Researchers turned Claude into an exploit writer against OpenAI on the same day one flaw opened four major AI coding agents to zero-click takeover.
Emerging Trends and Key Updates
- Trend Air Security's Plugin4Shell zero-click flaw hits Claude Code, Codex, GitHub Copilot and Gemini CLI, while Hacktron chained Claude-built exploits to reach OpenAI employee accounts.
- Trend Compromising one distributor scales: a stolen Cloudflare key hit 100,000 Brevo sites, 13 npm packages carried WeaselBiscuit, and Google planted a mole inside TeamPCP.
- Update · new North Korea's WaterPlum drew a five-nation advisory for posing as AI recruiters, and Transparent Tribe planted Rust backdoors across Indian and Afghan government networks.
- Update · updated CISA retired its weekly vulnerability bulletin under BOD 26-04 as unauthenticated root flaws surfaced in Check Point management servers and Orkes Conductor via CVE-2026-58138.
- Update · new OpenAI's projected $280 billion burn and wary buyers of Oracle data-center debt land as Fetterman calls the AI race a Manhattan Project and Waymo drives Pittsburgh.
- Update · new Trump announced a Greenland troop agreement with Denmark, the Bank of Japan lifted rates to 1.25%, and West Texas Intermediate closed the week under $100.
Security
1. Plugin4Shell Opens Four AI Coding Agents
Latest developments: Air Security disclosed on September 18, 2026 that Claude Code, Codex, GitHub Copilot, and Gemini CLI share one zero-click remote code execution flaw it calls Plugin4Shell, the first supply-chain vulnerability of the AI agent ecosystem: whoever controls a plugin's source repository swaps the code an agent installs even when the agent pins that plugin to a specific reviewed version. Anthropic fixed it in Claude Code 2.1.179 and OpenAI in Codex 0.146.0, and GitHub Copilot and Gemini CLI still carry it.
read more
Anyone whose coding agent installs plugins from a marketplace is exposed, and a successful attacker gains the same access to company systems and data as the employee running the agent. Palo Alto Networks' Unit 42 separately showed that default settings in Amazon's AgentCore Harness let prompt injection pull credentials out, and Hush Security found hardcoded API keys and access tokens in 12 percent of credential slots across roughly 82,000 public MCP configuration files on GitHub.
Sources: Help Net Security · The Hacker News · Unit 42 (Palo Alto) · Help Net Security · ↑ top
2. Check Point Management Servers Yield Root
Latest developments: Check Point Software shipped a fix through its LivePatch channel for a critical flaw that lets an attacker with no credentials run code as root over the network on Security Management and Log Servers, and says it sees no sign of exploitation; Kaspersky and Tanium patched product flaws the same day, and Microsoft closed 18 vulnerabilities across Azure and its AI-branded products, among them CVE-2026-85889, a 10.0-rated missing authentication for a critical function in Azure AI Foundry that hands an unauthorized attacker elevated privileges over a network and that Microsoft fixed with no customer action required.
read more
The Security Management Server controls firewall policy and administrator access, so root on that box hands an intruder the rules governing every gateway it manages. Check Point customers should take the LivePatch update immediately.
Sources: BleepingComputer · The Hacker News · SecurityWeek · The Hacker News · ↑ top
3. CISA Retires Its Weekly Vulnerability Bulletin
Latest developments: The Cybersecurity and Infrastructure Security Agency ended its weekly vulnerability summary, the long-running roundup of newly published flaws, following Binding Operational Directive 26-04, which orders federal agencies to rank vulnerabilities by real-world risk instead of working down a list by severity score, and on September 18, 2026 it added three actively exploited Linux kernel flaws to the Known Exploited Vulnerabilities catalog: CVE-2025-39964, a race condition, CVE-2026-53266, an out-of-bounds write, and CVE-2025-39682, an improper check for unusual or exceptional conditions; a researcher published working exploit code the same day for four Linux kernel bugs that each hand a local user root, all of which kernel maintainers fixed over the past few weeks.
read more
Federal agencies and the many private teams that read the bulletin lose a standing catalog of new CVEs and gain a mandate to prioritize what attackers actually exploit. Security teams that built processes around the weekly summary should shift to the Known Exploited Vulnerabilities catalog and exploitation telemetry, and anyone running an older kernel should update now.
