================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Friday, September 18, 2026 - 1:35 PM EDT ================================================================ The AI agent ecosystem took its first supply-chain hit as Plugin4Shell opened Claude Code, Codex, GitHub Copilot, and Gemini CLI to zero-click code execution, while researchers pointed Claude at OpenAI and reached employee accounts. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets | Feed Health EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Air Security's Plugin4Shell zero-click flaw in four coding agents, Hacktron's Claude-built exploit into OpenAI employee accounts, and LLM-written WeaselBiscuit npm stealers show the agent stack cutting both ways. see: Plugin4Shell Opens Four AI Coding Agents; Hacktron Uses Claude to Reach OpenAI Employee Accounts; LLM-Written Stealers Ride npm Packages * [TREND] A stolen Cloudflare API key pushed ClickFix scripts onto 100,000 Brevo customer sites, while abandoned IoT companion apps still call a resurrected CDN domain nobody audits. see: Brevo Attack Reaches 100,000 Websites; Abandoned Apps and a Resurrected CDN Domain * [UPDATE (new)] Wired revealed that Google Threat Intelligence Group ran an undercover analyst inside TeamPCP, the crew behind the record software supply-chain spree that breached thousands of companies. see: Google Runs a Mole Inside TeamPCP * [UPDATE (updated)] CISA retired its weekly vulnerability summary under Binding Operational Directive 26-04 as Check Point patched an unauthenticated root flaw and attackers exploited CVE-2026-58138 in Orkes Conductor. see: CISA Retires Its Weekly Vulnerability Bulletin; Check Point Management Servers Yield Root; Attackers Exploit Orkes Conductor as Docker Sandboxes Leak macOS Hosts * [UPDATE (new)] Waymo cars now drive themselves through Pittsburgh streets the same day Senator John Fetterman told the AI Horizons Summit the AI race resembles the Manhattan Project. see: Waymo Drives Itself Through Pittsburgh; Fetterman Calls the AI Race a Manhattan Project * [UPDATE (new)] Pittsburgh took delivery of new crew cab snowplows in 76-degree weather, Mount Lebanon ran its first Special Olympics torch run, and crews pulled mold from Monessen's school. see: Pittsburgh Takes Delivery of New Snowplows; Mount Lebanon Runs Its First Torch Run; Crews Pull Mold From Monessen's School SECURITY ---------------------------------------------------------------- 1. PLUGIN4SHELL OPENS FOUR AI CODING AGENTS AI Security · [ai, supply-chain, zero-day] Latest developments: Air Security disclosed on September 18, 2026 that Claude Code, Codex, GitHub Copilot, and Gemini CLI share one zero-click remote code execution flaw it calls Plugin4Shell, the first supply-chain vulnerability of the AI agent ecosystem: whoever controls a plugin's source repository swaps the code an agent installs even when the agent pins that plugin to a specific reviewed version. Anthropic fixed it in Claude Code 2.1.179 and OpenAI in Codex 0.146.0, and GitHub Copilot and Gemini CLI still carry it. Anyone whose coding agent installs plugins from a marketplace is exposed, and a successful attacker gains the same access to company systems and data as the employee running the agent. Palo Alto Networks' Unit 42 separately showed that default settings in Amazon's AgentCore Harness let prompt injection pull credentials out, and Hush Security found hardcoded API keys and access tokens in 12 percent of credential slots across roughly 82,000 public MCP configuration files on GitHub. - Help Net Security: https://www.helpnetsecurity.com/2026/09/18/plugin4shell-ai-coding-agents-vulnerability/ - The Hacker News: https://thehackernews.com/2026/09/plugin4shell-lets-repository-owners.html - Unit 42 (Palo Alto): https://unit42.paloaltonetworks.com/securing-aws-agentcore-harness-credentials/ - Help Net Security: https://www.helpnetsecurity.com/2026/09/18/hush-security-mcp-credential-exposure-report/ 2. CHECK POINT MANAGEMENT SERVERS YIELD ROOT Vulnerabilities and Exploits · [patch, rce] Latest developments: Check Point Software shipped a fix through its LivePatch channel for a critical flaw that lets an attacker with no credentials run code as root over the network on Security Management and Log Servers, and says it sees no sign of exploitation; Kaspersky and Tanium patched product flaws the same day, and Microsoft closed 18 vulnerabilities across Azure and its AI-branded products, among them CVE-2026-85889, a 10.0-rated missing authentication for a critical function in Azure AI Foundry that hands an unauthorized attacker elevated privileges over a network and that Microsoft fixed with no customer action required. The Security Management Server controls firewall policy and administrator access, so root on that box hands an intruder the rules governing every gateway it manages. Check Point customers should take the