Cisco Talos pulled apart the first known malware implant that runs its own command and control through an AI model, with no human operator in the loop.
Emerging Trends and Key Updates
- Trend A Chinese-speaking crew looted 996 Zyxel switches via CVE-2026-7273 under a two-day CISA deadline, while two WordPress core flaws now have public paths to server code.
- Trend Attackers are pushing AI into the loop: CLOSEDQUORUM drives its own command and control through chat, and Patrick Wardle's proof-of-concept flips a Muse setting to steal dictated prompts.
- Update · new Stolen credentials for third-party Ribon apps let attackers inject scripts into BigCommerce storefronts, the latest breach merchants inherited from code they embed.
- Update · new Japan dismantled its first North Korean laptop farm as the United States, Japan, Germany, and Australia jointly detailed the WaterPlum campaign funding Pyongyang.
- Trend Skepticism about the AI buildout runs through Zitron's tally of hyperscaler debt, Newport's dismissal of superintelligence, and Pitt faculty bargaining against AI evaluators.
- Update · new Pittsburgh's flood watch runs to Wednesday morning on the first day of fall as home heating oil prices balloon across Western Pennsylvania heading into winter.
Security
1. Chinese-Speaking Crew Loots 996 Zyxel Switches
Latest developments: GreyNoise reported on September 21, 2026 that a Chinese-speaking threat actor has exploited CVE-2026-7273 since August to pull sensitive data off 996 unpatched Zyxel GS1900 Smart Managed Switches in 48 countries, and CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day with a federal patch deadline of Thursday, September 24, 2026.
read more
CVE-2026-7273 is a stack-based buffer overflow rated 8.8 in the Zyxel GS1900 line of Gigabit Ethernet switches that yields arbitrary operating system command execution; the compromised devices sit mostly in Italy, the United States, Taiwan, South Korea, and other European Union countries. Zyxel has shipped fixes, and CISA cataloged a Veeam flaw granting SYSTEM access alongside it.
Sources: Help Net Security · BleepingComputer · The Hacker News · CISA Advisories · ↑ top
2. CLOSEDQUORUM Runs Its Own Command and Control
Latest developments: Cisco Talos released CAIRN, a research toolkit for hunting, classifying, and tracking AI-integrated malware, and used it on September 22, 2026 to surface CLOSEDQUORUM, a binary that drives its entire command and control loop through AI chatbots with no operator involvement.
read more
CLOSEDQUORUM is the first reported implant that decides its own next actions through a language model instead of waiting on a human handler, which moves large stretches of the attack chain off the attacker's keyboard. Talos published CAIRN so defenders can hunt for the same pattern in their own telemetry.
Sources: Cisco Talos · Cisco Talos · Wired Security · ↑ top
3. WordPress Core Yields Two Paths to Server Code
Latest developments: Researchers published technical details and a working proof-of-concept exploit for Click2Shell on September 21, 2026, and a second core flaw surfaced the same week: Comment2Shell, CVE-2026-93485, which WordPress fixed on September 17, 2026 in version 7.1.1.
read more
Click2Shell is a cross-site request forgery bug in WordPress core that installs and previews a theme when a logged-in administrator opens a crafted link, ending in remote code execution; Comment2Shell lets an anonymous visitor leave a comment carrying a hidden script that runs code on the server once an administrator views the page. Site owners should move to WordPress 7.1.1 now.
Sources: BleepingComputer · The Hacker News · SecurityWeek · ↑ top
4. Japan Dismantles Its First North Korean Laptop Farm
Latest developments: Japanese authorities took down the country's first North Korean laptop farm, SecurityWeek reported on September 22, 2026, as the United States, Japan, Germany, and Australia published a joint report on the WaterPlum campaign that counts funds or credentials taken from more than 7,000 cryptocurrency wallets.
read more
WaterPlum, the operation also tracked as Contagious Interview, poses as artificial intelligence and blockchain companies, recruits through fake job postings, and has infected at least 30,000 devices in more than 100 countries, moving $10.71 million in stolen cryptocurrency to North Korea. Web designers, engineers, and cryptocurrency specialists are the primary targets.
