================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Monday, September 28, 2026 - 7:05 AM EDT ================================================================ Attackers ran two Citrix NetScaler remote code execution zero-days for weeks before Citrix shipped patches, and CISA now gives federal agencies until Wednesday to close them. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets | Feed Health EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Administrators yanked NetScaler appliances offline before Citrix confirmed CVE-2026-88771, and Kiteworks customers powered down file-transfer servers over a weekend warning now traced to its Advanced Forms feature. see: Citrix NetScaler Zero-Days Draw a Wednesday Deadline; Kiteworks Traces Its Shutdown Order to Advanced Forms * [TREND] A hardware watchdog from Nvidia and governance advice from AWS arrive as Ben Thompson calls agents the ultimate aggregators and Cal Newport demands outside scrutiny of frontier labs. see: Nvidia and AWS Move to Fence In AI Agents; Apps, Agents, and Aggregation; It's Time to Investigate the AI Labs * [TREND] Courts put prices on security failures as a New Mexico jury found Facebook liable, a judge gave Cameron John Wagenius 70 months, and Pennsylvania settled with Labcorp. see: A New Mexico Jury Holds Facebook Liable on Privacy; A Soldier Draws 70 Months for the Snowflake Extortion; Pennsylvania Settles With Labcorp Over the 2019 Breach * [UPDATE (new)] The 10-year Treasury yield reached 5.2% and Brent topped $108 as Washington and Beijing published tariff-cut lists and Pittsburgh households face the end of cheap money. see: The Bond Selloff Deepens as Brent Tops $108; Washington and Beijing Publish the Tariff-Cut Lists; The Era of Cheap Money Ends * [UPDATE (new)] Bitget resumed the Bitcoin withdrawals it froze after its breach and now puts the theft at $387.5 million. see: Bitget Reopens Bitcoin Withdrawals * [UPDATE (updated)] Counter-terrorism investigators are examining whether the five men arrested outside RAF Fairford answer to Iran, none publicly identified, with the British defense secretary disputing a witness account. see: Investigators Chase an Iran Link at RAF Fairford SECURITY ---------------------------------------------------------------- 1. CITRIX NETSCALER ZERO-DAYS DRAW A WEDNESDAY DEADLINE Vulnerabilities and Exploits · [zero-day, patch, kev] Latest developments: Help Net Security reported on September 28, 2026 that attackers exploited CVE-2026-88771 and CVE-2026-88772 for weeks before the disclosure, planting webshells on the appliances they reached; warnings from the Dutch National Cyber Security Center reached IT suppliers and surfaced as Reddit rumors on Friday, September 25, 2026, and CISA ordered federal agencies to patch by Wednesday, September 30, 2026. CVE-2026-88771, an improper input validation flaw rated 9.5, and CVE-2026-88772, a memory buffer flaw, each give an unauthenticated attacker remote code execution on NetScaler ADC and NetScaler Gateway. Citrix shipped fixes for both plus six more bugs running through CVE-2026-88778; anyone running an affected version should patch and hunt for webshells. - Help Net Security: https://www.helpnetsecurity.com/2026/09/28/citrix-netscaler-rce-zero-days-exploited-for-weeks-cve-2026-88771-cve-2026-88772/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-exploited-citrix-flaws-by-wednesday/ - The Hacker News: https://thehackernews.com/2026/09/cisa-says-attackers-are-exploiting-two.html - CISA Advisories: https://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway 2. NVIDIA AND AWS MOVE TO FENCE IN AI AGENTS AI Security · [ai, governance] Latest developments: Nvidia introduced an AI agent safety platform on September 28, 2026 that pairs open-source software with a reference system design and a hardware-based watchdog to hold agents inside set boundaries, the same day Amazon Web Services published Reimagine 2026, built on nine months of