infosecfollow

daily plain-text briefing: security, markets, business, and pittsburgh

Spain's data protection regulator logged what appears to be the first breach an AI agent carried out end to end, hours after Mandiant traced the Shai-Hulud worm to a hijacked AI coding-assistant session.


Emerging Trends and Key Updates

Security

1. Oracle Ships 800 Fixes as Google Patches an Exploited Pixel Zero-Day

Vulnerabilities and Exploits · [patch, zero-day]

Latest developments: CISA added CVE-2026-58704, the 8.0-rated permission bypass in the Pixel cellular modem that attackers already use in limited targeted attacks, to its Known Exploited Vulnerabilities catalog on September 16, 2026, a day after Google shipped it among 110 Pixel fixes; Oracle's September 2026 security update closed more than 800 vulnerabilities across 17 product families, over 100 of them critical; and Google and Mozilla together closed 115 browser flaws, 42 in Chrome and 73 in Firefox.

read more

The Oracle batch spans databases, middleware, and business applications, which makes it the heaviest scheduling problem for enterprise administrators this quarter. Pixel owners should update first, since the modem flaw sits under active exploitation.

Sources: SecurityWeek · BleepingComputer · CISA Advisories · SecurityWeek · ↑ top

2. Poisoned Plugins Backdoor WordPress and cPanel Hosts

Vulnerabilities and Exploits · [exploit, wordpress, patch]

Latest developments: Acronis confirmed that attackers exploit CVE-2026-87886, the 7.8-rated insecure file permissions flaw in its backup plugin for cPanel, WebHost Manager, and Plesk, in limited targeted attacks that raise a local Linux account to root; SecurityWeek reported that unauthenticated remote code execution flaws in The Events Calendar expose more than 200,000 WordPress sites to takeover; Wordfence blocked thousands of attempts to upload PHP backdoors through WooCommerce Wholesale Lead Capture, a premium plugin running on more than 6,000 sites; and tampered Admin Menu Editor Pro updates, pushed after a threat actor compromised the maintainer's website, planted a hidden user account on 1,500 WordPress sites.

read more

Hosting stacks run on third-party plugins that update themselves and that nobody audits. Patch the Acronis backup plugin, The Events Calendar, and WooCommerce Wholesale Lead Capture, then hunt for unfamiliar administrator accounts and new PHP files in upload directories.

Sources: SecurityWeek · Help Net Security · The Hacker News · BleepingComputer · ↑ top

3. Runaway Agents and AI-Found Bugs Swamp Defenders

AI Security · [ai, agents]

Latest developments: Forever Security showed that one ordinary browser extension seizes the AI assistants built into five Chromium products—Gemini Live in Chrome, Perplexity Comet, Microsoft Edge, Opera Neon, and the Claude in Chrome extension—with a single click after installation, and Dark Reading detailed BragJack, an attack that turns a browser's built-in assistant against its owner to reach sensitive information, run malicious actions, and exfiltrate data; Mandiant's AI Risk and Resilience report, built on its own casework and Google Threat Intelligence Group telemetry, tracked attacks moving from direct prompts to indirect prompt injection and AI supply chain compromise and cited one autonomous agent that ran up a $50,000 cloud bill; and Cisco Talos argued that AI keeps surfacing vulnerabilities nobody can patch, leaving network segmentation and next-generation firewall and intrusion prevention pairs as the compensating layer.

read more

Enterprises now run agents that call APIs, change production configurations, and spend money without a human in the loop, and the browser assistant sitting on every employee laptop belongs on that list. Gate proposed agent actions before they touch production systems, cap cloud spending per agent, restrict extension installation, and segment what agents cannot patch.

Sources: Dark Reading · The Hacker News · Help Net Security · Cisco Talos · ↑ top

4. Spain Reports the First Agentic AI Data Breach

AI Security · [ai, breach, supply chain]

Latest developments: The Spanish Data Protection Agency received notification of an attack that an AI agent running on a known large language model carried out, chaining a successful login, vulnerability discovery, and access to personal data, which SecurityWeek calls the first agentic AI breach a regulator has logged; Mandiant separately traced an attacker who hijacked an active AI coding-assistant session at a software-as-a-service provider, steered the assistant into recommending poisoned software, and then watched the Shai-Hulud worm move across roughly 100 internal code repositories, taking repository secrets and source code.

read more

One AI agent ran a full intrusion sequence against a Spanish organization, and a hijacked coding assistant seeded a worm inside a vendor's repositories. Treat agent sessions as privileged accounts: log every action they take, rotate repository secrets, and require human approval before an assistant installs a dependency.

