================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Wednesday, October 7, 2026 - 7:06 AM EDT ================================================================ Researchers burned 32 zero-days on the opening day of Pwn2Own Ireland while Anthropic's Project Glasswing counted 129,000 verified software flaws and Google shipped 247 Chrome fixes, a day that showed vulnerability discovery outrunning the patch cycle. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets | Feed Health EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Anthropic folded Project Glasswing into a tiered verification program on the back of machine-verified flaw counts no human team could match, while researchers at Pwn2Own Ireland burned 32 zero-days for $388,500. see: AI Agents Industrialize Vulnerability Discovery; Pwn2Own Ireland Opens With 32 Zero-Days * [TREND] Chrome 155 ships 247 fixes alongside Android's 25 and four SonicWall appliance flaws, while attackers already backdoor WordPress sites through stored cross-site scripting in Ninja Forms. see: Chrome, Android, and SonicWall Ship Fixes; Ninja Forms Flaw Backdoors WordPress Sites * [UPDATE (new)] Ransomware notifications from Advantest and canceled classes at Osaka Metropolitan University land as Arizona's Supreme Court reports a million court records copied, some reaching back 30 years. see: Ransomware Hits Advantest and Osaka Metropolitan University; Arizona's Court System Loses a Million Records * [TREND] A fresh 24-year high in the 30-year Treasury yield met IMF calls for spending cuts, India's first rate rise in three years, and Houthi missiles lifting Brent above $100. see: The Bond Rout Resumes and the IMF Tells Governments to Cut; India Raises Rates for the First Time in Three Years; Houthi Missiles Reach Riyadh as Brent Tops $100 * [UPDATE (new)] Allegheny County's 2027 budget holds taxes flat, Pennsylvania books $516 million from Meta ahead of a Harrisburg spending fight, and Amtrak's second New York trip starts November 18. see: Innamorato's 2027 Budget Holds Taxes Flat; Pennsylvania Collects at Least $516 Million From Meta; Amtrak Sets November 18 for the Second New York Train * [TREND] Zitron's Credit Crunch digs into the debt financing the AI build-out while Newport calls for outside investigation of the frontier labs' carefully staged announcements. see: Credit Crunch; It’s Time to Investigate the AI Labs SECURITY ---------------------------------------------------------------- 1. AI AGENTS INDUSTRIALIZE VULNERABILITY DISCOVERY AI Security · [ai, patch] Latest developments: Anthropic merged its Cyber Verification Program and Project Glasswing into one three-tier program on October 6, 2026, lifting automated blocks on malware analysis and vulnerability testing for approved security professionals, and said Glasswing verified at least 129,000 software vulnerabilities between April and July 2026; Google's PageBreak agent found 500 flaws in Google's own web applications, and the OpenSSH maintainers, shipping version 10.6 the same day, said AI models now generate so many of the security reports they receive that they will cut releases more often to keep up. Vendors run models as bug hunters at a volume human researchers cannot match, which shifts the bottleneck to triage, ownership, and patching inside the projects that receive the reports. OpenSSH 10.6 also turns on a post-quantum signature algorithm, so anyone holding the earlier experimental keys has to replace them. - The Hacker News: https://thehackernews.com/2026/10/anthropic-expands-claude-access-for.html - Help Net Security: https://www.helpnetsecurity.com/2026/10/07/anthropic-expands-cyber-verification-program/ - Dark Reading: https://www.darkreading.com/application-security/google-pagebreak-ai-agent-500-flaws-web-apps - Help Net Security: https://www.helpnetsecurity.com/2026/10/07/openssh-10-6-released/ 2. CHROME, ANDROID, AND SONICWALL SHIP FIXES Vulnerabilities and Exploits · [patch, vulnerability] Latest developments: Google released Chrome 155 with 247 vulnerability fixes, four of them critical use-after-free defects in Chromecast, Browser, Navigation, and Track, and its October 2026 Android updates closed 25 flaws including a critical privilege escalation in the System component; SonicWall patched four bugs in its Secure Mobile Access 1000 series appliances, among them CVE-2026-102255, which lets an unauthenticated remote attacker direct the appliance to issue requests on the attacker's behalf and reach internal functionality; and X.Org fixed 12 flaws in xorg-server 21.1.25 and xwayland-24.1.14, nine of which carry arbitrary code execution. SonicWall says it sees no evidence that anyone exploits the SMA 1000 bugs yet, and those appliances sit at the network edge where attackers have hunted all