================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Tuesday, September 8, 2026 - 7:05 AM EDT ================================================================ Adobe shipped an emergency fix for a perfect-10 Magento zero-day that plants Rust backdoors on storefronts, and a Vietnam-linked border database left 220 million traveler records sitting behind default credentials. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets | Feed Health EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Adobe shipped a CVSS 10.0 fix for StyleSmuggler while N-able rushed Hotfix 4 for CVE-2026-86218, both zero-days that hit business platforms before patches existed. see: Adobe Patches StyleSmuggler at CVSS 10.0; N-able N-central Zero-Day Under Attack * [TREND] Cisco Talos caught ClickFix crews pulling obfuscated JavaScript from Google Sheets while BengalSEO poisoned Bing results from Rajasthan, both hiding behind infrastructure that firewalls already trust. see: ClickFix and ClearFake Move Into the Browser; BengalSEO Poisons Bing Results to Push MayaBot * [TREND] Grindr will pay £26 million over shared HIV status as an unsecured Vietnam-linked border database spilled passport data on 220 million travelers. see: Grindr Settles U.K. HIV Data Suit for £26 Million; 220 Million Traveler Records Exposed in Vietnam-Linked APIS Leak * [UPDATE (new)] Houthi strikes on Saudi energy pushed Brent toward $100, Russia resumed missiles on Kyiv, Britain sold 30-year gilts at 5.83%, and Canada's tariffs took effect. see: Houthi Strikes on Saudi Energy Push Brent Toward $100; Russia Resumes Missile Strikes on Kyiv; Britain Sells Gilts at Its Costliest Since 1998; Canada's Retaliatory Tariffs Take Effect * [UPDATE (new)] A Pittsburgh-area mother says her infant was exposed to measles at UPMC Children's, and North Huntingdon's Walmart reopened Monday with its pharmacy still closed. see: Infant Exposed to Measles at UPMC Children's; North Huntingdon Walmart Reopens, Pharmacy Still Closed * [UPDATE (new)] Jeannette lines up 13 redevelopment parcels for a buyers' tour and four days on Clay Avenue as the Irish Festival moves to the Carrie Blast Furnaces. see: Jeannette Puts 13 Properties on a Buyers' Tour; Jeannette Plans Four Days on Clay Avenue; Pittsburgh Irish Festival Moves to Carrie Furnaces SECURITY ---------------------------------------------------------------- 1. ADOBE PATCHES STYLESMUGGLER AT CVSS 10.0 Vulnerabilities and Exploits · [zero-day, patch, exploitation] Latest developments: Adobe released patches on September 7, 2026 for the StyleSmuggler zero-day, now tracked as CVE-2026-75650 and rated a perfect 10.0, and researchers reported that the attackers exploiting it drop a Rust backdoor and a PHP web shell on the servers they reach. StyleSmuggler lets an attacker run code on an Adobe Commerce or Magento Open Source server without logging in, and the Dutch e-commerce security firm Sansec dated the first exploitation to September 4, 2026. Every store operator should apply the update and hunt the server for the backdoor and web shell. - The Hacker News: https://thehackernews.com/2026/09/adobe-patches-magento-zero-day.html - BleepingComputer: https://www.bleepingcomputer.com/news/security/magento-stylesmuggler-zero-day-exploited-to-deploy-linux-backdoor/ - SecurityWeek: https://www.securityweek.com/adobe-commerce-zero-day-exploited-to-backdoor-online-stores/ 2. N-ABLE N-CENTRAL ZERO-DAY UNDER ATTACK Vulnerabilities and Exploits · [zero-day, patch, msp] Latest developments: SecurityWeek reported that attackers exploited CVE-2026-86218 as a zero-day before N-able shipped Hotfix 4 on September 5, 2026, and told administrators to comb their deployments for user accounts nobody recognizes. The flaw hands an unauthenticated attacker remote code execution on N-central, the remote monitoring and management platform managed service providers use to administer customer endpoints. Every on-premises operator running a build below 2026.3.1.14 needs Hotfix 4 and an account audit. - SecurityWeek: https://www.securityweek.com/n-able-patches-critical-zero-day-in-n-central/ - Help Net Security: https://www.helpnetsecurity.com/2026/09/07/n-able-n-central-hotfix-cve-2026-86218/ 