Sources: SecurityWeek · BleepingComputer · The Hacker News · ↑ top

5. Forged Admin Tokens Open WSO2 API Manager

Vulnerabilities and Exploits · [exploit, patch]

Latest developments: watchTowr reported active exploitation of CVE-2026-5430, a 9.8-rated failure to verify a cryptographic signature in WSO2 API Manager that lets an attacker forge a JSON Web Token, authenticate as an administrator, and take over accounts, a flaw the Hacktron Team found and reported; attackers separately began exploiting CVE-2026-89026, rated 9.8, in the Issabel Framework, where a hard-coded credential lets an unauthenticated remote attacker run operating system commands on the open-source unified communications PBX.

read more

WSO2 API Manager fronts enterprise APIs and the data behind them, and Issabel runs corporate phone systems, so both give an intruder administrative reach in one step. Apply the vendor fixes and audit logs for administrative sessions and commands that no legitimate login produced.

Sources: The Hacker News · SecurityWeek · The Hacker News · ↑ top

6. NightEagle Hits Russia as a North Korean Toolkit Lands in Seoul

Nation-State Activity · [apt, espionage]

Latest developments: Kaspersky widened the Russian picture on September 16, 2026, naming three clusters that hit enterprises there: NightEagle, also tracked as APT-Q-95 and active since at least 2023, which plants the GhostContainer backdoor, stages its tools on GitHub, and exploits weaknesses in Active Directory and Remote Desktop Protocol, alongside Hacking Cat and Toy Ghouls, which deliver backdoors, ransomware, and wipers; Dark Reading separately reported that a likely North Korean group used a previously undocumented Linux espionage toolkit to seize load balancers at South Korean media and automotive companies, read communications, and push deeper into those networks.

read more

All four crews aim at infrastructure that security teams rarely instrument: domain controllers, remote access services, and the Linux appliances balancing traffic at the network edge. Hunt on those devices for unexpected tunnels, new local accounts, and outbound connections to GitHub-hosted payloads.

Sources: Securelist (Kaspersky) · The Hacker News · Dark Reading · ↑ top

7. Hackers Dump a Flock Safety Camera's Software and Data

Data Privacy · [surveillance, privacy, breach]

Latest developments: A hacker collective pulled down a Flock Safety camera, extracted the software running inside it, and published the contents, and Wired counted thousands of videos and logs showing that the single device captured 1.6 million images of 50,000 vehicles in 21 days; The Record reported the same day that Washington, D.C.'s police department has used Flock camera data in misconduct investigations of its own officers, which drew a formal complaint from the officers' union.

read more

Flock Safety sells automated license plate readers to police departments across the United States, and the stolen files show exactly how one device recognizes and logs cars and the people near them. Agencies running Flock hardware should expect these capture rates, retention records, and internal uses to drive local policy fights and open records demands.

Sources: 404 Media · Wired Security · The Record · ↑ top

8. Premier Medical Group and CenterPoint Energy Count Victims

Ransomware and Cybercrime · [breach, healthcare]

Latest developments: Premier Medical Group began notifying 280,000 people that hackers reached files holding names, contact information, diagnosis details, and health insurance information in June 2026, and CenterPoint Energy, the Houston utility serving roughly 7 million customers in Indiana, Minnesota, Ohio, and Texas, confirmed that an unauthorized third party took customer data through one of its external systems after a hacker posting as 4d722e4d656f77 claimed millions of records on a hacking forum.

read more

Both sets of records outlast any password reset: medical diagnoses on one side, utility accounts tied to home addresses on the other. Customers of either should expect phishing that quotes real account details back to them.

