Attackers spent the day inside other people's add-on software—ConnectWise ScreenConnect, WSO2 API Manager, Acronis's cPanel backup plugin, and WordPress plugins on hundreds of thousands of sites—while Oracle and Google shipped nearly a thousand fixes of their own.
Emerging Trends and Key Updates
- Trend Mandiant now treats indirect prompt injection and poisoned AI supply chains as routine incident response, while Zitron and Newport argue today's AI power already does real harm.
- Trend Attackers keep entering through add-ons and remote tools administrators install once, with Acronis's cPanel backup plugin, ConnectWise ScreenConnect, and WSO2 API Manager all exploited in the wild.
- Update · updated Oracle's September release closed more than 800 flaws across 17 product families while Google patched CVE-2026-58704, an exploited permission bypass in the Pixel cellular modem.
- Update · updated A hacker collective pulled down a Flock Safety camera and published its software, revealing that one device had captured 1.6 million vehicle images.
- Update · new Ursula von der Leyen used her State of the Union in Strasbourg to demand a joint European answer to sabotage and to offer Canada associate membership.
- Update · new A $13 billion power plant divides Fayette County, North Park broke ground on its Observation Tower, and forecasters flagged Wednesday storms across the region.
Security
1. Oracle Ships 800 Fixes as Google Patches an Exploited Pixel Zero-Day
Latest developments: Oracle's September 2026 security update closed more than 800 vulnerabilities across 17 product families, over 100 of them critical; Google patched CVE-2026-58704, an 8.0-rated permission bypass in the Pixel cellular modem that a logic error opens and that attackers already use in limited targeted attacks, as part of 110 Pixel fixes released September 15, 2026; and Google and Mozilla together closed 115 browser flaws, 42 in Chrome and 73 in Firefox.
read more
The Oracle batch spans databases, middleware, and business applications, which makes it the heaviest scheduling problem for enterprise administrators this quarter. Pixel owners should update first, since the modem flaw sits under active exploitation.
Sources: SecurityWeek · BleepingComputer · SecurityWeek · SecurityWeek · ↑ top
2. Poisoned Plugins Backdoor WordPress and cPanel Hosts
Latest developments: Acronis confirmed that attackers exploit CVE-2026-87886, the 7.8-rated insecure file permissions flaw in its backup plugin for cPanel, WebHost Manager, and Plesk, in limited targeted attacks that raise a local Linux account to root; SecurityWeek reported that unauthenticated remote code execution flaws in The Events Calendar expose more than 200,000 WordPress sites to takeover; Wordfence blocked thousands of attempts to upload PHP backdoors through WooCommerce Wholesale Lead Capture, a premium plugin running on more than 6,000 sites; and tampered Admin Menu Editor Pro updates, pushed after a threat actor compromised the maintainer's website, planted a hidden user account on 1,500 WordPress sites.
read more
Hosting stacks run on third-party plugins that update themselves and that nobody audits. Patch the Acronis backup plugin, The Events Calendar, and WooCommerce Wholesale Lead Capture, then hunt for unfamiliar administrator accounts and new PHP files in upload directories.
Sources: SecurityWeek · Help Net Security · The Hacker News · BleepingComputer · ↑ top
3. Runaway Agents and AI-Found Bugs Swamp Defenders
Latest developments: Mandiant's AI Risk and Resilience report, built on its own casework and Google Threat Intelligence Group telemetry, tracked attacks moving from direct prompts to indirect prompt injection and AI supply chain compromise and cited one autonomous agent that ran up a $50,000 cloud bill; Cisco Talos argued that AI keeps surfacing vulnerabilities nobody can patch, leaving network segmentation and next-generation firewall and intrusion prevention pairs as the compensating layer; AI-assisted researchers buried Vercel's $1 million sandbox challenge in submissions, among them Linux kernel flaws, until the company automated its triage; and 404 Media documented iLands, an agent platform whose bots flood inboxes worldwide with useless work and requests for money.
read more
Enterprises now run agents that call APIs, change production configurations, and spend money without a human in the loop. Gate proposed agent actions before they touch production systems, cap cloud spending per agent, and segment what agents cannot patch.
