================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Monday, October 5, 2026 - 7:05 AM EDT ================================================================ Attackers exploited a third NetScaler zero-day against appliances Citrix customers had patched days earlier, while an AI-discovered file server flaw drew attacks and AI-written bug reports shut down Google's open-source bounty. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets | Feed Health EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Attackers are already probing CVE-2026-61500, a Rejetto HFS session forgery flaw an AI system found, while Google froze its open-source bug bounty under a flood of machine-written reports. see: AI-Found Rejetto HFS Flaw Under Attack; Google Freezes Its Open-Source Bug Bounty * [UPDATE (new)] Citrix confirmed exploitation of CVE-2026-88779 against freshly patched NetScaler appliances, and Microsoft shipped an out-of-band Exchange Server fix for CVE-2026-96940 on the same day. see: NetScaler Zero-Day Hits Freshly Patched Appliances; Out-of-Band Exchange Fix for CVE-2026-96940 * [UPDATE (new)] Huntress found legitimate remote monitoring software in 45 percent of first-quarter endpoint incidents, as the Senate passed a bipartisan healthcare cybersecurity bill following 730 breaches last year. see: RMM Tools Carry Attackers Into Endpoints; Senate Passes a Healthcare Cybersecurity Bill * [TREND] European political risk piles up as the euro hits a 17-month low on French debt fears, Sánchez calls a November 29 election, and Flávio Bolsonaro forces a Brazilian runoff. see: The Euro Slides as France's Debt Worries Spread; Sánchez Calls a Snap Spanish Election; Flávio Bolsonaro Leads Brazil Into a Runoff * [TREND] Commentators turn on the AI boom, with Zitron picking apart GDP projections, Newport urging investigations of the frontier labs, and Ben Thompson calling Apple's walled garden a constraint. see: Premium: How Has AI Changed The Economy?; It's Time to Investigate the AI Labs; Apple and a Hacker's Future * [UPDATE (new)] Pittsburgh installs 10 Walk of Fame markers for Mario Lemieux and Myron Cope, while a new partnership pushes the Three Rivers Heritage Trail toward 40 miles. see: Ten Markers Join the Pittsburgh Walk of Fame; The Heritage Trail Pushes Toward 40 Miles SECURITY ---------------------------------------------------------------- 1. NETSCALER ZERO-DAY HITS FRESHLY PATCHED APPLIANCES Vulnerabilities and Exploits · [zero-day, patch, exploit] Latest developments: Citrix confirmed that attackers exploited CVE-2026-88779, rated 8.7, against NetScaler ADC and Gateway appliances administrators had just patched for CVE-2026-88771 and CVE-2026-88772, and researchers tied the memory overflow to crashes that knock SAML authentication deployments offline while they test the bug for remote code execution. The flaw sits in how NetScaler ADC and NetScaler Gateway handle a memory buffer, and a single hit takes the appliance down, cutting remote access for everyone behind it. Citrix shipped emergency builds, and CISA placed the bug in its Known Exploited Vulnerabilities catalog, which starts the Binding Operational Directive 26-04 clock for federal agencies. - The Hacker News: https://thehackernews.com/2026/10/new-netscaler-zero-day-exploited-in.html - SecurityWeek: https://www.securityweek.com/exploitation-of-citrix-netscaler-zero-day-hits-appliances-patched-days-earlier/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/citrix-patches-netscaler-saml-zero-day-exploited-in-attacks/ - CISA Advisories: https://www.cisa.gov/news-events/alerts/2026/10/04/cisa-adds-one-known-exploited-vulnerability-catalog 2. AI-FOUND REJETTO HFS FLAW UNDER ATTACK Vulnerabilities and Exploits · [exploit, ai, patch] Latest developments: VulnCheck reported on October 5, 2026 that attackers are probing CVE-2026-61500, the 9.3-rated session forgery flaw in Rejetto HTTP File Server that an AI system discovered, where a weak pseudo-random number generator hands an attacker a predictable session-cookie signing key. Rejetto HFS is a small Windows file server that administrators and hobbyists expose straight to the internet. Whoever recovers the signing key forges an administrator session and runs code on the host, so upgrade the software or take the server off the internet. - SecurityWeek: https://www.securityweek.com/exploitation-hits-rejetto-hfs-vulnerability-discovered-by-ai/ - The Hacker News: https://thehackernews.com/2026/10/attackers-target-rejetto-hfs-flaw-that.html 3. GOOGLE FREEZES