Sources: SecurityWeek · The Hacker News · ↑ top
5. Patrick Wardle Turns Meta Muse Into a Backdoor
Latest developments: Security researcher Patrick Wardle released a proof-of-concept on September 21, 2026 showing that malware already running on a Mac flips one hidden Muse setting so that a user's dictated prompts travel to the attacker rather than to Meta, opening a second route into the assistant beyond the ClickFix hijack Ars Technica described.
read more
Muse is the artificial intelligence assistant Meta launched with extraordinarily broad access to its owner's machine, and Meta has not patched the flaw. Whoever takes the assistant inherits every permission its owner granted the app.
Sources: The Hacker News · Ars Technica Security · ↑ top
6. Stolen Ribon Credentials Inject Scripts Into BigCommerce Stores
Latest developments: BigCommerce notified multiple merchants on September 21, 2026 that attackers compromised credentials for third-party Ribon applications and used that access to inject malicious scripts into their online stores.
read more
The ecommerce platform BigCommerce lets merchants install third-party apps, and Ribon's stolen credentials gave attackers a path straight into storefront pages where shoppers enter payment details. Merchants running Ribon apps should audit their storefront scripts and rotate application credentials.
Sources: BleepingComputer · ↑ top
Business and Politics
Iran Dangles a Hormuz Reopening and Brent Breaks Below $100
Latest developments: Brent crude reversed early gains and fell under $100 a barrel Tuesday, September 22, after reports that Iran offered to reopen the Strait of Hormuz within seven days if the United States eases military pressure.
read more
The offer, surfacing as world leaders gather at the United Nations General Assembly where President Trump speaks Tuesday morning, whipsawed markets: the dollar touched a seven-week high against a basket of currencies before paring the move, gold slipped inside a $4,300 to $4,400 range, the 30-year Treasury yield fell, and a global rally in artificial intelligence shares stalled in European trade. Hormuz carries roughly a fifth of the world's seaborne oil, and the diesel and inflation shock running through American prices hangs on whether the waterway opens.
Sources: WSJ World News · WSJ Markets · WSJ Markets · WSJ Markets · ↑ top
Xi Brings Taiwan to the Summit With Trump
Latest developments: The Wall Street Journal reported Tuesday, September 22, that Beijing quietly helped stage the mainland visit of Taiwan's opposition leader and now reads President Trump as a rare window to persuade the island that resistance is futile.
read more
Chinese leader Xi Jinping goes into his coming summit with Trump aiming first to extend the trade truce between the two economies, and he also plans to raise Taiwan, Iran, and the race to dominate artificial intelligence, according to the Financial Times. Trump addresses the United Nations General Assembly Tuesday morning on wars, tariffs, and energy before the China talks.
Sources: WSJ World News · FT Home · WSJ World News · WSJ US Business · ↑ top
DWS Weighs Emergency Curbs on Its German Property Fund
Latest developments: The Financial Times reported Tuesday, September 22, that DWS, the asset manager Deutsche Bank controls, is considering emergency measures to limit withdrawals from its open-ended German real estate fund as retail investors pull money out.
read more
Open-ended property funds promise daily liquidity against buildings that take months to sell, and gating one of Germany's largest such retail products would mark the sharpest sign yet of strain in European commercial real estate. Investors across the German market have been redeeming steadily as valuations fall and financing costs stay high.
Pittsburgh
Weather
Today: Chance Rain Showers, high 62F.
Tonight: Chance Rain Showers, low 54F.
Wednesday: Chance Rain Showers, high 64F.
Business
Home Heating Oil Prices Balloon Across Western Pennsylvania
Latest developments: The Post-Gazette reported Tuesday, September 22, that home heating oil prices across Western Pennsylvania have ballooned heading into winter, with one customer saying, "I might not make it."
read more
Roughly one in ten Pennsylvania households burns oil for heat, and the distillate squeeze that carried the average United States diesel price above $6.50 a gallon feeds the same barrel into home furnaces. Households on fixed incomes in rural Westmoreland, Armstrong, and Indiana counties, where natural gas lines never reached, absorb the increase directly.
Sources: Pittsburgh Post-Gazette · ↑ top
Chobani's Lehigh Valley Plant Needs Pennsylvania Milk
Latest developments: The Post-Gazette reported Tuesday, September 22, that state officials call Chobani's new Lehigh Valley plant a game-changer for Pennsylvania dairy and now need farmers to supply it.
read more
Governor Josh Shapiro, Agriculture Secretary Russell Redding, and Community and Economic Development Secretary Rick Siger courted the yogurt maker to Pennsylvania, and filling the plant's tanks depends on dairy farms that have been shrinking in number for two decades. Pittsburgh's Turner Dairy figures in the supply picture.
