================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Monday, September 7, 2026 - 7:05 AM EDT ================================================================ Attackers turned on the remote management software that managed service providers run, forcing N-able to ship a fourth emergency N-central hotfix in five weeks while ConnectWise left a ScreenConnect file-transfer flaw unpatched. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets | Feed Health EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] N-able's fourth N-central hotfix in five weeks landed days after ConnectWise's unpatched ScreenConnect file-transfer bug, exposing the two remote-management platforms MSPs use to reach thousands of customer networks. see: N-able Ships Fourth N-central Hotfix in Five Weeks; ScreenConnect File Transfers Carry Malware * [UPDATE (updated)] Attackers now chain two RouterOS flaws to hijack internet-exposed MikroTik routers and create their own accounts, so administrators who install the patch and stop there keep the intruder. see: MikroTik RouterOS Flaws Chained to Hijack Routers * [TREND] Credential theft is moving past passwords as JSCeal replays stolen session cookies into Google accounts and a Lenovo ID flaw opened roughly 5,000 linked Dropbox accounts. see: JSCeal Steals Session Cookies to Walk Past Google Logins; Lenovo ID Hole Opened 5,000 Dropbox Accounts * [TREND] OpenAI put Astra and an automated research intern in front of $20 subscribers, while Greg Brockman defends alignment and Zitron dissects the circular financing propping up the boom. see: Astra Reaches $20 Subscribers as OpenAI Automates Research; An Interview with OpenAI President Greg Brockman About Astra and Alignment; Premium: The Hater's Guide To Circular Financing (Part Two) * [UPDATE (new)] Fresh U.S. and Iran strikes pushed Brent above $97, gasoline hit an all-time Labor Day record, and Beijing widened a $54 billion recapitalization of state banks and insurers. see: Brent Tops $97 as the U.S. and Iran Trade Strikes; Gasoline Sets a Labor Day Record; Beijing Recapitalizes Banks and Insurers * [UPDATE (new)] Pennsylvania's license plate readers increasingly feed AI systems, even as Deutschtown's East Ohio Street draws new investment and Blawnox moves ahead with beautifying its business district. see: Street Cameras Start Talking to AI; East Ohio Street Booms in Deutschtown; Blawnox Dresses Up Freeport Road SECURITY ---------------------------------------------------------------- 1. ASTRA REACHES $20 SUBSCRIBERS AS OPENAI AUTOMATES RESEARCH AI Security · [ai, offensive security, privacy] Latest developments: OpenAI began rolling ChatGPT Astra out to $20-a-month Plus subscribers with no date announced for free users, and separately said it hit the goal it set last fall of fielding an automated research intern by September 2026, a system that completes well-defined research tasks under human direction that would occupy a skilled researcher for several days. Astra is the first model OpenAI rates as crossing the critical cyber threshold under its Preparedness Framework; the company scored it at 100 percent on ExploitBench and made it refuse user requests for proof-of-concept exploits. OpenAI aims for a fully automated AI researcher by March 2028, and is testing a Writing Style feature that reads examples from a user's connected personal apps to imitate how they write. - BleepingComputer: https://www.bleepingcomputer.com/news/artificial-intelligence/chatgpt-astra-is-now-rolling-out-to-20-plus-subscription/ - Help Net Security: https://www.helpnetsecurity.com/2026/09/07/openai-research-automation-intern/ - BleepingComputer: https://www.bleepingcomputer.com/news/artificial-intelligence/chatgpt-can-now-connect-to-your-personal-apps-to-mimic-writing-style/ 2. N-ABLE SHIPS FOURTH N-CENTRAL HOTFIX IN FIVE WEEKS Vulnerabilities and Exploits · [patch, zero-day, supply chain] Latest developments: N-able released an emergency Hotfix 4 for a maximum-severity unauthenticated remote code execution flaw in N-central, its fourth hotfix for the platform in five weeks, and told every on-premises operator running a build below 2026.3.1.14 to install it, including anyone who applied Hotfix 3 