================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Friday, September 18, 2026 - 10:05 AM EDT ================================================================ Hacktron researchers pointed Claude at OpenAI's sign-in flow and reached internal code, on the same day one plugin flaw surfaced in all four major AI coding agents. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets | Feed Health EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] A zero-click Plugin4Shell flaw hits Claude Code, Codex, Copilot and Gemini CLI, while Hacktron chained Claude-built exploits into OpenAI employee accounts, making AI agent plumbing a soft spot. see: Plugin4Shell Opens Four AI Coding Agents; Hacktron Uses Claude to Reach OpenAI Employee Accounts * [TREND] Malware authors are handing the keyboard to models, from LLM-written npm stealers like WeaselBiscuit to RatHat, whose AI subsystem navigates stolen Android phones for China-based operators. see: LLM-Written Stealers Ride npm Packages; RatHat Android Trojan Drives Phones With AI * [TREND] A single stolen Cloudflare key let Brevo intruders inject ClickFix scripts into 100,000 websites, while attackers hit CVE-2026-58138 in Orkes Conductor and Docker sandboxes leaked macOS hosts. see: Brevo Attack Reaches 100,000 Websites; Attackers Exploit Orkes Conductor as Docker Sandboxes Leak macOS Hosts * [UPDATE (new)] Check Point patched an unauthenticated root flaw in its management servers, abandoned IoT apps were found carrying vulnerable dependencies, and SynthID watermarking was shown to weaken model refusals. see: Check Point Management Servers Yield Root; Abandoned Apps and a Resurrected CDN Domain; SynthID Watermarking Erodes Model Refusals * [UPDATE (new)] A second slow-moving superload crosses Armstrong, Indiana and Westmoreland counties next week, and county requirements pushed up the cost of North Allegheny's natatorium renovation. see: A Second Superload Rolls Next Week; County Rules Raise North Allegheny's Pool Costs SECURITY ---------------------------------------------------------------- 1. PLUGIN4SHELL OPENS FOUR AI CODING AGENTS AI Security · [ai, supply-chain, zero-day] Latest developments: Air Security disclosed on September 18, 2026 that Claude Code, Codex, GitHub Copilot, and Gemini CLI share one zero-click remote code execution flaw it calls Plugin4Shell, the first supply-chain vulnerability of the AI agent ecosystem: whoever controls a plugin's source repository swaps the code an agent installs even when the agent pins that plugin to a specific reviewed version. Anthropic fixed it in Claude Code 2.1.179 and OpenAI in Codex 0.146.0, and GitHub Copilot and Gemini CLI still carry it. Anyone whose coding agent installs plugins from a marketplace is exposed, and a successful attacker gains the same access to company systems and data as the employee running the agent. Palo Alto Networks' Unit 42 separately showed that default settings in Amazon's AgentCore Harness let prompt injection pull credentials out, and Hush Security found hardcoded API keys and access tokens in 12 percent of credential slots across roughly 82,000 public MCP configuration files on GitHub. - Help Net Security: https://www.helpnetsecurity.com/2026/09/18/plugin4shell-ai-coding-agents-vulnerability/ - The Hacker News: https://thehackernews.com/2026/09/plugin4shell-lets-repository-owners.html - Unit 42 (Palo Alto): https://unit42.paloaltonetworks.com/securing-aws-agentcore-harness-credentials/ - Help Net Security: https://www.helpnetsecurity.com/2026/09/18/hush-security-mcp-credential-exposure-report/ 2. CHECK POINT MANAGEMENT SERVERS YIELD ROOT Vulnerabilities and Exploits · [patch, rce] Latest developments: Check Point Software shipped a fix through its LivePatch channel for a critical flaw that lets an attacker with no credentials run code as root over the network on Security Management and Log Servers, and says it sees no sign of exploitation; Kaspersky and Tanium patched product flaws the same day, and Microsoft closed 18 vulnerabilities across Azure and its AI-branded products, among them CVE-2026-85889, a 10.0-rated missing authentication for a critical function in Azure AI Foundry that hands an unauthorized attacker elevated privileges over a network and that Microsoft fixed with no customer action required. The Security Management Server controls firewall policy and administrator access, so root on that box hands