Sources: Pittsburgh Post-Gazette · ↑ top
Rural King Looks at Hillcrest Shopping Center in Lower Burrell
Latest developments: TribLive reported Tuesday, September 22, that the farm-and-home chain Rural King is eyeing the Hillcrest Shopping Center in Lower Burrell for a new store.
read more
Rural King sells livestock feed, tools, clothing, and hardware, and a Lower Burrell location would give the Alle-Kiski Valley a single stop for home, clothing, and farming goods. Hillcrest Shopping Center sits along Leechburg Road in Westmoreland County.
Around Town
The Flood Watch Runs to Wednesday Morning on the First Day of Fall
Latest developments: The National Weather Service in Pittsburgh extended its flood watch through 8 a.m. Wednesday, September 23, and WTAE marked both Tuesday and Wednesday as Impact Days as more rounds of showers cross the region.
read more
Washington County residents along a swollen creek told WTAE they expect another round of flooding after two straight weekends of high water, one saying, "My trailer might go down the creek next." KDKA meteorologist Ron Smiley put Tuesday's high near 60 degrees on the first day of fall, with no warm-up behind it.
Sources: TribLive · WTAE · WTAE · KDKA · ↑ top
Sto-Rox Climbs Out of the Red
Latest developments: The Post-Gazette reported Tuesday, September 22, that the Sto-Rox School District has balanced its books after years of financial struggle.
read more
Sto-Rox, which serves McKees Rocks and Stowe Township in Allegheny County, has spent years among the most financially distressed districts in Western Pennsylvania, running deficits that drew state scrutiny and repeated warnings about its ability to stay solvent.
Sources: Pittsburgh Post-Gazette · ↑ top
Pitt's Faculty Union Bargains Over AI Teachers
Latest developments: PublicSource reported Tuesday, September 22, that college unions in Pittsburgh are writing protections against artificial intelligence teachers and evaluators into their contract talks.
read more
Tyler Bickford, president of the University of Pittsburgh faculty union, said universities have moved fast to adopt AI tools with what he called "much more kind of inconsistent thinking and policy development about guardrails," leaving open whether software grades student work or stands in for instructors.
Sources: PublicSource · ↑ top
Events
Wiz Khalifa Opens the Wylie in the Hill District
Latest developments: Wiz Khalifa told Pittsburgh City Paper in an interview published Tuesday, September 22, that he will open the Hill District's new venue, Citizens Live at The Wylie, on Friday, October 2, promising "lots of energy and a lot of weed smoke."
read more
The Pittsburgh rapper, who grew up in the city and broke through with "Black and Yellow," headlines the first show at Citizens Live at The Wylie, the new concert hall on Wylie Avenue in the Hill District.
Sources: Pittsburgh City Paper · ↑ top
Backyard Docs Spreads Across Several Venues
Latest developments: Pittsburgh City Paper reported Tuesday, September 22, that the Backyard Docs Film Festival, which started as a do-it-yourself backyard screening series, has grown into a multi-day event running at several Pittsburgh venues.
read more
This year's program takes up labor fights, immigration enforcement in the courts, a campaign to stop a pipeline, a fresh look at the East Palestine derailment, and a popular local haunt with a grim history.
Sources: Pittsburgh City Paper · ↑ top
October Fills With Oktoberfests, Apples, and Giant Pumpkins
Latest developments: The Post-Gazette published its October food calendar Tuesday, September 22, listing Oktoberfest celebrations, apple harvest events, and giant pumpkin weigh-offs across the Pittsburgh region.
read more
Pittsburgh City Paper's food column the same morning reported that Oktoberfest season has opened around the city and that the Pleasure Bar has closed.
