================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Wednesday, September 16, 2026 - 10:06 AM EDT ================================================================ Attackers spent the day inside other people's add-on software—ConnectWise ScreenConnect, WSO2 API Manager, Acronis's cPanel backup plugin, and WordPress plugins on hundreds of thousands of sites—while Oracle and Google shipped nearly a thousand fixes of their own. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets | Feed Health EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Mandiant now treats indirect prompt injection and poisoned AI supply chains as routine incident response, while Zitron and Newport argue today's AI power already does real harm. see: Runaway Agents and AI-Found Bugs Swamp Defenders; AI Is Already In Dangerous Hands; Superintelligence is a Fairy Tale. But Chasing It Can Still Cause Harm. * [TREND] Attackers keep entering through add-ons and remote tools administrators install once, with Acronis's cPanel backup plugin, ConnectWise ScreenConnect, and WSO2 API Manager all exploited in the wild. see: Poisoned Plugins Backdoor WordPress and cPanel Hosts; CISA Says Attackers Now Exploit ScreenConnect; Forged Admin Tokens Open WSO2 API Manager * [UPDATE (updated)] Oracle's September release closed more than 800 flaws across 17 product families while Google patched CVE-2026-58704, an exploited permission bypass in the Pixel cellular modem. see: Oracle Ships 800 Fixes as Google Patches an Exploited Pixel Zero-Day * [UPDATE (updated)] A hacker collective pulled down a Flock Safety camera and published its software, revealing that one device had captured 1.6 million vehicle images. see: Hackers Dump a Flock Safety Camera's Software and Data * [UPDATE (new)] Ursula von der Leyen used her State of the Union in Strasbourg to demand a joint European answer to sabotage and to offer Canada associate membership. see: Von der Leyen Asks Europe to Answer Sabotage Together; Von der Leyen Offers Canada Associate Membership * [UPDATE (new)] A $13 billion power plant divides Fayette County, North Park broke ground on its Observation Tower, and forecasters flagged Wednesday storms across the region. see: A $13 Billion Power Plant Splits Fayette County; North Park Breaks Ground on Its Observation Tower; Storms Return Wednesday Afternoon SECURITY ---------------------------------------------------------------- 1. ORACLE SHIPS 800 FIXES AS GOOGLE PATCHES AN EXPLOITED PIXEL ZERO-DAY Vulnerabilities and Exploits · [patch, zero-day] Latest developments: Oracle's September 2026 security update closed more than 800 vulnerabilities across 17 product families, over 100 of them critical; Google patched CVE-2026-58704, an 8.0-rated permission bypass in the Pixel cellular modem that a logic error opens and that attackers already use in limited targeted attacks, as part of 110 Pixel fixes released September 15, 2026; and Google and Mozilla together closed 115 browser flaws, 42 in Chrome and 73 in Firefox. The Oracle batch spans databases, middleware, and business applications, which makes it the heaviest scheduling problem for enterprise administrators this quarter. Pixel owners should update first, since the modem flaw sits under active exploitation. - SecurityWeek: https://www.securityweek.com/oracle-patches-800-vulnerabilities-in-september-2026-security-update/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/google-fixes-actively-exploited-android-zero-day-on-pixel-devices/ - SecurityWeek: https://www.securityweek.com/pixel-modem-zero-day-exploited-in-targeted-attacks/ - SecurityWeek: https://www.securityweek.com/chrome-firefox-updates-patch-115-vulnerabilities/ 2. POISONED PLUGINS BACKDOOR WORDPRESS AND CPANEL HOSTS Vulnerabilities and Exploits · [exploit, wordpress, patch] Latest developments: Acronis confirmed that attackers exploit CVE-2026-87886, the 7.8-rated insecure file permissions flaw in its backup plugin for cPanel, WebHost Manager, and Plesk, in limited targeted attacks that raise a local Linux account to root; SecurityWeek reported that unauthenticated remote code execution flaws in The Events Calendar expose more than 200,000 WordPress sites to takeover; Wordfence blocked thousands of attempts to upload PHP backdoors through WooCommerce Wholesale Lead Capture, a premium plugin running on more than 6,000 sites; and tampered Admin Menu Editor Pro updates, pushed after a threat actor compromised the maintainer's website, planted a hidden user account on 1,500 WordPress sites. Hosting stacks run on third-party plugins