Sources: SecurityWeek · Help Net Security · BleepingComputer · ↑ top

9. Von der Leyen Asks Europe to Answer Sabotage Together

Nation-State Activity · [policy, ai]

Latest developments: Ursula von der Leyen, president of the European Commission, used her State of the Union address in Strasbourg on September 16, 2026 to call for a joint European response to cyberattacks and sabotage, pointing to recent incidents in Denmark, Lithuania, and Poland and an attempted drone attack in Leipzig; she warned that advanced AI could unleash hacking on an unprecedented scale, asked the leading AI labs to slow self-improving models and promised to invite them in, committed the bloc to work with Canada and the United Kingdom on evaluating and verifying advanced systems and on early warning, and outlined new protections for children against social media.

read more

European Union governments have handled cyber and physical sabotage nationally, and von der Leyen wants the bloc to answer as one. Companies selling connected products into Europe should watch for coordination duties stacked on top of the Cyber Resilience Act's 24-hour incident reporting clock.

Sources: The Record · SecurityWeek · Help Net Security · ↑ top

10. CISA Says Attackers Now Exploit ScreenConnect

Vulnerabilities and Exploits · [exploit, patch]

Latest developments: The Cybersecurity and Infrastructure Security Agency warned on September 16, 2026 that attackers exploit a critical ConnectWise ScreenConnect vulnerability in the wild, two days after ConnectWise shipped the fix for the flaw that lets an attacker push files through an active remote session and run them without authorization.

read more

ScreenConnect hands managed service providers remote control of client endpoints, so one exploited server gives an intruder every machine beneath it. Update self-hosted ScreenConnect servers now and review session and file transfer logs for transfers no technician made.

Sources: BleepingComputer · ↑ top

Business and Politics

Saudi Arabia Appears to Fire a Chinese Ballistic Missile

Latest developments: The Wall Street Journal reported Wednesday, September 16, that the body of what appeared to be a Dongfeng 15 turned up in the Yemeni desert, the first sign that Saudi Arabia has fired a Chinese ballistic missile.

read more

The kingdom has absorbed months of Houthi drone and missile attacks on its oil facilities and its Red Sea coast, and the militants now hold the Bab al-Mandeb chokepoint. Saudi Arabia reaching into a Chinese missile arsenal widens a war that has shut the Strait of Hormuz to tanker traffic, closed the East-West pipeline, and left Brent near four-month highs.

Sources: WSJ World News · ↑ top

The AI Slowdown Fight Moves Inside OpenAI and Anthropic

Latest developments: The Financial Times reported Wednesday, September 16, that staff at OpenAI and Anthropic are struggling over how to turn their chief executives' slowdown rhetoric into practice, and the Wall Street Journal reported that dozens of business leaders at a private event this week called the safety threat real and pressed President Trump to work with China on joint guardrails.

read more

Anthropic Chief Executive Dario Amodei's essay against a race to the bottom in model development knocked down memory-chip makers and Nvidia worldwide on Monday, September 14, and Trump called the warnings a hoax. DeepMind co-founder Shane Legg told the Financial Times that AI must not outrun safety controls as his company launched the DeepMind Institute to study artificial general intelligence, and the Journal's markets column argued the buildout slows on its own economics whatever happens on safety.

Sources: FT Home · FT Home · WSJ US Business · WSJ Markets · ↑ top

Chinese Oil Prices Hit Records

Latest developments: The Financial Times reported Wednesday, September 16, that domestic Chinese oil prices reached record highs after the drone attacks on Saudi Arabia's East-West pipeline, and that Beijing has drained enough of its stockpile that it must come back to the world market.

read more

China held global crude prices down through the first months of the Iran war by drawing on inventories instead of buying, a cushion analysts told the Financial Times is ending as the country comes off its crash diet. Fresh Chinese buying would land on a market already short the barrels that normally move through the Strait of Hormuz, with Brent near four-month highs and the Hormuz squeeze now pushing Asian buyers to look past long-term liquefied natural gas contracts.

Sources: FT Home · FT Markets · WSJ World News · ↑ top

The Fed Decides on Rates

Latest developments: The Federal Reserve announces its decision at 2 p.m. ET Wednesday, September 16, with futures pricing a quarter-point increase as close to certain, and the case firmed during the morning as the Commerce Department reported retail sales up 1.2% in August against the 0.8% economists expected and a 0.5% drop in July.

read more

An increase would be the Fed's first in years, forced by August consumer prices running 3.4% and by the oil shock from the Gulf war, and it would come from a central bank Chair Kevin Warsh now runs under steady public pressure from President Trump; the economists in the FT-Booth survey published Wednesday morning said the Fed should raise over those objections. The 10-year Treasury yield slipped below 5% Wednesday morning, the dollar firmed slightly, gold rose as yields and oil eased, and bitcoin traded at $75,877 in European afternoon trade, near a four-week low.

