================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Tuesday, September 22, 2026 - 7:05 AM EDT ================================================================ Cisco Talos pulled apart the first known malware implant that runs its own command and control through an AI model, with no human operator in the loop. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets | Feed Health EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] A Chinese-speaking crew looted 996 Zyxel switches via CVE-2026-7273 under a two-day CISA deadline, while two WordPress core flaws now have public paths to server code. see: Chinese-Speaking Crew Loots 996 Zyxel Switches; WordPress Core Yields Two Paths to Server Code * [TREND] Attackers are pushing AI into the loop: CLOSEDQUORUM drives its own command and control through chat, and Patrick Wardle's proof-of-concept flips a Muse setting to steal dictated prompts. see: CLOSEDQUORUM Runs Its Own Command and Control; Patrick Wardle Turns Meta Muse Into a Backdoor * [UPDATE (new)] Stolen credentials for third-party Ribon apps let attackers inject scripts into BigCommerce storefronts, the latest breach merchants inherited from code they embed. see: Stolen Ribon Credentials Inject Scripts Into BigCommerce Stores * [UPDATE (new)] Japan dismantled its first North Korean laptop farm as the United States, Japan, Germany, and Australia jointly detailed the WaterPlum campaign funding Pyongyang. see: Japan Dismantles Its First North Korean Laptop Farm * [TREND] Skepticism about the AI buildout runs through Zitron's tally of hyperscaler debt, Newport's dismissal of superintelligence, and Pitt faculty bargaining against AI evaluators. see: Premium: The Hater's Guide To AI Debt (Part 1); Superintelligence is a Fairy Tale. But Chasing It Can Still Cause Harm.; Pitt's Faculty Union Bargains Over AI Teachers * [UPDATE (new)] Pittsburgh's flood watch runs to Wednesday morning on the first day of fall as home heating oil prices balloon across Western Pennsylvania heading into winter. see: The Flood Watch Runs to Wednesday Morning on the First Day of Fall; Home Heating Oil Prices Balloon Across Western Pennsylvania SECURITY ---------------------------------------------------------------- 1. CHINESE-SPEAKING CREW LOOTS 996 ZYXEL SWITCHES Vulnerabilities and Exploits · [exploit, patch, kev] Latest developments: GreyNoise reported on September 21, 2026 that a Chinese-speaking threat actor has exploited CVE-2026-7273 since August to pull sensitive data off 996 unpatched Zyxel GS1900 Smart Managed Switches in 48 countries, and CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day with a federal patch deadline of Thursday, September 24, 2026. CVE-2026-7273 is a stack-based buffer overflow rated 8.8 in the Zyxel GS1900 line of Gigabit Ethernet switches that yields arbitrary operating system command execution; the compromised devices sit mostly in Italy, the United States, Taiwan, South Korea, and other European Union countries. Zyxel has shipped fixes, and CISA cataloged a Veeam flaw granting SYSTEM access alongside it. - Help Net Security: https://www.helpnetsecurity.com/2026/09/22/zyxel-switches-cve-2026-7273-vulnerability-exploited/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-actively-exploited-zyxel-flaw-by-thursday/ - The Hacker News: https://thehackernews.com/2026/09/zyxel-and-veeam-flaws-under-active.html - CISA Advisories: https://www.cisa.gov/news-events/alerts/2026/09/21/cisa-adds-one-known-exploited-vulnerability-catalog 2. CLOSEDQUORUM RUNS ITS OWN COMMAND AND CONTROL AI Security · [ai, malware, threat-intel] Latest developments: Cisco Talos released CAIRN, a research toolkit for hunting, classifying, and tracking AI-integrated malware, and used it on September 22, 2026 to surface CLOSEDQUORUM, a binary that drives its entire command and control loop through AI chatbots with no operator involvement. CLOSEDQUORUM is the first reported implant that decides its own next actions through a language