Spain's privacy regulator logged the first data breach an AI agent carried out on its own, hours before European Commission President Ursula von der Leyen asked the bloc to answer AI-powered hacking and sabotage as one.
Emerging Trends and Key Updates
- Trend An AI agent chained login, bug discovery, and data theft in Spain, a browser extension hijacks Chrome and Comet assistants, and OpenAI widens its safety incident disclosures.
- Trend Exploitation follows disclosure within days as watchTowr tracks forged JWTs in WSO2 API Manager, CISA flags the Acronis cPanel backup plugin, and Oracle ships 800 fixes.
- Trend A hacker collective's teardown of a Flock Safety camera exposed 1.6 million plate images as Washington, D.C. police turned the same readers on their own officers.
- Update · new The FBI, NCSC, and AIVD named CHOSEN BRICK, Iranian spyware aimed at dissidents, while BleepingComputer detailed KREMLIN, a banking toolkit force-installing malicious Chrome and Edge extensions.
- Update · new Von der Leyen urged a European answer to sabotage in Strasbourg as the House sent a Russia sanctions package to Trump and a Chinese missile surfaced in Yemen.
- Update · new Allegheny County trimmed its paid parental leave plan and briefed superintendents on measles quarantines, while Pittsburgh Water began clearing past-due balances after two years of on-time payments.
Security
1. Oracle Ships 800 Fixes as Google Patches an Exploited Pixel Zero-Day
Latest developments: CISA added two more exploited flaws on September 16, 2026—CVE-2026-76460, an incorrect use of privileged APIs in Cisco Identity Services Engine, and CVE-2026-87886 in the Acronis backup plugin—and warned the same day that attackers now exploit the critical ConnectWise ScreenConnect file transfer flaw that ConnectWise patched on September 14, 2026; CISA had already cataloged CVE-2026-58704, the 8.0-rated permission bypass in the Pixel cellular modem that attackers use in limited targeted attacks.
read more
Oracle's September update closed more than 800 vulnerabilities across 17 product families, over 100 of them critical, and Google's September Pixel release carried 110 fixes. Update Pixel phones and self-hosted ScreenConnect servers first, review ScreenConnect session and file transfer logs for transfers no technician made, then schedule the Oracle work.
Sources: SecurityWeek · BleepingComputer · CISA Advisories · BleepingComputer · ↑ top
2. Poisoned Plugins Backdoor WordPress and cPanel Hosts
Latest developments: CISA added CVE-2026-87886 to its Known Exploited Vulnerabilities catalog on September 16, 2026, hours after Acronis confirmed that attackers use the 7.8-rated insecure file permissions flaw in its backup plugin for cPanel, WebHost Manager, and Plesk to raise a local Linux account to root in limited targeted attacks; SecurityWeek reported that unauthenticated remote code execution flaws in The Events Calendar expose more than 200,000 WordPress sites to takeover; Wordfence blocked thousands of attempts to upload PHP backdoors through WooCommerce Wholesale Lead Capture, a premium plugin running on more than 6,000 sites; and tampered Admin Menu Editor Pro updates, pushed after a threat actor compromised the maintainer's website, planted a hidden user account on 1,500 WordPress sites.
read more
Hosting stacks run on third-party plugins that update themselves and that nobody audits. Patch the Acronis backup plugin, The Events Calendar, and WooCommerce Wholesale Lead Capture, then hunt for unfamiliar administrator accounts and new PHP files in upload directories.
Sources: SecurityWeek · Help Net Security · The Hacker News · BleepingComputer · ↑ top
3. Runaway Agents and AI-Found Bugs Swamp Defenders
Latest developments: Forever Security showed that one ordinary browser extension seizes the AI assistants built into five Chromium products—Gemini Live in Chrome, Perplexity Comet, Microsoft Edge, Opera Neon, and the Claude in Chrome extension—with a single click after installation, and Dark Reading detailed BragJack, an attack that turns a browser's built-in assistant against its owner to reach sensitive information, run malicious actions, and exfiltrate data; Mandiant's AI Risk and Resilience report, built on its own casework and Google Threat Intelligence Group telemetry, tracked attacks moving from direct prompts to indirect prompt injection and AI supply chain compromise and cited one autonomous agent that ran up a $50,000 cloud bill; and Cisco Talos argued that AI keeps surfacing vulnerabilities nobody can patch, leaving network segmentation and next-generation firewall and intrusion prevention pairs as the compensating layer.
read more
Enterprises now run agents that call APIs, change production configurations, and spend money without a human in the loop, and the browser assistant sitting on every employee laptop belongs on that list. Gate proposed agent actions before they touch production systems, cap cloud spending per agent, restrict extension installation, and segment what agents cannot patch.