LivePatch update immediately. - BleepingComputer: https://www.bleepingcomputer.com/news/security/check-point-warns-critical-flaw-lets-hackers-execute-code-as-root/ - The Hacker News: https://thehackernews.com/2026/09/critical-check-point-management-server.html - SecurityWeek: https://www.securityweek.com/check-point-kaspersky-tanium-patch-product-vulnerabilities/ - The Hacker News: https://thehackernews.com/2026/09/microsoft-patches-cvss-100-azure-ai.html 3. LLM-WRITTEN STEALERS RIDE NPM PACKAGES Software Supply Chain Security · [supply-chain, malware, apt] Latest developments: Researchers at OpenSourceMalware identified 13 npm packages delivering WeaselBiscuit, a previously undocumented JavaScript stealer that harvests Chrome extension storage and overlaps functionally with BeaverTail and a second strain from North Korea's Contagious Interview campaign; analysts tied a financially motivated actor claiming to be a bug bounty hunter to the PhantomRaven stealer on npm and judged with high confidence that a large language model wrote it, citing verbose comments, placeholder code, and token-analysis patterns; and BleepingComputer traced a third campaign that ranks SEO-optimized GitHub repositories impersonating LastPass Authenticator and other well-known software to push a new stealer called Rapuncel. All three families reach developers through the registries and repositories they trust and take browser-held credentials and wallet data off the machines that build software. Development teams should pin dependencies, audit recently added packages, verify the publisher behind any GitHub download, and treat Chrome extension storage as credential material. - The Hacker News: https://thehackernews.com/2026/09/weaselbiscuit-stealer-spreads-via-13.html - The Hacker News: https://thehackernews.com/2026/09/claimed-bug-bounty-hunter-likely-used.html - BleepingComputer: https://www.bleepingcomputer.com/news/security/fake-lastpass-authenticator-github-repos-push-new-rapuncel-infostealer/ 4. CISA RETIRES ITS WEEKLY VULNERABILITY BULLETIN Policy and Regulation · [policy, patch] Latest developments: The Cybersecurity and Infrastructure Security Agency ended its weekly vulnerability summary, the long-running roundup of newly published flaws, following Binding Operational Directive 26-04, which orders federal agencies to rank vulnerabilities by real-world risk instead of working down a list by severity score, and on September 18, 2026 it added two actively exploited Linux kernel flaws to the Known Exploited Vulnerabilities catalog: CVE-2025-39964, a race condition, and CVE-2026-53266, an out-of-bounds write. Federal agencies and the many private teams that read the bulletin lose a standing catalog of new CVEs and gain a mandate to prioritize what attackers actually exploit. Security teams that built processes around the weekly summary should shift to the Known Exploited Vulnerabilities catalog and exploitation telemetry. - SecurityWeek: https://www.securityweek.com/cisa-retires-weekly-vulnerability-bulletin-in-risk-based-pivot/ - Dark Reading: https://www.darkreading.com/cyber-risk/cisa-ditches-weekly-vuln-roundups-risk-based-focus - CISA Advisories: https://www.cisa.gov/news-events/alerts/2026/09/18/cisa-adds-two-known-exploited-vulnerabilities-catalog 5. HACKTRON USES CLAUDE TO REACH OPENAI EMPLOYEE ACCOUNTS AI Security · [ai, exploit, vulnerability] Latest developments: Researchers at Hacktron used Claude to build a working exploit, chained it with a flaw in OpenAI's sign-in flow, and reached OpenAI employee accounts and sensitive internal GitHub data, and OpenAI paid them a bug bounty for the demonstration. The work shows a frontier model carrying the offensive engineering, from finding the weakness to writing the exploit, against the company that builds a competing frontier model. Every organization that relies on a single sign-on path into its source code should assume attackers now run the same loop. - Ars Technica Security: https://arstechnica.com/ai/2026/09/researchers-used-claude-to-hack-openai/ - SecurityWeek: https://www.securityweek.com/ai-built-exploit-and-sign-in-flaw-opened-path-to-internal-openai-code/ 6. BREVO ATTACK REACHES 100,000 WEBSITES Software Supply Chain Security · [supply-chain, malware, breach] Latest developments: SecurityWeek put the count at 100,000 websites on September 18, 2026, and detailed the method: the attackers used the stolen Cloudflare API key to deploy a Cloudflare worker that injected the malicious scripts, a day after Brevo confirmed the theft. Brevo, the French email marketing platform, lost a Cloudflare API key that attackers turned into ClickFix scripts running on its own sites and inside the JavaScript files its customers embed on theirs, making every one of those sites a malware distribution point. Site owners who load Brevo JavaScript should audit their pages and rotate anything the injected