Bitget disclosed that suspected North Korean hackers drained $351.6 million from its hot and warm wallets, the largest exchange theft of the year.
Emerging Trends and Key Updates
- Trend Bitget's $351.6 million loss to suspected North Korean operators shows thieves moving upstream to custodians, while prosecutors seized bank accounts of Tether-linked payments group Capstone.
- Trend Microsoft's Storm-2570 profile shows one affiliate playbook behind Qilin, DragonForce, Anubis, and BERT, so post-compromise tradecraft names the intrusion earlier than any ransom note does.
- Trend Russian drones that damaged Kyiv data centers on September 23 cut service at four or more providers, collapsing the distance between a physical hit and a network outage.
- Update · new Attackers are hitting Roundcube's CVE-2026-48842 SQL injection live, fake payroll installers plant ScreenConnect and MacSync, and a no-permission app roots OnePlus 15 handsets that remain unpatched.
- Update · new Iran's seven-day ceasefire offer and a possible Hormuz reopening paused the bond selloff as Tokyo readied yen intervention, eurozone business lending halved, and mortgage rates topped 7%.
- Update · updated Pittsburgh's weekend brings the 49th Great Race as Joey Porter Jr.'s contract standoff enters another game week and the Pirates' home finale turned fans toward 2027.
Security
1. Roundcube Webmail SQL Injection Draws Live Attacks
Latest developments: Researchers pinned the Roundcube flaw the Canadian Centre for Cyber Security flagged to CVE-2026-48842, rated 8.1, a pre-authentication SQL injection in the virtuser_query plugin that traces to backslash handling in a preg_replace() call.
read more
The bug affects Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, and an attacker reaches it with no login before injecting code. Anyone running a self-hosted Roundcube server should install the May 2026 patch immediately.
Sources: The Hacker News · SecurityWeek · BleepingComputer · ↑ top
2. Fake Installers Deliver ScreenConnect and MacSync
Latest developments: Allure Security reported on September 25, 2026 that an attacker advertises desktop applications for three large United States payroll and human resources platforms that have never shipped one, and the installer plants ScreenConnect configured for silent remote control; Kaspersky traced the latest MacSync variant to a counterfeit cryptocurrency wallet called Toria, which runs its own website and draws traffic from X and Telegram.
read more
Ryan Merritt, director of security research at Allure Security, notes all three payroll providers deliver only web applications, so any downloadable client is a fake, and the MacSync variant steals credentials, wallet data, and files while pulling fresh payloads from public iCloud calendar events. Block installers for software that has no desktop edition and treat unsolicited wallet apps as hostile.
Sources: Help Net Security · Help Net Security · BleepingComputer · ↑ top
3. OnePlus, Cloudflare, and File Watchers Give Up Data
Latest developments: Rasmus Moorats chained two flaws in OnePlus software to root a OnePlus 15 running current OxygenOS from an app that requests no permissions, and OnePlus told him the same flaws reach many more of its phones and OPPO's with no patch yet; Cloudflare and the researchers who found it disclosed on September 24, 2026 that a Containers flaw let one paying customer read disk data that other customers' containers left behind on the same server; and researchers showed that the file-change notification systems in Windows, Linux, and Android leak keystroke timing, browsing activity, and WhatsApp media events.
read more
Three separate boundaries that platforms ask users to trust—the Android permission model, container tenant isolation, and the operating system file watcher—hand over root, neighboring data, and user behavior. Cloudflare has fixed its flaw; OnePlus and OPPO owners have no patch to install.
Sources: The Hacker News · The Hacker News · SecurityWeek · ↑ top
4. Russia Pairs Drone Strikes With Cyber Sabotage in Europe
Latest developments: The internet monitoring group NetBlocks recorded partial connectivity losses at four or more internet providers serving Kyiv and other parts of Ukraine after a Russian drone attack on September 23, 2026 damaged data centers, as Dark Reading documented the wider pattern of cyber sabotage, disinformation, and drone attacks against the European countries supplying Ukraine.
read more
Russia combines network intrusion, influence operations, and physical strikes on the buildings that hold servers, so a data center hit now reads as an outage first. Operators with Ukrainian or frontline European infrastructure should plan capacity outside single physical sites.
