Attackers are exploiting two unpatched remote code execution zero-days in Citrix NetScaler ADC and NetScaler Gateway, and Citrix has published neither a confirmation nor a fix.
Quiet day: only 50 security items in the last 48 hours.
Emerging Trends and Key Updates
- Trend Attackers are running two unpatched NetScaler zero-days days after CISA cataloged live SharePoint exploitation, with a federal patching deadline for CVE-2026-65660 landing Monday.
- Trend Criminals keep buying their way onto screens, with Google ad placements pushing scareware that freezes Macs and Macfinger ClickFix lures coaxing victims into pasting attacker commands.
- Trend Conifers found 47 percent of detection rules in the average organization need attention, while CISA's new election plan names patching barriers as a top obstacle for county systems.
- Update · new A cyberattack knocked out non-emergency systems at Dyfed-Powys Police in Wales as counter-terrorism officers handled explosives arrests near RAF Fairford, the base flying Iran strikes.
- Trend European gas storage at record lows sets up an LNG bidding war with Asian buyers, while retail redemptions from private credit funds finally slowed.
- Update · new Washington County opens a flood recovery center as Pitt's Cathedral of Learning turns 100 and the Post-Gazette maps the races deciding Harrisburg.
Security
1. SharePoint Exploitation Puts Agencies on a Monday Deadline
Latest developments: SecurityWeek reported on September 27, 2026 that attackers now exploit CVE-2026-65660 in the wild, and the CISA patching deadline for federal agencies falls Monday, September 28, 2026.
read more
CVE-2026-65660, rated 8.8, is a code injection flaw in Microsoft Office SharePoint Server that gives an authenticated user remote code execution; CISA listed it alongside CVE-2026-67279 in MikroTik RouterOS. Patch both, and treat any internet-facing SharePoint server as a priority.
Sources: SecurityWeek · The Hacker News · ↑ top
2. Citrix NetScaler Zero-Days Under Active Exploitation
Latest developments: The security firm watchTowr reported on September 26, 2026 that attackers exploit two unpatched remote code execution zero-days in Citrix NetScaler ADC and NetScaler Gateway appliances, and some administrators have pulled their appliances off the network rather than wait for a fix.
read more
NetScaler ADC and Gateway terminate remote access and load-balance applications for enterprises worldwide, and remote code execution on one hands an attacker the network edge. Citrix has confirmed nothing and shipped nothing; take the appliances offline or lock down their management interfaces until a patch arrives.
Sources: The Hacker News · ↑ top
3. Scareware Ads and the Macfinger ClickFix Campaign
Latest developments: Ars Technica reported on September 25, 2026 that Google ad placements across the internet deliver scareware that freezes a Mac and tells its owner the machine carries an infection, and the SANS Internet Storm Center published a breakdown of the malware behind the Macfinger ClickFix campaign the same day.
read more
Both routes convince the person at the keyboard to act: the ad fakes an infection warning, and ClickFix lures hand the victim a command to paste. Train staff to treat any browser page claiming an infection as hostile, and block the paste-and-run pattern at the endpoint.
Sources: Ars Technica Security · SANS Internet Storm Center · ↑ top
4. A Cyberattack Disrupts Dyfed-Powys Police
Latest developments: Dyfed-Powys Police, the force covering southwest and mid Wales, said on September 25, 2026 that a cyberattack knocked out some of its non-emergency systems and may have exposed staff information.
read more
The force kept emergency response running while it worked through the outage and assessed what attackers reached. Police staff records carry home addresses and personal details that make officers targets, so the exposure question matters more than the downtime.
Sources: The Record · ↑ top
5. CISA Delivers an Election Security Plan
Latest developments: CISA published the election security plan that Homeland Security Secretary Markwayne Mullin ordered in July 2026, and it flags attacks on voter registration databases and the barriers that keep election offices from patching their systems.
read more
State and county election offices run the machinery of American voting on small budgets and thin staff, which leaves known vulnerabilities open for months. The plan sets out what the agency will do about both problems ahead of the next federal election cycle.
Sources: SecurityWeek · ↑ top
6. Conifers Finds Detection Rules Failing Quietly
Latest developments: Conifers assessed 14,652 detection rules across its customer base and found that 47 percent of the detections in the average organization need attention, with failures falling into five groups that start with logic bugs.
read more
The study covered rules customers wrote themselves and rules vendors manage inside SIEM, endpoint, cloud, identity, email, and network tools. A rule can show as deployed on a coverage dashboard and still never fire when an attacker uses the technique it targets, so test detections against real technique execution instead of trusting the dashboard.