scripts could have touched. - SecurityWeek: https://www.securityweek.com/brevo-supply-chain-attack-injects-malware-into-100000-websites/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/brevo-supply-chain-attack-injected-clickfix-scripts-on-customer-sites/ 7. ATTACKERS EXPLOIT ORKES CONDUCTOR AS DOCKER SANDBOXES LEAK MACOS HOSTS Vulnerabilities and Exploits · [exploit, patch, rce] Latest developments: SecurityWeek reported on September 18, 2026 that attackers exploit CVE-2026-58138 in Orkes Conductor, an unauthenticated remote code execution flaw they reach through inline workflow definitions, and Docker warned in a September 15 announcement that CVE-2026-77179, rated critical, lets malicious code inside a Docker Sandboxes virtual machine on macOS escape the shared project directory and read or change any file on the host. Orkes Conductor orchestrates microservice workflows, and the flaw gives an unauthenticated caller code execution on the orchestrator. The Docker escape runs with the rights of the host account that started the virtual machine, collapsing the isolation developers rely on when they run untrusted code. - SecurityWeek: https://www.securityweek.com/critical-orkes-conductor-vulnerability-exploited-in-attacks/ - The Hacker News: https://thehackernews.com/2026/09/critical-docker-sandboxes-flaw-lets.html 8. RATHAT ANDROID TROJAN DRIVES PHONES WITH AI Ransomware and Cybercrime · [malware, mobile, ai] Latest developments: Researchers flagged RatHat on September 17, 2026, Android malware that China-based operators spread through targeted smishing and malvertising to deceptive third-party download portals, which carries an AI-powered subsystem that navigates and controls a compromised handset and abuses the Android Debug Bridge to keep shell access after the victim uninstalls the app. The AI layer lets one operator work many phones at once without hand-driving each screen, and the ADB persistence survives the obvious remedy. Android users should install only from Google Play and check developer options for enabled debugging. - The Hacker News: https://thehackernews.com/2026/09/rathat-android-malware-abuses-adb-to.html - BleepingComputer: https://www.bleepingcomputer.com/news/security/new-rathat-android-malware-uses-ai-to-automate-device-control/ 9. ABANDONED APPS AND A RESURRECTED CDN DOMAIN Software Supply Chain Security · [supply-chain, iot, vulnerability] Latest developments: Researchers at the University of Massachusetts Amherst analyzed 61,500 abandoned Android smart home and internet-of-things companion apps drawn from the AndroZoo archive and found nearly three in four carrying software dependencies with documented vulnerabilities, while The Hacker News traced a domain that once served a wound-down content delivery network: the owner let it expire, someone re-registered it in July 2025, and thousands of websites, code repositories, and documentation pages still hard-code hostnames beneath it. Millions of people still run companion apps for smart plugs, cameras, and thermostats that stopped receiving updates years ago, and those apps keep sending data to servers nobody maintains. Whoever controls a re-registered CDN domain can answer every one of those stale requests with code of their own choosing, so teams should grep their repositories and pages for third-party hostnames and verify who owns each one today. - Help Net Security: https://www.helpnetsecurity.com/2026/09/18/abandoned-iot-apps-data-security-risks/ - The Hacker News: https://thehackernews.com/2026/09/an-abandoned-cdn-domain-was-re.html 10. GOOGLE RUNS A MOLE INSIDE TEAMPCP Software Supply Chain Security · [supply-chain, breach] Latest developments: Wired reported on September 18, 2026 that Google Threat Intelligence Group placed an undercover analyst in the inner circle of TeamPCP, the crew behind the largest software supply-chain hacking spree on record, which breached thousands of companies. TeamPCP reached thousands of corporate victims by compromising software rather than attacking each target directly, and Google now says it watched the crew from the inside. Any organization that installs third-party code sits in the blast radius of a campaign built that way and should track the indicators Google publishes. - Wired Security: https://www.wired.com/story/an-undercover-google-analyst-infiltrated-a-notorious-supply-chain-hacking-gang/ BUSINESS AND POLITICS ---------------------------------------------------------------- * A Fed Review Faults Its Own Supervisors Over Silicon Valley Bank Latest developments: A new Federal Reserve report released Friday, September 18, blames the central bank's own bank-supervision staff for the 2023 collapse of Silicon Valley Bank and calls for an overhaul of how the Fed supervises banks. The review, commissioned by Fed Vice Chair for Supervision Michelle Bowman, concludes that examiners were "too timid" in pressing