Adobe shipped an emergency fix for a perfect-10 Magento zero-day that plants Rust backdoors on storefronts, and a Vietnam-linked border database left 220 million traveler records sitting behind default credentials.
Emerging Trends and Key Updates
- Trend Adobe shipped a CVSS 10.0 fix for StyleSmuggler while N-able rushed Hotfix 4 for CVE-2026-86218, both zero-days that hit business platforms before patches existed.
- Trend Cisco Talos caught ClickFix crews pulling obfuscated JavaScript from Google Sheets while BengalSEO poisoned Bing results from Rajasthan, both hiding behind infrastructure that firewalls already trust.
- Trend Grindr will pay £26 million over shared HIV status as an unsecured Vietnam-linked border database spilled passport data on 220 million travelers.
- Update · new Houthi strikes on Saudi energy pushed Brent toward $100, Russia resumed missiles on Kyiv, Britain sold 30-year gilts at 5.83%, and Canada's tariffs took effect.
- Update · new A Pittsburgh-area mother says her infant was exposed to measles at UPMC Children's, and North Huntingdon's Walmart reopened Monday with its pharmacy still closed.
- Update · new Jeannette lines up 13 redevelopment parcels for a buyers' tour and four days on Clay Avenue as the Irish Festival moves to the Carrie Blast Furnaces.
Security
1. Adobe Patches StyleSmuggler at CVSS 10.0
Latest developments: Adobe released patches on September 7, 2026 for the StyleSmuggler zero-day, now tracked as CVE-2026-75650 and rated a perfect 10.0, and researchers reported that the attackers exploiting it drop a Rust backdoor and a PHP web shell on the servers they reach.
read more
StyleSmuggler lets an attacker run code on an Adobe Commerce or Magento Open Source server without logging in, and the Dutch e-commerce security firm Sansec dated the first exploitation to September 4, 2026. Every store operator should apply the update and hunt the server for the backdoor and web shell.
Sources: The Hacker News · BleepingComputer · SecurityWeek · ↑ top
2. N-able N-central Zero-Day Under Attack
Latest developments: SecurityWeek reported that attackers exploited CVE-2026-86218 as a zero-day before N-able shipped Hotfix 4 on September 5, 2026, and told administrators to comb their deployments for user accounts nobody recognizes.
read more
The flaw hands an unauthenticated attacker remote code execution on N-central, the remote monitoring and management platform managed service providers use to administer customer endpoints. Every on-premises operator running a build below 2026.3.1.14 needs Hotfix 4 and an account audit.
Sources: SecurityWeek · Help Net Security · ↑ top
3. ClickFix and ClearFake Move Into the Browser
Latest developments: Cisco Talos published two campaign teardowns on September 8, 2026: one operation abuses the Google Visualization API to fetch obfuscated JavaScript from a published Google Sheets document and inject it into the victim's browser session to steal cryptocurrency, and a ClearFake chain running over WebDAV delivers the Amatera stealer, ZigCryptoStealer, and NetSupport Manager.
read more
Both operations chase cryptocurrency and credentials from whoever lands on the lure, with Talos assessing the ClearFake activity as untargeted. Hosting the command channel on Google's own domains defeats blocklists that judge traffic by destination.
Sources: Cisco Talos · Cisco Talos · ↑ top
4. 220 Million Traveler Records Exposed in Vietnam-Linked APIS Leak
Latest developments: BleepingComputer reported that researchers reached a Vietnam-linked Advance Passenger Information System database over a cloud path guarded by default credentials and found 220 million passenger and crew records covering 2017 through 2026.
read more
The records carry names, passport numbers, dates of birth, nationalities, and flight details, the manifest data airlines file with border authorities before departure. Anyone holding that combination can build convincing identity fraud against travelers who never dealt with the operator directly.
Sources: BleepingComputer · ↑ top
5. BengalSEO Poisons Bing Results to Push MayaBot
Latest developments: The DFIR Report disclosed BengalSEO, a search engine optimization poisoning operation it discovered in March 2026 that has run out of the Indian state of Rajasthan since at least 2015 behind two information technology service providers, among them WeConnect, seeding poisoned Bing results that deliver MayaBot malware and tech support scams.
read more
Victims searching Bing for ordinary software and support topics land on attacker pages that install MayaBot or open a scripted tech support scam. Blocking the domains alone leaves the operators free to rank new ones, so watch endpoints for MayaBot itself.
Sources: The Hacker News · ↑ top
6. Grindr Settles U.K. HIV Data Suit for £26 Million
Latest developments: Grindr agreed to pay £26 million, or $35.1 million, to settle the United Kingdom lawsuit filed against it in April 2024 over allegations that it shared users' personal information, including HIV status, with third parties for advertising.
read more
Grindr, the largest LGBTQ+ dating app, faced claims that the sharing violated U.K. privacy law. The settlement puts a price on advertising pipelines that carry health data, a warning to any company passing special-category information to ad partners.
