F5 confirmed attackers exploited a BIG-IP Access Policy Manager zero-day for unauthenticated remote code execution, the third security appliance in two days—after Check Point and Arista—to fall to live exploitation.
Emerging Trends and Key Updates
- Trend Attackers burned zero-days from edge to browser as F5 BIG-IP APM fell to CVE-2026-94127, UTA0565 chained Chrome and Windows bugs, and Next.js handed over server code.
- Trend Britain's NCSC conceded artificial intelligence favors attackers just as 80,000 relay servers surfaced funneling users in China into American frontier models, likely to clone them.
- Update · updated ShinyHunters escalated its claimed FBI breach with a demand that the bureau retract how its threat report characterizes the group, or the stolen files leak.
- Trend Energy and banking politics collided as Brent crude slid a sixth day, American refiners fought Trump's diesel export ban, and Swiss senators rejected UBS's capital compromise.
- Update · updated Zitron sharpened his accounting of the buildout, arguing hyperscalers' claimed graphics processor purchases far outnumber the chips actually installed and earning revenue.
- Trend Local institutions reshuffled as Pittsburgh acknowledged running license plate readers since 2006, Penn State faced demands over closing branch campuses, and Mutual Aid returned an ambulance base to Latrobe.
Security
1. F5 BIG-IP APM Zero-Day Lands Amid an Edge Appliance Rout
Latest developments: F5 disclosed on September 22, 2026 that attackers exploit CVE-2026-94127 as a zero-day to run code on BIG-IP with no login, narrowing the exposure to systems where Access Policy Manager acts as an OAuth authorization server issuing tokens to applications, and shipped engineering hotfixes; Check Point added on September 23, 2026 that probing of CVE-2026-85102, the pre-authentication remote code execution flaw in Quantum Security Gateway it patched on September 9, 2026, began days after that release, and Arista pressed customers to patch CVE-2026-93952 immediately.
read more
BIG-IP Access Policy Manager fronts VPN and single sign-on for large enterprises, and Check Point's Security Management Server writes firewall policy for entire fleets. CISA has cataloged CVE-2026-94127, CVE-2026-93616, CVE-2026-85102, and CVE-2026-93952 as actively exploited; apply the vendor hotfixes now and hunt for web service activity dating to July 23, 2026.
Sources: Help Net Security · The Hacker News · BleepingComputer · SecurityWeek · ↑ top
2. ShinyHunters Demands the FBI Retract a Threat Report
Latest developments: ShinyHunters attached a demand to its claimed Federal Bureau of Investigation breach on September 23, 2026: retract the way an FBI threat report describes the group, or it leaks the stolen files.
read more
The extortion gang says it entered FBI systems through a new Oracle PeopleSoft zero-day and took records on current and former employees plus job applicants; a sample of 5,000 alleged agents shown to 404 Media carries names, home addresses, phone numbers, and spouse details. The FBI has not confirmed the intrusion.
Sources: SecurityWeek · The Hacker News · BleepingComputer · 404 Media · ↑ top
3. Defenders Concede AI's Edge to Attackers
Latest developments: Dave Chismon, chief technology officer for architecture at the United Kingdom's National Cyber Security Centre, wrote on September 22, 2026 that artificial intelligence will help attackers considerably more than defenders and that attack volume will climb as automated defenses lag; the same week, Outerlimit left stealth with $16 million in pre-seed funding for a decentralized authorization layer that discovers, watches, and blocks harmful autonomous actions, and researchers released Prismor, an open-source control plane that checks every tool call by Claude Code, Codex, or Cursor against policy and returns allow, warn, or block.
read more
Reports of misaligned and runaway agents have pushed the AI safety argument out of the lab and into procurement, with executives endorsing slower development and vendors selling runtime brakes. Organizations running coding agents should require a policy checkpoint between the agent and the shell, file system, and credential store.
