Cisco Talos surfaced the first malware that runs its own command and control through AI chatbots, while attackers worked the network edge hard, exploiting a 10.0-rated VeloCloud Orchestrator flaw and looting 996 Zyxel switches.
Emerging Trends and Key Updates
- Trend Attackers keep hammering network edge gear, with Arista confirming exploitation of a 10.0-rated VeloCloud Orchestrator bug, an unpatched D-Link DIR-822A zero-day, and 996 looted Zyxel switches.
- Trend AI threads through the day's malware, from Cisco Talos finding CLOSEDQUORUM asking a chatbot for its next orders to Patrick Wardle turning Meta Muse into a Mac backdoor.
- Trend State-aligned operations are drawing operational answers, as Japanese authorities dismantled the country's first North Korean laptop farm and Trellix tracked SideCopy pushing spear-phishing into Indian universities.
- Update · new Abdelhamid Naceri outed themselves as the Nightmare Eclipse leaker and released another Defender zero-day, while LAPSUS$ Chapter II hijacked three Elsevier domains to taunt the FBI.
- Update · new The Iran energy shock cuts both ways: Brent slid toward $98 on a possible Hormuz reopening, Ineos idled three Hull plants, and Western Pennsylvania heating oil ballooned.
- Trend Pittsburgh-area schools are negotiating with AI directly, as Pennsylvania Creates trains teenagers to use it responsibly and Pitt's faculty union bargains against AI teachers and evaluators.
Security
1. VeloCloud Orchestrator and D-Link Routers Under Fire
Latest developments: Arista said on September 22, 2026 that attackers exploit CVE-2026-93952, a 10.0-rated flaw in on-premises VeloCloud Orchestrator that lets a remote attacker with no login reach internal functions and the orchestrator host; D-Link warned the same day of CVE-2026-86296, a maximum-severity zero-day in legacy DIR-822A dual-band Wi-Fi routers that carries public proof-of-concept code and no patch; and Dinh Ho Anh Khoa of Viettel Cyber Security published details showing that CVE-2026-65660, which Microsoft first filed as a 6.5 spoofing bug, gives an authenticated user remote code execution on SharePoint Server 2016, 2019, and Subscription Edition.
read more
VeloCloud Orchestrator manages the Edge devices in a VeloCloud SD-WAN, and only orchestrators that authenticate their Edges with certificates carry the flaw. Microsoft has shipped SharePoint patches, D-Link owners of DIR-822A hardware have no fix and should retire the devices.
Sources: The Hacker News · BleepingComputer · The Hacker News · The Hacker News · ↑ top
2. Chinese-Speaking Crew Loots 996 Zyxel Switches
Latest developments: GreyNoise reported on September 21, 2026 that a Chinese-speaking threat actor has exploited CVE-2026-7273 since August to pull sensitive data off 996 unpatched Zyxel GS1900 Smart Managed Switches in 48 countries, and CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day with a federal patch deadline of Thursday, September 24, 2026.
read more
CVE-2026-7273 is a stack-based buffer overflow rated 8.8 in the Zyxel GS1900 line of Gigabit Ethernet switches that yields arbitrary operating system command execution; the compromised devices sit mostly in Italy, the United States, Taiwan, South Korea, and other European Union countries. Zyxel has shipped fixes, and CISA cataloged a Veeam flaw granting SYSTEM access alongside it.
Sources: Help Net Security · BleepingComputer · The Hacker News · SecurityWeek · ↑ top
3. CLOSEDQUORUM Runs Its Own Command and Control
Latest developments: Cisco Talos released CAIRN, a research toolkit that classifies AI-integrated malware entirely from file metadata such as submitter, import hash, domain, and AI provider, with no download and no detonation, and used it on September 22, 2026 to surface CLOSEDQUORUM, a binary that drives its entire command and control loop through AI chatbots with no operator involvement.
read more
CLOSEDQUORUM is the first reported implant that decides its own next actions through a language model instead of waiting on a human handler, which moves large stretches of the attack chain off the attacker's keyboard. Talos published CAIRN so defenders can hunt for the same pattern in their own telemetry.
