Attackers ran two Citrix NetScaler remote code execution zero-days for weeks before Citrix shipped patches, and CISA now gives federal agencies until Wednesday to close them.
Emerging Trends and Key Updates
- Trend Administrators yanked NetScaler appliances offline before Citrix confirmed CVE-2026-88771, and Kiteworks customers powered down file-transfer servers over a weekend warning now traced to its Advanced Forms feature.
- Trend A hardware watchdog from Nvidia and governance advice from AWS arrive as Ben Thompson calls agents the ultimate aggregators and Cal Newport demands outside scrutiny of frontier labs.
- Trend Courts put prices on security failures as a New Mexico jury found Facebook liable, a judge gave Cameron John Wagenius 70 months, and Pennsylvania settled with Labcorp.
- Update · new The 10-year Treasury yield reached 5.2% and Brent topped $108 as Washington and Beijing published tariff-cut lists and Pittsburgh households face the end of cheap money.
- Update · new Bitget resumed the Bitcoin withdrawals it froze after its breach and now puts the theft at $387.5 million.
- Update · updated Counter-terrorism investigators are examining whether the five men arrested outside RAF Fairford answer to Iran, none publicly identified, with the British defense secretary disputing a witness account.
Security
1. Citrix NetScaler Zero-Days Draw a Wednesday Deadline
Latest developments: Help Net Security reported on September 28, 2026 that attackers exploited CVE-2026-88771 and CVE-2026-88772 for weeks before the disclosure, planting webshells on the appliances they reached; warnings from the Dutch National Cyber Security Center reached IT suppliers and surfaced as Reddit rumors on Friday, September 25, 2026, and CISA ordered federal agencies to patch by Wednesday, September 30, 2026.
read more
CVE-2026-88771, an improper input validation flaw rated 9.5, and CVE-2026-88772, a memory buffer flaw, each give an unauthenticated attacker remote code execution on NetScaler ADC and NetScaler Gateway. Citrix shipped fixes for both plus six more bugs running through CVE-2026-88778; anyone running an affected version should patch and hunt for webshells.
Sources: Help Net Security · BleepingComputer · The Hacker News · CISA Advisories · ↑ top
2. Nvidia and AWS Move to Fence In AI Agents
Latest developments: Nvidia introduced an AI agent safety platform on September 28, 2026 that pairs open-source software with a reference system design and a hardware-based watchdog to hold agents inside set boundaries, the same day Amazon Web Services published Reimagine 2026, built on nine months of confidential interviews with 154 executives at 128 organizations across 23 industries.
read more
Enterprises scaling agent deployments lack the controls to bound them: Chris Latimer, chief executive of Vectorize, found coding agents storing API keys, credentials, and sensitive documents in plain text on developer machines and in cloud services, reachable through poisoned memories planted via plugins, skills, and MCP integrations. Security teams should audit what their agents write to memory and who can read it.
Sources: SecurityWeek · Help Net Security · Help Net Security · BleepingComputer · ↑ top
3. A Soldier Draws 70 Months for the Snowflake Extortion
Latest developments: Court records identify the former United States Army soldier sentenced to 70 months as Cameron John Wagenius, 22, who hacked and extorted at least 10 American technology and telecommunications companies between April 2023 and December 2024.
read more
Wagenius belonged to the crew that broke into Snowflake customer accounts in 2024, took data from more than 165 organizations using the cloud data storage company, and threatened to publish it unless victims paid; AT&T ranked among the targets, and the court ordered nearly $300,000 in restitution.
Sources: Help Net Security · BleepingComputer · ↑ top
4. Kiteworks Traces Its Shutdown Order to Advanced Forms
Latest developments: Kiteworks told SecurityWeek on September 28, 2026 that it found a vulnerability in its Advanced Forms feature, called the weekend shutdown order precautionary, and said it has no evidence that anyone compromised Kiteworks or customer systems.
read more
Kiteworks, which sells managed file transfer and secure content software, told customers worldwide to power down servers for a window that grew from six hours to nine after federal intelligence authorities passed the company credible threat intelligence. Customers should apply the Advanced Forms fix and review logs from the exposure window.