an intruder the rules governing every gateway it manages. Check Point customers should take the LivePatch update immediately. - BleepingComputer: https://www.bleepingcomputer.com/news/security/check-point-warns-critical-flaw-lets-hackers-execute-code-as-root/ - The Hacker News: https://thehackernews.com/2026/09/critical-check-point-management-server.html - SecurityWeek: https://www.securityweek.com/check-point-kaspersky-tanium-patch-product-vulnerabilities/ - The Hacker News: https://thehackernews.com/2026/09/microsoft-patches-cvss-100-azure-ai.html 3. HACKTRON USES CLAUDE TO REACH OPENAI EMPLOYEE ACCOUNTS AI Security · [ai, exploit, vulnerability] Latest developments: Researchers at Hacktron used Claude to build a working exploit, chained it with a flaw in OpenAI's sign-in flow, and reached OpenAI employee accounts and sensitive internal GitHub data, and OpenAI paid them a bug bounty for the demonstration. The work shows a frontier model carrying the offensive engineering, from finding the weakness to writing the exploit, against the company that builds a competing frontier model. Every organization that relies on a single sign-on path into its source code should assume attackers now run the same loop. - Ars Technica Security: https://arstechnica.com/ai/2026/09/researchers-used-claude-to-hack-openai/ - SecurityWeek: https://www.securityweek.com/ai-built-exploit-and-sign-in-flaw-opened-path-to-internal-openai-code/ 4. BREVO ATTACK REACHES 100,000 WEBSITES Software Supply Chain Security · [supply-chain, malware, breach] Latest developments: SecurityWeek put the count at 100,000 websites on September 18, 2026, and detailed the method: the attackers used the stolen Cloudflare API key to deploy a Cloudflare worker that injected the malicious scripts, a day after Brevo confirmed the theft. Brevo, the French email marketing platform, lost a Cloudflare API key that attackers turned into ClickFix scripts running on its own sites and inside the JavaScript files its customers embed on theirs, making every one of those sites a malware distribution point. Site owners who load Brevo JavaScript should audit their pages and rotate anything the injected scripts could have touched. - SecurityWeek: https://www.securityweek.com/brevo-supply-chain-attack-injects-malware-into-100000-websites/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/brevo-supply-chain-attack-injected-clickfix-scripts-on-customer-sites/ 5. ATTACKERS EXPLOIT ORKES CONDUCTOR AS DOCKER SANDBOXES LEAK MACOS HOSTS Vulnerabilities and Exploits · [exploit, patch, rce] Latest developments: SecurityWeek reported on September 18, 2026 that attackers exploit CVE-2026-58138 in Orkes Conductor, an unauthenticated remote code execution flaw they reach through inline workflow definitions, and Docker warned in a September 15 announcement that CVE-2026-77179, rated critical, lets malicious code inside a Docker Sandboxes virtual machine on macOS escape the shared project directory and read or change any file on the host. Orkes Conductor orchestrates microservice workflows, and the flaw gives an unauthenticated caller code execution on the orchestrator. The Docker escape runs with the rights of the host account that started the virtual machine, collapsing the isolation developers rely on when they run untrusted code. - SecurityWeek: https://www.securityweek.com/critical-orkes-conductor-vulnerability-exploited-in-attacks/ - The Hacker News: https://thehackernews.com/2026/09/critical-docker-sandboxes-flaw-lets.html 6. LLM-WRITTEN STEALERS RIDE NPM PACKAGES Software Supply Chain Security · [supply-chain, malware, apt] Latest developments: Researchers at OpenSourceMalware identified 13 npm packages delivering WeaselBiscuit, a previously undocumented JavaScript stealer that harvests Chrome extension storage and overlaps functionally with BeaverTail and a second strain from North Korea's Contagious Interview campaign; separately, analysts tied a financially motivated actor claiming to be a bug bounty hunter to the PhantomRaven stealer on npm and judged with high confidence that a large language model wrote it, citing verbose comments, placeholder code, and token-analysis patterns. Both families reach developers through the npm registry and take browser-held credentials and wallet data off the machines that build software. Development teams should pin dependencies, audit recently added packages, and treat Chrome extension