Sources: Help Net Security · Cisco Talos · SecurityWeek · 404 Media · ↑ top
4. New Malware Kits Reach Windows, Linux, and macOS
Latest developments: Researchers named four operations in a day: BambooToken, running since at least February 2023, carries its command channel over the MQTT messaging protocol to control Windows and Linux machines at organizations across Asia and South America; Elastic Security Labs detailed KREMLIN, a Brazilian banking toolkit it tracks as REF9334 that impersonates a dozen banks and installs a Chrome and Edge extension to lift credentials and session tokens; Dark Reading priced VectraRAT, a malware-as-a-service platform bundling a Windows implant, command-and-control infrastructure, and an operator panel, at $250 a month; and Palo Alto Networks' Unit 42 traced Atomic macOS Stealer campaigns that talk victims through fake setup guides.
read more
Each kit lowers the cost of full remote access and credential theft for operators with little skill. Block MQTT traffic leaving corporate networks, inventory browser extensions, and treat macOS installation instructions copied from a website as hostile.
Sources: The Hacker News · The Hacker News · Dark Reading · Unit 42 (Palo Alto) · ↑ top
5. Hackers Dump a Flock Safety Camera's Software and Data
Latest developments: A hacker collective pulled down a Flock Safety camera, extracted the software running inside it, and published the contents, and Wired counted thousands of videos and logs showing that the single device captured 1.6 million images of 50,000 vehicles in 21 days; The Record reported the same day that Washington, D.C.'s police department has used Flock camera data in misconduct investigations of its own officers, which drew a formal complaint from the officers' union.
read more
Flock Safety sells automated license plate readers to police departments across the United States, and the stolen files show exactly how one device recognizes and logs cars and the people near them. Agencies running Flock hardware should expect these capture rates, retention records, and internal uses to drive local policy fights and open records demands.
Sources: 404 Media · Wired Security · The Record · ↑ top
6. Premier Medical Group and CenterPoint Energy Count Victims
Latest developments: Premier Medical Group began notifying 280,000 people that hackers reached files holding names, contact information, diagnosis details, and health insurance information in June 2026, and CenterPoint Energy, the Houston utility serving roughly 7 million customers in Indiana, Minnesota, Ohio, and Texas, confirmed that an unauthorized third party took customer data through one of its external systems after a hacker posting as 4d722e4d656f77 claimed millions of records on a hacking forum.
read more
Both sets of records outlast any password reset: medical diagnoses on one side, utility accounts tied to home addresses on the other. Customers of either should expect phishing that quotes real account details back to them.
Sources: SecurityWeek · Help Net Security · BleepingComputer · ↑ top
7. Forged Admin Tokens Open WSO2 API Manager
Latest developments: watchTowr reported active exploitation of CVE-2026-5430, a 9.8-rated failure to verify a cryptographic signature in WSO2 API Manager that lets an attacker forge a JSON Web Token, authenticate as an administrator, and take over accounts; the Hacktron Team found and reported the flaw.
read more
WSO2 API Manager fronts enterprise APIs and the data behind them, so a forged administrator token reaches customer records and internal services directly. Apply the vendor fix and audit API Manager logs for administrative sessions that no legitimate login produced.
Sources: The Hacker News · SecurityWeek · ↑ top
8. Von der Leyen Asks Europe to Answer Sabotage Together
Latest developments: Ursula von der Leyen, president of the European Commission, used her State of the Union address in Strasbourg on September 16, 2026 to call for a joint European response to cyberattacks and sabotage, pointing to recent incidents in Denmark, Lithuania, and Poland and an attempted drone attack in Leipzig, and she asked the leading AI labs to slow self-improving models, promising to invite them in and to work with Canada and the United Kingdom on evaluating and verifying advanced systems and on early warning.
read more
European Union governments have handled cyber and physical sabotage nationally, and von der Leyen wants the bloc to answer as one. Companies selling connected products into Europe should watch for coordination duties stacked on top of the Cyber Resilience Act's 24-hour incident reporting clock.
Sources: The Record · Help Net Security · ↑ top
9. NightEagle Hits Russia as a North Korean Toolkit Lands in Seoul
Latest developments: Kaspersky's Global Emergency Response Team documented a new NightEagle campaign against Russian companies that plants the GhostContainer backdoor, stages its tools on GitHub, and exploits weaknesses in Active Directory and Remote Desktop Protocol, and Dark Reading reported that a likely North Korean group used a previously undocumented Linux espionage toolkit to seize load balancers at South Korean media and automotive companies, read communications, and push deeper into those networks.
read more
Both crews aim at infrastructure that security teams rarely instrument: domain controllers, remote access services, and the Linux appliances balancing traffic at the network edge. Hunt on those devices for unexpected tunnels, new local accounts, and outbound connections to GitHub-hosted payloads.