Sources: Dark Reading · The Hacker News · Help Net Security · Cisco Talos · ↑ top
4. Von der Leyen Asks Europe to Answer Sabotage Together
Latest developments: Ursula von der Leyen, president of the European Commission, used her State of the Union address in Strasbourg on September 16, 2026 to call for a joint European response to cyberattacks and sabotage, pointing to recent incidents in Denmark, Lithuania, and Poland and an attempted drone attack in Leipzig; she warned that advanced AI could unleash hacking on an unprecedented scale, asked the leading AI labs to slow self-improving models and promised to invite them in, committed the bloc to work with Canada and the United Kingdom on evaluating and verifying advanced systems and on early warning, and outlined new protections for children against social media. In Washington the same day, House Energy and Commerce Chairman Brett Guthrie said the FRONTIER Act, the chamber's AI safety bill, will likely wait until 2027 because he declines to rush it through a lame duck session.
read more
European Union governments have handled cyber and physical sabotage nationally, and von der Leyen wants the bloc to answer as one while Congress lets its own AI bill slip past this term. Companies selling connected products into Europe should watch for coordination duties stacked on top of the Cyber Resilience Act's 24-hour incident reporting clock.
Sources: The Record · SecurityWeek · Help Net Security · The Record · ↑ top
5. Spain Reports the First Agentic AI Data Breach
Latest developments: The Spanish Data Protection Agency received notification of an attack that an AI agent running on a known large language model carried out, chaining a successful login, vulnerability discovery, and access to personal data, which SecurityWeek calls the first agentic AI breach a regulator has logged; Mandiant separately traced an attacker who hijacked an active AI coding-assistant session at a software-as-a-service provider, steered the assistant into recommending poisoned software, and then watched the Shai-Hulud worm move across roughly 100 internal code repositories, taking repository secrets and source code.
read more
One AI agent ran a full intrusion sequence against a Spanish organization, and a hijacked coding assistant seeded a worm inside a vendor's repositories. Treat agent sessions as privileged accounts: log every action they take, rotate repository secrets, and require human approval before an assistant installs a dependency.
Sources: SecurityWeek · BleepingComputer · The Hacker News · ↑ top
6. Forged Admin Tokens Open WSO2 API Manager
Latest developments: watchTowr reported active exploitation of CVE-2026-5430, a 9.8-rated failure to verify a cryptographic signature in WSO2 API Manager that lets an attacker forge a JSON Web Token, authenticate as an administrator, and take over accounts, a flaw the Hacktron Team found and reported; attackers separately began exploiting CVE-2026-89026, rated 9.8, in the Issabel Framework, where a hard-coded credential lets an unauthenticated remote attacker run operating system commands on the open-source unified communications PBX.
read more
WSO2 API Manager fronts enterprise APIs and the data behind them, and Issabel runs corporate phone systems, so both give an intruder administrative reach in one step. Apply the vendor fixes and audit logs for administrative sessions and commands that no legitimate login produced.
Sources: The Hacker News · SecurityWeek · The Hacker News · ↑ top
7. Iran's CHOSEN BRICK Malware Spies on Dissidents
Latest developments: The FBI, the United Kingdom's National Cyber Security Centre, and the Netherlands' AIVD named the malware on September 16, 2026: CHOSEN BRICK, which Iranian state operators have delivered through social messaging apps to dissidents, activists, and journalists in the three countries since at least 2025, and the FBI detailed how the operators run command and control through Telegram.
read more
CHOSEN BRICK copies a target's email and chat messages, captures screenshots, and switches on the microphone of an infected Windows machine. People in exile communities, newsrooms, and human rights organizations should treat unsolicited files arriving over Telegram and WhatsApp as hostile and check devices against the agencies' published indicators.
Sources: BleepingComputer · SecurityWeek · Help Net Security · ↑ top
8. NightEagle Hits Russia as a North Korean Toolkit Lands in Seoul
Latest developments: Kaspersky widened the Russian picture on September 16, 2026, naming three clusters that hit enterprises there: NightEagle, also tracked as APT-Q-95 and active since at least 2023, which plants the GhostContainer backdoor, stages its tools on GitHub, and exploits weaknesses in Active Directory and Remote Desktop Protocol, alongside Hacking Cat and Toy Ghouls, which deliver backdoors, ransomware, and wipers; Dark Reading separately reported that a likely North Korean group used a previously undocumented Linux espionage toolkit to seize load balancers at South Korean media and automotive companies, read communications, and push deeper into those networks.
read more
All four crews aim at infrastructure that security teams rarely instrument: domain controllers, remote access services, and the Linux appliances balancing traffic at the network edge. Hunt on those devices for unexpected tunnels, new local accounts, and outbound connections to GitHub-hosted payloads.
