================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Tuesday, October 6, 2026 - 7:05 AM EDT ================================================================ Dell and Atlassian shipped fixes for unauthenticated flaws that hand attackers root on PowerEdge update servers and file reads across eight self-hosted products, while the FBI removed an Accenture contractor it blames for the missed patch behind the ShinyHunters theft of bureau employee records. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets | Feed Health EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Trusted access remains the way in, with pre-auth holes in Dell System Update and Atlassian Data Center and a Danish firm's lawful lookup rights draining Denmark's CPR. see: Dell and Atlassian Patch Pre-Auth Flaws; A Company's Lawful Access Drained Denmark's CPR * [TREND] Attackers keep refining the lure: ClickFix now prefetches its payload into the browser cache as a PNG, while Blinder Tunnel dangles fake Dubai Airports jobs at Iraqi operators. see: ClickFix Hides Its Payload in the Browser Cache; Blinder Tunnel Hits Iraqi Critical Infrastructure * [UPDATE (updated)] The FBI removed an Accenture contractor over its alleged role in the ShinyHunters theft of thousands of bureau employees' records, making patch discipline a contract question. see: FBI Cuts an Accenture Contractor Over Its Breach * [TREND] Pressure on AI mounts as Italy fines IQVIA, OpenAI watermarks EU text, Seoul blames AI models for bank attacks, and Newport calls for investigating frontier labs. see: Italy Fines IQVIA as OpenAI Watermarks EU Text; Hackers Turn an AI Tool on South Korean Banks; It's Time to Investigate the AI Labs * [UPDATE (new)] Houthi strikes on Saudi airports pulled Pakistan and Turkey into a mutual defense pact as oil slipped under $90 and France's debt rout reached American junk bonds. see: Houthis Hit Saudi Airports as Riyadh Invokes a Defense Pact; Oil Slips Under $90 While German Orders Collapse; France's Debt Sell-Off Reaches American Junk Bonds * [UPDATE (new)] The November 3 election shapes local news, with Allegheny County detailing ballot handling and counting and Representative Chris Deluzio opening a three-stop town hall tour in Penn Hills. see: Allegheny County Details Its Ballot Security; Deluzio Opens a Town Hall Tour in Penn Hills SECURITY ---------------------------------------------------------------- 1. DELL AND ATLASSIAN PATCH PRE-AUTH FLAWS Vulnerabilities and Exploits · [patch, vulnerability] Latest developments: Dell told customers on October 5, 2026 to patch CVE-2026-86360, a 9.6-rated path traversal in Dell System Update that carries an unauthenticated remote attacker to arbitrary code execution with root privileges, and Atlassian disclosed CVE-2026-21589 the same day, a 9.3-rated flaw in eight self-hosted Data Center products that lets an attacker with no login read specific files in each product's web application root directory. Dell System Update is the command-line tool enterprise administrators use to push driver, BIOS, and firmware updates to PowerEdge servers, and every version before 2.3.0.0 carries the flaw. Upgrade Dell System Update to 2.3.0.0 and apply Atlassian's fixes; the Atlassian attacker must know a file's exact name and path and cannot list the directory's contents. - Help Net Security: https://www.helpnetsecurity.com/2026/10/06/dell-system-update-vulnerability-cve-2026-86360/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/new-dell-system-update-flaw-lets-hackers-gain-root-privileges/ - The Hacker News: https://thehackernews.com/2026/10/critical-atlassian-flaw-lets.html 2. A COMPANY'S LAWFUL ACCESS DRAINED DENMARK'S CPR Data Breaches · [breach, third-party risk] Latest developments: Denmark's digitalization ministry said on October 5, 2026 that the attackers rode a private Danish company's lawful right to look up records in the Central Person Register, taking names, addresses, and personal identification numbers on roughly 8.8 million people, and the CPR administration learned of it on the evening of Friday, October 2, 2026. The register covers residents of Denmark, deceased people, and citizens who have moved abroad, and its 10-digit CPR number anchors taxes, healthcare, and banking for every one of them. The ministry warns Danes never to treat the CPR number as proof of identity, since the stolen set now circulates. - SecurityWeek: https://www.securityweek.com/8-8-million-impacted-by-data-breach-at-denmarks-central-person-register/ - The Hacker News: https://thehackernews.com/2026/10/denmark-says-attackers-accessed-cpr.html - Help Net Security: https://www.helpnetsecurity.com/2026/10/06/denmark-central-population-register-cpr-data-breach/ 3. FBI CUTS AN ACCENTURE CONTRACTOR OVER ITS BREACH Ransomware and Cybercrime · [breach, law enforcement] Latest developments: Reuters reported, citing two people familiar with the matter, that the FBI removed an Accenture contractor over that contractor's alleged role in the ShinyHunters breach that took personal details on thousands of bureau employees, and the FBI said its review so far traces the incident to a security failure. ShinyHunters, the extortion group whose members face arrests across Europe and the Middle East, stole FBI employee data through a flaw the contractor left unpatched. Saif al-Din Khader, the member known as Rey whom Jordanian authorities detained on September 29, 2026, cooperates with the bureau as it works the case. - The Hacker News: https://thehackernews.com/2026/10/fbi-removes-accenture-contractor-after.html - The Record: https://therecord.media/alleged-shinyhunters-member-detained-jordan-fbi 4. BLINDER TUNNEL HITS IRAQI CRITICAL INFRASTRUCTURE Nation-State Activity · [apt, critical infrastructure, phishing] Latest developments: Palo Alto Networks Unit 42 disclosed Blinder Tunnel on October 6, 2026, an Iran-nexus campaign that dangles fake Dubai Airports recruitment offers at workers inside Iraqi critical infrastructure operators, then runs its malware's command and control through GitHub. The operators lean on job-offer social engineering rather than exploits to land the first payload, and GitHub traffic hides the control channel inside a service most networks already allow. Infrastructure operators in Iraq should treat unsolicited aviation recruitment approaches as a phishing vector and watch outbound GitHub connections from workstations that have no development role. - Unit 42 (Palo Alto): https://unit42.paloaltonetworks.com/blinder-tunnel-targets-critical-infrastructure/ 5. CLICKFIX HIDES ITS PAYLOAD IN THE BROWSER CACHE Ransomware and Cybercrime · [malware, social engineering] Latest developments: The Microsoft Threat Intelligence team described a ClickFix variant on October 6, 2026 in which compromised websites prefetch a script into the visitor's browser cache disguised as a PNG file, so the command the victim pastes loads a payload that already sits on the machine and sidesteps the length limits of the Windows Run dialog. ClickFix campaigns talk users into pasting a command into Windows Run to fix a fake error or clear a fake CAPTCHA, and the cache trick removes the remote download that defenders watch for. Block script execution from browser cache paths, and train staff that no legitimate site asks them to paste a command into Run. - The Hacker News: https://thehackernews.com/2026/10/clickfix-smuggles-payloads-through.html 6. ITALY FINES IQVIA AS OPENAI WATERMARKS EU TEXT Policy and Regulation · [policy, privacy, ai] Latest developments: Italy's Data Protection Authority fined IQVIA 7 million euros, or $7.8 million, over data-processing practices the regulator says left roughly one million patients open to exposure and de-anonymization, and OpenAI moved to embed invisible watermarks in the text that ChatGPT and Codex generate for users in the European Union. IQVIA, the health data and clinical research company, failed to anonymize patient records properly, and the Italian penalty sets a price on weak de-identification for every firm that resells health data. The OpenAI watermarks give European regulators and customers a way to tell machine-written text from human-written text. - BleepingComputer: https://www.bleepingcomputer.com/news/security/iqvia-fined-78-million-for-failing-to-properly-anonymize-health-data/ - BleepingComputer: https://www.bleepingcomputer.com/news/artificial-intelligence/openai-is-adding-invisible-watermarks-to-chatgpt-and-codex-text-in-the-eu/ BUSINESS AND POLITICS ---------------------------------------------------------------- * Houthis Hit Saudi Airports as Riyadh Invokes a Defense Pact Latest developments: Houthi rebels struck two airports inside Saudi Arabia on Tuesday, October 6, and Saudi Arabia, Pakistan, and Turkey triggered their mutual defense pact in response. The strikes answer the counteroffensive Saudi-backed Yemeni forces opened this week to push the Houthis off the Red Sea coast and away from Bab el-Mandab, through which a large share of Europe-bound tanker traffic passes. Turkey has not ratified the pact, so ground deployments remain unlikely for now, leaving air power and missile defense as the near-term response. - WSJ World News: https://www.wsj.com/world/middle-east/yemens-houthi-rebels-strike-two-airports-in-saudi-arabia-072f4dd3?mod=rss_worldnews - FT World: https://www.ft.com/content/f94db6c5-1ad2-4bbf-9fec-4a4ef1e99dba?syn-25a6b1a6=1 * France's Debt Sell-Off Reaches American Junk Bonds Latest developments: The Financial Times reported Tuesday, October 6, that the Treasury rout now feeds through to junk-rated United States companies' borrowing costs, and far-right presidential frontrunner Marine Le Pen published an economic plan capping French public borrowing at 60% of gross domestic product. A pre-election sell-off in French government debt has widened spreads across the euro area and raised fears of broader eurozone contagion, while the parallel climb in United States Treasury yields lifts refinancing costs for the weakest American corporate borrowers. Analysts doubt Le Pen can hit her deficit and debt targets, and British Chancellor John Healey told executives from Barclays, HSBC, and NatWest on Tuesday that the United Kingdom faces a "difficult" fiscal picture, refusing to say whether banks face Budget tax increases. - FT Home: https://www.ft.com/content/7c7ccb82-2973-47af-ad9b-b469c6ea0048?syn-25a6b1a6=1 - FT Home: https://www.ft.com/content/9b252b46-a87c-45e7-a09a-45a39ce077b8?syn-25a6b1a6=1 - FT World: https://www.ft.com/content/4e1a4297-62f4-4b42-a41a-2ad23b64cbe9?syn-25a6b1a6=1 - FT World: https://www.ft.com/content/5b233375-b686-4dc1-ab59-47930f1583ad?syn-25a6b1a6=1 * Hackers Turn an AI Tool on South Korean Banks Latest developments: South Korean President Lee Jae Myung said Tuesday, October 6, that attackers used artificial intelligence models in the cyberattacks on the country's banks, and the Wall Street Journal reported the hackers worked with a freely available Chinese AI tool. The intrusions breached hardened South Korean bank systems and have stirred public anxiety that one government official called "a completely new kind of crisis." The episode gives lenders everywhere a live case of commodity AI tools lowering the skill and cost required to penetrate well-defended financial institutions. - WSJ World News: https://www.wsj.com/world/asia/hackers-use-chinese-ai-tool-to-hit-south-korean-banks-exposing-new-risk-5d4d3885?mod=rss_worldnews - FT World: https://www.ft.com/content/fb32e9f8-4bf7-44ad-983d-1a03f50f66f5?syn-25a6b1a6=1 * Oil Slips Under $90 While German Orders Collapse Latest developments: West Texas Intermediate crude fell below $90 a barrel Tuesday, October 6, as Gulf exports recovered, the same morning German manufacturing orders came in 10.6% lower on the month for August, and President Trump eased limits on tax-free use of red-dyed diesel. Recovering Middle East crude shipments pulled prices down even as fresh shipping incidents around the Strait of Hormuz and the Red Sea kept risk premiums alive, and European natural gas prices rose because storage sits low despite returning Persian Gulf liquefied natural gas flows. The German order slump shows the energy shock from the Middle East and Ukraine conflicts cutting into the euro area's largest economy, and European Commission President Ursula von der Leyen gave exporters an extra year to meet the European Union's methane emission rules to blunt fuel costs. - WSJ Markets: https://www.wsj.com/finance/commodities-futures/oil-little-changed-as-traders-weigh-mideast-crude-export-data-6785f907?mod=rss_markets_main - WSJ World News: https://www.wsj.com/finance/commodities-futures/german-factory-orders-tumbled-in-august-70212cb1?mod=rss_worldnews - WSJ Markets: https://www.wsj.com/articles/european-gas-prices-rise-as-low-storage-leaves-market-vulnerable-cd26ccd5?mod=rss_markets_main - WSJ World News: https://www.wsj.com/world/europe/exporters-to-get-extra-year-for-eus-methane-emission-rules-von-der-leyen-says-b5ecf787?mod=rss_worldnews - FT World: https://www.ft.com/content/1d152b5b-decb-41c3-a197-8de1d1ca26fc?syn-25a6b1a6=1 PITTSBURGH ---------------------------------------------------------------- Weather: Today: Sunny, high 65F. Tonight: Clear, low 43F. Wednesday: Sunny, high 74F. Business: * Pittsburgh Hotel Rooms Get Scarce and Expensive Latest developments: The Post-Gazette reported Tuesday, October 6, that Pittsburgh's crowded weekend calendar has driven hotel rates up and availability down, with Steelers and Penguins dates on the schedule. Downtown and North Shore hotels charge premium rates for the coming weekend as sports and event demand converges on the city. The squeeze follows a fall in which the Pittsburgh region has leaned on visitor spending, and it lands on anyone booking late for a Pittsburgh trip. - Pittsburgh Post-Gazette: https://www.post-gazette.com/local/city/2026/10/06/pittsburgh-hotels-this-weekend-steelers-penguins/stories/202610050052 * Restaurant News