================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Friday, September 11, 2026 - 7:06 AM EDT ================================================================ A suspected Russian-speaking attacker turned hundreds of AI agents loose on PaperCut print servers and compromised 395 organizations in 48 countries, while Anthropic reported Russian criminals using Claude to automate malware evasion. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets | Feed Health EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Two crews turned frontier models into labor this week, aiming hundreds of agents at PaperCut print servers and using Claude to rewrite malware until detection engines missed it. see: PaperCut Ships Maintenance Releases After AI-Agent Campaign; Criminals Point Claude at Malware Evasion * [UPDATE (new)] Intruders chained two already-patched Artifactory flaws to backdoor self-hosted JFrog servers, while UNC3569 abused Sogou Input Method to reach Windows users typing Chinese. see: Intruders Backdoor Unpatched JFrog Artifactory Servers; UNC3569 Rides Sogou Input Method to GRAYRABBIT * [UPDATE (new)] Surfshark's misconfigured test server and Trezor's 347,000-recipient Brevo phishing land as a Conti operator drew four years and Treasury pressed banks on $13 billion in scam losses. see: Surfshark Test Server and Trezor Phishing Fallout; Conti Sentence and Treasury's Scam Reporting Push * [TREND] Houthis took effective control of the Bab al-Mandeb as the IEA wrote off Hormuz for 2026 and record $6 diesel hit, with bond yields pausing before CPI. see: Houthis Take the Bab al-Mandeb; Diesel Hits $6 and the IEA Writes Off Hormuz; The Bond Rout Pauses Before the CPI * [TREND] Newport calls superintelligence a fairy tale, Zitron traces market concentration through Nvidia and OpenAI, and Ben Thompson reads Apple's faith in apps as its AI blind spot. see: Superintelligence is a Fairy Tale. But Chasing It Can Still Cause Harm.; Concentration Risk; The iPhone Duo, The Intelligent Personal Hub, Apple Watch Audio Intelligence * [UPDATE (new)] Shanksville marks 25 years since Flight 93, the North Shore weighs a season without Pirates baseball, and The Lion King opens the Broadway series at the Benedum. see: Flight 93 Marks 25 Years; The North Shore Braces for a Season Without Baseball; 'The Lion King' Opens the Broadway Season SECURITY ---------------------------------------------------------------- 1. PAPERCUT SHIPS MAINTENANCE RELEASES AFTER AI-AGENT CAMPAIGN Vulnerabilities and Exploits · [patch, zero-day, ai] Latest developments: PaperCut released maintenance releases 26.0.5, 25.0.13, and 24.1.10 that replace every emergency patch the company had pushed for the two actively exploited flaws, and GreyNoise detailed the attacker's method: a private lab holding a vulnerable copy of PaperCut NG/MF and an Active Directory domain, where the suspected Russian-speaking operator built and tested the exploit before handing the break-ins to AI agents that reached at least 440 instances at 395 organizations in 48 countries. PaperCut NG/MF runs print management for schools, universities, and enterprises worldwide, and the exploited pair chains an authentication bypass with remote code execution. Administrators should move straight to 26.0.5, 25.0.13, or 24.1.10 and hunt for unfamiliar accounts and outbound connections to 45.142.193.132. - The Hacker News: https://thehackernews.com/2026/09/papercut-replaces-emergency-patches.html - Help Net Security: https://www.helpnetsecurity.com/2026/09/11/ai-agents-papercut-ng-mf-attack-campaign/ - SecurityWeek: https://www.securityweek.com/papercut-flaws-exploited-in-ai-powered-attacks/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/ai-powered-attack-exploited-papercut-flaws-to-hack-395-organizations/ 2. SURFSHARK TEST SERVER AND TREZOR PHISHING FALLOUT Data Breaches · [breach, phishing, third-party] Latest developments: Surfshark disclosed that a configuration error left one of its internal