Sources: Securelist (Kaspersky) · The Hacker News · Dark Reading · ↑ top
9. Hackers Dump a Flock Safety Camera's Software and Data
Latest developments: A hacker collective pulled down a Flock Safety camera, extracted the software running inside it, and published the contents, and Wired counted thousands of videos and logs showing that the single device captured 1.6 million images of 50,000 vehicles in 21 days; The Record reported the same day that Washington, D.C.'s police department has used Flock camera data in misconduct investigations of its own officers, which drew a formal complaint from the officers' union.
read more
Flock Safety sells automated license plate readers to police departments across the United States, and the stolen files show exactly how one device recognizes and logs cars and the people near them. Agencies running Flock hardware should expect these capture rates, retention records, and internal uses to drive local policy fights and open records demands.
Sources: 404 Media · Wired Security · The Record · ↑ top
10. KREMLIN Toolkit Force-Installs Browser Extensions
Latest developments: BleepingComputer detailed KREMLIN on September 16, 2026, a toolkit a banking malware operation has run since mid-2025 that walks past browser installation checks to force malicious Chrome and Edge extensions onto infected machines, where the extensions steal credentials, session tokens, and other sensitive data; Palo Alto Networks' Unit 42 published fresh Atomic macOS Stealer activity in which deceptive setup guides talk Mac users into surrendering credentials; and Bruce Schneier flagged a fake CAPTCHA variant that persuades people to download and run the malicious program themselves.
read more
Stolen session tokens survive a password reset and skip the multi-factor prompt, which is why extension-based theft pays. Block unmanaged extension installation through browser policy, revoke sessions after any infostealer detection, and tell staff that a CAPTCHA asking them to paste a command into a terminal is an attack.
Sources: BleepingComputer · Unit 42 (Palo Alto) · Schneier on Security · ↑ top
Business and Politics
Congress Passes the Russia Sanctions Bill
Latest developments: The House passed a sweeping Russia sanctions package Wednesday, September 16, and sent it to President Trump, who is expected to sign it.
read more
The bill hands Trump new authority to level tariffs on the largest importers of Russian oil and gas, a group that includes American allies, and it targets Russian officials along with the pillars of Moscow's economy. Lawmakers named the measure for the late Senator Lindsey Graham, and it lands on an energy market already short the barrels that normally move through the Strait of Hormuz.
Sources: FT World · WSJ Politics · ↑ top
The Fed Decides on Rates
Latest developments: The Federal Reserve raised the federal funds rate Wednesday afternoon, September 16, its first increase since 2023 and a unanimous vote, Chair Kevin Warsh said inflation remains "too high," and President Trump answered by calling for borrowing costs of 1% or less.
read more
The increase answers August consumer prices running 3.4% and the oil shock from the Gulf war, and new projections show most policymakers expecting one more tightening this year. The Dow industrials fell 500 points and all three major U.S. indexes closed lower for the seventh time in eight sessions, the dollar strengthened, and gold gave back its gains.
Sources: FT Home · WSJ Markets · WSJ Markets · WSJ Markets · FT Home · WSJ Markets · ↑ top
Saudi Arabia Appears to Fire a Chinese Ballistic Missile
Latest developments: The Wall Street Journal reported Wednesday, September 16, that the body of what appeared to be a Dongfeng 15 turned up in the Yemeni desert, the first sign that Saudi Arabia has fired a Chinese ballistic missile, and the Houthis claimed the same day that they shot down a Saudi F-15.
read more
The kingdom has absorbed months of Houthi drone and missile attacks on its oil facilities and its Red Sea coast, and the militants now hold the Bab al-Mandeb chokepoint. Saudi Arabia reaching into a Chinese missile arsenal widens a war that has shut the Strait of Hormuz to tanker traffic, closed the East-West pipeline, and left Brent near four-month highs.
Sources: WSJ World News · WSJ World News · ↑ top
Chinese Oil Prices Hit Records
Latest developments: The Financial Times reported Wednesday, September 16, that domestic Chinese oil prices reached record highs after the drone attacks on Saudi Arabia's East-West pipeline, and that Beijing has drained enough of its stockpile that it must come back to the world market.
read more
China held global crude prices down through the first months of the Iran war by drawing on inventories instead of buying, a cushion analysts told the Financial Times is ending as the country comes off its crash diet. Fresh Chinese buying would land on a market already short the barrels that normally move through the Strait of Hormuz, with Brent near four-month highs and the Hormuz squeeze now pushing Asian buyers to look past long-term liquefied natural gas contracts.
