Attackers own the perimeter today: Cisco patched a root-level Secure Email Gateway zero-day already in use, CISA reported ransomware crews joining attacks on a critical VMware vCenter flaw, and Apple closed 261 vulnerabilities in the largest patch release it has ever shipped.
Emerging Trends and Key Updates
- Trend China's spy chief cast Anthropic's Claude Mythos and OpenAI's GPT-5.5-Cyber as attack tools the same week Microsoft opened consultation on a Humanist AI Code of Conduct.
- Trend Edge appliances took the day's damage: unauthenticated root through Cisco's CVE-2026-76461, ransomware crews joining VMware vCenter exploitation, and a VPN flaw exposing 246,000 Japanese government records.
- Trend Delivery rode trust somebody else built, with paid ads from HBO Max's verified Reddit account pushing ClickFix while mass scanning pulled AWS and Azure keys from exposed Vite servers.
- Trend Patch speed is the whole game as Apple pushed 261 fixes across iOS 27 and Volexity watched UTA0560 chain recently patched Chrome and Windows bugs into NGOs.
- Update · new The first data center superloads roll Wednesday, PennDOT extended the Hulton Road slide closure another month, and forecasters flagged Wednesday and Thursday as Impact Days.
- Update · new Kenny Chesney booked Acrisure Stadium for Memorial Day weekend 2027, and the 16th Pittsburgh International Jazz Festival fills downtown Thursday through Sunday.
Security
1. Cisco Secure Email Gateway Zero-Day Hands Attackers Root
Latest developments: Cisco released the patch and confirmed active exploitation on September 15, 2026, detailing CVE-2026-76461 as a 9.8-rated failure to validate email parsing in AsyncOS versions 15.5, 16.0, and 16.5 that lets an unauthenticated remote attacker run arbitrary commands as root, published indicators of compromise for administrators to hunt with, and sharpened the SQL injection entry CISA posted to its Known Exploited Vulnerabilities catalog a day earlier.
read more
Cisco Secure Email Gateway appliances handle inbound mail for large enterprises, and a crafted message reaches the underlying operating system with full privileges. Administrators should install the AsyncOS fix immediately and audit the appliances for unfamiliar accounts and outbound connections.
Sources: BleepingComputer · The Hacker News · SecurityWeek · CISA Advisories · ↑ top
2. Beijing Flags US AI Models as Attack Tools
Latest developments: China's spy chief named Anthropic's Claude Mythos and OpenAI's GPT-5.5-Cyber on September 15, 2026 as signs of a disruptive upgrade in cyber capability that speeds vulnerability discovery and malware development; Sophos's Counter Threat Unit found a persona called Optimus_Prime advertising an uncensored AI subscription named Luciferus on the Exploit forum on August 24, 2026 as a substitute for jailbreaking ChatGPT or Claude; and OpenAI opened an investigation into research tying a swarm of its agents to the May 2026 attack on RubyGems.
read more
Offensive AI has moved from research claim to market commodity, with state intelligence services citing commercial models as weapons and criminal forums selling purpose-built uncensored ones. Security teams should assume exploit development and phishing production now scale past what headcount used to allow.
Sources: The Record · Help Net Security · SecurityWeek · ↑ top
3. Hijacked HBO Max Reddit Account Spreads ClickFix Malware
Latest developments: Attackers seized u/hbomax, the verified official Reddit account of HBO Max, and spent 48 hours running paid ads from it that sent macOS and Windows users to a ClickFix page, which talked them into pasting commands that installed information-stealing malware.
read more
ClickFix cons a victim into running the attacker's command on their own machine, and the stolen advertising status of a verified brand account supplies the trust the trick needs. Reddit users should treat any ad that asks them to run a terminal or Run-box command as an attack regardless of who posted it.
Sources: BleepingComputer · Help Net Security · SecurityWeek · ↑ top
4. Exposed Developer Servers Leak Cloud Credentials
Latest developments: F5 Labs documented a mass-scanning campaign hunting internet-exposed Vite development servers to pull Amazon Web Services and Microsoft Azure credentials, configurations, and infrastructure state files out of them, and Sysdig separately clocked a human operator who turned a remote code execution flaw in a Marimo notebook into access on an SSH bastion host in eight seconds.
read more
Development servers and notebooks hold live cloud keys and reach production networks, and administrators leave them open to the internet without authentication. Teams should pull Vite dev servers and Marimo notebooks off public addresses and rotate any cloud credential those hosts touched.
