Google patched the seventh exploited Chrome zero-day of 2026 while the researcher called Nightmare Eclipse published a working bypass of Microsoft's Defender fix hours after the largest Patch Tuesday on record.
Emerging Trends and Key Updates
- Trend Google's Chrome 153 fix for a seventh V8 zero-day lands alongside critical Ivanti and cPanel patches, while ShieldCrash reopened a Defender hole hours after Microsoft's September updates.
- Trend Attackers are abandoning disk, hiding a PHP web shell in the memory of F5 BIG-IP appliances while DoppelCart assembles phishing pages inside victims' own browsers via blob URLs.
- Update · new Brent crossed $100 after U.S. strikes on Iranian-linked ships, European gas hit a 2023 high, Trump banned Canadian dairy and alcohol, and Bessent warned yen shorts.
- Update · new Liquid Network thieves returned $263 million of the roughly $320 million drained through an Elements bug, while 404 Media exposed Border Patrol units screening Americans' financial data.
- Update · new Allegheny County Council moved to require AI disclosure in campaign ads as Innamorato pushes paid parental leave, and forecasters flag Thursday storms with a flooding risk.
Security
1. Chrome 153 Patches Seventh Zero-Day of 2026
Latest developments: Google shipped Chrome 153.0.8010.36 and .37 for Windows and macOS and 153.0.8010.36 for Linux on September 8, 2026, fixing 230 flaws, among them CVE-2026-87491, an out-of-bounds write in the V8 JavaScript and WebAssembly engine that attackers already exploit in the wild, the seventh Chrome zero-day of the year and the second in six days after CVE-2026-85046.
read more
Google rates CVE-2026-87491 medium severity and says the exploit runs code inside the browser sandbox, and it withheld technical detail while users update. Every Chrome and Chromium-based browser deployment needs the update now.
Sources: SecurityWeek · The Hacker News · BleepingComputer · Help Net Security · ↑ top
2. Ivanti, cPanel, and ICS Vendors Ship Critical Fixes
Latest developments: Ivanti patched six critical remote code execution flaws in Neurons for ITSM plus authentication bypass bugs in Sentry and Endpoint Manager Mobile; cPanel disclosed on September 8, 2026 that an account holder with mail privileges can write arbitrary files through EmailTrack and run code as root on every supported cPanel and WHM version; Schneider Electric, Siemens, AVEVA, and Rockwell Automation released their own industrial control system patches; and researchers counted more than 36,000 internet-exposed Plex Media Server instances still unpatched against flaws disclosed last week.
read more
The four sets of fixes cover shared hosting servers, mobile and IT service management platforms, plant floor equipment, and home media servers, each reachable from the internet in typical deployments. Operators should prioritize the cPanel root escalation and the Ivanti Neurons for ITSM flaws, which yield full server control.
Sources: SecurityWeek · The Hacker News · SecurityWeek · BleepingComputer · ↑ top
3. ShieldCrash Bypasses Microsoft's Defender Patch
Latest developments: Hours after Microsoft published its September 2026 updates, the anonymous researcher known as Nightmare Eclipse, who also goes by Chaotic Eclipse, released a proof-of-concept exploit named ShieldCrash that grants SYSTEM privileges and defeats Microsoft's fix for CVE-2026-69414, the 7.8-rated Defender flaw the same researcher reported last month as ShieldBreak.
read more
ShieldCrash leaves Microsoft Defender installations open to local privilege escalation with no vendor fix available, extending a run of zero-day drops by Nightmare Eclipse that has already covered CrowdStrike Falcon, Nvidia, Avast, and Kaspersky software. Administrators should watch for an out-of-band Microsoft update and monitor Defender's remediation routines for abuse.