Sources: SecurityWeek · CISA Advisories · CISA Advisories · The Hacker News · ↑ top
4. LLM-Written Stealers Ride npm Packages
Latest developments: Researchers at OpenSourceMalware identified 13 npm packages delivering WeaselBiscuit, a previously undocumented JavaScript stealer that harvests Chrome extension storage and overlaps functionally with BeaverTail and a second strain from North Korea's Contagious Interview campaign; analysts tied a financially motivated actor claiming to be a bug bounty hunter to the PhantomRaven stealer on npm and judged with high confidence that a large language model wrote it, citing verbose comments, placeholder code, and token-analysis patterns; and BleepingComputer traced a third campaign that ranks SEO-optimized GitHub repositories impersonating LastPass Authenticator and other well-known software to push a new stealer called Rapuncel.
read more
All three families reach developers through the registries and repositories they trust and take browser-held credentials and wallet data off the machines that build software. Development teams should pin dependencies, audit recently added packages, verify the publisher behind any GitHub download, and treat Chrome extension storage as credential material.
Sources: The Hacker News · The Hacker News · BleepingComputer · ↑ top
5. Hacktron Uses Claude to Reach OpenAI Employee Accounts
Latest developments: Researchers at Hacktron used Claude to build a working exploit, chained it with a flaw in OpenAI's sign-in flow, and reached OpenAI employee accounts and sensitive internal GitHub data, and OpenAI paid them a bug bounty for the demonstration.
read more
The work shows a frontier model carrying the offensive engineering, from finding the weakness to writing the exploit, against the company that builds a competing frontier model. Every organization that relies on a single sign-on path into its source code should assume attackers now run the same loop.
Sources: Ars Technica Security · SecurityWeek · ↑ top
6. WaterPlum Turns Job Interviews Into Crypto Theft
Latest developments: The FBI, the Defense Department, Japan's National Police Agency, and law enforcement agencies in Australia and Germany issued a joint advisory on September 18, 2026 naming WaterPlum, North Korean operators who pose as artificial intelligence and blockchain companies, recruit through fake job postings, and have infected thousands of devices across 100 countries to steal cryptocurrency from the applicants; a United Nations report published September 16, 2026 found that as of July, Vietnam, Laos, Pakistan, and Argentina had taken meaningful steps against the North Korean information technology worker schemes an October study laid out.
read more
WaterPlum makes the hiring process the intrusion: a candidate answering a posting from a fabricated AI or crypto firm installs malware during a technical exercise and loses the wallets on that machine. Software and crypto professionals should refuse to run code, packages, or debugging tools that a recruiter sends.
Sources: The Record · The Record · ↑ top
7. Brevo Attack Reaches 100,000 Websites
Latest developments: SecurityWeek put the count at 100,000 websites on September 18, 2026, and detailed the method: the attackers used the stolen Cloudflare API key to deploy a Cloudflare worker that injected the malicious scripts, a day after Brevo confirmed the theft.
read more
Brevo, the French email marketing platform, lost a Cloudflare API key that attackers turned into ClickFix scripts running on its own sites and inside the JavaScript files its customers embed on theirs, making every one of those sites a malware distribution point. Site owners who load Brevo JavaScript should audit their pages and rotate anything the injected scripts could have touched.
Sources: SecurityWeek · BleepingComputer · ↑ top
8. Attackers Exploit Orkes Conductor as Docker Sandboxes Leak macOS Hosts
Latest developments: SecurityWeek reported on September 18, 2026 that attackers exploit CVE-2026-58138 in Orkes Conductor, an unauthenticated remote code execution flaw they reach through inline workflow definitions, and Docker warned in a September 15 announcement that CVE-2026-77179, rated critical, lets malicious code inside a Docker Sandboxes virtual machine on macOS escape the shared project directory and read or change any file on the host.
read more
Orkes Conductor orchestrates microservice workflows, and the flaw gives an unauthenticated caller code execution on the orchestrator. The Docker escape runs with the rights of the host account that started the virtual machine, collapsing the isolation developers rely on when they run untrusted code.
Sources: SecurityWeek · The Hacker News · ↑ top
9. Google Runs a Mole Inside TeamPCP
Latest developments: Wired reported on September 18, 2026 that Google Threat Intelligence Group placed an undercover analyst in the inner circle of TeamPCP, the crew behind the largest software supply-chain hacking spree on record, which breached thousands of companies.
read more
TeamPCP reached thousands of corporate victims by compromising software rather than attacking each target directly, and Google now says it watched the crew from the inside. Any organization that installs third-party code sits in the blast radius of a campaign built that way and should track the indicators Google publishes.