Sources: SecurityWeek · ↑ top
5. Bitget Reopens Bitcoin Withdrawals
Latest developments: Bitget resumed the Bitcoin withdrawals it froze after the breach, BleepingComputer reported on September 28, 2026, and put the theft at $387.5 million.
read more
Suspected North Korean hackers drained a limited number of Bitget hot wallets starting at 18:31 UTC on September 24, 2026. The cryptocurrency exchange says a User Protection Fund holding more than $464 million covers customer losses, and investigators have frozen some wallet addresses tied to the attacker.
Sources: BleepingComputer · ↑ top
6. A New Mexico Jury Holds Facebook Liable on Privacy
Latest developments: A jury in New Mexico found Facebook liable on September 28, 2026 for deceiving its users about the privacy protections the platform offered them.
read more
The verdict puts a civil finding of deception behind claims Facebook made to its own users about how it guarded their data, and it lands as regulators elsewhere press the same question—Ireland's Data Protection Commission fined Google 403 million euros over location data on September 21, 2026.
Sources: SecurityWeek · ↑ top
Business and Politics
The Bond Selloff Deepens as Brent Tops $108
Latest developments: The 10-year Treasury yield reached 5.2% Monday morning, September 28, German 10-year Bund yields hit multiyear highs, Brent crude pushed above $108, gold futures fell 3% on bets the Federal Reserve raises rates again next month, and United States stock futures slumped at the start of a week carrying the monthly jobs report.
read more
President Trump's rejection of Iran's proposal to resume nuclear talks and reopen the Strait of Hormuz has killed the diplomatic premium traders had priced in, sending crude and European gas higher and government bonds lower on both sides of the Atlantic; the Wall Street Journal reports that widening federal deficits plus the war have unraveled Trump's plan to push interest rates and inflation down, and TotalEnergies used the surge in cash flow to raise buybacks and dividends. Every dollar of oil feeds through to transport costs across the American economy, and Bank of England Deputy Governor Dave Ramsden said Monday that the bank may have to raise its key rate if inflationary pressure builds.
Sources: WSJ Markets · FT Home · WSJ Markets · WSJ Markets · WSJ Markets · WSJ World News · ↑ top
Washington and Beijing Publish the Tariff-Cut Lists
Latest developments: The two governments released reciprocal product lists Monday, September 28, each covering roughly $30 billion of goods that will carry lower tariffs, running from foie gras to camels, with a board of trade setting the reduced levies on non-sensitive items.
read more
The lists put flesh on the truce Xi Jinping and President Trump reached during Xi's three-day state visit to Washington last week, which extended the trade standoff's ceasefire and opened a channel on artificial intelligence safety while settling none of the harder questions. Chinese state media have spent the days since celebrating the deference Trump showed Xi, treatment one commentary summarized as "Xi got face."
Sources: FT Home · FT Home · WSJ US Business · ↑ top
Investigators Chase an Iran Link at RAF Fairford
Latest developments: Counter-terrorism investigators are examining whether the five men arrested Sunday, September 27, outside RAF Fairford answer to Iran, none of the five has been publicly identified, and the British defense secretary disputed a witness's account that police knew nothing about the suspects until she called them in.
read more
RAF Fairford, in western England, operates under the United States Air Force and hosts the B-1 bombers flying strikes on Iran, now in the war's eighth month. British police hold the five on suspicion of preparing an act of terrorism and explosives offenses, and President Trump has suggested American agencies worked with Britain to stop an attack.
Sources: WSJ World News · FT Home · FT World · ↑ top
Pittsburgh
Weather
Today: Cloudy, high 68F.
Tonight: Areas Of Fog, low 59F.
Tuesday: Areas Of Fog then Partly Sunny, high 76F.
Business
The Era of Cheap Money Ends
Latest developments: The Post-Gazette published a guide Monday, September 28, to what the jump in borrowing costs does to Pittsburgh households, declaring the era of cheap money finished.
read more
The 10-year Treasury yield has climbed past 5% for the first time since 2007 and the average United States 30-year mortgage rate sits above 7%, its highest since January 2025, which raises the cost of mortgages, car loans, and credit-card balances for Western Pennsylvania borrowers while paying savers more. Traders now expect another Federal Reserve increase next month.
