Anthropic caught a Russia-linked espionage crew steering Claude against more than 20 government, intelligence, and defense organizations in the same week a Russian-speaking operator's AI agents finished breaking into 395 PaperCut customers.
Emerging Trends and Key Updates
- Trend A Russian-speaking operator turned hundreds of AI agents loose on PaperCut servers across 48 countries, while Anthropic disrupted a Russia-linked crew running Claude against government and defense targets.
- Update · new Cisco Talos tied three clusters exploiting CVE-2026-20079 to Qilin ransomware, as GitLab and Check Point shipped critical patches and intruders backdoored unpatched JFrog Artifactory servers.
- Update · updated A compromised Brevo marketing account pushed phishing to 347,000 Trezor addresses, and Surfshark disclosed that a misconfigured internal test server sat exposed to the open internet.
- Trend U.S. inflation held at 3.4% while diesel set a $6 record, the IEA wrote off Hormuz, and Houthi forces seized the Bab al-Mandeb.
- Trend Rosh Hashanah begins at sundown, Flight 93 marks 25 years near Shanksville, and Saturday showers threaten the weekend around the Steelers home opener.
Security
1. PaperCut Ships Maintenance Releases After AI-Agent Campaign
Latest developments: PaperCut released maintenance releases 26.0.5, 25.0.13, and 24.1.10 that replace every emergency patch the company had pushed for the two actively exploited flaws, and GreyNoise detailed the attacker's method: a private lab holding a vulnerable copy of PaperCut NG/MF and an Active Directory domain, where the suspected Russian-speaking operator built and tested the exploit before handing the break-ins to AI agents that reached at least 440 instances at 395 organizations in 48 countries.
read more
PaperCut NG/MF runs print management for schools, universities, and enterprises worldwide, and the exploited pair chains an authentication bypass with remote code execution. Administrators should move straight to 26.0.5, 25.0.13, or 24.1.10 and hunt for unfamiliar accounts and outbound connections to 45.142.193.132.
Sources: The Hacker News · Help Net Security · SecurityWeek · BleepingComputer · ↑ top
2. Surfshark Test Server and Trezor Phishing Fallout
Latest developments: Surfshark disclosed that a configuration error left one of its internal test servers facing the internet and hackers reached the engineering material, internal configurations, and proxy servers on it; Trezor put numbers on the phishing that followed the breach at its email provider Brevo, counting 347,000 addresses targeted and 2,500 customers who clicked the malicious link, and SecurityWeek reported that the same Brevo access also pushed phishing to users of BitBox and CoinTracking; IDScan confirmed that hackers reached customer data in its cloud platform.
read more
IDScan, the Louisiana identity verification firm that runs ID checks for car rental companies, retailers, and cannabis dispensaries, posted its acknowledgment on September 4, 2026 without naming a victim count, days after researchers tied it to a dark-web trove of 153 million driver's license scans. Trezor customers should treat any email asking for a recovery seed as theft in progress.
Sources: SecurityWeek · SecurityWeek · BleepingComputer · Help Net Security · ↑ top
3. Conti Sentence and Treasury's Scam Reporting Push
Latest developments: Oleksii Oleksiyovych Lytvynenko, the Ukrainian national whom Irish authorities arrested in 2023, drew four years in a U.S. prison for developing Conti ransomware, an operation that hit more than 1,000 victims worldwide before shutting down in 2022, and the U.S. Department of the Treasury urged banks to file more reports on cyber-enabled scams, tallying nearly $13 billion in losses since 2023 as scam compounds expand worldwide.
read more
Treasury wants banks to feed it more detail on what happens to defrauded customers, the raw material for sanctions and seizures against the Southeast Asian and African compounds. Banks should route scam cases into suspicious activity reports rather than closing them as ordinary fraud.
Sources: SecurityWeek · The Record · BleepingComputer · The Record · ↑ top
4. Criminals Point Claude at Malware Evasion
Latest developments: Anthropic detected and disrupted a Russia-linked cyber-espionage group that ran Claude through a hacking campaign against more than 20 government, intelligence, diplomatic, and defense organizations, part of the same disclosure in which the company described Russian criminals automating malware evasion and intruders stealing a pre-release Claude model from AI vendor infrastructure; Microsoft's security researchers separately documented an AI-assisted business email compromise campaign that impersonates executives and sends fabricated invoices to push finance teams into ACH payment fraud.
read more
Attackers now fold commercial models into ordinary espionage and criminal work, using them to mutate malware past detection engines and to write convincing executive impersonations, and they treat the model vendors themselves as targets worth breaching. Finance teams should confirm every payment-detail change through a channel separate from email.