Sources: The Record · Dark Reading · SecurityWeek · Help Net Security · ↑ top
4. Next.js, Bifrost, and WordPress Hand Over Server Code
Latest developments: Vercel patched a Next.js flaw on September 22, 2026 in which ImageResponse, the feature that renders Open Graph preview images, runs attacker code on the server when an application feeds it values pulled from the request URL; Maxim Labs' Bifrost AI gateway carries CVE-2026-90898, rated 9.8, which hands an unauthenticated attacker arbitrary commands through one HTTP request on every HTTP transport release before 2.1.0 that leaves management authentication off; and WordPress assigned CVE-2026-87902 to the path traversal it fixed in 7.1.2, listing every release from 4.7.0 through 7.1.1 as affected.
read more
Three widely deployed pieces of the developer stack now reach server code execution from an unauthenticated request: the Next.js image renderer, an open-source gateway that routes to more than 20 large language model providers, and the WordPress theme loader. Upgrade Next.js, move Bifrost to 2.1.0 or enable management authentication, and take WordPress to 7.1.2 or the patched release on your branch.
Sources: The Hacker News · The Hacker News · Help Net Security · ↑ top
5. UTA0565 Chains Chrome and Windows Zero-Days
Latest developments: A Chinese threat actor that researchers track as UTA0565 ran fake websites on September 3 and 4, 2026 that chained two Google Chrome flaws, CVE-2026-85046 and CVE-2026-87491, with CVE-2026-85880 in the Windows Advanced Local Procedure Call subsystem, breaking out of the browser sandbox to install malware called CLEANGULP.
read more
The three flaws were zero-days when the crew used them, and the chain takes a victim from a single web page to code running on Windows. Google shipped Chrome 154 this week closing 108 vulnerabilities, several of them critical memory safety and memory corruption bugs; update Chrome and apply the Windows patches.
Sources: The Hacker News · SecurityWeek · ↑ top
6. Relays Mask Chinese Access to Frontier Models
Latest developments: Dark Reading reported on September 22, 2026 that more than 80,000 artificial intelligence relay servers hide the identities of users in China as they query the most capable American large language models, and that the likeliest motive is cloning those models.
read more
Export controls and vendor terms bar Chinese access to frontier systems, and the relay layer routes around both by laundering the origin of each request. Model providers and enterprises reselling API access should treat relay traffic as an abuse and distillation problem, not merely a billing one.
Sources: Dark Reading · ↑ top
Business and Politics
Oil Falls a Sixth Day as Washington and Tehran Talk
Latest developments: Brent crude slid below $99 a barrel in Asian trading Wednesday, September 23, a sixth straight daily decline and the longest losing streak in more than 12 months, after Saudi Arabia began testing its East-West pipeline for structural integrity and pressure and American officials met Iranian counterparts on the sidelines of the United Nations General Assembly.
read more
The war with Iran shut the Strait of Hormuz and carried crude above $100 a barrel, and traders are now pricing in a diplomatic opening plus the return of Saudi pipeline capacity that moves barrels around the waterway. Shipping still shows the strain: rates for the largest supertankers on Middle East-to-China routes have more than doubled since late August to a record $1.2 million a day, and the dollar climbed Wednesday to an eight-week high against a basket of currencies as bets on further Federal Reserve rate increases outweighed the fall in oil.
Sources: FT World · WSJ World News · FT Home · WSJ Markets · ↑ top
American Refiners Fight the Diesel Export Ban
Latest developments: The Wall Street Journal reported Wednesday, September 23, that United States oil companies are fiercely opposing the diesel export ban President Trump endorsed a day earlier, while Republican lawmakers in difficult races keep pressing him to impose it, and European diesel futures jumped Wednesday on the prospect that American cargoes stop crossing the Atlantic.
read more
Refiners believed they had persuaded Washington to leave diesel shipments alone until Trump said he would support suspending them, and a ban would strand American barrels at home while tightening a European market already short of fuel. The surge costs European drivers 203 million euros a day, with motorists paying 40% more at each fill-up than they did at the start of 2026.
Sources: WSJ World News · WSJ Markets · FT Home · ↑ top
The Swiss Upper House Turns Down the UBS Capital Compromise
Latest developments: The upper house of the Swiss parliament rejected the softer compromise UBS had pushed for Wednesday, September 23, and backed a regime requiring the bank to hold 90% in top-tier capital against its foreign subsidiaries, down from the 100% the government first planned.
read more
Bern wrote the full-backing requirement after the 2023 rescue of Credit Suisse left Switzerland with a single globally systemically important bank, and UBS has lobbied against it for months on the argument that it traps capital abroad. The vote leaves the lender close to the government's position and sets the terms other supervisors will measure their own subsidiary rules against.
