Revolut handed customer passports and financial records to fraudsters who filed emergency data requests from a genuine government email account, capping a day of impersonation losses and fresh exploitation of the software supply chain.
Emerging Trends and Key Updates
- Trend Attackers chained three JFrog Artifactory bugs to plant backdoors while ConnectWise shipped a fix for a wormable ScreenConnect file transfer hole, keeping build and remote-admin plumbing the prime target.
- Update · updated Fraudsters used a working government email account to pry passports and financial records out of Revolut, the sharpest detail yet in a theft that also hit Telus subscribers.
- Trend Dario Amodei's call to slow the frontier sank Nvidia and memory-chip shares, drew rebuttals from Ben Thompson and Cal Newport, as AWS benchmarked models' false vulnerability alarms.
- Trend Brent hit $109 after Saudi Arabia quit the Hormuz talks, and Kevin Warsh heads into Wednesday's rate increase under Trump's glare, with the euro at one-month lows.
- Update · new A single click on Tencent's Sogou input method now yields remote code execution, ENISA opened the Cyber Resilience Act reporting portal, and deepfake sites hit European politicians.
- Update · new Flash flooding opened a 40-foot sinkhole under a South Strabane fire station, USDA helicopters began dropping rabies baits, and the Pirates' deadline choices look worse as hopes fade.
Security
1. Revolut and Telus Disclose Customer Data Theft
Latest developments: The Record reported on September 14, 2026 that the fraudsters who extracted Revolut customer records submitted emergency data requests from a working government email account, sharpening the disclosure Revolut confirmed on Saturday, September 12, 2026, and Telus warned subscribers the same day that intruders used stolen credentials across a multi-month campaign to reach personal data and billing records.
read more
The Revolut notification to affected customers lists birth dates, postal and email addresses, phone numbers, and copies of identity documents including passports, and the company told TechCrunch a limited number of customers lost data and that it contacted each of them directly. Customers of both companies should treat unsolicited contact referencing their account details as fraud and watch for identity theft.
Sources: BleepingComputer · The Record · Help Net Security · SecurityWeek · ↑ top
2. Third JFrog Artifactory Flaw Joins Backdoor Campaign
Latest developments: SecurityWeek reported on September 14, 2026 that attackers chain three JFrog Artifactory vulnerabilities, one more than the pair CISA cataloged on September 11, to bypass authentication and raise their privileges to administrator before planting a backdoor.
read more
CISA already lists the incorrect authorization bug CVE-2026-42016 and the improper authentication bug CVE-2026-42018 as actively exploited, and Wiz dated the campaign against self-hosted Artifactory servers from August 15 through September 8, 2026, finding it reached only operators who had skipped JFrog's earlier fixes. Anyone running Artifactory on their own hardware should install every available update and hunt for a Rust backdoor and unfamiliar administrator accounts.
Sources: SecurityWeek · BleepingComputer · ↑ top
3. Chinese Hackers Ride Sogou Flaw to GrayRabbit
Latest developments: SecurityWeek reported on September 14, 2026 that CVE-2026-51990 in Tencent's Sogou Input Method for Windows hands attackers remote code execution from a single click, the mechanism behind the China-aligned espionage campaign that BleepingComputer tied a day earlier to the GrayRabbit backdoor.
read more
Sogou Input Method ranks among the most widely installed tools for typing Chinese characters on Windows, and operators start each intrusion with a crafted link that plants GrayRabbit carrying the logged-in user's full rights. Anyone running Sogou Input Method should update it or pull it off corporate machines.
Sources: SecurityWeek · BleepingComputer · ↑ top
4. September Windows Updates Break Remote Desktop and USB Audio
Latest developments: Microsoft confirmed on September 14, 2026 that its September 2026 security updates knock out Remote Desktop Services on Windows Server, matching four days of administrator reports, and acknowledged a second regression in which USB audio devices fail after the KB5124008 and KB5124012 updates.
read more
The Remote Desktop failures block user connections on Windows Server 2019, 2022, and 2025, and some hosts recover only after a hard reset. Administrators running the September rollup should test remote access and audio hardware before broad deployment and watch Microsoft's release health dashboard for the fixes.