3. CLICKFIX AND CLEARFAKE MOVE INTO THE BROWSER Ransomware and Cybercrime · [malware, infostealer, cryptocurrency] Latest developments: Cisco Talos published two campaign teardowns on September 8, 2026: one operation abuses the Google Visualization API to fetch obfuscated JavaScript from a published Google Sheets document and inject it into the victim's browser session to steal cryptocurrency, and a ClearFake chain running over WebDAV delivers the Amatera stealer, ZigCryptoStealer, and NetSupport Manager. Both operations chase cryptocurrency and credentials from whoever lands on the lure, with Talos assessing the ClearFake activity as untargeted. Hosting the command channel on Google's own domains defeats blocklists that judge traffic by destination. - Cisco Talos: https://blog.talosintelligence.com/clickfix-moves-into-the-browser/ - Cisco Talos: https://blog.talosintelligence.com/clearfake-webdav-infection-chain/ 4. 220 MILLION TRAVELER RECORDS EXPOSED IN VIETNAM-LINKED APIS LEAK Data Breaches · [breach, aviation, data exposure] Latest developments: BleepingComputer reported that researchers reached a Vietnam-linked Advance Passenger Information System database over a cloud path guarded by default credentials and found 220 million passenger and crew records covering 2017 through 2026. The records carry names, passport numbers, dates of birth, nationalities, and flight details, the manifest data airlines file with border authorities before departure. Anyone holding that combination can build convincing identity fraud against travelers who never dealt with the operator directly. - BleepingComputer: https://www.bleepingcomputer.com/news/security/220-million-traveler-records-exposed-in-vietnam-linked-apis-leak/ 5. BENGALSEO POISONS BING RESULTS TO PUSH MAYABOT Ransomware and Cybercrime · [malware, scams, seo poisoning] Latest developments: The DFIR Report disclosed BengalSEO, a search engine optimization poisoning operation it discovered in March 2026 that has run out of the Indian state of Rajasthan since at least 2015 behind two information technology service providers, among them WeConnect, seeding poisoned Bing results that deliver MayaBot malware and tech support scams. Victims searching Bing for ordinary software and support topics land on attacker pages that install MayaBot or open a scripted tech support scam. Blocking the domains alone leaves the operators free to rank new ones, so watch endpoints for MayaBot itself. - The Hacker News: https://thehackernews.com/2026/09/bengalseo-poisons-bing-search-results.html 6. GRINDR SETTLES U.K. HIV DATA SUIT FOR £26 MILLION Policy and Regulation · [privacy, policy, legal] Latest developments: Grindr agreed to pay £26 million, or $35.1 million, to settle the United Kingdom lawsuit filed against it in April 2024 over allegations that it shared users' personal information, including HIV status, with third parties for advertising. Grindr, the largest LGBTQ+ dating app, faced claims that the sharing violated U.K. privacy law. The settlement puts a price on advertising pipelines that carry health data, a warning to any company passing special-category information to ad partners. - The Hacker News: https://thehackernews.com/2026/09/grindr-to-pay-26-million-to-settle-uk.html BUSINESS AND POLITICS ---------------------------------------------------------------- * Houthi Strikes on Saudi Energy Push Brent Toward $100 Latest developments: Yemen's Houthi militants hit energy facilities in southern Saudi Arabia overnight into Tuesday, September 8, halting some operations and wounding 73 people, which opens a second front in a war that until now squeezed oil flows mainly at the Strait of Hormuz. Brent crude climbed toward $100 a barrel Tuesday, September 8, pulling U.S. stock futures, Treasurys, and European indexes lower as traders returned from the Labor Day weekend and waited on U.S. consumer inflation data. Julius Baer told clients the risk premium now embedded in crude looks exceptionally bloated and stands ready to deflate. - WSJ World News: https://www.wsj.com/world/middle-east/oil-nears-100-a-barrel-as-fresh-attacks-on-saudi-energy-operations-raise-supply-concerns-568aad5f?mod=rss_worldnews - FT World: https://www.ft.com/content/d9bc67e2-97f4-47ef-8de5-1ae48d841018?syn-25a6b1a6=1 - WSJ Markets: https://www.wsj.com/finance/commodities-futures/u-s-stock-futures-treasurys-weaken-as-brent-nears-100-c29efc2f?mod=rss_markets_main * Russia Resumes Missile Strikes on Kyiv Latest developments: Russia launched missiles at Kyiv overnight into Tuesday, September 8, ending the pause in raids that both sides observed during the American envoys' visit. Steve Witkoff and Jared Kushner met Vladimir Putin at the Kremlin on September 5 and Volodymyr Zelenskyy in Kyiv on September 6, carrying a peace proposal that produced no breakthrough. The renewed attacks restore the pressure on Ukraine's capital that the truce had lifted for the duration of the trip. - FT World: https://www.ft.com/content/0815cd34-bf4c-4771-8bf5-710eff286763 * Britain Sells Gilts at Its Costliest Since 1998 Latest developments: The UK Debt Management Office priced 30-year gilts at a yield of roughly 5.83% on Tuesday, September 8, the highest borrowing cost Britain has paid at a debt sale since 1998. The global bond sell-off has driven British long-term yields to levels that squeeze the public finances, and Chancellor Rachel Reeves' successor, Healey, took a first set of questions in Parliament the same day. The Financial Times counts the United States, France, and the United Kingdom among countries now spending more to service debt than to fund defense. - FT World: https://www.ft.com/content/b23151c3-b4c1-4f96-a801-f3507d907cc7?syn-25a6b1a6=1 - FT World: https://www.ft.com/content/359e9dac-cc19-4a93-8155-3d087adf4103 - FT Home: https://www.ft.com/content/4f28ef6c-f727-4d36-88a3-bbdbd13ddfbf?syn-25a6b1a6=1 * Canada's Retaliatory Tariffs Take Effect Latest developments: Ottawa's retaliatory trade measures against Washington took effect overnight into Tuesday, September 8, hours after President Trump posted a call for Americans to boycott Bombardier. The Canadian countermeasures answer U.S. tariffs and escalate a trade fight between the largest pair of trading partners in North America, with Trump singling out the Montreal jet maker Bombardier for a sales ban in the United States. - FT Home: https://www.ft.com/content/a7011878-b0b7-4e7f-8f5a-e7d9d662fd47?syn-25a6b1a6=1 PITTSBURGH ---------------------------------------------------------------- Weather: Today: Mostly Sunny, high 86F. Tonight: Partly Cloudy, low 66F. Wednesday: Mostly Sunny, high 87F. Business: * North Huntingdon Walmart Reopens, Pharmacy Still Closed Latest developments: The Walmart in North Huntingdon reopened Monday, September 7, with limited services after a multi-day closure, and its pharmacy remains shut. A power outage from last week's severe storms and a fire that followed kept the Westmoreland County store dark for days. Shoppers who fill prescriptions there must go elsewhere until the pharmacy reopens. - WTAE: https://www.wtae.com/article/north-huntingdon-walmart-reopens-limited-services-fire/73635858 * Grocery Staples Outrun General Food Inflation Latest developments: WPXI reported Tuesday, September 8, that U.S. Department of Agriculture figures show prices for several staple grocery items rising faster than grocery inflation overall as the fall shopping season begins. Inflation, higher transportation costs, and tariffs are pushing food prices up for Pittsburgh-area households, extending a squeeze that has already driven Western Pennsylvania families back to home canning to hold down bills. - WPXI: https://www.wpxi.com/news/local/ways-save-your-next-grocery-bill-prices-continue-rise/LIOAUBW27JCIHB7YYDNBJQH2WI/ * Jeannette Puts 13 Properties on a Buyers' Tour Latest developments: Jeannette will drive prospective buyers past 13 properties open for redevelopment later this month, TribLive reported Tuesday, September 8. The Westmoreland County city is marketing vacant and underused buildings directly to investors, a step that pairs with the four days of events it has scheduled on Clay Avenue to showcase the downtown. - TribLive: https://triblive.com/local/westmoreland/jeannette-plans-tour-of-available-properties/ Around town: * Infant Exposed to Measles at UPMC Children's Latest developments: A Pittsburgh-area mother told KDKA on Monday night, September 7, that her 2-month-old daughter was exposed to measles at UPMC Children's Hospital of Pittsburgh, the first family to describe the exposure publicly. The Allegheny County Health Department warned on September 1 that two people tested positive after visiting the Lawrenceville hospital, and infants under 12 months sit below the age for the first scheduled measles vaccine dose. Pennsylvania's outbreak has already produced the first U.S. measles-associated deaths of 2026. - KDKA: https://www.cbsnews.com/pittsburgh/news/infant-exposed-measles-childrens-hospital/ * A Border Stands Between a Hilltop Block and One Tree Latest developments: PublicSource reported Tuesday, September 8, that the Pittsburgh-Mount Oliver municipal line is holding up a Hilltop resident's request for a single street tree on her block. Murray has pressed for public shade on a treeless Hilltop street where the noon sun turns the pavement punishing, and a representative of the Pittsburgh Forestry Department agreed the block runs hot. The boundary between the city and the borough of Mount Oliver complicates who plants and maintains the tree. - PublicSource: https://www.publicsource.org/mount-oliver-tree-planting-city-borough-line/ * Hempfield Teacher Builds a Countywide Civics Program Latest developments: TribLive reported Tuesday, September 8, that Hempfield Area High School teacher Ken Stough has created a civics program for schools across Westmoreland County. Stough argues Pennsylvania civics education needs a rebuild and has designed a course of study that reaches beyond his own classroom to districts throughout the county. - TribLive: https://triblive.com/local/westmoreland/hempfield-area-high-school-teacher-creates-countywide-civics-program/ Events: * Pittsburgh Irish Festival Moves to Carrie Furnaces Latest developments: TribLive previewed the annual Pittsburgh Irish Festival on Tuesday, September 8, staged at the Carrie Blast Furnaces in Rankin and Swissvale. The festival brings Celtic music, dance, and food to the preserved iron-making site along the Monongahela River. About 17% of Pittsburghers claim some Irish heritage, and organizers pitch the weekend at everyone else too. - TribLive: https://triblive.com/aande/music/pittsburgh-irish-festival-to-bring-culture-and-fun-to-carrie-furnaces/ * In Good Spirits Gathers Western Pennsylvania Distilleries Latest developments: Iron City Distilling announced the second annual In Good Spirits: A Celebration of the Distilleries of Western PA, TribLive reported Tuesday, September 8. Iron City Distilling hosts distillers from across the region for a single tasting event, the second year it has convened the Western Pennsylvania craft spirits trade under one roof. - TribLive: https://triblive.com/local/valley-news-dispatch/iron-city-distilling-to-host-second-annual-in-good-spirits-event/ * Jeannette Plans Four Days on Clay Avenue Latest developments: Jeannette has scheduled four days of events along Clay Avenue celebrating the city's history and current culture, TribLive reported Tuesday, September 8. The Westmoreland County city, once the glass-making center of the region, will fill its main commercial street with programming meant to show off what remains and what has arrived since. - TribLive: https://triblive.com/local/westmoreland/jeannette-sets-4-day-celebration-of-good-things-found-in-city/ SPORTS ---------------------------------------------------------------- Pirates (71-73) Up Next · Pirates @ White Sox · Tue Sep 8, 7:40 PM https://plaintextsports.com/mlb/2026/teams/pittsburgh-pirates Steelers (0-0, T-1st in AFC North) Up Next · Falcons @ Steelers · Sun Sep 13, 1:00 PM https://plaintextsports.com/nfl/2026/week1/atl-pit Around the Teams: * Rodgers Calls It His Last Rodeo on Not Just Football Latest developments: Cam Heyward's Not Just Football released part one of its Aaron Rodgers interview Tuesday morning, September 8, five days before the Steelers open at home against the Atlanta Falcons. The four-time MVP told Heyward and co-host Hayden that this season is his last rodeo, walked through the full-circle bond with head coach Mike McCarthy, who coached