model instead of waiting on a human handler, which moves large stretches of the attack chain off the attacker's keyboard. Talos published CAIRN so defenders can hunt for the same pattern in their own telemetry. - Cisco Talos: https://blog.talosintelligence.com/the-closed-quorum-inside-the-first-reported-autonomous-ai-c2-implant/ - Cisco Talos: https://blog.talosintelligence.com/introducing-cairn-frontier-tracking-for-ai-integrated-malware/ - Wired Security: https://www.wired.com/story/a-tool-for-tracking-ai-integrated-malware-uncovered-an-autonomous-command-system/ 3. WORDPRESS CORE YIELDS TWO PATHS TO SERVER CODE Vulnerabilities and Exploits · [patch, rce, cms] Latest developments: Researchers published technical details and a working proof-of-concept exploit for Click2Shell on September 21, 2026, and a second core flaw surfaced the same week: Comment2Shell, CVE-2026-93485, which WordPress fixed on September 17, 2026 in version 7.1.1. Click2Shell is a cross-site request forgery bug in WordPress core that installs and previews a theme when a logged-in administrator opens a crafted link, ending in remote code execution; Comment2Shell lets an anonymous visitor leave a comment carrying a hidden script that runs code on the server once an administrator views the page. Site owners should move to WordPress 7.1.1 now. - BleepingComputer: https://www.bleepingcomputer.com/news/security/wordpress-click2shell-flaw-lets-hackers-execute-php-on-the-server/ - The Hacker News: https://thehackernews.com/2026/09/wordpress-comment2shell-flaw-can-turn.html - SecurityWeek: https://www.securityweek.com/wordpress-patches-click2shell-vulnerability/ 4. JAPAN DISMANTLES ITS FIRST NORTH KOREAN LAPTOP FARM Nation-State Activity · [apt, cryptocurrency, law-enforcement] Latest developments: Japanese authorities took down the country's first North Korean laptop farm, SecurityWeek reported on September 22, 2026, as the United States, Japan, Germany, and Australia published a joint report on the WaterPlum campaign that counts funds or credentials taken from more than 7,000 cryptocurrency wallets. WaterPlum, the operation also tracked as Contagious Interview, poses as artificial intelligence and blockchain companies, recruits through fake job postings, and has infected at least 30,000 devices in more than 100 countries, moving $10.71 million in stolen cryptocurrency to North Korea. Web designers, engineers, and cryptocurrency specialists are the primary targets. - SecurityWeek: https://www.securityweek.com/japan-dismantles-first-north-korean-laptop-farm-as-us-and-allies-detail-wider-scheme/ - The Hacker News: https://thehackernews.com/2026/09/contagious-interview-campaign.html 5. PATRICK WARDLE TURNS META MUSE INTO A BACKDOOR AI Security · [ai, zero-day, macos] Latest developments: Security researcher Patrick Wardle released a proof-of-concept on September 21, 2026 showing that malware already running on a Mac flips one hidden Muse setting so that a user's dictated prompts travel to the attacker rather than to Meta, opening a second route into the assistant beyond the ClickFix hijack Ars Technica described. Muse is the artificial intelligence assistant Meta launched with extraordinarily broad access to its owner's machine, and Meta has not patched the flaw. Whoever takes the assistant inherits every permission its owner granted the app. - The Hacker News: https://thehackernews.com/2026/09/one-hidden-meta-muse-setting-could-let.html - Ars Technica Security: https://arstechnica.com/security/2026/09/muse-metas-extraordinarily-privileged-ai-assistant-has-a-serious-0-day/ 6. STOLEN RIBON CREDENTIALS INJECT SCRIPTS INTO BIGCOMMERCE STORES Data Breaches · [breach, supply-chain, ecommerce] Latest developments: BigCommerce notified multiple merchants on September 21, 2026 that attackers compromised credentials for third-party Ribon applications and used that access to inject malicious scripts into their online stores. The ecommerce platform BigCommerce lets merchants install