Sources: WSJ Markets · FT Home · WSJ Markets · WSJ Markets · ↑ top

Von der Leyen Offers Canada Associate Membership

Latest developments: European Commission President Ursula von der Leyen proposed Wednesday, September 16, making Canada the first associate member of the European Union, saying the two "see the world with the same eyes."

read more

The offer endorses Canadian Prime Minister Mark Carney's drive to pivot his country toward Europe and away from the United States, and it would create a membership tier that has never existed in the bloc's history. Several EU governments have balked at Carney's parallel call for "middle powers" to line up together against Washington and Beijing, leaving the proposal short of unanimous backing.

Sources: WSJ World News · FT Home · FT World · ↑ top

Pittsburgh

Weather

This Afternoon: Chance Showers And Thunderstorms, high 88F.

Tonight: Chance Showers And Thunderstorms then Areas Of Fog, low 70F.

Thursday: Showers And Thunderstorms, high 86F.

Business

Duquesne Light Workers Authorize a Strike

Latest developments: WPXI reported Wednesday, September 16, that unionized Duquesne Light Company workers have voted to authorize a strike.

read more

Duquesne Light distributes electricity across Allegheny and Beaver counties from its downtown Pittsburgh headquarters, and its union crews handle the line work, service calls, and outage restoration that keep the region's grid running.

Sources: WPXI · ↑ top

Riley's Pour House Rebuilds in Carnegie

Latest developments: Pittsburgh Magazine reported Wednesday, September 16, that Riley's Pour House will hold a groundbreaking celebration Friday, September 18, at its original site, 215 E. Main Street in Carnegie, with construction starting next week and a grand opening slated for March 2027.

read more

Fire destroyed the Irish pub at that address in November 2024, and the owners are rebuilding on the same lot rather than moving, returning a long-running gathering spot to Carnegie's main commercial street in Allegheny County.

Sources: Pittsburgh Magazine · ↑ top

A 381-Ton Superload Crosses Three Counties

Latest developments: KDKA reported Wednesday, September 16, that roughly 50 superloads will travel from Armstrong County to Indiana County over the next four months, deeply disrupting traffic along the way, a day after WTAE published the route for the first haul: a 381-ton load moving Wednesday, September 16, through Armstrong, Westmoreland, and Indiana counties.

read more

The loads run from the Armstrong Terminals in Gilpin to the data center project rising near Homer City in Indiana County, and each one travels at a crawl and closes lanes along the way.

Sources: WTAE · KDKA · ↑ top

A $13 Billion Power Plant Splits Fayette County

Latest developments: WTAE reported Wednesday, September 16, that a $13 billion energy proposal has divided Fayette County, with supporters counting the construction jobs and investment and opponents arguing the environmental cost runs too high.

read more

Fayette County, in the southwestern corner of Pennsylvania along the Monongahela, sits in the middle of the power buildout that the region's data center developers have set off, and a project of this size would rank among the largest private investments the county has ever seen.

Sources: WTAE · ↑ top

Allegheny Smokeworks Closes in Blawnox

Latest developments: TribLive reported Wednesday, September 16, that Allegheny Smokeworks will close its Blawnox location because the landlord is putting the building on the market.

read more

Allegheny Smokeworks has operated for years in Blawnox, the small Allegheny River borough between Aspinwall and Harmarville, and the sale of its building ends the run there.

Sources: TribLive · ↑ top

Upper Burrell Holds Off on Its Data Center Rules

Latest developments: The Upper Burrell Planning Commission voted Tuesday, September 15, to delay its recommendation on the township's latest draft data center ordinance so residents can take more concerns to the township supervisors.

read more

Upper Burrell, a Westmoreland County township near New Kensington, has been drafting zoning rules to govern data centers as developers scout Western Pennsylvania, the same pressure that pushed Allegheny County Council this week toward barring large data centers from county land.