storage as credential material. - The Hacker News: https://thehackernews.com/2026/09/weaselbiscuit-stealer-spreads-via-13.html - The Hacker News: https://thehackernews.com/2026/09/claimed-bug-bounty-hunter-likely-used.html 7. RATHAT ANDROID TROJAN DRIVES PHONES WITH AI Ransomware and Cybercrime · [malware, mobile, ai] Latest developments: Researchers flagged RatHat on September 17, 2026, Android malware that China-based operators spread through targeted smishing and malvertising to deceptive third-party download portals, which carries an AI-powered subsystem that navigates and controls a compromised handset and abuses the Android Debug Bridge to keep shell access after the victim uninstalls the app. The AI layer lets one operator work many phones at once without hand-driving each screen, and the ADB persistence survives the obvious remedy. Android users should install only from Google Play and check developer options for enabled debugging. - The Hacker News: https://thehackernews.com/2026/09/rathat-android-malware-abuses-adb-to.html - BleepingComputer: https://www.bleepingcomputer.com/news/security/new-rathat-android-malware-uses-ai-to-automate-device-control/ 8. ABANDONED APPS AND A RESURRECTED CDN DOMAIN Software Supply Chain Security · [supply-chain, iot, vulnerability] Latest developments: Researchers at the University of Massachusetts Amherst analyzed 61,500 abandoned Android smart home and internet-of-things companion apps drawn from the AndroZoo archive and found nearly three in four carrying software dependencies with documented vulnerabilities, while The Hacker News traced a domain that once served a wound-down content delivery network: the owner let it expire, someone re-registered it in July 2025, and thousands of websites, code repositories, and documentation pages still hard-code hostnames beneath it. Millions of people still run companion apps for smart plugs, cameras, and thermostats that stopped receiving updates years ago, and those apps keep sending data to servers nobody maintains. Whoever controls a re-registered CDN domain can answer every one of those stale requests with code of their own choosing, so teams should grep their repositories and pages for third-party hostnames and verify who owns each one today. - Help Net Security: https://www.helpnetsecurity.com/2026/09/18/abandoned-iot-apps-data-security-risks/ - The Hacker News: https://thehackernews.com/2026/09/an-abandoned-cdn-domain-was-re.html 9. SYNTHID WATERMARKING ERODES MODEL REFUSALS AI Security · [ai, research] Latest developments: Researchers found that turning on SynthID text watermarking changes how large language models answer harmful prompts, and the watermarking can push a model to follow instructions it would otherwise refuse. Watermarking exists to mark machine-generated text for provenance, and this work shows the same mechanism shifting the token choices that safety training depends on. Anyone deploying watermarked models should re-run refusal testing with the watermark enabled. - Ars Technica Security: https://arstechnica.com/security/2026/09/ai-text-watermarking-can-make-models-more-vulnerable-to-adversarial-prompts/ - Schneier on Security: https://www.schneier.com/blog/archives/2026/09/are-ais-still-struggling-with-captchas.html 10. CISA RETIRES ITS WEEKLY VULNERABILITY BULLETIN Policy and Regulation · [policy, patch] Latest developments: The Cybersecurity and Infrastructure Security Agency ended its weekly vulnerability summary, the long-running roundup of newly published flaws, following Binding Operational Directive 26-04, which orders federal agencies to rank vulnerabilities by real-world risk instead of working down a list by severity score. Federal agencies and the many private teams that read the bulletin lose a standing catalog of new CVEs and gain a mandate to prioritize what attackers actually exploit. Security teams that built processes around the weekly summary should shift to the Known Exploited Vulnerabilities catalog and exploitation telemetry. - SecurityWeek: https://www.securityweek.com/cisa-retires-weekly-vulnerability-bulletin-in-risk-based-pivot/ - Dark Reading: https://www.darkreading.com/cyber-risk/cisa-ditches-weekly-vuln-roundups-risk-based-focus BUSINESS AND POLITICS ---------------------------------------------------------------- * Turkey Moves to Liquidate Funds in a Ponzi Inquiry Latest developments: The Financial Times reported