Citrix confirmed that attackers exploit two NetScaler zero-days for remote code execution, shipped fixes for eight flaws at once, and CISA put both bugs on its Known Exploited Vulnerabilities catalog with a binding federal deadline.
Quiet day: only 25 security items in the last 48 hours.
Emerging Trends and Key Updates
- Trend Attackers keep taking the network edge first, with Citrix confirming two NetScaler zero-days under exploitation as federal agencies face a Monday deadline to patch SharePoint flaw CVE-2026-65660.
- Update · new Shared infrastructure carries shared risk after Cloudflare fixed a Containers and Sandboxes flaw letting paying Workers customers recover residual data from other tenants on the same physical host.
- Trend Defenses erode quietly, with Conifers finding 47 percent of detection rules need repair behind green dashboards and CISA's election security plan naming patching friction at election offices.
- Update · new Responder tooling took hits as Wireshark 4.6.9 closed 19 vulnerabilities and 16 bugs while Microsoft halted the KB5002907 Office update that was deactivating licenses.
- Update · new Mediators pressed Tehran for nuclear concessions, British police arrested five men near RAF Fairford, and Swiss voters rejected the neutrality measure by 68.4 percent.
- Update · new A good Pittsburgh Sunday: the Steelers offense erupted against Cincinnati even with Joey Porter Jr. inactive, and the Pirates finished above .500 for the first time since 2018.
Security
1. Citrix NetScaler Zero-Days Under Active Exploitation
Latest developments: Citrix confirmed on September 27, 2026 that attackers exploit CVE-2026-88771, an improper input validation flaw, and CVE-2026-88772, a memory buffer flaw, for remote code execution on NetScaler ADC and NetScaler Gateway, released fixes for those two plus six more vulnerabilities running through CVE-2026-88778, and CISA added both exploited bugs to its Known Exploited Vulnerabilities catalog; one of the two reaches every deployment on an affected version, including appliances in the default configuration.
read more
NetScaler ADC and Gateway terminate remote access and load-balance applications for enterprises worldwide, and remote code execution on one hands an attacker the network edge. Install the Citrix updates now and hunt for signs of compromise on any appliance that sat exposed before the patch.
Sources: The Hacker News · BleepingComputer · CISA Advisories · CISA Advisories · ↑ top
2. SharePoint Exploitation Puts Agencies on a Monday Deadline
Latest developments: SecurityWeek reported on September 27, 2026 that attackers now exploit CVE-2026-65660 in the wild, and the CISA patching deadline for federal agencies falls Monday, September 28, 2026.
read more
CVE-2026-65660, rated 8.8, is a code injection flaw in Microsoft Office SharePoint Server that gives an authenticated user remote code execution; CISA listed it alongside CVE-2026-67279 in MikroTik RouterOS. Patch both, and treat any internet-facing SharePoint server as a priority.
Sources: SecurityWeek · The Hacker News · ↑ top
3. Scareware Ads and the Macfinger ClickFix Campaign
Latest developments: Ars Technica reported on September 25, 2026 that Google ad placements across the internet deliver scareware that freezes a Mac and tells its owner the machine carries an infection, and the SANS Internet Storm Center published a breakdown of the malware behind the Macfinger ClickFix campaign the same day.
read more
Both routes convince the person at the keyboard to act: the ad fakes an infection warning, and ClickFix lures hand the victim a command to paste. Train staff to treat any browser page claiming an infection as hostile, and block the paste-and-run pattern at the endpoint.
Sources: Ars Technica Security · SANS Internet Storm Center · ↑ top
4. Wireshark Patches 19 Flaws as an Office Update Deactivates Licenses
Latest developments: The Wireshark project shipped release 4.6.9 on September 27, 2026, closing 19 vulnerabilities and 16 bugs in the packet analyzer that sits on nearly every incident responder's laptop, and Microsoft halted the rollout of the KB5002907 Microsoft 365 update after it deactivated and in some cases removed perpetual Office 2016 and Office 2019 installations.
read more
Wireshark parses untrusted capture files, so a malformed packet trace turns its dissectors into an attack surface against the analyst; update to 4.6.9. Organizations running perpetual Office licenses alongside Microsoft 365 should hold KB5002907 until Microsoft resumes the rollout.
