================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Tuesday, September 15, 2026 - 7:05 AM EDT ================================================================ Cisco rushed out a fix for a Secure Email Gateway zero-day that hands unauthenticated attackers root on the appliance, while Chinese operators chained patched Chrome and Windows bugs to plant the GRIMWEDGE backdoor inside non-governmental organizations. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets | Feed Health EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Attackers keep hitting the boxes guarding the edge: Cisco patched actively exploited CVE-2026-76461 for root on AsyncOS, while Japan's Digital Agency traced 246,000 exposed records to a VPN flaw. see: Cisco Secure Email Gateway Zero-Day Hands Attackers Root; Japan's Digital Agency VPN Flaw Exposes 246,000 Records * [TREND] Microsoft opened six weeks of comment on a Humanist AI Code of Conduct drawing the offensive-cyber line, as Zitron and Newport argue today's operators already cause harm. see: Microsoft Drafts a Humanist AI Code of Conduct; AI Is Already In Dangerous Hands; Superintelligence is a Fairy Tale. But Chasing It Can Still Cause Harm. * [TREND] Criminals rent reputation they never earned: the verified u/hbomax account ran 48 hours of ClickFix ads, while five Black Axe romance-scam leaders were extradited from South Africa. see: Hijacked HBO Max Reddit Account Spreads ClickFix Malware; Black Axe Leaders Extradited to the United States * [UPDATE (new)] Volexity says Chinese cluster UTA0560 spear-phished several NGOs on September 1, chaining recently patched Chrome and Windows flaws to plant the GRIMWEDGE implant. see: UTA0560 Plants GRIMWEDGE in NGOs * [UPDATE (new)] The 10-year Treasury yield touched 5.04%, its highest since 2007, and diesel set a $6.27 record a day before the Federal Reserve's rate decision. see: Ten-Year Treasury Yield Tops 5%; Diesel Sets a Record at $6.27 * [UPDATE (new)] Pitcairn council voted 5-2 to keep its ICE agreement, Allegheny County logged a record 1,400 comments on paid parental leave, and Plum backed Clover Commons residents. see: Pitcairn Council Keeps Its ICE Agreement; 1,400 Comments on Paid Parental Leave; Plum Backs Clover Commons Residents SECURITY ---------------------------------------------------------------- 1. CISCO SECURE EMAIL GATEWAY ZERO-DAY HANDS ATTACKERS ROOT Vulnerabilities and Exploits · [zero-day, patch, kev] Latest developments: Cisco released the patch and confirmed active exploitation on September 15, 2026, detailing CVE-2026-76461 as a 9.8-rated failure to validate email parsing in AsyncOS that lets an unauthenticated remote attacker run arbitrary commands as root, a sharper account than the SQL injection entry CISA posted to its Known Exploited Vulnerabilities catalog a day earlier. Cisco Secure Email Gateway appliances handle inbound mail for large enterprises, and a crafted message reaches the underlying operating system with full privileges. Administrators should install the AsyncOS fix immediately and audit the appliances for unfamiliar accounts and outbound connections. - BleepingComputer: https://www.bleepingcomputer.com/news/security/new-cisco-secure-email-zero-day-exploited-to-execute-commands-as-root/ - The Hacker News: https://thehackernews.com/2026/09/cisco-secure-email-gateway-flaw.html - SecurityWeek: https://www.securityweek.com/root-rce-zero-day-in-cisco-secure-email-gateway-under-active-exploitation/ - CISA Advisories: https://www.cisa.gov/news-events/alerts/2026/09/14/cisa-adds-one-known-exploited-vulnerability-catalog 2. HIJACKED HBO MAX REDDIT ACCOUNT SPREADS CLICKFIX MALWARE Ransomware and Cybercrime · [clickfix, infostealer, malvertising] Latest developments: Attackers seized u/hbomax, the verified official Reddit account of HBO Max, and spent 48 hours running paid ads from it that sent macOS and Windows users to a ClickFix page, which talked them into pasting commands that installed information-stealing