Sources: The Hacker News · BleepingComputer · The Hacker News · ↑ top
5. Black Axe Leaders Extradited to the United States
Latest developments: Five alleged leaders of the Black Axe syndicate arrived in the United States from South Africa to face wire fraud and money laundering charges, and prosecutors unsealed a 2021 indictment accusing the men of romance scams that took thousands of dollars each from more than 100 people; separately, Kenneth Carter, 44, of Portland, Oregon, drew 16 months in federal prison for feeding a SIM-swap gang customer information from the AT&T retail store where he worked, part of an attempt to steal more than half a million dollars.
read more
Black Axe is a Nigerian organized crime network that runs cyber-enabled financial fraud worldwide, and the Carter case shows how a single retail employee opens the telephone accounts that protect bank logins. Companies should treat carrier account access as a privileged system and monitor it accordingly.
Sources: BleepingComputer · The Record · Graham Cluley · ↑ top
6. Apple Ships Its Largest Patch Release Ever
Latest developments: Apple shipped its annual operating system upgrade on September 14, 2026, fixing 261 vulnerabilities across its platforms by the SANS Internet Storm Center's count, roughly 200 of them in iOS 27 and macOS Golden Gate 27, among them kernel flaws that lead to memory corruption, privilege escalation, system termination, and information leaks.
read more
The release sets a record for Apple and lands amid the post-AI surge in vulnerability volume that has also driven record Microsoft and Adobe patch batches this month. Fleet managers should move iPhone, iPad, and Mac endpoints to the new releases and expect exploit writers to work backward from the kernel fixes.
Sources: SecurityWeek · SANS Internet Storm Center · ↑ top
7. Japan's Digital Agency VPN Flaw Exposes 246,000 Records
Latest developments: Japan's Digital Agency disclosed a breach that may have exposed roughly 246,000 record rows of personal information on government employees, which intruders reached through a flaw in a VPN product, and SecurityWeek put the number of people whose personal information the hackers stole at about 240,000.
read more
The Digital Agency runs the Japanese government's shared digital infrastructure, so the exposed rows cover staff across ministries. Agencies relying on the same VPN products should assume credential reuse and force resets.
Sources: BleepingComputer · SecurityWeek · ↑ top
8. Microsoft Drafts a Humanist AI Code of Conduct
Latest developments: Microsoft AI published the first draft of its Humanist AI Code of Conduct on September 15, 2026, opening a six-week public consultation on a document that fixes a boundary between defensive cyber research and operational attack capability, sets a chain of command for its models, and lists safety constraints, with a revised version due later this year to govern model development from 2027 onward.
read more
The code is Microsoft's training manual for how it builds models and how it expects them to behave once customers deploy them, arriving a day after Anthropic chief executive Dario Amodei asked the industry to slow frontier improvement. Enterprises evaluating Microsoft models should read the draft as the vendor's statement of what its systems will refuse.
Sources: Help Net Security · SecurityWeek · ↑ top
9. Ransomware Gangs Join VMware vCenter Attacks
Latest developments: The Cybersecurity and Infrastructure Security Agency warned security teams on September 15, 2026 that ransomware gangs have joined the ongoing exploitation of a critical remote code execution flaw in VMware vCenter that the vendor patched in July 2026.
read more
vCenter runs the management plane for VMware virtual infrastructure, so one compromised server exposes every virtual machine beneath it, which is why extortion crews prize it. Administrators still holding the July release should apply it now and check vCenter logs for unrecognized administrative sessions.
Sources: BleepingComputer · ↑ top
10. UTA0560 Plants GRIMWEDGE in NGOs
Latest developments: Volexity reported on September 15, 2026 that the Chinese threat cluster it tracks as UTA0560 spear-phished several non-governmental organizations on September 1, 2026, chaining recently patched Google Chrome and Microsoft Windows flaws to drop a JavaScript backdoor the firm named GRIMWEDGE.
read more
GRIMWEDGE arrives through a browser exploit chain that fires on a single spear-phishing click and leaves a JavaScript implant behind, the fourth Chrome and Windows chain researchers have documented this month. Organizations running Chrome should confirm they have the September updates on every endpoint.