Sources: FT Home · FT Markets · WSJ World News · ↑ top
The AI Slowdown Fight Moves Inside OpenAI and Anthropic
Latest developments: OpenAI disclosed a wider set of safety incidents Wednesday, September 16, and adopted new rules for reporting them, saying it hopes competitors follow, a day after the Financial Times reported that staff at OpenAI and Anthropic are struggling over how to turn their chief executives' slowdown rhetoric into practice and the Wall Street Journal reported that dozens of business leaders at a private event pressed President Trump to work with China on joint guardrails.
read more
Anthropic Chief Executive Dario Amodei's essay against a race to the bottom in model development knocked down memory-chip makers and Nvidia worldwide on Monday, September 14, and Trump called the warnings a hoax. DeepMind co-founder Shane Legg told the Financial Times that AI must not outrun safety controls as his company launched the DeepMind Institute to study artificial general intelligence, and the Journal's markets column argued the buildout slows on its own economics whatever happens on safety.
Sources: WSJ US Business · FT Home · FT Home · WSJ US Business · WSJ Markets · ↑ top
Von der Leyen Offers Canada Associate Membership
Latest developments: European Commission President Ursula von der Leyen proposed Wednesday, September 16, making Canada the first associate member of the European Union, saying the two "see the world with the same eyes."
read more
The offer endorses Canadian Prime Minister Mark Carney's drive to pivot his country toward Europe and away from the United States, and it would create a membership tier that has never existed in the bloc's history. Several EU governments have balked at Carney's parallel call for "middle powers" to line up together against Washington and Beijing, leaving the proposal short of unanimous backing.
Sources: WSJ World News · FT Home · FT World · ↑ top
Pittsburgh
Weather
Tonight: Chance Showers And Thunderstorms, low 70F.
Thursday: Showers And Thunderstorms, high 86F.
Thursday Night: Chance Showers And Thunderstorms, low 67F.
Business
Harrisburg Weighs a Digital Advertising Tax
Latest developments: TribLive reported Wednesday, September 16, that Pennsylvania lawmakers are weighing a tax on digital advertising sold by the world's largest technology companies.
read more
The proposal would pull revenue from Google, Meta, and Amazon into the state treasury, and it faces two lines of attack: smaller Pennsylvania businesses that buy and resell digital ads argue the cost lands on them, and versions of the tax in other states have drawn legal challenges.
Duquesne Light and the Energy Department Take On the Grid
Latest developments: Duquesne Light and the U.S. Department of Energy announced technology Wednesday, September 16, to strengthen the electrical grid, a step both sides cast as changing how Western Pennsylvania handles its power demand.
read more
Duquesne Light distributes electricity across Allegheny and Beaver counties from its downtown Pittsburgh headquarters, and it faces a load forecast that the region's data center buildout keeps pushing higher. The announcement arrives days after its union crews voted to authorize a strike.
Safety Board Faults Shell for the Cracker Plant Fire
Latest developments: The U.S. Chemical Safety and Hazard Investigation Board blamed ineffective safety controls and an inexperienced engineer for the June 2025 explosion and fire at Shell's ethane cracker in Beaver County, in a report KDKA covered Wednesday, September 16.
read more
The blast did $95 million in damage at the plant, the multibillion-dollar complex Shell built to turn Marcellus ethane into plastic pellets and the largest industrial investment in the region in a generation.
Duquesne Light Workers Authorize a Strike
Latest developments: WPXI reported Wednesday, September 16, that unionized Duquesne Light Company workers have voted to authorize a strike.
read more
Duquesne Light distributes electricity across Allegheny and Beaver counties from its downtown Pittsburgh headquarters, and its union crews handle the line work, service calls, and outage restoration that keep the region's grid running.
Riley's Pour House Rebuilds in Carnegie
Latest developments: Pittsburgh Magazine reported Wednesday, September 16, that Riley's Pour House will hold a groundbreaking celebration Friday, September 18, at its original site, 215 E. Main Street in Carnegie, with construction starting next week and a grand opening slated for March 2027.
read more
Fire destroyed the Irish pub at that address in November 2024, and the owners are rebuilding on the same lot rather than moving, returning a long-running gathering spot to Carnegie's main commercial street in Allegheny County.
Sources: Pittsburgh Magazine · ↑ top
A 381-Ton Superload Crosses Three Counties
Latest developments: The 381-ton first haul moved Wednesday, September 16, and continues Thursday through Armstrong, Westmoreland, and Indiana counties, and KDKA reported that roughly 50 superloads will follow over the next four months.
read more
The loads run from the Armstrong Terminals in Gilpin to the data center project rising near Homer City in Indiana County, and each one travels at a crawl and closes lanes along the way.
A $13 Billion Power Plant Splits Fayette County
Latest developments: WTAE reported Wednesday, September 16, that a $13 billion energy proposal has divided Fayette County, with supporters counting the construction jobs and investment and opponents arguing the environmental cost runs too high.
read more
Fayette County, in the southwestern corner of Pennsylvania along the Monongahela, sits in the middle of the power buildout that the region's data center developers have set off, and a project of this size would rank among the largest private investments the county has ever seen.