confidential interviews with 154 executives at 128 organizations across 23 industries. Enterprises scaling agent deployments lack the controls to bound them: Chris Latimer, chief executive of Vectorize, found coding agents storing API keys, credentials, and sensitive documents in plain text on developer machines and in cloud services, reachable through poisoned memories planted via plugins, skills, and MCP integrations. Security teams should audit what their agents write to memory and who can read it. - SecurityWeek: https://www.securityweek.com/nvidia-unveils-ai-agent-safety-platform-with-hardware-based-watchdog/ - Help Net Security: https://www.helpnetsecurity.com/2026/09/28/chris-latimer-vectorize-agent-memory-security/ - Help Net Security: https://www.helpnetsecurity.com/2026/09/28/ai-agent-security-governance-aws-report/ - BleepingComputer: https://www.bleepingcomputer.com/news/artificial-intelligence/anthropic-turns-claude-into-an-ai-marketplace-with-2-000-plus-plugins-and-connectors/ 3. A SOLDIER DRAWS 70 MONTHS FOR THE SNOWFLAKE EXTORTION Ransomware and Cybercrime · [extortion, breach, law enforcement] Latest developments: Court records identify the former United States Army soldier sentenced to 70 months as Cameron John Wagenius, 22, who hacked and extorted at least 10 American technology and telecommunications companies between April 2023 and December 2024. Wagenius belonged to the crew that broke into Snowflake customer accounts in 2024, took data from more than 165 organizations using the cloud data storage company, and threatened to publish it unless victims paid; AT&T ranked among the targets, and the court ordered nearly $300,000 in restitution. - Help Net Security: https://www.helpnetsecurity.com/2026/09/28/us-army-soldier-snowflake-breaches-extortion/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/us-soldier-gets-70-months-in-prison-for-extorting-10-tech-telecom-firms/ 4. KITEWORKS TRACES ITS SHUTDOWN ORDER TO ADVANCED FORMS Vulnerabilities and Exploits · [vulnerability, patch] Latest developments: Kiteworks told SecurityWeek on September 28, 2026 that it found a vulnerability in its Advanced Forms feature, called the weekend shutdown order precautionary, and said it has no evidence that anyone compromised Kiteworks or customer systems. Kiteworks, which sells managed file transfer and secure content software, told customers worldwide to power down servers for a window that grew from six hours to nine after federal intelligence authorities passed the company credible threat intelligence. Customers should apply the Advanced Forms fix and review logs from the exposure window. - SecurityWeek: https://www.securityweek.com/kiteworks-urges-server-shutdown-finds-advanced-forms-vulnerability/ 5. BITGET REOPENS BITCOIN WITHDRAWALS Nation-State Activity · [north korea, cryptocurrency, breach] Latest developments: Bitget resumed the Bitcoin withdrawals it froze after the breach, BleepingComputer reported on September 28, 2026, and put the theft at $387.5 million. Suspected North Korean hackers drained a limited number of Bitget hot wallets starting at 18:31 UTC on September 24, 2026. The cryptocurrency exchange says a User Protection Fund holding more than $464 million covers customer losses, and investigators have frozen some wallet addresses tied to the attacker. - BleepingComputer: https://www.bleepingcomputer.com/news/security/bitget-resumes-bitcoin-withdrawals-after-3875-million-crypto-heist/ 6. A NEW MEXICO JURY HOLDS FACEBOOK LIABLE ON PRIVACY Policy and Regulation · [privacy, policy] Latest developments: A jury in New Mexico found Facebook liable on September 28, 2026 for deceiving its users about the privacy protections the platform offered them. The verdict puts a civil finding of deception behind claims Facebook made to its own users about how it guarded their data, and it lands as regulators elsewhere press the same question—Ireland's Data Protection Commission fined Google 403 million