malware. ClickFix cons a victim into running the attacker's command on their own machine, and the stolen advertising status of a verified brand account supplies the trust the trick needs. Reddit users should treat any ad that asks them to run a terminal or Run-box command as an attack regardless of who posted it. - BleepingComputer: https://www.bleepingcomputer.com/news/security/hackers-hijack-hbo-max-reddit-account-to-push-malware-in-clickfix-ads/ - Help Net Security: https://www.helpnetsecurity.com/2026/09/15/hbo-max-reddit-account-clickfix-infostealer-malware/ - SecurityWeek: https://www.securityweek.com/hacked-hbo-reddit-account-used-for-malware-delivery-via-clickfix-attack/ 3. BLACK AXE LEADERS EXTRADITED TO THE UNITED STATES Ransomware and Cybercrime · [fraud, law enforcement, sim swapping] Latest developments: Five alleged leaders of the Black Axe syndicate arrived in the United States from South Africa to face wire fraud and money laundering charges, and prosecutors unsealed a 2021 indictment accusing the men of romance scams that took thousands of dollars each from more than 100 people; separately, Kenneth Carter, 44, of Portland, Oregon, drew 16 months in federal prison for feeding a SIM-swap gang customer information from the AT&T retail store where he worked, part of an attempt to steal more than half a million dollars. Black Axe is a Nigerian organized crime network that runs cyber-enabled financial fraud worldwide, and the Carter case shows how a single retail employee opens the telephone accounts that protect bank logins. Companies should treat carrier account access as a privileged system and monitor it accordingly. - BleepingComputer: https://www.bleepingcomputer.com/news/security/black-axe-gang-members-extradited-to-us-face-cybercrime-charges/ - The Record: https://therecord.media/members-of-black-axe-cybercrime-group-extradited-south-africa - Graham Cluley: https://www.bitdefender.com/en-us/blog/hotforsecurity/former-at-t-worker-jailed-sim-swap 4. MICROSOFT DRAFTS A HUMANIST AI CODE OF CONDUCT AI Security · [ai, policy, governance] Latest developments: Microsoft AI published the first draft of its Humanist AI Code of Conduct on September 15, 2026, opening a six-week public consultation on a document that fixes a boundary between defensive cyber research and operational attack capability, sets a chain of command for its models, and lists safety constraints, with a revised version due later this year to govern model development from 2027 onward. The code is Microsoft's training manual for how it builds models and how it expects them to behave once customers deploy them, arriving a day after Anthropic chief executive Dario Amodei asked the industry to slow frontier improvement. Enterprises evaluating Microsoft models should read the draft as the vendor's statement of what its systems will refuse. - Help Net Security: https://www.helpnetsecurity.com/2026/09/15/microsoft-ai-safety-rules-humanist-ai-code-of-conduct/ - SecurityWeek: https://www.securityweek.com/microsoft-ai-code-of-conduct-sets-cyberattack-boundaries-chain-of-command-safety-constraints/ 5. UTA0560 PLANTS GRIMWEDGE IN NGOS Nation-State Activity · [apt, zero-day, espionage] Latest developments: Volexity reported on September 15, 2026 that the Chinese threat cluster it tracks as UTA0560 spear-phished several non-governmental organizations on September 1, 2026, chaining recently patched Google Chrome and Microsoft Windows flaws to drop a JavaScript backdoor the firm named GRIMWEDGE. GRIMWEDGE arrives through a browser exploit chain that fires on a single spear-phishing click and leaves a JavaScript implant behind, the fourth Chrome and Windows chain researchers have documented this month. Organizations running Chrome should confirm they have the September updates on every endpoint. - The Hacker News: https://thehackernews.com/2026/09/china-linked-hackers-exploit-chrome.html 6. JAPAN'S DIGITAL AGENCY VPN FLAW EXPOSES 246,000 RECORDS Data Breaches · [breach, vpn, government] Latest developments: Japan's Digital Agency disclosed a breach that may have exposed roughly 246,000 record rows of personal information on government employees, which intruders reached through a flaw in the agency's VPN. The Digital Agency runs the Japanese government's shared digital infrastructure, so the exposed rows cover staff across ministries. Agencies relying on the same VPN products should assume credential reuse and force resets. - BleepingComputer: https://www.bleepingcomputer.com/news/security/japans-digital-agency-says-vpn-flaw-exposed-246-000-personnel-records/ BUSINESS AND POLITICS ---------------------------------------------------------------- * Ten-Year Treasury Yield Tops 5% Latest developments: The 10-year Treasury yield reached 5.04% Tuesday morning, September 15, the highest since 2007, and 10-year German and Japanese government yields hit multiyear highs as U.S. stock futures slid a day before the Federal Reserve decides on rates. A global bond selloff has lifted long-term borrowing costs past levels last seen before the financial crisis, with traders pricing a Federal Reserve increase Wednesday, September 16, on the strength of Brent crude near $108 a barrel and record American diesel prices. The Wall Street Journal reported the same morning that regulators have begun scrutinizing the growing Treasury market footprint of hedge funds, a concentration that amplifies any dislocation. - WSJ Markets: https://www.wsj.com/finance/investing/u-s-10-year-treasury-yield-rises-to-highest-since-2007-91d1e44f?mod=rss_markets_main - FT Home: https://www.ft.com/content/5e2327aa-dbd0-4a79-8c99-622a893876d7?syn-25a6b1a6=1 - WSJ Markets: https://www.wsj.com/finance/stocks/stock-futures-retreat-10-year-treasury-yield-holds-above-5-as-investors-await-fed-decision-1cde847e?mod=rss_markets_main - WSJ Markets: https://www.wsj.com/finance/investing/hedge-funds-face-scrutiny-over-growing-treasury-footprint-8490230d?mod=rss_markets_main * Supreme Court Blocks Trump's Mail Ballot Rules Latest developments: The U.S. Supreme Court rejected the Trump administration's new mail-ballot requirements Monday night, September 14, in an unsigned order from which Justices Samuel Alito and Clarence Thomas dissented. President Trump's executive order would have imposed fresh requirements on mail voting weeks before the November congressional elections, with voting already underway in some states; a federal appeals court blocked it September 10 and the administration sought emergency relief. Election administrators had warned that implementing new rules this late would throw the midterms into a scramble. - FT Home: https://www.ft.com/content/b3674c9d-9db2-448d-bd57-f1c040de2d54?syn-25a6b1a6=1 - WSJ Politics: https://www.wsj.com/politics/policy/supreme-court-blocks-trumps-new-mail-ballot-requirements-for-midterms-d7e8af3f?mod=rss_socialpoliticsfeed * Diesel Sets a Record at $6.27 Latest developments: The average U.S. diesel price hit a record $6.27 a gallon Tuesday, September 15, hardening expectations of a Federal Reserve rate increase, while Brent traded at $107.59 with Saudi Arabia's East-West pipeline still shut. Drones fired from Iraq knocked out the line that moves Saudi crude from the eastern oil fields to the Red Sea, and Houthi forces have seized territory commanding the Bab al-Mandeb corridor, leaving Crown Prince Mohammed bin Salman fighting on two fronts. American manufacturers report a fresh burst of supply chain cost inflation from the Iran war, tariffs, and AI-driven component scarcity. - WSJ Markets: https://www.wsj.com/finance/commodities-futures/u-s-diesel-prices-hit-new-record-high-as-fuel-squeeze-bites-455c4983?mod=rss_markets_main - WSJ World News: https://www.wsj.com/business/energy-oil/oil-prices-rise-as-middle-east-supply-concerns-persist-e3bff20f?mod=rss_worldnews - FT Home: https://www.ft.com/content/a143e08d-e979-410a-8e81-160fd4eba367?syn-25a6b1a6=1 - FT World: https://www.ft.com/content/e14542d9-2bc5-49c8-8e7e-c9656b0a2d36?syn-25a6b1a6=1 PITTSBURGH ---------------------------------------------------------------- Weather: Today: Sunny, high 82F. Tonight: Mostly Clear, low 63F. Wednesday: Mostly Sunny, high 87F. Business: * Liquor Money as Growth Money Latest developments: Post-Gazette columnist Brandon McGinley argued Tuesday, September 15, that Pennsylvania should study how Ohio turns state liquor sales profits into economic development through JobsOhio. Ohio pledges the profits of its state liquor enterprise to JobsOhio, the private nonprofit that recruits employers and readies industrial sites, giving the state a dedicated stream of deal money. Pennsylvania runs its own liquor stores through the Pennsylvania Liquor Control Board and pays for site preparation out of Governor Josh Shapiro's PA SITES program, which competes for general fund dollars every budget cycle. - Pittsburgh Post-Gazette: https://www.post-gazette.com/local/city/2026/09/15/ohio-jobsohio-liquor-economic-development-shapiro-pa-sites/stories/202609090015 * KLVN Closes and the Gobblerito Turns 20 Latest developments: Pittsburgh City Paper reported Tuesday, September 15, that KLVN Coffee Lab has closed and that Mad Mex's Gobblerito reaches its 20th year, alongside fresh word on Penn Brewery, Acrisure Stadium concessions, and Jackworth Ginger Beer. KLVN Coffee Lab shuts its doors as the Gobblerito, the Thanksgiving-dinner burrito that Mad Mex sells each fall, marks two decades on the menu. Penn Brewery, the Troy Hill brewer that filed for bankruptcy five months ago, has landed new owners. - Pittsburgh City Paper: https://www.pghcitypaper.com/food-drink/the-gobblerito-turns-20-klvn-closes-and-more-pittsburgh-food-news/ - WPXI: https://www.wpxi.com/news/local/pittsburghs-oldest-brewery-receives-new-owners/VZRE3ASKKBD27DO4M3FEV2PIMM/ * Riverfront Theater Moves Downtown Latest developments: TribLive reported Tuesday, September 15, that Riverfront Theater Company has left Aspinwall for a space in Pittsburgh's Cultural District, keeping its name. Riverfront Theater Company built its audience in the Allegheny River borough of Aspinwall and now joins the concentration of stages in the Cultural District downtown. The move puts a small producing company inside the same blocks as the Benedum Center and the Byham Theater. - TribLive: https://triblive.com/local/fox-chapel/riverfront-theater-company-relocates-from-aspinwall-to-pittsburghs-cultural-district/ Around town: * Pitcairn Council Keeps Its ICE Agreement Latest developments: Pitcairn Borough Council voted 5-2 on Monday, September 14, against a resolution to terminate the borough police department's cooperation agreement with U.S. Immigration and Customs Enforcement. Pitcairn entered the 287(g) agreement, which deputizes local officers to perform federal immigration functions, without public input or a council vote, and residents filled a heated meeting to demand that the council undo it. The vote runs opposite the direction taken in Stowe Township, where commissioners rescinded their own 287(g) agreement earlier this month. - TribLive: https://triblive.com/local/monroeville/pitcairn-council-votes-down-resolution-to-end-police-ice-agreement/ - Pittsburgh Post-Gazette: https://www.post-gazette.com/local/2026/09/14/ice-pitcairn-police-department-partnership-vote-borough-council-287-g/stories/202609140051 - KDKA: https://www.cbsnews.com/pittsburgh/news/pitcairn-meeting-ice-agreement/ - WTAE: https://www.wtae.com/article/pennsylvania-pitcairn-police-ice/73733859 * 1,400 Comments on Paid Parental Leave Latest developments: PublicSource reported Tuesday, September 15, that Allegheny County collected about 1,400 public comments on its paid parental leave proposal, a record for the county, and that the tally shows broad support, a deep split, and appetite for changes to the bill. The legislation before Allegheny County Council would give county employees 18 weeks of paid parental leave, a signature item for County