Sources: Wired Security · ↑ top
10. Transparent Tribe Plants Rust Backdoors in India and Afghanistan
Latest developments: Zscaler ThreatLabz attributed a fresh campaign against government and defense organizations in India and Afghanistan to Transparent Tribe, the Pakistan-aligned group that researchers also track as APT36 and Earth Karkaddan, and named four previously undocumented tools in it: RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH, with the Rust backdoor taking its commands from private GitHub repositories.
read more
Routing command and control through private GitHub repositories buries the backdoor's traffic inside a service nearly every enterprise network permits. Government and defense network teams in the region should inspect outbound GitHub API calls from hosts with no development role.
Sources: The Hacker News · ↑ top
Business and Politics
Trump Announces a Greenland Security Deal With Denmark
Latest developments: President Trump said Friday evening, September 18, that the United States and Denmark have reached an agreement putting more American forces in Greenland and barring certain nations from establishing a military foothold there, and the Danish government said the two sides could sign it next week.
read more
The accord covers security on the Arctic island, a semiautonomous Danish territory, and stops well short of the takeover Trump has demanded for months. Copenhagen says the agreement will respect Greenland's sovereignty, which settles, for now, a standoff that strained relations between Washington and a NATO ally.
Sources: FT Home · WSJ World News · ↑ top
The AI Buildout's Bill Lands in the Credit Markets
Latest developments: The Financial Times reported Friday, September 18, that OpenAI projects it will burn $280 billion in cash by 2030 and that investors have turned wary of the $18 billion of debt financing Oracle's data centers as permitting fights and construction delays mount in New Mexico; the British data center group Nscale filed the same day for a New York Stock Exchange listing at a $35 billion valuation.
read more
OpenAI's projection of deeply negative cash flow follows from its infrastructure spending and from price pressure on the models it sells, and Oracle's borrowing shows how local opposition translates into credit risk. Nscale, backed by Nvidia and holding a large contract to supply computing power to Anthropic, intends to trade under the symbol NSCL, which will put a public market price on the debt-financed buildout that banks and bond investors have underwritten.
Sources: FT Home · FT Home · FT Markets · WSJ Markets · ↑ top
A Fed Review Faults Its Own Supervisors Over Silicon Valley Bank
Latest developments: A new Federal Reserve report released Friday, September 18, blames the central bank's own bank-supervision staff for the 2023 collapse of Silicon Valley Bank and calls for an overhaul of how the Fed supervises banks.
read more
The review, commissioned by Fed Vice Chair for Supervision Michelle Bowman, concludes that examiners were "too timid" in pressing Silicon Valley Bank on its interest-rate and liquidity risks during the Biden years, a sharp break from the 2023 postmortem that faulted the bank's managers first. A federal judge separately rejected arguments that criticism of the bank's executives rested on hindsight, leaving supervisors and management both exposed as the Fed rewrites its examination playbook.
Sources: WSJ Markets · FT World · FT World · ↑ top
Turkey Moves to Liquidate Funds in a Ponzi Inquiry
Latest developments: Turkish authorities moved Friday, September 18, to liquidate the investment funds at the center of what regulators describe as a Ponzi-like scheme, forcing big Turkish banks to sell the assets inside them, and the Wall Street Journal reported the same day that the implosion has heaped fresh stress on President Recep Tayyip Erdogan's already troubled economy.
read more
Roughly 300,000 investors hold positions in the funds, which held billions of dollars, and the unwinding comes amid fears that the assets carried inflated valuations. A Financial Times column told U.S. Treasury Secretary Scott Bessent to watch the affair, arguing that stretched markets break without any fraud at all.
Sources: FT World · FT World · WSJ World News · ↑ top
The Bank of Japan Lifts Rates to 1.25%
Latest developments: The Bank of Japan raised its policy rate to 1.25% Friday, September 18, the highest since 1995, said it will hold to a quarterly pace of tightening, and the dollar's gain against the yen cooled by the New York close.
read more
The yen fell 1.2% to a two-week low of 158.05 per dollar after two board members signaled that future increases may come more slowly than markets had priced, and Japanese authorities warned they may intervene again in the currency. The weaker yen lands on Treasury Secretary Scott Bessent, who pushed Tokyo to raise rates and who led the first coordinated support for the currency since 1998 earlier this summer.
Sources: FT Home · WSJ World News · FT World · WSJ Markets · ↑ top
Buffett Hands the Berkshire Chair to His Son
Latest developments: Berkshire Hathaway said Friday morning, September 18, that Warren Buffett will step down as chairman and that his son Howard Buffett will succeed him.
read more
Warren Buffett led the $1 trillion conglomerate for more than six decades, stays on the board, and takes the title of chairman emeritus. Howard Buffett, long designated to protect the culture of the company, inherits the chairmanship of an insurer, railroad, and utility owner whose paper holdings move markets.