year. Administrators should restart Chrome to take the update, push the October Android patch level, and rebuild X servers on Linux desktops and workstations. - SecurityWeek: https://www.securityweek.com/chrome-155-update-patches-247-vulnerabilities/ - Help Net Security: https://www.helpnetsecurity.com/2026/10/07/sonicwall-fixes-pre-auth-ssrf-flaw-in-sma-1000-appliances-cve-2026-102255/ - SecurityWeek: https://www.securityweek.com/androids-october-2026-updates-patch-25-vulnerabilities/ - Help Net Security: https://www.helpnetsecurity.com/2026/10/07/x-org-server-fixed-vulnerabilities/ 3. RANSOMWARE HITS ADVANTEST AND OSAKA METROPOLITAN UNIVERSITY Ransomware and Cybercrime · [ransomware, breach] Latest developments: Advantest Corporation, the Japanese maker of semiconductor test equipment, began notifying individuals on October 7, 2026 that a ransomware attack earlier in the year exposed their personally identifiable information, and Osaka Metropolitan University said on October 6, 2026 that a suspected ransomware attack had canceled classes and left its internal network, email, and a range of administrative and academic systems unavailable. Two Japanese institutions in the same week show both halves of the damage: Advantest faces breach notification duties for people whose records attackers took, and Osaka Metropolitan University lost the systems that run teaching. People who hear from Advantest should treat their data as public and monitor accounts. - BleepingComputer: https://www.bleepingcomputer.com/news/security/advantest-confirms-personal-information-stolen-in-ransomware-attack/ - The Record: https://therecord.media/osaka-university-cancels-classes-ransomware 4. ARIZONA'S COURT SYSTEM LOSES A MILLION RECORDS Data Breaches · [breach] Latest developments: The Arizona Supreme Court said attackers copied personal information on more than 1 million people out of the state court system, reaching records as far back as 30 years. Anyone who passed through an Arizona court over three decades—as a party, a juror, or a witness—may sit in the stolen set. Those people should freeze credit, watch for identity theft, and take up whatever monitoring the court offers. - SecurityWeek: https://www.securityweek.com/personal-information-for-over-1-million-people-stolen-in-a-cyberattack-on-arizonas-court-system/ 5. PWN2OWN IRELAND OPENS WITH 32 ZERO-DAYS Vulnerabilities and Exploits · [zero-day, patch] Latest developments: Researchers opened Pwn2Own Ireland 2026 on October 6, 2026 by exploiting 32 zero-day vulnerabilities and collecting $388,500, and two separate entries took over the Samsung Galaxy S26. The contest pays cash for working exploits against fully patched phones, routers, printers, and smart-home devices, then hands the technical details to the vendors. Owners of the Galaxy S26 and the other targeted gear should expect firmware updates in the coming weeks and install them. - BleepingComputer: https://www.bleepingcomputer.com/news/security/hackers-exploit-32-zero-days-on-first-day-of-pwn2own-ireland/ 6. NINJA FORMS FLAW BACKDOORS WORDPRESS SITES Vulnerabilities and Exploits · [exploit, patch] Latest developments: Attackers exploit stored cross-site scripting vulnerabilities in two unrelated WordPress plugins, Ninja Forms and WPC Product Bundles for WooCommerce, to install backdoors and create rogue administrator accounts, BleepingComputer reported on October 6, 2026. Both plugins run on large numbers of lead-capture and WooCommerce storefronts, and a stored script lands in the database where any visiting administrator executes it. Site owners should update both plugins, delete administrator accounts they cannot account for, and hunt for injected JavaScript in posts, forms, and product data. - BleepingComputer: https://www.bleepingcomputer.com/news/security/ninja-forms-plugin-flaw-exploited-to-hack-wordpress-sites/ BUSINESS AND POLITICS ---------------------------------------------------------------- * The Bond Rout Resumes and the IMF Tells Governments to Cut Latest developments: The selloff restarted Wednesday, October 7, after a single day of relief: the 30-year Treasury yield set a fresh 24-year high, French bonds underperformed again, sterling reached a 16-month high against the euro on bets the Bank of England raises rates, and International Monetary Fund Managing Director Kristalina Georgieva told governments to rein in spending and face "very tough political choices" to calm yields. Long-dated government debt has repriced worldwide for two weeks, with French paper carrying the widest risk premium in the euro area as the government of Finance Minister Roland Lescure fights for billions of euros in cuts. The Wall Street Journal describes France's economy as trapped in a negative feedback loop of weak growth and rising debt, and