From Palm Palm to Dianoia's Latest developments: Pittsburgh City Paper's weekly food column, published Tuesday, October 6, carries fresh news on Titusz, Palm Palm, Dynamic Coffee Roasters, and Dianoia's Eatery, running from a hot sauce release to pumpkin gnocchi. The column tracks menu launches, openings, and promotions across the city's independent restaurants and roasters, including Palm Palm in East Liberty, which Yelp named one of the country's best new restaurants for 2026, and Dianoia's Eatery in the Strip District. It is the standing weekly read for operators and diners watching which Pittsburgh kitchens move. - Pittsburgh City Paper: https://www.pghcitypaper.com/food-drink/food-news-2/ Around town: * Penn-Trafford Weighs Closing McCullough Elementary Latest developments: The Penn-Trafford School Board discussed a consolidation plan Monday night, October 5, that would close McCullough Elementary School and rework the grade levels taught in the district's remaining buildings. The Westmoreland County district opened the reconfiguration discussion to address a budget crunch, and board members have taken no vote. Families in Penn Township and Trafford face a possible change in which building their children attend and at which grades. - TribLive: https://triblive.com/local/westmoreland/penn-trafford-considers-school-consolidation-closing-mccullough-elementary-to-address-budget-crunch/ - WTAE: https://www.wtae.com/article/penn-trafford-mccullough-elementary-school/74042034 - KDKA: https://www.cbsnews.com/pittsburgh/video/penn-trafford-school-board-mulls-consolidation-plan/ * Deluzio Opens a Town Hall Tour in Penn Hills Latest developments: United States Representative Chris Deluzio took constituent questions in Penn Hills on Monday, October 5, the first of three town halls he has scheduled before the November 3 election. The Democrat who represents Pennsylvania's 17th District fielded questions on artificial intelligence data centers, the Supreme Court, and government ethics; Judi Mitchell, 78, of Forest Hills told TribLive she worries about ethics across government. The tour gives voters in Allegheny and Beaver counties a direct audience with their congressman four weeks out from the midterms. - WTAE: https://www.wtae.com/article/congressman-chris-deluzio-ai-data-centers-supreme-court-town-hall/74042121 - TribLive: https://triblive.com/local/penn-hills/constituents-voice-concerns-ahead-of-midterms-at-u-s-rep-chris-deluzio-town-hall/ - WPXI: https://www.wpxi.com/news/local/congressman-chris-deluzio-kicks-off-town-hall-tour-penn-hills/MG4ZNO7TEVD35HOPFLMLCSWJEY/ * Allegheny County Details Its Ballot Security Latest developments: The Allegheny County elections division laid out its handling and counting protocols Monday, October 5, and the Post-Gazette published a step-by-step guide Tuesday, October 6, to requesting, completing, and returning a Pennsylvania mail ballot. County election administrators described the custody and verification steps that govern ballots for the November 3 election, and voters can still choose between voting in person or returning a mail ballot at a drop-off or satellite location. Deadlines for requesting and returning mail ballots now sit weeks away, and errors such as a missing signature or date can void a ballot. - WTAE: https://www.wtae.com/article/pennsylvania-election-ballot-security-allegheny-county/74038416 - WTAE: https://www.wtae.com/article/pennsyvlania-election-day-deadlines-2026-election/74038372 - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/politics-state/2026/10/06/pennsylvania-mail-voting-ballot/stories/202610060006 Events: * Contemporary Craft Centers Disabled Artists Latest developments: The Post-Gazette reviewed "Textures of Being" on Tuesday, October 6, the Contemporary Craft exhibition built around disabled artists and their work. The show gathers craft work by disabled artists at Contemporary Craft in Pittsburgh, with the writers and curators framing the project around care. Admission to Contemporary Craft's galleries is free. - Post-Gazette Arts & Entertainment: https://www.post-gazette.com/ae/art-architecture/2026/10/06/contemporary-craft-disability-textures-of-being-exhibition/stories/202609280051 SPORTS ---------------------------------------------------------------- Steelers (2-2) Up Next · Colts @ Steelers · Sun Oct 11, 1:00 PM https://plaintextsports.com/nfl/2026/week5/ind-pit Penguins (2-1-0) Mon Oct 5 · Jets 3 · Penguins 2 · Final Jets edge Penguins 3-2 as Cole Perfetti scores 9 seconds after tying goal https://plaintextsports.com/nhl/2026-10-05/wpg-pit Up Next · Penguins @ Capitals · Wed Oct 7, 7:30 PM https://plaintextsports.com/nhl/2026-10-07/pit-wsh Around the Teams: * Week 4 Grades Fall on Rodgers and Iheanachor Latest developments: The Post-Gazette published its Week 4 Steelers grades Tuesday, October 6, marking down quarterback Aaron Rodgers, rookie offensive lineman Max Iheanachor, and much of the roster for the game at Cleveland. The paper's grades follow its reporting that the Browns found a template for attacking Pittsburgh's pass protection, with T.J. Watt among the few to come out well. The Steelers now carry a quarter-season body of work in which the offensive line and Rodgers' protection rank as the central problems. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/10/06/nfl-week4-grades-tj-watt/stories/202610060002 * SNR Drive Works Through the Roster Moves Latest developments: Matt Williamson and Wes Uhler spent Monday's SNR Drive, October 5, on the Steelers' roster moves and recapped head coach Mike McCarthy's news conference, with Rob King, the voice of the Steelers, calling in. The show took up the decision to put defensive tackle Derrick Harmon on injured reserve and the signing of veteran cornerback Sean Murphy-Bunting, both of which the team made Monday. McCarthy addressed the media the same day ahead of the Steelers' Week 5 game at the Indianapolis Colts, set for Sunday, October 11, at 1 p.m. Eastern on CBS. - Pittsburgh Steelers (YouTube): https://www.youtube.com/watch?v=mHNKHQ2rsfs - Pittsburgh Steelers (YouTube): https://www.youtube.com/watch?v=MeqXUDduzqY READING ---------------------------------------------------------------- * Stratechery -- Game Decompilation, Is This Legal?, A Well-Trodden Path Ben Thompson works through the legal gray zone around decompiling old games and argues the practice follows a path other media have already traveled. The real disruption to the games business, he contends, comes from new titles and AI-driven personalization rather than from fans reverse-engineering the back catalog. https://stratechery.com/2026/game-decompilation-is-this-legal-a-well-trodden-path/ * Ed Zitron -- Premium: How Has AI Changed The Economy? Zitron attacks a Wall Street Journal illustration of artificial intelligence's potential share of gross domestic product, noting that its 2025-to-2032 window makes most of the chart projection rather than measurement. He argues such framing obscures how little AI has actually changed economic output so far. https://www.wheresyoured.at/premium-how-has-ai-changed-the-economy/ * Cal Newport -- It's Time to Investigate the AI Labs Newport argues the two leading frontier AI labs have behaved brazenly in recent months, starting with a run of carefully staged announcements. He calls for outside scrutiny of their claims and conduct. https://calnewport.com/its-time-to-investigate-the-ai-labs/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,697.10 ▼ -0.3% Dow 51,125.48 ▼ -0.9% Nasdaq 27,039.67 ▲ +0.1% WTI crude 90.64 ▼ -2.8% EUR/USD 1.1309 ▼ -0.9% GBP/USD 1.3239 ▼ -0.3% USD/JPY 157.60 ▼ -0.2% FEED HEALTH ---------------------------------------------------------------- Security: 24 of 24 feeds loaded, 52 items in the 24-hour window. No recent items: Krebs on Security, CISA Advisories, Securelist (Kaspersky), Sophos News, Google Online Security Blog, Cisco Talos, Graham Cluley, Microsoft Security Blog, Google Project Zero, The DFIR Report, Frank on Fraud, Wired Security. Pittsburgh: 9 of 9 feeds loaded, 60 items in the 48-hour window. Business and Politics: 8 of 8 feeds loaded, 60 items in the 36-hour window. Events: 4 of 4 feeds loaded, 9 items in the 120-hour window. Sports media: 6 of 6 feeds loaded, 18 items in the 96-hour window. No recent items: Footbahlin with Ben Roethlisberger, Not Just Football with Cam Heyward, Ben Roethlisberger / Channel Seven (YouTube). Team USA: 3 of 3 feeds loaded, 21 items in the 72-hour window. No recent items: Guardian Olympics. Reading: 3 of 3 feeds loaded, 12 items in the 336-hour window. Markets (Yahoo Finance): 7 of 7 rows Weather (NWS): 3 forecast periods Scores (ESPN, plaintextsports): 2 teams via ESPN Summaries: 3 model call(s) served by claude-opus-5 (329s of model time; $1.69 at API list price). ================================================================ Generated 2026-10-06 07:05 EDT. Updated weekdays at about 7:05 AM, 10:05 AM, 1:35 PM, and 7:35 PM ET, and weekends at about 8:05 AM and 7:35 PM ET. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 3 Team USA feeds; WSJ World News, WSJ Markets, WSJ US Business, WSJ Politics, The Economist, FT Home, FT World, FT Markets; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN or plaintextsports.com. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================