euros over location data on September 21, 2026. - SecurityWeek: https://www.securityweek.com/new-mexico-jury-finds-facebook-liable-for-deceiving-users-about-privacy-protections/ BUSINESS AND POLITICS ---------------------------------------------------------------- * The Bond Selloff Deepens as Brent Tops $108 Latest developments: The 10-year Treasury yield reached 5.2% Monday morning, September 28, German 10-year Bund yields hit multiyear highs, Brent crude pushed above $108, gold futures fell 3% on bets the Federal Reserve raises rates again next month, and United States stock futures slumped at the start of a week carrying the monthly jobs report. President Trump's rejection of Iran's proposal to resume nuclear talks and reopen the Strait of Hormuz has killed the diplomatic premium traders had priced in, sending crude and European gas higher and government bonds lower on both sides of the Atlantic; the Wall Street Journal reports that widening federal deficits plus the war have unraveled Trump's plan to push interest rates and inflation down, and TotalEnergies used the surge in cash flow to raise buybacks and dividends. Every dollar of oil feeds through to transport costs across the American economy, and Bank of England Deputy Governor Dave Ramsden said Monday that the bank may have to raise its key rate if inflationary pressure builds. - WSJ Markets: https://www.wsj.com/finance/treasury-yields-rise-amid-u-s-iran-diplomatic-stalemate-e763fe89?mod=rss_markets_main - FT Home: https://www.ft.com/content/d751ad99-531d-4990-9a4c-ee89a9fc1b2d?syn-25a6b1a6=1 - WSJ Markets: https://www.wsj.com/articles/rising-deficits-and-war-unravel-trumps-strategy-to-lower-interest-rates-and-inflation-f93a6a76?mod=rss_markets_main - WSJ Markets: https://www.wsj.com/finance/commodities-futures/gold-falls-on-expectations-of-higher-for-longer-fed-rates-238bf7a5?mod=rss_markets_main - WSJ Markets: https://www.wsj.com/finance/commodities-futures/european-gas-prices-rise-on-prospects-of-prolonged-lng-disruptions-82000fff?mod=rss_markets_main - WSJ World News: https://www.wsj.com/pro/central-banking/boes-ramsden-sees-case-for-raising-key-rate-if-inflationary-pressures-build-6297ba77?mod=rss_worldnews * Washington and Beijing Publish the Tariff-Cut Lists Latest developments: The two governments released reciprocal product lists Monday, September 28, each covering roughly $30 billion of goods that will carry lower tariffs, running from foie gras to camels, with a board of trade setting the reduced levies on non-sensitive items. The lists put flesh on the truce Xi Jinping and President Trump reached during Xi's three-day state visit to Washington last week, which extended the trade standoff's ceasefire and opened a channel on artificial intelligence safety while settling none of the harder questions. Chinese state media have spent the days since celebrating the deference Trump showed Xi, treatment one commentary summarized as "Xi got face." - FT Home: https://www.ft.com/content/b1ba7dd2-3e3a-4944-b637-ff7db3b636e1?syn-25a6b1a6=1 - FT Home: https://www.ft.com/content/8ac777fc-882e-4781-826b-272d72d468a0?syn-25a6b1a6=1 - WSJ US Business: https://www.wsj.com/logistics-report/soaring-transport-costs-spread-through-u-s-economy-fb7cd42f?mod=pls_whats_news_us_business_f * Investigators Chase an Iran Link at RAF Fairford Latest developments: Counter-terrorism investigators are examining whether the five men arrested Sunday, September 27, outside RAF Fairford answer to Iran, none of the five has been publicly identified, and the British defense secretary disputed a witness's account that police knew nothing about the suspects until she called them in. RAF Fairford, in western England, operates under the United States Air Force and hosts the B-1 bombers flying strikes on Iran, now in the war's eighth month. British police hold the five on suspicion of preparing an act of terrorism and explosives offenses, and President Trump has suggested American