Sources: Dark Reading · The Record · ↑ top
5. Bitget Loses $351.6 Million to Suspected North Korean Hackers
Latest developments: Bitget disclosed on September 25, 2026 that attackers it suspects work for North Korea took $351.6 million out of its hot and warm wallets.
read more
Bitget, a cryptocurrency exchange, lost the funds from the wallets it keeps online to serve customer withdrawals. Exchanges holding warm wallets on internet-reachable infrastructure should re-examine signing controls and withdrawal limits.
Sources: BleepingComputer · ↑ top
6. Storm-2570 Runs One Playbook Behind Four Ransomware Brands
Latest developments: Microsoft published tradecraft on September 24, 2026 for Storm-2570, a ransomware affiliate that reuses the same post-compromise tools and techniques whether it ends up deploying Qilin, DragonForce, Anubis, or BERT.
read more
Storm-2570 rents whichever encryptor it wants and leaves a consistent signature in the hours before deployment. Defenders who hunt that signature stop the intrusion ahead of encryption rather than after it.
Sources: Microsoft Security Blog · ↑ top
Business and Politics
Iran Offers a Seven-Day Ceasefire and a Hormuz Reopening
Latest developments: Iran's foreign minister handed Washington a seven-day ceasefire proposal overnight into Friday, September 25, saying the Strait of Hormuz could reopen within a week, and the global bond selloff paused as Brent retreated from its highs.
read more
The war has kept the Strait of Hormuz shut, and the prospect of reopening it dragged oil prices lower Friday, pulled eurozone government bond yields down, and steadied United States stock futures after a week that drove long-dated Treasury yields to two-decade highs. Traders weighed the diplomacy against continued Houthi missile fire at Saudi energy infrastructure, and analysts called the respite for debt markets tentative.
Sources: FT Home · FT World · WSJ Markets · WSJ Markets · ↑ top
Tokyo Signals Yen Intervention With Washington's Blessing
Latest developments: Japanese Finance Minister Satsuki Katayama said Friday, September 25, that President Trump raised the yen's weakness with Prime Minister Sanae Takaichi and that Treasury Secretary Scott Bessent would support fresh currency intervention.
read more
The yen has slid as the Bank of Japan tightens slowly from a 1.25% policy rate while American yields climb, and Katayama's remarks put Tokyo closer to selling dollars for the first time with explicit American cover. A Japanese intervention would jolt the dollar-yen market and the carry trades built on it.
Sources: FT World · WSJ Markets · ↑ top
Prosecutors Seize Accounts of a Tether-Linked Payments Group
Latest developments: United States prosecutors have seized bank accounts belonging to the payments group Capstone, the Financial Times reported Friday, September 25.
read more
Prosecutors allege Capstone moved hundreds of millions of dollars illegally for crypto companies, including Tether, at the direction of a Caribbean bank. The seizure reaches into the correspondent-banking plumbing that carries stablecoin flows, the channel banks rely on to know who stands behind crypto payments.
Eurozone Business Lending Halves in August
Latest developments: Bank lending to eurozone businesses fell by half in August, figures published Friday, September 25, showed, the clearest sign yet that the European Central Bank's rate increase has begun to choke corporate investment.
read more
The collapse in new credit lands as German consumer confidence drops to its lowest level since May on energy costs and as the European Commission's energy commissioner warns national capitals that the continent faces its worst winter for energy prices since 2022, pressing the Trump administration to keep diesel flowing across the Atlantic. Weak credit, expensive fuel, and a widening French-German yield spread leave the euro exposed to renewed falls.
Sources: WSJ World News · WSJ World News · FT World · ↑ top
Pittsburgh
Weather
Today: Sunny, high 70F.
Tonight: Mostly Clear, low 49F.
Saturday: Mostly Sunny, high 71F.