Silicon Valley Bank on its interest-rate and liquidity risks during the Biden years, a sharp break from the 2023 postmortem that faulted the bank's managers first. A federal judge separately rejected arguments that criticism of the bank's executives rested on hindsight, leaving supervisors and management both exposed as the Fed rewrites its examination playbook. - WSJ Markets: https://www.wsj.com/economy/central-banking/new-fed-report-on-svb-collapse-pins-blame-on-feds-own-regulators-9a3cb062?mod=rss_markets_main - FT Markets: https://www.ft.com/content/98c6db91-44c7-487e-a733-331a58766ba1?syn-25a6b1a6=1 - FT World: https://www.ft.com/content/24dc8ce0-5331-4280-ad85-c2dddcef429d?syn-25a6b1a6=1 * Turkey Moves to Liquidate Funds in a Ponzi Inquiry Latest developments: Turkish authorities moved Friday, September 18, to liquidate the investment funds at the center of what regulators describe as a Ponzi-like scheme, forcing big Turkish banks to sell the assets inside them, and the Wall Street Journal reported the same day that the implosion has heaped fresh stress on President Recep Tayyip Erdogan's already troubled economy. Roughly 300,000 investors hold positions in the funds, which held billions of dollars, and the unwinding comes amid fears that the assets carried inflated valuations. A Financial Times column told U.S. Treasury Secretary Scott Bessent to watch the affair, arguing that stretched markets break without any fraud at all. - FT World: https://www.ft.com/content/3943277e-eaf8-4faf-9f9c-1c05cb2ba992?syn-25a6b1a6=1 - FT World: https://www.ft.com/content/d6adb7bb-72b4-47d1-b3bd-11e908d06b60?syn-25a6b1a6=1 * The Bank of Japan Lifts Rates to 1.25% Latest developments: The Bank of Japan raised its policy rate to 1.25% Friday, September 18, the highest since 1995, and said it will hold to a quarterly pace of tightening. The yen fell 1.2% to a two-week low of 158.05 per dollar after two board members signaled that future increases may come more slowly than markets had priced, and Japanese authorities warned they may intervene again in the currency. The weaker yen lands on Treasury Secretary Scott Bessent, who pushed Tokyo to raise rates and who led the first coordinated support for the currency since 1998 earlier this summer. - FT Home: https://www.ft.com/content/97a0bed5-0580-4ccc-bd3c-fe9a714259e2?syn-25a6b1a6=1 - WSJ World News: https://www.wsj.com/economy/central-banking/bank-of-japan-raises-benchmark-interest-rate-to-1-25-highest-level-since-1995-2b28cbe9?mod=rss_worldnews - FT World: https://www.ft.com/content/14f9df6a-5a70-42d9-86ee-37e6242aae6e * Buffett Hands the Berkshire Chair to His Son Latest developments: Berkshire Hathaway said Friday morning, September 18, that Warren Buffett will step down as chairman and that his son Howard Buffett will succeed him. Warren Buffett led the $1 trillion conglomerate for more than six decades, stays on the board, and takes the title of chairman emeritus. Howard Buffett, long designated to protect the culture of the company, inherits the chairmanship of an insurer, railroad, and utility owner whose paper holdings move markets. - WSJ US Business: https://www.wsj.com/business/warren-buffett-to-step-down-as-berkshire-hathaway-chairman-de0e003f?mod=pls_whats_news_us_business_f - FT Home: https://www.ft.com/content/e26d8335-426a-4405-ae4c-433bd2696994 * Russia Seizes Nestlé's Local Operations Latest developments: A presidential decree reported Friday, September 18, put the Russian businesses of Nestlé and the French retailers Auchan and Leroy Merlin under temporary external administration. Moscow stripped operational control from three Western companies that kept trading in Russia after the 2022 invasion of Ukraine, and Nestlé is weighing its options for the unit. The seizures raise the cost of remaining for every multinational still holding Russian assets. - WSJ World News: https://www.wsj.com/articles/nestle-weighs-options-for-russia-unit-after-moscow-puts-it-under-administration-221402de?mod=rss_worldnews * Oil Slides Below $100 Latest developments: Crude's third straight decline stalled Friday afternoon, September 18, as traders weighed how fast Saudi Arabia can restore flows, and France called a G7 summit on releasing more strategic oil reserves. West Texas Intermediate slipped under $100 a barrel on bets that Riyadh will repair the drone damage that shut its East-West pipeline, the outage that drove U.S. diesel to a record $6.27 a gallon this month. In the same session the two-year Treasury yield touched 4.744%, its highest since July 2024, as traders priced further Federal Reserve increases; the stronger dollar pulled gold down and U.S. stock indexes finished the morning in the red. - WSJ World News: https://www.wsj.com/business/energy-oil/oil-prices-fall-for-third-day-as-wti-slips-below-100-e533d2fe?mod=rss_worldnews - FT World: https://www.ft.com/content/31c53c3c-5cc1-4248-98dc-68fc8956e8cc?syn-25a6b1a6=1 - WSJ Markets: https://www.wsj.com/finance/investing/two-year-u-s-treasury-yield-reaches-new-multi-year-high-99d3112b?mod=rss_markets_main - WSJ Markets: https://www.wsj.com/finance/stocks/stock-futures-rise-as-oil-extends-losses-treasury-yields-rise-0bda0bff?mod=rss_markets_main PITTSBURGH ---------------------------------------------------------------- Weather: This Afternoon: Partly Sunny, high 78F. Tonight: Partly Cloudy, low 59F. Saturday: Partly Sunny, high 80F. Business: * Waymo Drives Itself Through Pittsburgh Latest developments: TribLive and WPXI reported Friday, September 18, that Waymo's cars now run fully autonomously on Pittsburgh streets, with a safety technician sitting behind the wheel. The Alphabet subsidiary had been driving its vehicles manually to map the city, and the switch to autonomous operation puts Waymo on the roads of the region that trained a generation of self-driving engineers at Carnegie Mellon University. A technician stays in the driver's seat during the testing. - TribLive: https://triblive.com/business/technology/waymo-driverless-cars-now-testing-fully-autonomously-in-pittsburgh/ - WPXI: https://www.wpxi.com/news/local/waymo-now-testing-fully-autonomously-pittsburgh-with-safety-technician-behind-wheel/JIS2I7RGKRFRBBXWE7BMN4QK3U/ * Fetterman Calls the AI Race a Manhattan Project Latest developments: U.S. Senator John Fetterman told the AI Horizons Summit in Pittsburgh on Friday, September 18, that the race to build artificial intelligence resembles the Manhattan Project, and he brushed off worries about the lack of regulation. Fetterman spoke a day after Governor Josh Shapiro used the same summit's keynote to press for federal AI rules and say he has "real concerns," which puts Pennsylvania's Democratic governor and its Democratic senator on opposite sides of the question at a conference held in a city courting data centers and AI investment. - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/politics-nation/2026/09/18/fetterman-ai-horizons-summit-pittsburgh/stories/202609180054 * A Second Superload Rolls Next Week Latest developments: WPXI reported Friday, September 18, that a second slow-moving superload will cross Armstrong, Indiana, and Westmoreland counties next week, following the 380-ton first haul that crawled through Delmont on Wednesday, September 16. Escort vehicles, the Pennsylvania State Police, and bucket trucks that lift wires out of the way will run ahead of and behind the truck, which carries equipment to data center construction near Homer City in Indiana County. The Pennsylvania Department of Transportation warns drivers that the haul will occupy two lanes at times and move as a rolling slowdown, with roughly 50 more superloads scheduled over the next four months. - WPXI: https://www.wpxi.com/news/local/2nd-slow-moving-superload-move-through-western-pennsylvania-next-week/ZSZWS5I3CZGZ5CGLTSMMO6HQ5M/ * The Canada Trade War Reaches Pennsylvania's Shop Floors Latest developments: TribLive reported Friday, September 18, that the escalating tariff fight with Canada is hitting Pennsylvania's largest export market and the manufacturers that sell into it. Christian Klanica, who runs a machining company in Hempfield, Westmoreland County, said the levies flying between Washington and Ottawa change so often that he can no longer keep track of which ones apply to his work. Canada buys more Pennsylvania goods than any other country, which puts the state's machine shops and metal fabricators at the center of the dispute. - TribLive: https://triblive.com/local/regional/so-much-chaos-escalating-trade-war-with-canada-impacts-pa-s-largest-export-market/ * Butterwood Sells Dessert After Dark Latest developments: Pittsburgh City Paper's food column made the case Friday, September 18, for Butterwood as the city's answer to a late-night sweet tooth. Bakeries run on 4 a.m. shifts, and the column argues Butterwood inverts that schedule by keeping its counter going for customers who want cake at night. The piece lands as Pittsburgh's after-dark dining options draw fresh attention. - Pittsburgh City Paper: https://www.pghcitypaper.com/food-drink/satisfying-a-late-night-sweet-tooth-at-butterwood/ Around town: * Pittsburgh Takes Delivery of New Snowplows Latest developments: TribLive rode along Friday, September 18, with driver Mike Simcic as he steered one of the city of Pittsburgh's new crew cab plow trucks through East Liberty, the dashboard reading 76 degrees. Pittsburgh is stocking a new plow fleet ahead of winter, months after residents complained about unplowed hillside streets in past storms. Crews are training on the trucks now while the weather holds. - TribLive: https://triblive.com/local/balmy-weather-aside-pittsburgh-preps-for-winter-with-new-plow-fleet/ * Mount Lebanon Runs Its First Torch Run Latest developments: More than 100 runners