Sources: The Record · SecurityWeek · Microsoft Security Blog · ↑ top
5. Cisco Firewall Flaws Deliver Qilin Ransomware
Latest developments: Cisco Talos named the payoff behind the three threat clusters exploiting CVE-2026-20079, the 10.0-rated authentication bypass in the Secure Firewall Management Center web interface, and CVE-2026-20316: the intruders steal credentials and then deploy Qilin ransomware, and the clusters span ransomware crews and state-sponsored operators.
read more
Secure Firewall Management Center sets policy for Cisco firewalls, so an unauthenticated bypass there hands an attacker the perimeter and the credentials the appliance holds. CISA gave federal civilian agencies until September 12, 2026 to patch; every other operator should install Cisco's fixes and rotate stored credentials now.
Sources: The Hacker News · BleepingComputer · ↑ top
6. GitLab and Check Point Ship Critical Patches
Latest developments: GitLab told customers on September 10, 2026 to patch their servers immediately against CVE-2026-85706, a maximum-severity path traversal flaw, and Check Point assigned CVE-2026-85102 and CVE-2026-85103 to the two critical VPN certificate handling flaws in its Security Gateways and Security Management products that yield remote code execution.
read more
GitLab holds the source code and continuous integration pipelines of the companies that run it, and Check Point gateways terminate corporate VPN traffic, so both sit where one flaw opens everything behind it. Administrators should apply each vendor's fix immediately.
Sources: BleepingComputer · SecurityWeek · ↑ top
7. Intruders Backdoor Unpatched JFrog Artifactory Servers
Latest developments: Wiz reported attacks running from August 15 through September 8, 2026 in which intruders chained two JFrog Artifactory flaws to take administrator control of self-hosted servers and plant backdoors, reaching only the servers whose operators had skipped JFrog's earlier fixes; CISA on September 10, 2026 added two MikroTik RouterOS bugs already under exploitation, CVE-2026-67277 and CVE-2026-86060, to its Known Exploited Vulnerabilities catalog.
read more
Artifactory holds the packages that software build pipelines pull from, so a backdoor there reaches every application a company ships. Operators of self-hosted Artifactory should apply JFrog's fixes, audit administrator accounts, and inspect stored artifacts for tampering.
Sources: The Hacker News · CISA Advisories · ↑ top
8. UNC3569 Rides Sogou Input Method to GRAYRABBIT
Latest developments: Gen Digital published research on September 10, 2026 showing that the China-linked group UNC3569 exploited a flaw in Sogou Input Method, the Tencent-owned tool that ranks among the most widely used ways to type Chinese characters on Windows, starting each intrusion with a crafted link and finishing with a backdoor called GRAYRABBIT that carries the logged-in user's full rights.
read more
Sogou Input Method sits on millions of Windows desktops and loads into every application that accepts typing, which makes it an unusually quiet foothold. Organizations with Chinese-language users should inventory Sogou installations and update them.
Sources: The Hacker News · ↑ top
9. A Few Dollars Kicks a Stranger's Phone Off the Network
Latest developments: Researchers at Michigan State University and three partner schools bought a Samsung Galaxy Z Fold 7, copied the identification number printed on the sealed box, reported the handset to its carrier as lost, and then found that the phone, still new and sitting on a lab bench, refused to connect, one of six weaknesses they found in how carriers process lost-phone reports.
read more
Anyone who reads a handset's identifier off a box, a receipt, or a repair ticket can knock that phone off the cellular network for a few dollars, with no access to the device or the account. Carriers hold the fix: verify that whoever reports a loss actually controls the line.
Sources: Help Net Security · ↑ top
Business and Politics
August CPI Holds at 3.4%
Latest developments: The Labor Department reported Friday morning, September 11, that U.S. consumer prices rose 3.4% over the year in August, matching forecasts, and traders lifted the odds of a Federal Reserve rate increase at the September 16 meeting to 87%.
read more
High fuel costs hold the headline rate well above the Federal Reserve's 2% target, with crude above $100 a barrel and retail diesel at a record $6 a gallon. U.S. stocks rose on the print, reading a rate increase as a check on inflation, and the dollar climbed to a one-week high against a basket of currencies.