Allegheny Smokeworks Closes in Blawnox
Latest developments: TribLive reported Wednesday, September 16, that Allegheny Smokeworks will close its Blawnox location because the landlord is putting the building on the market.
read more
Allegheny Smokeworks has operated for years in Blawnox, the small Allegheny River borough between Aspinwall and Harmarville, and the sale of its building ends the run there.
Upper Burrell Holds Off on Its Data Center Rules
Latest developments: The Upper Burrell Planning Commission voted Tuesday, September 15, to delay its recommendation on the township's latest draft data center ordinance so residents can take more concerns to the township supervisors.
read more
Upper Burrell, a Westmoreland County township near New Kensington, has been drafting zoning rules to govern data centers as developers scout Western Pennsylvania, the same pressure that pushed Allegheny County Council this week toward barring large data centers from county land.
Around Town
The Board of Health Cuts Its Parental Leave Plan
Latest developments: The Allegheny County Board of Health pared back its paid parental leave proposal Wednesday, September 16, shaving six weeks off the 18-week benefit and loosening its eligibility requirements after weeks of public feedback.
read more
The proposal drew about 1,400 public comments, a county record, with small business owners and worker advocates splitting over it at a County Council hearing on September 10. County Executive Sara Innamorato has made the benefit a plank of her reelection campaign.
Sources: Pittsburgh Post-Gazette · TribLive · ↑ top
County Schools Prepare for Measles
Latest developments: The Allegheny County Health Department's director met with school superintendents this week to plan a rapid response if measles reaches the county, and warned that exposures would force 21-day quarantines for unvaccinated students, PublicSource reported Wednesday, September 16.
read more
Pennsylvania leads the country in confirmed measles cases this year, with 676 counted on September 11 and four deaths, the most recent reported by the Mifflin County coroner. Allegheny County has stayed clear of the outbreak so far.
Sources: PublicSource · ↑ top
Pittsburgh Water Opens Debt Forgiveness
Latest developments: Pittsburgh Water launched a debt forgiveness program Wednesday, September 16, that clears a customer's past-due balance after two years of on-time payments.
read more
Pittsburgh Water, the public utility that supplies drinking water and sewer service to the city and several neighboring municipalities, has raised rates repeatedly to pay for lead line replacement and plant work, and the program aims at households whose arrears grew along with the bills.
State Grants Land in Pittsburgh, Millvale, and Heidelberg
Latest developments: Three Wednesday, September 16, reports tallied the latest round of state grants: $1.2 million to the city of Pittsburgh for a new fire truck and redevelopment of Hilltop properties, $450,000 to Millvale toward its Logan Street reconstruction, and money for three police vehicles in Heidelberg alongside Scott Township police and infrastructure projects in Carnegie and Bridgeville.
read more
Millvale's Logan Street rebuild carries a price tag above $1 million, so the borough covers the rest, and the Chartiers Valley awards spread across four small municipalities in Allegheny County that rely on Harrisburg for capital purchases their tax bases cannot absorb.
Sources: WPXI · TribLive · TribLive · ↑ top
The Latino Community Center Buys a Strip District Home
Latest developments: Pittsburgh Magazine reported Wednesday, September 16, that the Latino Community Center finalized plans this week to leave the office space it rents near Friendship for a building it purchased in the Strip District.
read more
The center runs programs for Pittsburgh's Latine families, and owning its headquarters ends its dependence on a lease. The move lands at the start of Hispanic Heritage Month, the same stretch in which the Pennsylvania Metropolitan Area Hispanic Chamber of Commerce opened new programs for Hispanic business owners.
Sources: Pittsburgh Magazine · ↑ top
Carey Scheide Miller Takes Over the Natural History Museum
Latest developments: Carnegie Museums announced Wednesday, September 16, that Carey Scheide Miller will serve as director and vice president of the Carnegie Museum of Natural History.
read more
Miller has worked as vice president and chief development officer for Carnegie Museums since 2023, and she now runs the Oakland institution that holds the dinosaur halls and one of the country's largest research collections.
Sources: Pittsburgh Magazine · ↑ top
Storms Return Wednesday Afternoon
Latest developments: WTAE flagged Wednesday, September 16, as an Impact Day for isolated storms, while KDKA meteorologist Ron Smiley's morning forecast kept most of the day dry, with highs in the mid-80s and spells of sun before higher rain chances arrive Thursday.
read more
The pattern follows a warm, humid stretch across the Pittsburgh region, and the heavier, more widespread rain holds off until Thursday, September 17.
North Park Breaks Ground on Its Observation Tower
Latest developments: TribLive reported Wednesday, September 16, that North Park held a groundbreaking for its Observation Tower, with paint brushes standing in for shovels at the ceremony.
read more
North Park, the Allegheny County park spread across the county's northern townships, counts the tower among the spots visitors return to for the view, and the project starts construction on it.