a day earlier. N-central is the remote monitoring and management platform managed service providers use to administer customer machines, so one compromised server exposes every network beneath it. N-able's incident notice says attackers have exploited the flaw in the wild while its release notes call that unconfirmed; operators should patch immediately and hunt for intrusion. - The Hacker News: https://thehackernews.com/2026/09/n-able-issues-fourth-n-central-hotfix.html - BleepingComputer: https://www.bleepingcomputer.com/news/security/n-able-patches-max-severity-n-central-flaw-amid-ongoing-attacks/ 3. SCREENCONNECT FILE TRANSFERS CARRY MALWARE Vulnerabilities and Exploits · [vulnerability, malware, patch] Latest developments: ConnectWise published temporary mitigations for a file transfer flaw in ScreenConnect Remote Access Support and Access sessions that attackers already use to spread malware, confirmed the bug affects both its cloud service and on-premises installations, and promised a CVE identifier and a fix within the week. ScreenConnect is the remote support and access tool that corporate IT departments and managed service providers use to take over user desktops, and the flaw abuses the file transfer built into live sessions. ConnectWise dated its advisory September 3, 2026; administrators should apply the interim mitigations now and update as soon as the patch ships. - BleepingComputer: https://www.bleepingcomputer.com/news/security/connectwise-warns-of-new-screenconnect-flaw-without-patch/ - Help Net Security: https://www.helpnetsecurity.com/2026/09/07/connectwise-screenconnect-file-transfer-flaw/ 4. MIKROTIK ROUTEROS FLAWS CHAINED TO HIJACK ROUTERS Vulnerabilities and Exploits · [exploitation, patch, network devices] Latest developments: BleepingComputer reported that attackers now chain two recently disclosed RouterOS vulnerabilities, rather than firing the SSH authentication bypass alone, to seize full control of MikroTik routers whose SSH service faces the internet. MikroTik patched the SSH authentication bypass late last week after exploitation had already started, and the SANS Internet Storm Center told administrators to assume compromise because attackers add new accounts to the devices to survive the update. Anyone running RouterOS with SSH exposed should patch, audit the user list, and rotate credentials. - BleepingComputer: https://www.bleepingcomputer.com/news/security/hackers-exploit-new-mikrotik-routeros-flaws-to-hijack-routers/ - SANS Internet Storm Center: https://isc.sans.edu/diary/rss/33314 5. JSCEAL STEALS SESSION COOKIES TO WALK PAST GOOGLE LOGINS Ransomware and Cybercrime · [malware, credential theft] Latest developments: Check Point Research published a teardown of JSCeal, malware compiled to V8 JavaScript bytecode that harvests credentials, watches the user, intercepts traffic, and replays stolen session cookies to enter Google accounts without triggering authentication. JSCeal's operators wrap the payloads in javascript-obfuscator, protecting strings with RC4 and flattening control flow through proxy functions and operation wrappers to frustrate analysis. Defenders should treat stolen browser session cookies as a credential and shorten session lifetimes on Google accounts. - The Hacker News: https://thehackernews.com/2026/09/jsceal-malware-can-bypass-google.html 6. LENOVO ID HOLE OPENED 5,000 DROPBOX ACCOUNTS Identity and Access Management · [breach, authentication] Latest developments: Graham Cluley, writing on Bitdefender's Hot for Security blog, detailed a flaw in Lenovo's login system that let hackers into roughly 5,000 Dropbox accounts that owners had linked to a Lenovo ID. Lenovo laptop owners who connected Dropbox to their Lenovo ID for single-sign-on convenience inherited the weakness in Lenovo's authentication. Anyone who made that link should unlink the accounts, change the Dropbox password, and review recent file access. - Graham Cluley: https://www.bitdefender.com/en-us/blog/hotforsecurity/lenovo-login-system-hackers-dropbox BUSINESS AND POLITICS ---------------------------------------------------------------- * Brent Tops $97 as the U.S. and Iran Trade Strikes Latest developments: The United States and Iran