Sources: Securelist (Kaspersky) · Dark Reading · ↑ top
10. CISA Says Attackers Now Exploit ScreenConnect
Latest developments: The Cybersecurity and Infrastructure Security Agency warned on September 16, 2026 that attackers exploit a critical ConnectWise ScreenConnect vulnerability in the wild, two days after ConnectWise shipped the fix for the flaw that lets an attacker push files through an active remote session and run them without authorization.
read more
ScreenConnect hands managed service providers remote control of client endpoints, so one exploited server gives an intruder every machine beneath it. Update self-hosted ScreenConnect servers now and review session and file transfer logs for transfers no technician made.
Sources: BleepingComputer · ↑ top
Business and Politics
Chinese Oil Prices Hit Records
Latest developments: The Financial Times reported Wednesday, September 16, that domestic Chinese oil prices reached record highs after the drone attacks on Saudi Arabia's East-West pipeline, and that Beijing has drained enough of its stockpile that it must come back to the world market.
read more
China held global crude prices down through the first months of the Iran war by drawing on inventories instead of buying, a cushion analysts told the Financial Times is ending as the country comes off its crash diet. Fresh Chinese buying would land on a market already short the barrels that normally move through the Strait of Hormuz, with Brent near four-month highs and the Hormuz squeeze now pushing Asian buyers to look past long-term liquefied natural gas contracts.
Sources: FT Home · FT Markets · WSJ World News · ↑ top
The Fed Decides on Rates
Latest developments: The Federal Reserve announces its decision at 2 p.m. ET Wednesday, September 16, with futures pricing a quarter-point increase as close to certain, and the case firmed during the morning as the Commerce Department reported retail sales up 1.2% in August against the 0.8% economists expected and a 0.5% drop in July.
read more
An increase would be the Fed's first in years, forced by August consumer prices running 3.4% and by the oil shock from the Gulf war, and it would come from a central bank Chair Kevin Warsh now runs under steady public pressure from President Trump; the economists in the FT-Booth survey published Wednesday morning said the Fed should raise over those objections. The 10-year Treasury yield slipped below 5% Wednesday morning, the dollar firmed slightly, gold rose as yields and oil eased, and bitcoin traded at $75,877 in European afternoon trade, near a four-week low.
Sources: WSJ Markets · FT Home · WSJ Markets · WSJ Markets · ↑ top
Von der Leyen Offers Canada Associate Membership
Latest developments: European Commission President Ursula von der Leyen proposed Wednesday, September 16, making Canada the first associate member of the European Union, saying the two "see the world with the same eyes."
read more
The offer endorses Canadian Prime Minister Mark Carney's drive to pivot his country toward Europe and away from the United States, and it would create a membership tier that has never existed in the bloc's history. Several EU governments have balked at Carney's parallel call for "middle powers" to line up together against Washington and Beijing, leaving the proposal short of unanimous backing.
Sources: WSJ World News · FT Home · FT World · ↑ top
Pittsburgh
Weather
Today: Mostly Sunny then Slight Chance Showers And Thunderstorms, high 88F.
Tonight: Chance Showers And Thunderstorms, low 69F.
Thursday: Showers And Thunderstorms Likely, high 85F.
Business
A $13 Billion Power Plant Splits Fayette County
Latest developments: WTAE reported Wednesday, September 16, that a $13 billion energy proposal has divided Fayette County, with supporters counting the construction jobs and investment and opponents arguing the environmental cost runs too high.
read more
Fayette County, in the southwestern corner of Pennsylvania along the Monongahela, sits in the middle of the power buildout that the region's data center developers have set off, and a project of this size would rank among the largest private investments the county has ever seen.
Allegheny Smokeworks Closes in Blawnox
Latest developments: TribLive reported Wednesday, September 16, that Allegheny Smokeworks will close its Blawnox location because the landlord is putting the building on the market.
read more
Allegheny Smokeworks has operated for years in Blawnox, the small Allegheny River borough between Aspinwall and Harmarville, and the sale of its building ends the run there.
Upper Burrell Holds Off on Its Data Center Rules
Latest developments: The Upper Burrell Planning Commission voted Tuesday, September 15, to delay its recommendation on the township's latest draft data center ordinance so residents can take more concerns to the township supervisors.
read more
Upper Burrell, a Westmoreland County township near New Kensington, has been drafting zoning rules to govern data centers as developers scout Western Pennsylvania, the same pressure that pushed Allegheny County Council this week toward barring large data centers from county land.