Sources: FT Home · WSJ Markets · WSJ Markets · WSJ Markets · ↑ top
Houthis Take the Bab al-Mandeb
Latest developments: The Iran-backed Houthis seized Red Sea islands and a coastal town in a lightning offensive against Saudi-backed forces, giving them effective control of the Bab al-Mandeb chokepoint as of Friday, September 11, a step beyond the seizure of the Red Sea port of Mocha reported a day earlier.
read more
Bab al-Mandeb carries traffic between the Gulf of Aden and the Suez Canal and serves as the main alternative for cargo that can no longer transit the Strait of Hormuz. The militants now hold ground on both approaches, and traders marked up the risk to Middle East crude exports even as oil slipped Friday after the prior session's surge.
Sources: WSJ World News · FT Home · WSJ World News · ↑ top
Diesel Hits $6 and the IEA Writes Off Hormuz
Latest developments: The International Energy Agency said Friday, September 11, that the Strait of Hormuz will not reopen this year and cut its 2026 global oil demand outlook by 2.5 million barrels a day, hours after U.S. retail diesel set a record at $6 a gallon.
read more
Crude trades above $100 a barrel and heads for a 10% weekly gain after the U.S.-Iran escalation and Houthi attacks on shipping and Saudi energy sites. Diesel prices set the pace for American farming, trucking, and industrial costs, and they land on households already squeezed on affordability, while Iran and the Gulf states prepare to meet on a temporary Iran-Oman shipping arrangement that regional governments hope opens a path to reopening the strait.
Sources: FT World · FT Home · WSJ US Business · FT Home · ↑ top
The Bond Rout Pauses Before the CPI
Latest developments: U.S. and European government bond yields edged lower Friday, September 11, as oil prices fell and the August inflation print landed in line with forecasts, interrupting the global selloff, though German borrowing costs reached their highest level since 2009.
read more
The 10-year Treasury yield sits just under 5%, the highest in nearly three years, after Treasury Secretary Scott Bessent's $6 billion buyback of 10- to 20-year paper failed to steady the market; investors call the operation far too small for the job. Gold heads for a weekly loss, the dollar firmed, and the climb in borrowing costs now threatens equities and the pace of the economy.
Sources: FT Home · FT World · WSJ Markets · ↑ top
Pittsburgh
Weather
Today: Mostly Sunny, high 82F.
Tonight: Mostly Cloudy, low 64F.
Saturday: Chance Showers And Thunderstorms then Slight Chance Showers And Thunderstorms, high 81F.
Business
Diesel Tops $6 a Gallon
Latest developments: WTAE reported Friday, September 11, that the price of diesel passed $6 a gallon for the first time.
read more
Trucks, trains, and farm equipment burn diesel, so the record price works into the delivered cost of nearly everything Western Pennsylvania households buy, and it follows the disruption of crude supply from the Iran conflict that has also pushed regional gasoline well above last year's levels.
The North Shore Braces for a Season Without Baseball
Latest developments: The Post-Gazette reported Friday, September 11, on what a Major League Baseball work stoppage would cost the businesses around PNC Park if the Pirates play no games next season.
read more
Restaurants, bars, and parking operators on Pittsburgh's North Shore build their year around 81 Pirates home dates at PNC Park, and owners there now weigh staffing and revenue against the chance that the 2027 season never opens.
Sources: Pittsburgh Post-Gazette · ↑ top
Ranking Pittsburgh's Rankings
Latest developments: Pittsburgh City Paper's Affordable-ish Housing column on Friday, September 11, went through the ranked lists the city keeps landing on and graded the lists themselves.
read more
Pittsburgh turns up on national rankings for everything from best place to live without a car to best city for good neighbors, and the column weighs which of those lists carry any weight for people deciding where to rent or buy here.
Sources: Pittsburgh City Paper · ↑ top
Around Town
Rain Returns for the Weekend
Latest developments: Forecasters gave the region sunshine Friday, September 11, then flagged Saturday, September 12, as an Impact Day for afternoon showers, with scattered rain lingering into Sunday and the Steelers' home opener.
read more
WTAE expects Western Pennsylvania to dry out Friday before showers return Saturday afternoon, and KDKA meteorologist Ron Smiley has scattered rain hanging around through Sunday, September 13, when the Steelers host the Atlanta Falcons at Acrisure Stadium.
Rosh Hashanah Begins at Sundown
Latest developments: Rosh Hashanah starts at sundown Friday, September 11, and runs until sunset Sunday, September 13, opening the Jewish high holidays.
read more
TribLive's editorial board marked the new year Friday, September 11, and the Post-Gazette published the story of a 1952 Rosh Hashana service at Tree of Life, recorded voices sealed in a time capsule that carry the Squirrel Hill congregation's history. The Jewish Federation of Greater Pittsburgh expanded security across regional Jewish institutions ahead of the holiday.