Sources: The Hacker News · ↑ top
Business and Politics
Kyiv and Moscow Strike Energy Targets After Truce Claim
Latest developments: Russia and Ukraine traded aerial strikes overnight into Tuesday, September 15, hitting gas stations in Kyiv and energy infrastructure in the southeastern Zaporizhzhia region, one day after President Trump announced the two sides had agreed to stop attacking each other's energy systems.
read more
Trump said Monday, September 14, that Moscow and Kyiv would spare energy infrastructure, an announcement that surprised Ukrainian officials, and he had pressed Ukraine to halt strikes on Russian refineries that he blames for record diesel prices. The exchange of strikes leaves the oil and refined-product markets without the relief a genuine energy truce would supply.
Sources: WSJ World News · ↑ top
Ten-Year Treasury Yield Tops 5%
Latest developments: The 10-year Treasury yield reached 5.04% Tuesday morning, September 15, the highest since 2007, and 10-year German and Japanese government yields hit multiyear highs as U.S. stock futures slid a day before the Federal Reserve decides on rates.
read more
A global bond selloff has lifted long-term borrowing costs past levels last seen before the financial crisis, with traders pricing a Federal Reserve increase Wednesday, September 16, on the strength of Brent crude near $108 a barrel and record American diesel prices. The Wall Street Journal reported the same morning that regulators have begun scrutinizing the growing Treasury market footprint of hedge funds, a concentration that amplifies any dislocation.
Sources: WSJ Markets · FT Home · WSJ Markets · WSJ Markets · ↑ top
Supreme Court Blocks Trump's Mail Ballot Rules
Latest developments: The U.S. Supreme Court rejected the Trump administration's new mail-ballot requirements Monday night, September 14, in an unsigned order from which Justices Samuel Alito and Clarence Thomas dissented.
read more
President Trump's executive order would have imposed fresh requirements on mail voting weeks before the November congressional elections, with voting already underway in some states; a federal appeals court blocked it September 10 and the administration sought emergency relief. Election administrators had warned that implementing new rules this late would throw the midterms into a scramble.
Sources: FT World · WSJ Politics · ↑ top
Diesel Sets a Record at $6.27
Latest developments: The average U.S. diesel price hit a record $6.27 a gallon Tuesday, September 15, hardening expectations of a Federal Reserve rate increase, while Brent traded at $107.59 with Saudi Arabia's East-West pipeline still shut.
read more
Drones fired from Iraq knocked out the line that moves Saudi crude from the eastern oil fields to the Red Sea, and Houthi forces have seized territory commanding the Bab al-Mandeb corridor, leaving Crown Prince Mohammed bin Salman fighting on two fronts. American manufacturers report a fresh burst of supply chain cost inflation from the Iran war, tariffs, and AI-driven component scarcity.
Sources: WSJ Markets · WSJ World News · FT Home · FT World · ↑ top
Pittsburgh
Weather
Today: Sunny, high 82F.
Tonight: Mostly Clear, low 63F.
Wednesday: Mostly Sunny, high 87F.
Business
Superloads Roll Wednesday
Latest developments: KDKA reported Tuesday, September 15, that the first superload deliveries to Pennsylvania data center construction sites begin Wednesday, September 16, with each haul running the size of a Boeing 777 with its wings tucked in.
read more
The hauls carry equipment weighing as much as 380 tons from the Armstrong Terminals in Gilpin to the data center project near Homer City in Indiana County, where more than 1,800 construction workers are already at work on the Homer City Energy Campus. The loads slipped past two earlier announced start dates.
Hispanic Chamber Opens New Programs for Entrepreneurs
Latest developments: Pittsburgh Magazine reported Tuesday, September 15, that the Pennsylvania Metropolitan Area Hispanic Chamber of Commerce is launching programs and resources for Hispanic business owners as Hispanic Heritage Month begins.
read more
Hispanic Heritage Month runs September 15, the independence anniversary for Costa Rica, El Salvador, Guatemala, Honduras, and Nicaragua, through October 15, and the chamber marks it with galas, festivals, and support work for Hispanic-owned businesses across the Pittsburgh region.