third-party apps, and Ribon's stolen credentials gave attackers a path straight into storefront pages where shoppers enter payment details. Merchants running Ribon apps should audit their storefront scripts and rotate application credentials. - BleepingComputer: https://www.bleepingcomputer.com/news/security/bigcommerce-alerts-merchants-of-data-breach-linked-to-ribon-apps/ BUSINESS AND POLITICS ---------------------------------------------------------------- * Iran Dangles a Hormuz Reopening and Brent Breaks Below $100 Latest developments: Brent crude reversed early gains and fell under $100 a barrel Tuesday, September 22, after reports that Iran offered to reopen the Strait of Hormuz within seven days if the United States eases military pressure. The offer, surfacing as world leaders gather at the United Nations General Assembly where President Trump speaks Tuesday morning, whipsawed markets: the dollar touched a seven-week high against a basket of currencies before paring the move, gold slipped inside a $4,300 to $4,400 range, the 30-year Treasury yield fell, and a global rally in artificial intelligence shares stalled in European trade. Hormuz carries roughly a fifth of the world's seaborne oil, and the diesel and inflation shock running through American prices hangs on whether the waterway opens. - WSJ World News: https://www.wsj.com/world/middle-east/oil-prices-rise-as-hormuz-shipping-risks-persist-363fbeb1?mod=rss_worldnews - WSJ Markets: https://www.wsj.com/finance/stocks/ai-stock-rally-loses-steam-oil-prices-turn-negative-e19323a8?mod=rss_markets_main - WSJ Markets: https://www.wsj.com/livecoverage/stock-market-today-dow-sp-500-nasdaq-09-22-2026?mod=rss_markets_main - WSJ Markets: https://www.wsj.com/finance/currencies/asian-currencies-mixed-on-hopes-for-u-s-iran-negotiations-95e21ec2?mod=rss_markets_main * Xi Brings Taiwan to the Summit With Trump Latest developments: The Wall Street Journal reported Tuesday, September 22, that Beijing quietly helped stage the mainland visit of Taiwan's opposition leader and now reads President Trump as a rare window to persuade the island that resistance is futile. Chinese leader Xi Jinping goes into his coming summit with Trump aiming first to extend the trade truce between the two economies, and he also plans to raise Taiwan, Iran, and the race to dominate artificial intelligence, according to the Financial Times. Trump addresses the United Nations General Assembly Tuesday morning on wars, tariffs, and energy before the China talks. - WSJ World News: https://www.wsj.com/world/china/trump-xi-taiwan-f236f228?mod=rss_worldnews - FT Home: https://www.ft.com/content/9bea08f4-c9e8-450a-9d0f-0af0bf47b64e?syn-25a6b1a6=1 - WSJ World News: https://www.wsj.com/world/china/before-the-trump-xi-summit-an-insiders-read-on-how-beijing-sees-taiwan-3f2f5535?mod=rss_worldnews - WSJ US Business: https://www.wsj.com/articles/trumps-u-n-speech-and-china-talks-put-tariffs-ai-and-energy-in-focus-36a90be6?mod=pls_whats_news_us_business_f * DWS Weighs Emergency Curbs on Its German Property Fund Latest developments: The Financial Times reported Tuesday, September 22, that DWS, the asset manager Deutsche Bank controls, is considering emergency measures to limit withdrawals from its open-ended German real estate fund as retail investors pull money out. Open-ended property funds promise daily liquidity against buildings that take months to sell, and gating one of Germany's largest such retail products would mark the sharpest sign yet of strain in European commercial real estate. Investors across the German market have been redeeming steadily as valuations fall and financing costs stay high. - FT World: https://www.ft.com/content/d773c1d5-b515-48d7-9713-14c253972e3a?syn-25a6b1a6=1 PITTSBURGH ---------------------------------------------------------------- Weather: Today: Chance Rain Showers, high 62F. Tonight: Chance Rain Showers, low 54F. Wednesday: Chance Rain Showers, high 64F. Business: * Home Heating Oil Prices