Sources: TribLive · Pittsburgh Post-Gazette · ↑ top
Flight 93 Marks 25 Years
Latest developments: The observance itself runs Friday, September 11, at the Flight 93 National Memorial near Shanksville, with President Trump attending a separate ceremony at the Pentagon.
read more
United Airlines Flight 93 came down in a field in Somerset County on September 11, 2001, after the 40 passengers and crew fought back, and families, first responders, and visitors gather at the memorial to read the names. WPXI spoke with Jack Grandcolas, who lost his wife and their unborn child on the flight and described how her actions guided his own recovery, and PublicSource collected readers' memories from across the region.
Sources: KDKA · WTAE · WPXI · PublicSource · ↑ top
One Superintendent for Rochester and New Brighton
Latest developments: The Post-Gazette reported Friday, September 11, on the single superintendent now running both the Rochester and New Brighton school districts in Beaver County.
read more
Two small Beaver County districts share one chief administrator, an arrangement that spreads a single salary across both payrolls and doubles the school boards, budgets, and buildings one person answers for.
Sources: Pittsburgh Post-Gazette · ↑ top
Bradford Woods Sets a Meeting on Its Future
Latest developments: TribLive reported Friday, September 11, that Bradford Woods will present the results of this year's community survey at a public meeting at 6 p.m. Thursday, October 1, at the Bradford Woods Volunteer Fire Company.
read more
The borough of Bradford Woods, in northern Allegheny County, surveyed residents earlier this year about what they want from the community and will use the October meeting to walk through the answers and take comment.
Events
Five Things to Do in Westmoreland County
Latest developments: TribLive published its Westmoreland County weekend list Friday, September 11, covering Friday, September 11, through Sunday, September 13.
read more
The guide lays out five events across Westmoreland County for the weekend, offered as a way to fill the hours before the Steelers open the regular season Sunday.
'The Lion King' Opens the Broadway Season
Latest developments: TribLive reviewed "Disney's The Lion King" on Friday, September 11, calling it a majestic opening to the Pittsburgh Cultural Trust's 2026-27 PNC Broadway in Pittsburgh Series at the Benedum Center downtown.
read more
The show has grossed more than $2 billion in almost 30 years on Broadway, the highest total any Broadway musical has reached, and its puppetry and staging carry the visual weight that opens the Cultural Trust's season at the Benedum Center in Pittsburgh's Cultural District.
Sketch Lab Report Returns to Arcade Comedy
Latest developments: Pittsburgh City Paper previewed the third volume of Sketch Lab Report on Friday, September 11.
read more
Sketch Lab Report at Arcade Comedy Theater downtown showcases new sketch writing from the theater's writing program, and City Paper describes this round as subversive and inventive humor built by local writers.
Sources: Pittsburgh City Paper · ↑ top
Three Tours of Houses, Gardens, and a Campus
Latest developments: The Post-Gazette laid out three fall tours Friday, September 11, covering old houses and gardens in the Mexican War Streets on the North Side and in Shadyside, and the historic campus and church at Saint Vincent College in Latrobe.
read more
The Mexican War Streets and Shadyside tours open private houses and gardens to visitors, and the Saint Vincent College tour walks the Benedictine campus and its church in Unity Township, Westmoreland County.
Sources: Post-Gazette Arts & Entertainment · ↑ top
Sports
Pirates (74-73)
Thu Sep 10 · Pirates 2 · White Sox 0 · Final
Up Next · Pirates @ Cubs · Fri Sep 11, 2:20 PM
Steelers (0-0, T-1st in AFC North)
Up Next · Falcons @ Steelers · Sun Sep 13, 1:00 PM
Around the Teams
Fittipaldo and McCarthy Close Out Week 1 Prep
Latest developments: Post-Gazette beat writer Ray Fittipaldo posted his Steelers chat transcript Thursday, September 10, and head coach Mike McCarthy met the media the same day before practice.
read more
Fittipaldo took reader questions on the Week 1 roster and the Atlanta matchup, and McCarthy spoke on the Steelers' own channel three days before kickoff. The Steelers host the Falcons at 1 p.m. Sunday, September 13, on FOX.
Sources: Post-Gazette Steelers · Pittsburgh Steelers (YouTube) · ↑ top
Hiles Puts the Standard on McCarthy
Latest developments: Post-Gazette columnist Noah Hiles wrote Friday, September 11, that setting a new Steelers standard ranks as head coach Mike McCarthy's top priority in his first season.
read more
McCarthy takes over a franchise that has gone years without a playoff win, and Hiles argues the measure of 2026 lies in the habits and expectations McCarthy installs rather than the win total, starting with Sunday's opener against the Atlanta Falcons at Acrisure Stadium.