test servers facing the internet and hackers reached the engineering material, internal configurations, and proxy servers on it; Trezor put numbers on the phishing that followed the breach at its email provider Brevo, counting 347,000 addresses targeted and 2,500 customers who clicked the malicious link; and IDScan confirmed that hackers reached customer data in its cloud platform. IDScan, the Louisiana identity verification firm that runs ID checks for car rental companies, retailers, and cannabis dispensaries, posted its acknowledgment on September 4, 2026 without naming a victim count, days after researchers tied it to a dark-web trove of 153 million driver's license scans. Trezor customers should treat any email asking for a recovery seed as theft in progress. - SecurityWeek: https://www.securityweek.com/surfshark-systems-targeted-by-hackers/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/surfshark-vpn-says-hackers-breached-internal-testing-proxy-servers/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/trezor-347-000-users-targeted-in-phishing-attacks-after-brevo-breach/ - Help Net Security: https://www.helpnetsecurity.com/2026/09/11/idscan-net-data-breach-153-million-drivers-licenses/ 3. CRIMINALS POINT CLAUDE AT MALWARE EVASION AI Security · [ai, malware, fraud] Latest developments: Anthropic reported that Russian hackers used Claude to automate malware evasion and that criminal groups increasingly attack AI vendors' own infrastructure, in one case stealing a pre-release Claude model; Microsoft's security researchers separately documented an AI-assisted business email compromise campaign that impersonates executives and sends fabricated invoices to push finance teams into ACH payment fraud. Attackers now fold commercial models into ordinary criminal work, using them to mutate malware past detection engines and to write convincing executive impersonations, and they treat the model vendors themselves as targets worth breaching. Finance teams should confirm every payment-detail change through a channel separate from email. - SecurityWeek: https://www.securityweek.com/anthropic-says-russian-hackers-used-claude-ai-to-automate-malware-evasion/ - Microsoft Security Blog: https://www.microsoft.com/en-us/security/blog/2026/09/10/protecting-organizations-ai-assisted-executive-impersonation-invoice-fraud/ 4. INTRUDERS BACKDOOR UNPATCHED JFROG ARTIFACTORY SERVERS Vulnerabilities and Exploits · [supply-chain, patch, backdoor] Latest developments: Wiz reported attacks running from August 15 through September 8, 2026 in which intruders chained two JFrog Artifactory flaws to take administrator control of self-hosted servers and plant backdoors, reaching only the servers whose operators had skipped JFrog's earlier fixes; CISA on September 10, 2026 added two MikroTik RouterOS bugs already under exploitation, CVE-2026-67277 and CVE-2026-86060, to its Known Exploited Vulnerabilities catalog. Artifactory holds the packages that software build pipelines pull from, so a backdoor there reaches every application a company ships. Operators of self-hosted Artifactory should apply JFrog's fixes, audit administrator accounts, and inspect stored artifacts for tampering. - The Hacker News: https://thehackernews.com/2026/09/attackers-chain-jfrog-artifactory-flaws.html - CISA Advisories: https://www.cisa.gov/news-events/alerts/2026/09/10/cisa-adds-two-known-exploited-vulnerabilities-catalog 5. CONTI SENTENCE AND TREASURY'S SCAM REPORTING PUSH Policy and Regulation · [ransomware, policy, fraud] Latest developments: A Ukrainian national drew four years in prison for his role in Conti ransomware attacks during 2021 and 2022, and the U.S. Department of the Treasury urged banks to file more reports on cyber-enabled scams, tallying nearly $13 billion in losses since 2023 as scam compounds expand worldwide. Treasury wants banks to feed it more detail on what happens to defrauded customers, the raw material for sanctions and seizures against the Southeast