Hackers cracked open a Flock Safety camera and published what it saw, while Oracle, Google, and Mozilla shipped more than 900 fixes and attackers forged administrator tokens into WSO2 API Manager.
Emerging Trends and Key Updates
- Trend Mandiant logs indirect prompt injection and AI supply chain compromise moving faster than patch cycles, while Zitron and Newport argue the concentrated power of today's AI firms is the nearer danger.
- Trend Espionage crews keep working below the endpoint agent, with NightEagle abusing Active Directory and Remote Desktop at Russian firms and BambooToken tunneling commands over MQTT across Asia and South America.
- Trend Authentication tokens are the prize: watchTowr reports active exploitation of CVE-2026-5430, a signature-verification failure letting attackers forge administrator JSON Web Tokens and take over WSO2 API Manager accounts.
- Update · new Oracle's September release closes more than 800 vulnerabilities across 17 product families, over 100 critical, alongside 110 Pixel fixes including a zero-day already used in targeted attacks.
- Update · new A hacker collective pulled the software and stored data off a Flock Safety camera, which Wired found had captured 1.6 million images of 50,000 vehicles alone.
- Update · new The Fed's rate decision lands Wednesday afternoon, Upper Burrell delayed its data center ordinance for more resident input, and a 381-ton superload crossed three counties.
Security
1. New Malware Kits Reach Windows, Linux, and macOS
Latest developments: Researchers named four operations in a day: BambooToken, running since at least February 2023, carries its command channel over the MQTT messaging protocol to control Windows and Linux machines at organizations across Asia and South America; Elastic Security Labs detailed KREMLIN, a Brazilian banking toolkit it tracks as REF9334 that impersonates a dozen banks and installs a Chrome and Edge extension to lift credentials and session tokens; Dark Reading priced VectraRAT, a malware-as-a-service platform bundling a Windows implant, command-and-control infrastructure, and an operator panel, at $250 a month; and Palo Alto Networks' Unit 42 traced Atomic macOS Stealer campaigns that talk victims through fake setup guides.
read more
Each kit lowers the cost of full remote access and credential theft for operators with little skill. Block MQTT traffic leaving corporate networks, inventory browser extensions, and treat macOS installation instructions copied from a website as hostile.
Sources: The Hacker News · The Hacker News · Dark Reading · Unit 42 (Palo Alto) · ↑ top
2. Runaway Agents and AI-Found Bugs Swamp Defenders
Latest developments: Mandiant's AI Risk and Resilience report, built on its own casework and Google Threat Intelligence Group telemetry, tracked attacks moving from direct prompts to indirect prompt injection and AI supply chain compromise and cited one autonomous agent that ran up a $50,000 cloud bill; Cisco Talos argued that AI keeps surfacing vulnerabilities nobody can patch, leaving network segmentation and next-generation firewall and intrusion prevention pairs as the compensating layer; AI-assisted researchers buried Vercel's $1 million sandbox challenge in submissions, among them Linux kernel flaws, until the company automated its triage; and 404 Media documented iLands, an agent platform whose bots flood inboxes worldwide with useless work and requests for money.
read more
Enterprises now run agents that call APIs, change production configurations, and spend money without a human in the loop. Gate proposed agent actions before they touch production systems, cap cloud spending per agent, and segment what agents cannot patch.
Sources: Help Net Security · Cisco Talos · SecurityWeek · 404 Media · ↑ top
3. Oracle Ships 800 Fixes as Google Patches an Exploited Pixel Zero-Day
Latest developments: Oracle's September 2026 security update closed more than 800 vulnerabilities across 17 product families, over 100 of them critical; Google released 110 Pixel fixes that include a zero-day attackers already use in targeted attacks; and Google and Mozilla together closed 115 browser flaws, 42 in Chrome and 73 in Firefox.
read more
The Oracle batch spans databases, middleware, and business applications, which makes it the heaviest scheduling problem for enterprise administrators this quarter. Pixel owners should update first, since the Android flaw sits under active exploitation.
Sources: SecurityWeek · BleepingComputer · SecurityWeek · ↑ top
4. Hackers Dump a Flock Safety Camera's Software and Data
Latest developments: A hacker collective pulled down a Flock Safety camera, extracted the software running inside it, and published the contents, and Wired counted thousands of videos and logs showing that the single device captured 1.6 million images of 50,000 vehicles in 21 days.
read more
Flock Safety sells automated license plate readers to police departments across the United States, and the stolen files show exactly how one device recognizes and logs cars and the people near them. Agencies running Flock hardware should expect these capture rates and retention records to drive local policy fights and open records demands.
Sources: 404 Media · Wired Security · ↑ top
5. Forged Admin Tokens Open WSO2 API Manager
Latest developments: watchTowr reported active exploitation of CVE-2026-5430, a 9.8-rated failure to verify a cryptographic signature in WSO2 API Manager that lets an attacker forge a JSON Web Token, authenticate as an administrator, and take over accounts; the Hacktron Team found and reported the flaw.
read more
WSO2 API Manager fronts enterprise APIs and the data behind them, so a forged administrator token reaches customer records and internal services directly. Apply the vendor fix and audit API Manager logs for administrative sessions that no legitimate login produced.
