Mandiant put names on the malware coming through Citrix NetScaler—WHIPSHOT and SLAPSHOT—as researchers published the pre-authentication path to shellcode on the day CISA's federal patch deadline expires.
Emerging Trends and Key Updates
- Trend Two of the day's worst bugs sit in rarely audited DTLS code, with a 9.5-rated NetScaler overflow now tied to WHIPSHOT and SLAPSHOT alongside an OpenSSL heap leak.
- Trend Autonomous agents now work both sides, as an AI-driven intrusion hit DIVD, the Dutch volunteer disclosure group, while commentators press for formal investigation of the frontier AI labs.
- Trend Cisco Talos tied UAT-11587's Antino backdoor to government targets in Taiwan and Cambodia, while investigators found a ransomware toolkit on South African air traffic control networks.
- Update · new An attacker compromised OpenInfra Europe's self-hosted Artifactory at artifactory.nordix.org and planted 101 malicious npm packages, turning registries that build pipelines trusted into delivery routes.
- Update · new Long-term Treasury yields retreated from a 25-year peak as France and Italy printed multiyear inflation highs and Trump refereed a lobbying fight over diesel exports.
- Update · new Carnegie Mellon drew notice twice, accepting a $3 billion gift from Ken Griffin and canceling the Democratic Socialists of America convention that CMU Progressives arranged on campus.
Security
1. NetScaler Exploitation Yields WHIPSHOT and SLAPSHOT
Latest developments: Mandiant Consulting and Google Threat Intelligence Group named the tooling on September 30, 2026—web shells they call WHIPSHOT and tunneling malware they call SLAPSHOT—and placed the victims in government, financial services, technology, education, and legal and professional services across North America and Europe, while researchers published the mechanics of CVE-2026-88772, a 9.5-rated memory overflow in the way NetScaler handles Datagram Transport Layer Security that carries an attacker from zero credentials to shellcode, on the day CISA's deadline for federal agencies to patch arrives.
read more
Citrix fixed CVE-2026-88771 and CVE-2026-88772 in NetScaler ADC and NetScaler Gateway after weeks of zero-day attacks that reach appliances running the default configuration. Attackers take root, harvest credentials, and pivot into internal networks, so patch the appliances, rotate secrets, and hunt for web shells and new accounts.
Sources: The Hacker News · The Hacker News · BleepingComputer · Dark Reading · ↑ top
2. Attackers Poison OpenInfra's Artifactory and 101 npm Packages
Latest developments: OpenInfra Europe, the regional hub of the OpenInfra Foundation, posted a notice on its homepage on September 30, 2026 saying an attacker compromised the self-hosted JFrog Artifactory instance it runs at artifactory.nordix.org, and told anyone who downloaded or installed artifacts from that server between August 28 and September 15, 2026 to stop using them, pull them out of their pipelines, and treat the packages as compromised; OX Security researchers Nir Zadok, Moshe Siman Tov Bustan, and Vitalii Chepurko separately counted 101 malicious npm packages that abuse the open-source Baileys WhatsApp project to add developers to WhatsApp groups without consent, a campaign they call PhantomSub.
read more
Both attacks target the registries developers pull from rather than the code they write, so a single poisoned artifact reaches every build that fetched it. Audit dependency caches and continuous integration logs for the Nordix window and remove the flagged npm packages.
Sources: Help Net Security · The Hacker News · ↑ top
3. UAT-11587 Delivers the Antino Backdoor Across Asia
Latest developments: Cisco Talos disclosed a China-nexus cluster it tracks as UAT-11587 on September 30, 2026 that hits government and policy organizations in Taiwan, India, the Philippines, and Cambodia with a previously undocumented backdoor that developer artifacts in the code call Antino, and SecurityWeek reported the same day that the larger phishing campaigns Russia's Star Blizzard runs through its RedFlick delivery chain install a backdoor named CosmicPulse.
read more
Two state programs gained fresh named payloads: Antino against Asian government and policy bodies, CosmicPulse against organizations tied to Ukraine. Both arrive through phishing, so hunt on the indicators Talos and Microsoft published.
Sources: Cisco Talos · SecurityWeek · ↑ top
4. OpenSSL and wolfSSL Close High-Severity Holes
Latest developments: OpenSSL shipped fixes on September 29, 2026 for a high-severity bug in its Datagram Transport Layer Security code that hands unencrypted heap memory to the far side of a connection or crashes the program when a handshake retransmission begins while a larger handshake message sits half-sent, and SecurityWeek counted roughly a dozen patched vulnerabilities in each of OpenSSL and wolfSSL.
read more
The two libraries sit underneath VPNs, embedded devices, and anything speaking TLS over UDP, so the flaw reaches far past the projects themselves. Rebuild and redeploy every product that statically links either library.