carried the torch through Mount Lebanon on Friday, September 18, in the municipality's first hometown torch run for Special Olympics Pennsylvania. Mount Lebanon police officers ran alongside students from Mount Lebanon High School, who made up most of the field, raising money and attention for Special Olympics Pennsylvania. KDKA's Jessica Riley and WTAE both covered the inaugural run. - WTAE: https://www.wtae.com/article/mount-lebanon-first-torch-run-special-olympics/73788820 - KDKA: https://www.cbsnews.com/pittsburgh/news/mt-lebanon-hometown-torch-run-special-olympics/ * Crews Pull Mold From Monessen's School Latest developments: WPXI reported Friday, September 18, that remediation work is underway inside Monessen Middle and High School after crews found mold in the building over the summer. The Westmoreland County district's middle and high school students share the one building, and the work proceeds while the school year runs. Mold has surfaced repeatedly in Western Pennsylvania school buildings after a wet summer. - WPXI: https://www.wpxi.com/news/local/work-underway-inside-monessen-middle-high-school-after-mold-found-over-summer/WNLJNAHIKRGILG4T4CBHBPVLZQ/ * County Rules Raise North Allegheny's Pool Costs Latest developments: TribLive reported Friday, September 18, that Allegheny County requirements have pushed up the cost of the North Allegheny School District's natatorium renovation, according to a presentation the district gave at its September 9 school board meeting. The district, which serves McCandless, Marshall, Bradford Woods, and Franklin Park, is weighing alternative versions of the project as the price climbs. The board must decide how much of the swimming facility work to keep before it commits the money. - TribLive: https://triblive.com/local/north-allegheny-renovation-update-includes-cost-increases-project-alternatives/ * A Dry Saturday, a Wet Sunday Latest developments: WTAE called Sunday, September 20, an Impact Day in its Friday outlook, September 18, with rain arriving Saturday night after a dry start to the weekend. The Post-Gazette reported the same morning that repeated heavy downpours have flooded Western Pennsylvania through a stretch of weeks that gives residents little time to clean up between storms. Elizabeth Township took 2 inches in under 90 minutes Thursday, and Oakmont is still working through damage from a storm three weeks ago. - WTAE: https://www.wtae.com/article/western-pa-this-weekend-dry-start-rainy-finish/73783487 - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/weather-news/2026/09/18/pittsburgh-severe-weather-flooding/stories/202609170086 - TribLive: https://triblive.com/local/valley-news-dispatch/storm-response-improving-oakmont-officials-say/ * Bracken House Tenants Hear About the Garage Latest developments: The Bracken House apartment complex on Pittsburgh's North Shore held a town hall Thursday night, September 17, to update residents on its collapsed parking garage. Tenants have gone without their parking structure since it gave way, and WTAE reported frustration among residents waiting for a timeline and a repair plan. The building sits within walking distance of Acrisure Stadium and PNC Park, where game-day parking already runs tight. - WTAE: https://www.wtae.com/article/frustrations-north-shore-apartment-parking-garage-collapsed-bracken-house/73782372 * Westmoreland Widens Its Lead Pipe Removal Latest developments: The Municipal Authority of Westmoreland County plans a substantial expansion of its lead service line replacement program, TribLive reported Friday, September 18. The authority supplies water across Westmoreland County and has been pulling lead pipes out of its distribution system under federal replacement requirements. The expansion widens the number of homes whose service lines the authority will dig up and replace. - TribLive: https://triblive.com/local/westmoreland/westmoreland-water-authority-seeks-to-expand-program-to-remove-lead-pipes/ Events: * 'The Pitt' Casts Pittsburgh Extras for October Latest developments: TribLive's TV Talk column reported Friday, September 18, that "The Pitt" returns to Pittsburgh late next month to shoot exterior scenes for its third season and needs local background players for filming October 27 through 29. The medical drama, a two-time Emmy winner for best drama, sets its story in a Pittsburgh emergency department and shoots its exteriors in the city. Residents who want to appear as background players in the October 27-29 scenes can apply through the casting call the column describes. - TribLive: https://triblive.com/aande/movies-tv/tv-talk-the-pitt-seeks-pittsburgh-extras/ * The Jazz Festival Closes Out Downtown Latest developments: The Pittsburgh International Jazz Festival runs its final two days downtown through Sunday, September 20, and the Post-Gazette profiled 103-year-old retired judge Warren Watson, who has