Sources: SANS Internet Storm Center · BleepingComputer · ↑ top
5. Cloudflare Containers Leaked Data Across Tenants
Latest developments: Cloudflare fixed a vulnerability in its Containers and Sandboxes products, BleepingComputer reported on September 27, 2026, that let any customer holding a Workers Paid account recover residual data from other customers' containers sharing the same physical host.
read more
Containers and Sandboxes run customer workloads on Cloudflare's shared fleet, and the flaw broke the isolation boundary that separates one tenant's leftover data from the next tenant on the machine. Cloudflare deployed the fix on its own platform, so customers take no action, though anyone who ran sensitive workloads on the service should weigh what data the containers held.
Sources: BleepingComputer · ↑ top
6. A Cyberattack Disrupts Dyfed-Powys Police
Latest developments: Dyfed-Powys Police, the force covering southwest and mid Wales, said on September 25, 2026 that a cyberattack knocked out some of its non-emergency systems and may have exposed staff information.
read more
The force kept emergency response running while it worked through the outage and assessed what attackers reached. Police staff records carry home addresses and personal details that make officers targets, so the exposure question matters more than the downtime.
Sources: The Record · ↑ top
7. CISA Delivers an Election Security Plan
Latest developments: CISA published the election security plan that Homeland Security Secretary Markwayne Mullin ordered in July 2026, and it flags attacks on voter registration databases and the barriers that keep election offices from patching their systems.
read more
State and county election offices run the machinery of American voting on small budgets and thin staff, which leaves known vulnerabilities open for months. The plan sets out what the agency will do about both problems ahead of the next federal election cycle.
Sources: SecurityWeek · ↑ top
8. Conifers Finds Detection Rules Failing Quietly
Latest developments: Conifers assessed 14,652 detection rules across its customer base and found that 47 percent of the detections in the average organization need attention, with failures falling into five groups that start with logic bugs.
read more
The study covered rules customers wrote themselves and rules vendors manage inside SIEM, endpoint, cloud, identity, email, and network tools. A rule can show as deployed on a coverage dashboard and still never fire when an attacker uses the technique it targets, so test detections against real technique execution instead of trusting the dashboard.
Sources: Help Net Security · ↑ top
Business and Politics
Iran Pressed to Trade Nuclear Concessions for Talks
Latest developments: Mediators are pressing Tehran to offer nuclear concessions to restart negotiations with Washington, the Wall Street Journal reported Sunday, September 27, a bid the mediators themselves call a long shot after President Trump rejected Iran's seven-day truce proposal.
read more
The seven-month war has closed the Strait of Hormuz, and Trump told the Wall Street Journal he expects American bombing to resume after the November 3 midterm elections. The concession track is the only thing standing between the current fighting and all-out war across the Gulf, and the oil, tanker, and gas markets price every turn of it.
Sources: WSJ World News · ↑ top
Explosives Arrests at the British Base Flying Iran Strikes
Latest developments: British police arrested five men near RAF Fairford on Sunday, September 27, on suspicion of preparing a terrorist act, counter-terrorism officers took over the case, and President Trump suggested American agencies worked with the United Kingdom to stop an attack; investigators are examining whether the suspects have ties to Iran's Islamic Revolutionary Guard Corps.
read more
RAF Fairford in Gloucestershire hosts the American long-range bombers running missions in the war with Iran, and police declared a major incident, sent bomb disposal teams to the scene, and evacuated homes near the perimeter. Iran has warned Britain of consequences for hosting the flights, which carries the war onto British soil.
Sources: FT Home · WSJ World News · ↑ top
Swiss Voters Rule on Neutrality
Latest developments: Swiss voters rejected the neutrality measure Sunday, September 27, with 68.4% opposed, leaving Bern free to keep cooperating with military alliances.
read more
The referendum would have barred Switzerland from working with any military alliance unless an enemy attacked it first, writing centuries of practice into a hard constitutional rule. Defeat preserves the quiet defense cooperation Bern has built with European partners since Russia invaded Ukraine, including joint procurement and air-defense coordination.