that update themselves and that nobody audits. Patch the Acronis backup plugin, The Events Calendar, and WooCommerce Wholesale Lead Capture, then hunt for unfamiliar administrator accounts and new PHP files in upload directories. - SecurityWeek: https://www.securityweek.com/unauthenticated-rce-flaws-could-expose-200000-wordpress-sites-to-takeover/ - Help Net Security: https://www.helpnetsecurity.com/2026/09/16/acronis-backup-plugin-vulnerability-exploited-cve-2026-87886/ - The Hacker News: https://thehackernews.com/2026/09/attackers-exploit-woocommerce-wholesale.html - BleepingComputer: https://www.bleepingcomputer.com/news/security/malcious-admin-menu-editor-pro-plugin-backdoors-1-500-wordpress-sites/ 3. RUNAWAY AGENTS AND AI-FOUND BUGS SWAMP DEFENDERS AI Security · [ai, agents] Latest developments: Mandiant's AI Risk and Resilience report, built on its own casework and Google Threat Intelligence Group telemetry, tracked attacks moving from direct prompts to indirect prompt injection and AI supply chain compromise and cited one autonomous agent that ran up a $50,000 cloud bill; Cisco Talos argued that AI keeps surfacing vulnerabilities nobody can patch, leaving network segmentation and next-generation firewall and intrusion prevention pairs as the compensating layer; AI-assisted researchers buried Vercel's $1 million sandbox challenge in submissions, among them Linux kernel flaws, until the company automated its triage; and 404 Media documented iLands, an agent platform whose bots flood inboxes worldwide with useless work and requests for money. Enterprises now run agents that call APIs, change production configurations, and spend money without a human in the loop. Gate proposed agent actions before they touch production systems, cap cloud spending per agent, and segment what agents cannot patch. - Help Net Security: https://www.helpnetsecurity.com/2026/09/16/google-mandiant-enterprise-ai-security-risks-report/ - Cisco Talos: https://blog.talosintelligence.com/securing-the-unpatchable-in-an-age-of-ai-driven-vulnerabilities/ - SecurityWeek: https://www.securityweek.com/1-million-sandbox-challenge-uncovers-linux-kernel-flaws/ - 404 Media: https://www.404media.co/ai-agent-platform-reinvents-spam-floods-inboxes-worldwide/ 4. NEW MALWARE KITS REACH WINDOWS, LINUX, AND MACOS Ransomware and Cybercrime · [malware, cybercrime] Latest developments: Researchers named four operations in a day: BambooToken, running since at least February 2023, carries its command channel over the MQTT messaging protocol to control Windows and Linux machines at organizations across Asia and South America; Elastic Security Labs detailed KREMLIN, a Brazilian banking toolkit it tracks as REF9334 that impersonates a dozen banks and installs a Chrome and Edge extension to lift credentials and session tokens; Dark Reading priced VectraRAT, a malware-as-a-service platform bundling a Windows implant, command-and-control infrastructure, and an operator panel, at $250 a month; and Palo Alto Networks' Unit 42 traced Atomic macOS Stealer campaigns that talk victims through fake setup guides. Each kit lowers the cost of full remote access and credential theft for operators with little skill. Block MQTT traffic leaving corporate networks, inventory browser extensions, and treat macOS installation instructions copied from a website as hostile. - The Hacker News: https://thehackernews.com/2026/09/bambootoken-malware-uses-mqtt-to.html - The Hacker News: https://thehackernews.com/2026/09/kremlin-banking-malware-hijacks-chrome.html - Dark Reading: https://www.darkreading.com/endpoint-security/vectrarat-hack-windows-enterprises - Unit 42 (Palo Alto): https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/ 5. HACKERS DUMP A FLOCK SAFETY CAMERA'S SOFTWARE AND DATA Data Privacy · [surveillance, privacy, breach] Latest developments: A hacker collective pulled down a Flock Safety camera, extracted the software running inside it, and published the contents, and Wired counted thousands of videos and logs showing that the single device captured 1.6 million images of 50,000 vehicles in 21 days; The Record reported the same day that Washington, D.C.'s police department has used Flock camera data in misconduct investigations of its own officers, which drew a formal complaint from the officers' union. Flock Safety sells automated license plate readers to police departments across the United States, and the stolen files show exactly how one device recognizes and logs cars and the people near them. Agencies running Flock hardware should expect these capture