Sources: Pittsburgh Magazine · ↑ top
Liquor Money as Growth Money
Latest developments: Post-Gazette columnist Brandon McGinley argued Tuesday, September 15, that Pennsylvania should study how Ohio turns state liquor sales profits into economic development through JobsOhio.
read more
Ohio pledges the profits of its state liquor enterprise to JobsOhio, the private nonprofit that recruits employers and readies industrial sites, giving the state a dedicated stream of deal money. Pennsylvania runs its own liquor stores through the Pennsylvania Liquor Control Board and pays for site preparation out of Governor Josh Shapiro's PA SITES program, which competes for general fund dollars every budget cycle.
Sources: Pittsburgh Post-Gazette · ↑ top
KLVN Closes and the Gobblerito Turns 20
Latest developments: Pittsburgh City Paper reported Tuesday, September 15, that KLVN Coffee Lab has closed and that Mad Mex's Gobblerito reaches its 20th year, alongside fresh word on Penn Brewery, Acrisure Stadium concessions, and Jackworth Ginger Beer.
read more
KLVN Coffee Lab shuts its doors as the Gobblerito, the Thanksgiving-dinner burrito that Mad Mex sells each fall, marks two decades on the menu. Penn Brewery, the Troy Hill brewer that filed for bankruptcy five months ago, has landed new owners.
Sources: Pittsburgh City Paper · WPXI · ↑ top
Riverfront Theater Moves Downtown
Latest developments: TribLive reported Tuesday, September 15, that Riverfront Theater Company has left Aspinwall for a space in Pittsburgh's Cultural District, keeping its name.
read more
Riverfront Theater Company built its audience in the Allegheny River borough of Aspinwall and now joins the concentration of stages in the Cultural District downtown. The move puts a small producing company inside the same blocks as the Benedum Center and the Byham Theater.
Around Town
Hulton Road Stays Closed Another Month
Latest developments: The Pennsylvania Department of Transportation extended the slide repair on Hulton Road in Plum Borough, keeping the road closed around the clock for another month, WPXI reported Tuesday, September 15.
read more
Crews are stabilizing a hillside slide along Hulton Road, the Plum Borough route that carries traffic toward the Allegheny River crossing at Oakmont. Drivers have already lived with a full closure and now face roughly four more weeks of detours.
Impact Days Wednesday and Thursday
Latest developments: WTAE flagged Wednesday, September 16, and Thursday, September 17, as Impact Days Tuesday morning, September 15, after a chilly start that warms through the afternoon, and KDKA meteorologist Ron Smiley expects rain chances to return Wednesday afternoon.
read more
Tuesday stays dry across the Pittsburgh area, and the next system arrives midweek with rain heavy enough for the stations to flag two straight days. The region has taken repeated flooding this summer, most recently in Washington County and along Wildwood Road in Hampton Township.
Pitcairn Council Keeps Its ICE Agreement
Latest developments: Pitcairn Borough Council voted 5-2 on Monday, September 14, against a resolution to terminate the borough police department's cooperation agreement with U.S. Immigration and Customs Enforcement.
read more
Pitcairn entered the 287(g) agreement, which deputizes local officers to perform federal immigration functions, without public input or a council vote, and residents filled a heated meeting to demand that the council undo it. The vote runs opposite the direction taken in Stowe Township, where commissioners rescinded their own 287(g) agreement earlier this month.
Sources: TribLive · Pittsburgh Post-Gazette · KDKA · WTAE · ↑ top
1,400 Comments on Paid Parental Leave
Latest developments: PublicSource reported Tuesday, September 15, that Allegheny County collected about 1,400 public comments on its paid parental leave proposal, a record for the county, and that the tally shows broad support, a deep split, and appetite for changes to the bill.
read more
The legislation before Allegheny County Council would give county employees 18 weeks of paid parental leave, a signature item for County Executive Sara Innamorato as she seeks reelection, and the Council's health committee held a public hearing on it September 10. Residents now get another window to weigh in on possible amendments.