Etna Opens a Library
Latest developments: TribLive reported Wednesday, September 16, that Etna is preparing to open its own library, a project longtime Mayor Tom Rengers began pushing after a visit to the Millvale Community Library.
read more
Etna, the Allegheny River borough next to Millvale and Sharpsburg, has gone without a library of its own, and Rengers took the neighboring Millvale operation as the model for what the borough should build.
Pittsburgh Public Bets on STEAM After the Closures
Latest developments: TribLive reported Wednesday, September 16, that Pittsburgh Public Schools sees a wider future for its STEAM programming even after the district's school closures, with parents at Woolslair elementary, among them Jazlynn Worthy, crediting the program for what it has done for their children.
read more
Woolslair, in Bloomfield, has built its identity around science, technology, engineering, arts, and mathematics instruction, and the district is deciding how that work carries over as it consolidates buildings.
Nearly 4,000 County Students Without Homes
Latest developments: PublicSource reported Wednesday, September 16, that nearly 4,000 Allegheny County students experience homelessness, and that a new book, "Echoes of Brilliance," collects their accounts in their own words.
read more
One contributor, a local college student the book calls Jordan, describes nights when he did not know where he would sleep or how he would reach school. The county's school districts carry the caseload under the federal McKinney-Vento law, which entitles those students to transportation and enrollment protections.
Sources: PublicSource · ↑ top
Events
Backyard Basketball Classic Comes December 9
Latest developments: WTAE reported Wednesday, September 16, that Pitt, West Virginia, Duquesne, and Robert Morris will meet in a Backyard Basketball Classic doubleheader Wednesday, December 9, at PPG Paints Arena in Pittsburgh's Uptown.
read more
The four programs sit within an hour or so of one another and have played one another off and on for a century, and the doubleheader puts all four rivalries in one building on one night.
Panda Fest and the Jazz Festival Fill the Weekend
Latest developments: NEXTpittsburgh published its weekend guide Wednesday, September 16, listing more than 15 things to do from Thursday, September 17, through Sunday, September 20, led by Panda Fest and the Pittsburgh International Jazz Festival.
read more
The jazz festival runs its 16th year Thursday, September 17, through Sunday, September 20, in downtown Pittsburgh, with free concerts also playing at Pittsburgh International Airport. NEXTpittsburgh pairs the weekend list with its live music guide for fall festivals and concerts and its NEXT in the Gallery roundup of September art shows.
Sources: NEXTpittsburgh Events · ↑ top
'Disney's The Lion King' Runs Through September 27
Latest developments: KDKA's Pittsburgh Today Live went behind the show Wednesday, September 16, with the production's puppet supervisor explaining how the masks and puppets bring the characters to life.
read more
The Pittsburgh Cultural Trust and the PNC Broadway in Pittsburgh Series present "Disney's The Lion King" at the Benedum Center in downtown Pittsburgh through Sunday, September 27, the show that opened the Trust's 2026-27 Broadway season.
Evans City Pumpkinfest, September 19 and 20
Latest developments: KDKA previewed Evans City Pumpkinfest on Wednesday, September 16, with Chris Jamison, the Pittsburgh singer who reached the finals of "The Voice," among the performers.
read more
Pumpkinfest fills E. Main Street in Evans City, Butler County, on Saturday, September 19, and Sunday, September 20, with food, family activities, and live music.
The Great Race Comes September 26 and 27
Latest developments: KDKA walked through the first steps toward the City of Pittsburgh Great Race on Wednesday, September 16, ten days out from the event.
read more
One Great Weekend runs Saturday, September 26, and Sunday, September 27: the Dollar Bank Junior Great Race on Saturday, then the 5K, the 10K, and the One GREAT Challenge on Sunday.
Luke Bryan's Farm Tour at 1846 Farms
Latest developments: KDKA published its guide to the show Tuesday night, September 15, placing Luke Bryan's Farm Tour stop at 1846 Farms in Unity Township, near Latrobe in Westmoreland County, on Thursday, September 17.
read more
Bryan has run the Farm Tour for years, playing open fields at working farms, and thousands of fans are expected to fill the Unity Township site Thursday.
Sports
Pirates (75-76)
Tue Sep 15 · Brewers 5 · Pirates 1 · Final
Up Next · Brewers @ Pirates · Thu Sep 17, 12:35 PM
Steelers (1-0, T-1st in AFC North)
Up Next · Steelers @ Patriots · Sun Sep 20, 1:00 PM
Around the Teams
Porter Practices Limited Again
Latest developments: Cornerback Joey Porter Jr. took a limited practice again Wednesday, September 16, as the Steelers opened their preparation for the New England Patriots, the Post-Gazette reported.
read more
Porter sat out the Week 1 win over the Atlanta Falcons with his contract unresolved, and sources told the Post-Gazette then that he was healthy enough to play. Head coach McCarthy, who met the media Wednesday before practice, has declined to set any timeline for his return; the Steelers play at New England on Sunday, September 20, at 1 p.m. ET on CBS.