Sources: Pittsburgh Post-Gazette · ↑ top
Pennsylvania Settles With Labcorp Over the 2019 Breach
Latest developments: Pennsylvania Attorney General Dave Sunday announced Sunday, September 27, that the state has joined a multistate settlement with Laboratory Corporation of America over the 2019 data breach at the company's former debt collector.
read more
The breach exposed personal and medical information belonging to Labcorp patients, and Pennsylvania joins other states collecting from the North Carolina testing giant, one of the largest clinical laboratory operators serving the Pittsburgh region.
The Sushi Counter Inside Wholey's
Latest developments: The Post-Gazette profiled Andy Nguyen on Monday, September 28, the man running the sushi bar inside Wholey's fish market in the Strip District.
read more
Nguyen cuts to order at the counter in Robert Wholey & Co., the century-old Penn Avenue market that anchors the Strip District's food trade, and customers tell the Post-Gazette his sushi ranks as the best they have eaten.
Sources: Pittsburgh Post-Gazette · ↑ top
Around Town
Sto-Rox Teachers Bargain From the Bottom of the Pay Scale
Latest developments: PublicSource reported Monday, September 28, that Sto-Rox teachers rank among the lowest paid in Allegheny County and that union leaders say contract negotiations collapsed in June after the district refused to work with them.
read more
Nearly every student in the Sto-Rox School District, which serves McKees Rocks and Stowe Township, lives in poverty, and money the district loses to charter school tuition plus its thin tax base leaves administrators bargaining hard. The district balanced its books this year after years of deficits.
Sources: PublicSource · ↑ top
Advocates Protest UPMC's Halt to Pediatric Gender Care
Latest developments: Transgender advocates rallied against UPMC's decision to stop providing gender-affirming care to patients under 18, the Post-Gazette reported Sunday, September 27.
read more
UPMC, the largest health system and largest private employer in Western Pennsylvania, ran the region's main pediatric gender clinic through UPMC Children's Hospital of Pittsburgh, and its withdrawal leaves families in the region searching for care elsewhere.
Sources: Pittsburgh Post-Gazette · ↑ top
Clouds Monday, Then a Warming Start to October
Latest developments: The coastal storm off the East Coast keeps Western Pennsylvania under a solid cloud deck through Monday, September 28, and WTAE expects the clouds to break Tuesday ahead of a warming trend that opens October.
read more
KDKA meteorologist Ron Smiley traced Monday's gray to the same storm spinning along the Atlantic coast, which has held its rain east of Pittsburgh for three days.
Events
Driftwood Oven Turns Into a Dance Floor
Latest developments: Pittsburgh City Paper reported Monday, September 28, on After Dark, the monthly late-night DJ party the Lawrenceville pizzeria Driftwood Oven throws inside its dining room.
read more
Driftwood Oven, the wood-fired pizza shop in Pittsburgh's Lawrenceville neighborhood, clears its floor once a month for After Dark, pairing DJ sets and dancing with pizza service.
Sources: Pittsburgh City Paper · ↑ top
Sports
Pirates (82-80)
Sun Sep 27 · Pirates 4 · Tigers 2 · Final
Steelers (2-1, T-1st in AFC North)
Sun Sep 27 · Bengals 27 · Steelers 30 · Final
Up Next · Steelers @ Browns · Thu Oct 1, 8:15 PM
Penguins (0-0-0, 0 pts)
Up Next · Penguins @ Flyers · Wed Sep 30, 7:30 PM
Around the Teams
Harmon Seals It, and the Young Core Carries the Day
Latest developments: The Post-Gazette's Monday analysis, September 28, credits the Steelers' youngest players for beating the Cincinnati Bengals, with defensive lineman Derrick Harmon ending the game on a strip-sack of quarterback Joe Burrow and rookie offensive lineman Max Iheanachor holding up in his first extended work.
read more
Harmon, the second-year lineman from Oregon, knocked the ball loose from Burrow to close out Sunday's game at Acrisure Stadium, and the paper's report card handed running back Jaylen Warren its highest marks after he shouldered the offense. The Steelers had spent two weeks fielding the league's least productive offense.
