Revolut handed customer passports and account records to someone writing from a government agency's own email domain, while ConnectWise and JFrog shipped patches for flaws attackers already ride into corporate networks.
Emerging Trends and Key Updates
- Trend Attackers bypassed software entirely, impersonating a government agency to pry customer records from Revolut and Telus while a Twitch extension quietly shipped 31,000 OAuth tokens to Russian proxies.
- Trend Remote administration tooling draws exploitation first, with ConnectWise patching a wormable ScreenConnect file-transfer flaw and attackers chaining three JFrog Artifactory bugs into administrator-level backdoors.
- Trend AWS ships a Deception Benchmark scoring AI false positives while Dario Amodei's slow-down essay sank chip stocks worldwide and drew a rebuttal from Ben Thompson.
- Update · new Microsoft confirmed its September 2026 security updates knock out Remote Desktop Services on Windows Server and break USB audio devices, matching four days of administrator reports.
- Update · new Saudi Arabia's exit from the Hormuz talks drove oil to $108 a barrel as Fed Chair Kevin Warsh heads into Wednesday's expected rate increase.
- Update · new The Steelers beat Atlanta behind Alex Highsmith's closing sack and Jaquan Brisker's hometown interception, though analysts warn Joey Porter Jr.'s contract absence will start to hurt soon.
Security
1. Revolut and Telus Disclose Customer Data Theft
Latest developments: Revolut confirmed on Saturday, September 12, 2026 that someone impersonating a government agency, writing from an email address on that agency's own domain, pulled sensitive customer records out of the London fintech, and Telus warned subscribers on September 14, 2026 that intruders used stolen credentials across a multi-month campaign to reach personal data and billing records.
read more
The Revolut notification to affected customers lists birth dates, postal and email addresses, phone numbers, and copies of identity documents including passports, and the company told TechCrunch a limited number of customers lost data and that it contacted each of them directly. Customers of both companies should treat unsolicited contact referencing their account details as fraud and watch for identity theft.
Sources: BleepingComputer · Help Net Security · SecurityWeek · ↑ top
2. Third JFrog Artifactory Flaw Joins Backdoor Campaign
Latest developments: SecurityWeek reported on September 14, 2026 that attackers chain three JFrog Artifactory vulnerabilities, one more than the pair CISA cataloged on September 11, to bypass authentication and raise their privileges to administrator before planting a backdoor.
read more
CISA already lists the incorrect authorization bug CVE-2026-42016 and the improper authentication bug CVE-2026-42018 as actively exploited, and Wiz dated the campaign against self-hosted Artifactory servers from August 15 through September 8, 2026, finding it reached only operators who had skipped JFrog's earlier fixes. Anyone running Artifactory on their own hardware should install every available update and hunt for a Rust backdoor and unfamiliar administrator accounts.
Sources: SecurityWeek · BleepingComputer · ↑ top
3. September Windows Updates Break Remote Desktop and USB Audio
Latest developments: Microsoft confirmed on September 14, 2026 that its September 2026 security updates knock out Remote Desktop Services on Windows Server, matching four days of administrator reports, and acknowledged a second regression in which USB audio devices fail after the KB5124008 and KB5124012 updates.
read more
The Remote Desktop failures block user connections on Windows Server 2019, 2022, and 2025, and some hosts recover only after a hard reset. Administrators running the September rollup should test remote access and audio hardware before broad deployment and watch Microsoft's release health dashboard for the fixes.
Sources: BleepingComputer · BleepingComputer · ↑ top
4. CISOs Fight Over-Privileged AI Agents as AWS Measures False Positives
Latest developments: Amazon Web Services released its Deception Benchmark publicly on September 14, 2026, a dataset and evaluation process that scores how well AI models separate genuine vulnerabilities from code that merely looks risky, and found the models piling up false positives; SecurityWeek reported the same day that security leaders are struggling to rein in over-privileged agents without stripping out the value those agents deliver.
read more
Security teams now point AI at vulnerability triage, penetration testing, threat modeling, incident response, and code review, and every false positive adds work for the humans reviewing the output. Teams should benchmark any model before they trust its findings and scope agent permissions to the narrowest set of systems each task requires.