Sources: Cisco Talos · Cisco Talos · Wired Security · Help Net Security · ↑ top
4. WordPress Core Yields Two Paths to Server Code
Latest developments: Researchers published technical details and a working proof-of-concept exploit for Click2Shell on September 21, 2026, and a second core flaw surfaced the same week: Comment2Shell, CVE-2026-93485, which WordPress fixed on September 17, 2026 in version 7.1.1.
read more
Click2Shell is a cross-site request forgery bug in WordPress core that installs and previews a theme when a logged-in administrator opens a crafted link, ending in remote code execution; Comment2Shell lets an anonymous visitor leave a comment carrying a hidden script that runs code on the server once an administrator views the page. Site owners should move to WordPress 7.1.1 now.
Sources: BleepingComputer · The Hacker News · SecurityWeek · ↑ top
5. Nightmare Eclipse Drops a Defender Zero-Day
Latest developments: Abdelhamid Naceri, a former employee of Microsoft Germany, revealed that they are the exploit leaker known as Nightmare Eclipse and Chaotic Eclipse, and over the weekend released another Microsoft Defender zero-day exploit, this one blocking the antivirus from taking updates.
read more
A machine whose Defender cannot pull updates runs on stale detection while an attacker works, and Microsoft has no fix out. Administrators should monitor Defender update status and signature age across their fleets.
Sources: SecurityWeek · BleepingComputer · ↑ top
6. Japan Dismantles Its First North Korean Laptop Farm
Latest developments: Japanese authorities took down the country's first North Korean laptop farm, SecurityWeek reported on September 22, 2026, as the United States, Japan, Germany, and Australia published a joint report on the WaterPlum campaign that counts funds or credentials taken from more than 7,000 cryptocurrency wallets.
read more
WaterPlum, the operation also tracked as Contagious Interview, poses as artificial intelligence and blockchain companies, recruits through fake job postings, and has infected at least 30,000 devices in more than 100 countries, moving $10.71 million in stolen cryptocurrency to North Korea. Web designers, engineers, and cryptocurrency specialists are the primary targets.
Sources: SecurityWeek · The Hacker News · ↑ top
7. Patrick Wardle Turns Meta Muse Into a Backdoor
Latest developments: Security researcher Patrick Wardle released a proof-of-concept on September 21, 2026 showing that malware already running on a Mac flips one hidden Muse setting so that a user's dictated prompts travel to the attacker rather than to Meta, opening a second route into the assistant beyond the ClickFix hijack Ars Technica described.
read more
Muse is the artificial intelligence assistant Meta launched with extraordinarily broad access to its owner's machine, and Meta has not patched the flaw. Whoever takes the assistant inherits every permission its owner granted the app.
Sources: The Hacker News · Ars Technica Security · ↑ top
8. LAPSUS$ Chapter II Hijacks Elsevier Domains
Latest developments: Three domains and web portals belonging to Elsevier, the Dutch academic publisher, redirected visitors on the evening of September 21, 2026 to a page branded LAPSUS$ GROUP, Chapter II that carried a signed statement taunting the FBI and counting down to a future victim; researchers at Cloudskope clocked the redirect at 78 minutes, running from roughly 7:49 p.m. until someone cleared it before 10:09 p.m. central time.
read more
Elsevier has offered no explanation of how the redirect happened. The LAPSUS$ name belongs to the extortion crew whose members law enforcement arrested in 2022, and this page claims a revival.
Sources: Help Net Security · ↑ top
9. SideCopy Spear-Phishes Indian Academia
Latest developments: Trellix researchers reported on September 22, 2026 that SideCopy has pushed past Indian government targets into academic institutions, opening with spear-phishing that abuses mshta.exe to run malicious scripts around standard security controls and ends in ReverseRAT.
read more
ReverseRAT gives the operators remote control of a compromised machine, and universities carry the research data and personnel records that make them worth the trip. Defenders should alert on mshta.exe launching from mail attachments and links.