Balloon Across Western Pennsylvania Latest developments: The Post-Gazette reported Tuesday, September 22, that home heating oil prices across Western Pennsylvania have ballooned heading into winter, with one customer saying, "I might not make it." Roughly one in ten Pennsylvania households burns oil for heat, and the distillate squeeze that carried the average United States diesel price above $6.50 a gallon feeds the same barrel into home furnaces. Households on fixed incomes in rural Westmoreland, Armstrong, and Indiana counties, where natural gas lines never reached, absorb the increase directly. - Pittsburgh Post-Gazette: https://www.post-gazette.com/business/money/2026/09/22/western-pennsylvania-home-heating-oil-prices/stories/202609150058 * Chobani's Lehigh Valley Plant Needs Pennsylvania Milk Latest developments: The Post-Gazette reported Tuesday, September 22, that state officials call Chobani's new Lehigh Valley plant a game-changer for Pennsylvania dairy and now need farmers to supply it. Governor Josh Shapiro, Agriculture Secretary Russell Redding, and Community and Economic Development Secretary Rick Siger courted the yogurt maker to Pennsylvania, and filling the plant's tanks depends on dairy farms that have been shrinking in number for two decades. Pittsburgh's Turner Dairy figures in the supply picture. - Pittsburgh Post-Gazette: https://www.post-gazette.com/business/pittsburgh-company-news/2026/09/22/chobani-lehigh-valley-turner-dairy-shapiro-siger-redding/stories/202609160003 * Rural King Looks at Hillcrest Shopping Center in Lower Burrell Latest developments: TribLive reported Tuesday, September 22, that the farm-and-home chain Rural King is eyeing the Hillcrest Shopping Center in Lower Burrell for a new store. Rural King sells livestock feed, tools, clothing, and hardware, and a Lower Burrell location would give the Alle-Kiski Valley a single stop for home, clothing, and farming goods. Hillcrest Shopping Center sits along Leechburg Road in Westmoreland County. - TribLive: https://triblive.com/local/valley-news-dispatch/rural-king-eyeing-hillcrest-shopping-center-in-lower-burrell-for-new-location/ Around town: * The Flood Watch Runs to Wednesday Morning on the First Day of Fall Latest developments: The National Weather Service in Pittsburgh extended its flood watch through 8 a.m. Wednesday, September 23, and WTAE marked both Tuesday and Wednesday as Impact Days as more rounds of showers cross the region. Washington County residents along a swollen creek told WTAE they expect another round of flooding after two straight weekends of high water, one saying, "My trailer might go down the creek next." KDKA meteorologist Ron Smiley put Tuesday's high near 60 degrees on the first day of fall, with no warm-up behind it. - TribLive: https://triblive.com/local/regional/flood-watch-extended-for-southwestern-pa-to-midweek/ - WTAE: https://www.wtae.com/article/impact-day-more-rain-with-a-flood-watch-for-southwestern-pa/73815572 - WTAE: https://www.wtae.com/article/pennsylvania-flooding-creek-swells-washington-county/73829099 - KDKA: https://www.cbsnews.com/pittsburgh/news/cooler-temperatures-in-place-today-for-the-first-day-of-fall-in-the-pittsburgh-area/ * Sto-Rox Climbs Out of the Red Latest developments: The Post-Gazette reported Tuesday, September 22, that the Sto-Rox School District has balanced its books after years of financial struggle. Sto-Rox, which serves McKees Rocks and Stowe Township in Allegheny County, has spent years among the most financially distressed districts in Western Pennsylvania, running deficits that drew state scrutiny and repeated warnings about its ability to stay solvent. - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/education/2026/09/22/sto-rox-school-district-budget/stories/202609170039 * Pitt's Faculty Union Bargains Over AI Teachers Latest developments: PublicSource reported Tuesday, September 22, that college unions in Pittsburgh are writing protections against artificial intelligence