Asian and African compounds. Banks should route scam cases into suspicious activity reports rather than closing them as ordinary fraud. - BleepingComputer: https://www.bleepingcomputer.com/news/security/conti-ransomware-gang-member-sentenced-to-four-years-in-prison/ - The Record: https://therecord.media/treasury-urges-banks-report-cyber-scams 6. UNC3569 RIDES SOGOU INPUT METHOD TO GRAYRABBIT Nation-State Activity · [apt, backdoor, china] Latest developments: Gen Digital published research on September 10, 2026 showing that the China-linked group UNC3569 exploited a flaw in Sogou Input Method, the Tencent-owned tool that ranks among the most widely used ways to type Chinese characters on Windows, starting each intrusion with a crafted link and finishing with a backdoor called GRAYRABBIT that carries the logged-in user's full rights. Sogou Input Method sits on millions of Windows desktops and loads into every application that accepts typing, which makes it an unusually quiet foothold. Organizations with Chinese-language users should inventory Sogou installations and update them. - The Hacker News: https://thehackernews.com/2026/09/china-linked-unc3569-exploited-sogou.html BUSINESS AND POLITICS ---------------------------------------------------------------- * Houthis Take the Bab al-Mandeb Latest developments: The Iran-backed Houthis captured an island and a coastal town, giving them effective control of the Bab al-Mandeb chokepoint as of Friday, September 11, a step beyond the seizure of the Red Sea port of Mocha reported a day earlier. Bab al-Mandeb carries traffic between the Gulf of Aden and the Suez Canal and serves as the main alternative for cargo that can no longer transit the Strait of Hormuz. The militants now hold ground on both approaches, and traders marked up the risk to Middle East crude exports even as oil slipped Friday after the prior session's surge. - WSJ World News: https://www.wsj.com/world/middle-east/iran-backed-houthis-take-effective-control-of-bab-al-mandeb-chokepoint-0c6f4592?mod=rss_worldnews - WSJ World News: https://www.wsj.com/business/energy-oil/oil-prices-slip-after-recent-surge-amid-supply-risks-e1819c15?mod=rss_worldnews * Diesel Hits $6 and the IEA Writes Off Hormuz Latest developments: The International Energy Agency said Friday, September 11, that the Strait of Hormuz will not reopen this year and cut its 2026 global oil demand outlook by 2.5 million barrels a day, hours after U.S. retail diesel set a record at $6 a gallon. Crude trades above $100 a barrel and heads for a 10% weekly gain after the U.S.-Iran escalation and Houthi attacks on shipping and Saudi energy sites. Diesel prices set the pace for American farming, trucking, and industrial costs, and they land on households already squeezed on affordability, while Iran and the Gulf states prepare to meet on a temporary Iran-Oman shipping arrangement that regional governments hope opens a path to reopening the strait. - FT Home: https://www.ft.com/content/ab6f6433-1f23-4153-a02b-7984d14734c6?syn-25a6b1a6=1 - FT Home: https://www.ft.com/content/ebfa69a3-323b-450d-8bfd-0b12e01d2a5b?syn-25a6b1a6=1 - WSJ US Business: https://www.wsj.com/business/energy-oil/u-s-iran-escalation-to-delay-oil-flow-recovery-into-next-year-iea-says-16737455?mod=pls_whats_news_us_business_f - FT Home: https://www.ft.com/content/df2d9bcc-59f9-4122-aa4d-2020bef77e0e?syn-25a6b1a6=1 * The Bond Rout Pauses Before the CPI Latest developments: U.S. and European government bond yields edged lower Friday morning, September 11, interrupting the global selloff hours before the August U.S. consumer-price report, as traders raised the odds that the Federal Reserve lifts rates at next week's meeting. The 10-year Treasury yield sits just under 5%, the highest in nearly three years, after Treasury Secretary Scott Bessent's $6 billion buyback of 10- to 20-year paper failed to steady the market; investors call the operation far too small for the job. Gold heads for a weekly loss of