Sources: PublicSource · ↑ top
Plum Backs Clover Commons Residents
Latest developments: Plum Borough Council passed a resolution urging the Pennsylvania legislature to act for residents of Clover Commons facing steep land rent increases, and TribLive's editorial board pressed the state Senate the same day, September 15, to move on manufactured home protections.
read more
Nearly 60 residents of Clover Commons, a senior manufactured home community in Plum, marched through their own streets last week over land rent that has climbed by roughly a third in a few years, and asked state senators to pass House Bill 1250. Homeowners in such communities own the house and rent the ground beneath it, which leaves them exposed when an owner raises the rent.
Sources: WTAE · TribLive · ↑ top
Events
Kenny Chesney Books Acrisure Stadium for 2027
Latest developments: Kenny Chesney announced Tuesday, September 15, that his Original Vibe Room Tour will play Acrisure Stadium over Memorial Day weekend in May 2027, with Eric Church, Sheryl Crow, and Reylan James on the bill.
read more
Chesney returns to Acrisure Stadium on Pittsburgh's North Shore, the football stadium he has filled repeatedly on stadium tours, for a Memorial Day weekend date in May 2027. The announcements from KDKA, WTAE, WPXI, and the Post-Gazette did not state ticket prices or an on-sale date.
Sources: Post-Gazette Arts & Entertainment · KDKA · WTAE · ↑ top
Jazz Festival Fills Downtown Thursday Through Sunday
Latest developments: Pittsburgh Magazine's weekend list, published Tuesday, September 15, leads with the 16th Pittsburgh International Jazz Festival, which runs Thursday, September 17, through Sunday, September 20, downtown.
read more
The festival is free and family friendly, and this year carries the theme "Our America250" for the nation's 250th anniversary, tracing how jazz, blues, rock, soul, gospel, and hip hop shaped American culture. Programming runs across downtown Pittsburgh over the four days.
Sources: Pittsburgh Magazine · ↑ top
Flight 93 Chalk Portraits in Somerset
Latest developments: The Post-Gazette reported Tuesday, September 15, that the chalk portraits of the 40 Flight 93 passengers and crew will stay on view in Somerset through Sunday, September 20.
read more
Artists drew the portraits in chalk for the 25th anniversary of the September 11, 2001, attacks, and organizers are preserving them in Somerset, the Somerset County seat about 15 miles from the Flight 93 National Memorial in Stonycreek Township. Visitors can see them through Sunday, September 20.
Sources: Pittsburgh Post-Gazette · ↑ top
Film on Film at Row House Hollywood
Latest developments: Pittsburgh City Paper profiled projectionist Katerina Sarandou on Tuesday, September 15, who has run the booth at Row House Hollywood since the theater's first screening.
read more
Row House Hollywood programs 35mm and 70mm prints for audiences that want movies projected the pre-digital way, and Sarandou threads and runs every one of them. The theater is the second house from the Row House team, which started with Row House Cinema in Lawrenceville.
Sources: Pittsburgh City Paper · ↑ top
Sports
Pirates (75-75)
Up Next · Brewers @ Pirates · Tue Sep 15, 6:40 PM
Steelers (1-0, T-1st in AFC North)
Up Next · Steelers @ Patriots · Sun Sep 20, 1:00 PM
Around the Teams
Week 1 Grades Split Watt and Metcalf
Latest developments: The Post-Gazette published its Week 1 grades Tuesday, September 15, calling T.J. Watt's performance that of a superstar and marking down receiver DK Metcalf.
read more
Watt's pick-six against the Atlanta Falcons decided the Steelers' season opener, and Alex Highsmith's late sack closed it out, while Metcalf, acquired to stretch the field for quarterback Aaron Rodgers, drew the harshest review of the afternoon. The offense, hemmed in by penalties, told reporters it sits close to hitting the big plays it drew up.
Sources: Post-Gazette Steelers · ↑ top
Dan Rooney Talks German Plans on Männer aus Stahl
Latest developments: The Steelers posted the new season opener of their German-language podcast Männer aus Stahl on Tuesday, September 15, with Vice President of Strategy Dan Rooney discussing the club's plans for its German fan base.
read more
ProSieben host Christoph "Icke" Dommisch interviews Rooney, a member of the family that founded the Steelers, about the team's first game with Borussia Dortmund, its flag football camp in Germany, and German food. The Steelers hold marketing rights in Germany and have built a following there.
