================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Friday, September 11, 2026 - 1:36 PM EDT ================================================================ Anthropic's threat report and the PaperCut swarm show attackers handing whole intrusion workflows to commercial AI models, while maximum-severity flaws in GitLab, Cisco, and JFrog Artifactory draw exploitation within hours of disclosure. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets | Feed Health EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Huntress found malware lures hidden inside weaponized Claude Artifacts and shared chat transcripts as Anthropic named its Generative Threat Groups, one aligned with Russia's Midnight Blizzard. see: Attackers Turn AI Platforms Into Delivery Infrastructure; Criminals Point Claude at Malware Evasion * [UPDATE (updated)] PaperCut shipped maintenance releases 26.0.5, 25.0.13, and 24.1.10 replacing every emergency patch after an operator turned AI agents loose on 395 organizations across 48 countries. see: PaperCut Ships Maintenance Releases After AI-Agent Campaign * [TREND] Attackers spent the week inside the software factory, planting a Rust backdoor on unpatched JFrog Artifactory servers and probing GitLab's 10.0-rated path traversal bug hours after disclosure. see: Intruders Backdoor Unpatched JFrog Artifactory Servers; GitLab and Check Point Ship Critical Patches * [UPDATE (updated)] Sophos tied a Qilin ransomware cluster hitting Cisco firewalls to Cyclops Blink, the modular implant Russia's Sandworm group once deployed against network devices, now rebuilt with new capabilities. see: Cisco Firewall Flaws Deliver Qilin Ransomware * [TREND] Diesel topped $6 a gallon as August CPI held at 3.4% and the IEA said the Strait of Hormuz will not reopen this year. see: Diesel Tops $6 a Gallon; August CPI Holds at 3.4%; Diesel Hits $6 and the IEA Writes Off Hormuz * [UPDATE (new)] Flight 93 marked 25 years at Shanksville, the CDC declared the record cyclosporiasis outbreak over, and Wildwood Road in Hampton flooded again after a wet summer. see: Flight 93 Marks 25 Years; Cyclospora Outbreak Declared Over; Wildwood Road Floods Again in Hampton SECURITY ---------------------------------------------------------------- 1. CRIMINALS POINT CLAUDE AT MALWARE EVASION AI Security · [ai, malware, fraud] Latest developments: Anthropic published the full threat report behind yesterday's disclosure, naming the clusters Generative Threat Groups and covering December 2025 through August 2026: GTG-20006, which aligns with the Russian state-sponsored group Midnight Blizzard, used Claude to rebuild malware each time defenders detected it and ran the campaign against more than 20 government, intelligence, diplomatic, and defense organizations; other groups used the models for weapons design, propaganda, and mass surveillance; criminals breached AI vendor infrastructure and stole a pre-release Claude model; and Anthropic separately disrupted industrial-scale distillation attacks from seven China-based labs, among them Alibaba, Moonshot, DeepSeek, Z.ai, and MiniMax, that pumped its models to extract capabilities into their own. Attackers now fold commercial models into ordinary espionage and criminal work, using them to mutate malware past detection engines and to write convincing executive impersonations, and they treat the model vendors themselves as targets worth breaching. Finance teams should confirm every payment-detail change through a channel separate from email. - The Hacker News: https://thehackernews.com/2026/09/anthropic-says-seven-china-based-ai.html - The Hacker News: https://thehackernews.com/2026/09/russian-state-sponsored-hackers-use.html - SecurityWeek: https://www.securityweek.com/anthropic-says-russian-hackers-used-claude-ai-to-automate-malware-evasion/ - Microsoft Security Blog: https://www.microsoft.com/en-us/security/blog/2026/09/10/protecting-organizations-ai-assisted-executive-impersonation-invoice-fraud/ 2. PAPERCUT SHIPS MAINTENANCE RELEASES AFTER AI-AGENT CAMPAIGN Vulnerabilities and Exploits · [patch, zero-day, ai] Latest developments: PaperCut released maintenance releases 26.0.5, 25.0.13, and 24.1.10 that replace every emergency patch the company had pushed for the two actively exploited flaws, and GreyNoise detailed the attacker's method: a private lab holding a vulnerable copy of PaperCut NG/MF and an Active Directory domain, where the suspected Russian-speaking operator built and tested the exploit before handing the break-ins to AI agents that reached at least 440 instances at 395 organizations in 48 countries; Dark Reading traced the agents through the whole kill chain, from staging the lab to reconnaissance, lateral movement, and exfiltration. PaperCut NG/MF runs print management for schools, universities, and enterprises worldwide, and the exploited pair chains an authentication bypass with remote code execution. Administrators should move straight to 26.0.5, 25.0.13, or 24.1.10 and hunt for unfamiliar accounts and outbound connections to 45.142.193.132. - The Hacker News: https://thehackernews.com/2026/09/papercut-replaces-emergency-patches.html - Help Net Security: https://www.helpnetsecurity.com/2026/09/11/ai-agents-papercut-ng-mf-attack-campaign/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/ai-powered-attack-exploited-papercut-flaws-to-hack-395-organizations/ - Dark Reading: https://www.darkreading.com/cyberattacks-data-breaches/papercut-ai-swarm-attack-cyber-kill-chain 3. GITLAB AND CHECK POINT SHIP CRITICAL PATCHES Vulnerabilities and Exploits · [patch, rce] Latest developments: Attackers began probing GitLab's CVE-2026-85706 in the wild within hours of the September 10, 2026 disclosure, a 10.0-rated path traversal bug in the repository commits API that lets an unauthenticated user read any file on the GitLab server; Check Point assigned CVE-2026-85102 and CVE-2026-85103 to the two critical VPN certificate handling flaws in its Security Gateways and Security Management products that yield remote code execution. GitLab holds the source code and continuous integration pipelines of the companies that run it, and Check Point gateways terminate corporate VPN traffic, so both sit where one flaw opens everything behind it. Administrators should apply each vendor's fix immediately. - The Hacker News: https://thehackernews.com/2026/09/gitlab-cvss-10-file-read-flaw-draws-in.html - SecurityWeek: https://www.securityweek.com/gitlab-vulnerability-exploited-one-day-after-disclosure/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/gitlab-urges-users-to-patch-max-severity-path-traversal-flaw/ - SecurityWeek: https://www.securityweek.com/check-point-patches-critical-vpn-vulnerabilities/ 4. SURFSHARK TEST SERVER AND TREZOR PHISHING FALLOUT Data Breaches · [breach, phishing, third-party] Latest developments: Surfshark disclosed that a configuration error left one of its internal test servers facing the internet and hackers reached the engineering material, internal configurations, and proxy servers on it; Trezor put numbers on the phishing that followed the breach at its email provider Brevo, counting 347,000 addresses targeted and 2,500 customers who clicked the malicious link, and SecurityWeek reported that the same Brevo access also pushed phishing to users of BitBox and CoinTracking; IDScan confirmed that hackers reached customer data in its cloud platform. IDScan, the Louisiana identity verification firm that runs ID checks for car rental companies, retailers, and cannabis dispensaries, posted its acknowledgment on September 4, 2026 without naming a victim count, days after researchers tied it to a dark-web trove of 153 million driver's license scans. Trezor customers should treat any email asking for a recovery seed as theft in progress. - SecurityWeek: https://www.securityweek.com/surfshark-systems-targeted-by-hackers/ - SecurityWeek: https://www.securityweek.com/trezor-says-347000-users-received-phishing-emails-after-brevo-hack/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/trezor-347-000-users-targeted-in-phishing-attacks-after-brevo-breach/ - Help Net Security: https://www.helpnetsecurity.com/2026/09/11/idscan-net-data-breach-153-million-drivers-licenses/ 5. CONTI SENTENCE AND TREASURY'S SCAM REPORTING PUSH Policy and Regulation · [ransomware, policy, fraud] Latest developments: Oleksii Oleksiyovych Lytvynenko, the Ukrainian national whom Irish authorities arrested in 2023, drew four years in a U.S. prison for developing Conti ransomware, an operation that hit more than 1,000 victims worldwide before shutting down in 2022, and the U.S. Department of the Treasury urged banks to file more reports on cyber-enabled scams, tallying nearly $13 billion in losses since 2023 as scam compounds expand worldwide. Treasury wants banks to feed it more detail on what happens to defrauded customers, the raw material for sanctions and seizures against the Southeast Asian and African compounds. Banks should route scam cases into suspicious activity reports rather than closing them as ordinary fraud. - SecurityWeek: https://www.securityweek.com/ukrainian-conti-ransomware-developer-sentenced-to-4-years-in-us-prison/ - The Record: https://therecord.media/conti-ransomware-ukraine-hacker - BleepingComputer: https://www.bleepingcomputer.com/news/security/conti-ransomware-gang-member-sentenced-to-four-years-in-prison/ - The Record: https://therecord.media/treasury-urges-banks-report-cyber-scams 6. CISCO FIREWALL FLAWS DELIVER QILIN RANSOMWARE Vulnerabilities and Exploits · [ransomware, patch, zero-day] Latest developments: Sophos identified the malware riding one of the intrusion clusters as Cyclops Blink, the modular implant Russia's Sandworm group deployed against network devices years ago, now rebuilt with new capabilities and aimed at Cisco Secure Firewall Management Center appliances; Cisco Talos had already named the payoff behind the three clusters exploiting CVE-2026-20079, the 10.0-rated authentication bypass in the Secure Firewall Management Center web interface, and CVE-2026-20316, which steal credentials and then deploy Qilin ransomware. Secure Firewall Management Center sets policy for Cisco firewalls, so an unauthenticated bypass there hands an attacker the perimeter and the credentials the appliance