ITS OPEN-SOURCE BUG BOUNTY AI Security · [ai, bug-bounty, policy] Latest developments: Google's rules page states that as of October 1, 2026 the Open Source Software Vulnerability Rewards Program accepts no further product vulnerability reports, a pause the company blames on a surge of automated, AI-generated submissions that swamped the engineers and open-source maintainers who triage them. OSS VRP pays researchers for flaws in Google's open-source projects and the ecosystem around them. Volunteer maintainers now absorb the triage cost of machine-written reports that amount to noise, and legitimate researchers lose a payout channel while the pause holds. - BleepingComputer: https://www.bleepingcomputer.com/news/google/google-halts-open-source-bug-bounty-program-amid-ai-spam-surge/ - Help Net Security: https://www.helpnetsecurity.com/2026/10/05/google-ai-generated-vulnerability-reports-pause/ 4. OUT-OF-BAND EXCHANGE FIX FOR CVE-2026-96940 Vulnerabilities and Exploits · [patch, vulnerability] Latest developments: Microsoft shipped an out-of-band update on October 5, 2026 for CVE-2026-96940, a high-severity Exchange Server flaw that lets an authenticated attacker read the email and attachments of other users in the same organization; the Exchange Server Team found the bug internally and sees no active exploitation. The flaw stops at tenant boundaries, so an attacker reaches mailboxes only inside an organization where they already hold an account. Microsoft considers the risk high enough to break its patch schedule, and administrators should install the update now. - Help Net Security: https://www.helpnetsecurity.com/2026/10/05/exchange-server-vulnerability-cve-2026-96940/ 5. RMM TOOLS CARRY ATTACKERS INTO ENDPOINTS Ransomware and Cybercrime · [malware, detection] Latest developments: Huntress found legitimate remote monitoring and management software in 45 percent of the endpoint-related incidents it recorded in the first quarter of 2026, and in its ranking of 11 attack tactics by frequency and damage, RMM abuse lands at the top for how often the company sees it. Attackers install the same management agents IT departments run every day, so the binaries, certificates, and outbound traffic look like business as usual to defenders. Inventory the RMM products that belong on your network and alert on every other one that appears. - Help Net Security: https://www.helpnetsecurity.com/2026/10/05/remote-monitoring-and-management-rmm-abuse/ 6. SENATE PASSES A HEALTHCARE CYBERSECURITY BILL Policy and Regulation · [policy, healthcare, breach] Latest developments: The United States Senate passed a bipartisan bill to strengthen healthcare cybersecurity, SecurityWeek reported on October 5, 2026, against a tally of more than 730 breaches last year that reached over 270 million Americans at an average cost of $10 million each. Hospitals, insurers, and their vendors hold dense patient records and run clinical systems that tolerate no downtime, which keeps the sector near the top of attacker target lists. The breach figures cited in the debate cover a single year across the industry. - SecurityWeek: https://www.securityweek.com/senate-passes-bipartisan-bill-to-strengthen-healthcare-cybersecurity/ BUSINESS AND POLITICS ---------------------------------------------------------------- * Flávio Bolsonaro Leads Brazil Into a Runoff Latest developments: First-round returns from Sunday's vote, October 4, put Senator Flávio Bolsonaro well clear of President Luiz Inácio Lula da Silva and send the race to a runoff, overturning the dead heat final polls had shown. Flávio Bolsonaro, son of the jailed former president Jair Bolsonaro, took a commanding lead in Brazil's presidential first round, and The Economist judged voters all but certain to make him the next president of Latin America's largest economy. A Bolsonaro restoration would end four years of Lula and reset fiscal, trade, and Amazon policy for a country that anchors emerging-market debt and equity indexes. - FT Home: https://www.ft.com/content/028da85c-0e1f-4f1b-ad04-eac78c4f18c0?syn-25a6b1a6=1 - FT Home: https://www.ft.com/content/1ab64d24-0f32-4dc8-86b5-20d06e3b3588?syn-25a6b1a6=1 - The Economist: https://www.economist.com/the-americas/2026/10/05/the-bolsonaro-comeback-in-brazil - FT World: https://www.ft.com/content/7feba19e-b498-4453-a744-214638044f0a?syn-25a6b1a6=1 * The Euro Slides as France's Debt Worries Spread Latest developments: The euro fell Monday morning, October 5, to its weakest level against the dollar since 2025—a 17-month low