Sources: The Hacker News · SecurityWeek · ↑ top
6. NightEagle Hits Russia as a North Korean Toolkit Lands in Seoul
Latest developments: Kaspersky's Global Emergency Response Team documented a new NightEagle campaign against Russian companies that plants the GhostContainer backdoor, stages its tools on GitHub, and exploits weaknesses in Active Directory and Remote Desktop Protocol, and Dark Reading reported that a likely North Korean group used a previously undocumented Linux espionage toolkit to seize load balancers at South Korean media and automotive companies, read communications, and push deeper into those networks.
read more
Both crews aim at infrastructure that security teams rarely instrument: domain controllers, remote access services, and the Linux appliances balancing traffic at the network edge. Hunt on those devices for unexpected tunnels, new local accounts, and outbound connections to GitHub-hosted payloads.
Sources: Securelist (Kaspersky) · Dark Reading · ↑ top
Business and Politics
The Fed Decides on Rates
Latest developments: The Federal Reserve announces its decision Wednesday afternoon, September 16, with futures markets pricing a quarter-point increase as close to certain, and the economists surveyed in the FT-Booth poll published the same morning said the central bank should raise rates over President Trump's objections.
read more
An increase would be the Fed's first in years, forced by August consumer prices running 3.4% and by the oil shock from the Gulf war, and it would come from a central bank Chair Kevin Warsh now runs under steady public pressure from Trump. The 10-year Treasury yield sat near 5% Wednesday morning, the dollar held steady in European trade, gold rose as yields and oil eased, and bitcoin traded at $75,491, near a four-week low.
Sources: WSJ Markets · FT Home · WSJ Markets · WSJ Markets · ↑ top
Von der Leyen Offers Canada Associate Membership
Latest developments: European Commission President Ursula von der Leyen proposed Wednesday, September 16, making Canada the first associate member of the European Union, saying the two 'see the world with the same eyes.'
read more
The offer endorses Canadian Prime Minister Mark Carney's drive to pivot his country toward Europe and away from the United States, and it would create a membership tier that has never existed in the bloc's history. Several EU governments have balked at Carney's parallel call for 'middle powers' to line up together against Washington and Beijing, leaving the proposal short of unanimous backing.
Sources: WSJ World News · FT Home · FT World · ↑ top
Pittsburgh
Weather
Today: Mostly Sunny then Slight Chance Showers And Thunderstorms, high 88F.
Tonight: Chance Showers And Thunderstorms, low 69F.
Thursday: Showers And Thunderstorms Likely, high 85F.
Business
Allegheny Smokeworks Closes in Blawnox
Latest developments: TribLive reported Wednesday, September 16, that Allegheny Smokeworks will close its Blawnox location because the landlord is putting the building on the market.
read more
Allegheny Smokeworks has operated for years in Blawnox, the small Allegheny River borough between Aspinwall and Harmarville, and the sale of its building ends the run there.
Upper Burrell Holds Off on Its Data Center Rules
Latest developments: The Upper Burrell Planning Commission voted Tuesday, September 15, to delay its recommendation on the township's latest draft data center ordinance so residents can take more concerns to the township supervisors.
read more
Upper Burrell, a Westmoreland County township near New Kensington, has been drafting zoning rules to govern data centers as developers scout Western Pennsylvania, the same pressure that pushed Allegheny County Council this week toward barring large data centers from county land.
A 381-Ton Superload Crosses Three Counties
Latest developments: WTAE published the route Tuesday night, September 15, for the first of the hauls: a 381-ton superload moving Wednesday, September 16, through Armstrong, Westmoreland, and Indiana counties.
read more
The loads run from the Armstrong Terminals in Gilpin to the data center project rising near Homer City in Indiana County, and each one travels at a crawl and closes lanes along the way.
Around Town
Etna Opens a Library
Latest developments: TribLive reported Wednesday, September 16, that Etna is preparing to open its own library, a project longtime Mayor Tom Rengers began pushing after a visit to the Millvale Community Library.
read more
Etna, the Allegheny River borough next to Millvale and Sharpsburg, has gone without a library of its own, and Rengers took the neighboring Millvale operation as the model for what the borough should build.
Pittsburgh Public Bets on STEAM After the Closures
Latest developments: TribLive reported Wednesday, September 16, that Pittsburgh Public Schools sees a wider future for its STEAM programming even after the district's school closures, with parents at Woolslair elementary, among them Jazlynn Worthy, crediting the program for what it has done for their children.
read more
Woolslair, in Bloomfield, has built its identity around science, technology, engineering, arts, and mathematics instruction, and the district is deciding how that work carries over as it consolidates buildings.
Nearly 4,000 County Students Without Homes
Latest developments: PublicSource reported Wednesday, September 16, that nearly 4,000 Allegheny County students experience homelessness, and that a new book, 'Echoes of Brilliance,' collects their accounts in their own words.
read more
One contributor, a local college student the book calls Jordan, describes nights when he did not know where he would sleep or how he would reach school. The county's school districts carry the caseload under the federal McKinney-Vento law, which entitles those students to transportation and enrollment protections.