A 381-Ton Superload Crosses Three Counties
Latest developments: WTAE published the route Tuesday night, September 15, for the first of the hauls: a 381-ton superload moving Wednesday, September 16, through Armstrong, Westmoreland, and Indiana counties.
read more
The loads run from the Armstrong Terminals in Gilpin to the data center project rising near Homer City in Indiana County, and each one travels at a crawl and closes lanes along the way.
Around Town
Storms Return Wednesday Afternoon
Latest developments: WTAE flagged Wednesday, September 16, as an Impact Day for isolated storms, while KDKA meteorologist Ron Smiley's morning forecast kept most of the day dry, with highs in the mid-80s and spells of sun before higher rain chances arrive Thursday.
read more
The pattern follows a warm, humid stretch across the Pittsburgh region, and the heavier, more widespread rain holds off until Thursday, September 17.
North Park Breaks Ground on Its Observation Tower
Latest developments: TribLive reported Wednesday, September 16, that North Park held a groundbreaking for its Observation Tower, with paint brushes standing in for shovels at the ceremony.
read more
North Park, the Allegheny County park spread across the county's northern townships, counts the tower among the spots visitors return to for the view, and the project starts construction on it.
Etna Opens a Library
Latest developments: TribLive reported Wednesday, September 16, that Etna is preparing to open its own library, a project longtime Mayor Tom Rengers began pushing after a visit to the Millvale Community Library.
read more
Etna, the Allegheny River borough next to Millvale and Sharpsburg, has gone without a library of its own, and Rengers took the neighboring Millvale operation as the model for what the borough should build.
Pittsburgh Public Bets on STEAM After the Closures
Latest developments: TribLive reported Wednesday, September 16, that Pittsburgh Public Schools sees a wider future for its STEAM programming even after the district's school closures, with parents at Woolslair elementary, among them Jazlynn Worthy, crediting the program for what it has done for their children.
read more
Woolslair, in Bloomfield, has built its identity around science, technology, engineering, arts, and mathematics instruction, and the district is deciding how that work carries over as it consolidates buildings.
Nearly 4,000 County Students Without Homes
Latest developments: PublicSource reported Wednesday, September 16, that nearly 4,000 Allegheny County students experience homelessness, and that a new book, "Echoes of Brilliance," collects their accounts in their own words.
read more
One contributor, a local college student the book calls Jordan, describes nights when he did not know where he would sleep or how he would reach school. The county's school districts carry the caseload under the federal McKinney-Vento law, which entitles those students to transportation and enrollment protections.
Sources: PublicSource · ↑ top
Events
Luke Bryan's Farm Tour at 1846 Farms
Latest developments: KDKA published its guide to the show Tuesday night, September 15, placing Luke Bryan's Farm Tour stop at 1846 Farms in Unity Township, near Latrobe in Westmoreland County, on Thursday, September 17.
read more
Bryan has run the Farm Tour for years, playing open fields at working farms, and thousands of fans are expected to fill the Unity Township site Thursday.
Sports
Pirates (75-76)
Tue Sep 15 · Brewers 5 · Pirates 1 · Final
Up Next · Brewers @ Pirates · Wed Sep 16, 6:40 PM
Steelers (1-0, T-1st in AFC North)
Up Next · Steelers @ Patriots · Sun Sep 20, 1:00 PM
Around the Teams
Watt Walks Through the Pick-Six
Latest developments: T.J. Watt joined Not Just Football on Wednesday morning, September 16, to break down his pick-six against the Atlanta Falcons, the snaps he took on both sides of the line, and life as a new father.
read more
Cam Heyward and co-host Hayward Heyward run the show; after the Watt interview they went through the Steelers' Week 1 win and the zone-heavy plan the defense used, then looked ahead to the trip to the New England Patriots on Sunday, September 20, at 1 p.m. ET on CBS.
Sources: Not Just Football with Cam Heyward · ↑ top
Dulac Takes Week 2 Questions
Latest developments: Post-Gazette beat writer Gerry Dulac held his Steelers chat Wednesday, September 16, taking reader questions on the club as it prepares for New England.
read more
Dulac has covered the Steelers for the Post-Gazette for decades and runs the weekly chat through the season. The Steelers play at the New England Patriots on Sunday, September 20, at 1 p.m. ET on CBS.