Sources: The Hacker News · ↑ top
Business and Politics
Houthi Strikes on Saudi Energy Push Brent Toward $100
Latest developments: Yemen's Houthi militants hit energy facilities in southern Saudi Arabia overnight into Tuesday, September 8, halting some operations and wounding 73 people, which opens a second front in a war that until now squeezed oil flows mainly at the Strait of Hormuz.
read more
Brent crude climbed toward $100 a barrel Tuesday, September 8, pulling U.S. stock futures, Treasurys, and European indexes lower as traders returned from the Labor Day weekend and waited on U.S. consumer inflation data. Julius Baer told clients the risk premium now embedded in crude looks exceptionally bloated and stands ready to deflate.
Sources: WSJ World News · FT World · WSJ Markets · ↑ top
Russia Resumes Missile Strikes on Kyiv
Latest developments: Russia launched missiles at Kyiv overnight into Tuesday, September 8, ending the pause in raids that both sides observed during the American envoys' visit.
read more
Steve Witkoff and Jared Kushner met Vladimir Putin at the Kremlin on September 5 and Volodymyr Zelenskyy in Kyiv on September 6, carrying a peace proposal that produced no breakthrough. The renewed attacks restore the pressure on Ukraine's capital that the truce had lifted for the duration of the trip.
Britain Sells Gilts at Its Costliest Since 1998
Latest developments: The UK Debt Management Office priced 30-year gilts at a yield of roughly 5.83% on Tuesday, September 8, the highest borrowing cost Britain has paid at a debt sale since 1998.
read more
The global bond sell-off has driven British long-term yields to levels that squeeze the public finances, and Chancellor Rachel Reeves' successor, Healey, took a first set of questions in Parliament the same day. The Financial Times counts the United States, France, and the United Kingdom among countries now spending more to service debt than to fund defense.
Sources: FT World · FT World · FT Home · ↑ top
Canada's Retaliatory Tariffs Take Effect
Latest developments: Ottawa's retaliatory trade measures against Washington took effect overnight into Tuesday, September 8, hours after President Trump posted a call for Americans to boycott Bombardier.
read more
The Canadian countermeasures answer U.S. tariffs and escalate a trade fight between the largest pair of trading partners in North America, with Trump singling out the Montreal jet maker Bombardier for a sales ban in the United States.
Pittsburgh
Weather
Today: Mostly Sunny, high 86F.
Tonight: Partly Cloudy, low 66F.
Wednesday: Mostly Sunny, high 87F.
Business
North Huntingdon Walmart Reopens, Pharmacy Still Closed
Latest developments: The Walmart in North Huntingdon reopened Monday, September 7, with limited services after a multi-day closure, and its pharmacy remains shut.
read more
A power outage from last week's severe storms and a fire that followed kept the Westmoreland County store dark for days. Shoppers who fill prescriptions there must go elsewhere until the pharmacy reopens.
Grocery Staples Outrun General Food Inflation
Latest developments: WPXI reported Tuesday, September 8, that U.S. Department of Agriculture figures show prices for several staple grocery items rising faster than grocery inflation overall as the fall shopping season begins.
read more
Inflation, higher transportation costs, and tariffs are pushing food prices up for Pittsburgh-area households, extending a squeeze that has already driven Western Pennsylvania families back to home canning to hold down bills.
Jeannette Puts 13 Properties on a Buyers' Tour
Latest developments: Jeannette will drive prospective buyers past 13 properties open for redevelopment later this month, TribLive reported Tuesday, September 8.
read more
The Westmoreland County city is marketing vacant and underused buildings directly to investors, a step that pairs with the four days of events it has scheduled on Clay Avenue to showcase the downtown.
Around Town
Infant Exposed to Measles at UPMC Children's
Latest developments: A Pittsburgh-area mother told KDKA on Monday night, September 7, that her 2-month-old daughter was exposed to measles at UPMC Children's Hospital of Pittsburgh, the first family to describe the exposure publicly.
read more
The Allegheny County Health Department warned on September 1 that two people tested positive after visiting the Lawrenceville hospital, and infants under 12 months sit below the age for the first scheduled measles vaccine dose. Pennsylvania's outbreak has already produced the first U.S. measles-associated deaths of 2026.
A Border Stands Between a Hilltop Block and One Tree
Latest developments: PublicSource reported Tuesday, September 8, that the Pittsburgh-Mount Oliver municipal line is holding up a Hilltop resident's request for a single street tree on her block.
read more
Murray has pressed for public shade on a treeless Hilltop street where the noon sun turns the pavement punishing, and a representative of the Pittsburgh Forestry Department agreed the block runs hot. The boundary between the city and the borough of Mount Oliver complicates who plants and maintains the tree.
Sources: PublicSource · ↑ top
Hempfield Teacher Builds a Countywide Civics Program
Latest developments: TribLive reported Tuesday, September 8, that Hempfield Area High School teacher Ken Stough has created a civics program for schools across Westmoreland County.
read more
Stough argues Pennsylvania civics education needs a rebuild and has designed a course of study that reaches beyond his own classroom to districts throughout the county.