Sources: BleepingComputer · BleepingComputer · ↑ top
5. CISOs Fight Over-Privileged AI Agents as AWS Measures False Positives
Latest developments: Amazon Web Services released its Deception Benchmark publicly on September 14, 2026, a dataset and evaluation process that scores how well AI models separate genuine vulnerabilities from code that merely looks risky, and found the models piling up false positives; SecurityWeek reported the same day that security leaders are struggling to rein in over-privileged agents without stripping out the value those agents deliver.
read more
Security teams now point AI at vulnerability triage, penetration testing, threat modeling, incident response, and code review, and every false positive adds work for the humans reviewing the output. Teams should benchmark any model before they trust its findings and scope agent permissions to the narrowest set of systems each task requires.
Sources: Help Net Security · SecurityWeek · ↑ top
6. ConnectWise Patches Wormable ScreenConnect Flaw
Latest developments: ConnectWise released the fix on September 14, 2026 for the ScreenConnect file transfer flaw it had covered with temporary mitigations a week earlier, closing a hole that lets an attacker send files through an active remote session and execute them without authorization.
read more
Huntress traced three unrelated intrusions in which backdoored ScreenConnect instances pushed a four-stage Visual Basic Script payload to every newly connected host, a spread that started with a Quick Assist tech-support scam, a phishing-delivered MSI installer, and a fake update. The flaw reaches both the ConnectWise cloud service and on-premises installations, so every operator should apply the patch and audit recent session file transfers.
Sources: SecurityWeek · ↑ top
7. ENISA Opens the Cyber Resilience Act Reporting Portal
Latest developments: The EU Agency for Cybersecurity switched on the Cyber Resilience Act's Single Reporting Platform on September 11, 2026, the day the law's reporting duties began binding manufacturers, and now runs the portal day to day under Article 16(1) of the act.
read more
Any company placing a product with digital elements on the European Union market reports actively exploited vulnerabilities and severe incidents through that single portal, and the act gives 24 hours from discovery to notify authorities. Product and legal teams selling into the European Union should register with the platform and rehearse the one-day clock.
Sources: Help Net Security · ↑ top
8. Deepfake Sites Target More Than 100 European Politicians
Latest developments: Wired published an analysis on September 14, 2026 of 160 deepfake websites and found more than 100 politicians from 22 countries in Europe appearing in sexually explicit synthetic imagery on them, with women accounting for nearly every target.
read more
The sites run openly and pull public images of serving politicians into explicit video and photographs. The scale gives European regulators a concrete test of the Cyber Resilience Act era's wider push to hold platforms and tool makers accountable for synthetic sexual imagery.
Sources: Wired Security · ↑ top
9. JeetBot Twitch Extension Leaks 31,000 OAuth Tokens
Latest developments: The Hacker News reported on September 14, 2026 that a browser extension called Twitch Enhanced Viewer, listing HISHIMIRO and jeetbot.cc as its developer, leaked the OAuth tokens of nearly 31,000 users to proxy servers that a Russian commercial bot service runs.
read more
The extension shipped on both the Google Chrome Web Store and the Mozilla Firefox Add-ons store, and the stolen tokens open the victims' Twitch accounts without a password. Anyone who installed it should remove it, revoke Twitch application authorizations, and reset the account password.
Sources: The Hacker News · ↑ top
Business and Politics
Oil Reaches $108 as Riyadh Quits the Hormuz Talks
Latest developments: Brent traded at $109 a barrel Monday, September 14, after Saudi Arabia walked out of the regional de-escalation talks and left its East-West pipeline shut following last week's drone attack, and Houthi forces seized two more strategic Red Sea islands.
read more
The East-West line carries crude from Saudi Arabia's eastern fields to the Red Sea and served as the main workaround for the blocked Strait of Hormuz. Houthi fighters now hold the Bab al-Mandeb chokepoint as well, putting both of the region's vital energy corridors under the sway of Iran and its allies, and gas traders have moved to pricing an outage that runs through the winter.