Europe and Asia Head Into an LNG Bidding War
Latest developments: The Financial Times reported Sunday, September 27, that European Union gas storage sits at record lows heading into winter, setting up intensifying competition with Asian buyers for liquefied natural gas cargoes over the coming months.
read more
The war with Iran and the closure of the Strait of Hormuz have thinned the pool of seaborne cargoes just as Europe enters the heating season with its tanks emptier than at any point on record. Every cargo Asia outbids Europe for pushes European gas and power prices higher and squeezes energy-intensive industry, which has already idled plants in Britain.
Private Credit Redemptions Slow
Latest developments: Redemption requests from retail investors in private credit funds fell, the Financial Times reported Sunday, September 27, easing the withdrawal pressure that had built through the summer, though fund managers told the paper it remains too early to call the bottom.
read more
Retail money in semi-liquid private credit vehicles had been heading for the exits, forcing managers to meet redemptions out of a portfolio of loans that trade rarely. A slower pace of withdrawals relieves the funding mismatch that banks lending into the sector watch most closely.
Pittsburgh
Weather
Tonight: Mostly Cloudy, low 58F.
Monday: Cloudy, high 68F.
Monday Night: Mostly Cloudy, low 59F.
Business
Brickworks Breaks Ground in the Strip District
Latest developments: Developers held the groundbreaking Sunday, September 27, for Brickworks, a luxury housing project in the heart of Pittsburgh's Strip District, WPXI reported.
read more
The Strip District has absorbed a decade of warehouse conversions, robotics tenants, and new apartments along Smallman and Railroad streets. Brickworks adds market-rate units to a neighborhood whose residential pipeline now competes with the downtown office conversions taking shape a mile west.
CCAC Faculty Rally Over Their Contract
Latest developments: Community College of Allegheny County faculty members rallied Saturday, September 26, at the college's North Side campus as contract negotiations with the administration continue.
read more
CCAC runs four campuses across Allegheny County and enrolls the region's largest body of two-year students. The faculty took their bargaining fight outdoors on the North Side the same weekend the college marked its 60th year.
Washington County Opens a Flood Recovery Center
Latest developments: Washington County will host a Multi-Agency Response Center to help residents and business owners recover from the storm damage and flooding of the past two weekends, WPXI reported Sunday, September 27.
read more
Two straight weekends of heavy rain pushed Chartiers Creek and other streams over their banks, swamping buildings along Jefferson Avenue in Canton Township and prompting the township to declare a state of emergency on September 20. The response center gathers aid agencies in one place so flooded households and businesses can file damage claims and reach recovery programs without chasing them separately.
Around Town
Fetterman Sees a Democratic Senate and Keeps His Own Plans Open
Latest developments: U.S. Senator John Fetterman told KDKA on Sunday, September 27, that it is "entirely possible" Democrats win control of the Senate in the November 3 midterms, and he answered questions about his own future by saying, "let's revisit after the midterm."
read more
Fetterman, the Pennsylvania Democrat who has spent the term feuding with his party's left flank, faces a likely primary challenge in 2028 without a settled political base. His refusal to commit keeps open the question of whether he seeks reelection, switches parties, or leaves the seat.
A Bill to Keep AI Out of the Teacher's Chair
Latest developments: Duquesne University education dean Gretchen Givens Generett wrote in TribLive on Sunday, September 27, that state Senator Lindsey Williams will introduce the Human Students Need Human Educators bill, which would bar artificial intelligence from serving as the teacher of record.
read more
The measure would cover Pennsylvania public and charter schools from kindergarten through 12th grade, the State System of Higher Education, the state-related universities, and community colleges. Generett argues artificial intelligence belongs in classrooms as a tool and never at the front of the room, and the bill lands as faculty unions in Pittsburgh write similar protections into contract talks.