holds. CISA gave federal civilian agencies until September 12, 2026 to patch; every other operator should install Cisco's fixes and rotate stored credentials now. - The Hacker News: https://thehackernews.com/2026/09/cisco-fmc-flaws-exploited-to-steal.html - BleepingComputer: https://www.bleepingcomputer.com/news/security/cisco-fmc-flaws-exploited-by-ransomware-gang-state-sponsored-hackers/ - Sophos News: https://www.sophos.com/en-us/blog/-eye-spy-cyclops-blink-returns-with-extended-capabilities 7. INTRUDERS BACKDOOR UNPATCHED JFROG ARTIFACTORY SERVERS Vulnerabilities and Exploits · [supply-chain, patch, backdoor] Latest developments: BleepingComputer identified the payload the intruders plant on self-hosted Artifactory servers as a Rust backdoor, reached by chaining a critical authentication bypass with a high-severity flaw to gain administrative privileges; Wiz dated the attacks from August 15 through September 8, 2026 and found they reached only the servers whose operators had skipped JFrog's earlier fixes, and CISA on September 10, 2026 added two MikroTik RouterOS bugs already under exploitation, CVE-2026-67277 and CVE-2026-86060, to its Known Exploited Vulnerabilities catalog. Artifactory holds the packages that software build pipelines pull from, so a backdoor there reaches every application a company ships. Operators of self-hosted Artifactory should apply JFrog's fixes, audit administrator accounts, and inspect stored artifacts for tampering. - The Hacker News: https://thehackernews.com/2026/09/attackers-chain-jfrog-artifactory-flaws.html - BleepingComputer: https://www.bleepingcomputer.com/news/security/artifactory-flaws-chained-in-attacks-deploying-backdoor-malware/ - CISA Advisories: https://www.cisa.gov/news-events/alerts/2026/09/10/cisa-adds-two-known-exploited-vulnerabilities-catalog 8. ATTACKERS TURN AI PLATFORMS INTO DELIVERY INFRASTRUCTURE AI Security · [ai, phishing, malware] Latest developments: Huntress documented criminals hosting malware lures inside weaponized Claude Artifacts, shared AI chat transcripts, and sponsored search results, poisoning search results for people looking for AI tools and pushing ClickFix-style prompts; the SANS Internet Storm Center traced an attacker running a semi-autonomous coding agent that hunts poorly secured large language model resale gateways, farms accounts and exploits ordinary web flaws to take API access, validates the capacity, and aggregates the stolen inference behind a gateway of their own; and Ars Technica reported ClickFix infections spreading on both Windows and macOS. ClickFix tells a victim to paste a command into a terminal or Run dialog to fix a fake error, and the lure now arrives dressed as legitimate AI content on platforms users already trust. Tell staff to treat any web page that asks them to paste a command as an attack, and check whether your own LLM gateways demand authentication. - BleepingComputer: https://www.bleepingcomputer.com/news/security/how-threat-actors-are-turning-trusted-ai-platforms-into-an-attack-surface/ - Ars Technica Security: https://arstechnica.com/security/2026/09/clickfix-attacks-infecting-pcs-and-macs-are-going-viral/ - SANS Internet Storm Center: https://isc.sans.edu/diary/rss/33332 9. UNC3569 RIDES SOGOU INPUT METHOD TO GRAYRABBIT Nation-State Activity · [apt, backdoor, china] Latest developments: Gen Digital published research on September 10, 2026 showing that the China-linked group UNC3569 exploited a flaw in Sogou Input Method, the Tencent-owned tool that ranks among the most widely used ways to type Chinese characters on Windows, starting each intrusion with a crafted link and finishing with a backdoor called GRAYRABBIT that carries the logged-in user's full rights. Sogou Input Method sits on millions of Windows desktops and loads into every application that accepts typing, which makes it an unusually quiet foothold. Organizations with Chinese-language users should inventory Sogou installations and update them. - The Hacker News: https://thehackernews.com/2026/09/china-linked-unc3569-exploited-sogou.html 10. A FEW DOLLARS KICKS A STRANGER'S PHONE OFF THE NETWORK Vulnerabilities and Exploits · [mobile, research] Latest developments: Researchers at Michigan State University and three partner schools bought a Samsung Galaxy Z Fold 7, copied the identification number printed on the sealed box, reported the handset to its carrier as lost, and then found that the phone, still new and sitting on a lab bench, refused to connect, one of six weaknesses they found in how carriers process lost-phone reports. Anyone who reads a handset's identifier off a box, a receipt, or a repair ticket can knock that phone off the cellular network for a few dollars, with no access to the device or the account. Carriers hold the fix: verify that whoever reports a loss actually controls the line. - Help Net Security: https://www.helpnetsecurity.com/2026/09/11/cellular-network-lost-phone-reporting/ BUSINESS AND POLITICS ---------------------------------------------------------------- * August CPI Holds at 3.4% Latest developments: The Labor Department reported Friday morning, September 11, that