Friday, September 18, that Turkish authorities have moved to liquidate the investment funds at the center of what regulators describe as a Ponzi-like scheme, forcing big Turkish banks to sell the assets held inside them. Roughly 300,000 investors hold positions in the funds, and the unwinding comes amid fears that the assets carried inflated valuations. A Financial Times column the same day told U.S. Treasury Secretary Scott Bessent to watch the affair, arguing that stretched markets break without any fraud at all. - FT Home: https://www.ft.com/content/3943277e-eaf8-4faf-9f9c-1c05cb2ba992?syn-25a6b1a6=1 - FT World: https://www.ft.com/content/d6adb7bb-72b4-47d1-b3bd-11e908d06b60?syn-25a6b1a6=1 * The Bank of Japan Lifts Rates to 1.25% Latest developments: The Bank of Japan raised its policy rate to 1.25% Friday, September 18, the highest since 1995, and said it will hold to a quarterly pace of tightening. The yen fell 1.2% to a two-week low of 158.05 per dollar after two board members signaled that future increases may come more slowly than markets had priced. Higher yields at home give Tokyo investors, long among the largest buyers of U.S. Treasurys, a reason to keep money in Japan. - FT Home: https://www.ft.com/content/97a0bed5-0580-4ccc-bd3c-fe9a714259e2?syn-25a6b1a6=1 - WSJ World News: https://www.wsj.com/economy/central-banking/bank-of-japan-raises-benchmark-interest-rate-to-1-25-highest-level-since-1995-2b28cbe9?mod=rss_worldnews - FT World: https://www.ft.com/content/14f9df6a-5a70-42d9-86ee-37e6242aae6e * Buffett Hands the Berkshire Chair to His Son Latest developments: Berkshire Hathaway said Friday morning, September 18, that Warren Buffett will step down as chairman and that his son Howard Buffett will succeed him. Warren Buffett led the $1 trillion conglomerate for more than six decades and takes the title of chair emeritus. Howard Buffett, long designated to protect the culture of the company, inherits the chairmanship of an insurer, railroad, and utility owner whose paper holdings move markets. - WSJ US Business: https://www.wsj.com/business/warren-buffett-to-step-down-as-berkshire-hathaway-chairman-de0e003f?mod=pls_whats_news_us_business_f - FT Home: https://www.ft.com/content/e26d8335-426a-4405-ae4c-433bd2696994 * Russia Seizes Nestlé's Local Operations Latest developments: A presidential decree reported Friday, September 18, put the Russian businesses of Nestlé and the French retailers Auchan and Leroy Merlin under temporary external administration. Moscow stripped operational control from three Western companies that kept trading in Russia after the 2022 invasion of Ukraine, and Nestlé is weighing its options for the unit. The seizures raise the cost of remaining for every multinational still holding Russian assets. - WSJ World News: https://www.wsj.com/articles/nestle-weighs-options-for-russia-unit-after-moscow-puts-it-under-administration-221402de?mod=rss_worldnews * Oil Slides Below $100 Latest developments: Crude fell for a third straight session Friday, September 18, with West Texas Intermediate dropping under $100 a barrel and Brent near $102. Traders are betting Saudi Arabia will restore export capacity after drone damage shut its East-West pipeline, which eased the supply fear that drove diesel to a record $6.27 a gallon this month. Gold climbed above $4,400 an ounce, Treasury yields eased, and U.S. stock futures rose as AI shares extended Thursday's rally. - WSJ World News: https://www.wsj.com/business/energy-oil/oil-prices-fall-for-third-day-as-wti-slips-below-100-e533d2fe?mod=rss_worldnews - WSJ Markets: https://www.wsj.com/finance/commodities-futures/oil-falls-as-worries-over-middle-east-supply-disruptions-ease-36be861a?mod=rss_markets_main - WSJ Markets: https://www.wsj.com/finance/stocks/stock-futures-rise-as-oil-extends-losses-treasury-yields-rise-0bda0bff?mod=rss_markets_main PITTSBURGH ---------------------------------------------------------------- Weather: Today: Mostly Cloudy, high 78F. Tonight: Partly Cloudy, low 58F. Saturday: Partly Sunny, high 78F. Business: * A Second Superload Rolls Next Week Latest developments: WPXI reported Friday, September 18, that a second slow-moving superload will cross Armstrong, Indiana, and Westmoreland counties next week, following the 380-ton first haul that crawled through Delmont on Wednesday, September 16. Escort vehicles, the Pennsylvania State Police, and bucket trucks that lift