Sources: Post-Gazette Steelers · ↑ top
Rodgers Savors a Last Season
Latest developments: The Post-Gazette reported Thursday, September 10, that quarterback Aaron Rodgers plans to savor what he calls a special season in Pittsburgh as his career winds down.
read more
Rodgers, who opens his second year with the Steelers on Sunday, September 13, against the Atlanta Falcons, has told teammates and reporters he treats this run as the end of the line, and he spoke with the media at practice Wednesday, September 9, alongside DK Metcalf, Alex Highsmith, and Eli Heidenreich a day later.
Sources: Post-Gazette Steelers · Pittsburgh Steelers (YouTube) · ↑ top
SNR Drive Runs the Week 1 Numbers
Latest developments: Matt Williamson and Wes Uhler spent Thursday's SNR Drive, September 10, on Steelers season what-ifs and Williamson's Week 1 statistical packet.
read more
The Steelers-produced show also recapped the NFL's Wednesday night kickoff, went around the college slate, and brought on a Steelers beat writer ahead of Sunday's opener against the Atlanta Falcons.
Sources: Pittsburgh Steelers (YouTube) · ↑ top
Team USA
The Next Wave of U.S. Men's Players
Latest developments: ESPN surveyed Friday, September 11, the American men who missed this year's World Cup squad and now aim at the 2030 tournament.
read more
Diego Luna and Yunus Musah lead a group of five United States players in their twenties whom ESPN identifies as candidates for a larger national team role in the next World Cup cycle.
Sources: ESPN Soccer · ↑ top
Reading
- Cal Newport — Superintelligence is a Fairy Tale. But Chasing It Can Still Cause Harm.. Newport answers Anthropic employees who said publicly that the systems they build could kill billions, arguing that superintelligence remains a story people tell themselves. He holds that the race toward it still does real damage, in the resources it consumes and the harms it creates along the way.
- Stratechery — The iPhone Duo, The Intelligent Personal Hub, Apple Watch Audio Intelligence. Ben Thompson reads Apple's latest launch as another demonstration of what integrating hardware and software buys the company. He names Apple's belief in the primacy of apps as its largest blind spot in an AI era that favors an intelligent personal hub.
- Ed Zitron — Concentration Risk. Zitron takes up the concentration of the market and the economy in a handful of AI companies. The piece extends his running case against the circular financing that runs among Nvidia, OpenAI, and the hyperscalers.
Markets
S&P 500 7,673.58 ▼ -0.2% Dow 52,866.24 ▼ -0.7% Nasdaq 26,369.50 ▲ +0.2% WTI crude 94.87 ▲ +9.3% EUR/USD 1.1626 ▲ +0.2% GBP/USD 1.3538 = +0.0% USD/JPY 154.55 ▼ -3.2%
Feed Health
Security: 24 of 24 feeds loaded, 55 items in the 24-hour window. No recent items: Krebs on Security, CISA Advisories, Securelist (Kaspersky), Sophos News, Unit 42 (Palo Alto), Google Online Security Blog, Graham Cluley, Google Project Zero, The DFIR Report, Kim Zetter (Zero Day), Frank on Fraud.
Pittsburgh: 9 of 9 feeds loaded, 60 items in the 48-hour window. No recent items: NEXTpittsburgh.
Business and Politics: 8 of 8 feeds loaded, 60 items in the 36-hour window.
Events: 4 of 4 feeds loaded, 9 items in the 120-hour window. No recent items: NEXTpittsburgh Events, NEXTpittsburgh Arts & Entertainment.
Sports media: 6 of 6 feeds loaded, 30 items in the 96-hour window.
Team USA: 3 of 3 feeds loaded, 31 items in the 72-hour window. No recent items: Guardian Olympics.
Reading: 3 of 3 feeds loaded, 12 items in the 336-hour window.
Markets (Yahoo Finance): 7 of 7 rows
Weather (NWS): 3 forecast periods
Scores (ESPN, plaintextsports): 2 teams via plaintextsports; mlb: ESPN failed (mlb: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nfl: ESPN failed (nfl: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nhl: ESPN failed (nhl: HTTP 403 (server: AkamaiGHost)); used plaintextsports
Summaries: 3 model call(s) served by claude-opus-5 (346s of model time; $1.95 at API list price).