Sources: The Hacker News · ↑ top
10. Stolen Ribon Credentials Inject Scripts Into BigCommerce Stores
Latest developments: BigCommerce notified multiple merchants on September 21, 2026 that attackers compromised credentials for third-party Ribon applications and used that access to inject malicious scripts into their online stores.
read more
The ecommerce platform BigCommerce lets merchants install third-party apps, and Ribon's stolen credentials gave attackers a path straight into storefront pages where shoppers enter payment details. Merchants running Ribon apps should audit their storefront scripts and rotate application credentials.
Sources: BleepingComputer · ↑ top
Business and Politics
Iran Dangles a Hormuz Reopening and Brent Breaks Below $100
Latest developments: Oil fell for a fifth straight session Tuesday, September 22, reaching roughly $98 a barrel after Saudi Arabia signaled it will reopen the East-West pipeline, shut for two weeks by drone strikes, and after reports that Iran offered to reopen the Strait of Hormuz within seven days if the United States eases military pressure.
read more
The offer surfaced as world leaders gathered at the United Nations General Assembly, where President Trump spoke Tuesday morning. Markets swung with it: the dollar touched a seven-week high against a basket of currencies before giving the move back, gold traded inside a $4,300 to $4,400 range, Treasury yields slipped, and a global rally in artificial intelligence shares stalled. Hormuz carries roughly a fifth of the world's seaborne oil, and the diesel and inflation shock running through American prices hangs on whether the waterway opens.
Sources: WSJ World News · FT Home · WSJ Markets · WSJ Markets · WSJ Markets · WSJ Markets · ↑ top
Xi Brings Taiwan to the Summit With Trump
Latest developments: Washington and Beijing agreed to open an "AI dialogue" ahead of the summit, the Financial Times reported Tuesday, September 22, and the Wall Street Journal reported the same morning that Chinese chief executives will likely skip the meeting, a sign both sides expect little business to come out of it.
read more
Chinese leader Xi Jinping goes into his coming summit with President Trump aiming first to extend the trade truce between the two economies, and he also plans to raise Taiwan, Iran, and the race to dominate artificial intelligence. Beijing quietly helped stage the mainland visit of Taiwan's opposition leader and reads Trump as a rare window to persuade the island that resistance is futile. Trump addressed the United Nations General Assembly Tuesday morning on wars, tariffs, and energy before the China talks.
Sources: WSJ World News · FT Home · WSJ World News · WSJ US Business · WSJ World News · FT World · ↑ top
Ineos Idles Three Hull Chemical Plants as Gas Prices Soar
Latest developments: Ineos, the conglomerate Jim Ratcliffe owns, suspended production at three chemical plants in Hull on Tuesday, September 22, as the oil and gas price surge touched off by the war with Iran made the factories uneconomic to run.
read more
The three plants employ 300 people, and the shutdown marks the energy shock moving from prices into shuttered European industrial capacity. Bank of America told clients the same morning that higher-for-longer natural gas prices on the continent will lift European utilities' earnings, the mirror image of the squeeze crushing gas-hungry manufacturers.
Sources: FT Markets · WSJ Markets · ↑ top
DWS Weighs Emergency Curbs on Its German Property Fund
Latest developments: The Financial Times reported Tuesday, September 22, that DWS, the asset manager Deutsche Bank controls, is considering emergency measures to limit withdrawals from its open-ended German real estate fund as retail investors pull money out.
read more
Open-ended property funds promise daily liquidity against buildings that take months to sell, and gating one of Germany's largest such retail products would mark the sharpest sign yet of strain in European commercial real estate. Investors across the German market have been redeeming steadily as valuations fall and financing costs stay high.
Pittsburgh
Weather
Today: Chance Rain Showers, high 62F.
Tonight: Chance Rain Showers, low 54F.