Sources: Help Net Security · ↑ top
Business and Politics
Explosives Arrests at the British Base Flying Iran Strikes
Latest developments: Police in western England arrested several men Sunday, September 27, on suspicion of explosives offenses near RAF Fairford, the Royal Air Force base the United States Air Force has used to launch strikes on Iran, and counter-terrorism officers took over the investigation.
read more
RAF Fairford in Gloucestershire hosts American bombers running missions in the seven-month war with Iran, and British police declared a major incident and evacuated homes around the perimeter. An attack attempt on the launch point for American strikes carries the war onto British soil.
Swiss Voters Rule on Neutrality
Latest developments: Switzerland votes Sunday, September 27, on a measure that would bar the country from cooperating with any military alliance unless an enemy attacks it first.
read more
The referendum would write centuries of Swiss neutrality into a hard constitutional rule, cutting off the quiet defense cooperation Bern has built with European partners since Russia invaded Ukraine. A Yes vote would lock Switzerland out of joint procurement, air-defense coordination, and NATO-adjacent exercises for the duration of any conflict it does not directly enter.
Private Credit Redemptions Slow
Latest developments: Redemption requests from retail investors in private credit funds fell, the Financial Times reported Sunday, September 27, easing the withdrawal pressure that had built through the summer, though fund managers told the paper it remains too early to call the bottom.
read more
Retail money in semi-liquid private credit vehicles had been heading for the exits, forcing managers to meet redemptions out of a portfolio of loans that trade rarely. A slower pace of withdrawals relieves the funding mismatch that banks lending into the sector watch most closely.
Sources: FT Markets · ↑ top
Europe and Asia Head Into an LNG Bidding War
Latest developments: The Financial Times reported Sunday, September 27, that European Union gas storage sits at record lows heading into winter, setting up intensifying competition with Asian buyers for liquefied natural gas cargoes over the coming months.
read more
The war with Iran and the closure of the Strait of Hormuz have thinned the pool of seaborne cargoes just as Europe enters the heating season with its tanks emptier than at any point on record. Every cargo Asia outbids Europe for pushes European gas and power prices higher and squeezes energy-intensive industry, which has already idled plants in Britain.
Pittsburgh
Weather
Today: Mostly Sunny, high 71F.
Tonight: Mostly Cloudy, low 58F.
Monday: Mostly Cloudy, high 68F.
Business
CCAC Faculty Rally Over Their Contract
Latest developments: Community College of Allegheny County faculty members rallied Saturday, September 26, at the college's North Side campus as contract negotiations with the administration continue.
read more
CCAC runs four campuses across Allegheny County and enrolls the region's largest body of two-year students. The faculty took their bargaining fight outdoors on the North Side the same weekend the college marked its 60th year.
Washington County Opens a Flood Recovery Center
Latest developments: Washington County will host a Multi-Agency Response Center to help residents and business owners recover from the storm damage and flooding of the past two weekends, WPXI reported Sunday, September 27.
read more
Two straight weekends of heavy rain pushed Chartiers Creek and other streams over their banks, swamping buildings along Jefferson Avenue in Canton Township and prompting the township to declare a state of emergency on September 20. The response center gathers aid agencies in one place so flooded households and businesses can file damage claims and reach recovery programs without chasing them separately.
Around Town
The Cathedral of Learning Turns 100
Latest developments: The Post-Gazette published two pieces Sunday, September 27, marking the centennial of the University of Pittsburgh's Cathedral of Learning, one tracing how the tower became a Pittsburgh landmark and one collecting readers' memories of the building they call Cathy.
read more
The Gothic skyscraper anchors Pitt's Oakland campus, holds the Nationality Rooms, and serves as classroom space and civic symbol at once. The anniversary lands as Pitt runs the $3 billion "Proving Possible" fundraising campaign it opened September 25.
Sources: Pittsburgh Post-Gazette · ↑ top
The Races That Decide Harrisburg
Latest developments: The Post-Gazette laid out Sunday, September 27, the specific 2026 legislative contests that will determine which party controls the Pennsylvania House and Senate, with the election five weeks off on November 3.
read more
Democrats hold the Pennsylvania House by a single seat and Republicans hold the Senate, so a handful of suburban and Western Pennsylvania districts decide whether Governor Josh Shapiro governs with a split legislature or a friendlier one. Allegheny County mailed roughly 120,000 ballots to voters starting last weekend.
Sources: Pittsburgh Post-Gazette · ↑ top
The Nor'easter Sends Clouds and Little Else
Latest developments: WPXI, WTAE, and KDKA all forecast Sunday morning, September 27, that the nor'easter backing inland will hold most of its rain east of the region, leaving Pittsburgh cloudy and breezy with seasonable temperatures and a chance of light rain by evening.
read more
The Laurel Highlands ridges carry the best shower chance through the day. Kickoff at Acrisure Stadium at 1 p.m. falls inside the dry stretch.