Events
Pittsburgh Irish Festival Moves to Carrie Furnaces
Latest developments: TribLive previewed the annual Pittsburgh Irish Festival on Tuesday, September 8, staged at the Carrie Blast Furnaces in Rankin and Swissvale.
read more
The festival brings Celtic music, dance, and food to the preserved iron-making site along the Monongahela River. About 17% of Pittsburghers claim some Irish heritage, and organizers pitch the weekend at everyone else too.
In Good Spirits Gathers Western Pennsylvania Distilleries
Latest developments: Iron City Distilling announced the second annual In Good Spirits: A Celebration of the Distilleries of Western PA, TribLive reported Tuesday, September 8.
read more
Iron City Distilling hosts distillers from across the region for a single tasting event, the second year it has convened the Western Pennsylvania craft spirits trade under one roof.
Jeannette Plans Four Days on Clay Avenue
Latest developments: Jeannette has scheduled four days of events along Clay Avenue celebrating the city's history and current culture, TribLive reported Tuesday, September 8.
read more
The Westmoreland County city, once the glass-making center of the region, will fill its main commercial street with programming meant to show off what remains and what has arrived since.
Sports
Pirates (71-73)
Up Next · Pirates @ White Sox · Tue Sep 8, 7:40 PM
Steelers (0-0, T-1st in AFC North)
Up Next · Falcons @ Steelers · Sun Sep 13, 1:00 PM
Around the Teams
Rodgers Calls It His Last Rodeo on Not Just Football
Latest developments: Cam Heyward's Not Just Football released part one of its Aaron Rodgers interview Tuesday morning, September 8, five days before the Steelers open at home against the Atlanta Falcons.
read more
The four-time MVP told Heyward and co-host Hayden that this season is his last rodeo, walked through the full-circle bond with head coach Mike McCarthy, who coached him in Green Bay, and described his single year under Mike Tomlin. Rodgers also talked about locker-room chemistry and the team's bonding trip to Idaho.
Sources: Not Just Football with Cam Heyward · ↑ top
Pittsburgh's Teams and the Week After 9/11
Latest developments: The Post-Gazette published a retrospective Tuesday, September 8, on how the September 11, 2001, attacks upended the Steelers, Pirates, and Penguins, three days before the 25th anniversary.
read more
The piece traces the uncertainty that froze schedules and travel for Pittsburgh's franchises, and the role the teams then played in pulling the city together once games resumed.
Sources: Post-Gazette Pirates · ↑ top
Reading
- Stratechery — Write Things Down. Ben Thompson argues that writing things down carries real power for humans and for AI systems alike. The harder questions come first: deciding what to write, why to write it, and actually finishing the work.
- Cal Newport — Wendell Berry and the Promise of the Deep Life. Newport marks the death of Wendell Berry at 92 at his home in Port Royal, Kentucky, where Berry farmed with traditional methods and wrote. He reads Berry's example as a case for a deep life built on attention to place and craft.
- Ed Zitron — Premium: The Hater's Guide To Circular Financing (Part Two). Zitron traces the loops in AI financing: Nvidia funds OpenAI, which spends the money renting Nvidia GPUs back from Microsoft, Google, and Amazon. He contends the arrangements inflate reported demand for chips that the same parties are paying for.
Markets
S&P 500 7,690.10 = +0.0% Dow 53,223.02 ▼ -0.6% Nasdaq 26,355.91 ▲ +0.4% WTI crude 89.95 ▲ +8.0% EUR/USD 1.1608 ▼ -0.3% GBP/USD 1.3520 ▼ -0.6% USD/JPY 158.14 ▼ -0.8%
Feed Health
Security: 24 of 24 feeds loaded, 37 items in the 24-hour window. No recent items: Krebs on Security, Dark Reading, CISA Advisories, Ars Technica Security, Securelist (Kaspersky), Sophos News, Unit 42 (Palo Alto), Google Online Security Blog, Graham Cluley, Microsoft Security Blog, Google Project Zero, The DFIR Report, Kim Zetter (Zero Day), Wired Security.
Pittsburgh: 9 of 9 feeds loaded, 60 items in the 48-hour window. No recent items: NEXTpittsburgh, Pittsburgh Magazine.
Business and Politics: 8 of 8 feeds loaded, 60 items in the 36-hour window.
Events: 4 of 4 feeds loaded, 4 items in the 120-hour window. No recent items: Post-Gazette Music, NEXTpittsburgh Events, NEXTpittsburgh Arts & Entertainment.
Sports media: 6 of 6 feeds loaded, 24 items in the 96-hour window. No recent items: Footbahlin with Ben Roethlisberger, Ben Roethlisberger / Channel Seven (YouTube).
Team USA: 3 of 3 feeds loaded, 32 items in the 72-hour window.
Reading: 3 of 3 feeds loaded, 12 items in the 336-hour window.
Markets (Yahoo Finance): 7 of 7 rows
Weather (NWS): 3 forecast periods
Scores (ESPN, plaintextsports): 2 teams via plaintextsports; mlb: ESPN failed (mlb: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nfl: ESPN failed (nfl: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nhl: ESPN failed (nhl: HTTP 403 (server: AkamaiGHost)); used plaintextsports
Summaries: 3 model call(s) served by claude-opus-5 (254s of model time; $1.47 at API list price).