The Cathedral of Learning Turns 100
Latest developments: The Post-Gazette published two pieces Sunday, September 27, marking the centennial of the University of Pittsburgh's Cathedral of Learning, one tracing how the tower became a Pittsburgh landmark and one collecting readers' memories of the building they call Cathy.
read more
The Gothic skyscraper anchors Pitt's Oakland campus, holds the Nationality Rooms, and serves as classroom space and civic symbol at once. The anniversary lands as Pitt runs the $3 billion "Proving Possible" fundraising campaign it opened September 25.
Sources: Pittsburgh Post-Gazette · ↑ top
The Races That Decide Harrisburg
Latest developments: The Post-Gazette laid out Sunday, September 27, the specific 2026 legislative contests that will determine which party controls the Pennsylvania House and Senate, with the election five weeks off on November 3.
read more
Democrats hold the Pennsylvania House by a single seat and Republicans hold the Senate, so a handful of suburban and Western Pennsylvania districts decide whether Governor Josh Shapiro governs with a split legislature or a friendlier one. Allegheny County mailed roughly 120,000 ballots to voters starting last weekend.
Sources: Pittsburgh Post-Gazette · ↑ top
The Nor'easter Sends Clouds and Little Else
Latest developments: The nor'easter held its rain east of Western Pennsylvania through Sunday, September 27, and WPXI's evening update calls for spotty showers mainly east of Pittsburgh, overnight temperatures in the 50s, and clouds to open the workweek.
read more
The storm flooded the Atlantic coast for a second day and knocked out power to more than 130,000 customers in the Northeast while leaving Pittsburgh dry and breezy. The Laurel Highlands ridges carried the region's best shower chance, and the 1 p.m. kickoff at Acrisure Stadium stayed inside the dry stretch.
Sources: WPXI · WPXI · WTAE · KDKA · ↑ top
Sports
Pirates (82-80)
Sat Sep 26 · Pirates 3 · Tigers 4 · Final
Sun Sep 27 · Pirates 4 · Tigers 2 · Final
Steelers (2-1, T-1st in AFC North)
Sun Sep 27 · Bengals 27 · Steelers 30 · Final
Up Next · Steelers @ Browns · Thu Oct 1, 8:15 PM
Penguins (0-0-0, 0 pts)
Up Next · Penguins @ Flyers · Wed Sep 30, 7:30 PM
Around the Teams
The Offense Wakes Up Against Cincinnati
Latest developments: The Steelers' offense came alive against the Cincinnati Bengals on Sunday, September 27, at Acrisure Stadium, with running back Jaylen Warren carrying the load, and Post-Gazette columnist Noah Hiles called the game a Mike McCarthy masterpiece.
read more
Pittsburgh entered AFC North play with the NFL's worst offense, running back Rico Dowdle hurt and rookie lineman Gennings Dunker on injured reserve, and Aaron Rodgers matched Joe Burrow throw for throw while defensive lineman Derrick Harmon made plays on the other side. McCarthy, Rodgers, and Harmon took questions afterward, Cam Heyward and his co-host streamed a postgame show on Not Just Football, and the Post-Gazette report card handed Warren its top marks; the Steelers play at Cleveland on Thursday night.
Sources: Post-Gazette Steelers · Post-Gazette Steelers · Post-Gazette Steelers · Not Just Football with Cam Heyward · Pittsburgh Steelers (YouTube) · ↑ top
Porter Sits Out a Third Straight Game
Latest developments: The Steelers listed cornerback Joey Porter Jr. among their inactives again Sunday, September 27, against the Cincinnati Bengals, the Post-Gazette reported.
read more
Porter has stayed out of uniform through a contract standoff with general manager Omar Khan, and Asante Samuel Jr. has taken his place in the secondary and played well. Rod Woodson and Darren Perry fought the Steelers over contracts in the 1990s and finished their Pittsburgh careers anyway, the precedent the Post-Gazette raised last week as Porter's absence stretched on.