Sources: WPXI · WTAE · KDKA · ↑ top
Sports
Pirates (81-80)
Sat Sep 26 · Pirates 3 · Tigers 4 · Final
Up Next · Pirates @ Tigers · Sun Sep 27, 3:10 PM
Steelers (1-1, T-2nd in AFC North)
Up Next · Bengals @ Steelers · Sun Sep 27, 1:00 PM
Penguins (0-0-0, 0 pts)
Up Next · Penguins @ Flyers · Wed Sep 30, 7:30 PM
Around the Teams
The Tight End Case Against Cincinnati
Latest developments: The Post-Gazette's scouting report, published Sunday morning, September 27, argues that head coach Mike McCarthy should follow the league-wide turn toward tight ends against the Cincinnati Bengals, and Gerry Dulac released his Week 3 picks the same morning.
read more
The Steelers open AFC North play against the undefeated Bengals at 1 p.m. Sunday at Acrisure Stadium on CBS, carrying the NFL's worst offense into the game with running back Rico Dowdle hurt and rookie lineman Gennings Dunker on injured reserve. Pat Freiermuth gives McCarthy the piece the Post-Gazette says the passing game has underused through two weeks.
Sources: Post-Gazette Steelers · Post-Gazette Steelers · ↑ top
Team USA
Eleven Debuts in a 4-1 Win Over Peru
Latest developments: ESPN reported Sunday, September 27, that Mauricio Pochettino handed out 11 debuts in the United States' 4-1 win over Peru in Orlando, Florida, eight of them to teenagers, and that the coach called himself "so proud" and said the play gave him goosebumps.
read more
The friendly Saturday, September 26, was the American men's first match since the 2026 World Cup and the opening of the cycle toward 2030. Sebastian Berhalter drew a 10 and Justin Ellis a 9 in ESPN's player ratings, and 16-year-old Cavan Sullivan started, the youngest American to do so since Freddy Adu in 2006.
Sources: ESPN Soccer · ESPN Soccer · ESPN Soccer · ↑ top
Reading
- Ed Zitron — Premium: The Hater's Guide To AI Debt (Part 2). Zitron continues his accounting of the borrowing behind the hyperscalers' artificial intelligence buildout, opening on a satirical scene of a chief executive summoned by the chief financial officer to a critical finance meeting about what all those GPUs cost.
- Stratechery — An Interview with Colossus EIC Jeremy Stern About Profiling Mark Zuckerberg. Ben Thompson interviews Colossus editor in chief Jeremy Stern about how the magazine built its profile of Mark Zuckerberg, and what it takes to get at technology executives who control their own public image.
Markets
S&P 500 7,736.58 ▲ +1.7% Dow 51,720.54 ▼ -0.3% Nasdaq 27,062.10 ▲ +3.2% WTI crude 93.91 ▼ -8.3% EUR/USD 1.1414 ▼ -0.8% GBP/USD 1.3311 ▼ -1.0% USD/JPY 157.79 ▲ +1.8%
Feed Health
Security: 24 of 24 feeds loaded, 50 items in the 48-hour window. No recent items: CISA Advisories, Securelist (Kaspersky), Sophos News, Google Online Security Blog, Cisco Talos, Graham Cluley, Google Project Zero, The DFIR Report, Kim Zetter (Zero Day), Frank on Fraud.
Pittsburgh: 9 of 9 feeds loaded, 60 items in the 48-hour window. No recent items: NEXTpittsburgh.
Business and Politics: 8 of 8 feeds loaded, 60 items in the 36-hour window.
Events: 4 of 4 feeds loaded, 14 items in the 120-hour window.
Sports media: 6 of 6 feeds loaded, 30 items in the 96-hour window. No recent items: Footbahlin with Ben Roethlisberger, Ben Roethlisberger / Channel Seven (YouTube).
Team USA: 3 of 3 feeds loaded, 30 items in the 72-hour window. No recent items: Guardian Olympics.
Reading: 3 of 3 feeds loaded, 12 items in the 336-hour window. No recent items: Cal Newport.
Markets (Yahoo Finance): 7 of 7 rows
Weather (NWS): 3 forecast periods
Scores (ESPN, plaintextsports): 3 teams via plaintextsports; mlb: ESPN failed (mlb: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nfl: ESPN failed (nfl: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nhl: ESPN failed (nhl: HTTP 403 (server: AkamaiGHost)); used plaintextsports
Summaries: 3 model call(s) served by claude-opus-5 (267s of model time; $1.62 at API list price).