U.S. consumer prices rose 3.4% over the year in August, matching forecasts, and traders lifted the odds of a Federal Reserve rate increase at the September 16 meeting to 87%. High fuel costs hold the headline rate well above the Federal Reserve's 2% target, with crude above $100 a barrel and retail diesel at a record $6 a gallon. U.S. stocks rose on the print, reading a rate increase as a check on inflation, and the dollar climbed to a one-week high against a basket of currencies. - FT Home: https://www.ft.com/content/24646e74-9506-4718-b1be-789208db86d9?syn-25a6b1a6=1 - WSJ Markets: https://www.wsj.com/livecoverage/stock-market-cpi-inflation-09-11-2026?mod=rss_markets_main - WSJ Markets: https://www.wsj.com/finance/stocks/stock-futures-nudge-up-yields-slip-but-markets-remain-on-edge-035097c4?mod=rss_markets_main - WSJ Markets: https://www.wsj.com/finance/currencies/asian-currencies-consolidate-but-haven-demand-for-dollar-may-weigh-a563ed11?mod=rss_markets_main * Houthis Take the Bab al-Mandeb Latest developments: The Iran-backed Houthis seized Red Sea islands and a coastal town in a lightning offensive against Saudi-backed forces, giving them effective control of the Bab al-Mandeb chokepoint as of Friday, September 11, a step beyond the seizure of the Red Sea port of Mocha reported a day earlier. Bab al-Mandeb carries traffic between the Gulf of Aden and the Suez Canal and serves as the main alternative for cargo that can no longer transit the Strait of Hormuz. The militants now hold ground on both approaches, and traders marked up the risk to Middle East crude exports even as oil slipped Friday after the prior session's surge. - WSJ World News: https://www.wsj.com/world/middle-east/iran-backed-houthis-take-effective-control-of-bab-al-mandeb-chokepoint-0c6f4592?mod=rss_worldnews - FT Home: https://www.ft.com/content/976fa0d6-ed09-4a6f-be02-ff4317b45f40?syn-25a6b1a6=1 - WSJ World News: https://www.wsj.com/business/energy-oil/oil-prices-slip-after-recent-surge-amid-supply-risks-e1819c15?mod=rss_worldnews * Diesel Hits $6 and the IEA Writes Off Hormuz Latest developments: The International Energy Agency said Friday, September 11, that the Strait of Hormuz will not reopen this year and cut its 2026 global oil demand outlook by 2.5 million barrels a day, hours after U.S. retail diesel set a record at $6 a gallon. Crude trades above $100 a barrel and heads for a 10% weekly gain after the U.S.-Iran escalation and Houthi attacks on shipping and Saudi energy sites. Diesel prices set the pace for American farming, trucking, and industrial costs, and they land on households already squeezed on affordability, while Iran and the Gulf states prepare to meet on a temporary Iran-Oman shipping arrangement that regional governments hope opens a path to reopening the strait. - FT World: https://www.ft.com/content/ab6f6433-1f23-4153-a02b-7984d14734c6?syn-25a6b1a6=1 - FT Home: https://www.ft.com/content/ebfa69a3-323b-450d-8bfd-0b12e01d2a5b?syn-25a6b1a6=1 - WSJ US Business: https://www.wsj.com/business/energy-oil/u-s-iran-escalation-to-delay-oil-flow-recovery-into-next-year-iea-says-16737455?mod=pls_whats_news_us_business_f - FT Home: https://www.ft.com/content/df2d9bcc-59f9-4122-aa4d-2020bef77e0e?syn-25a6b1a6=1 * The Bond Rout Pauses Before the CPI Latest developments: U.S. and European government bond yields edged lower Friday, September 11, as oil prices fell and the August inflation print landed in line with forecasts, interrupting the global selloff, though German borrowing costs reached their highest level since 2009. The 10-year Treasury yield sits just under 5%, the highest in nearly three years, after Treasury Secretary Scott Bessent's $6 billion buyback of 10- to 20-year paper failed to steady the market; investors call the operation far too small for the job. Gold heads for a weekly loss, the dollar firmed, and the climb in borrowing costs now threatens equities and the pace of the economy. - FT Home: https://www.ft.com/content/dd4cc4a0-844e-486a-b99c-b379d457019b?syn-25a6b1a6=1 - FT World: https://www.ft.com/content/2c9ce5b0-32ae-4460-aa89-9c80eb05ee41?syn-25a6b1a6=1 - WSJ Markets: https://www.wsj.com/finance/commodities-futures/gold-rises-ahead-of-u-s-cpi-data-c995e7d0?mod=rss_markets_main PITTSBURGH ---------------------------------------------------------------- Weather: This Afternoon: Sunny, high 82F. Tonight: Mostly Cloudy, low 64F. Saturday: Slight Chance Showers And Thunderstorms, high 81F. Business: * A New Operator for the Convention Center Latest developments: The Sports and Exhibition Authority voted unanimously Friday, September 11, to approve a new contract for managing and operating the David L. Lawrence Convention Center. The authority owns the convention center in downtown Pittsburgh, the building that anchors the city's trade show and convention business, and the board's vote hands day-to-day management and operations to a new contractor. - WPXI: https://www.wpxi.com/news/local/sea-taps-new-operator-david-l-lawrence-convention-center/CGZQAYFIKFAFLAAOFVCBQOWPJM/ * New Kensington Zoners Push Out a Boxing Club Latest developments: TribLive reported Friday, September 