Executive Sara Innamorato as she seeks reelection, and the Council's health committee held a public hearing on it September 10. Residents now get another window to weigh in on possible amendments. - PublicSource: https://www.publicsource.org/allegheny-county-paid-parental-leave-proposal-comments/ * Plum Backs Clover Commons Residents Latest developments: Plum Borough Council passed a resolution urging the Pennsylvania legislature to act for residents of Clover Commons facing steep land rent increases, and TribLive's editorial board pressed the state Senate the same day, September 15, to move on manufactured home protections. Nearly 60 residents of Clover Commons, a senior manufactured home community in Plum, marched through their own streets last week over land rent that has climbed by roughly a third in a few years, and asked state senators to pass House Bill 1250. Homeowners in such communities own the house and rent the ground beneath it, which leaves them exposed when an owner raises the rent. - WTAE: https://www.wtae.com/article/plum-borough-council-resolution-rent-increases/73733993 - TribLive: https://triblive.com/opinion/editorial-senate-should-move-on-manufactured-home-protections/ Events: * Flight 93 Chalk Portraits in Somerset Latest developments: The Post-Gazette reported Tuesday, September 15, that the chalk portraits of the 40 Flight 93 passengers and crew will stay on view in Somerset through Sunday, September 20. Artists drew the portraits in chalk for the 25th anniversary of the September 11, 2001, attacks, and organizers are preserving them in Somerset, the Somerset County seat about 15 miles from the Flight 93 National Memorial in Stonycreek Township. Visitors can see them through Sunday, September 20. - Pittsburgh Post-Gazette: https://www.post-gazette.com/life/goodness/2026/09/15/chalk-portraits-flight-93-memorial-shanksville-pa-911/stories/202609140030 * Film on Film at Row House Hollywood Latest developments: Pittsburgh City Paper profiled projectionist Katerina Sarandou on Tuesday, September 15, who has run the booth at Row House Hollywood since the theater's first screening. Row House Hollywood programs 35mm and 70mm prints for audiences that want movies projected the pre-digital way, and Sarandou threads and runs every one of them. The theater is the second house from the Row House team, which started with Row House Cinema in Lawrenceville. - Pittsburgh City Paper: https://www.pghcitypaper.com/arts-entertainment-2/katerina-sarandou-revives-the-art-of-film-projection-at-row-house-hollywood/ SPORTS ---------------------------------------------------------------- Pirates (75-75) Up Next · Brewers @ Pirates · Tue Sep 15, 6:40 PM https://plaintextsports.com/mlb/2026-09-15/mil-pit Steelers (1-0, T-1st in AFC North) Up Next · Steelers @ Patriots · Sun Sep 20, 1:00 PM https://plaintextsports.com/nfl/2026/teams/pittsburgh-steelers Around the Teams: * SNR Drive Turns the Page to New England Latest developments: Matt Williamson and Wes Uhler spent Monday's SNR Drive, posted September 14 on the Steelers' channel, reviewing the Week 1 win over the Atlanta Falcons and head coach Mike McCarthy's Monday news conference, and the club began promoting Week 2 at the New England Patriots, Sunday, September 20, at 1 p.m. ET on CBS. SNR Drive is the Steelers' daily radio and video show, and Williamson, a former NFL scout, works through the tape and the coach's remarks with Uhler each weekday. McCarthy, in his first season running the team, met reporters Monday to open preparation for the trip to Foxborough. - Pittsburgh Steelers (YouTube): https://www.youtube.com/watch?v=0bPe7tfg1gM - Pittsburgh Steelers (YouTube): https://www.youtube.com/watch?v=ZQ71kAuM-mE Team USA: * Colombia Courts Alexander Shaw Latest developments: A source told ESPN on Tuesday, September 15, that Colombia has contacted Inter Miami midfielder Alexander Shaw, who played for the United States under-20 team in this year's Concacaf tournament, setting up a fight over his international future. Shaw holds dual nationality, and a player who has appeared only in youth competition may still switch federations before committing at the senior level. The United States developed him through its under-20 program, and Colombia now aims to pull him the other way. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49946575/source-colombia-united-state-battling-inter-miami-20-dual-national-alexander-shaw READING ---------------------------------------------------------------- * Stratechery -- OpenAI Ads, Amazon Ads in ChatGPT, Walmart to Accept Apple Pay Ben Thompson argues that advertising inside ChatGPT is already working and that it hands Amazon an answer to the problem chatbots pose to its retail search business. He reads Walmart's decision to accept Apple Pay as proof that fighting an entrenched standard costs more than joining it. https://stratechery.com/2026/openai-ads-amazon-ads-in-chatgpt-walmart-to-accept-apple-pay/ * Ed Zitron -- AI Is Already In Dangerous Hands Zitron contends that the speculative case about future superintelligence distracts from the concrete harm the people running today's AI companies are doing with the technology they already control. https://www.wheresyoured.at/ai-is-already-in-dangerous-hands/ * Cal Newport -- Superintelligence is a Fairy Tale. But Chasing It Can Still Cause Harm. Newport dismisses the prospect of self-improving superintelligence as a story the industry tells itself, writing in response to Anthropic employees who said publicly that their work could kill billions. He argues the pursuit still does damage through the money, energy, and social disruption it consumes along the way. https://calnewport.com/superintelligence-is-a-fairy-tale-but-chasing-it-can-still-cause-harm/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,635.71 ▼ -0.7% Dow 52,445.06 ▼ -1.5% Nasdaq 26,255.18 ▼ -0.4% WTI crude 98.60 ▲ +9.6% EUR/USD 1.1619 ▲ +0.1% GBP/USD 1.3536 ▲ +0.1% USD/JPY 153.76 ▼ -2.8% FEED HEALTH ---------------------------------------------------------------- Security: 24 of 24 feeds loaded, 60 items in the 24-hour window. No recent items: Krebs on Security, Ars Technica Security, Securelist (Kaspersky), Sophos News, Unit 42 (Palo Alto), Google Online Security Blog, Cisco Talos, Microsoft Security Blog, Google Project Zero, The DFIR Report, Kim Zetter (Zero Day), Frank on Fraud. Pittsburgh: 9 of 9 feeds loaded, 60 items in the 48-hour window. Business and Politics: 8 of 8 feeds loaded, 60 items in the 36-hour window. Events: 4 of 4 feeds loaded, 8 items in the 120-hour window. No recent items: NEXTpittsburgh Events, NEXTpittsburgh Arts & Entertainment. Sports media: 6 of 6 feeds loaded, 30 items in the 96-hour window. No recent items: Footbahlin with Ben Roethlisberger, Ben Roethlisberger / Channel Seven (YouTube). Team USA: 3 of 3 feeds loaded, 28 items in the 72-hour window. No recent items: Guardian Olympics. Reading: 3 of 3 feeds loaded, 12 items in the 336-hour window. Markets (Yahoo Finance): 7 of 7 rows Weather (NWS): 3 forecast periods Scores (ESPN, plaintextsports): 2 teams via plaintextsports; mlb: ESPN failed (mlb: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nfl: ESPN failed (nfl: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nhl: ESPN failed (nhl: HTTP 403 (server: AkamaiGHost)); used plaintextsports Summaries: 3 model call(s) served by claude-opus-5 (296s of model time; $1.69 at API list price). ================================================================ Generated 2026-09-15 07:05 EDT. Updated weekdays at about 7:05 AM, 10:05 AM, 1:35 PM, and 7:35 PM ET, and weekends at about 8:05 AM and 7:35 PM ET. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 3 Team USA feeds; WSJ World News, WSJ Markets, WSJ US Business, WSJ Politics, The Economist, FT Home, FT World, FT Markets; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN or plaintextsports.com. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================