Sources: FT Home · WSJ US Business · WSJ World News · FT World · ↑ top
Warsh Faces Trump Over Wednesday's Rate Increase
Latest developments: The Financial Times reported Monday, September 14, that Federal Reserve Chair Kevin Warsh risks President Trump's ire by matching his inflation warnings with action at Wednesday's decision, and traders sent the euro to a one-month low and gold down 1.1% on the expectation he will raise rates.
read more
The Federal Reserve meets September 16 and the Bank of Japan follows this week, with both expected to tighten, the Fed for the first time in years. Governor Kazuo Ueda faces competing pressure from Tokyo and Washington, and the U.S. Treasury market is already flailing as the oil shock feeds through to prices.
Sources: FT Home · FT Markets · WSJ Markets · FT World · ↑ top
A Call to Slow AI Knocks Down Tech Shares Worldwide
Latest developments: Nvidia and the memory-chip makers extended the global selloff at the New York open Monday, September 14, after Anthropic Chief Executive Dario Amodei's weekend essay warning against a race to the bottom in model development, and Steve Bannon and Senator Bernie Sanders joined to demand stronger AI regulation.
read more
Anthropic, the maker of Claude, told investors it expects a second straight profitable quarter as it prepares an initial public offering that could value it near $2 trillion. Its schism with OpenAI has driven the industry's sprint toward ever more powerful systems, and the market read Amodei's plea for restraint as a threat to the earnings the buildout promises.
Sources: FT Home · WSJ Markets · FT Home · The Economist · ↑ top
Pittsburgh
Weather
Today: Sunny, high 72F.
Tonight: Partly Cloudy, low 51F.
Tuesday: Mostly Sunny, high 82F.
Business
Heating Bills Climb Into Winter
Latest developments: WTAE reported Monday, September 14, that the average American household will spend $1,030 on heat this winter, an increase that arrives with household budgets already stretched.
read more
The forecast lands on a region that watched retail diesel pass $6 a gallon Friday, September 11, as the Middle East conflict squeezed global fuel supply. Families with no slack left in their budgets face trade-offs between heat and other bills.
be.wild.er Farm Becomes a Cooperative
Latest developments: The Post-Gazette reported Monday, September 14, that be.wild.er, the Natrona Heights farm now in its tenth year, has converted to a cooperative.
read more
Small farms around the country have turned to shared ownership to spread the cost and risk of land, equipment, and labor across their workers. be.wild.er sells online and joins that shift in the Pittsburgh region.
Sources: Pittsburgh Post-Gazette · ↑ top
DeFoor Audits the Medical Marijuana Program
Latest developments: Pennsylvania Auditor General Timothy L. DeFoor released a performance audit Sunday, September 13, of the Department of Health's handling of the state Medical Marijuana Program.
read more
The Department of Health licenses the growers, processors, and dispensaries that serve Pennsylvania's registered medical cannabis patients, and the auditor general's office reviews how it runs that program. The findings bear on operators across Western Pennsylvania and on the patients who buy from them.
Around Town
A Sinkhole Swallows a South Strabane Fire Station Lot
Latest developments: WTAE reported Monday, September 14, that flash flooding opened a 40-foot sinkhole under a fire station parking lot in South Strabane Township, Washington County, with repairs estimated as high as $750,000.
read more
The collapse follows the storms that filled streets in the city of Washington and pushed the city to declare a state of emergency on Saturday, September 12. The repair bill falls on a volunteer department's home station in a township of roughly 9,000 people southeast of Pittsburgh.