Wednesday: Chance Rain Showers, high 64F.
Business
Tandem Foods Expands in Allegheny County
Latest developments: Governor Josh Shapiro announced Tuesday, September 22, a $42 million expansion by the nutritional snack food manufacturer Tandem Foods in Allegheny County.
read more
Tandem Foods will add 83 jobs and hold onto 446 existing full-time positions over the next three years under the project. The expansion lands as Pennsylvania courts food manufacturers, among them Chobani's new Lehigh Valley plant.
Home Heating Oil Prices Balloon Across Western Pennsylvania
Latest developments: The Post-Gazette reported Tuesday, September 22, that home heating oil prices across Western Pennsylvania have ballooned heading into winter, with one customer saying, "I might not make it."
read more
Roughly one in ten Pennsylvania households burns oil for heat, and the distillate squeeze that carried the average United States diesel price above $6.50 a gallon feeds the same barrel into home furnaces. Households on fixed incomes in rural Westmoreland, Armstrong, and Indiana counties, where natural gas lines never reached, absorb the increase directly.
Sources: Pittsburgh Post-Gazette · ↑ top
Chobani's Lehigh Valley Plant Needs Pennsylvania Milk
Latest developments: The Post-Gazette reported Tuesday, September 22, that state officials call Chobani's new Lehigh Valley plant a game-changer for Pennsylvania dairy and now need farmers to supply it.
read more
Governor Josh Shapiro, Agriculture Secretary Russell Redding, and Community and Economic Development Secretary Rick Siger courted the yogurt maker to Pennsylvania, and filling the plant's tanks depends on dairy farms that have been shrinking in number for two decades. Pittsburgh's Turner Dairy figures in the supply picture.
Sources: Pittsburgh Post-Gazette · ↑ top
Rural King Looks at Hillcrest Shopping Center in Lower Burrell
Latest developments: TribLive reported Tuesday, September 22, that the farm-and-home chain Rural King is eyeing the Hillcrest Shopping Center in Lower Burrell for a new store.
read more
Rural King sells livestock feed, tools, clothing, and hardware, and a Lower Burrell location would give the Alle-Kiski Valley a single stop for home, clothing, and farming goods. Hillcrest Shopping Center sits along Leechburg Road in Westmoreland County.
Around Town
Pennsylvania Creates Teaches Teenagers to Use AI
Latest developments: TribLive reported Tuesday, September 22, on Pennsylvania Creates, an initiative that aims to make teenagers artificial intelligence literate and responsible in their use of it.
read more
West Allegheny High School senior Trevor Manno, who leans on the tools for schoolwork, describes their usefulness firsthand. The program arrives as Pittsburgh universities bargain over guardrails for the same technology in their classrooms.
Westmoreland County Gives Away Narcan Next Week
Latest developments: TribLive reported Tuesday, September 22, that Westmoreland County officials will blanket the region with free doses of the overdose-reversing drug naloxone during an annual statewide prevention event next week.
read more
The giveaway rides on Pennsylvania's yearly prevention push, and county officials want the medication in as many hands as they can reach across Westmoreland's boroughs and townships.
The Flood Watch Runs to Wednesday Morning on the First Day of Fall
Latest developments: The Post-Gazette reported Tuesday, September 22, that the flood watch will likely expire Tuesday morning for Allegheny County with a dry week behind it, while the watch holds through 8 a.m. Wednesday, September 23, for other parts of Southwestern Pennsylvania, and WTAE marked Tuesday and Wednesday as Impact Days.
read more
Thick clouds and an east wind hold highs in the low 60s Tuesday and Wednesday, with scattered rounds of showers rather than all-day washouts. Washington County residents along a swollen creek told WTAE they expect another round of flooding after two straight weekends of high water, one saying, "My trailer might go down the creek next."
