. Monday Night: Mostly Clear, low 58F. Business: * Allegheny County Pension Deficit Latest developments: TribLive's editorial board argued Sunday, September 6, that Allegheny County can no longer defer its pension problem, three days after a judge told the county the same thing. A judge ruled Thursday, September 3, that state law obliges Allegheny County to keep its employee pension system actuarially sound, then declined to order specific steps to close a deficit of roughly $1.4 billion and gave the county time to fix it itself. - TribLive: https://triblive.com/opinion/editorial-allegheny-county-cannot-keep-putting-off-pension-problem/ * Grocery Bills Drive a Canning Revival Latest developments: TribLive reported Sunday, September 6, that home canning is growing across Western Pennsylvania as families put up the late-summer harvest to hold down grocery costs. Canning season now runs through Western Pennsylvania kitchens, and the people doing it describe control over their own food supply as nonnegotiable, a household response to food prices that also shows up in the region's farm stands and hardware aisles. - TribLive: https://triblive.com/local/regional/home-canning-grows-in-popularity-as-western-pa-families-preserve-food-cut-grocery-costs/ Around town: * Fetterman Apologizes for CHOP Text Latest developments: U.S. Senator John Fetterman told CNN this weekend that a curt text message he sent rejecting Children's Hospital of Philadelphia leaders' concerns about Medicaid cuts was a "dumb joke," and he called the Wall Street Journal story that reported it "a hit piece," TribLive reported Sunday, September 6. Fetterman, the Braddock Democrat, has drawn fire from anonymous staff and Senate leaks over his positions, and the apology to the Philadelphia children's hospital lands as Medicaid cuts work their way through Pennsylvania health systems. - TribLive: https://triblive.com/news/pennsylvania/report-john-fetterman-called-wall-street-journal-story-a-hit-piece-and-apologized-for-text-message-dismissing-chop-leaders/ * McKeesport Health Office Reopens Renovated Latest developments: Allegheny County officials marked the completion of renovations Sunday, September 6, at the county Health Department office at 339 Fifth Avenue in McKeesport. The rebuilt office consolidates the department's services in the Mon Valley under one roof, giving McKeesport-area residents a single county public health location. - WPXI: https://www.wpxi.com/news/local/renovated-mckeesport-public-health-office-consolidate-various-services/ADUGU2ZFEVHAVB4NDKWRRHWOZA/ * ICE Detention Goes Mobile in Pennsylvania Latest developments: The Post-Gazette reported Sunday, September 6, how Immigration and Customs Enforcement vans could function as mobile detention centers in Pennsylvania. ICE is turning vehicles into holding space, a shift that would let the agency detain people in Pennsylvania without a fixed facility and that changes where and how long detention happens in the state. - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/politics-state/2026/09/06/ice-mobile-detention-vans-pennsylvania/stories/202609060053 * Hammill Challenges Steele in the 33rd Latest developments: TribLive laid out Sunday, September 6, the matchup between Republican Mike Hammill and Democratic incumbent Mandy Steele for the state House seat in the 33rd Legislative District. Both candidates live in the Lower Valley, and the district they are running to represent stretches from Aspinwall along the Allegheny River to Harrison, one of the Allegheny County seats on the November ballot. - TribLive: https://triblive.com/local/valley-news-dispatch/republican-mike-hammill-challenges-democrat-mandy-steele-for-state-33rd-district-house-seat/ Events: * Panda Fest Comes to Station Square Latest developments: WPXI reported Sunday, September 6, that Panda Fest will make its Pittsburgh debut September 18 through September 20. Panda Fest, an Asian street food festival, runs Friday, September 18, through Sunday, September 20, 2026, in the Station Square parking lot on Pittsburgh's South Shore. - WPXI: https://www.wpxi.com/news/local/panda-fest-bring-asian-street-food-experience-station-square-pittsburgh/6KTV6DACANGBXNMUS646EQA7HE/ * Pittsburgh Soul Food Festival Downtown Latest developments: WPXI reported Saturday evening, September 5, that the seventh annual Pittsburgh Soul Food Festival is running downtown through the Labor Day weekend after Thursday's storms threatened it. The Pittsburgh Soul Food Festival, in its seventh year, takes over downtown Pittsburgh across the Labor Day holiday weekend of September 5 through 7, 2026, with food vendors and music. - WPXI: https://www.wpxi.com/news/local/pittsburgh-soul-food-festival-continues-over-labor-day-weekend/6GVYTHXOENBTZETDG7S2PGVUGE/ SPORTS ---------------------------------------------------------------- Pirates (71-73) Sat Sep 5 · Angels 6 · Pirates 1 · Final https://plaintextsports.com/mlb/2026-09-05/laa-pit Sun Sep 6 · Angels 0 · Pirates 1 · Final https://plaintextsports.com/mlb/2026-09-06/laa-pit Up Next · Pirates @ White Sox · Tue Sep 8, 7:40 PM https://plaintextsports.com/mlb/2026/teams/pittsburgh-pirates Steelers (0-0, T-1st in AFC North) Up Next · Falcons @ Steelers · Sun Sep 13, 1:00 PM https://plaintextsports.com/nfl/2026/week1/atl-pit Around the Teams: * Skenes Ends a Seven-Start Winless Run Latest developments: The Post-Gazette reported Sunday, September 6, that Paul Skenes collected his first win since July 19, throwing 5 1/3 scoreless innings against the Los Angeles Angels at PNC Park and ending a seven-start stretch without one. Skenes, the Pirates' ace, had gone more than six weeks without a decision in his favor despite the run prevention behind him; catcher Henry Davis supplied the offense with a solo home run, and the club heads to the Chicago White Sox on Tuesday to open a six-game road trip. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/09/06/pirates-henry-davis-paul-skenes-angels-mlb-score/stories/202609060066 * Left-Handers Keep Silencing the Pirates Latest developments: The Post-Gazette wrote Saturday night, September 5, that the Pirates' season-long trouble with left-handed starting pitching surfaced again against the Los Angeles Angels at PNC Park. Angels left-hander Yusei Kikuchi held Pittsburgh to almost nothing while rookie right-hander Braxton Ashcraft started for the Pirates, and the lineup, Bryan Reynolds included, extended a pattern that has followed the club all year against left-handed starters. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/09/05/pirates-angels-mlb-braxton-ashcraft-bryan-reynolds/stories/202609050031 Team USA: * U.S. Women Survive Italy in Berlin Latest developments: The United States beat Italy 55-52 on Sunday, September 6, in Berlin, its closest FIBA Women's World Cup game in two decades, pushing the American winning streak in World Cup play to 32 games. Kara Lawson's team, playing without A'ja Wilson and Kelsey Plum, followed its 33-point opening win over China with a three-point escape against Italy, a result that keeps intact a streak stretching back more than 20 years. - ESPN Olympics: https://www.espn.com/olympics/story/_/id/49852465/team-usa-escapes-win-italy-women-world-cup * Italy Beats the U.S. U20 Women Latest developments: The United States lost its opening match at the U20 Women's World Cup on Sunday, September 6, falling 2-1 to Italy in Lodz, Poland. The defeat leaves the young Americans in an early hole in a difficult group at the tournament in Poland, with the rest of their group stage ahead. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49851299/italy-stuns-united-states-u20-women-world-cup-opener * Reyna Scores His First for Strasbourg Latest developments: Giovanni Reyna scored his first goal since joining Strasbourg on Sunday, September 6, as the club beat Troyes 6-2 in Ligue 1. Reyna, the U.S. men's national team midfielder, moved to Strasbourg in the summer window after his time at Borussia Dortmund ran down, a transfer ESPN framed as a last chance to revive his career. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49853186/giovanni-reyna-scores-first-goal-move-strasbourg * Cavan Sullivan Passes Freddy Adu Latest developments: Cavan Sullivan, the 16-year-old Philadelphia Union midfielder, scored in a third straight Major League Soccer match, breaking a record Freddy Adu set, ESPN reported early Sunday, September 6. Sullivan, whom the Union signed as the youngest player in league history and who is bound for Manchester City, is now the youngest player to score in three consecutive MLS games, a mark Adu had held since his own teenage debut with D.C. United. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49842819/cavan-sullivan-freddy-adu-mls-record-philadelphia-union READING ---------------------------------------------------------------- * Ed Zitron -- Premium: The Hater's Guide To Circular Financing (Part Two) Zitron traces the loops in AI financing—Nvidia funds OpenAI, which spends the money renting Nvidia GPUs back from Microsoft, Google, and Amazon—and argues the arrangements manufacture revenue that returns to its source. https://www.wheresyoured.at/premium-the-haters-guide-to-circular-financing-part-two/ * Stratechery -- An Interview with OpenAI President Greg Brockman About Astra and Alignment Ben Thompson interviews OpenAI co-founder and President Greg Brockman on the company's history, its Astra model, the mechanics of alignment, and what Brockman calls the weight of building the future. https://stratechery.com/2026/an-interview-with-openai-president-greg-brockman-about-astra-and-alignment/ * Cal Newport -- Are We at War with AI Agent "Civilizations"? Newport returns to July's OpenAI hacking attack after the company released more detail, and pushes back on the framing of autonomous agent swarms as rival civilizations at war with us. https://calnewport.com/are-we-at-war-with-ai-agent-civilizations/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,690.10 = +0.0% Dow 53,223.02 ▼ -0.6% Nasdaq 26,355.91 ▲ +0.4% WTI crude 89.95 ▲ +8.0% EUR/USD 1.1603 ▼ -0.5% GBP/USD 1.3524 ▼ -0.8% USD/JPY 158.93 ▼ -0.2% FEED HEALTH ---------------------------------------------------------------- Security: 24 of 24 feeds loaded, 17 items in the 48-hour window. No recent items: Krebs on Security, Schneier on Security, Dark Reading, CISA Advisories, The Record, Ars Technica Security, Securelist (Kaspersky), Sophos News, Unit 42 (Palo Alto), Google Online Security Blog, Cisco Talos, Graham Cluley, Microsoft Security Blog, Google Project Zero, The DFIR Report, Kim Zetter (Zero Day), Frank on Fraud. Pittsburgh: 9 of 9 feeds loaded, 60 items in the 48-hour window. No recent items: PublicSource, Pittsburgh City Paper, NEXTpittsburgh, Pittsburgh Magazine. Business and Politics: 8 of 8 feeds loaded, 58 items in the 36-hour window. Events: 4 of 4 feeds loaded, 8 items in the 120-hour window. No recent items: NEXTpittsburgh Events, NEXTpittsburgh Arts & Entertainment. Sports media: 6 of 6 feeds loaded, 26 items in the 96-hour window. No recent items: Footbahlin with Ben Roethlisberger, Ben Roethlisberger / Channel Seven (YouTube). Team USA: 3 of 3 feeds loaded, 23 items in the 72-hour window. No recent items: Guardian Olympics. Reading: 3 of 3 feeds loaded, 12 items in the 336-hour window. Markets (Yahoo Finance): 7 of 7 rows Weather (NWS): 3 forecast periods Scores (ESPN, plaintextsports): 2 teams via plaintextsports; mlb: ESPN failed (mlb: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nfl: ESPN failed (nfl: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nhl: ESPN failed (nhl: HTTP 403 (server: AkamaiGHost)); used plaintextsports Summaries: 3 model call(s) served by claude-opus-5 (200s of model time; $1.35 at API list price). ================================================================ Generated 2026-09-06 19:34 EDT. Updated weekdays at about 7:05 AM, 10:05 AM, 1:35 PM, and 7:35 PM ET, and weekends at about 8:05 AM and 7:35 PM ET. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 3 Team USA feeds; WSJ World News, WSJ Markets, WSJ US Business, WSJ Politics, The Economist, FT Home, FT World, FT Markets; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN or plaintextsports.com. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================