teachers and evaluators into their contract talks. Tyler Bickford, president of the University of Pittsburgh faculty union, said universities have moved fast to adopt AI tools with what he called "much more kind of inconsistent thinking and policy development about guardrails," leaving open whether software grades student work or stands in for instructors. - PublicSource: https://www.publicsource.org/pitt-unions-ai-bargaining/ Events: * Wiz Khalifa Opens the Wylie in the Hill District Latest developments: Wiz Khalifa told Pittsburgh City Paper in an interview published Tuesday, September 22, that he will open the Hill District's new venue, Citizens Live at The Wylie, on Friday, October 2, promising "lots of energy and a lot of weed smoke." The Pittsburgh rapper, who grew up in the city and broke through with "Black and Yellow," headlines the first show at Citizens Live at The Wylie, the new concert hall on Wylie Avenue in the Hill District. - Pittsburgh City Paper: https://www.pghcitypaper.com/arts-entertainment-2/music/wiz-khalifa-citizens-live-at-the-wylie/ * Backyard Docs Spreads Across Several Venues Latest developments: Pittsburgh City Paper reported Tuesday, September 22, that the Backyard Docs Film Festival, which started as a do-it-yourself backyard screening series, has grown into a multi-day event running at several Pittsburgh venues. This year's program takes up labor fights, immigration enforcement in the courts, a campaign to stop a pipeline, a fresh look at the East Palestine derailment, and a popular local haunt with a grim history. - Pittsburgh City Paper: https://www.pghcitypaper.com/arts-entertainment-2/backyard-docs-highlights-labor-issues-ice-in-the-courts-and-more/ * October Fills With Oktoberfests, Apples, and Giant Pumpkins Latest developments: The Post-Gazette published its October food calendar Tuesday, September 22, listing Oktoberfest celebrations, apple harvest events, and giant pumpkin weigh-offs across the Pittsburgh region. Pittsburgh City Paper's food column the same morning reported that Oktoberfest season has opened around the city and that the Pleasure Bar has closed. - Pittsburgh Post-Gazette: https://www.post-gazette.com/life/food/2026/09/22/october-food-events/stories/202609270029 - Pittsburgh City Paper: https://www.pghcitypaper.com/food-drink/oktoberfest-kicks-off-pleasure-bar-closes-and-more-pittsburgh-food-news/ SPORTS ---------------------------------------------------------------- Pirates (79-77) Up Next · Cardinals @ Pirates · Tue Sep 22, 6:40 PM https://plaintextsports.com/mlb/2026-09-22/stl-pit Steelers (1-1, T-2nd in AFC North) Up Next · Bengals @ Steelers · Sun Sep 27, 1:00 PM https://plaintextsports.com/nfl/2026/teams/pittsburgh-steelers Around the Teams: * SNR Drive Takes Apart the Trip to Foxborough Latest developments: Matt Williamson and Wes Uhler spent Monday evening's SNR Drive, posted September 21 on the Steelers' channel, working through the Week 2 game at New England, with Steelers radio voice Rob King calling into the show. The pair opened with first impressions of the offense, brought King on for roughly 25 minutes, returned to the game, then ran through the rest of the league's Week 2 results and Monday night's game. The Steelers host the Cincinnati Bengals at Acrisure Stadium Sunday, September 27, at 1 p.m. ET on CBS. - Pittsburgh Steelers (YouTube): https://www.youtube.com/watch?v=ubHFY0RmqJI * Louis Lipps Cooks Louisiana Food on the North Shore Latest developments: The Post-Gazette profiled former Steelers receiver Louis Lipps on Tuesday, September 22, and printed the recipes he brings to his tailgate outside Acrisure Stadium. Lipps, who grew up in Louisiana and caught passes for the Steelers from 1984 through 1991, feeds his tailgate crowd the food he was raised on before home games on the North Shore. - Post-Gazette Steelers: https://www.post-gazette.com/life/food/2026/09/22/tailgating-steelers-louis-lipps-acrisure-stadium-pittsburgh-recipes/stories/202609270022 Team USA: * The USWNT Pipeline Draws Alarms Latest developments: ESPN published an assessment Tuesday, September 22, asking whether the United States women's national team's grip on the world game is slipping as its youth sides keep losing. The piece follows a run of poor results at the under-20 and under-17 levels, among them Brazil's penalty-shootout elimination of the United States in the round of 16 at the Under-20 Women's World Cup, and weighs how much of the alarm the numbers actually support. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/50000963/is-uswnt-talent-pipeline-risk-running-dry READING ---------------------------------------------------------------- * Stratechery -- Amazon Blocks Muse, Amazon’s Moat, Aggregator v Aggregator Ben Thompson argues Amazon's move to block the AI agent Muse was predictable, and that the two sides still have room to strike a deal because Amazon's warehouses, delivery network, and physical-world investments amount to a moat artificial intelligence cannot cross on its own. https://stratechery.com/2026/amazon-blocks-muse-amazons-moat-aggregator-v-aggregator/ * Ed Zitron -- Premium: The Hater's Guide To AI Debt (Part 1) Zitron traces how hyperscalers finance their graphics-processor buildouts, arguing that the debt piling up behind the AI boom rests on revenue that has yet to appear. https://www.wheresyoured.at/premium-the-haters-guide-to-ai-debt-part-1/ * Cal Newport -- Superintelligence is a Fairy Tale. But Chasing It Can Still Cause Harm. Newport dismisses the notion that current systems lead to a superintelligence capable of killing billions, a claim Anthropic employees floated publicly, and argues that the race to build it does real damage regardless. https://calnewport.com/superintelligence-is-a-fairy-tale-but-chasing-it-can-still-cause-harm/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,638.10 = +0.0% Dow 51,812.90 ▼ -1.2% Nasdaq 26,404.59 ▲ +0.6% WTI crude 101.25 ▲ +2.7% EUR/USD 1.1502 ▼ -1.0% GBP/USD 1.3421 ▼ -0.8% USD/JPY 155.77 ▲ +1.3% FEED HEALTH ---------------------------------------------------------------- Security: 24 of 24 feeds loaded, 59 items in the 24-hour window. No recent items: Krebs on Security, Securelist (Kaspersky), Sophos News, Unit 42 (Palo Alto), Google Online Security Blog, Graham Cluley, Microsoft Security Blog, Google Project Zero, The DFIR Report, Kim Zetter (Zero Day), Frank on Fraud. Pittsburgh: 9 of 9 feeds loaded, 60 items in the 48-hour window. Business and Politics: 8 of 8 feeds loaded, 60 items in the 36-hour window. Events: 4 of 4 feeds loaded, 9 items in the 120-hour window. No recent items: NEXTpittsburgh Events, NEXTpittsburgh Arts & Entertainment. Sports media: 6 of 6 feeds loaded, 30 items in the 96-hour window. No recent items: Footbahlin with Ben Roethlisberger, Ben Roethlisberger / Channel Seven (YouTube). Team USA: 3 of 3 feeds loaded, 24 items in the 72-hour window. No recent items: Guardian Olympics. Reading: 3 of 3 feeds loaded, 12 items in the 336-hour window. Markets (Yahoo Finance): 7 of 7 rows Weather (NWS): 3 forecast periods Scores (ESPN, plaintextsports): 2 teams via plaintextsports; mlb: ESPN failed (mlb: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nfl: ESPN failed (nfl: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nhl: ESPN failed (nhl: HTTP 403 (server: AkamaiGHost)); used plaintextsports Summaries: 3 model call(s) served by claude-opus-5 (235s of model time; $1.65 at API list price). ================================================================ Generated 2026-09-22 07:05 EDT. Updated weekdays at about 7:05 AM, 10:05 AM, 1:35 PM, and 7:35 PM ET, and weekends at about 8:05 AM and 7:35 PM ET. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 3 Team USA feeds; WSJ World News, WSJ Markets, WSJ US Business, WSJ Politics, The Economist, FT Home, FT World, FT Markets; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN or plaintextsports.com. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================