Rabies Baits Drop From Helicopters This Week
Latest developments: The U.S. Department of Agriculture began distributing oral rabies vaccine baits by helicopter across Western Pennsylvania this week, WPXI reported Monday, September 14.
read more
The agency drops the baits each year to vaccinate raccoons and other wildlife and hold the rabies front line along the Appalachians. Residents who find the packets should leave them alone and keep pets away.
County Rebuilds Its Addiction Treatment System
Latest developments: The Allegheny County Department of Human Services announced an initiative Sunday, September 13, to restructure how the county delivers drug and alcohol treatment.
read more
The department funds and coordinates the providers that treat county residents for substance use disorder, and the restructuring changes how those services fit together. It touches the treatment options available to families across Allegheny County.
Shapiro Holds a 38-to-1 Cash Lead
Latest developments: PublicSource laid out Monday, September 14, the scale of Governor Josh Shapiro's fundraising advantage over Republican challenger Stacy Garrity, a 38-to-1 lead in cash on hand as of June, much of it raised outside Pennsylvania.
read more
Shapiro, the Democratic incumbent, faces Garrity, the state treasurer, in the November 3 election for governor. PublicSource will track contributions in the race through Election Day.
Sources: PublicSource · ↑ top
A Cool, Clear Start to the Week
Latest developments: WTAE forecast a comfortable, bright Monday, September 14, across Western Pennsylvania behind Sunday's storm line, with warmth and humidity building back by midweek.
read more
A cold front swept the region Sunday with damaging wind, hail, and heavy rain through Allegheny, Butler, and Beaver counties. The break in the heat lasts only a couple of days.
Sports
Pirates (75-75)
Sun Sep 13 · Pirates 4 · Cubs 3 · Final
Up Next · Brewers @ Pirates · Tue Sep 15, 6:40 PM
Steelers (1-0, T-1st in AFC North)
Sun Sep 13 · Falcons 13 · Steelers 20 · Final
Up Next · Steelers @ Patriots · Sun Sep 20, 1:00 PM
Around the Teams
The Trade Deadline Comes Back to Bite the Pirates
Latest developments: The Post-Gazette's Off The Bat column argued Monday, September 14, that the Pirates' choices at this year's trade deadline should haunt the front office as the club's playoff hopes slip away.
read more
Pittsburgh sold at the deadline and then played well enough down the stretch to stay on the edge of the wild card race, a late push that manager Don Kelly kept alive by avoiding a sweep at Wrigley Field on Sunday. The Pirates open their final homestand at PNC Park this week.
Sources: Post-Gazette Pirates · ↑ top
The Bill for Porter's Standoff Comes Later
Latest developments: The Post-Gazette's Week 1 analysis, published Monday, September 14, concluded that the Steelers got through the opener without cornerback Joey Porter Jr. and warned that his absence will start to hurt soon.
read more
Porter sat out Sunday's game against the Atlanta Falcons with his contract unresolved, and sources told the Post-Gazette he is healthy enough to play. The Steelers travel to face the New England Patriots on Sunday.
Sources: Post-Gazette Steelers · Post-Gazette Steelers · ↑ top
Brisker's Hometown Debut
Latest developments: Safety Jaquan Brisker intercepted a pass in his first game for the Steelers on Sunday, September 13, and the Post-Gazette's notebook made it the centerpiece of the defense's day alongside Cam Heyward and kicker Chris Boswell.
read more
Brisker, a Western Pennsylvania native, signed with Pittsburgh this offseason after his run with the Chicago Bears, and he took the field at Acrisure Stadium for the first time as a Steeler in Mike McCarthy's head coaching debut.
Sources: Post-Gazette Steelers · ↑ top
Highsmith's Sack Sealed It
Latest developments: The Post-Gazette broke down late Sunday, September 13, the Alex Highsmith sack that closed out the Steelers' win over the Atlanta Falcons, the second defensive play that decided the game.
read more
Highsmith and T.J. Watt both drew A-plus grades in the paper's report card on the opener, with Watt's pick-six the other turning point. The two outside linebackers carried a defense that head coach Mike McCarthy plans to rotate more heavily this season.