11, that the New Kensington zoning hearing board denied Sanctuary Boxing Club's request for a special exception for business use, leaving the club less than three months to find a new location. Sanctuary Boxing Club trains in New Kensington, Westmoreland County, and the zoning board's refusal to permit business use at its current address forces the gym to move or close. - TribLive: https://triblive.com/local/valley-news-dispatch/sanctuary-boxing-club-to-move-after-new-kensington-zoning-board-denies-business-use-at-current-location/ * Diesel Tops $6 a Gallon Latest developments: WTAE and the Post-Gazette reported Friday, September 11, that diesel passed $6 a gallon for the first time, and the August inflation report put gasoline up 3.9% and fuel oil up 10.1% for the month. Trucks, trains, and farm equipment burn diesel, so the record price works into the delivered cost of nearly everything Western Pennsylvania households buy, and it follows the disruption of crude supply from the Iran conflict that has also pushed regional gasoline well above last year's levels. - WTAE: https://www.wtae.com/article/diesel-costs-6-gallon-first-time-how-affects-you-consumer/73684536 - Pittsburgh Post-Gazette: https://www.post-gazette.com/business/money/2026/09/11/us-diesel-prices-soar/stories/202609120005 - WTAE: https://www.wtae.com/article/gasoline-prices-rise-again-inflation-hits-34-percent/73685116 - Pittsburgh Post-Gazette: https://www.post-gazette.com/business/money/2026/09/11/inflation-middle-east-clash-fuel-prices/stories/202609120006 * The North Shore Braces for a Season Without Baseball Latest developments: The Post-Gazette reported Friday, September 11, on what a Major League Baseball work stoppage would cost the businesses around PNC Park if the Pirates play no games next season. Restaurants, bars, and parking operators on Pittsburgh's North Shore build their year around 81 Pirates home dates at PNC Park, and owners there now weigh staffing and revenue against the chance that the 2027 season never opens. - Pittsburgh Post-Gazette: https://www.post-gazette.com/business/career-workplace/2026/09/11/pirates-mlb-work-stoppage-north-shore-businesses/stories/202609090060 * Ranking Pittsburgh's Rankings Latest developments: Pittsburgh City Paper's Affordable-ish Housing column on Friday, September 11, went through the ranked lists the city keeps landing on and graded the lists themselves. Pittsburgh turns up on national rankings for everything from best place to live without a car to best city for good neighbors, and the column weighs which of those lists carry any weight for people deciding where to rent or buy here. - Pittsburgh City Paper: https://www.pghcitypaper.com/columns/affordable-ish-housing/affordable-ish-housing-in-pittsburgh-ranking-the-rankings-edition/ Around town: * Cyclospora Outbreak Declared Over Latest developments: The Centers for Disease Control and Prevention and the Food and Drug Administration declared the record-setting cyclosporiasis outbreak over Friday, September 11, saying all iceberg lettuce tied to it has left the market. Contaminated iceberg lettuce carried the parasite that causes cyclosporiasis through multiple states this summer, and federal health officials now say no further illness risk remains from that supply. - KDKA: https://www.cbsnews.com/pittsburgh/news/cyclospora-outbreak-over-us-fda-cdc/ - WTAE: https://www.wtae.com/article/lettuce-cyclospora-outbreak-over/73686617 * Wildwood Road Floods Again in Hampton Latest developments: KDKA's Jessica Riley reported Friday, September 11, that residents along Wildwood Road in Hampton Township have grown frustrated with flooding that keeps returning after a week of heavy storms and an exceptionally wet summer. Water is reaching parts of Allegheny County that rarely see it, and the Wildwood Road corridor in Hampton Township, north of Pittsburgh, has taken repeated hits as the storms continue. - KDKA: https://www.cbsnews.com/pittsburgh/video/repeated-flooding-frustrates-hampton-township-residents-along-wildwood-road/ * Rain Returns for the Weekend Latest developments: Forecasters gave the region sunshine Friday, September 11, then flagged Saturday, September 12, as an Impact Day for afternoon showers, with scattered rain lingering into Sunday and the Steelers' home opener. WTAE expects Western Pennsylvania to dry out Friday before showers return Saturday afternoon, and KDKA meteorologist Ron Smiley has scattered rain hanging around through Sunday, September 13, when the Steelers host the Atlanta Falcons at Acrisure Stadium. - WTAE: https://www.wtae.com/article/pittsburgh-drying-out-with-sunshine-today/73682094 - KDKA: https://www.cbsnews.com/pittsburgh/news/wet-weather-continues-into-the-weekend-in-pittsburgh-rain-possible-for-steelers-opener/ * Rosh Hashanah Begins at Sundown Latest developments: Rosh Hashanah starts at sundown Friday, September 11, and runs until sunset Sunday, September 13, opening the Jewish high holidays. TribLive's editorial board marked the new year Friday, September 11, and the Post-Gazette published the story of a 1952 Rosh Hashana service at Tree of Life, recorded voices sealed in a time