Sources: BleepingComputer · The Hacker News · Help Net Security · ↑ top
4. DoppelCart Runs 119,000 Fake Storefronts
Latest developments: Researchers named DoppelCart, a card-skimming operation that runs more than 119,000 domains as fake online shops to harvest payment card details, and separately documented a phishing method that assembles the malicious page inside the victim's browser from Microsoft services and blob URLs, which leaves defenders no hosted site to detect or block; Palo Alto Networks' Unit 42 traced a pay-per-install network that used YouTube gaming lures and search engine poisoning to push multi-payload malware into enterprise networks.
read more
All three operations lean on scale and on infrastructure that reputation-based defenses trust, whether that is a fresh domain among 119,000, a Microsoft-hosted blob URL, or a YouTube video. Blocklists alone will not hold, so defenders need content inspection at the browser and endpoint.
Sources: BleepingComputer · SecurityWeek · Unit 42 (Palo Alto) · ↑ top
5. F5 BIG-IP Rootkit Hides Web Shell in Memory
Latest developments: Sophos published an analysis on September 7, 2026 of a Linux rootkit tied to break-ins at F5 BIG-IP Access Policy Manager appliances that intercepts PHP file loading: when Apache loads any of three of the appliance's own PHP scripts, the rootkit appends a web shell to the copy in memory, so the file on disk still checks out clean.
read more
The technique gives attackers a fileless backdoor on internet-facing remote-access appliances that survives disk scanning and file integrity checks. F5 BIG-IP APM operators need memory-level inspection and should treat compromised appliances as unrecoverable without a rebuild.
Sources: The Hacker News · BleepingComputer · ↑ top
6. Liquid Network Thieves Return $263 Million
Latest developments: Whoever drained nearly 4,000 bitcoin, roughly $320 million, from the Liquid Network federation wallet on September 6, 2026 through a bug in Elements returned 3,400 of those coins, about $263 million, the next day while demanding that the sidechain fix the flaw, and kept 598.5 bitcoin worth some $47 million; Liquid remains paused, so holders cannot redeem the L-BTC token for bitcoin.
read more
Liquid is a Bitcoin sidechain that locks up real bitcoin to back L-BTC, and the attackers reached the federation wallet that holds the reserve. In parallel prosecutions and investigations, Malone Lam pleaded guilty to racketeering charges over a $245 million crypto heist that funded Hamptons vacations, cars, and private jets, and CrowdStrike detailed Slim Spider, a Brazil-based crew that has stolen cryptocurrency custody secrets from Brazilian financial institutions since March 2026.
Sources: SecurityWeek · The Hacker News · The Record · The Hacker News · ↑ top
7. Border Patrol Screens Americans' Financial Habits
Latest developments: 404 Media identified predictive policing units inside U.S. Border Patrol that analyze Americans' financial data and then direct local police to pull drivers over who face no suspicion of a particular crime; the State Department on August 26, 2026 labeled the Italian tech collective Autistici/Inventati an extremist group hosting infrastructure for far-left militants and warned that anyone funding it risks sanctions, and the collective has now shut down; and the Pentagon switched off advertising identifiers across its phones after location data sold by the ad industry helped adversaries track United States troops.
read more
Commercially available financial and location data now drives both government targeting of civilians and foreign targeting of American service members. Any organization whose staff travel or handle sensitive work should disable mobile ad identifiers as the Defense Department did.
Sources: 404 Media · The Record · Graham Cluley · ↑ top
Business and Politics
Brent Crosses $100 a Barrel
Latest developments: Brent topped $100 a barrel early Wednesday, September 9, the first time since July, after the U.S. military struck multiple ships tied to Iran's Revolutionary Guards and Iranian missiles hit American targets in Jordan.
read more
The blockade war between Washington and Tehran has drained tanker capacity and inventories, and traders see no credible path to de-escalation, so crude has run up through the $90s over two weeks. U.S. stock futures held steady while Treasury yields ticked higher and gold climbed on the inflation and rate-hike implications; European shares fell at the open as the oil move hit banks.
Sources: FT Home · WSJ World News · FT World · WSJ Markets · ↑ top
Trump Bans Canadian Dairy, Motorcycles, and Alcohol
Latest developments: President Trump signed orders late Tuesday, September 8, barring Canadian dairy, motorcycles, and most alcoholic beverages from the U.S. market, with the prohibitions taking effect in three weeks.
read more
The orders answer Ottawa's tariffs on roughly $20 billion of American goods, which took effect Tuesday. The ban covers a small subset of industries and could ruin the Canadian companies inside it, and Trump has also moved to bar Canadian firms from U.S. government contracts.