Sources: WSJ US Business · FT Home · ↑ top
Russia Seizes Nestlé's Local Operations
Latest developments: A presidential decree reported Friday, September 18, put the Russian businesses of Nestlé and the French retailers Auchan and Leroy Merlin under temporary external administration.
read more
Moscow stripped operational control from three Western companies that kept trading in Russia after the 2022 invasion of Ukraine, and Nestlé is weighing its options for the unit. The seizures raise the cost of remaining for every multinational still holding Russian assets.
Sources: WSJ World News · ↑ top
Oil Slides Below $100
Latest developments: Oil futures ended a frantic week little changed Friday, September 18, with West Texas Intermediate under $100 as traders bet Saudi Arabia will soon restore flows through its damaged East-West pipeline, and the Dow Jones Industrial Average closed lower for a third straight week.
read more
The outage that shut the Saudi pipeline drove crude to four-month highs midweek and pushed U.S. diesel to a record $6.27 a gallon this month, and France has called a G7 summit on releasing more strategic reserves. The two-year Treasury yield reached 4.741% Friday, its highest since July 2024, as traders priced further Federal Reserve increases, and U.S. stocks finished mixed with the Nasdaq composite eking out a small weekly gain.
Sources: WSJ World News · FT World · WSJ Markets · WSJ Markets · WSJ Markets · WSJ Markets · ↑ top
Pittsburgh
Weather
Tonight: Partly Cloudy, low 59F.
Saturday: Partly Sunny, high 80F.
Saturday Night: Mostly Cloudy then Showers And Thunderstorms Likely, low 66F.
Business
Riley's Pour House Breaks Ground in Carnegie
Latest developments: Riley's Pour House held a ceremonial groundbreaking Friday, September 18, at its original site, 215 E. Main Street in Carnegie, nearly two years after a fire destroyed the Irish pub, and the owners said they hope to reopen in about six months.
read more
Fire leveled the pub in 2024, and the owners pledged then to rebuild on the same block of Carnegie's main commercial street. Construction starts next week on a building the owners say will improve on the original.
Sources: KDKA · WPXI · WTAE · ↑ top
Spirit's Collapse Still Weighs on Pittsburgh International
Latest developments: TribLive reported Friday, September 18, that passenger traffic at Pittsburgh International Airport has yet to recover from the May shutdown of Spirit Airlines.
read more
Allegheny County Airport Authority Chief Executive Christina Cassotis said the loss of Spirit's seats is dragging on airports across the United States, not on Pittsburgh alone. The authority counts passenger volume as the measure that drives airline decisions about adding routes to the Findlay Township airport.
A Federal Grant Could Return Flights to Arnold Palmer
Latest developments: KDKA reported Friday, September 18, that a new U.S. Department of Transportation grant could bring commercial flights back to Arnold Palmer Regional Airport in Westmoreland County.
read more
The airport outside Latrobe carries the name of the golfer who grew up there and has gone without scheduled commercial service. The federal money would pay to restore passenger flights at a field that sits about 40 miles east of Pittsburgh International.
Waymo Drives Itself Through Pittsburgh
Latest developments: TribLive and WPXI reported Friday, September 18, that Waymo's cars now run fully autonomously on Pittsburgh streets with a safety technician behind the wheel, and WPXI added that evening that the company still lacks state permission to operate without a person in the driver's seat and hopes to start commercial service soon.
read more
The Alphabet subsidiary had been driving its vehicles manually to map the city, and the switch to autonomous operation puts Waymo on the roads of the region that trained a generation of self-driving engineers at Carnegie Mellon University. A technician stays in the driver's seat during the testing.
Sources: TribLive · WPXI · WPXI · ↑ top
Fetterman Calls the AI Race a Manhattan Project
Latest developments: U.S. Senator John Fetterman told the AI Horizons Summit in Pittsburgh on Friday, September 18, that the race to build artificial intelligence resembles the Manhattan Project, and he brushed off worries about the lack of regulation; speakers on the summit's second day in Bakery Square said the region's power and land make its infrastructure ready for AI.
read more
Fetterman spoke a day after Governor Josh Shapiro used the same summit's keynote to press for federal AI rules and say he has "real concerns," which puts Pennsylvania's Democratic governor and its Democratic senator on opposite sides of the question at a conference held in a city courting data centers and AI investment.