capsule that carry the Squirrel Hill congregation's history. The Jewish Federation of Greater Pittsburgh expanded security across regional Jewish institutions ahead of the holiday. - TribLive: https://triblive.com/opinion/laurels-lances-new-name-no-budging/ - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/2026/09/11/rosh-hashana-tree-of-life-congregation-time-capsule/stories/202609090066 * Flight 93 Marks 25 Years Latest developments: Families, first responders, and visitors gathered at the Flight 93 National Memorial near Shanksville on Friday morning, September 11, to read the names, while President Trump marked the anniversary at a Pentagon ceremony. United Airlines Flight 93 came down in a field in Somerset County on September 11, 2001, after the 40 passengers and crew fought back. WPXI spoke with Jack Grandcolas, who lost his wife and their unborn child on the flight and described how her actions guided his own recovery, and PublicSource collected readers' memories from across the region. - KDKA: https://www.cbsnews.com/pittsburgh/news/flight-93-memorial-ceremonies-today-25-years-911-attacks/ - WTAE: https://www.wtae.com/article/trump-pentagon-9-11-25th-anniversary/73683238 - WPXI: https://www.wpxi.com/news/local/man-who-lost-his-wife-unborn-child-flight-93-crash-shares-how-her-heroism-guided-him-healing/XCAKIUBSK5CAFDEZ3AO5UAEATQ/ - PublicSource: https://www.publicsource.org/pittsburgh-readers-remember-9-11-25-years/ * One Superintendent for Rochester and New Brighton Latest developments: The Post-Gazette reported Friday, September 11, on the single superintendent now running both the Rochester and New Brighton school districts in Beaver County. Two small Beaver County districts share one chief administrator, an arrangement that spreads a single salary across both payrolls and doubles the school boards, budgets, and buildings one person answers for. - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/education/2026/09/11/rochester-new-brighton-school-districts-superintendent/stories/202609100048 * Bradford Woods Sets a Meeting on Its Future Latest developments: TribLive reported Friday, September 11, that Bradford Woods will present the results of this year's community survey at a public meeting at 6 p.m. Thursday, October 1, at the Bradford Woods Volunteer Fire Company. The borough of Bradford Woods, in northern Allegheny County, surveyed residents earlier this year about what they want from the community and will use the October meeting to walk through the answers and take comment. - TribLive: https://triblive.com/local/residents-urged-to-help-shape-future-of-bradford-woods/ Events: * Taco Festival Fills the Stacks Saturday Latest developments: KDKA's Pittsburgh Today Live previewed the Original Pittsburgh Taco Festival on Friday, September 11, a day before it opens. The Original Pittsburgh Taco Festival runs Saturday, September 12, at The Stacks at 3 Crossings in the Strip District, with more than 25 food trucks and live Latin music. - KDKA: https://www.cbsnews.com/pittsburgh/video/ptl-previews-the-original-pittsburgh-taco-festival/ * Pittsburgh County Fair on the North Side Latest developments: KDKA previewed the Pittsburgh County Fair on Friday, September 11, ahead of Saturday's event. The Pittsburgh County Fair takes place Saturday, September 12, at Allegheny Commons Park West on the North Side, a celebration of urban agriculture and handmade and homemade goods from around the city. - KDKA: https://www.cbsnews.com/pittsburgh/video/ptl-previews-the-pittsburgh-county-fair/ * Turkey Fund Kickoff Show Sells Tickets Latest developments: KDKA said Friday, September 11, that tickets are on sale now for the Pittsburgh Today Live Turkey Fund Kickoff Show, one week out. The PTL Turkey Fund Kickoff Show runs Friday, September 18, at the Pittsburgh Playhouse downtown, the annual benefit that opens KDKA's holiday food drive. - KDKA: https://www.cbsnews.com/pittsburgh/video/one-week-away-from-the-ptl-turkey-fund-kickoff-show/ * Five Things to Do in Westmoreland County Latest developments: TribLive published its Westmoreland County weekend list Friday, September 11, covering Friday, September 11, through Sunday, September 13. The guide lays out five events across Westmoreland County for the weekend, offered as a way to fill the hours before the Steelers open the regular season Sunday. - TribLive: https://triblive.com/local/westmoreland/here-are-5-things-to-do-in-westmoreland-this-weekend-sept-11-13/ * 'The Lion King' Opens the Broadway Season Latest developments: TribLive reviewed "Disney's The Lion King" on Friday, September 11, calling it a majestic opening to the Pittsburgh Cultural Trust's 2026-27 PNC Broadway in Pittsburgh Series at the Benedum Center downtown. The show has grossed more than $2 billion in almost 30 years on Broadway, the highest total any Broadway musical has reached, and its puppetry and staging carry the visual weight that opens the Cultural Trust's season at the Benedum Center in Pittsburgh's Cultural District. - TribLive: https://triblive.com/aande/theater-arts/review-disneys-the-lion-king-is-a-majestic-start-to-the-pnc-broadway-in-pittsburgh-series-season-at-the-benedum/ * Sketch Lab Report Returns to Arcade Comedy Latest developments: Pittsburgh City Paper previewed the third volume of Sketch Lab Report on Friday, September 11. Sketch Lab Report at Arcade Comedy Theater downtown showcases new sketch writing from the theater's writing program, and City Paper describes this round as subversive and inventive humor built by local writers. - Pittsburgh City Paper: https://www.pghcitypaper.com/arts-entertainment-2/arcade-comedy-theater-gets-sketchy-with-writing-showcase/ * Three Tours of Houses, Gardens, and a Campus Latest developments: The Post-Gazette laid out three fall tours Friday, September 11, covering old houses and gardens in the Mexican War Streets on the North Side and in Shadyside, and the historic campus and church at Saint Vincent College in Latrobe. The Mexican War Streets and Shadyside tours open private houses and gardens to visitors, and the Saint Vincent College tour walks the Benedictine campus and its church in Unity Township, Westmoreland County. - Post-Gazette Arts & Entertainment: https://www.post-gazette.com/life/homes/2026/09/11/mexican-war-streets-shadyside-saint-vincent-college-house-tours/stories/202609110004 SPORTS ---------------------------------------------------------------- Pirates (74-73) Thu Sep 10 · Pirates 2 · White Sox 0 · Final https://plaintextsports.com/mlb/2026-09-10/pit-cws Up Next · Pirates @ Cubs · Fri Sep 11, 2:20 PM https://plaintextsports.com/mlb/2026-09-11/pit-chc Steelers (0-0, T-1st in AFC North) Up Next · Falcons @ Steelers · Sun Sep 13, 1:00 PM https://plaintextsports.com/nfl/2026/week1/atl-pit Around the Teams: * O'Hearn Comes Off the Injured List Latest developments: The Pirates activated Ryan O'Hearn from the injured list Friday, September 11, restoring the lineup to full strength. The Post-Gazette reported the move as the Pirates play out the season's final weeks with their regular batting order intact for the first time in weeks, days after the club put All-Star right-hander Braxton Ashcraft on the 15-day injured list with right arm discomfort. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/09/11/ryan-ohearn-injury-news/stories/202609110046 * Murf Gray, Third Baseman of the Future Latest developments: The Post-Gazette profiled Murf Gray on Friday, September 11, a top-100 prospect the Pirates see as their third baseman of the future. Gray ranks among baseball's top 100 prospects and plays a position the Pirates have struggled to settle, and the piece traces his path through the organization toward Pittsburgh. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/09/11/murf-gray-mlb-prospects-pirates/stories/202609110030 * Steelers Live Sizes Up the Falcons Latest developments: Rob King, Missi Matthews, and Matt Williamson broke down the Steelers-Falcons matchups on Steelers Live The Match Up, posted Friday, September 11. The Steelers-produced show walked through the individual matchups two days before Pittsburgh hosts the Atlanta Falcons at 1 p.m. Sunday, September 13, on FOX, and the team also hosted a 9/11 National Day of Service meal packing event at Acrisure Stadium on Friday. - Pittsburgh Steelers (YouTube): https://www.youtube.com/watch?v=yRAl5WDrupo - Pittsburgh Steelers (YouTube): https://www.youtube.com/shorts/e1Vtx98UpZM * Fittipaldo and McCarthy Close Out Week 1 Prep Latest developments: Post-Gazette beat writer Ray Fittipaldo posted his Steelers chat transcript Thursday, September 10, and head coach Mike McCarthy met the media the same day before practice. Fittipaldo took reader questions on the Week 1 roster and the Atlanta matchup, and McCarthy spoke on the Steelers' own channel three days before kickoff. The Steelers host the Falcons at 1 p.m. Sunday, September 13, on FOX. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/09/10/steelers-week1-analysis-news/stories/202609080021 - Pittsburgh Steelers (YouTube): https://www.youtube.com/watch?v=gLtshAen59U * Hiles Puts the Standard on McCarthy Latest developments: Post-Gazette columnist Noah Hiles wrote Friday, September 11, that setting a new Steelers standard ranks as head coach Mike McCarthy's top priority in his first season. McCarthy takes over a franchise that has gone years without a playoff win, and Hiles argues the measure of 2026 lies in the habits and expectations McCarthy installs rather than the win total, starting with Sunday's opener against the Atlanta Falcons at Acrisure Stadium. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/09/11/mike-mccarthy-debut-nfl-season-preview/stories/202609080036 * Rodgers Savors a Last Season Latest developments: The Post-Gazette reported Thursday, September 10, that quarterback Aaron Rodgers plans to savor what he calls a special season in Pittsburgh as his career winds down. Rodgers, who opens his second year with the Steelers on Sunday, September 13, against the Atlanta Falcons, has told teammates and reporters he treats this run as the end of the line, and he spoke with the media at practice Wednesday, September 9, alongside DK Metcalf, Alex Highsmith, and Eli Heidenreich a day later. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/09/10/aaron-rodgers-final-season-nfl-preview/stories/202609070026 - Pittsburgh Steelers (YouTube): https://www.youtube.com/watch?v=7QKGO68JUjs * SNR Drive Runs the Week 1 Numbers Latest developments: Matt Williamson and Wes Uhler spent Thursday's SNR Drive, September 10, on Steelers season what-ifs and Williamson's Week 1 statistical packet. The Steelers-produced show also recapped the NFL's Wednesday night kickoff, went around the college slate, and brought on a Steelers beat writer ahead of Sunday's opener against the Atlanta Falcons. - Pittsburgh Steelers (YouTube): https://www.youtube.com/watch?v=2iQJI4Zumtw Team USA: * Pulisic Chafes on the Milan Bench Latest developments: AC Milan coach Ruben Amorim said Friday, September 11, that Christian Pulisic is upset about sitting out so far this season, and hinted the American will play this weekend. Pulisic, the United States men's national team forward, has yet to feature for Milan in the new Serie A season, and Amorim addressed the situation publicly before the club's next match. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49905122/christian-pulisic-upset-ac-milan-role-ruben-amorim * The Next Wave of U.S. Men's Players Latest developments: ESPN surveyed Friday, September 11, the American men who missed this year's World Cup squad and now aim at the 2030 tournament. Diego Luna and Yunus Musah lead a group of five United States players in their twenties whom ESPN identifies as candidates for a larger national team role in the next World Cup cycle. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49895766/diego-luna-yunus-musah-usmnt-fringe-players-hoping-bigger-role-2030-fifa-world-cup READING ---------------------------------------------------------------- * Ed Zitron -- Premium: The Hater's Guide To Broadcom Zitron turns his hater's guide format on Broadcom and Chief Executive Hock Tan, opening with the coffee chat Tan held for VMware employees after the acquisition and the management style he brought to the sprawling Palo Alto campus. https://www.wheresyoured.at/premium-the-haters-guide-to-broadcom/ * Cal Newport -- Superintelligence is a Fairy Tale. But Chasing It Can Still Cause Harm. Newport answers Anthropic employees who said publicly that the systems they build could kill billions, arguing that superintelligence remains a story people tell themselves. He holds that the race toward it still does real damage, in the resources it consumes and the harms it creates along the way. https://calnewport.com/superintelligence-is-a-fairy-tale-but-chasing-it-can-still-cause-harm/ * Stratechery -- The iPhone Duo, The Intelligent Personal Hub, Apple Watch Audio Intelligence Ben Thompson reads Apple's latest launch as another demonstration of what integrating hardware and software buys the company. He names Apple's belief in the primacy of apps as its largest blind spot in an AI era that favors an intelligent personal hub. https://stratechery.com/2026/the-iphone-duo-the-intelligent-personal-hub-apple-watch-audio-intelligence/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,673.58 ▼ -0.2% Dow 52,866.24 ▼ -0.7% Nasdaq 26,369.50 ▲ +0.2% WTI crude 94.87 ▲ +9.3% EUR/USD 1.1626 ▲ +0.2% GBP/USD 1.3538 = +0.0% USD/JPY 154.55 ▼ -3.2% FEED HEALTH ---------------------------------------------------------------- Security: 24 of 24 feeds loaded, 59 items in the 24-hour window. No recent items: Krebs on Security, CISA Advisories, Securelist (Kaspersky), Unit 42 (Palo Alto), Google Online Security Blog, Graham Cluley, Microsoft Security Blog, Google Project Zero, The DFIR Report, Kim Zetter (Zero Day), Frank on Fraud. Pittsburgh: 9 of 9 feeds loaded, 60 items in the 48-hour window. No recent items: NEXTpittsburgh. Business and Politics: 8 of 8 feeds loaded, 60 items in the 36-hour window. Events: 4 of 4 feeds loaded, 9 items in the 120-hour window. No recent items: NEXTpittsburgh Events, NEXTpittsburgh Arts & Entertainment. Sports media: 6 of 6 feeds loaded, 30 items in the 96-hour window. Team USA: 3 of 3 feeds loaded, 31 items in the 72-hour window. No recent items: Guardian Olympics. Reading: 3 of 3 feeds loaded, 12 items in the 336-hour window. Markets (Yahoo Finance): 7 of 7 rows Weather (NWS): 3 forecast periods Scores (ESPN, plaintextsports): 2 teams via plaintextsports; mlb: ESPN failed (mlb: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nfl: ESPN failed (nfl: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nhl: ESPN failed (nhl: HTTP 403 (server: AkamaiGHost)); used plaintextsports Summaries: 3 model call(s) served by claude-opus-5 (373s of model time; $2.11 at API list price). ================================================================ Generated 2026-09-11 13:36 EDT. Updated weekdays at about 7:05 AM, 10:05 AM, 1:35 PM, and 7:35 PM ET, and weekends at about 8:05 AM and 7:35 PM ET. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 3 Team USA feeds; WSJ World News, WSJ Markets, WSJ US Business, WSJ Politics, The Economist, FT Home, FT World, FT Markets; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN or plaintextsports.com. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================