Business
Thousands Skip Pennsylvania's Utility Assistance
Latest developments: The Post-Gazette reported Friday, September 25, that thousands of eligible Pennsylvania households never sign up for the state's utility assistance programs and that regulators remain unconvinced by proposals to enroll them automatically.
read more
Pennsylvania's low-income programs discount electric and gas bills, and residential ratepayers across the state carry their entire cost. Automatic enrollment would pull in customers who qualify and never apply, a group that grows in consequence as winter heating bills rise.
Sources: Pittsburgh Post-Gazette · ↑ top
Mortgage Rates Top 7% for the First Time Since January 2025
Latest developments: The weekly survey published Thursday, September 24, put the average United States 30-year mortgage rate above 7% for the first time since January 2025, a fifth consecutive weekly increase.
read more
The climb follows the bond selloff that carried long-dated Treasury yields to their highest levels in two decades, and it raises the monthly cost of a Pittsburgh-area purchase for buyers already squeezed on price. Each of the past five weeks added to the rate.
Around Town
Pennsylvania's Poor Bridges Grow Fewer
Latest developments: The Post-Gazette reported Friday, September 25, that the latest national bridge report still rates many Pennsylvania spans poor while the state's count keeps improving.
read more
Pennsylvania carries one of the heaviest loads of aging bridges in the country, a legacy that drives the Pennsylvania Department of Transportation's repair schedule and the detours around Pittsburgh. The federal ratings track each span's deck, superstructure, and substructure.
Sources: Pittsburgh Post-Gazette · ↑ top
A Dry, Seasonal Weekend and Shorter Days
Latest developments: KDKA marked Friday, September 25, as the region's daylight "flip" day as fall air settled over Pittsburgh, and WTAE forecast a dry, seasonal weekend across Western Pennsylvania.
read more
The stretch of cool, sunny weather follows Friday morning's frost and holds through the Great Race weekend, with no rain in the forecast for Western Pennsylvania.
Mama Lu, 95, Runs Pittsburgh's Feed
Latest developments: Pittsburgh City Paper profiled Lucille "Mama Lu" Rago on Friday, September 25.
read more
Rago, 95, has built a large TikTok and Instagram following with videos showing off her flashy clothes, her Steelers fandom, and her humor.
Sources: Pittsburgh City Paper · ↑ top
Events
The Great Race Weekend Arrives
Latest developments: The weekend guides now in print carry the 49th Great Race, the Hollywood Theater's 100th anniversary, and A Landing Ovation into the Saturday and Sunday just ahead, September 26 and 27.
read more
The Great Race, Pittsburgh's annual road race, fills downtown and the East End streets this weekend, with the Dollar Bank Junior Great Race alongside it; the Hollywood Theater marks its centennial; and A Landing Ovation pairs Pittsburgh Ballet Theatre with Pittsburgh Opera. NEXTpittsburgh's guide adds fall festivals and outdoor recreation across the region.
Sources: Post-Gazette Arts & Entertainment · NEXTpittsburgh Events · ↑ top
Sports
Pirates (81-78)
Thu Sep 24 · Cardinals 1 · Pirates 2 · Final
Up Next · Pirates @ Tigers · Fri Sep 25, 6:40 PM
Steelers (1-1, T-2nd in AFC North)
Up Next · Bengals @ Steelers · Sun Sep 27, 1:00 PM
Around the Teams
Porter's Contract Fight Finds Precedent
Latest developments: The Post-Gazette recounted Friday, September 25, how Rod Woodson and Darren Perry fought the Steelers over contracts and stayed in Pittsburgh anyway, as Joey Porter Jr.'s standoff reaches another game week; Matt Williamson and Wes Uhler delivered another Porter update on Thursday's SNR Drive.
read more
Cornerback Joey Porter Jr. and the Steelers remain apart on an extension, and Asante Samuel Jr. has played well in his place, a stretch the Post-Gazette detailed Thursday. Cincinnati visits Acrisure Stadium Sunday, September 27, at 1 p.m. ET on CBS.