more than 2%, the dollar firmed, and the climb in borrowing costs now threatens equities and the pace of the economy. - FT Home: https://www.ft.com/content/dd4cc4a0-844e-486a-b99c-b379d457019b?syn-25a6b1a6=1 - WSJ Markets: https://www.wsj.com/finance/investing/yields-on-u-s-european-government-bonds-edge-lower-but-still-hover-near-multiyear-highs-90ceba80?mod=rss_markets_main - FT Home: https://www.ft.com/content/2c9ce5b0-32ae-4460-aa89-9c80eb05ee41?syn-25a6b1a6=1 - WSJ Markets: https://www.wsj.com/finance/commodities-futures/gold-rises-ahead-of-u-s-cpi-data-c995e7d0?mod=rss_markets_main PITTSBURGH ---------------------------------------------------------------- Weather: Today: Mostly Sunny, high 82F. Tonight: Mostly Cloudy, low 64F. Saturday: Chance Showers And Thunderstorms then Slight Chance Showers And Thunderstorms, high 81F. Business: * The North Shore Braces for a Season Without Baseball Latest developments: The Post-Gazette reported Friday, September 11, on what a Major League Baseball work stoppage would cost the businesses around PNC Park if the Pirates play no games next season. Restaurants, bars, and parking operators on Pittsburgh's North Shore build their year around 81 Pirates home dates at PNC Park, and owners there now weigh staffing and revenue against the chance that the 2027 season never opens. - Pittsburgh Post-Gazette: https://www.post-gazette.com/business/career-workplace/2026/09/11/pirates-mlb-work-stoppage-north-shore-businesses/stories/202609090060 * Ranking Pittsburgh's Rankings Latest developments: Pittsburgh City Paper's Affordable-ish Housing column on Friday, September 11, went through the ranked lists the city keeps landing on and graded the lists themselves. Pittsburgh turns up on national rankings for everything from best place to live without a car to best city for good neighbors, and the column weighs which of those lists carry any weight for people deciding where to rent or buy here. - Pittsburgh City Paper: https://www.pghcitypaper.com/columns/affordable-ish-housing/affordable-ish-housing-in-pittsburgh-ranking-the-rankings-edition/ Around town: * Flight 93 Marks 25 Years Latest developments: The observance itself runs Friday, September 11, at the Flight 93 National Memorial near Shanksville, with President Trump attending a separate ceremony at the Pentagon. United Airlines Flight 93 came down in a field in Somerset County on September 11, 2001, after the 40 passengers and crew fought back, and families, first responders, and visitors gather at the memorial to read the names. WPXI spoke with Jack Grandcolas, who lost his wife and their unborn child on the flight and described how her actions guided his own recovery, and PublicSource collected readers' memories from across the region. - KDKA: https://www.cbsnews.com/pittsburgh/news/flight-93-memorial-ceremonies-today-25-years-911-attacks/ - WTAE: https://www.wtae.com/article/trump-pentagon-9-11-25th-anniversary/73683238 - WPXI: https://www.wpxi.com/news/local/man-who-lost-his-wife-unborn-child-flight-93-crash-shares-how-her-heroism-guided-him-healing/XCAKIUBSK5CAFDEZ3AO5UAEATQ/ - PublicSource: https://www.publicsource.org/pittsburgh-readers-remember-9-11-25-years/ * One Superintendent for Rochester and New Brighton Latest developments: The Post-Gazette reported Friday, September 11, on the single superintendent now running both the Rochester and New Brighton school districts in Beaver County. Two small Beaver County districts share one chief administrator, an arrangement that spreads a single salary across both payrolls and doubles the school boards, budgets, and buildings one person answers for. - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/education/2026/09/11/rochester-new-brighton-school-districts-superintendent/stories/202609100048 * Bradford Woods Sets a Meeting on Its Future Latest developments: TribLive reported Friday, September 11, that Bradford Woods will present the results of this year's community survey at a public meeting