Sources: Post-Gazette Steelers · ↑ top
Team USA
Team USA Credits Stewart for the Title Run
Latest developments: ESPN reported Monday, September 14, that players and staff on the United States women's team pointed to Breanna Stewart as the force behind the fifth straight FIBA World Cup title, calling her the program's greatest winner.
read more
The United States beat France in the final in Germany on Sunday, September 13, a rematch of the 2024 Olympic gold medal game, with Stewart scoring 22 points under coach Kara Lawson. Spain took the bronze medal, beating host Germany 81-58.
Sources: ESPN Olympics · ↑ top
Rodman Leaves a Spirit Loss for the US Open
Latest developments: Trinity Rodman flew from the Washington Spirit's 3-0 defeat straight to Flushing Meadows to watch Ben Shelton play the US Open final, ESPN reported Monday, September 14.
read more
Rodman, a United States women's national team winger and Olympic gold medalist, plays for the Spirit, whose loss dropped the club in ESPN's NWSL Power Rankings as Gotham FC took over the top spot. Shelton, an American, reached his first US Open final.
Sources: ESPN Soccer · ESPN Soccer · ↑ top
Reading
- Stratechery — Pacing the Frontier, AI’s Digital Limits, AI Commissars. Ben Thompson calls Dario Amodei's proposal to pace the AI frontier unrealistic and reads it as a bid for political control over who builds what.
- Ed Zitron — Premium: The Hater's Guide To Broadcom. Zitron dissects Broadcom under Chief Executive Hock Tan, starting with the coffee chat where Tan introduced his cost-stripping management style to VMware employees after the acquisition.
- Cal Newport — Superintelligence is a Fairy Tale. But Chasing It Can Still Cause Harm.. Newport argues that superintelligence remains a myth, and that the industry's race toward it does real damage anyway, writing in response to Anthropic employees who said publicly that the systems they build could kill billions.
Markets
S&P 500 7,655.43 ▼ -0.4% Dow 52,643.67 ▼ -1.1% Nasdaq 26,319.30 ▼ -0.1% WTI crude 96.62 ▲ +9.4% EUR/USD 1.1623 ▲ +0.2% GBP/USD 1.3534 ▲ +0.1% USD/JPY 154.32 ▼ -2.9%
Feed Health
Security: 24 of 24 feeds loaded, 33 items in the 24-hour window. No recent items: Krebs on Security, Dark Reading, CISA Advisories, Ars Technica Security, Securelist (Kaspersky), Google Online Security Blog, Cisco Talos, Graham Cluley, Microsoft Security Blog, Google Project Zero, The DFIR Report, Kim Zetter (Zero Day), 404 Media, Frank on Fraud.
Pittsburgh: 9 of 9 feeds loaded, 60 items in the 48-hour window. No recent items: NEXTpittsburgh.
Business and Politics: 8 of 8 feeds loaded, 60 items in the 36-hour window.
Events: 4 of 4 feeds loaded, 8 items in the 120-hour window. No recent items: NEXTpittsburgh Events, NEXTpittsburgh Arts & Entertainment.
Sports media: 6 of 6 feeds loaded, 30 items in the 96-hour window. No recent items: Footbahlin with Ben Roethlisberger, Ben Roethlisberger / Channel Seven (YouTube).
Team USA: 3 of 3 feeds loaded, 28 items in the 72-hour window. No recent items: Guardian Olympics.
Reading: 3 of 3 feeds loaded, 12 items in the 336-hour window.
Markets (Yahoo Finance): 7 of 7 rows
Weather (NWS): 3 forecast periods
Scores (ESPN, plaintextsports): 2 teams via plaintextsports; mlb: ESPN failed (mlb: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nfl: ESPN failed (nfl: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nhl: ESPN failed (nhl: HTTP 403 (server: AkamaiGHost)); used plaintextsports
Summaries: 3 model call(s) served by claude-opus-5 (242s of model time; $1.65 at API list price).