Sources: The Hacker News · SecurityWeek · ↑ top
5. A Ransomware Toolkit Reaches South African Air Traffic Control
Latest developments: South Africa asked for outside help after a cyberattack on its air traffic control systems, and investigators found a ransomware toolkit installed on at least one operational network, Dark Reading reported on September 30, 2026.
read more
Aviation infrastructure keeps drawing attackers, and this time the intrusion reached a network that controls live air traffic rather than a back office. Operators should segment operational networks from corporate ones and verify that flight-critical systems carry current patches.
Sources: Dark Reading · ↑ top
6. An AI Agent Breaches the Dutch Institute for Vulnerability Disclosure
Latest developments: The Dutch Institute for Vulnerability Disclosure, the volunteer nonprofit that finds and reports flaws to their owners, disclosed an AI-driven attack on its own systems that it described as "loud and very, very messy," and Dark Reading detailed a patched Unsloth Studio vulnerability that lets a malicious AI model execute arbitrary Python code during routine inspection by way of the trust_remote_code setting.
read more
Automated agents now run intrusions noisily enough to leave heavy forensic trails, and the tooling researchers use to open unknown models doubles as an execution path. Treat downloaded models as untrusted code and keep trust_remote_code off.
Sources: BleepingComputer · Dark Reading · ↑ top
Business and Politics
Treasury Yields Retreat From a 25-Year Peak
Latest developments: Bond markets rebounded Wednesday morning, September 30, a day after long-term United States borrowing costs reached their highest level in almost 25 years, as traders trimmed bets on another Federal Reserve increase.
read more
Gold futures rose, European and Asian indexes opened higher, and United States stock futures climbed as yields eased and oil slipped, with Goldman Sachs estimating Gulf crude exports recovered to 23.3 million barrels a day in the week through September 28, roughly the 2025 average. New York Fed President John Williams signaled the next rate increase can wait, which cooled the selloff that had run through the prior week.
Sources: FT World · WSJ Markets · WSJ World News · ↑ top
French and Italian Inflation Reach Multiyear Highs
Latest developments: Inflation readings published Wednesday, September 30, put France and Italy at multiyear highs on energy costs, strengthening the case for another European Central Bank increase next month.
read more
French inflation topped forecasts as energy prices climbed, and Vanguard, one of the largest holders of French government debt, said Paris is "degrading credit" as borrowing costs surge, with the Iran war compounding the fiscal strain ahead of a budget fight. The euro sits near a 16-month low against the dollar after Tuesday's slide.
Sources: WSJ World News · FT World · ↑ top
Trump Holds Crunch Talks on a Diesel Export Ban
Latest developments: The White House convened decisive talks on restricting diesel exports Wednesday, September 30, with President Trump personally refereeing a lobbying fight between the oil industry and senior Republicans who warn of voter anger over fuel prices five weeks before the November 3 midterms.
read more
Energy Secretary Chris Wright has pointed toward a voluntary cap rather than an outright ban; refiners say a hard ban would throttle supply, and European diesel futures move on the prospect that American cargoes stop crossing the Atlantic. Chinese refineries, running at 75% of capacity, hold the spare capacity that could relieve the global diesel squeeze.
Sources: FT Home · WSJ Markets · ↑ top
The American Military Finishes Its Iraq Withdrawal
Latest developments: The United States military said Wednesday, September 30, that it has pulled the last American troops out of Iraq, closing a 12-year mission against the Islamic State.
read more
Baghdad's demand that tens of thousands of militants surrender their weapons has fallen short, and the Wall Street Journal describes a country left exposed as Washington's war with Iran feeds the armed factions inside it. The exit removes the American ground presence from the country that sits between Iran and the Gulf oil corridor.
Sources: WSJ World News · ↑ top
Pittsburgh
Weather
Today: Patchy Fog then Partly Sunny, high 78F.
Tonight: Mostly Cloudy, low 62F.
Thursday: Partly Sunny, high 82F.
Business
Ken Griffin Gives Carnegie Mellon $3 Billion
Latest developments: Carnegie Mellon University announced Wednesday, September 30, a $3 billion gift from Citadel founder Ken Griffin, described as the largest contribution any individual has made in the history of higher education.
read more
The money opens a new Carnegie Mellon campus in Miami and expands the Oakland campus in Pittsburgh. Griffin, who moved Citadel's headquarters to Miami, has spent years working to build the Florida city into a rival of New York and London.