Sources: TribLive · ↑ top

Around Town

State Grants Land in Pittsburgh, Millvale, and Heidelberg

Latest developments: Three Wednesday, September 16, reports tallied the latest round of state grants: $1.2 million to the city of Pittsburgh for a new fire truck and redevelopment of Hilltop properties, $450,000 to Millvale toward its Logan Street reconstruction, and money for three police vehicles in Heidelberg alongside Scott Township police and infrastructure projects in Carnegie and Bridgeville.

read more

Millvale's Logan Street rebuild carries a price tag above $1 million, so the borough covers the rest, and the Chartiers Valley awards spread across four small municipalities in Allegheny County that rely on Harrisburg for capital purchases their tax bases cannot absorb.

Sources: WPXI · TribLive · TribLive · ↑ top

The Latino Community Center Buys a Strip District Home

Latest developments: Pittsburgh Magazine reported Wednesday, September 16, that the Latino Community Center finalized plans this week to leave the office space it rents near Friendship for a building it purchased in the Strip District.

read more

The center runs programs for Pittsburgh's Latine families, and owning its headquarters ends its dependence on a lease. The move lands at the start of Hispanic Heritage Month, the same stretch in which the Pennsylvania Metropolitan Area Hispanic Chamber of Commerce opened new programs for Hispanic business owners.

Sources: Pittsburgh Magazine · ↑ top

Carey Scheide Miller Takes Over the Natural History Museum

Latest developments: Carnegie Museums announced Wednesday, September 16, that Carey Scheide Miller will serve as director and vice president of the Carnegie Museum of Natural History.

read more

Miller has worked as vice president and chief development officer for Carnegie Museums since 2023, and she now runs the Oakland institution that holds the dinosaur halls and one of the country's largest research collections.

Sources: Pittsburgh Magazine · ↑ top

Storms Return Wednesday Afternoon

Latest developments: WTAE flagged Wednesday, September 16, as an Impact Day for isolated storms, while KDKA meteorologist Ron Smiley's morning forecast kept most of the day dry, with highs in the mid-80s and spells of sun before higher rain chances arrive Thursday.

read more

The pattern follows a warm, humid stretch across the Pittsburgh region, and the heavier, more widespread rain holds off until Thursday, September 17.

Sources: WTAE · KDKA · ↑ top

North Park Breaks Ground on Its Observation Tower

Latest developments: TribLive reported Wednesday, September 16, that North Park held a groundbreaking for its Observation Tower, with paint brushes standing in for shovels at the ceremony.

read more

North Park, the Allegheny County park spread across the county's northern townships, counts the tower among the spots visitors return to for the view, and the project starts construction on it.

Sources: TribLive · ↑ top

Etna Opens a Library

Latest developments: TribLive reported Wednesday, September 16, that Etna is preparing to open its own library, a project longtime Mayor Tom Rengers began pushing after a visit to the Millvale Community Library.

read more

Etna, the Allegheny River borough next to Millvale and Sharpsburg, has gone without a library of its own, and Rengers took the neighboring Millvale operation as the model for what the borough should build.

Sources: TribLive · ↑ top

Pittsburgh Public Bets on STEAM After the Closures

Latest developments: TribLive reported Wednesday, September 16, that Pittsburgh Public Schools sees a wider future for its STEAM programming even after the district's school closures, with parents at Woolslair elementary, among them Jazlynn Worthy, crediting the program for what it has done for their children.

read more

Woolslair, in Bloomfield, has built its identity around science, technology, engineering, arts, and mathematics instruction, and the district is deciding how that work carries over as it consolidates buildings.

Sources: TribLive · ↑ top

Nearly 4,000 County Students Without Homes

Latest developments: PublicSource reported Wednesday, September 16, that nearly 4,000 Allegheny County students experience homelessness, and that a new book, "Echoes of Brilliance," collects their accounts in their own words.

read more

One contributor, a local college student the book calls Jordan, describes nights when he did not know where he would sleep or how he would reach school. The county's school districts carry the caseload under the federal McKinney-Vento law, which entitles those students to transportation and enrollment protections.

Sources: PublicSource · ↑ top

Events

Panda Fest and the Jazz Festival Fill the Weekend

Latest developments: NEXTpittsburgh published its weekend guide Wednesday, September 16, listing more than 15 things to do from Thursday, September 17, through Sunday, September 20, led by Panda Fest and the Pittsburgh International Jazz Festival.

read more

The jazz festival runs its 16th year Thursday, September 17, through Sunday, September 20, in downtown Pittsburgh, with free concerts also playing at Pittsburgh International Airport. NEXTpittsburgh pairs the weekend list with its live music guide for fall festivals and concerts and its NEXT in the Gallery roundup of September art shows.