Sources: Pittsburgh Post-Gazette · KDKA · ↑ top
A Second Superload Rolls Next Week
Latest developments: WPXI reported Friday, September 18, that a second slow-moving superload will cross Armstrong, Indiana, and Westmoreland counties next week, following the 380-ton first haul that crawled through Delmont on Wednesday, September 16.
read more
Escort vehicles, the Pennsylvania State Police, and bucket trucks that lift wires out of the way will run ahead of and behind the truck, which carries equipment to data center construction near Homer City in Indiana County. The Pennsylvania Department of Transportation warns drivers that the haul will occupy two lanes at times and move as a rolling slowdown, with roughly 50 more superloads scheduled over the next four months.
The Canada Trade War Reaches Pennsylvania's Shop Floors
Latest developments: TribLive reported Friday, September 18, that the escalating tariff fight with Canada is hitting Pennsylvania's largest export market and the manufacturers that sell into it.
read more
Christian Klanica, who runs a machining company in Hempfield, Westmoreland County, said the levies flying between Washington and Ottawa change so often that he can no longer keep track of which ones apply to his work. Canada buys more Pennsylvania goods than any other country, which puts the state's machine shops and metal fabricators at the center of the dispute.
Butterwood Sells Dessert After Dark
Latest developments: Pittsburgh City Paper's food column made the case Friday, September 18, for Butterwood as the city's answer to a late-night sweet tooth.
read more
Bakeries run on 4 a.m. shifts, and the column argues Butterwood inverts that schedule by keeping its counter going for customers who want cake at night. The piece lands as Pittsburgh's after-dark dining options draw fresh attention.
Sources: Pittsburgh City Paper · ↑ top
Around Town
UPMC Settles With the Justice Department Over Care for Minors
Latest developments: UPMC agreed Friday, September 18, to pay nearly $1 million to the U.S. Department of Justice and to end gender-affirming care for patients under 18, resolving a federal investigation into that care and the billing attached to it.
read more
UPMC runs the region's largest hospital network, including UPMC Children's Hospital of Pittsburgh in Lawrenceville, which U.S. News & World Report placed among the nation's top 10 pediatric hospitals this week. The agreement closes the department's probe without further claims.
Sources: TribLive · KDKA · ↑ top
Dukes and Timko Meet Again in the 12th
Latest developments: WTAE reported Friday, September 18, that Brandon Dukes and Scott Timko are preparing for a November rematch in Pennsylvania House District 12 after a razor-thin finish in the August special election.
read more
The August special election produced one of the closest legislative results in Pennsylvania this year, and the two candidates face each other again on the November ballot for the full term. The seat counts in a Harrisburg chamber where the margin between the parties runs to a handful of votes.
Goats Clear the Invasives in Frick Park
Latest developments: KDKA and WTAE visited the Allegheny Goatscape herd working through the brush in Frick Park on Friday, September 18.
read more
Allegheny Goatscape has sent goats into Frick Park for nearly a decade to eat invasive plants, which opens ground for native trees and shrubs in Pittsburgh's largest city park. The herd grazes a fenced section at a time and moves on when the plot is cleared.
Pittsburgh Takes Delivery of New Snowplows
Latest developments: TribLive rode along Friday, September 18, with driver Mike Simcic as he steered one of the city of Pittsburgh's new crew cab plow trucks through East Liberty, the dashboard reading 76 degrees.
read more
Pittsburgh is stocking a new plow fleet ahead of winter, months after residents complained about unplowed hillside streets in past storms. Crews are training on the trucks now while the weather holds.
Mount Lebanon Runs Its First Torch Run
Latest developments: More than 100 runners carried the torch through Mount Lebanon on Friday, September 18, in the municipality's first hometown torch run for Special Olympics Pennsylvania.
read more
Mount Lebanon police officers ran alongside students from Mount Lebanon High School, who made up most of the field, raising money and attention for Special Olympics Pennsylvania. KDKA's Jessica Riley and WTAE both covered the inaugural run.
Crews Pull Mold From Monessen's School
Latest developments: WPXI reported Friday, September 18, that remediation work is underway inside Monessen Middle and High School after crews found mold in the building over the summer.
read more
The Westmoreland County district's middle and high school students share the one building, and the work proceeds while the school year runs. Mold has surfaced repeatedly in Western Pennsylvania school buildings after a wet summer.
County Rules Raise North Allegheny's Pool Costs
Latest developments: TribLive reported Friday, September 18, that Allegheny County requirements have pushed up the cost of the North Allegheny School District's natatorium renovation, according to a presentation the district gave at its September 9 school board meeting.
read more
The district, which serves McCandless, Marshall, Bradford Woods, and Franklin Park, is weighing alternative versions of the project as the price climbs. The board must decide how much of the swimming facility work to keep before it commits the money.