Sources: Help Net Security · SecurityWeek · ↑ top
5. ConnectWise Patches Wormable ScreenConnect Flaw
Latest developments: ConnectWise released the fix on September 14, 2026 for the ScreenConnect file transfer flaw it had covered with temporary mitigations a week earlier, closing a hole that lets an attacker send files through an active remote session and execute them without authorization.
read more
Huntress traced three unrelated intrusions in which backdoored ScreenConnect instances pushed a four-stage Visual Basic Script payload to every newly connected host, a spread that started with a Quick Assist tech-support scam, a phishing-delivered MSI installer, and a fake update. The flaw reaches both the ConnectWise cloud service and on-premises installations, so every operator should apply the patch and audit recent session file transfers.
Sources: SecurityWeek · ↑ top
6. JeetBot Twitch Extension Leaks 31,000 OAuth Tokens
Latest developments: The Hacker News reported on September 14, 2026 that a browser extension called Twitch Enhanced Viewer, listing HISHIMIRO and jeetbot.cc as its developer, leaked the OAuth tokens of nearly 31,000 users to proxy servers that a Russian commercial bot service runs.
read more
The extension shipped on both the Google Chrome Web Store and the Mozilla Firefox Add-ons store, and the stolen tokens open the victims' Twitch accounts without a password. Anyone who installed it should remove it, revoke Twitch application authorizations, and reset the account password.
Sources: The Hacker News · ↑ top
Business and Politics
Oil Reaches $108 as Riyadh Quits the Hormuz Talks
Latest developments: Saudi Arabia pulled out of the regional de-escalation talks Monday, September 14, and kept its East-West pipeline shut after last week's drone attack, driving oil to $108 a barrel.
read more
The East-West line carries crude from Saudi Arabia's eastern fields to the Red Sea and served as the main workaround for the blocked Strait of Hormuz. Houthi fighters now hold the Bab al-Mandeb chokepoint as well, putting both of the region's vital energy corridors under the sway of Iran and its allies, and gas traders have moved to pricing an outage that runs through the winter.
Sources: FT Home · WSJ US Business · WSJ World News · FT World · ↑ top
Warsh Faces Trump Over Wednesday's Rate Increase
Latest developments: The Financial Times reported Monday, September 14, that Federal Reserve Chair Kevin Warsh risks President Trump's ire by matching his inflation warnings with action at Wednesday's decision, and traders sent the euro to a one-month low and gold down 1.1% on the expectation he will raise rates.
read more
The Federal Reserve meets September 16 and the Bank of Japan follows this week, with both expected to tighten, the Fed for the first time in years. Governor Kazuo Ueda faces competing pressure from Tokyo and Washington, and the U.S. Treasury market is already flailing as the oil shock feeds through to prices.
Sources: FT Home · FT Markets · WSJ Markets · FT World · ↑ top
A Call to Slow AI Knocks Down Tech Shares Worldwide
Latest developments: Chip and AI stocks fell around the globe Monday, September 14, with South Korea's Kospi sliding and Nasdaq futures dropping, after Anthropic Chief Executive Dario Amodei published a weekend essay warning against a race to the bottom in the development of new models.
read more
Anthropic, the maker of Claude, told investors it expects a second straight profitable quarter as it prepares an initial public offering that could value it near $2 trillion. Its schism with OpenAI has driven the industry's sprint toward ever more powerful systems, and the market read Amodei's plea for restraint as a threat to the earnings the buildout promises.
Sources: FT Home · WSJ Markets · FT Home · The Economist · ↑ top
Pittsburgh
Weather
Today: Sunny, high 72F.
Tonight: Partly Cloudy, low 51F.
Tuesday: Mostly Sunny, high 82F.