Sources: Pittsburgh Steelers (YouTube) · ↑ top
SNR Drive Turns the Page to New England
Latest developments: Matt Williamson and Wes Uhler spent Monday's SNR Drive, posted September 14 on the Steelers' channel, reviewing the Week 1 win over the Atlanta Falcons and head coach Mike McCarthy's Monday news conference, and the club began promoting Week 2 at the New England Patriots, Sunday, September 20, at 1 p.m. ET on CBS.
read more
SNR Drive is the Steelers' daily radio and video show, and Williamson, a former NFL scout, works through the tape and the coach's remarks with Uhler each weekday. McCarthy, in his first season running the team, met reporters Monday to open preparation for the trip to Foxborough.
Sources: Pittsburgh Steelers (YouTube) · Pittsburgh Steelers (YouTube) · ↑ top
Team USA
Colombia Courts Alexander Shaw
Latest developments: A source told ESPN on Tuesday, September 15, that Colombia has contacted Inter Miami midfielder Alexander Shaw, who played for the United States under-20 team in this year's Concacaf tournament, setting up a fight over his international future.
read more
Shaw holds dual nationality, and a player who has appeared only in youth competition may still switch federations before committing at the senior level. The United States developed him through its under-20 program, and Colombia now aims to pull him the other way.
Sources: ESPN Soccer · ↑ top
Reading
- Stratechery — OpenAI Ads, Amazon Ads in ChatGPT, Walmart to Accept Apple Pay. Ben Thompson argues that advertising inside ChatGPT is already working and that it hands Amazon an answer to the problem chatbots pose to its retail search business. He reads Walmart's decision to accept Apple Pay as proof that fighting an entrenched standard costs more than joining it.
- Ed Zitron — AI Is Already In Dangerous Hands. Zitron contends that the speculative case about future superintelligence distracts from the concrete harm the people running today's AI companies are doing with the technology they already control.
- Cal Newport — Superintelligence is a Fairy Tale. But Chasing It Can Still Cause Harm.. Newport dismisses the prospect of self-improving superintelligence as a story the industry tells itself, writing in response to Anthropic employees who said publicly that their work could kill billions. He argues the pursuit still does damage through the money, energy, and social disruption it consumes along the way.
Markets
S&P 500 7,635.71 ▼ -0.7% Dow 52,445.06 ▼ -1.5% Nasdaq 26,255.18 ▼ -0.4% WTI crude 98.60 ▲ +9.6% EUR/USD 1.1619 ▲ +0.1% GBP/USD 1.3536 ▲ +0.1% USD/JPY 153.76 ▼ -2.8%
Feed Health
Security: 24 of 24 feeds loaded, 63 items in the 24-hour window. No recent items: Krebs on Security, CISA Advisories, Ars Technica Security, Securelist (Kaspersky), Unit 42 (Palo Alto), Google Online Security Blog, Cisco Talos, Microsoft Security Blog, Google Project Zero, The DFIR Report, Kim Zetter (Zero Day), Frank on Fraud.
Pittsburgh: 9 of 9 feeds loaded, 60 items in the 48-hour window.
Business and Politics: 8 of 8 feeds loaded, 60 items in the 36-hour window.
Events: 4 of 4 feeds loaded, 8 items in the 120-hour window. No recent items: NEXTpittsburgh Events, NEXTpittsburgh Arts & Entertainment.
Sports media: 6 of 6 feeds loaded, 30 items in the 96-hour window. No recent items: Footbahlin with Ben Roethlisberger, Ben Roethlisberger / Channel Seven (YouTube).
Team USA: 3 of 3 feeds loaded, 29 items in the 72-hour window. No recent items: Guardian Olympics.
Reading: 3 of 3 feeds loaded, 12 items in the 336-hour window.
Markets (Yahoo Finance): 7 of 7 rows
Weather (NWS): 3 forecast periods
Scores (ESPN, plaintextsports): 2 teams via plaintextsports; mlb: ESPN failed (mlb: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nfl: ESPN failed (nfl: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nhl: ESPN failed (nhl: HTTP 403 (server: AkamaiGHost)); used plaintextsports
Summaries: 3 model call(s) served by claude-opus-5 (310s of model time; $1.91 at API list price).