A Dry Saturday, a Wet Sunday
Latest developments: WTAE held Sunday, September 20, as an Impact Day in its Friday evening update, September 18, with rain returning Saturday night and heavy rain falling through Sunday.
read more
The Post-Gazette reported the same morning that repeated heavy downpours have flooded Western Pennsylvania through a stretch of weeks that gives residents little time to clean up between storms. Elizabeth Township took 2 inches in under 90 minutes Thursday, and Oakmont is still working through damage from a storm three weeks ago.
Sources: WTAE · Pittsburgh Post-Gazette · TribLive · ↑ top
Bracken House Tenants Hear About the Garage
Latest developments: The Bracken House apartment complex on Pittsburgh's North Shore held a town hall Thursday night, September 17, to update residents on its collapsed parking garage.
read more
Tenants have gone without their parking structure since it gave way, and WTAE reported frustration among residents waiting for a timeline and a repair plan. The building sits within walking distance of Acrisure Stadium and PNC Park, where game-day parking already runs tight.
Westmoreland Widens Its Lead Pipe Removal
Latest developments: The Municipal Authority of Westmoreland County plans a substantial expansion of its lead service line replacement program, TribLive reported Friday, September 18.
read more
The authority supplies water across Westmoreland County and has been pulling lead pipes out of its distribution system under federal replacement requirements. The expansion widens the number of homes whose service lines the authority will dig up and replace.
Events
Buffalo Bill House Opens for Tours at 35
Latest developments: KDKA and WTAE reported Friday, September 18, that the house used as Buffalo Bill's home in "The Silence of the Lambs" opens for guided tours this weekend as the film turns 35, with actress Brooke Smith visiting the set.
read more
The 1991 Oscar-winning thriller shot at the house in Perryopolis, Fayette County, and its owners run guided tours through the rooms that appear in the movie. Smith, who played Catherine Martin, returned to the house for the anniversary weekend.
Panda Fest Fills Station Square
Latest developments: WTAE reported Friday, September 18, that Panda Fest has drawn 80 vendors and more than 200 dishes to its Pittsburgh debut, with organizers expecting 50,000 visitors.
read more
The traveling outdoor Asian food festival, which bills itself as the nation's largest, opened Thursday, September 17, at Station Square on the South Shore as part of a nationwide tour. Vendors cook on the plaza beside the Monongahela River, a few minutes from downtown by the Smithfield Street Bridge.
'The Pitt' Casts Pittsburgh Extras for October
Latest developments: TribLive's TV Talk column reported Friday, September 18, that "The Pitt" returns to Pittsburgh late next month to shoot exterior scenes for its third season and needs local background players for filming October 27 through 29.
read more
The medical drama, a two-time Emmy winner for best drama, sets its story in a Pittsburgh emergency department and shoots its exteriors in the city. Residents who want to appear as background players in the October 27-29 scenes can apply through the casting call the column describes.
Sources: TribLive · Post-Gazette Arts & Entertainment · ↑ top
The Jazz Festival Closes Out Downtown
Latest developments: The Pittsburgh International Jazz Festival runs its final two days downtown through Sunday, September 20, and the Post-Gazette profiled 103-year-old retired judge Warren Watson, who has kept the city's jazz tradition going.
read more
The 16th edition of the festival fills downtown Pittsburgh from Thursday, September 17, through Sunday, September 20, with Grammy winners Samara Joy and Lalah Hathaway on the bill. NEXTpittsburgh's weekend guide pairs it with Panda Fest at Station Square among more than 15 things to do, and the Post-Gazette's weekend list adds FestPGH.
Sources: NEXTpittsburgh Events · Post-Gazette Arts & Entertainment · Post-Gazette Arts & Entertainment · ↑ top
Soergel Orchards Opens Fall Fest Saturday
Latest developments: Soergel Orchards opens its annual Fall Fest Saturday, September 19, the first day of a six-week run.
read more
Fall Fest runs through Sunday, November 1, at Soergel Orchards, beside the northbound Wexford exit of Interstate 79 in Franklin Park. Tractors carry visitors into the orchards to pick pumpkins and apples, and roasted corn and apple cider draw crowds to the barn area.