Sources: Pittsburgh Post-Gazette · Pittsburgh City Paper · ↑ top
Sports
Pirates (79-77)
Up Next · Cardinals @ Pirates · Tue Sep 22, 6:40 PM
Steelers (1-1, T-2nd in AFC North)
Up Next · Bengals @ Steelers · Sun Sep 27, 1:00 PM
Around the Teams
SNR Drive Takes Apart the Trip to Foxborough
Latest developments: Matt Williamson and Wes Uhler spent Monday evening's SNR Drive, posted September 21 on the Steelers' channel, working through the Week 2 game at New England, with Steelers radio voice Rob King calling into the show.
read more
The pair opened with first impressions of the offense, brought King on for roughly 25 minutes, returned to the game, then ran through the rest of the league's Week 2 results and Monday night's game. The Steelers host the Cincinnati Bengals at Acrisure Stadium Sunday, September 27, at 1 p.m. ET on CBS.
Sources: Pittsburgh Steelers (YouTube) · ↑ top
Louis Lipps Cooks Louisiana Food on the North Shore
Latest developments: The Post-Gazette profiled former Steelers receiver Louis Lipps on Tuesday, September 22, and printed the recipes he brings to his tailgate outside Acrisure Stadium.
read more
Lipps, who grew up in Louisiana and caught passes for the Steelers from 1984 through 1991, feeds his tailgate crowd the food he was raised on before home games on the North Shore.
Sources: Post-Gazette Steelers · ↑ top
Team USA
The USWNT Pipeline Draws Alarms
Latest developments: ESPN published an assessment Tuesday, September 22, asking whether the United States women's national team's grip on the world game is slipping as its youth sides keep losing.
read more
The piece follows a run of poor results at the under-20 and under-17 levels, among them Brazil's penalty-shootout elimination of the United States in the round of 16 at the Under-20 Women's World Cup, and weighs how much of the alarm the numbers actually support.
Sources: ESPN Soccer · ↑ top
Reading
- Stratechery — Amazon Blocks Muse, Amazon’s Moat, Aggregator v Aggregator. Ben Thompson argues Amazon's move to block the AI agent Muse was predictable, and that the two sides still have room to strike a deal because Amazon's warehouses, delivery network, and physical-world investments amount to a moat artificial intelligence cannot cross on its own.
- Ed Zitron — Premium: The Hater's Guide To AI Debt (Part 1). Zitron traces how hyperscalers finance their graphics-processor buildouts, arguing that the debt piling up behind the AI boom rests on revenue that has yet to appear.
- Cal Newport — Superintelligence is a Fairy Tale. But Chasing It Can Still Cause Harm.. Newport dismisses the notion that current systems lead to a superintelligence capable of killing billions, a claim Anthropic employees floated publicly, and argues that the race to build it does real damage regardless.
Markets
S&P 500 7,638.10 = +0.0% Dow 51,812.90 ▼ -1.2% Nasdaq 26,404.59 ▲ +0.6% WTI crude 101.25 ▲ +2.7% EUR/USD 1.1502 ▼ -1.0% GBP/USD 1.3421 ▼ -0.8% USD/JPY 155.77 ▲ +1.3%
Feed Health
Security: 24 of 24 feeds loaded, 59 items in the 24-hour window. No recent items: Krebs on Security, Securelist (Kaspersky), Sophos News, Unit 42 (Palo Alto), Google Online Security Blog, Graham Cluley, Microsoft Security Blog, Google Project Zero, The DFIR Report, Kim Zetter (Zero Day), Frank on Fraud.
Pittsburgh: 9 of 9 feeds loaded, 60 items in the 48-hour window.
Business and Politics: 8 of 8 feeds loaded, 60 items in the 36-hour window.
Events: 4 of 4 feeds loaded, 9 items in the 120-hour window. No recent items: NEXTpittsburgh Events, NEXTpittsburgh Arts & Entertainment.
Sports media: 6 of 6 feeds loaded, 30 items in the 96-hour window. No recent items: Footbahlin with Ben Roethlisberger, Ben Roethlisberger / Channel Seven (YouTube).
Team USA: 3 of 3 feeds loaded, 24 items in the 72-hour window. No recent items: Guardian Olympics.
Reading: 3 of 3 feeds loaded, 12 items in the 336-hour window.
Markets (Yahoo Finance): 7 of 7 rows
Weather (NWS): 3 forecast periods
Scores (ESPN, plaintextsports): 2 teams via plaintextsports; mlb: ESPN failed (mlb: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nfl: ESPN failed (nfl: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nhl: ESPN failed (nhl: HTTP 403 (server: AkamaiGHost)); used plaintextsports
Summaries: 3 model call(s) served by claude-opus-5 (235s of model time; $1.65 at API list price).