Sources: PublicSource · ↑ top
Events
Luke Bryan's Farm Tour at 1846 Farms
Latest developments: KDKA published its guide to the show Tuesday night, September 15, placing Luke Bryan's Farm Tour stop at 1846 Farms in Unity Township, near Latrobe in Westmoreland County, on Thursday, September 17.
read more
Bryan has run the Farm Tour for years, playing open fields at working farms, and thousands of fans are expected to fill the Unity Township site Thursday.
Sports
Pirates (75-76)
Tue Sep 15 · Brewers 5 · Pirates 1 · Final
Up Next · Brewers @ Pirates · Wed Sep 16, 6:40 PM
Steelers (1-0, T-1st in AFC North)
Up Next · Steelers @ Patriots · Sun Sep 20, 1:00 PM
Around the Teams
The Film Says McCarthy's Offense Looked New
Latest developments: The Post-Gazette's film study, published Wednesday, September 16, found head coach Mike McCarthy's offense genuinely different in design from what the Steelers ran in recent seasons, with the results still lagging the scheme.
read more
McCarthy took over as head coach this year and built the offense around quarterback Aaron Rodgers and receiver DK Metcalf, who drew a poor grade from the paper for the Week 1 win over the Atlanta Falcons. The Steelers play at the New England Patriots on Sunday, September 20, at 1 p.m. ET on CBS.
Sources: Post-Gazette Steelers · ↑ top
Team USA
Record Ratings for the Women's World Cup Final
Latest developments: TNT said Tuesday, September 15, that an average of 1.2 million people watched the United States beat France in the FIBA Women's World Cup gold medal game, a record audience for the event on the network.
read more
The United States won 97-79 in Germany on Sunday, September 13, for its fifth straight World Cup title, with Breanna Stewart scoring 22 points and Jackie Young 18 under coach Kara Lawson.
Sources: ESPN Olympics · ↑ top
DeMelo Sues Over Her Cardiac Arrest
Latest developments: Racing Louisville FC midfielder Savannah DeMelo sued University of Louisville Health and two physicians, ESPN reported Tuesday, September 15, claiming they failed to diagnose the heart condition that led to her cardiac arrest on the field.
read more
DeMelo, a United States international who played in the 2023 Women's World Cup, collapsed during an NWSL match in September 2025. The suit puts a club's medical screening under legal scrutiny at a moment when the league is expanding its player health protocols.
Sources: ESPN Soccer · ↑ top
Reading
- Stratechery — Salesforce AI Force, Agents as UI, The Race to Headless. Ben Thompson reads Salesforce's AI Force launch as the company giving up on its user interface as a competitive moat, and argues that is the right call because AI agents are dissolving the interface layer across enterprise software.
- Ed Zitron — AI Is Already In Dangerous Hands. Zitron argues that the speculative debate over future superintelligence distracts from the concentrated power the current crop of AI companies already holds, and that the people running them have shown what they will do with it.
- Cal Newport — Superintelligence is a Fairy Tale. But Chasing It Can Still Cause Harm.. Newport, responding to Anthropic employees who said publicly that the systems they build could kill billions, treats superintelligence as a myth while warning that the race toward it inflicts real damage along the way.
Markets
S&P 500 7,618.15 ▼ -0.9% Dow 52,306.47 ▼ -1.6% Nasdaq 26,167.22 ▼ -0.8% WTI crude 101.16 ▲ +10.7% EUR/USD 1.1603 ▼ -0.1% GBP/USD 1.3527 ▲ +0.1% USD/JPY 153.87 ▼ -2.0%
Feed Health
Security: 24 of 24 feeds loaded, 66 items in the 24-hour window. No recent items: Krebs on Security, Schneier on Security, Ars Technica Security, Sophos News, Google Online Security Blog, Graham Cluley, Microsoft Security Blog, Google Project Zero, The DFIR Report, Kim Zetter (Zero Day), Frank on Fraud.
Pittsburgh: 9 of 9 feeds loaded, 60 items in the 48-hour window.
Business and Politics: 8 of 8 feeds loaded, 60 items in the 36-hour window.
Events: 4 of 4 feeds loaded, 11 items in the 120-hour window. No recent items: NEXTpittsburgh Arts & Entertainment.
Sports media: 6 of 6 feeds loaded, 30 items in the 96-hour window.
Team USA: 3 of 3 feeds loaded, 30 items in the 72-hour window. No recent items: Guardian Olympics.
Reading: 3 of 3 feeds loaded, 12 items in the 336-hour window.
Markets (Yahoo Finance): 7 of 7 rows
Weather (NWS): 3 forecast periods
Scores (ESPN, plaintextsports): 2 teams via plaintextsports; mlb: ESPN failed (mlb: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nfl: ESPN failed (nfl: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nhl: ESPN failed (nhl: HTTP 403 (server: AkamaiGHost)); used plaintextsports
Summaries: 3 model call(s) served by claude-opus-5 (302s of model time; $1.74 at API list price).