rates, retention records, and internal uses to drive local policy fights and open records demands. - 404 Media: https://www.404media.co/hackers-stole-flocks-camera-software-revealing-how-the-company-tracks-cars-and-people-2/ - Wired Security: https://www.wired.com/story/hackers-flock-camera-data-shows-how-system-works/ - The Record: https://therecord.media/dc-police-union-opposes-flock-camera-use-probing-officers 6. PREMIER MEDICAL GROUP AND CENTERPOINT ENERGY COUNT VICTIMS Ransomware and Cybercrime · [breach, healthcare] Latest developments: Premier Medical Group began notifying 280,000 people that hackers reached files holding names, contact information, diagnosis details, and health insurance information in June 2026, and CenterPoint Energy, the Houston utility serving roughly 7 million customers in Indiana, Minnesota, Ohio, and Texas, confirmed that an unauthorized third party took customer data through one of its external systems after a hacker posting as 4d722e4d656f77 claimed millions of records on a hacking forum. Both sets of records outlast any password reset: medical diagnoses on one side, utility accounts tied to home addresses on the other. Customers of either should expect phishing that quotes real account details back to them. - SecurityWeek: https://www.securityweek.com/280000-impacted-by-premier-medical-group-data-breach/ - Help Net Security: https://www.helpnetsecurity.com/2026/09/16/centerpoint-energy-data-breach-hacker-claims/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/centerpoint-energy-confirms-customer-data-stolen-in-cyberattack/ 7. FORGED ADMIN TOKENS OPEN WSO2 API MANAGER Vulnerabilities and Exploits · [exploit, patch] Latest developments: watchTowr reported active exploitation of CVE-2026-5430, a 9.8-rated failure to verify a cryptographic signature in WSO2 API Manager that lets an attacker forge a JSON Web Token, authenticate as an administrator, and take over accounts; the Hacktron Team found and reported the flaw. WSO2 API Manager fronts enterprise APIs and the data behind them, so a forged administrator token reaches customer records and internal services directly. Apply the vendor fix and audit API Manager logs for administrative sessions that no legitimate login produced. - The Hacker News: https://thehackernews.com/2026/09/active-exploitation-attempts-target.html - SecurityWeek: https://www.securityweek.com/enterprises-warned-of-attacks-exploiting-wso2-vulnerability/ 8. VON DER LEYEN ASKS EUROPE TO ANSWER SABOTAGE TOGETHER Nation-State Activity · [policy, ai] Latest developments: Ursula von der Leyen, president of the European Commission, used her State of the Union address in Strasbourg on September 16, 2026 to call for a joint European response to cyberattacks and sabotage, pointing to recent incidents in Denmark, Lithuania, and Poland and an attempted drone attack in Leipzig, and she asked the leading AI labs to slow self-improving models, promising to invite them in and to work with Canada and the United Kingdom on evaluating and verifying advanced systems and on early warning. European Union governments have handled cyber and physical sabotage nationally, and von der Leyen wants the bloc to answer as one. Companies selling connected products into Europe should watch for coordination duties stacked on top of the Cyber Resilience Act's 24-hour incident reporting clock. - The Record: https://therecord.media/eu-chief-wants-joint-response-to-cyberattacks - Help Net Security: https://www.helpnetsecurity.com/2026/09/16/eu-ursula-von-der-leyen-ai/ 9. NIGHTEAGLE HITS RUSSIA AS A NORTH KOREAN TOOLKIT LANDS IN SEOUL Nation-State Activity · [apt, espionage] Latest developments: Kaspersky's Global Emergency Response Team documented a new NightEagle campaign against Russian companies that plants the GhostContainer backdoor, stages its tools on GitHub, and exploits weaknesses in Active Directory and Remote Desktop Protocol, and Dark Reading reported that a likely North Korean group used a previously undocumented Linux espionage toolkit to seize load balancers at South Korean media and automotive companies, read communications, and push deeper into those networks. Both crews aim at infrastructure that security teams rarely instrument: domain controllers, remote access services, and the Linux appliances balancing traffic at the network edge. Hunt on those devices for unexpected tunnels, new local accounts, and outbound connections to GitHub-hosted payloads. - Securelist (Kaspersky): https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/ - Dark Reading: https://www.darkreading.com/cyberattacks-data-breaches/cyber-south-korean-media-automotive 10. CISA SAYS ATTACKERS NOW EXPLOIT SCREENCONNECT Vulnerabilities and Exploits · [exploit, patch] Latest developments: The Cybersecurity and Infrastructure Security Agency warned on September 16, 2026 that attackers exploit a critical ConnectWise ScreenConnect vulnerability in the wild, two days after ConnectWise shipped the fix for the flaw that lets an attacker push files through an active remote session and run them without authorization. ScreenConnect hands managed service providers remote control of client endpoints, so one exploited server gives an intruder every machine beneath it. Update self-hosted ScreenConnect servers now and review session and file transfer logs for transfers no technician made. - BleepingComputer: https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-exploiting-critical-screenconnect-flaw/ BUSINESS AND POLITICS ---------------------------------------------------------------- * Chinese Oil Prices Hit Records Latest developments: The Financial Times reported Wednesday, September 16, that domestic Chinese oil prices reached record highs after the drone attacks on Saudi Arabia's East-West pipeline, and that Beijing has drained enough of its stockpile that it must come back to the world market. China held global crude prices down through the first months of the Iran war by drawing on inventories instead of buying, a cushion analysts told the Financial Times is ending as the country comes off its crash diet. Fresh Chinese buying would land on a market already short the barrels that normally move through the Strait of Hormuz, with Brent near four-month highs and the Hormuz squeeze now pushing Asian buyers to look past long-term liquefied natural gas contracts. - FT Home: https://www.ft.com/content/3a88d016-9575-4c11-bd34-14606964a867?syn-25a6b1a6=1 - FT Markets: https://www.ft.com/content/31f41c2e-084b-4bdf-a548-bf3d1139dbbe?syn-25a6b1a6=1 - WSJ World News: https://www.wsj.com/business/energy-oil/oil-prices-edge-lower-ahead-of-fed-decision-aa5afb9c?mod=rss_worldnews * The Fed Decides on Rates Latest developments: The Federal Reserve announces its decision at 2 p.m. ET Wednesday, September 16, with futures pricing a quarter-point increase as close to certain, and the case firmed during the morning as the Commerce Department reported retail sales up 1.2% in August against the 0.8% economists expected and a 0.5% drop in July. An increase would be the Fed's first in years, forced by August consumer prices running 3.4% and by the oil shock from the Gulf war, and it would come from a central bank Chair Kevin Warsh now runs under steady public pressure from President Trump; the economists in the FT-Booth survey published Wednesday morning said the Fed should raise over those objections. The 10-year Treasury yield slipped below 5% Wednesday morning, the dollar firmed slightly, gold rose as yields and oil eased, and bitcoin traded at $75,877 in European afternoon trade, near a four-week low. - WSJ Markets: https://www.wsj.com/livecoverage/fed-meeting-warsh-interest-rate-09-16-2026?mod=rss_markets_main - FT Home: https://www.ft.com/content/f62e467a-bcb6-423d-96f2-b2b1e08faaa8?syn-25a6b1a6=1 - WSJ Markets: https://www.wsj.com/finance/stocks/oil-pares-gains-stock-futures-steady-as-cautious-optimism-heralds-fed-day-65090da0?mod=rss_markets_main - WSJ Markets: https://www.wsj.com/finance/currencies/eyes-on-fed-decision-after-bitcoin-trades-near-4-week-low-on-failed-clarity-vote-2b8af150?mod=rss_markets_main * Von der Leyen Offers Canada Associate Membership Latest developments: European Commission President Ursula von der Leyen proposed Wednesday, September 16, making Canada the first associate member of the European Union, saying the two "see the world with the same eyes." The offer endorses Canadian Prime Minister Mark Carney's drive to pivot his country toward Europe and away from the United States, and it would create a membership tier that has never existed in the bloc's history. Several EU governments have balked at Carney's parallel call for "middle powers" to line up together against Washington and Beijing, leaving the proposal short of unanimous backing. - WSJ World News: https://www.wsj.com/world/europe/eu-chief-floats-plan-to-make-canada-first-associate-member-da300f13?mod=rss_worldnews - FT Home: https://www.ft.com/content/8fed428e-7bcc-435c-9487-cb4e6a795328?syn-25a6b1a6=1 - FT World: https://www.ft.com/content/2e2e0c1e-51d6-49e2-9f4a-6ef793908b85?syn-25a6b1a6=1 PITTSBURGH ---------------------------------------------------------------- Weather: Today: Mostly Sunny then Slight Chance Showers And Thunderstorms, high 88F. Tonight: Chance Showers And Thunderstorms, low 69F. Thursday: Showers And Thunderstorms Likely, high 85F. Business: * A $13 Billion Power Plant Splits Fayette County Latest developments: WTAE reported Wednesday, September 16, that a $13 billion energy proposal has divided Fayette County, with supporters counting the construction jobs and investment and opponents arguing the environmental cost runs too high. Fayette County, in the southwestern corner of Pennsylvania along the Monongahela, sits in the middle of the power buildout that the region's data center developers have set off, and a project of this size would rank among the largest private investments the county has ever seen. - WTAE: https://www.wtae.com/article/fayette-county-power-plant-jobs-environmental-concerns/73752895 * Allegheny Smokeworks Closes in Blawnox Latest developments: TribLive reported Wednesday, September 16, that Allegheny Smokeworks will close its Blawnox location because the landlord is putting the building on the market. Allegheny Smokeworks has operated for years in Blawnox, the small Allegheny River borough between Aspinwall and Harmarville, and the sale of its building ends the run there. - TribLive: https://triblive.com/local/valley-news-dispatch/allegheny-smokeworks-closing-in-blawnox-as-landlord-looks-to-sell-building/ * Upper Burrell Holds Off on Its Data Center Rules Latest developments: The Upper Burrell Planning Commission voted Tuesday, September 15, to delay its recommendation on the township's latest draft data center ordinance so residents can take more concerns to the township supervisors. Upper Burrell, a Westmoreland County township near New Kensington, has been drafting zoning rules to govern data centers as developers scout Western Pennsylvania, the same pressure that pushed Allegheny County Council this week toward barring large data centers from county land. - TribLive: https://triblive.com/local/valley-news-dispatch/upper-burrell-planning-commission-delays-recommendation-regarding-data-center-ordinance/ * A 381-Ton Superload Crosses Three Counties Latest developments: WTAE published the route Tuesday night, September 15, for the first of the hauls: a 381-ton superload moving Wednesday, September 16, through Armstrong, Westmoreland, and Indiana counties. The loads run from the Armstrong Terminals in Gilpin to the data center project rising near Homer City in Indiana County, and each one travels at a crawl and closes lanes along the way. - WTAE: https://www.wtae.com/article/pennsylvania-superload-armstrong-westmoreland-indiana/73728555 Around town: * Storms Return Wednesday Afternoon Latest developments: WTAE flagged Wednesday, September 16, as an Impact Day for isolated storms, while KDKA meteorologist Ron Smiley's morning forecast kept most of the day dry, with highs in the mid-80s and spells of sun before higher rain chances arrive Thursday. The pattern follows a warm, humid stretch across the Pittsburgh region, and the heavier, more widespread rain holds off until Thursday, September 17. - WTAE: https://www.wtae.com/article/impact-day-isolated-storms-return/73755877 - KDKA: https://www.cbsnews.com/pittsburgh/news/most-of-today-will-be-dry-for-the-pittsburgh-area-with-higher-rain-chances-tomorrow/ * North Park Breaks Ground on Its Observation Tower Latest developments: TribLive reported Wednesday, September 16, that North Park held a groundbreaking for its Observation Tower, with paint brushes standing in for shovels at the ceremony. North Park, the Allegheny County park spread across the county's northern townships, counts the tower among the spots visitors return to for the view, and the project starts construction on it. - TribLive: https://triblive.com/local/north-parks-observation-tower-is-top-spot-for-memory-making/ * Etna Opens a Library Latest developments: TribLive reported Wednesday, September 16, that Etna is preparing to open its own library, a project longtime Mayor Tom Rengers began pushing after a visit to the Millvale Community Library. Etna, the Allegheny River borough next to Millvale and Sharpsburg, has gone without a library of its own, and Rengers took the neighboring Millvale operation as the model for what the borough should build. - TribLive: https://triblive.com/local/etna-prepares-to-start-a-new-chapter-with-opening-of-library/ * Pittsburgh Public Bets on STEAM After the Closures Latest developments: TribLive reported Wednesday, September 16, that Pittsburgh