at 6 p.m. Thursday, October 1, at the Bradford Woods Volunteer Fire Company. The borough of Bradford Woods, in northern Allegheny County, surveyed residents earlier this year about what they want from the community and will use the October meeting to walk through the answers and take comment. - TribLive: https://triblive.com/local/residents-urged-to-help-shape-future-of-bradford-woods/ Events: * 'The Lion King' Opens the Broadway Season Latest developments: TribLive reviewed "Disney's The Lion King" on Friday, September 11, calling it a majestic opening to the Pittsburgh Cultural Trust's 2026-27 PNC Broadway in Pittsburgh Series at the Benedum Center downtown. The show has grossed more than $2 billion in almost 30 years on Broadway, the highest total any Broadway musical has reached, and its puppetry and staging carry the visual weight that opens the Cultural Trust's season at the Benedum Center in Pittsburgh's Cultural District. - TribLive: https://triblive.com/aande/theater-arts/review-disneys-the-lion-king-is-a-majestic-start-to-the-pnc-broadway-in-pittsburgh-series-season-at-the-benedum/ * Sketch Lab Report Returns to Arcade Comedy Latest developments: Pittsburgh City Paper previewed the third volume of Sketch Lab Report on Friday, September 11. Sketch Lab Report at Arcade Comedy Theater downtown showcases new sketch writing from the theater's writing program, and City Paper describes this round as subversive and inventive humor built by local writers. - Pittsburgh City Paper: https://www.pghcitypaper.com/arts-entertainment-2/arcade-comedy-theater-gets-sketchy-with-writing-showcase/ * Three Tours of Houses, Gardens, and a Campus Latest developments: The Post-Gazette laid out three fall tours Friday, September 11, covering old houses and gardens in the Mexican War Streets on the North Side and in Shadyside, and the historic campus and church at Saint Vincent College in Latrobe. The Mexican War Streets and Shadyside tours open private houses and gardens to visitors, and the Saint Vincent College tour walks the Benedictine campus and its church in Unity Township, Westmoreland County. - Post-Gazette Arts & Entertainment: https://www.post-gazette.com/life/homes/2026/09/11/mexican-war-streets-shadyside-saint-vincent-college-house-tours/stories/202609110004 SPORTS ---------------------------------------------------------------- Pirates (74-73) Thu Sep 10 · Pirates 2 · White Sox 0 · Final https://plaintextsports.com/mlb/2026-09-10/pit-cws Up Next · Pirates @ Cubs · Fri Sep 11, 2:20 PM https://plaintextsports.com/mlb/2026-09-11/pit-chc Steelers (0-0, T-1st in AFC North) Up Next · Falcons @ Steelers · Sun Sep 13, 1:00 PM https://plaintextsports.com/nfl/2026/week1/atl-pit Around the Teams: * Hiles Puts the Standard on McCarthy Latest developments: Post-Gazette columnist Noah Hiles wrote Friday, September 11, that setting a new Steelers standard ranks as head coach Mike McCarthy's top priority in his first season. McCarthy takes over a franchise that has gone years without a playoff win, and Hiles argues the measure of 2026 lies in the habits and expectations McCarthy installs rather than the win total, starting with Sunday's opener against the Atlanta Falcons at Acrisure Stadium. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/09/11/mike-mccarthy-debut-nfl-season-preview/stories/202609080036 * Rodgers Savors a Last Season Latest developments: The Post-Gazette reported Thursday, September 10, that quarterback Aaron Rodgers plans to savor what he calls a special season in Pittsburgh as his career winds down. Rodgers, who opens his second year with the Steelers on Sunday, September 13, against the Atlanta Falcons, has told teammates and reporters he treats this run as the end of the line, and he spoke with the media at practice Wednesday, September 9, alongside DK Metcalf, Alex Highsmith, and Eli Heidenreich a day later. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/09/10/aaron-rodgers-final-season-nfl-preview/stories/202609070026 - Pittsburgh Steelers (YouTube): https://www.youtube.com/watch?v=7QKGO68JUjs * SNR Drive Runs the Week 1 Numbers Latest developments: Matt Williamson and Wes Uhler spent Thursday's SNR Drive, September 10, on Steelers season what-ifs and Williamson's Week 1 statistical packet. The Steelers-produced show also recapped the NFL's Wednesday night kickoff, went around the college slate, and brought on a Steelers beat writer ahead of Sunday's opener against the Atlanta Falcons. - Pittsburgh Steelers (YouTube): https://www.youtube.com/watch?v=2iQJI4Zumtw READING ---------------------------------------------------------------- * Cal Newport -- Superintelligence is a Fairy Tale. But Chasing It Can Still Cause Harm. Newport answers Anthropic employees who said publicly that the systems they build could kill billions, arguing that superintelligence remains a story people tell themselves. He holds that the race toward it still does real damage, in the resources it consumes and the harms it creates along the way. https://calnewport.com/superintelligence-is-a-fairy-tale-but-chasing-it-can-still-cause-harm/ * Stratechery -- The iPhone Duo, The Intelligent Personal Hub, Apple Watch Audio Intelligence Ben Thompson reads Apple's latest launch as another demonstration of what integrating hardware and software buys the company. He names Apple's belief in the primacy of apps as its largest blind spot in an AI era that favors an intelligent personal hub. https://stratechery.com/2026/the-iphone-duo-the-intelligent-personal-hub-apple-watch-audio-intelligence/ * Ed Zitron -- Concentration Risk Zitron takes up the concentration of the market and the economy in a handful of AI companies. The piece extends his running case against the circular financing that runs among Nvidia, OpenAI, and the hyperscalers. https://www.wheresyoured.at/concentration-risk/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,673.58 ▼ -0.2% Dow 52,866.24 ▼ -0.7% Nasdaq 26,369.50 ▲ +0.2% WTI crude 94.87 ▲ +9.3% EUR/USD 1.1626 ▲ +0.2% GBP/USD 1.3538 = +0.0% USD/JPY 154.55 ▼ -3.2% FEED HEALTH ---------------------------------------------------------------- Security: 24 of 24 feeds loaded, 62 items in the 24-hour window. No recent items: Krebs on Security, Schneier on Security, Ars Technica Security, Securelist (Kaspersky), Sophos News, Unit 42 (Palo Alto), Google Online Security Blog, Google Project Zero, The DFIR Report, Kim Zetter (Zero Day), 404 Media, Frank on Fraud. Pittsburgh: 9 of 9 feeds loaded, 60 items in the 48-hour window. No recent items: NEXTpittsburgh. Business and Politics: 8 of 8 feeds loaded, 60 items in the 36-hour window. Events: 4 of 4 feeds loaded, 9 items in the 120-hour window. No recent items: NEXTpittsburgh Events, NEXTpittsburgh Arts & Entertainment. Sports media: 6 of 6 feeds loaded, 30 items in the 96-hour window. Team USA: 3 of 3 feeds loaded, 30 items in the 72-hour window. No recent items: Guardian Olympics. Reading: 3 of 3 feeds loaded, 12 items in the 336-hour window. Markets (Yahoo Finance): 7 of 7 rows Weather (NWS): 3 forecast periods Scores (ESPN, plaintextsports): 2 teams via plaintextsports; mlb: ESPN failed (mlb: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nfl: ESPN failed (nfl: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nhl: ESPN failed (nhl: HTTP 403 (server: AkamaiGHost)); used plaintextsports Summaries: 3 model call(s) served by claude-opus-5 (342s of model time; $1.78 at API list price). ================================================================ Generated 2026-09-11 07:06 EDT. Updated weekdays at about 7:05 AM, 10:05 AM, 1:35 PM, and 7:35 PM ET, and weekends at about 8:05 AM and 7:35 PM ET. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 3 Team USA feeds; WSJ World News, WSJ Markets, WSJ US Business, WSJ Politics, The Economist, FT Home, FT World, FT Markets; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN or plaintextsports.com. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================