Sources: Pittsburgh Post-Gazette · KDKA · WPXI · ↑ top
Pittsburgh Mills Goes Under Contract
Latest developments: The owner of The Galleria at Pittsburgh Mills confirmed to WTAE on Tuesday evening, September 29, that the Frazer Township mall sits under contract for sale, a step beyond Tuesday's reporting that the buyer's identity remained unknown.
read more
The mall has spent years in foreclosure, litigation, and municipal fines, and crews finished repaving its roads only last week. The owner has yet to name the buyer or the intended use of the property.
A Pittsburgh Plumber Builds a YouTube Business
Latest developments: Pittsburgh City Paper profiled Nick Hotujec on Wednesday, September 30, tracing how the master plumber turned Cheddar's Plumbing Co. into a large YouTube and TikTok following.
read more
Hotujec toured with local hardcore bands and studied jiu-jitsu before building the plumbing company, and he now films the trade for an audience far beyond his service area.
Sources: Pittsburgh City Paper · ↑ top
Around Town
Mt. Lebanon Station Waits a Year for Its Elevator
Latest developments: PublicSource published an account Wednesday, September 30, of why the elevator at the Mt. Lebanon light rail station has stayed out of service for more than a year.
read more
Laura Szafranski, a regular rider who depends on the elevator, told PublicSource that older and disabled passengers bear the cost of the delay, asking, "Why did it take so long?" The station sits on the light rail line that carries South Hills riders into downtown Pittsburgh.
Sources: PublicSource · ↑ top
Carnegie Mellon Cancels the DSA Convention
Latest developments: Pittsburgh City Paper reported Wednesday, September 30, that Carnegie Mellon University canceled a Democratic Socialists of America convention that CMU Progressives had arranged to host on campus.
read more
The university says hosting the organization would run afoul of the law; DSA figures including Ashik Siddique call the cancellation a possible return of Red Scare tactics. The group has grown into a force in Pittsburgh politics while facing threats and venue cancellations.
Sources: Pittsburgh City Paper · ↑ top
Penn Hills Weighs Lincoln Park's Future
Latest developments: Pittsburgh City Paper reported Wednesday, September 30, that Penn Hills faces a choice on its Lincoln Park neighborhood between new development and letting the emptied blocks revert to urban prairie.
read more
Many structures in Lincoln Park have deteriorated past repair, and demolition has thinned the neighborhood, though residents and investors point to scattered signs of life on the remaining blocks.
Sources: Pittsburgh City Paper · ↑ top
Events
Reel Q Opens Friday
Latest developments: The Post-Gazette previewed Reel Q on Wednesday, September 30, two days before the festival opens.
read more
Reel Q, Pittsburgh's LGBTQ+ film festival, opens Friday, October 2, 2026, with a program of features, short films, and international selections, among them the entries "House" and a documentary on medical malpractice.
Sources: Post-Gazette Arts & Entertainment · ↑ top
Oktoberfest Pittsburgh Opens Downtown
Latest developments: Pittsburgh City Paper published its October event guide Wednesday, September 30, listing the month's openings beginning Thursday, October 1.
read more
Oktoberfest Pittsburgh runs noon to 8 p.m. Thursday, October 1, through Sunday, October 11, at multiple downtown locations, free and open to all ages, with details at oktpgh.com. The same day the Pittsburgh Society of Artists opens its 60th Annual Exhibition at 2525 Rochester Road in Cranberry Township, 10 a.m. to 8 p.m. through Friday, October 30, free, and the Sound Series brings guitarist Eli Winter to the North Side.
Sources: Pittsburgh City Paper · ↑ top
Halloween Hangout Comes to the North Shore
Latest developments: Pittsburgh City Paper profiled ScareHouse founder Scott Simmons on Wednesday, September 30, and published its roundup of the region's Halloween season events the same morning.
read more
Simmons, who built the ScareHouse haunted attraction, now runs the company Needs More Fog and has opened Halloween Hangout on Pittsburgh's North Shore. City Paper's companion guide lists Halloween parties, scary movie screenings, and family events across the city through October.
Sources: Pittsburgh City Paper · Pittsburgh City Paper · ↑ top
Public Image Ltd Returns After a Decade
Latest developments: TribLive reported Wednesday, September 30, that Public Image Ltd will play Pittsburgh for the first time in more than 10 years.
read more
John Lydon, who fronted the Sex Pistols as Johnny Rotten before founding Public Image Ltd, leads the band on the return visit.