Sources: Post-Gazette Steelers · ↑ top
The Film Says McCarthy's Offense Looked New
Latest developments: The Post-Gazette's film study, published Wednesday, September 16, found head coach Mike McCarthy's offense genuinely different in design from what the Steelers ran in recent seasons, with the results still lagging the scheme.
read more
McCarthy took over as head coach this year and built the offense around quarterback Aaron Rodgers and receiver DK Metcalf, who drew a poor grade from the paper for the Week 1 win over the Atlanta Falcons. The Steelers play at the New England Patriots on Sunday, September 20, at 1 p.m. ET on CBS.
Sources: Post-Gazette Steelers · ↑ top
Team USA
Softball's Schiller Draws a Three-Year Ban
Latest developments: ESPN reported Wednesday, September 16, that American softball player Cam Schiller has accepted a three-year ban for doping with a steroid.
read more
The suspension sidelines Schiller through the run-up to softball's return to the Olympic program at the 2028 Los Angeles Games, where the United States will defend a sport it has dominated for decades.
Sources: ESPN Olympics · ↑ top
Record Ratings for the Women's World Cup Final
Latest developments: TNT said Tuesday, September 15, that an average of 1.2 million people watched the United States beat France in the FIBA Women's World Cup gold medal game, a record audience for the event on the network.
read more
The United States won 97-79 in Germany on Sunday, September 13, for its fifth straight World Cup title, with Breanna Stewart scoring 22 points and Jackie Young 18 under coach Kara Lawson.
Sources: ESPN Olympics · ↑ top
DeMelo Sues Over Her Cardiac Arrest
Latest developments: Racing Louisville FC midfielder Savannah DeMelo sued University of Louisville Health and two physicians, ESPN reported Tuesday, September 15, claiming they failed to diagnose the heart condition that led to her cardiac arrest on the field.
read more
DeMelo, a United States international who played in the 2023 Women's World Cup, collapsed during an NWSL match in September 2025. The suit puts a club's medical screening under legal scrutiny at a moment when the league is expanding its player health protocols.
Sources: ESPN Soccer · ↑ top
Reading
- Stratechery — Salesforce AI Force, Agents as UI, The Race to Headless. Ben Thompson reads Salesforce's AI Force launch as the company giving up on its user interface as a competitive moat, and argues that is the right call because AI agents are dissolving the interface layer across enterprise software.
- Ed Zitron — AI Is Already In Dangerous Hands. Zitron argues that the speculative debate over future superintelligence distracts from the concentrated power the current crop of AI companies already holds, and that the people running them have shown what they will do with it.
- Cal Newport — Superintelligence is a Fairy Tale. But Chasing It Can Still Cause Harm.. Newport, responding to Anthropic employees who said publicly that the systems they build could kill billions, treats superintelligence as a myth while warning that the race toward it inflicts real damage along the way.
Markets
S&P 500 7,618.15 ▼ -0.9% Dow 52,306.47 ▼ -1.6% Nasdaq 26,167.22 ▼ -0.8% WTI crude 101.16 ▲ +10.7% EUR/USD 1.1603 ▼ -0.1% GBP/USD 1.3527 ▲ +0.1% USD/JPY 153.87 ▼ -2.0%
Feed Health
Security: 24 of 24 feeds loaded, 60 items in the 24-hour window. No recent items: Krebs on Security, CISA Advisories, Ars Technica Security, Sophos News, Google Online Security Blog, Graham Cluley, Microsoft Security Blog, Google Project Zero, The DFIR Report, Kim Zetter (Zero Day), Frank on Fraud.
Pittsburgh: 9 of 9 feeds loaded, 60 items in the 48-hour window.
Business and Politics: 8 of 8 feeds loaded, 60 items in the 36-hour window.
Events: 4 of 4 feeds loaded, 11 items in the 120-hour window. No recent items: NEXTpittsburgh Arts & Entertainment.
Sports media: 6 of 6 feeds loaded, 30 items in the 96-hour window.
Team USA: 3 of 3 feeds loaded, 30 items in the 72-hour window. No recent items: Guardian Olympics.
Reading: 3 of 3 feeds loaded, 12 items in the 336-hour window.
Markets (Yahoo Finance): 7 of 7 rows
Weather (NWS): 3 forecast periods
Scores (ESPN, plaintextsports): 2 teams via plaintextsports; mlb: ESPN failed (mlb: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nfl: ESPN failed (nfl: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nhl: ESPN failed (nhl: HTTP 403 (server: AkamaiGHost)); used plaintextsports
Summaries: 3 model call(s) served by claude-opus-5 (356s of model time; $1.97 at API list price).