agencies worked with Britain to stop an attack. - WSJ World News: https://www.wsj.com/world/u-k-probes-possible-iran-link-to-suspected-terror-plot-at-base-hosting-u-s-forces-b2328fb2?mod=rss_worldnews - FT Home: https://www.ft.com/content/571a3103-ec01-464b-ab39-0c0da58d9524?syn-25a6b1a6=1 - FT World: https://www.ft.com/content/875027a3-db29-40a6-b17c-fa97c30fd07b?syn-25a6b1a6=1 PITTSBURGH ---------------------------------------------------------------- Weather: Today: Cloudy, high 68F. Tonight: Areas Of Fog, low 59F. Tuesday: Areas Of Fog then Partly Sunny, high 76F. Business: * The Era of Cheap Money Ends Latest developments: The Post-Gazette published a guide Monday, September 28, to what the jump in borrowing costs does to Pittsburgh households, declaring the era of cheap money finished. The 10-year Treasury yield has climbed past 5% for the first time since 2007 and the average United States 30-year mortgage rate sits above 7%, its highest since January 2025, which raises the cost of mortgages, car loans, and credit-card balances for Western Pennsylvania borrowers while paying savers more. Traders now expect another Federal Reserve increase next month. - Pittsburgh Post-Gazette: https://www.post-gazette.com/business/money/2026/09/28/higher-interest-rates/stories/202609270066 * Pennsylvania Settles With Labcorp Over the 2019 Breach Latest developments: Pennsylvania Attorney General Dave Sunday announced Sunday, September 27, that the state has joined a multistate settlement with Laboratory Corporation of America over the 2019 data breach at the company's former debt collector. The breach exposed personal and medical information belonging to Labcorp patients, and Pennsylvania joins other states collecting from the North Carolina testing giant, one of the largest clinical laboratory operators serving the Pittsburgh region. - WPXI: https://www.wpxi.com/news/local/pennsylvania-part-multistate-settlement-with-labcorp-following-2019-data-breach/LLB5IAHULNCXROR3VI5A6Z63EI/ * The Sushi Counter Inside Wholey's Latest developments: The Post-Gazette profiled Andy Nguyen on Monday, September 28, the man running the sushi bar inside Wholey's fish market in the Strip District. Nguyen cuts to order at the counter in Robert Wholey & Co., the century-old Penn Avenue market that anchors the Strip District's food trade, and customers tell the Post-Gazette his sushi ranks as the best they have eaten. - Pittsburgh Post-Gazette: https://www.post-gazette.com/life/food/2026/09/28/andy-nguyen-sushi-bar-wholeys-strip-district/stories/202610050001 Around town: * Sto-Rox Teachers Bargain From the Bottom of the Pay Scale Latest developments: PublicSource reported Monday, September 28, that Sto-Rox teachers rank among the lowest paid in Allegheny County and that union leaders say contract negotiations collapsed in June after the district refused to work with them. Nearly every student in the Sto-Rox School District, which serves McKees Rocks and Stowe Township, lives in poverty, and money the district loses to charter school tuition plus its thin tax base leaves administrators bargaining hard. The district balanced its books this year after years of deficits. - PublicSource: https://www.publicsource.org/sto-rox-teacher-contract-negotiations-pay/ * Advocates Protest UPMC's Halt to Pediatric Gender Care Latest developments: Transgender advocates rallied against UPMC's decision to stop providing gender-affirming care to patients under 18, the Post-Gazette reported Sunday, September 27. UPMC, the largest health system and largest private employer in Western Pennsylvania, ran the region's main pediatric gender clinic through UPMC Children's Hospital of Pittsburgh, and its withdrawal leaves families in the region searching for care elsewhere. - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/health/2026/09/27/upmc-children-s-doj-advocates-protest-halt-pediatric-gender-affirming-care/stories/202609270124 * Clouds Monday, Then a Warming