Sources: FT World · WSJ World News · ↑ top
Pittsburgh
Weather
Today: Partly Sunny, high 65F.
Tonight: Mostly Cloudy, low 51F.
Thursday: Mostly Sunny, high 66F.
Business
Mutual Aid Puts an Ambulance Base Back in Latrobe
Latest developments: TribLive reported Wednesday, September 23, that Mutual Aid Ambulance Service has moved a base back into Latrobe, three years after it pulled out when lease negotiations with the city stalled.
read more
Mutual Aid Ambulance Service covers much of Westmoreland County, and its 2023 departure left Latrobe without a crew stationed inside the city. The restored base shortens response times for the city and the surrounding communities the service answers.
Black Brewhouse Splits One Counter Two Ways
Latest developments: Pittsburgh City Paper reported Wednesday, September 23, on Black Brewhouse, a tasting lounge where TLC Libations and Windy Bridges serve as the mainstay brands and share the rent, the equipment, and the customers who walk in.
read more
The arrangement lets two small Pittsburgh drink makers carry the cost of a storefront neither would fill alone, and the operators describe ambitions that run past two labels behind one bar.
Sources: Pittsburgh City Paper · ↑ top
Around Town
Pittsburgh Has Read License Plates Since 2006
Latest developments: Daniel Shak, manager at the city of Pittsburgh's office of Public Safety Technology, told NEXTpittsburgh in a report published Wednesday, September 23, that the city has run automatic license plate readers since 2006, even though it buys nothing from Flock Safety.
read more
Flock's camera network has drawn surveillance fights in municipalities across the country, and Pittsburgh sits outside that contract while operating its own plate-reading equipment. The readers log vehicles passing fixed points and feed the records into police work.
Sources: NEXTpittsburgh · ↑ top
What Penn State Owes the Towns It Leaves
Latest developments: The TribLive editorial board argued Wednesday, September 23, that Pennsylvania State University carries an obligation to the communities losing the branch campuses it is shutting down.
read more
Penn State built a physical presence across the state, and its campus closures pull employment, enrollment, and foot traffic out of small towns that organized themselves around those buildings. The editorial presses the university to account for what happens to the properties and the people left behind.
Ligonier Township Holds Off on Lead Tests at Ligonier Beach
Latest developments: Ligonier Township officials have ruled out testing for lead at the large empty pool on the former Ligonier Beach property along Route 30, at least for now, TribLive reported Wednesday, September 23.
read more
The township owns the shuttered swimming complex in Westmoreland County and has weighed what to do with the basin sitting on the site. Skipping the testing for the moment defers the cost and the questions any positive result would raise about reuse of the property.
Events
Josias Figueirido at Zynka Gallery
Latest developments: The Post-Gazette published a review Wednesday, September 23, of the Spanish artist Josias Figueirido's show at Zynka Gallery in Sharpsburg, describing a dream world where technology and tradition play against each other.
read more
Zynka Gallery sits in Sharpsburg, along the Allegheny River northeast of Pittsburgh, and gives Figueirido his Western Pennsylvania showing.
Sources: Post-Gazette Arts & Entertainment · ↑ top
Lauri Ann West Marks Ten Years With a Free Week
Latest developments: TribLive reported Wednesday, September 23, that the Lauri Ann West Community Center is marking the 10th anniversary of its O'Hara Township facility with a week of free programs open to the community.
read more
The center runs classes, camps, and recreation programs for the Fox Chapel area out of its O'Hara building, and it is handing out a week's worth of those offerings at no charge to mark the decade.