wires out of the way will run ahead of and behind the truck, which carries equipment to data center construction near Homer City in Indiana County. The Pennsylvania Department of Transportation warns drivers that the haul will occupy two lanes at times and move as a rolling slowdown, with roughly 50 more superloads scheduled over the next four months. - WPXI: https://www.wpxi.com/news/local/2nd-slow-moving-superload-move-through-western-pennsylvania-next-week/ZSZWS5I3CZGZ5CGLTSMMO6HQ5M/ * The Canada Trade War Reaches Pennsylvania's Shop Floors Latest developments: TribLive reported Friday, September 18, that the escalating tariff fight with Canada is hitting Pennsylvania's largest export market and the manufacturers that sell into it. Christian Klanica, who runs a machining company in Hempfield, Westmoreland County, said the levies flying between Washington and Ottawa change so often that he can no longer keep track of which ones apply to his work. Canada buys more Pennsylvania goods than any other country, which puts the state's machine shops and metal fabricators at the center of the dispute. - TribLive: https://triblive.com/local/regional/so-much-chaos-escalating-trade-war-with-canada-impacts-pa-s-largest-export-market/ * Butterwood Sells Dessert After Dark Latest developments: Pittsburgh City Paper's food column made the case Friday, September 18, for Butterwood as the city's answer to a late-night sweet tooth. Bakeries run on 4 a.m. shifts, and the column argues Butterwood inverts that schedule by keeping its counter going for customers who want cake at night. The piece lands as Pittsburgh's after-dark dining options draw fresh attention. - Pittsburgh City Paper: https://www.pghcitypaper.com/food-drink/satisfying-a-late-night-sweet-tooth-at-butterwood/ Around town: * County Rules Raise North Allegheny's Pool Costs Latest developments: TribLive reported Friday, September 18, that Allegheny County requirements have pushed up the cost of the North Allegheny School District's natatorium renovation, according to a presentation the district gave at its September 9 school board meeting. The district, which serves McCandless, Marshall, Bradford Woods, and Franklin Park, is weighing alternative versions of the project as the price climbs. The board must decide how much of the swimming facility work to keep before it commits the money. - TribLive: https://triblive.com/local/north-allegheny-renovation-update-includes-cost-increases-project-alternatives/ * A Dry Saturday, a Wet Sunday Latest developments: WTAE called Sunday, September 20, an Impact Day in its Friday morning outlook, September 18, with rain arriving Saturday night after a dry start to the weekend. The Post-Gazette reported the same morning that repeated heavy downpours have flooded Western Pennsylvania through a stretch of weeks that gives residents little time to clean up between storms. Elizabeth Township took 2 inches in under 90 minutes Thursday, and Oakmont is still working through damage from a storm three weeks ago. - WTAE: https://www.wtae.com/article/western-pa-this-weekend-dry-start-rainy-finish/73783487 - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/weather-news/2026/09/18/pittsburgh-severe-weather-flooding/stories/202609170086 - TribLive: https://triblive.com/local/valley-news-dispatch/storm-response-improving-oakmont-officials-say/ * Bracken House Tenants Hear About the Garage Latest developments: The Bracken House apartment complex on Pittsburgh's North Shore held a town hall Thursday night, September 17, to update residents on its collapsed parking garage. Tenants have gone without their parking structure since it gave way, and WTAE reported frustration among residents waiting for a timeline and a repair plan. The building sits within walking distance of Acrisure Stadium and PNC Park, where game-day parking already runs tight. - WTAE: https://www.wtae.com/article/frustrations-north-shore-apartment-parking-garage-collapsed-bracken-house/73782372 * Westmoreland Widens Its Lead Pipe Removal Latest developments: The Municipal Authority of Westmoreland County plans a substantial expansion of its lead service line replacement program, TribLive reported Friday, September 18. The authority supplies water across Westmoreland County and has been pulling lead pipes out of its distribution system under federal replacement requirements. The expansion widens the number of homes whose