by the Financial Times' count, 16 months by the Wall Street Journal's—and to an 11-week low against sterling, while French government bond yields held at elevated levels and the WSJ flagged contagion risk heading into the United States session. France's deficit and political paralysis have driven its borrowing costs to multiyear premiums over Germany, and Rabobank told the Wall Street Journal that France's fiscal and political problems now arguably exceed Britain's. High energy prices compound the pressure on the single currency, and a Financial Times editorial urged the European Central Bank to suspend quantitative tightening until bond markets settle; United States stock futures held steady after Friday's rally on weak jobs data, and gold rose as traders pared bets on an October Federal Reserve increase. - FT Home: https://www.ft.com/content/8b19b9f7-9237-47bf-bc50-d8b78aa7fe24?syn-25a6b1a6=1 - WSJ Markets: https://www.wsj.com/finance/currencies/euro-falls-to-16-month-low-vs-dollar-weighed-by-french-concerns-d11c9534?mod=rss_markets_main - WSJ Markets: https://www.wsj.com/finance/stocks/u-s-stock-futures-steady-as-french-fiscal-pressure-raises-contagion-risk-468c102a?mod=rss_markets_main - WSJ Markets: https://www.wsj.com/finance/investing/french-bond-yields-stay-elevated-treasury-yields-ease-13103f54?mod=rss_markets_main - FT Home: https://www.ft.com/content/e0dfef01-4933-4ab9-8927-d08115f4822c - WSJ Markets: https://www.wsj.com/finance/currencies/asian-currencies-consolidate-but-may-be-aided-by-reduced-fed-rate-hike-prospects-e8316bd2?mod=rss_markets_main * Sánchez Calls a Snap Spanish Election Latest developments: Prime Minister Pedro Sánchez called a snap general election Monday, October 5, for November 29, after parliament defeated the legislation his government wrote to end Spain's housing crisis. Sánchez, who has governed without a majority through a fractious coalition, is gambling that public fury over soaring rents delivers his Socialist party the majority it lacks. The vote puts the euro area's fourth-largest economy into a seven-week campaign while French fiscal strain already weighs on the single currency. - FT Home: https://www.ft.com/content/866dea03-4cee-4009-b130-6f7a191336c4?syn-25a6b1a6=1 - WSJ World News: https://www.wsj.com/world/europe/spains-prime-minister-sanchez-calls-snap-elections-44caae73?mod=rss_worldnews * Aramco Cuts Asian Prices and Warns Stockpiles Are 'Scarily Thin' Latest developments: Saudi Aramco cut the official selling price of November Arab Light cargoes to Asia by $3 a barrel, to a $5 discount to the Oman/Dubai benchmark, as exports recovered, and Chief Executive Amin Nasser warned Monday, October 5, that Middle East conflict has left world oil inventories 'scarily thin' and up to two years from rebuilding. Crude fell in early Monday trading as Gulf flows revived and the Group of Seven moved ahead with the 100 million barrels of emergency crude and diesel it agreed to release on October 2. Shipowners now pay sailors as much as $25,000 a voyage to run tankers through the Strait of Hormuz past Iranian threats, on shuttle runs the Wall Street Journal priced at up to $40 million, and International Chamber of Commerce Secretary-General John Denton warned that gridlock at the strait threatens a global food crisis alongside the oil shock. - WSJ US Business: https://www.wsj.com/business/energy-oil/saudi-arabia-slashes-crude-prices-for-asia-as-exports-recover-ca411a2c?mod=pls_whats_news_us_business_f - FT Home: https://www.ft.com/content/53e88a8d-65b5-445e-82ee-aee253a32094?syn-25a6b1a6=1 - WSJ Markets: https://www.wsj.com/finance/commodities-futures/oil-prices-mixed-amid-signs-of-attacks-around-strait-of-hormuz-g-7-release-plan-179d43e6?mod=rss_markets_main - WSJ World News: https://www.wsj.com/business/logistics/shippers-are-offering-sailors-up-to-25-000-a-trip-to-sneak-oil-out-of-the-gulf-712d5bd7?mod=rss_worldnews - WSJ World News: https://www.wsj.com/world/middle-east/hormuz-gridlock-risks-global-food-crisis-international-chamber-of-commerce-chief-says-667781c8?mod=rss_worldnews PITTSBURGH ---------------------------------------------------------------- Weather: Today: Sunny, high 67F. Tonight: Mostly Clear, low 41F. Tuesday: Sunny, high 65F. Business: * Why Griffin Put $2 Billion in Wynwood Latest developments: TribLive reported from Miami early Monday, October 5, on why Ken Griffin chose that city's Wynwood neighborhood for a new Carnegie Mellon University campus, putting the Miami share of his gift at $2 billion. Griffin, who