Sources: NEXTpittsburgh Events · ↑ top
Sports
Pirates (76-77)
Thu Sep 17 · Brewers 4 · Pirates 7 · Final
Up Next · Royals @ Pirates · Sat Sep 19, 6:40 PM
Steelers (1-0, T-1st in AFC North)
Up Next · Steelers @ Patriots · Sun Sep 20, 1:00 PM
Around the Teams
Hoge Puts the Patriots' Run Game First
Latest developments: Merril Hoge said on Playbook, posted Friday, September 18, that neutralizing New England's ground attack ranks as the Steelers' top priority in Week 2, and Matt Williamson and Wes Uhler closed their Patriots preview on SNR Drive the same afternoon with sideline reporter Missi Matthews calling in.
read more
The Steelers play at the New England Patriots on Sunday, September 20, at 1 p.m. ET on CBS. T.J. Watt met reporters at the team facility Friday, September 18, after a week in which his pick-six against the Atlanta Falcons drew most of the credit for the Week 1 win.
Sources: Pittsburgh Steelers (YouTube) · Pittsburgh Steelers (YouTube) · Pittsburgh Steelers (YouTube) · ↑ top
Bernard Waits His Turn at Receiver
Latest developments: The Post-Gazette reported Friday, September 18, that receiver Germie Bernard says he is "prepared for the moment" if the Steelers hand him more snaps Sunday at New England.
read more
Bernard has worked behind the top of the Steelers receiver group through the opener against the Atlanta Falcons, a game in which DK Metcalf dropped passes and drew penalties in his first appearance for Pittsburgh. The club kicks off at the Patriots on Sunday, September 20, at 1 p.m. ET.
Sources: Post-Gazette Steelers · ↑ top
Benton Tells the German Podcast About His Extension
Latest developments: Defensive tackle Keeanu Benton described on the Steelers' German-language podcast Männer aus Stahl, posted Friday, September 18, how he learned of his contract extension and which teammate heard about it before he did.
read more
Benton talked with host Christoph "Icke" Dommisch about a bet with his friend and teammate Nick Herbig, a 1990s toy, and the Steelers' international game in Paris this season. The club posted a run of German episodes this week, part of its push toward its German fan base.
Sources: Pittsburgh Steelers (YouTube) · ↑ top
Heyward Bats Down Passes Like Mutombo
Latest developments: The Post-Gazette wrote Friday, September 18, that Cam Heyward's habit of knocking passes out of the air has made him the NFL's version of Dikembe Mutombo.
read more
Heyward, the Steelers defensive captain in his 16th season, has piled up batted balls at the line of scrimmage, a skill that turns interior pressure into incompletions and interceptions for the defense behind him. The piece runs two days before Pittsburgh plays at the New England Patriots.
Sources: Post-Gazette Steelers · ↑ top
Heyward's Show Takes Up Rodgers
Latest developments: Not Just Football with Cam Heyward posted a segment Friday morning, September 18, titled "Aaron Rodgers Reveals Which Era of Himself Was Best," two days before the Steelers play at New England.
read more
Heyward, the Steelers defensive captain, hosts the show with Hayden and turned it this week to the quarterback who started the Week 1 win over the Atlanta Falcons. The same program had T.J. Watt on Wednesday to walk through his pick-six and the defense's zone-heavy plan against Atlanta.
Sources: Not Just Football with Cam Heyward · Not Just Football with Cam Heyward · ↑ top
Hiles Puts the Contract on Metcalf
Latest developments: Post-Gazette columnist Noah Hiles wrote Friday, September 18, that DK Metcalf has to start playing like the receiver the Steelers pay him to be.
read more
Metcalf's first game in a Steelers uniform, the Week 1 win over the Atlanta Falcons, brought drops and penalties, and he told reporters Thursday he is not crying over spilled milk. Hiles argues the money the club committed to him leaves no room for another quiet afternoon as the Steelers travel to the New England Patriots.
Sources: Post-Gazette Steelers · Post-Gazette Steelers · ↑ top
Heyward's Show Sets a Live Postgame Stream
Latest developments: Not Just Football with Cam Heyward scheduled a live postgame show for the Steelers' trip to New England, posting the stream Thursday, September 17.
read more
Heyward and co-host Hayden will react on the show's YouTube channel after Sunday's 1 p.m. ET kickoff at the Patriots, which CBS carries. The program spent Wednesday with T.J. Watt breaking down his pick-six against Atlanta and previewing New England.
Sources: Not Just Football with Cam Heyward · ↑ top
Team USA
Balogun Opens His Season at Monaco
Latest developments: United States striker Folarin Balogun made his first appearance of the season for AS Monaco on Friday, September 18, coming on in a 2-1 win over Lens after a summer transfer fell through.
read more
Balogun led the American attack at this year's World Cup and missed the 28-player roster Mauricio Pochettino named Thursday, September 17, for the September and October FIFA window. His late start at Monaco followed a move away from the club that collapsed.