Sources: NEXTpittsburgh Events · ↑ top

'Disney's The Lion King' Runs Through September 27

Latest developments: KDKA's Pittsburgh Today Live went behind the show Wednesday, September 16, with the production's puppet supervisor explaining how the masks and puppets bring the characters to life.

read more

The Pittsburgh Cultural Trust and the PNC Broadway in Pittsburgh Series present "Disney's The Lion King" at the Benedum Center in downtown Pittsburgh through Sunday, September 27, the show that opened the Trust's 2026-27 Broadway season.

Sources: KDKA · KDKA · ↑ top

Evans City Pumpkinfest, September 19 and 20

Latest developments: KDKA previewed Evans City Pumpkinfest on Wednesday, September 16, with Chris Jamison, the Pittsburgh singer who reached the finals of "The Voice," among the performers.

read more

Pumpkinfest fills E. Main Street in Evans City, Butler County, on Saturday, September 19, and Sunday, September 20, with food, family activities, and live music.

Sources: KDKA · ↑ top

The Great Race Comes September 26 and 27

Latest developments: KDKA walked through the first steps toward the City of Pittsburgh Great Race on Wednesday, September 16, ten days out from the event.

read more

One Great Weekend runs Saturday, September 26, and Sunday, September 27: the Dollar Bank Junior Great Race on Saturday, then the 5K, the 10K, and the One GREAT Challenge on Sunday.

Sources: KDKA · ↑ top

Luke Bryan's Farm Tour at 1846 Farms

Latest developments: KDKA published its guide to the show Tuesday night, September 15, placing Luke Bryan's Farm Tour stop at 1846 Farms in Unity Township, near Latrobe in Westmoreland County, on Thursday, September 17.

read more

Bryan has run the Farm Tour for years, playing open fields at working farms, and thousands of fans are expected to fill the Unity Township site Thursday.

Sources: KDKA · ↑ top

Sports

Pirates (75-76)

Tue Sep 15 · Brewers 5 · Pirates 1 · Final

Up Next · Brewers @ Pirates · Wed Sep 16, 6:40 PM

Steelers (1-0, T-1st in AFC North)

Up Next · Steelers @ Patriots · Sun Sep 20, 1:00 PM

Around the Teams

Benton Wears a Microphone at Practice

Latest developments: The Steelers posted a full mic'd-up video of defensive tackle Keeanu Benton on Wednesday, September 16, recorded during practice at the team's facility.

read more

Benton works the interior of the line alongside Cam Heyward, and the video follows him through drills and position work as the Steelers prepare for the New England Patriots on Sunday, September 20, at 1 p.m. ET on CBS.

Sources: Pittsburgh Steelers (YouTube) · ↑ top

Watt Walks Through the Pick-Six

Latest developments: T.J. Watt joined Not Just Football on Wednesday morning, September 16, to break down his pick-six against the Atlanta Falcons, the snaps he took on both sides of the line, and life as a new father.

read more

Cam Heyward and co-host Hayward Heyward run the show; after the Watt interview they went through the Steelers' Week 1 win and the zone-heavy plan the defense used, then looked ahead to the trip to the New England Patriots on Sunday, September 20, at 1 p.m. ET on CBS.

Sources: Not Just Football with Cam Heyward · ↑ top

Dulac Takes Week 2 Questions

Latest developments: Post-Gazette beat writer Gerry Dulac held his Steelers chat Wednesday, September 16, taking reader questions on the club as it prepares for New England.

read more

Dulac has covered the Steelers for the Post-Gazette for decades and runs the weekly chat through the season. The Steelers play at the New England Patriots on Sunday, September 20, at 1 p.m. ET on CBS.

Sources: Post-Gazette Steelers · ↑ top

The Film Says McCarthy's Offense Looked New

Latest developments: The Post-Gazette's film study, published Wednesday, September 16, found head coach Mike McCarthy's offense genuinely different in design from what the Steelers ran in recent seasons, with the results still lagging the scheme.

read more

McCarthy took over as head coach this year and built the offense around quarterback Aaron Rodgers and receiver DK Metcalf, who drew a poor grade from the paper for the Week 1 win over the Atlanta Falcons. The Steelers play at the New England Patriots on Sunday, September 20, at 1 p.m. ET on CBS.