Business
Heating Bills Climb Into Winter
Latest developments: WTAE reported Monday, September 14, that the average American household will spend $1,030 on heat this winter, an increase that arrives with household budgets already stretched.
read more
The forecast lands on a region that watched retail diesel pass $6 a gallon Friday, September 11, as the Middle East conflict squeezed global fuel supply. Families with no slack left in their budgets face trade-offs between heat and other bills.
be.wild.er Farm Becomes a Cooperative
Latest developments: The Post-Gazette reported Monday, September 14, that be.wild.er, the Natrona Heights farm now in its tenth year, has converted to a cooperative.
read more
Small farms around the country have turned to shared ownership to spread the cost and risk of land, equipment, and labor across their workers. be.wild.er sells online and joins that shift in the Pittsburgh region.
Sources: Pittsburgh Post-Gazette · ↑ top
DeFoor Audits the Medical Marijuana Program
Latest developments: Pennsylvania Auditor General Timothy L. DeFoor released a performance audit Sunday, September 13, of the Department of Health's handling of the state Medical Marijuana Program.
read more
The Department of Health licenses the growers, processors, and dispensaries that serve Pennsylvania's registered medical cannabis patients, and the auditor general's office reviews how it runs that program. The findings bear on operators across Western Pennsylvania and on the patients who buy from them.
Around Town
County Rebuilds Its Addiction Treatment System
Latest developments: The Allegheny County Department of Human Services announced an initiative Sunday, September 13, to restructure how the county delivers drug and alcohol treatment.
read more
The department funds and coordinates the providers that treat county residents for substance use disorder, and the restructuring changes how those services fit together. It touches the treatment options available to families across Allegheny County.
Shapiro Holds a 38-to-1 Cash Lead
Latest developments: PublicSource laid out Monday, September 14, the scale of Governor Josh Shapiro's fundraising advantage over Republican challenger Stacy Garrity, a 38-to-1 lead in cash on hand as of June, much of it raised outside Pennsylvania.
read more
Shapiro, the Democratic incumbent, faces Garrity, the state treasurer, in the November 3 election for governor. PublicSource will track contributions in the race through Election Day.
Sources: PublicSource · ↑ top
A Cool, Clear Start to the Week
Latest developments: WTAE forecast a comfortable, bright Monday, September 14, across Western Pennsylvania behind Sunday's storm line, with warmth and humidity building back by midweek.
read more
A cold front swept the region Sunday with damaging wind, hail, and heavy rain through Allegheny, Butler, and Beaver counties. The break in the heat lasts only a couple of days.
Sports
Pirates (75-75)
Sun Sep 13 · Pirates 4 · Cubs 3 · Final
Up Next · Brewers @ Pirates · Tue Sep 15, 6:40 PM
Steelers (1-0, T-1st in AFC North)
Sun Sep 13 · Falcons 13 · Steelers 20 · Final
Up Next · Steelers @ Patriots · Sun Sep 20, 1:00 PM
Around the Teams
The Bill for Porter's Standoff Comes Later
Latest developments: The Post-Gazette's Week 1 analysis, published Monday, September 14, concluded that the Steelers got through the opener without cornerback Joey Porter Jr. and warned that his absence will start to hurt soon.
read more
Porter sat out Sunday's game against the Atlanta Falcons with his contract unresolved, and sources told the Post-Gazette he is healthy enough to play. The Steelers travel to face the New England Patriots on Sunday.
Sources: Post-Gazette Steelers · Post-Gazette Steelers · ↑ top
Brisker's Hometown Debut
Latest developments: Safety Jaquan Brisker intercepted a pass in his first game for the Steelers on Sunday, September 13, and the Post-Gazette's notebook made it the centerpiece of the defense's day alongside Cam Heyward and kicker Chris Boswell.
read more
Brisker, a Western Pennsylvania native, signed with Pittsburgh this offseason after his run with the Chicago Bears, and he took the field at Acrisure Stadium for the first time as a Steeler in Mike McCarthy's head coaching debut.
Sources: Post-Gazette Steelers · ↑ top
Highsmith's Sack Sealed It
Latest developments: The Post-Gazette broke down late Sunday, September 13, the Alex Highsmith sack that closed out the Steelers' win over the Atlanta Falcons, the second defensive play that decided the game.
read more
Highsmith and T.J. Watt both drew A-plus grades in the paper's report card on the opener, with Watt's pick-six the other turning point. The two outside linebackers carried a defense that head coach Mike McCarthy plans to rotate more heavily this season.