Sports
Steelers (2-1, T-1st in AFC North)
Up Next · Steelers @ Browns · Thu Oct 1, 8:15 PM
Penguins (0-0-0, 0 pts)
Up Next · Penguins @ Flyers · Wed Sep 30, 7:30 PM
Around the Teams
Harmon Talks Through the Strip-Sack
Latest developments: Derrick Harmon joined Not Just Football on Wednesday morning, September 30, to break down the forced fumble that ended the Cincinnati game and to describe a short week before Thursday's kickoff at Cleveland.
read more
Cam Heyward and co-host Hayden worked through the win over the Bengals with the second-year defensive lineman, handed out their weekly Unsung Hero awards, and continued their "Roll the Tape" series by roasting the football scenes in Little Giants. The Steelers play the Browns Thursday, October 1, at 8:15 p.m. ET on Prime Video.
Sources: Not Just Football with Cam Heyward · ↑ top
Team USA
Teenagers Carry the United States Past Chile
Latest developments: Mathis Albert, 17, scored in the United States men's 4-2 win over Chile in St. Louis on Tuesday night, September 29, passing Christian Pulisic as the youngest goal scorer in program history.
read more
Albert, who plays for Borussia Dortmund, put the game away with the fourth American goal, and fellow teenager Julian Hall also scored in Mauricio Pochettino's second friendly of the window. Center back Chris Richards scored and steadied an inexperienced defense after the Americans fell behind, drawing an 8 out of 10 in ESPN's ratings.
Sources: ESPN Soccer · ESPN Soccer · ESPN Soccer · ↑ top
Berhalter Scores and Assists Again
Latest developments: Sebastian Berhalter registered a goal and an assist against Chile on Tuesday, September 29, the second straight match he has done both.
read more
The Vancouver Whitecaps midfielder, son of former United States coach Gregg Berhalter, has taken over the creative work in Mauricio Pochettino's young squad while the teenagers draw the headlines.
Sources: ESPN Soccer · ↑ top
Tim Ream Retires From the National Team
Latest developments: Tim Ream announced his retirement from the United States men's national team, ESPN reported Tuesday, September 29.
read more
The Charlotte FC center back anchored the American defense across a decade and two World Cups, and he leaves the squad as Mauricio Pochettino turns the backline over to Chris Richards and a group of teenagers.
Sources: ESPN Soccer · ↑ top
Reading
- Stratechery — OpenAI Dev Day, Dot and OpenAI’s Product Transition, Sign In With ChatGPT. Ben Thompson calls OpenAI's Dev Day announcements confusing on their face, then argues they add up to a coherent transition from model provider to consumer platform, with Sign In With ChatGPT as the identity layer that would make it stick.
- Ed Zitron — Dead Money. Zitron continues his accounting of the artificial intelligence build-out, arguing that the capital pouring into Nvidia, Anthropic, and OpenAI will never earn a return.
- Cal Newport — It’s Time to Investigate the AI Labs. Newport points to months of brazen behavior by the two leading frontier labs, starting with a run of carefully staged announcements, and argues the conduct now warrants formal investigation.
Markets
S&P 500 7,701.62 ▲ +0.4% Dow 51,504.32 ▼ -0.5% Nasdaq 26,912.41 ▲ +1.0% WTI crude 92.23 ▼ -6.8% EUR/USD 1.1391 ▼ -0.8% GBP/USD 1.3256 ▼ -1.0% USD/JPY 157.87 ▲ +1.0%
Feed Health
Security: 24 of 24 feeds loaded, 71 items in the 24-hour window. No recent items: Krebs on Security, Schneier on Security, Ars Technica Security, Securelist (Kaspersky), Sophos News, Unit 42 (Palo Alto), Google Online Security Blog, Google Project Zero, The DFIR Report, Kim Zetter (Zero Day), Frank on Fraud.
Pittsburgh: 9 of 9 feeds loaded, 60 items in the 48-hour window.
Business and Politics: 8 of 8 feeds loaded, 60 items in the 36-hour window.
Events: 4 of 4 feeds loaded, 8 items in the 120-hour window. No recent items: NEXTpittsburgh Events, NEXTpittsburgh Arts & Entertainment.
Sports media: 6 of 6 feeds loaded, 30 items in the 96-hour window.
Team USA: 3 of 3 feeds loaded, 28 items in the 72-hour window. No recent items: Guardian Olympics.
Reading: 3 of 3 feeds loaded, 12 items in the 336-hour window.
Markets (Yahoo Finance): 7 of 7 rows
Weather (NWS): 3 forecast periods
Scores (ESPN, plaintextsports): 2 teams via plaintextsports; mlb: ESPN failed (mlb: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nfl: ESPN failed (nfl: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nhl: ESPN failed (nhl: HTTP 403 (server: AkamaiGHost)); used plaintextsports
Summaries: 3 model call(s) served by claude-opus-5 (288s of model time; $1.79 at API list price).