Sources: ESPN Soccer · ↑ top
Banks Picks Germany Over the United States
Latest developments: The German Football Federation announced Friday, September 18, that defender Noahkai Banks has pledged his international future to Germany, ending the United States' pursuit of him.
read more
Banks, who plays for Augsburg in the Bundesliga, came through United States youth teams before choosing the country of his birth. His decision costs the U.S. men's program a center back it had counted among the most coveted dual nationals of his age group.
Sources: ESPN Soccer · ↑ top
Madrid and Barcelona Track Cavan Sullivan
Latest developments: ESPN's Transfer Talk reported Friday, September 18, that Real Madrid and Barcelona are following Cavan Sullivan, the Philadelphia Union attacker already committed to a future move to Manchester City.
read more
Sullivan, 16, got his first senior United States call-up Thursday when manager Mauricio Pochettino named a 28-player roster for the coming FIFA international window, a group ESPN casts as the start of the road to the 2030 World Cup. He scored twice for the Union in a 5-0 win over San Diego on September 13, his first two-goal game in Major League Soccer.
Sources: ESPN Soccer · ↑ top
The Squad Without Pulisic and Balogun
Latest developments: ESPN examined Thursday evening, September 17, why Mauricio Pochettino left Christian Pulisic and Folarin Balogun out of his first United States squad since the World Cup.
read more
Pulisic, of AC Milan, and Balogun were the leading American attackers at this year's tournament, and both miss the 28-player roster for the September and October FIFA window. Their absence opens the front line to newcomers including 16-year-old Cavan Sullivan and New York Red Bulls forward Julian Hall, who said Thursday that his own allegiance remains "not solidified."
Sources: ESPN Soccer · ESPN Soccer · ↑ top
Reading
- Ed Zitron — Premium: The Hater's Guide To AI Debt (Part 1). Zitron traces how hyperscalers are financing their GPU buildouts with debt, and argues the borrowing behind the AI boom sets up a reckoning once the revenue fails to match the capital spending.
- Stratechery — An Interview with Joanna Stern About the iPhone Duo and AI for Normal People. Ben Thompson interviews Wall Street Journal personal technology columnist Joanna Stern about Apple's new iPhone Duo and how ordinary consumers, rather than industry insiders, actually encounter artificial intelligence in the products they buy.
- Cal Newport — Superintelligence is a Fairy Tale. But Chasing It Can Still Cause Harm.. Newport responds to Anthropic employees who said publicly that the systems they build could kill billions, calling superintelligence a fantasy while arguing that the race toward it inflicts real damage along the way.
Markets
S&P 500 7,609.16 ▼ -0.6% Dow 51,887.38 ▼ -1.4% Nasdaq 26,217.45 ▼ -0.4% WTI crude 102.32 ▲ +7.9% EUR/USD 1.1504 ▼ -1.0% GBP/USD 1.3422 ▼ -0.8% USD/JPY 155.73 ▲ +1.3%
Feed Health
Security: 24 of 24 feeds loaded, 55 items in the 24-hour window. No recent items: Krebs on Security, Securelist (Kaspersky), Sophos News, Google Online Security Blog, Cisco Talos, Graham Cluley, Microsoft Security Blog, Google Project Zero, The DFIR Report, Kim Zetter (Zero Day), Frank on Fraud.
Pittsburgh: 9 of 9 feeds loaded, 60 items in the 48-hour window.
Business and Politics: 8 of 8 feeds loaded, 60 items in the 36-hour window.
Events: 4 of 4 feeds loaded, 16 items in the 120-hour window.
Sports media: 4 of 6 feeds loaded, 30 items in the 96-hour window. Failed: Not Just Football with Cam Heyward (HTTPError: HTTP Error 404: Not Found); Ben Roethlisberger / Channel Seven (YouTube) (HTTPError: HTTP Error 404: Not Found).
Team USA: 3 of 3 feeds loaded, 25 items in the 72-hour window. No recent items: Guardian Olympics.
Reading: 3 of 3 feeds loaded, 12 items in the 336-hour window.
Markets (Yahoo Finance): 7 of 7 rows
Weather (NWS): 3 forecast periods
Scores (ESPN, plaintextsports): 2 teams via plaintextsports; mlb: ESPN failed (mlb: HTTP 403 (server: AkamaiGHost)); used plaintextsports; mlb: 1 plaintextsports rows not understood; nfl: ESPN failed (nfl: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nhl: ESPN failed (nhl: HTTP 403 (server: AkamaiGHost)); used plaintextsports
Summaries: 3 model call(s) served by claude-opus-5 (479s of model time; $2.49 at API list price).