founded the hedge fund Citadel and moved it from Chicago to Miami, gave Carnegie Mellon $3 billion—the largest donation to a higher education institution on record—with the bulk building a Miami campus in Wynwood and the balance going to the Pittsburgh campus. Miami already has universities, and Griffin's bet is that importing Carnegie Mellon's computer science reputation does something they cannot. - TribLive: https://triblive.com/news/world/miami-has-universities-why-ken-griffin-bet-2-billion-on-building-a-new-carnegie-mellon/ * Lab-Grown Diamonds Squeeze Pittsburgh Jewelers Latest developments: The Post-Gazette reported Monday, October 5, that the boom in lab-grown diamonds has left Pittsburgh jewelers managing the fallout in what they stock and what they charge. Laboratory-grown stones, chemically identical to mined diamonds and far cheaper, have taken a large share of the engagement ring market in a few years, collapsing prices for the mined inventory retailers already hold. Pittsburgh jewelry stores now carry both and have to explain the difference to buyers. - Pittsburgh Post-Gazette: https://www.post-gazette.com/business/money/2026/10/05/lab-grown-diamonds-pittsburgh/stories/202610040039 Around town: * The Heritage Trail Pushes Toward 40 Miles Latest developments: NEXTpittsburgh reported Monday, October 5, that a new partnership will extend the Three Rivers Heritage Trail, carrying Pittsburgh's riverfront trail network close to 40 miles. Friends of the Riverfront, the nonprofit that builds and maintains the Three Rivers Heritage Trail along the Allegheny, Monongahela, and Ohio rivers, marks 35 years and 35 miles of trail this year. The extension adds connected riverfront miles in a city where the trail doubles as a commuting route. - NEXTpittsburgh: https://nextpittsburgh.com/latest-news/pittsburgh-set-to-extend-three-rivers-heritage-trail-through-new-partnership/ * Ten Markers Join the Pittsburgh Walk of Fame Latest developments: Crews install sidewalk markers Monday, October 5, for 10 new Pittsburgh Walk of Fame inductees, among them Mario Lemieux, Myron Cope, and H.J. Heinz. The Pittsburgh Walk of Fame honors figures who shaped the city with markers set into downtown sidewalks. This year's class spans the Penguins owner and Hall of Fame center Mario Lemieux, the Steelers broadcaster Myron Cope, and the ketchup manufacturer H.J. Heinz. - KDKA: https://www.cbsnews.com/pittsburgh/news/pittsburgh-walk-of-fame-markers-mario-lemieux-myron-cope-h-j-heinz/ * Allegheny County Mail Voting Runs on Normal Rules Latest developments: PublicSource published a guide Monday, October 5, to returning mail ballots in Allegheny County, confirming the process operates as usual after the United States Supreme Court blocked the Trump administration's push to have the Postal Service vet mailed ballots. Allegheny County voters holding mail ballots for the November 3 election can send them back through the mail, drop them at a county return site, or bring them to their polling place on Election Day. Mail ballot requests in the county surged after the Supreme Court ruling. - PublicSource: https://www.publicsource.org/allegheny-county-mail-ballot-return-2026/ SPORTS ---------------------------------------------------------------- Steelers (2-2) Up Next · Colts @ Steelers · Sun Oct 11, 1:00 PM https://plaintextsports.com/nfl/2026/week5/ind-pit Penguins (2-0-0) Up Next · Jets @ Penguins · Mon Oct 5, 7:30 PM https://plaintextsports.com/nhl/2026-10-05/wpg-pit Around the Teams: * The Steelers' Two Biggest Problems Latest developments: The Post-Gazette published its quarter-season diagnosis Monday, October 5, naming the two problems that have defined the Steelers through four games and laying out fixes for each. The paper centers the offense, including how Pittsburgh uses receiver DK Metcalf and running back Jaylen Warren, after a 27-24 Thursday night loss at Cleveland in which pass protection broke down. The Steelers also expect to play multiple games without defensive tackle Derrick Harmon, who hurt his foot. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/10/05/steelers-offense-dk-metcalf-jaylen-warren/stories/202610020055 * Hiles Puts the Pirates' Offseason on Nutting Latest developments: Post-Gazette columnist Noah Hiles argued Monday, October 5, that whatever the Pirates gained this season evaporates unless owner Bob Nutting spends this winter. Hiles writes that general manager Ben Cherington has assembled real young talent around ace Paul Skenes, and that payroll from Nutting now decides whether it amounts to anything. The Pirates head into an offseason with open questions at second base and a looming Major League Baseball labor fight. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/10/05/pirates-offseason-bob-nutting-ben-cherington/stories/202610020002 Team USA: * Pochettino's Teenagers Run Through Mexico Latest developments: ESPN's postmatch coverage added that Julian Hall scored alongside Cavan Sullivan, that Mexico finished with 10 men, that both teenagers rated 9 out of 10, and that coach Mauricio Pochettino called his glut of in-form players 'a fantastic problem to have.' Cavan Sullivan, the 17-year-old Philadelphia Union midfielder, scored from distance Saturday night, October 3, to become the youngest goal scorer in United States men's national team history as the Americans beat Mexico 3-0 at State Farm Stadium in Glendale, Arizona. The win completed three victories from three matches in the October international window for Pochettino, who has leaned hard on debutants and teenagers in the cycle toward the 2030 World Cup. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/50097898/usa-mexico-mauricio-pochettino-julian-hall-cavan-sullivan - ESPN Soccer: https://www.espn.com/soccer/story/_/id/50095800/usmnt-player-ratings-sullivan-hall-9-10-big-win-vs-mexico - ESPN Soccer: https://www.espn.com/soccer/story/_/id/50096908/usa-mexico-cavan-sullivan-mauricio-pochettino-analysis-highlights READING ---------------------------------------------------------------- * Stratechery -- Apple and a Hacker's Future Ben Thompson writes that Apple's walled garden suited him for years, and that artificial intelligence has turned those same protections into constraints on what a technically capable user can build and automate. https://stratechery.com/2026/apple-and-a-hackers-future/ * Ed Zitron -- Premium: How Has AI Changed The Economy? Zitron attacks a Wall Street Journal illustration of artificial intelligence's potential share of gross domestic product, arguing that measuring 2025 through 2032 buries actual results under six years of projection and obscures how little AI has changed the economy so far. https://www.wheresyoured.at/premium-how-has-ai-changed-the-economy/ * Cal Newport -- It's Time to Investigate the AI Labs Newport points to months of what he calls brazen behavior by the two leading frontier artificial intelligence labs, starting with a run of carefully staged announcements, and argues the conduct warrants formal investigation. https://calnewport.com/its-time-to-investigate-the-ai-labs/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,679.05 ▼ -0.7% Dow 51,168.20 ▼ -1.1% Nasdaq 26,908.29 ▼ -0.6% WTI crude 91.28 ▼ -2.8% EUR/USD 1.1334 ▼ -0.8% GBP/USD 1.3236 ▼ -0.6% USD/JPY 157.54 ▼ -0.2% FEED HEALTH ---------------------------------------------------------------- Security: 24 of 24 feeds loaded, 23 items in the 24-hour window. No recent items: Krebs on Security, Schneier on Security, Dark Reading, The Record, Ars Technica Security, Securelist (Kaspersky), Sophos News, Unit 42 (Palo Alto), Google Online Security Blog, Cisco Talos, Graham Cluley, Microsoft Security Blog, Google Project Zero, The DFIR Report, Kim Zetter (Zero Day), 404 Media, Frank on Fraud, Wired Security. Pittsburgh: 9 of 9 feeds loaded, 60 items in the 48-hour window. No recent items: Pittsburgh Magazine. Business and Politics: 8 of 8 feeds loaded, 60 items in the 36-hour window. Events: 4 of 4 feeds loaded, 11 items in the 120-hour window. Sports media: 6 of 6 feeds loaded, 28 items in the 96-hour window. No recent items: Footbahlin with Ben Roethlisberger, Ben Roethlisberger / Channel Seven (YouTube). Team USA: 3 of 3 feeds loaded, 27 items in the 72-hour window. Reading: 3 of 3 feeds loaded, 12 items in the 336-hour window. Markets (Yahoo Finance): 7 of 7 rows Weather (NWS): 3 forecast periods Scores (ESPN, plaintextsports): 2 teams via ESPN Summaries: 3 model call(s) served by claude-opus-5 (287s of model time; $1.66 at API list price). ================================================================ Generated 2026-10-05 07:05 EDT. Updated weekdays at about 7:05 AM, 10:05 AM, 1:35 PM, and 7:35 PM ET, and weekends at about 8:05 AM and 7:35 PM ET. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 3 Team USA feeds; WSJ World News, WSJ Markets, WSJ US Business, WSJ Politics, The Economist, FT Home, FT World, FT Markets; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN or plaintextsports.com. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================