Sources: Post-Gazette Steelers · Pittsburgh Steelers (YouTube) · ↑ top
Freiermuth Reemerges in the Offense
Latest developments: The Post-Gazette wrote Wednesday, September 16, that tight end Pat Freiermuth is working his way back into a central role in Mike McCarthy's offense, and called that a good thing for the Steelers.
read more
On SNR Drive the same day, Matt Williamson and Wes Uhler went through the offensive and defensive personnel groupings with The Athletic's Mike DeFabo, who has watched practice this week. Quarterback Aaron Rodgers met the media after Wednesday's session, looking for more from an offense that left plays on the field in the opener.
Sources: Post-Gazette Steelers · Pittsburgh Steelers (YouTube) · Pittsburgh Steelers (YouTube) · ↑ top
Horwitz Hunts for His Swing
Latest developments: The Post-Gazette reported Wednesday, September 16, that Pirates first baseman Spencer Horwitz has tried everything to break a season-long slump, searching, in his words, for "the kind of hitter I can be."
read more
The Pirates acquired Horwitz to hit in the middle of the order, and the club is playing out the final weeks of a season its playoff hopes have left.
Sources: Post-Gazette Pirates · ↑ top
Benton Wears a Microphone at Practice
Latest developments: The Steelers posted a full mic'd-up video of defensive tackle Keeanu Benton on Wednesday, September 16, recorded during practice at the team's facility.
read more
Benton works the interior of the line alongside Cam Heyward, and the video follows him through drills and position work as the Steelers prepare for the New England Patriots on Sunday, September 20, at 1 p.m. ET on CBS.
Sources: Pittsburgh Steelers (YouTube) · ↑ top
Watt Walks Through the Pick-Six
Latest developments: T.J. Watt joined Not Just Football on Wednesday morning, September 16, to break down his pick-six against the Atlanta Falcons, the snaps he took on both sides of the line, and life as a new father.
read more
Cam Heyward and co-host Hayward Heyward run the show; after the Watt interview they went through the Steelers' Week 1 win and the zone-heavy plan the defense used, then looked ahead to the trip to the New England Patriots on Sunday, September 20, at 1 p.m. ET on CBS.
Sources: Not Just Football with Cam Heyward · ↑ top
Dulac Takes Week 2 Questions
Latest developments: Post-Gazette beat writer Gerry Dulac held his Steelers chat Wednesday, September 16, taking reader questions on the club as it prepares for New England.
read more
Dulac has covered the Steelers for the Post-Gazette for decades and runs the weekly chat through the season. The Steelers play at the New England Patriots on Sunday, September 20, at 1 p.m. ET on CBS.
Sources: Post-Gazette Steelers · ↑ top
The Film Says McCarthy's Offense Looked New
Latest developments: The Post-Gazette's film study, published Wednesday, September 16, found head coach Mike McCarthy's offense genuinely different in design from what the Steelers ran in recent seasons, with the results still lagging the scheme.
read more
McCarthy took over as head coach this year and built the offense around quarterback Aaron Rodgers and receiver DK Metcalf, who drew a poor grade from the paper for the Week 1 win over the Atlanta Falcons. The Steelers play at the New England Patriots on Sunday, September 20, at 1 p.m. ET on CBS.
Sources: Post-Gazette Steelers · ↑ top
Team USA
Cavan Sullivan Earns a First U.S. Call-Up
Latest developments: Sources told ESPN that Philadelphia Union attacker Cavan Sullivan, 16, will receive his first United States senior call-up for the September and October FIFA international window.
read more
Sullivan scored twice and set up another goal in the Union's 5-0 win over San Diego on Sunday, September 13, his first two-goal game in Major League Soccer. He enters a men's pool that turned over after the United States exited the 2026 World Cup, with Real Salt Lake midfielder Diego Luna out for months with a knee injury.
Sources: ESPN Soccer · ↑ top
Pulisic Comes Off the Bench in a Milan Loss
Latest developments: Christian Pulisic entered as a substitute Wednesday, September 16, as AC Milan opened its Europa League campaign with a 2-0 home loss to Benfica.
read more
Pulisic, the United States captain, has worked back into Ruben Amorim's rotation after missing the start of the Italian season, assisting in a 2-2 draw at Lazio on September 12 in his first appearance since the American exit from the 2026 World Cup.