exchanged a fresh series of strikes over the weekend, pushing Brent crude above $97 a barrel in early European trading Monday, September 7, while U.S. Treasurys sat closed for Labor Day and stock futures ran mixed. The war continues to choke traffic through the Strait of Hormuz: European natural gas climbed more than 2% to just under 74 euros a megawatt-hour with Qatari supply flows severely disrupted, eurozone government bond yields opened higher ahead of the European Central Bank's rate decision Thursday, September 10, and Tehran announced it will raise petrol prices because war-driven shortages have made its fuel subsidies, among the cheapest in the world, unsustainable. - WSJ Markets: https://www.wsj.com/finance/commodities-futures/oil-rises-amid-escalation-in-u-s-iran-conflict-aab0d7fb?mod=rss_markets_main - FT Home: https://www.ft.com/content/15d59180-ea46-4441-9c45-d6be584ae911?syn-25a6b1a6=1 - WSJ Markets: https://www.wsj.com/finance/commodities-futures/european-gas-climbs-on-lng-supply-concerns-ahead-of-winter-95ffd976?mod=rss_markets_main - WSJ Markets: https://www.wsj.com/finance/jgbs-edge-lower-amid-rising-oil-prices-b7e71276?mod=rss_markets_main - WSJ Markets: https://www.wsj.com/finance/stocks/oil-higher-on-hormuz-escalation-amid-quiet-markets-due-to-labor-day-6b5cc530?mod=rss_markets_main * Germany Weighs Letting the AfD Govern Latest developments: Alternative for Germany co-leader Alice Weidel called Sunday's Saxony-Anhalt result a dream and set a target of 40% of the vote in Germany's next federal election, and the rival parties now must decide whether to hand the AfD the state government or lock it out. The AfD finished well ahead of every rival in the September 6 Saxony-Anhalt election, the best showing in the party's history, and landed short of a majority in the state parliament, leaving Chancellor Friedrich Merz and the mainstream parties to choose between an awkward coalition of opponents and the first far-right state government in Germany since World War II. - FT Home: https://www.ft.com/content/ec1396b9-185e-4a55-86d6-36a560b549fb?syn-25a6b1a6=1 - WSJ World News: https://www.wsj.com/world/europe/germanys-right-wing-populists-on-course-for-historic-victory-56662408?mod=rss_worldnews - The Economist: https://www.economist.com/europe/2026/09/06/the-alternative-for-germany-has-won-its-best-ever-election-result * Beijing Recapitalizes Banks and Insurers Latest developments: Beijing said Monday, September 7, that it will inject $54 billion of fresh capital into state-controlled banks and insurers, widening the program to more institutions than the first round covered. The infusion is China's second recapitalization of its financial system in less than two years and lands as growth momentum sputters; separately, China's foreign-exchange reserves edged higher in August on a weaker dollar and a surging trade surplus, renewing concern about the yuan's appreciation. - FT Home: https://www.ft.com/content/8012b60e-c74e-49bc-9200-d37f13b4a135?syn-25a6b1a6=1 - WSJ World News: https://www.wsj.com/finance/beijing-to-inject-billions-into-banks-insurers-to-boost-growth-35d7a011?mod=rss_worldnews - WSJ World News: https://www.wsj.com/economy/chinas-foreign-exchange-reserves-continue-to-climb-def2bb7d?mod=rss_worldnews PITTSBURGH ---------------------------------------------------------------- Weather: Labor Day: Sunny, high 81F. Tonight: Mostly Clear, low 58F. Tuesday: Mostly Sunny, high 85F. Business: * Gasoline Sets a Labor Day Record Latest developments: The national average price of regular gasoline reached an all-time Labor Day high for the holiday Monday, September 7, three days after retail diesel set its own record at $5.85 a gallon. The war with Iran and refinery problems drive the increase, which lands on the last big driving weekend of the summer; WPXI and WTAE note the average for regular gasoline still sits below the all-time record of $5.02 a gallon set in June 2022. - WPXI: https://www.wpxi.com/news/local/fuel-prices-record-labor-day-high-us-thanks-iran-war-refinery-issues/FE6ZHV2NVNGMJMTABZWSWKMWJY/ - WTAE: https://www.wtae.com/article/national-average-price-gas-set-break-labor-day-record/73627071 * East Ohio Street Booms in Deutschtown