Sources: Post-Gazette Steelers · ↑ top

Team USA

Brazil Ends the U.S. Under-20 World Cup Run

Latest developments: Brazil eliminated the United States from the Under-20 Women's World Cup on Wednesday, September 16, winning 5-4 on penalties in the round of 16 after a 1-1 draw through 120 minutes.

read more

The exit comes days after Alex Morgan, Crystal Dunn, and Brazil's Marta signed an open letter asking FIFA to align the Under-20 Women's World Cup with the international match calendar, a fight over how national federations release young players for the tournament.

Sources: ESPN Soccer · ↑ top

Cole Campbell Commits to the United States

Latest developments: Cole Campbell told ESPN on Wednesday, September 16, that he has committed his international future to the United States as he pushes for a first senior call-up.

read more

Campbell has been the breakout American of the German season at Elversberg, and his decision adds a forward option to a men's pool that turned over after the United States exited the 2026 World Cup, with Diego Luna out for months with a knee injury.

Sources: ESPN Soccer · ↑ top

Softball's Schiller Draws a Three-Year Ban

Latest developments: ESPN reported Wednesday, September 16, that American softball player Cam Schiller has accepted a three-year ban for doping with a steroid.

read more

The suspension sidelines Schiller through the run-up to softball's return to the Olympic program at the 2028 Los Angeles Games, where the United States will defend a sport it has dominated for decades.

Sources: ESPN Olympics · ↑ top

Record Ratings for the Women's World Cup Final

Latest developments: TNT said Tuesday, September 15, that an average of 1.2 million people watched the United States beat France in the FIBA Women's World Cup gold medal game, a record audience for the event on the network.

read more

The United States won 97-79 in Germany on Sunday, September 13, for its fifth straight World Cup title, with Breanna Stewart scoring 22 points and Jackie Young 18 under coach Kara Lawson.

Sources: ESPN Olympics · ↑ top

DeMelo Sues Over Her Cardiac Arrest

Latest developments: Racing Louisville FC midfielder Savannah DeMelo sued University of Louisville Health and two physicians, ESPN reported Tuesday, September 15, claiming they failed to diagnose the heart condition that led to her cardiac arrest on the field.

read more

DeMelo, a United States international who played in the 2023 Women's World Cup, collapsed during an NWSL match in September 2025. The suit puts a club's medical screening under legal scrutiny at a moment when the league is expanding its player health protocols.

Sources: ESPN Soccer · ↑ top

Reading

Markets

weekly average, change vs prior week

S&P 500     7,618.15  ▼ -0.9%
Dow        52,306.47  ▼ -1.6%
Nasdaq     26,167.22  ▼ -0.8%
WTI crude     101.16  ▲ +10.7%
EUR/USD       1.1603  ▼ -0.1%
GBP/USD       1.3527  ▲ +0.1%
USD/JPY       153.87  ▼ -2.0%

Feed Health

Security: 24 of 24 feeds loaded, 60 items in the 24-hour window. No recent items: Krebs on Security, Ars Technica Security, Securelist (Kaspersky), Sophos News, Google Online Security Blog, Graham Cluley, Microsoft Security Blog, Google Project Zero, The DFIR Report, Kim Zetter (Zero Day), Frank on Fraud.

Pittsburgh: 8 of 9 feeds loaded, 60 items in the 48-hour window. Failed: WTAE (HTTPError: HTTP Error 404: Not Found).

Business and Politics: 8 of 8 feeds loaded, 60 items in the 36-hour window.

Events: 4 of 4 feeds loaded, 12 items in the 120-hour window.

Sports media: 6 of 6 feeds loaded, 30 items in the 96-hour window.

Team USA: 3 of 3 feeds loaded, 32 items in the 72-hour window. No recent items: Guardian Olympics.

Reading: 3 of 3 feeds loaded, 12 items in the 336-hour window.

Markets (Yahoo Finance): 7 of 7 rows

Weather (NWS): 3 forecast periods

Scores (ESPN, plaintextsports): 2 teams via plaintextsports; mlb: ESPN failed (mlb: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nfl: ESPN failed (nfl: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nhl: ESPN failed (nhl: HTTP 403 (server: AkamaiGHost)); used plaintextsports

Summaries: 3 model call(s) served by claude-opus-5 (419s of model time; $2.25 at API list price).