Sources: ESPN Soccer · ↑ top
Brazil Ends the U.S. Under-20 World Cup Run
Latest developments: Brazil eliminated the United States from the Under-20 Women's World Cup on Wednesday, September 16, winning 5-4 on penalties in the round of 16 after a 1-1 draw through 120 minutes.
read more
The exit comes days after Alex Morgan, Crystal Dunn, and Brazil's Marta signed an open letter asking FIFA to align the Under-20 Women's World Cup with the international match calendar, a fight over how national federations release young players for the tournament.
Sources: ESPN Soccer · ↑ top
Cole Campbell Commits to the United States
Latest developments: Cole Campbell told ESPN on Wednesday, September 16, that he has committed his international future to the United States as he pushes for a first senior call-up.
read more
Campbell has been the breakout American of the German season at Elversberg, and his decision adds a forward option to a men's pool that turned over after the United States exited the 2026 World Cup, with Diego Luna out for months with a knee injury.
Sources: ESPN Soccer · ↑ top
Softball's Schiller Draws a Three-Year Ban
Latest developments: ESPN reported Wednesday, September 16, that American softball player Cam Schiller has accepted a three-year ban for doping with a steroid.
read more
The suspension sidelines Schiller through the run-up to softball's return to the Olympic program at the 2028 Los Angeles Games, where the United States will defend a sport it has dominated for decades.
Sources: ESPN Olympics · ↑ top
Record Ratings for the Women's World Cup Final
Latest developments: TNT said Tuesday, September 15, that an average of 1.2 million people watched the United States beat France in the FIBA Women's World Cup gold medal game, a record audience for the event on the network.
read more
The United States won 97-79 in Germany on Sunday, September 13, for its fifth straight World Cup title, with Breanna Stewart scoring 22 points and Jackie Young 18 under coach Kara Lawson.
Sources: ESPN Olympics · ↑ top
DeMelo Sues Over Her Cardiac Arrest
Latest developments: Racing Louisville FC midfielder Savannah DeMelo sued University of Louisville Health and two physicians, ESPN reported Tuesday, September 15, claiming they failed to diagnose the heart condition that led to her cardiac arrest on the field.
read more
DeMelo, a United States international who played in the 2023 Women's World Cup, collapsed during an NWSL match in September 2025. The suit puts a club's medical screening under legal scrutiny at a moment when the league is expanding its player health protocols.
Sources: ESPN Soccer · ↑ top
Reading
- Stratechery — Salesforce AI Force, Agents as UI, The Race to Headless. Ben Thompson reads Salesforce's AI Force launch as the company giving up on its user interface as a competitive moat, and argues that is the right call because AI agents are dissolving the interface layer across enterprise software.
- Ed Zitron — AI Is Already In Dangerous Hands. Zitron argues that the speculative debate over future superintelligence distracts from the concentrated power the current crop of AI companies already holds, and that the people running them have shown what they will do with it.
- Cal Newport — Superintelligence is a Fairy Tale. But Chasing It Can Still Cause Harm.. Newport, responding to Anthropic employees who said publicly that the systems they build could kill billions, treats superintelligence as a myth while warning that the race toward it inflicts real damage along the way.
Markets
S&P 500 7,601.24 ▼ -1.1% Dow 52,122.72 ▼ -1.8% Nasdaq 26,112.23 ▼ -1.1% WTI crude 101.16 ▲ +10.7% EUR/USD 1.1585 ▼ -0.3% GBP/USD 1.3512 ▼ -0.1% USD/JPY 154.23 ▼ -0.9%
Feed Health
Security: 24 of 24 feeds loaded, 65 items in the 24-hour window. No recent items: Google Online Security Blog, Graham Cluley, Microsoft Security Blog, Google Project Zero, The DFIR Report, Kim Zetter (Zero Day), Frank on Fraud.
Pittsburgh: 9 of 9 feeds loaded, 60 items in the 48-hour window.
Business and Politics: 8 of 8 feeds loaded, 60 items in the 36-hour window.
Events: 4 of 4 feeds loaded, 14 items in the 120-hour window.
Sports media: 6 of 6 feeds loaded, 30 items in the 96-hour window.
Team USA: 3 of 3 feeds loaded, 28 items in the 72-hour window. No recent items: Guardian Olympics.
Reading: 3 of 3 feeds loaded, 12 items in the 336-hour window.
Markets (Yahoo Finance): 7 of 7 rows
Weather (NWS): 3 forecast periods
Scores (ESPN, plaintextsports): 2 teams via plaintextsports; mlb: ESPN failed (mlb: HTTP 403 (server: AkamaiGHost)); used plaintextsports; mlb: 1 plaintextsports rows not understood; nfl: ESPN failed (nfl: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nfl: plaintextsports page last published Sep 15; nhl: ESPN failed (nhl: HTTP 403 (server: AkamaiGHost)); used plaintextsports
Summaries: 3 model call(s) served by claude-opus-5 (568s of model time; $2.68 at API list price).