Sources: Post-Gazette Steelers · ↑ top
The Pirates Finish Above .500
Latest developments: The Pirates closed their season at Comerica Park in Detroit on Sunday, September 27, with a winning record, their first since 2018, the Post-Gazette reported, with rookie Konnor Griffin and right-hander Jared Jones figuring in the finale.
read more
Pittsburgh improved by 11 wins over 2025 and still missed the playoffs. General manager Ben Cherington told the Post-Gazette on Saturday that he expects to return for 2027 and backed manager Don Kelly to keep the job, and ace Paul Skenes finished a season he traced to his workload at the World Baseball Classic.
Sources: Post-Gazette Pirates · Post-Gazette Pirates · ↑ top
Team USA
Eleven Debuts in a 4-1 Win Over Peru
Latest developments: ESPN reported Sunday, September 27, that Mauricio Pochettino handed out 11 debuts in the United States' 4-1 win over Peru in Orlando, Florida, eight of them to teenagers, and that the coach called himself "so proud" and said the play gave him goosebumps.
read more
The friendly Saturday, September 26, was the American men's first match since the 2026 World Cup and the opening of the cycle toward 2030. Sebastian Berhalter drew a 10 and Justin Ellis a 9 in ESPN's player ratings, and 16-year-old Cavan Sullivan started, the youngest American to do so since Freddy Adu in 2006.
Sources: ESPN Soccer · ESPN Soccer · ESPN Soccer · ↑ top
Reading
- Ed Zitron — Premium: The Hater's Guide To AI Debt (Part 2). Zitron continues his accounting of the borrowing behind the hyperscalers' artificial intelligence buildout, opening on a satirical scene of a chief executive summoned by the chief financial officer to a critical finance meeting about what all those GPUs cost.
- Stratechery — An Interview with Colossus EIC Jeremy Stern About Profiling Mark Zuckerberg. Ben Thompson interviews Colossus editor in chief Jeremy Stern about how the magazine built its profile of Mark Zuckerberg, and what it takes to get at technology executives who control their own public image.
Markets
S&P 500 7,736.58 ▲ +1.7% Dow 51,720.54 ▼ -0.3% Nasdaq 27,062.10 ▲ +3.2% WTI crude 93.91 ▼ -8.3% EUR/USD 1.1430 ▼ -0.8% GBP/USD 1.3311 ▼ -1.0% USD/JPY 157.79 ▲ +1.8%
Feed Health
Security: 24 of 24 feeds loaded, 25 items in the 48-hour window. No recent items: Krebs on Security, Schneier on Security, Dark Reading, The Record, Ars Technica Security, Securelist (Kaspersky), Sophos News, Unit 42 (Palo Alto), Google Online Security Blog, Cisco Talos, Graham Cluley, Microsoft Security Blog, Google Project Zero, The DFIR Report, Kim Zetter (Zero Day), Frank on Fraud.
Pittsburgh: 9 of 9 feeds loaded, 60 items in the 48-hour window. No recent items: Pittsburgh City Paper, NEXTpittsburgh, Pittsburgh Magazine.
Business and Politics: 8 of 8 feeds loaded, 60 items in the 36-hour window.
Events: 4 of 4 feeds loaded, 11 items in the 120-hour window.
Sports media: 6 of 6 feeds loaded, 30 items in the 96-hour window. No recent items: Footbahlin with Ben Roethlisberger, Ben Roethlisberger / Channel Seven (YouTube).
Team USA: 3 of 3 feeds loaded, 27 items in the 72-hour window. No recent items: Guardian Olympics.
Reading: 3 of 3 feeds loaded, 12 items in the 336-hour window. No recent items: Cal Newport.
Markets (Yahoo Finance): 7 of 7 rows
Weather (NWS): 3 forecast periods
Scores (ESPN, plaintextsports): 3 teams via plaintextsports; mlb: ESPN failed (mlb: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nfl: ESPN failed (nfl: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nhl: ESPN failed (nhl: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nhl: plaintextsports page last published Sep 25
Summaries: 3 model call(s) served by claude-opus-5 (605s of model time; $1.66 at API list price).