Sources: Post-Gazette Steelers · Post-Gazette Steelers · Pittsburgh Steelers (YouTube) · ↑ top
The Pirates Point at 2027
Latest developments: The Post-Gazette reported Friday, September 25, that fans at the home finale spent the afternoon weighing what next season holds, and its season review argues September gives the Pirates reason to expect a different 2027.
read more
Pittsburgh missed the playoffs again, and the closing weeks brought the pieces the front office will build on: Paul Skenes finished his year with his 200th strikeout in his last start at PNC Park and faces an uncertain winter, and Brandon Lowe's bat carried the offense through the final homestand.
Sources: Post-Gazette Pirates · Post-Gazette Pirates · Post-Gazette Pirates · ↑ top
An FDNY Retiree Marks His Last Day at Acrisure
Latest developments: The Post-Gazette published Mike Callan's story Friday, September 25, two days before he celebrates his retirement at the Steelers game.
read more
Callan, a New York City firefighter who worked the cleanup in lower Manhattan after the September 11 attacks, will spend his retirement day at Acrisure Stadium for Sunday's game against the Cincinnati Bengals.
Sources: Post-Gazette Steelers · ↑ top
Team USA
ESPN Ranks the Americans by Club Form
Latest developments: ESPN published its Player Performance Index Friday, September 25, ranking the 50 best United States men's national team players by their form at club level as the new World Cup cycle opens.
read more
Mauricio Pochettino has called a young group into the first three-week September international window, and the index measures which Americans arrive playing well for their clubs and which lag. The window runs through a set of friendlies that open the cycle toward the 2030 World Cup.
Sources: ESPN Soccer · ↑ top
Reading
- Ed Zitron — Where're All The AI Chips?. Zitron chases the gap between the volume of AI accelerators the hyperscalers say they are buying and the compute capacity and revenue those chips actually produce, arguing the buildout's disclosed numbers fail to reconcile.
- Stratechery — An Interview with Colossus EIC Jeremy Stern About Profiling Mark Zuckerberg. Ben Thompson talks with Colossus editor-in-chief Jeremy Stern about reporting long profiles of Mark Zuckerberg and other technology leaders, and what that access reveals about how the industry's founders see themselves.
Markets
S&P 500 7,692.62 ▲ +1.2% Dow 51,674.22 ▼ -0.9% Nasdaq 26,787.67 ▲ +2.6% WTI crude 95.49 ▼ -6.7% EUR/USD 1.1450 ▼ -0.9% GBP/USD 1.3340 ▼ -1.0% USD/JPY 157.25 ▲ +1.6%
Feed Health
Security: 24 of 24 feeds loaded, 61 items in the 24-hour window. No recent items: Krebs on Security, Securelist (Kaspersky), Sophos News, Unit 42 (Palo Alto), Google Online Security Blog, Google Project Zero, The DFIR Report, Kim Zetter (Zero Day), Frank on Fraud, Wired Security.
Pittsburgh: 9 of 9 feeds loaded, 60 items in the 48-hour window.
Business and Politics: 8 of 8 feeds loaded, 60 items in the 36-hour window.
Events: 4 of 4 feeds loaded, 16 items in the 120-hour window.
Sports media: 6 of 6 feeds loaded, 30 items in the 96-hour window.
Team USA: 3 of 3 feeds loaded, 30 items in the 72-hour window. No recent items: Guardian Olympics.
Reading: 3 of 3 feeds loaded, 12 items in the 336-hour window. No recent items: Cal Newport.
Markets (Yahoo Finance): 7 of 7 rows
Weather (NWS): 3 forecast periods
Scores (ESPN, plaintextsports): 2 teams via plaintextsports; mlb: ESPN failed (mlb: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nfl: ESPN failed (nfl: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nhl: ESPN failed (nhl: HTTP 403 (server: AkamaiGHost)); used plaintextsports
Summaries: 3 model call(s) served by claude-opus-5 (363s of model time; $1.89 at API list price).