Sports
Pirates (80-77)
Tue Sep 22 · Cardinals 0 · Pirates 2 · Final
Up Next · Cardinals @ Pirates · Wed Sep 23, 6:40 PM
Steelers (1-1, T-2nd in AFC North)
Up Next · Bengals @ Steelers · Sun Sep 27, 1:00 PM
Around the Teams
Heyward Turns to Bengals Week
Latest developments: Cam Heyward and co-host Hayden posted their Week 2 reaction Wednesday morning, September 23, on Not Just Football, taking apart what has gone wrong on both sides of the ball at New England and previewing the divisional game against the Cincinnati Bengals.
read more
Heyward, the Steelers' defensive captain, runs the show with his brother Hayden; this episode works through the offense's collapse, the defense's share of the blame, Week 2 storylines around the league, and a new segment roasting football scenes from Hollywood movies. Cincinnati visits Acrisure Stadium Sunday, September 27, at 1 p.m. ET on CBS.
Sources: Not Just Football with Cam Heyward · ↑ top
Jared Jones Carries a One-Hitter in St. Louis
Latest developments: Right-hander Jared Jones and two relievers held the St. Louis Cardinals to a single hit Tuesday, September 22, the Post-Gazette reported, running the Pirates' winning streak to five games in the closing week of the season.
read more
Jones, who missed time earlier in his career to arm trouble, has given the Pirates a second front-line starter behind Paul Skenes heading into the winter, and the club is finishing out a season that lost its playoff stakes on September 19.
Sources: Post-Gazette Pirates · ↑ top
Team USA
The NWSL Writes a Youth Development Rule
Latest developments: Sources told ESPN in a report published Wednesday, September 23, that the National Women's Soccer League has adopted a mechanism letting clubs flag youth players and later sign them to contracts that would not count fully against the salary cap.
read more
The rule gives NWSL teams a financial reason to develop American teenagers in house, and it lands while the United States women's national team's youth sides keep losing and the federation's talent pipeline draws alarms.
Sources: ESPN Soccer · ↑ top
Reading
- Stratechery — More on Muse, Amazon, and Walmart; Muse and Expedia; Whither Google?. Ben Thompson argues Meta's Muse agent needs Walmart as the partner that lets it outlast Amazon's blockade, and that Expedia is bargaining to hold its middleware position between travelers and suppliers. He then asks why Google, holding the best position of anyone, has yet to move.
- Ed Zitron — Where're All The AI Chips?. Zitron traces the gap between the graphics processors the hyperscalers say they are buying and the ones actually installed and earning revenue, and argues the accounting behind the artificial intelligence buildout hides how little of that hardware is producing returns.
Markets
S&P 500 7,638.10 = +0.0% Dow 51,812.90 ▼ -1.2% Nasdaq 26,404.59 ▲ +0.6% WTI crude 99.00 ▼ -2.1% EUR/USD 1.1486 ▼ -1.0% GBP/USD 1.3395 ▼ -1.0% USD/JPY 156.36 ▲ +1.6%
Feed Health
Security: 24 of 24 feeds loaded, 76 items in the 24-hour window. No recent items: Krebs on Security, Securelist (Kaspersky), Sophos News, Unit 42 (Palo Alto), Google Online Security Blog, Cisco Talos, Graham Cluley, Google Project Zero, The DFIR Report, Kim Zetter (Zero Day), Frank on Fraud, Wired Security.
Pittsburgh: 9 of 9 feeds loaded, 60 items in the 48-hour window.
Business and Politics: 8 of 8 feeds loaded, 60 items in the 36-hour window.
Events: 4 of 4 feeds loaded, 13 items in the 120-hour window. No recent items: NEXTpittsburgh Events, NEXTpittsburgh Arts & Entertainment.
Sports media: 6 of 6 feeds loaded, 30 items in the 96-hour window.
Team USA: 3 of 3 feeds loaded, 24 items in the 72-hour window. No recent items: Guardian Olympics.
Reading: 3 of 3 feeds loaded, 12 items in the 336-hour window.
Markets (Yahoo Finance): 7 of 7 rows
Weather (NWS): 3 forecast periods
Scores (ESPN, plaintextsports): 2 teams via plaintextsports; mlb: ESPN failed (mlb: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nfl: ESPN failed (nfl: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nhl: ESPN failed (nhl: HTTP 403 (server: AkamaiGHost)); used plaintextsports
Summaries: 3 model call(s) served by claude-opus-5 (314s of model time; $1.83 at API list price).