service lines the authority will dig up and replace. - TribLive: https://triblive.com/local/westmoreland/westmoreland-water-authority-seeks-to-expand-program-to-remove-lead-pipes/ Events: * The Jazz Festival Closes Out Downtown Latest developments: The Pittsburgh International Jazz Festival runs its final two days downtown through Sunday, September 20, and the Post-Gazette profiled 103-year-old retired judge Warren Watson, who has kept the city's jazz tradition going. The 16th edition of the festival fills downtown Pittsburgh from Thursday, September 17, through Sunday, September 20, with Grammy winners Samara Joy and Lalah Hathaway on the bill. NEXTpittsburgh's weekend guide pairs it with Panda Fest at Station Square among more than 15 things to do. - NEXTpittsburgh Events: https://nextpittsburgh.com/events/15-things-to-do-this-weekend-sept-17-20-2026/ - Post-Gazette Arts & Entertainment: https://www.post-gazette.com/ae/music/2026/09/16/judge-warren-watson-103-pittsburgh-jazz/stories/202609090062 * Soergel Orchards Opens Fall Fest Saturday Latest developments: Soergel Orchards opens its annual Fall Fest Saturday, September 19, the first day of a six-week run. Fall Fest runs through Sunday, November 1, at Soergel Orchards, beside the northbound Wexford exit of Interstate 79 in Franklin Park. Tractors carry visitors into the orchards to pick pumpkins and apples, and roasted corn and apple cider draw crowds to the barn area. - NEXTpittsburgh Events: https://nextpittsburgh.com/events/6-farms-to-visit-this-fall-from-soergels-to-triple-b/ SPORTS ---------------------------------------------------------------- Pirates (76-77) Thu Sep 17 · Brewers 4 · Pirates 7 · Final https://plaintextsports.com/mlb/2026-09-17/mil-pit Up Next · Royals @ Pirates · Fri Sep 18, 6:40 PM https://plaintextsports.com/mlb/2026/teams/pittsburgh-pirates Steelers (1-0, T-1st in AFC North) Up Next · Steelers @ Patriots · Sun Sep 20, 1:00 PM https://plaintextsports.com/nfl/2026/week2/pit-ne Around the Teams: * Heyward's Show Takes Up Rodgers Latest developments: Not Just Football with Cam Heyward posted a segment Friday morning, September 18, titled "Aaron Rodgers Reveals the Best Version of Himself," two days before the Steelers play at New England. Heyward, the Steelers defensive captain, hosts the show with Hayden and turned it this week to the quarterback who started the Week 1 win over the Atlanta Falcons. The same program had T.J. Watt on Wednesday to walk through his pick-six and the defense's zone-heavy plan against Atlanta. - Not Just Football with Cam Heyward: https://www.youtube.com/watch?v=R7t-Ng-2wmc - Not Just Football with Cam Heyward: https://www.youtube.com/watch?v=yX1h_us6qMo * Hiles Puts the Contract on Metcalf Latest developments: Post-Gazette columnist Noah Hiles wrote Friday, September 18, that DK Metcalf has to start playing like the receiver the Steelers pay him to be. Metcalf's first game in a Steelers uniform, the Week 1 win over the Atlanta Falcons, brought drops and penalties, and he told reporters Thursday he is not crying over spilled milk. Hiles argues the money the club committed to him leaves no room for another quiet afternoon as the Steelers travel to the New England Patriots. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/09/18/dk-metcalf-contract-steelers/stories/202609180014 - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/09/17/dk-metcalf-drops-penalties-falcons/stories/202609170040 * Heyward's Show Sets a Live Postgame Stream Latest developments: Not Just Football with Cam Heyward scheduled a live postgame show for the Steelers' trip to New England, posting the stream Thursday, September 17. Heyward and co-host Hayden will react on the show's YouTube channel after Sunday's 1 p.m. ET kickoff at the Patriots, which CBS carries. The program spent Wednesday with T.J. Watt breaking down his pick-six against Atlanta and previewing New England. - Not Just Football with Cam Heyward: https://www.youtube.com/watch?v=vTEUk6Qr_Jo Team USA: * Madrid and Barcelona Track Cavan Sullivan Latest developments: ESPN's Transfer Talk reported Friday, September 18, that Real Madrid and Barcelona are following Cavan Sullivan, the Philadelphia Union attacker already committed to a future move to Manchester City. Sullivan, 16, got his first senior United States call-up Thursday when manager Mauricio Pochettino named a 28-player roster for the coming FIFA international window. He scored twice for the Union in a 5-0 win over San Diego on September 13, his first two-goal game in Major League Soccer. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49970584/transfer-rumors-news-real-madrid-barcelona-track-man-city-bound-usmnt-star-sullivan - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49965164/usmnt-cavan-sullivan-christian-pulisic-mauricio-pochettino * The Squad Without Pulisic and Balogun Latest developments: ESPN examined Thursday evening, September 17, why Mauricio Pochettino left Christian Pulisic and Folarin Balogun out of his first United States squad since the World Cup. Pulisic, of AC Milan, and Balogun were the leading American attackers at this year's tournament, and both miss the 28-player roster for the September and October FIFA window. Their absence opens the front line to newcomers including 16-year-old Cavan Sullivan and New York Red Bulls forward Julian Hall. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49966291/the-usmnt-first-post-world-cup-squad-missing-biggest-summer-stars-christian-pulisic-folarin-balogun - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49967712/julian-hall-usa-poland-new-york-red-bulls READING ---------------------------------------------------------------- * Stratechery -- An Interview with Joanna Stern About the iPhone Duo and AI for Normal People Ben Thompson interviews Wall Street Journal personal technology columnist Joanna Stern about Apple's new iPhone Duo and how ordinary consumers, rather than industry insiders, actually encounter artificial intelligence in the products they buy. https://stratechery.com/2026/an-interview-with-joanna-stern-about-the-iphone-duo-and-ai-for-normal-people/ * Ed Zitron -- AI Is Already In Dangerous Hands Zitron argues the danger from artificial intelligence sits with the people and companies who control the technology today, which makes the industry's debate about future superintelligence a distraction from harm already underway. https://www.wheresyoured.at/ai-is-already-in-dangerous-hands/ * Cal Newport -- Superintelligence is a Fairy Tale. But Chasing It Can Still Cause Harm. Newport responds to Anthropic employees who said publicly that the systems they build could kill billions, calling superintelligence a fantasy while arguing that the race toward it inflicts real damage along the way. https://calnewport.com/superintelligence-is-a-fairy-tale-but-chasing-it-can-still-cause-harm/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,610.45 ▼ -0.8% Dow 52,065.51 ▼ -1.5% Nasdaq 26,179.55 ▼ -0.7% WTI crude 102.32 ▲ +7.9% EUR/USD 1.1552 ▼ -0.6% GBP/USD 1.3478 ▼ -0.4% USD/JPY 154.71 ▲ +0.1% FEED HEALTH ---------------------------------------------------------------- Security: 24 of 24 feeds loaded, 59 items in the 24-hour window. No recent items: Krebs on Security, CISA Advisories, Securelist (Kaspersky), Sophos News, Google Online Security Blog, Google Project Zero, The DFIR Report, Kim Zetter (Zero Day), Frank on Fraud. Pittsburgh: 9 of 9 feeds loaded, 60 items in the 48-hour window. Business and Politics: 8 of 8 feeds loaded, 60 items in the 36-hour window. Events: 4 of 4 feeds loaded, 13 items in the 120-hour window. Sports media: 6 of 6 feeds loaded, 30 items in the 96-hour window. Team USA: 3 of 3 feeds loaded, 26 items in the 72-hour window. No recent items: Guardian Olympics. Reading: 3 of 3 feeds loaded, 12 items in the 336-hour window. Markets (Yahoo Finance): 7 of 7 rows Weather (NWS): 3 forecast periods Scores (ESPN, plaintextsports): 2 teams via plaintextsports; mlb: ESPN failed (mlb: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nfl: ESPN failed (nfl: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nhl: ESPN failed (nhl: HTTP 403 (server: AkamaiGHost)); used plaintextsports Summaries: 3 model call(s) served by claude-opus-5 (296s of model time; $1.90 at API list price). ================================================================ Generated 2026-09-18 10:05 EDT. Updated weekdays at about 7:05 AM, 10:05 AM, 1:35 PM, and 7:35 PM ET, and weekends at about 8:05 AM and 7:35 PM ET. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 3 Team USA feeds; WSJ World News, WSJ Markets, WSJ US Business, WSJ Politics, The Economist, FT Home, FT World, FT Markets; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN or plaintextsports.com. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================