Sources: Post-Gazette Steelers · ↑ top
Team USA
Team USA Credits Stewart for the Title Run
Latest developments: ESPN reported Monday, September 14, that players and staff on the United States women's team pointed to Breanna Stewart as the force behind the fifth straight FIBA World Cup title, calling her the program's greatest winner.
read more
The United States beat France in the final in Germany on Sunday, September 13, a rematch of the 2024 Olympic gold medal game, with Stewart scoring 22 points under coach Kara Lawson. Spain took the bronze medal, beating host Germany 81-58.
Sources: ESPN Olympics · ↑ top
Rodman Leaves a Spirit Loss for the US Open
Latest developments: Trinity Rodman flew from the Washington Spirit's 3-0 defeat straight to Flushing Meadows to watch Ben Shelton play the US Open final, ESPN reported Monday, September 14.
read more
Rodman, a United States women's national team winger and Olympic gold medalist, plays for the Spirit, whose loss dropped the club in ESPN's NWSL Power Rankings as Gotham FC took over the top spot. Shelton, an American, reached his first US Open final.
Sources: ESPN Soccer · ESPN Soccer · ↑ top
Reading
- Stratechery — Pacing the Frontier, AI’s Digital Limits, AI Commissars. Ben Thompson calls Dario Amodei's proposal to pace the AI frontier unrealistic and reads it as a bid for political control over who builds what.
- Ed Zitron — Premium: The Hater's Guide To Broadcom. Zitron dissects Broadcom under Chief Executive Hock Tan, starting with the coffee chat where Tan introduced his cost-stripping management style to VMware employees after the acquisition.
- Cal Newport — Superintelligence is a Fairy Tale. But Chasing It Can Still Cause Harm.. Newport argues that superintelligence remains a myth, and that the industry's race toward it does real damage anyway, writing in response to Anthropic employees who said publicly that the systems they build could kill billions.
Markets
S&P 500 7,655.43 ▼ -0.4% Dow 52,643.67 ▼ -1.1% Nasdaq 26,319.30 ▼ -0.1% WTI crude 96.62 ▲ +9.4% EUR/USD 1.1623 ▲ +0.2% GBP/USD 1.3534 ▲ +0.1% USD/JPY 154.32 ▼ -2.9%
Feed Health
Security: 24 of 24 feeds loaded, 23 items in the 24-hour window. No recent items: Krebs on Security, Schneier on Security, Dark Reading, CISA Advisories, Ars Technica Security, Securelist (Kaspersky), Sophos News, Google Online Security Blog, Cisco Talos, Graham Cluley, Microsoft Security Blog, Google Project Zero, The DFIR Report, Kim Zetter (Zero Day), 404 Media, Frank on Fraud, Wired Security.
Pittsburgh: 9 of 9 feeds loaded, 60 items in the 48-hour window. No recent items: NEXTpittsburgh, Pittsburgh Magazine.
Business and Politics: 8 of 8 feeds loaded, 60 items in the 36-hour window.
Events: 4 of 4 feeds loaded, 8 items in the 120-hour window. No recent items: NEXTpittsburgh Events, NEXTpittsburgh Arts & Entertainment.
Sports media: 6 of 6 feeds loaded, 30 items in the 96-hour window. No recent items: Footbahlin with Ben Roethlisberger, Ben Roethlisberger / Channel Seven (YouTube).
Team USA: 3 of 3 feeds loaded, 30 items in the 72-hour window. No recent items: Guardian Olympics.
Reading: 3 of 3 feeds loaded, 12 items in the 336-hour window.
Markets (Yahoo Finance): 7 of 7 rows
Weather (NWS): 3 forecast periods
Scores (ESPN, plaintextsports): 2 teams via plaintextsports; mlb: ESPN failed (mlb: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nfl: ESPN failed (nfl: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nhl: ESPN failed (nhl: HTTP 403 (server: AkamaiGHost)); used plaintextsports
Summaries: 3 model call(s) served by claude-opus-5 (293s of model time; $1.58 at API list price).