Sources: FT Home · WSJ World News · ↑ top
European Gas Reaches Its Highest Since 2023
Latest developments: European gas prices hit their highest level since 2023 on Wednesday, September 9, as the market priced in a prolonged liquefied natural gas squeeze.
read more
Europe enters winter with storage filled only enough to survive mild weather, a bet placed on a quick end to the Iran war. A longer disruption would put the continent in a bidding contest with Asia for a shrinking pool of LNG cargoes.
Sources: WSJ Markets · WSJ Markets · ↑ top
Bessent Warns Traders Off the Yen
Latest developments: Treasury Secretary Scott Bessent told currency traders Wednesday, September 9, to stop betting against the yen, saying "I am the house now."
read more
The warning follows July's rare joint intervention by Washington and Tokyo to support the Japanese currency, and it lands as the yen trades near six-month highs on expectations of two more Bank of Japan rate increases by year-end. Bessent's line puts the U.S. Treasury explicitly behind the currency, raising the cost of short positions.
Sources: FT Home · WSJ Markets · ↑ top
Pittsburgh
Weather
Today: Slight Chance Rain Showers then Partly Sunny, high 87F.
Tonight: Chance Showers And Thunderstorms then Showers And Thunderstorms, low 70F.
Thursday: Showers And Thunderstorms Likely, high 78F.
Business
Arnold Palmer Terminal Nears the Finish
Latest developments: TribLive reported Wednesday, September 9, that a leaking roof and finishing touches are all that remain in the first phase of the $22 million expansion at Arnold Palmer Regional Airport, while the search for a commercial carrier goes on.
read more
The project doubles the size of the terminal at Arnold Palmer Regional Airport in Unity, Westmoreland County. The airport has no commercial airline flying passengers out of the enlarged building.
Lost Lizard Video Rents VHS Tapes Again
Latest developments: Pittsburgh City Paper profiled Lost Lizard Video on Wednesday, September 9, the video rental store Vincent Santis stocks with VHS tapes.
read more
Santis designed the shop as a communal gathering space and says he missed the era of browsing a rental counter. The store has drawn steady local attention for reviving a format the streaming services buried.
Sources: Pittsburgh City Paper · ↑ top
Pittsburgh Distillers Ride the Canned-Cocktail Boom
Latest developments: The Post-Gazette reported Wednesday, September 9, that premixed ready-to-drink cocktails have never sold better, with Pittsburgh producers Wigle, Liberty Pole Spirits, and Lucky Sign in the category.
read more
Ready-to-drink cocktails have become one of the fastest-growing corners of the spirits business, and Western Pennsylvania distillers are putting their own bottled and canned versions on shelves. The format lets small producers reach drinkers who never visit a tasting room.
Sources: Pittsburgh Post-Gazette · ↑ top
Around Town
County Council Targets AI in Campaign Ads
Latest developments: Allegheny County Council members introduced a bill Tuesday, September 8, requiring candidates to disclose artificial intelligence in their campaign materials.
read more
The measure would mandate a disclaimer on AI-generated political content, aimed at keeping voters from being misled by synthetic images, audio, and video. Council introduced it weeks before mail ballots reach voters for the November midterms.
Sources: TribLive · WPXI · ↑ top
Innamorato Makes Parental Leave a Campaign Plank
Latest developments: PublicSource reported Wednesday, September 9, that Allegheny County Executive Sara Innamorato's push for paid parental leave for county employees is shaping up as a signature plank of her reelection campaign.
read more
Innamorato backed paid parental leave before her own pregnancy and now presses Allegheny County Council to pass it, two days after the group Worker Speak Out marched for the measure in the Labor Day parade. Democratic officials in red and purple states are watching whether the policy carries politically.
Sources: PublicSource · ↑ top
Storms and Flooding Arrive Thursday
Latest developments: KDKA and WTAE forecast rain moving in tonight and a severe storm and flooding risk building through Thursday, September 10, which WTAE has flagged as an Impact Day.
read more
Rain with embedded storms will work from north to south across Western Pennsylvania, with the flood threat concentrated Thursday morning. The region is still cleaning up from the September 3 storms that brought a 1-in-100-year rainfall and 120,000 outages.