Start to October Latest developments: The coastal storm off the East Coast keeps Western Pennsylvania under a solid cloud deck through Monday, September 28, and WTAE expects the clouds to break Tuesday ahead of a warming trend that opens October. KDKA meteorologist Ron Smiley traced Monday's gray to the same storm spinning along the Atlantic coast, which has held its rain east of Pittsburgh for three days. - WTAE: https://www.wtae.com/article/clouds-linger-over-western-pa/73920322 - KDKA: https://www.cbsnews.com/pittsburgh/news/its-going-to-be-a-cloudy-day-in-the-pittsburgh-area/ Events: * Driftwood Oven Turns Into a Dance Floor Latest developments: Pittsburgh City Paper reported Monday, September 28, on After Dark, the monthly late-night DJ party the Lawrenceville pizzeria Driftwood Oven throws inside its dining room. Driftwood Oven, the wood-fired pizza shop in Pittsburgh's Lawrenceville neighborhood, clears its floor once a month for After Dark, pairing DJ sets and dancing with pizza service. - Pittsburgh City Paper: https://www.pghcitypaper.com/arts-entertainment-2/driftwood-oven-serves-pizza-and-dance-club-vibes-with-after-dark/ SPORTS ---------------------------------------------------------------- Pirates (82-80) Sun Sep 27 · Pirates 4 · Tigers 2 · Final https://plaintextsports.com/mlb/2026-09-27/pit-det Steelers (2-1, T-1st in AFC North) Sun Sep 27 · Bengals 27 · Steelers 30 · Final https://plaintextsports.com/nfl/2026/week3/cin-pit Up Next · Steelers @ Browns · Thu Oct 1, 8:15 PM https://plaintextsports.com/nfl/2026/teams/pittsburgh-steelers Penguins (0-0-0, 0 pts) Up Next · Penguins @ Flyers · Wed Sep 30, 7:30 PM https://plaintextsports.com/nhl/2026-2027/teams/pittsburgh-penguins Around the Teams: * Harmon Seals It, and the Young Core Carries the Day Latest developments: The Post-Gazette's Monday analysis, September 28, credits the Steelers' youngest players for beating the Cincinnati Bengals, with defensive lineman Derrick Harmon ending the game on a strip-sack of quarterback Joe Burrow and rookie offensive lineman Max Iheanachor holding up in his first extended work. Harmon, the second-year lineman from Oregon, knocked the ball loose from Burrow to close out Sunday's game at Acrisure Stadium, and the paper's report card handed running back Jaylen Warren its highest marks after he shouldered the offense. The Steelers had spent two weeks fielding the league's least productive offense. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/09/28/steelers-bengals-derrick-harmon-max-iheanachor/stories/202609270108 - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/09/27/derrick-harmon-joe-burrow-week3/stories/202609270104 - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/09/27/steelers-report-card-bengals-week3/stories/202609270105 * McCarthy and the Locker Room Talk It Through Latest developments: The Steelers posted head coach Mike McCarthy's postgame news conference Monday morning, September 28, along with the podium session Aaron Rodgers and Derrick Harmon shared and a Press Pass round with T.J. Watt, Roman Wilson, Jaylen Warren, DK Metcalf, and Ben Skowronek. Cam Heyward and co-host Hayden streamed a live postgame show on Not Just Football as the game ended Sunday, September 27, working through the offense's turnaround against Cincinnati and the defensive pressure that forced Joe Burrow into mistakes. - Pittsburgh Steelers (YouTube): https://www.youtube.com/watch?v=DeKiHvV1knI - Pittsburgh Steelers (YouTube): https://www.youtube.com/watch?v=m3IJx725QYQ - Pittsburgh Steelers (YouTube): https://www.youtube.com/watch?v=335NldWL2QY - Not Just Football with Cam Heyward: https://www.youtube.com/watch?v=o3hW7elYvVA Team USA: * ESPN Rates Pochettino's Debutants Latest developments: ESPN graded the United States men's performance against Peru on Monday, September 28, giving Sebastian Berhalter a 10 and Justin Ellis a 9, and reported a palpable excitement around the camp after the 11 debuts coach Mauricio Pochettino handed out. Pochettino used the 4-1 friendly win over Peru in Orlando, Florida, on Saturday, September 26, the Americans' first match since the 2026 World Cup, to start rebuilding the squad around teenagers with the 2030 tournament in view. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/50037515/usmnt-player-ratings-ellis-gets-9-berhalter-10-peru-rout - ESPN Soccer: https://www.espn.com/soccer/story/_/id/50038192/theres-palpable-sense-excitement-surrounding-usmnts-young-guns READING ---------------------------------------------------------------- * Stratechery -- Apps, Agents, and Aggregation Ben Thompson argues that artificial intelligence agents are the ultimate aggregators, standing between users and everything they want done, which recasts apps as a means to an end and makes owning the agent layer the largest prize in technology. https://stratechery.com/2026/apps-agents-and-aggregation/ * Cal Newport -- It's Time to Investigate the AI Labs Newport catalogs what he calls brazen behavior by the two leading frontier artificial intelligence labs over recent months, starting with a run of carefully staged announcements, and calls for outside investigation of the companies. https://calnewport.com/its-time-to-investigate-the-ai-labs/ * Ed Zitron -- Premium: The Hater's Guide To AI Debt (Part 2) Zitron continues his accounting of the borrowing behind the artificial intelligence buildout, framing it as a satire in which a vest-wearing hyperscaler chief executive gets summoned to a critical finance meeting to learn what the data centers cost. https://www.wheresyoured.at/premium-the-haters-guide-to-ai-debt-part-2/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,736.58 ▲ +1.7% Dow 51,720.54 ▼ -0.3% Nasdaq 27,062.10 ▲ +3.2% WTI crude 93.91 ▼ -8.3% EUR/USD 1.1430 ▼ -0.8% GBP/USD 1.3311 ▼ -1.0% USD/JPY 157.79 ▲ +1.8% FEED HEALTH ---------------------------------------------------------------- Security: 24 of 24 feeds loaded, 26 items in the 24-hour window. No recent items: Krebs on Security, Schneier on Security, Dark Reading, The Record, Ars Technica Security, Securelist (Kaspersky), Sophos News, Unit 42 (Palo Alto), Google Online Security Blog, Cisco Talos, Graham Cluley, Microsoft Security Blog, Google Project Zero, The DFIR Report, Kim Zetter (Zero Day), 404 Media, Frank on Fraud, Wired Security. Pittsburgh: 9 of 9 feeds loaded, 60 items in the 48-hour window. No recent items: NEXTpittsburgh, Pittsburgh Magazine. Business and Politics: 8 of 8 feeds loaded, 60 items in the 36-hour window. Events: 4 of 4 feeds loaded, 10 items in the 120-hour window. Sports media: 6 of 6 feeds loaded, 30 items in the 96-hour window. No recent items: Footbahlin with Ben Roethlisberger, Ben Roethlisberger / Channel Seven (YouTube). Team USA: 3 of 3 feeds loaded, 26 items in the 72-hour window. No recent items: Guardian Olympics. Reading: 3 of 3 feeds loaded, 12 items in the 336-hour window. Markets (Yahoo Finance): 7 of 7 rows Weather (NWS): 3 forecast periods Scores (ESPN, plaintextsports): 3 teams via plaintextsports; mlb: ESPN failed (mlb: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nfl: ESPN failed (nfl: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nhl: ESPN failed (nhl: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nhl: plaintextsports page last published Sep 25 Summaries: 3 model call(s) served by claude-opus-5 (280s of model time; $1.60 at API list price). ================================================================ Generated 2026-09-28 07:05 EDT. Updated weekdays at about 7:05 AM, 10:05 AM, 1:35 PM, and 7:35 PM ET, and weekends at about 8:05 AM and 7:35 PM ET. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 3 Team USA feeds; WSJ World News, WSJ Markets, WSJ US Business, WSJ Politics, The Economist, FT Home, FT World, FT Markets; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN or plaintextsports.com. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================