Sources: Post-Gazette Steelers · Post-Gazette Steelers · Post-Gazette Steelers · ↑ top
McCarthy and the Locker Room Talk It Through
Latest developments: The Steelers posted head coach Mike McCarthy's postgame news conference Monday morning, September 28, along with the podium session Aaron Rodgers and Derrick Harmon shared and a Press Pass round with T.J. Watt, Roman Wilson, Jaylen Warren, DK Metcalf, and Ben Skowronek.
read more
Cam Heyward and co-host Hayden streamed a live postgame show on Not Just Football as the game ended Sunday, September 27, working through the offense's turnaround against Cincinnati and the defensive pressure that forced Joe Burrow into mistakes.
Sources: Pittsburgh Steelers (YouTube) · Pittsburgh Steelers (YouTube) · Pittsburgh Steelers (YouTube) · Not Just Football with Cam Heyward · ↑ top
Team USA
ESPN Rates Pochettino's Debutants
Latest developments: ESPN graded the United States men's performance against Peru on Monday, September 28, giving Sebastian Berhalter a 10 and Justin Ellis a 9, and reported a palpable excitement around the camp after the 11 debuts coach Mauricio Pochettino handed out.
read more
Pochettino used the 4-1 friendly win over Peru in Orlando, Florida, on Saturday, September 26, the Americans' first match since the 2026 World Cup, to start rebuilding the squad around teenagers with the 2030 tournament in view.
Sources: ESPN Soccer · ESPN Soccer · ↑ top
Reading
- Stratechery — Apps, Agents, and Aggregation. Ben Thompson argues that artificial intelligence agents are the ultimate aggregators, standing between users and everything they want done, which recasts apps as a means to an end and makes owning the agent layer the largest prize in technology.
- Cal Newport — It's Time to Investigate the AI Labs. Newport catalogs what he calls brazen behavior by the two leading frontier artificial intelligence labs over recent months, starting with a run of carefully staged announcements, and calls for outside investigation of the companies.
- Ed Zitron — Premium: The Hater's Guide To AI Debt (Part 2). Zitron continues his accounting of the borrowing behind the artificial intelligence buildout, framing it as a satire in which a vest-wearing hyperscaler chief executive gets summoned to a critical finance meeting to learn what the data centers cost.
Markets
S&P 500 7,736.58 ▲ +1.7% Dow 51,720.54 ▼ -0.3% Nasdaq 27,062.10 ▲ +3.2% WTI crude 93.91 ▼ -8.3% EUR/USD 1.1430 ▼ -0.8% GBP/USD 1.3311 ▼ -1.0% USD/JPY 157.79 ▲ +1.8%
Feed Health
Security: 24 of 24 feeds loaded, 26 items in the 24-hour window. No recent items: Krebs on Security, Schneier on Security, Dark Reading, The Record, Ars Technica Security, Securelist (Kaspersky), Sophos News, Unit 42 (Palo Alto), Google Online Security Blog, Cisco Talos, Graham Cluley, Microsoft Security Blog, Google Project Zero, The DFIR Report, Kim Zetter (Zero Day), 404 Media, Frank on Fraud, Wired Security.
Pittsburgh: 9 of 9 feeds loaded, 60 items in the 48-hour window. No recent items: NEXTpittsburgh, Pittsburgh Magazine.
Business and Politics: 8 of 8 feeds loaded, 60 items in the 36-hour window.
Events: 4 of 4 feeds loaded, 10 items in the 120-hour window.
Sports media: 6 of 6 feeds loaded, 30 items in the 96-hour window. No recent items: Footbahlin with Ben Roethlisberger, Ben Roethlisberger / Channel Seven (YouTube).
Team USA: 3 of 3 feeds loaded, 26 items in the 72-hour window. No recent items: Guardian Olympics.
Reading: 3 of 3 feeds loaded, 12 items in the 336-hour window.
Markets (Yahoo Finance): 7 of 7 rows
Weather (NWS): 3 forecast periods
Scores (ESPN, plaintextsports): 3 teams via plaintextsports; mlb: ESPN failed (mlb: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nfl: ESPN failed (nfl: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nhl: ESPN failed (nhl: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nhl: plaintextsports page last published Sep 25
Summaries: 3 model call(s) served by claude-opus-5 (280s of model time; $1.60 at API list price).