Sports
Pirates (72-73)
Tue Sep 8 · Pirates 9 · White Sox 3 · Final
Up Next · Pirates @ White Sox · Wed Sep 9, 7:40 PM
Steelers (0-0, T-1st in AFC North)
Up Next · Falcons @ Steelers · Sun Sep 13, 1:00 PM
Around the Teams
The Post-Gazette Picks the Season
Latest developments: The Post-Gazette staff published its 2026 NFL predictions Wednesday morning, September 9, covering the Steelers' record, the Super Bowl, and the league's individual awards.
read more
The picks land four days before the Steelers open at home against the Atlanta Falcons on Sunday, September 13, at 1 p.m. at Acrisure Stadium. Pittsburgh enters the season with Aaron Rodgers at quarterback and Mike McCarthy in his first year as head coach.
Sources: Post-Gazette Steelers · ↑ top
Khristian Curtis Nearly Lost His Arm
Latest developments: The Post-Gazette profiled Pirates pitcher Khristian Curtis on Wednesday, September 9, tracing the botched surgery that came close to costing him his throwing arm.
read more
Curtis describes every pitch he throws now as a blessing after the operation and the recovery that followed. The piece runs as the Pirates play out the final weeks of a season whose playoff odds have faded.
Sources: Post-Gazette Pirates · ↑ top
Reading
- Stratechery — OpenAI Does Math, Reward-Hacking, Meta Launches Personal Agent. Ben Thompson argues that OpenAI solving one of mathematics' famous open problems is technically impressive and nearly irrelevant to daily life, while Meta's Muse personal agent is the reverse: unglamorous and positioned to reach everyone.
- Ed Zitron — Concentration Risk. Zitron examines how much of the current market rests on a handful of AI-linked companies and the financing arrangements that tie them together, continuing the argument he built in his circular-financing series.
- Cal Newport — Wendell Berry and the Promise of the Deep Life. Newport marks the death of Wendell Berry, who died at 92 at his farm in Port Royal, Kentucky, and reads Berry's insistence on working land by traditional means as a case for a slower, more rooted life.
Markets
S&P 500 7,687.58 ▼ -0.1% Dow 53,143.05 ▼ -0.6% Nasdaq 26,366.01 ▲ +0.2% WTI crude 91.41 ▲ +9.5% EUR/USD 1.1610 ▼ -0.2% GBP/USD 1.3519 ▼ -0.5% USD/JPY 156.97 ▼ -1.6%
Feed Health
Security: 24 of 24 feeds loaded, 74 items in the 24-hour window. No recent items: Securelist (Kaspersky), Sophos News, Google Online Security Blog, Microsoft Security Blog, Google Project Zero, The DFIR Report, Kim Zetter (Zero Day), Frank on Fraud.
Pittsburgh: 9 of 9 feeds loaded, 60 items in the 48-hour window. No recent items: NEXTpittsburgh.
Business and Politics: 8 of 8 feeds loaded, 60 items in the 36-hour window.
Events: 4 of 4 feeds loaded, 6 items in the 120-hour window. No recent items: Post-Gazette Music, NEXTpittsburgh Events, NEXTpittsburgh Arts & Entertainment.
Sports media: 6 of 6 feeds loaded, 30 items in the 96-hour window.
Team USA: 3 of 3 feeds loaded, 29 items in the 72-hour window.
Reading: 3 of 3 feeds loaded, 12 items in the 336-hour window.
Markets (Yahoo Finance): 7 of 7 rows
Weather (NWS): 3 forecast periods
Scores (ESPN, plaintextsports): 2 teams via plaintextsports; mlb: ESPN failed (mlb: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nfl: ESPN failed (nfl: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nhl: ESPN failed (nhl: HTTP 403 (server: AkamaiGHost)); used plaintextsports
Summaries: 3 model call(s) served by claude-opus-5 (262s of model time; $1.63 at API list price).