kept the city's jazz tradition going. The 16th edition of the festival fills downtown Pittsburgh from Thursday, September 17, through Sunday, September 20, with Grammy winners Samara Joy and Lalah Hathaway on the bill. NEXTpittsburgh's weekend guide pairs it with Panda Fest at Station Square among more than 15 things to do. - NEXTpittsburgh Events: https://nextpittsburgh.com/events/15-things-to-do-this-weekend-sept-17-20-2026/ - Post-Gazette Arts & Entertainment: https://www.post-gazette.com/ae/music/2026/09/16/judge-warren-watson-103-pittsburgh-jazz/stories/202609090062 * Soergel Orchards Opens Fall Fest Saturday Latest developments: Soergel Orchards opens its annual Fall Fest Saturday, September 19, the first day of a six-week run. Fall Fest runs through Sunday, November 1, at Soergel Orchards, beside the northbound Wexford exit of Interstate 79 in Franklin Park. Tractors carry visitors into the orchards to pick pumpkins and apples, and roasted corn and apple cider draw crowds to the barn area. - NEXTpittsburgh Events: https://nextpittsburgh.com/events/6-farms-to-visit-this-fall-from-soergels-to-triple-b/ SPORTS ---------------------------------------------------------------- Pirates (76-77) Thu Sep 17 · Brewers 4 · Pirates 7 · Final https://plaintextsports.com/mlb/2026-09-17/mil-pit Up Next · Royals @ Pirates · Fri Sep 18, 6:40 PM https://plaintextsports.com/mlb/2026/teams/pittsburgh-pirates Steelers (1-0, T-1st in AFC North) Up Next · Steelers @ Patriots · Sun Sep 20, 1:00 PM https://plaintextsports.com/nfl/2026/week2/pit-ne Around the Teams: * Heyward Bats Down Passes Like Mutombo Latest developments: The Post-Gazette wrote Friday, September 18, that Cam Heyward's habit of knocking passes out of the air has made him the NFL's version of Dikembe Mutombo. Heyward, the Steelers defensive captain in his 16th season, has piled up batted balls at the line of scrimmage, a skill that turns interior pressure into incompletions and interceptions for the defense behind him. The piece runs two days before Pittsburgh plays at the New England Patriots. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/09/18/cam-heyward-batted-passes-dikembe-motumbo/stories/202609180052 * Heyward's Show Takes Up Rodgers Latest developments: Not Just Football with Cam Heyward posted a segment Friday morning, September 18, titled "Aaron Rodgers Reveals Which Era of Himself Was Best," two days before the Steelers play at New England. Heyward, the Steelers defensive captain, hosts the show with Hayden and turned it this week to the quarterback who started the Week 1 win over the Atlanta Falcons. The same program had T.J. Watt on Wednesday to walk through his pick-six and the defense's zone-heavy plan against Atlanta. - Not Just Football with Cam Heyward: https://www.youtube.com/watch?v=R7t-Ng-2wmc - Not Just Football with Cam Heyward: https://www.youtube.com/watch?v=yX1h_us6qMo * Hiles Puts the Contract on Metcalf Latest developments: Post-Gazette columnist Noah Hiles wrote Friday, September 18, that DK Metcalf has to start playing like the receiver the Steelers pay him to be. Metcalf's first game in a Steelers uniform, the Week 1 win over the Atlanta Falcons, brought drops and penalties, and he told reporters Thursday he is not crying over spilled milk. Hiles argues the money the club committed to him leaves no room for another quiet afternoon as the Steelers travel to the New England Patriots. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/09/18/dk-metcalf-contract-steelers/stories/202609180014 - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/09/17/dk-metcalf-drops-penalties-falcons/stories/202609170040 * Heyward's Show Sets a Live Postgame Stream Latest developments: Not Just Football with Cam Heyward scheduled a live postgame show for the Steelers' trip to New England, posting the stream Thursday, September 17. Heyward and co-host Hayden will react on the show's YouTube channel after Sunday's 1 p.m. ET kickoff at the Patriots, which CBS carries. The program spent Wednesday with T.J. Watt breaking down his pick-six against Atlanta and previewing New England. - Not Just Football with Cam Heyward: https://www.youtube.com/watch?v=vTEUk6Qr_Jo Team USA: * Banks Picks Germany Over the United States Latest developments: The German Football Federation announced Friday, September 18, that defender Noahkai Banks has pledged his international future to Germany, ending the United States' pursuit of him. Banks, who plays for Augsburg in the Bundesliga, came through United States youth teams before choosing the country of his birth. His decision costs the U.S. men's program a center back it had counted among the most coveted dual nationals of his age group. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49974049/noahkai-banks-germany-usa-augsburg * Madrid and Barcelona Track Cavan Sullivan Latest developments: ESPN's Transfer Talk reported Friday, September 18, that Real Madrid and Barcelona are following Cavan Sullivan, the Philadelphia Union attacker already committed to a future move to Manchester City. Sullivan, 16, got his first senior United States call-up Thursday when manager Mauricio Pochettino named a 28-player roster for the coming FIFA international window, a group ESPN casts as the start of the road to the 2030 World Cup. He scored twice for the Union in a 5-0 win over San Diego on September 13, his first two-goal game in Major League Soccer. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49970584/transfer-rumors-news-real-madrid-barcelona-track-man-city-bound-usmnt-star-sullivan - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49967323/sullivan-usmnt-gifted-next-generation-kickstart-road-2030-world-cup * The Squad Without Pulisic and Balogun Latest developments: ESPN examined Thursday evening, September 17, why Mauricio Pochettino left Christian Pulisic and Folarin Balogun out of his first United States squad since the World Cup. Pulisic, of AC Milan, and Balogun were the leading American attackers at this year's tournament, and both miss the 28-player roster for the September and October FIFA window. Their absence opens the front line to newcomers including 16-year-old Cavan Sullivan and New York Red Bulls forward Julian Hall, who said Thursday that his own allegiance remains "not solidified." - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49966291/the-usmnt-first-post-world-cup-squad-missing-biggest-summer-stars-christian-pulisic-folarin-balogun - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49967712/julian-hall-usa-poland-new-york-red-bulls READING ---------------------------------------------------------------- * Ed Zitron -- Premium: The Hater's Guide To AI Debt (Part 1) Zitron traces how hyperscalers are financing their GPU buildouts with debt, and argues the borrowing behind the AI boom sets up a reckoning once the revenue fails to match the capital spending. https://www.wheresyoured.at/premium-the-haters-guide-to-ai-debt-part-1/ * Stratechery -- An Interview with Joanna Stern About the iPhone Duo and AI for Normal People Ben Thompson interviews Wall Street Journal personal technology columnist Joanna Stern about Apple's new iPhone Duo and how ordinary consumers, rather than industry insiders, actually encounter artificial intelligence in the products they buy. https://stratechery.com/2026/an-interview-with-joanna-stern-about-the-iphone-duo-and-ai-for-normal-people/ * Cal Newport -- Superintelligence is a Fairy Tale. But Chasing It Can Still Cause Harm. Newport responds to Anthropic employees who said publicly that the systems they build could kill billions, calling superintelligence a fantasy while arguing that the race toward it inflicts real damage along the way. https://calnewport.com/superintelligence-is-a-fairy-tale-but-chasing-it-can-still-cause-harm/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,610.45 ▼ -0.8% Dow 52,065.51 ▼ -1.5% Nasdaq 26,179.55 ▼ -0.7% WTI crude 102.32 ▲ +7.9% EUR/USD 1.1552 ▼ -0.6% GBP/USD 1.3478 ▼ -0.4% USD/JPY 154.71 ▲ +0.1% FEED HEALTH ---------------------------------------------------------------- Security: 24 of 24 feeds loaded, 58 items in the 24-hour window. No recent items: Krebs on Security, Securelist (Kaspersky), Sophos News, Google Online Security Blog, Graham Cluley, Microsoft Security Blog, Google Project Zero, The DFIR Report, Kim Zetter (Zero Day), Frank on Fraud. Pittsburgh: 9 of 9 feeds loaded, 60 items in the 48-hour window. Business and Politics: 8 of 8 feeds loaded, 60 items in the 36-hour window. Events: 4 of 4 feeds loaded, 14 items in the 120-hour window. Sports media: 6 of 6 feeds loaded, 30 items in the 96-hour window. Team USA: 3 of 3 feeds loaded, 26 items in the 72-hour window. No recent items: Guardian Olympics. Reading: 3 of 3 feeds loaded, 12 items in the 336-hour window. Markets (Yahoo Finance): 7 of 7 rows Weather (NWS): 3 forecast periods Scores (ESPN, plaintextsports): 2 teams via plaintextsports; mlb: ESPN failed (mlb: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nfl: ESPN failed (nfl: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nhl: ESPN failed (nhl: HTTP 403 (server: AkamaiGHost)); used plaintextsports Summaries: 3 model call(s) served by claude-opus-5 (350s of model time; $2.09 at API list price). ================================================================ Generated 2026-09-18 13:35 EDT. Updated weekdays at about 7:05 AM, 10:05 AM, 1:35 PM, and 7:35 PM ET, and weekends at about 8:05 AM and 7:35 PM ET. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 3 Team USA feeds; WSJ World News, WSJ Markets, WSJ US Business, WSJ Politics, The Economist, FT Home, FT World, FT Markets; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN or plaintextsports.com. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================