him in Green Bay, and described his single year under Mike Tomlin. Rodgers also talked about locker-room chemistry and the team's bonding trip to Idaho. - Not Just Football with Cam Heyward: https://www.youtube.com/watch?v=HtDjQg4Kftk * Pittsburgh's Teams and the Week After 9/11 Latest developments: The Post-Gazette published a retrospective Tuesday, September 8, on how the September 11, 2001, attacks upended the Steelers, Pirates, and Penguins, three days before the 25th anniversary. The piece traces the uncertainty that froze schedules and travel for Pittsburgh's franchises, and the role the teams then played in pulling the city together once games resumed. - Post-Gazette Pirates: https://www.post-gazette.com/news/sept11/2026/09/08/sept11-impact-pittsburgh-sports/stories/202609070001 READING ---------------------------------------------------------------- * Stratechery -- Write Things Down Ben Thompson argues that writing things down carries real power for humans and for AI systems alike. The harder questions come first: deciding what to write, why to write it, and actually finishing the work. https://stratechery.com/2026/write-things-down/ * Cal Newport -- Wendell Berry and the Promise of the Deep Life Newport marks the death of Wendell Berry at 92 at his home in Port Royal, Kentucky, where Berry farmed with traditional methods and wrote. He reads Berry's example as a case for a deep life built on attention to place and craft. https://calnewport.com/wendell-berry-and-the-promise-of-the-deep-life/ * Ed Zitron -- Premium: The Hater's Guide To Circular Financing (Part Two) Zitron traces the loops in AI financing: Nvidia funds OpenAI, which spends the money renting Nvidia GPUs back from Microsoft, Google, and Amazon. He contends the arrangements inflate reported demand for chips that the same parties are paying for. https://www.wheresyoured.at/premium-the-haters-guide-to-circular-financing-part-two/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,690.10 = +0.0% Dow 53,223.02 ▼ -0.6% Nasdaq 26,355.91 ▲ +0.4% WTI crude 89.95 ▲ +8.0% EUR/USD 1.1608 ▼ -0.3% GBP/USD 1.3520 ▼ -0.6% USD/JPY 158.14 ▼ -0.8% FEED HEALTH ---------------------------------------------------------------- Security: 24 of 24 feeds loaded, 37 items in the 24-hour window. No recent items: Krebs on Security, Dark Reading, CISA Advisories, Ars Technica Security, Securelist (Kaspersky), Sophos News, Unit 42 (Palo Alto), Google Online Security Blog, Graham Cluley, Microsoft Security Blog, Google Project Zero, The DFIR Report, Kim Zetter (Zero Day), Wired Security. Pittsburgh: 9 of 9 feeds loaded, 60 items in the 48-hour window. No recent items: NEXTpittsburgh, Pittsburgh Magazine. Business and Politics: 8 of 8 feeds loaded, 60 items in the 36-hour window. Events: 4 of 4 feeds loaded, 4 items in the 120-hour window. No recent items: Post-Gazette Music, NEXTpittsburgh Events, NEXTpittsburgh Arts & Entertainment. Sports media: 6 of 6 feeds loaded, 24 items in the 96-hour window. No recent items: Footbahlin with Ben Roethlisberger, Ben Roethlisberger / Channel Seven (YouTube). Team USA: 3 of 3 feeds loaded, 32 items in the 72-hour window. Reading: 3 of 3 feeds loaded, 12 items in the 336-hour window. Markets (Yahoo Finance): 7 of 7 rows Weather (NWS): 3 forecast periods Scores (ESPN, plaintextsports): 2 teams via plaintextsports; mlb: ESPN failed (mlb: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nfl: ESPN failed (nfl: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nhl: ESPN failed (nhl: HTTP 403 (server: AkamaiGHost)); used plaintextsports Summaries: 3 model call(s) served by claude-opus-5 (254s of model time; $1.47 at API list price). ================================================================ Generated 2026-09-08 07:05 EDT. Updated weekdays at about 7:05 AM, 10:05 AM, 1:35 PM, and 7:35 PM ET, and weekends at about 8:05 AM and 7:35 PM ET. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 3 Team USA feeds; WSJ World News, WSJ Markets, WSJ US Business, WSJ Politics, The Economist, FT Home, FT World, FT Markets; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN or plaintextsports.com. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================