Sources: Pittsburgh Post-Gazette · TribLive · WTAE · WTAE · KDKA · ↑ top
Sto-Rox Climbs Out of the Red
Latest developments: The Post-Gazette reported Tuesday, September 22, that the Sto-Rox School District has balanced its books after years of financial struggle.
read more
Sto-Rox, which serves McKees Rocks and Stowe Township in Allegheny County, has spent years among the most financially distressed districts in Western Pennsylvania, running deficits that drew state scrutiny and repeated warnings about its ability to stay solvent.
Sources: Pittsburgh Post-Gazette · ↑ top
Pitt's Faculty Union Bargains Over AI Teachers
Latest developments: PublicSource reported Tuesday, September 22, that college unions in Pittsburgh are writing protections against artificial intelligence teachers and evaluators into their contract talks.
read more
Tyler Bickford, president of the University of Pittsburgh faculty union, said universities have moved fast to adopt AI tools with what he called "much more kind of inconsistent thinking and policy development about guardrails," leaving open whether software grades student work or stands in for instructors.
Sources: PublicSource · ↑ top
Events
Wiz Khalifa Opens the Wylie in the Hill District
Latest developments: Wiz Khalifa told Pittsburgh City Paper in an interview published Tuesday, September 22, that he will open the Hill District's new venue, Citizens Live at The Wylie, on Friday, October 2, promising "lots of energy and a lot of weed smoke."
read more
The Pittsburgh rapper, who grew up in the city and broke through with "Black and Yellow," headlines the first show at Citizens Live at The Wylie, the new concert hall on Wylie Avenue in the Hill District.
Sources: Pittsburgh City Paper · ↑ top
Backyard Docs Spreads Across Several Venues
Latest developments: Pittsburgh City Paper reported Tuesday, September 22, that the Backyard Docs Film Festival, which started as a do-it-yourself backyard screening series, has grown into a multi-day event running at several Pittsburgh venues.
read more
This year's program takes up labor fights, immigration enforcement in the courts, a campaign to stop a pipeline, a fresh look at the East Palestine derailment, and a popular local haunt with a grim history.
Sources: Pittsburgh City Paper · ↑ top
October Fills With Oktoberfests, Apples, and Giant Pumpkins
Latest developments: The Post-Gazette published its October food calendar Tuesday, September 22, listing Oktoberfest celebrations, apple harvest events, and giant pumpkin weigh-offs across the Pittsburgh region.
read more
Pittsburgh City Paper's food column the same morning reported that Oktoberfest season has opened around the city and that the Pleasure Bar has closed.
Sources: Pittsburgh Post-Gazette · Pittsburgh City Paper · ↑ top
Sports
Pirates (79-77)
Up Next · Cardinals @ Pirates · Tue Sep 22, 6:40 PM
Steelers (1-1, T-2nd in AFC North)
Up Next · Bengals @ Steelers · Sun Sep 27, 1:00 PM
Around the Teams
Week 2 Grades Fall Hardest on Rodgers and the Line
Latest developments: The Post-Gazette published its Week 2 grades Tuesday morning, September 22, handing poor marks to quarterback Aaron Rodgers, receiver DK Metcalf, and the offensive line after the trip to New England.
read more
The grades follow a week in which the Steelers' offense produced almost nothing at Gillette Stadium, head coach Mike McCarthy took the blame publicly, and the team began weighing changes up front, with rookie tackle Max Iheanachor in the conversation. Pittsburgh hosts the Cincinnati Bengals Sunday, September 27, at 1 p.m. ET on CBS.
Sources: Post-Gazette Steelers · Post-Gazette Steelers · ↑ top
SNR Drive Takes Apart the Trip to Foxborough
Latest developments: Matt Williamson and Wes Uhler spent Monday evening's SNR Drive, posted September 21 on the Steelers' channel, working through the Week 2 game at New England, with Steelers radio voice Rob King calling into the show.
read more
The pair opened with first impressions of the offense, brought King on for roughly 25 minutes, returned to the game, then ran through the rest of the league's Week 2 results and Monday night's game. The Steelers host the Cincinnati Bengals at Acrisure Stadium Sunday, September 27, at 1 p.m. ET on CBS.