Public Schools sees a wider future for its STEAM programming even after the district's school closures, with parents at Woolslair elementary, among them Jazlynn Worthy, crediting the program for what it has done for their children. Woolslair, in Bloomfield, has built its identity around science, technology, engineering, arts, and mathematics instruction, and the district is deciding how that work carries over as it consolidates buildings. - TribLive: https://triblive.com/news/education-classroom/full-steam-ahead-pittsburgh-public-sees-bright-future-for-program-after-school-closures/ * Nearly 4,000 County Students Without Homes Latest developments: PublicSource reported Wednesday, September 16, that nearly 4,000 Allegheny County students experience homelessness, and that a new book, "Echoes of Brilliance," collects their accounts in their own words. One contributor, a local college student the book calls Jordan, describes nights when he did not know where he would sleep or how he would reach school. The county's school districts carry the caseload under the federal McKinney-Vento law, which entitles those students to transportation and enrollment protections. - PublicSource: https://www.publicsource.org/allegheny-county-students-experience-homelessness-new-book-echoes-brilliance/ Events: * Luke Bryan's Farm Tour at 1846 Farms Latest developments: KDKA published its guide to the show Tuesday night, September 15, placing Luke Bryan's Farm Tour stop at 1846 Farms in Unity Township, near Latrobe in Westmoreland County, on Thursday, September 17. Bryan has run the Farm Tour for years, playing open fields at working farms, and thousands of fans are expected to fill the Unity Township site Thursday. - KDKA: https://www.cbsnews.com/pittsburgh/news/luke-bryan-1846-farms-tour/ SPORTS ---------------------------------------------------------------- Pirates (75-76) Tue Sep 15 · Brewers 5 · Pirates 1 · Final https://plaintextsports.com/mlb/2026-09-15/mil-pit Up Next · Brewers @ Pirates · Wed Sep 16, 6:40 PM https://plaintextsports.com/mlb/2026-09-16/mil-pit Steelers (1-0, T-1st in AFC North) Up Next · Steelers @ Patriots · Sun Sep 20, 1:00 PM https://plaintextsports.com/nfl/2026/teams/pittsburgh-steelers Around the Teams: * Watt Walks Through the Pick-Six Latest developments: T.J. Watt joined Not Just Football on Wednesday morning, September 16, to break down his pick-six against the Atlanta Falcons, the snaps he took on both sides of the line, and life as a new father. Cam Heyward and co-host Hayward Heyward run the show; after the Watt interview they went through the Steelers' Week 1 win and the zone-heavy plan the defense used, then looked ahead to the trip to the New England Patriots on Sunday, September 20, at 1 p.m. ET on CBS. - Not Just Football with Cam Heyward: https://www.youtube.com/watch?v=yX1h_us6qMo * Dulac Takes Week 2 Questions Latest developments: Post-Gazette beat writer Gerry Dulac held his Steelers chat Wednesday, September 16, taking reader questions on the club as it prepares for New England. Dulac has covered the Steelers for the Post-Gazette for decades and runs the weekly chat through the season. The Steelers play at the New England Patriots on Sunday, September 20, at 1 p.m. ET on CBS. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/09/16/steelers-news-analysis-week2/stories/202609160039 * The Film Says McCarthy's Offense Looked New Latest developments: The Post-Gazette's film study, published Wednesday, September 16, found head coach Mike McCarthy's offense genuinely different in design from what the Steelers ran in recent seasons, with the results still lagging the scheme. McCarthy took over as head coach this year and built the offense around quarterback Aaron Rodgers and receiver DK Metcalf, who drew a poor grade from the paper for the Week 1 win over the Atlanta Falcons. The Steelers play at the New England Patriots on Sunday, September 20, at 1 p.m. ET on CBS. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/09/16/film-study-offense-aaron-rodgers-dk-metcalf/stories/202609160007 Team USA: * Softball's Schiller Draws a Three-Year Ban Latest developments: ESPN reported Wednesday, September 16, that American softball player Cam Schiller has accepted a three-year ban for doping with a steroid. The suspension sidelines Schiller through the run-up to softball's return to the Olympic program at the 2028 Los Angeles Games, where the United States will defend a sport it has dominated for decades. - ESPN Olympics: https://www.espn.com/olympics/story/_/id/49956103/us-softball-player-cam-schiller-gets-3-year-steroid-ban * Record Ratings for the Women's World Cup Final Latest developments: TNT said Tuesday, September 15, that an average of 1.2 million people watched the United States beat France in the FIBA Women's World Cup gold medal game, a record audience for the event on the network. The United States won 97-79 in Germany on Sunday, September 13, for its fifth straight World Cup title, with Breanna Stewart scoring 22 points and Jackie Young 18 under coach Kara Lawson. - ESPN Olympics: https://www.espn.com/wnba/story/_/id/49954307/tnt-says-12-million-viewers-watched-usa-win-women-fiba-world-cup-final * DeMelo Sues Over Her Cardiac Arrest Latest developments: Racing Louisville FC midfielder Savannah DeMelo sued University of Louisville Health and two physicians, ESPN reported Tuesday, September 15, claiming they failed to diagnose the heart condition that led to her cardiac arrest on the field. DeMelo, a United States international who played in the 2023 Women's World Cup, collapsed during an NWSL match in September 2025. The suit puts a club's medical screening under legal scrutiny at a moment when the league is expanding its player health protocols. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49952542/savannah-demelo-racing-louisville-doctors-lawsuit-university-nwsl READING ---------------------------------------------------------------- * Stratechery -- Salesforce AI Force, Agents as UI, The Race to Headless Ben Thompson reads Salesforce's AI Force launch as the company giving up on its user interface as a competitive moat, and argues that is the right call because AI agents are dissolving the interface layer across enterprise software. https://stratechery.com/2026/salesforce-ai-force-agents-as-ui-the-race-to-headless/ * Ed Zitron -- AI Is Already In Dangerous Hands Zitron argues that the speculative debate over future superintelligence distracts from the concentrated power the current crop of AI companies already holds, and that the people running them have shown what they will do with it. https://www.wheresyoured.at/ai-is-already-in-dangerous-hands/ * Cal Newport -- Superintelligence is a Fairy Tale. But Chasing It Can Still Cause Harm. Newport, responding to Anthropic employees who said publicly that the systems they build could kill billions, treats superintelligence as a myth while warning that the race toward it inflicts real damage along the way. https://calnewport.com/superintelligence-is-a-fairy-tale-but-chasing-it-can-still-cause-harm/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,618.15 ▼ -0.9% Dow 52,306.47 ▼ -1.6% Nasdaq 26,167.22 ▼ -0.8% WTI crude 101.16 ▲ +10.7% EUR/USD 1.1603 ▼ -0.1% GBP/USD 1.3527 ▲ +0.1% USD/JPY 153.87 ▼ -2.0% FEED HEALTH ---------------------------------------------------------------- Security: 24 of 24 feeds loaded, 60 items in the 24-hour window. No recent items: Krebs on Security, CISA Advisories, Ars Technica Security, Sophos News, Google Online Security Blog, Graham Cluley, Microsoft Security Blog, Google Project Zero, The DFIR Report, Kim Zetter (Zero Day), Frank on Fraud. Pittsburgh: 9 of 9 feeds loaded, 60 items in the 48-hour window. Business and Politics: 8 of 8 feeds loaded, 60 items in the 36-hour window. Events: 4 of 4 feeds loaded, 11 items in the 120-hour window. No recent items: NEXTpittsburgh Arts & Entertainment. Sports media: 6 of 6 feeds loaded, 30 items in the 96-hour window. Team USA: 3 of 3 feeds loaded, 30 items in the 72-hour window. No recent items: Guardian Olympics. Reading: 3 of 3 feeds loaded, 12 items in the 336-hour window. Markets (Yahoo Finance): 7 of 7 rows Weather (NWS): 3 forecast periods Scores (ESPN, plaintextsports): 2 teams via plaintextsports; mlb: ESPN failed (mlb: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nfl: ESPN failed (nfl: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nhl: ESPN failed (nhl: HTTP 403 (server: AkamaiGHost)); used plaintextsports Summaries: 3 model call(s) served by claude-opus-5 (356s of model time; $1.97 at API list price). ================================================================ Generated 2026-09-16 10:06 EDT. Updated weekdays at about 7:05 AM, 10:05 AM, 1:35 PM, and 7:35 PM ET, and weekends at about 8:05 AM and 7:35 PM ET. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 3 Team USA feeds; WSJ World News, WSJ Markets, WSJ US Business, WSJ Politics, The Economist, FT Home, FT World, FT Markets; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN or plaintextsports.com. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================