Latest developments: The Post-Gazette reported Monday, September 7, that investment along East Ohio Street has the corridor changing fast, four days after KDKA covered the campaign by Pittsburgh leaders to revive the district. East Ohio Street is the commercial spine of Deutschtown on Pittsburgh's North Side, where longtime merchants asked the city for help and now watch new businesses arrive; residents and owners told the Post-Gazette they want the growth to lift everyone already there rather than price them out. - Pittsburgh Post-Gazette: https://www.post-gazette.com/business/development/2026/09/07/pittsburgh-deutschtown-east-ohio-street-revival-gentrification/stories/202609020037 Around town: * Street Cameras Start Talking to AI Latest developments: The Post-Gazette reported Monday, September 7, that the automatic license plate readers posted along Pennsylvania streets increasingly feed artificial-intelligence systems, five days after Governor Josh Shapiro and state Treasurer Stacy Garrity called for a statewide ban on Flock cameras. Police departments across Pennsylvania query camera networks that photograph every passing plate and log vehicle movements into searchable national databases, a practice that has drawn privacy objections in Harrisburg and from communities around Pittsburgh. - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/politics-state/2026/09/07/ai-automatic-license-plate-readers-cameras-surveillance-police-pennsylvania/stories/202609020083 * Blawnox Dresses Up Freeport Road Latest developments: Blawnox officials are moving ahead with a beautification project for the borough's business district, TribLive reported Monday, September 7. The plan adds benches, tables, trash cans, and new signage along Freeport Road, the commercial strip that carries traffic through the small Allegheny River borough northeast of Pittsburgh. - TribLive: https://triblive.com/local/valley-news-dispatch/upgrades-coming-to-blawnox-business-district/ * Sharpsburg Appoints Andrascik to Council Latest developments: Sharpsburg council appointed borough resident Jon Andrascik as a councilman, TribLive reported Monday, September 7. Andrascik served on the Sharpsburg parks and recreation commission for a little more than a year and has coached Fox Chapel Area youth soccer and basketball for more than a decade. - TribLive: https://triblive.com/local/valley-news-dispatch/sharpsburg-appoints-new-councilman/ Events: * Rib Fest Runs Through Labor Day Latest developments: Judges crowned new barbecue champions over the weekend, with one fan favorite extending its winning streak, and the festival keeps serving through Labor Day, Monday, September 7, TribLive reported. The Acrisure Stadium Kickoff and Rib Festival sets up at Acrisure Stadium on Pittsburgh's North Shore, where competing rib vendors cook for prizes and for the crowd ahead of the Steelers' home opener against the Atlanta Falcons on Sunday, September 13. - TribLive: https://triblive.com/lifestyles/food-drink/sauce-is-boss-rib-fest-at-acrisure-stadium-continues-on-labor-day/ SPORTS ---------------------------------------------------------------- Pirates (71-73) Sun Sep 6 · Angels 0 · Pirates 1 · Final https://plaintextsports.com/mlb/2026-09-06/laa-pit Up Next · Pirates @ White Sox · Tue Sep 8, 7:40 PM https://plaintextsports.com/mlb/2026/teams/pittsburgh-pirates Steelers (0-0, T-1st in AFC North) Up Next · Falcons @ Steelers · Sun Sep 13, 1:00 PM https://plaintextsports.com/nfl/2026/week1/atl-pit Around the Teams: * Steelers and the Tight End Arms Race Latest developments: The Post-Gazette wrote Monday, September 7, that head coach Mike McCarthy can put the Steelers one step ahead of the NFL's rush to stockpile tight ends by building the offense around two-tight-end personnel. Pittsburgh opens the season against the Atlanta Falcons on Sunday, September 13, at Acrisure Stadium with Pat Freiermuth heading the tight end room; the Post-Gazette argues McCarthy's 12 personnel packages give quarterback Aaron Rodgers a way to dictate matchups as the rest of the league chases the same idea. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/09/07/nfl-tight-ends-12-personnel/stories/202609060010 Team USA: * Belgium Balks at Infantino Over the Balogun Ruling Latest developments: The Belgian football federation said Monday, September 7, that it cannot support Gianni Infantino's bid for another term as FIFA president. The federation cited transparency and governance concerns along with FIFA's handling of its decision to clear United States forward Folarin Balogun of a mandatory one-game ban at the 2026 World Cup, a call that drew objections from rival national federations. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49857842/gianni-infantino-fifa-belgian-fa-belgium-world-cup-2026-folarin-balogun-red-card-overturned-usmnt READING ---------------------------------------------------------------- * Cal Newport -- Wendell Berry and the Promise of the Deep Life Newport marks the death of Wendell Berry at 92 at his home in Port Royal, Kentucky, where Berry farmed with traditional methods and wrote, and reads that life of place, slow work, and attention as the fullest case for what Newport calls the deep life. https://calnewport.com/wendell-berry-and-the-promise-of-the-deep-life/ * Stratechery -- An Interview with OpenAI President Greg Brockman About Astra and Alignment Ben Thompson interviews OpenAI co-founder and President Greg Brockman on the company's history, its Astra model, its approach to alignment, and the weight Brockman feels in building the technology. https://stratechery.com/2026/an-interview-with-openai-president-greg-brockman-about-astra-and-alignment/ * Ed Zitron -- Premium: The Hater's Guide To Circular Financing (Part Two) Zitron traces the loops in AI financing—Nvidia funds OpenAI, which spends the money renting Nvidia GPUs back from Microsoft, Google, and Amazon—and argues the clunky agreements manufacture the appearance of demand that props up the boom. https://www.wheresyoured.at/premium-the-haters-guide-to-circular-financing-part-two/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,690.10 = +0.0% Dow 53,223.02 ▼ -0.6% Nasdaq 26,355.91 ▲ +0.4% WTI crude 89.95 ▲ +8.0% EUR/USD 1.1603 ▼ -0.5% GBP/USD 1.3524 ▼ -0.8% USD/JPY 158.93 ▼ -0.2% FEED HEALTH ---------------------------------------------------------------- Security: 24 of 24 feeds loaded, 16 items in the 24-hour window. No recent items: Krebs on Security, Schneier on Security, Dark Reading, SecurityWeek, CISA Advisories, The Record, Ars Technica Security, Securelist (Kaspersky), Unit 42 (Palo Alto), Google Online Security Blog, Cisco Talos, Microsoft Security Blog, Google Project Zero, The DFIR Report, Kim Zetter (Zero Day), 404 Media, Frank on Fraud, Wired Security. Pittsburgh: 9 of 9 feeds loaded, 60 items in the 48-hour window. No recent items: PublicSource, Pittsburgh City Paper, NEXTpittsburgh, Pittsburgh Magazine. Business and Politics: 8 of 8 feeds loaded, 60 items in the 36-hour window. Events: 4 of 4 feeds loaded, 8 items in the 120-hour window. No recent items: NEXTpittsburgh Events, NEXTpittsburgh Arts & Entertainment. Sports media: 6 of 6 feeds loaded, 26 items in the 96-hour window. No recent items: Footbahlin with Ben Roethlisberger, Ben Roethlisberger / Channel Seven (YouTube). Team USA: 3 of 3 feeds loaded, 26 items in the 72-hour window. Reading: 3 of 3 feeds loaded, 12 items in the 336-hour window. Markets (Yahoo Finance): 7 of 7 rows Weather (NWS): 3 forecast periods Scores (ESPN, plaintextsports): 2 teams via plaintextsports; mlb: ESPN failed (mlb: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nfl: ESPN failed (nfl: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nhl: ESPN failed (nhl: HTTP 403 (server: AkamaiGHost)); used plaintextsports Summaries: 3 model call(s) served by claude-opus-5 (243s of model time; $1.37 at API list price). ================================================================ Generated 2026-09-07 07:05 EDT. Updated weekdays at about 7:05 AM, 10:05 AM, 1:35 PM, and 7:35 PM ET, and weekends at about 8:05 AM and 7:35 PM ET. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 3 Team USA feeds; WSJ World News, WSJ Markets, WSJ US Business, WSJ Politics, The Economist, FT Home, FT World, FT Markets; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN or plaintextsports.com. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================