Sources: Pittsburgh Steelers (YouTube) · ↑ top
Louis Lipps Cooks Louisiana Food on the North Shore
Latest developments: The Post-Gazette profiled former Steelers receiver Louis Lipps on Tuesday, September 22, and printed the recipes he brings to his tailgate outside Acrisure Stadium.
read more
Lipps, who grew up in Louisiana and caught passes for the Steelers from 1984 through 1991, feeds his tailgate crowd the food he was raised on before home games on the North Shore.
Sources: Post-Gazette Steelers · ↑ top
Team USA
The USWNT Pipeline Draws Alarms
Latest developments: ESPN published an assessment Tuesday, September 22, asking whether the United States women's national team's grip on the world game is slipping as its youth sides keep losing.
read more
The piece follows a run of poor results at the under-20 and under-17 levels, among them Brazil's penalty-shootout elimination of the United States in the round of 16 at the Under-20 Women's World Cup, and weighs how much of the alarm the numbers actually support.
Sources: ESPN Soccer · ↑ top
Reading
- Stratechery — Amazon Blocks Muse, Amazon’s Moat, Aggregator v Aggregator. Ben Thompson argues Amazon's move to block the AI agent Muse was predictable, and that the two sides still have room to strike a deal because Amazon's warehouses, delivery network, and physical-world investments amount to a moat artificial intelligence cannot cross on its own.
- Ed Zitron — Premium: The Hater's Guide To AI Debt (Part 1). Zitron traces how hyperscalers finance their graphics-processor buildouts, arguing that the debt piling up behind the AI boom rests on revenue that has yet to appear.
- Cal Newport — Superintelligence is a Fairy Tale. But Chasing It Can Still Cause Harm.. Newport dismisses the notion that current systems lead to a superintelligence capable of killing billions, a claim Anthropic employees floated publicly, and argues that the race to build it does real damage regardless.
Markets
S&P 500 7,638.10 = +0.0% Dow 51,812.90 ▼ -1.2% Nasdaq 26,404.59 ▲ +0.6% WTI crude 101.25 ▲ +2.7% EUR/USD 1.1502 ▼ -1.0% GBP/USD 1.3421 ▼ -0.8% USD/JPY 155.77 ▲ +1.3%
Feed Health
Security: 24 of 24 feeds loaded, 65 items in the 24-hour window. No recent items: Krebs on Security, CISA Advisories, Securelist (Kaspersky), Sophos News, Unit 42 (Palo Alto), Google Online Security Blog, Graham Cluley, Microsoft Security Blog, Google Project Zero, The DFIR Report, Kim Zetter (Zero Day), Frank on Fraud.
Pittsburgh: 9 of 9 feeds loaded, 60 items in the 48-hour window.
Business and Politics: 8 of 8 feeds loaded, 60 items in the 36-hour window.
Events: 4 of 4 feeds loaded, 9 items in the 120-hour window. No recent items: NEXTpittsburgh Events, NEXTpittsburgh Arts & Entertainment.
Sports media: 6 of 6 feeds loaded, 30 items in the 96-hour window. No recent items: Footbahlin with Ben Roethlisberger, Not Just Football with Cam Heyward, Ben Roethlisberger / Channel Seven (YouTube).
Team USA: 3 of 3 feeds loaded, 25 items in the 72-hour window. No recent items: Guardian Olympics.
Reading: 3 of 3 feeds loaded, 12 items in the 336-hour window.
Markets (Yahoo Finance): 7 of 7 rows
Weather (NWS): 3 forecast periods
Scores (ESPN, plaintextsports): 2 teams via plaintextsports; mlb: ESPN failed (mlb: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nfl: ESPN failed (nfl: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nhl: ESPN failed (nhl: HTTP 403 (server: AkamaiGHost)); used plaintextsports
Summaries: 3 model call(s) served by claude-opus-5 (254s of model time; $1.90 at API list price).