the Financial Times traces how United States mortgage bond hedging amplifies each move in Treasury yields. - WSJ Markets: https://www.wsj.com/finance/investing/u-s-european-government-bond-yields-rise-french-bonds-underperform-on-budget-worries-c068d9ae?mod=rss_markets_main - FT World: https://www.ft.com/content/7eb5da58-d909-4cec-9a30-1c6ec8ffb0a6?syn-25a6b1a6=1 - WSJ Markets: https://www.wsj.com/finance/currencies/asian-currencies-consolidate-but-may-be-aided-by-appetite-for-risk-assets-ee0a9ce8?mod=rss_markets_main - WSJ World News: https://www.wsj.com/economy/global/frances-economy-is-trapped-in-a-negative-feedback-loop-509598a9?mod=rss_worldnews - FT Markets: https://www.ft.com/content/a04ef3b4-2fcf-48f9-ab34-2c40c39d9a0c * India Raises Rates for the First Time in Three Years Latest developments: The Reserve Bank of India raised its policy rate Wednesday, October 7, its first increase in three years, citing higher inflation and energy costs and shifting its stance to tightening. India's central bank joins the global turn back toward tighter money as the war around Iran drives up crude and refined fuel prices in a country that imports most of its oil. The move lands the same week the Bank of Japan's wage data cleared the way for further tightening there and markets priced a Bank of England increase. - FT World: https://www.ft.com/content/713ccee6-855f-48d8-acf1-161265041ad8?syn-25a6b1a6=1 - FT World: https://www.ft.com/content/2895a744-9538-4bc9-ac9b-686677f5cdb2 * Houthi Missiles Reach Riyadh as Brent Tops $100 Latest developments: Houthi rebels fired a new missile barrage at Riyadh and at Aden on Wednesday, October 7, widening Tuesday's strikes on two Saudi airports, and Brent crude climbed back above $100 a barrel as traders added storm shut-ins in the United States Gulf of Mexico to the supply risk. The barrage follows the Saudi-backed Yemeni government offensive launched October 5 to retake the Bab el-Mandab strait, which the Houthis have used to disrupt tanker traffic, and it now reaches the Saudi capital itself. Shell said the Middle East conflict and the global fuel squeeze will push its third-quarter refining margin to a record high. - FT World: https://www.ft.com/content/6a2dc960-c9fd-4795-b5ea-78f9bb77309d?syn-25a6b1a6=1 - WSJ US Business: https://www.wsj.com/business/energy-oil/oil-prices-rise-as-houthi-attacks-u-s-gulf-storm-raise-supply-risks-9a0aacf8?mod=pls_whats_news_us_business_f - WSJ Markets: https://www.wsj.com/finance/commodities-futures/oil-rises-amid-ongoing-mideast-tensions-2c446a1e?mod=rss_markets_main - WSJ US Business: https://www.wsj.com/business/energy-oil/shells-refining-margin-surges-to-record-high-after-middle-east-conflict-upends-fuel-markets-39e45d67?mod=pls_whats_news_us_business_f PITTSBURGH ---------------------------------------------------------------- Weather: Today: Sunny, high 74F. Tonight: Partly Cloudy, low 53F. Thursday: Sunny, high 72F. Business: * Butler Works Lands $75 Million From the Energy Department Latest developments: The United States Department of Energy awarded Cleveland-Cliffs' Butler Works $75 million, and Energy Secretary Chris Wright toured the Butler County mill Tuesday, October 6, talking through steel tariffs and the industry's future with KDKA. The money expands Butler Works' output of electrical steel, the material that goes into transformers and the nation's power grid, and it marks the Trump administration's latest cash infusion into American steelmaking. Butler Works is one of the largest industrial employers north of Pittsburgh. - KDKA: https://www.cbsnews.com/pittsburgh/video/cleveland-cliffs-butler-works-awarded-75-million-from-department-of-energy/ - WPXI: https://www.wpxi.com/news/local/butler-steel-mill-gets-millions-dollars-boost-production-material-used-electrical-grids/VXL4PWXYXFHOFH2AHPIW5MCCFU/ - KDKA: https://www.cbsnews.com/pittsburgh/news/energy-secretary-chris-wright-tariffs-steel-industry/ * Springdale Seniors Fight the Skill Games Ban Latest developments: Senior citizens in Springdale turned out Tuesday, October 6, to press Pennsylvania's state senators to spare skill games, calling the machines their main entertainment and the clubs that hold them their community, as the removal deadline closes in. Pennsylvania's ban forces businesses to physically haul out skill game terminals, and the revenue loss has already put VFW posts and social clubs across the region on notice that they may not keep their doors open. Springdale's protest follows a Green Tree rally by operators on October 3. - TribLive: https://triblive.com/local/valley-news-dispatch/springdale-residents-turn-out-to-protest-looming-skill-games-ban/ * Lost Lizard Reopens the Video Store on Butler Street Latest developments: NEXTpittsburgh reported Wednesday, October 7, that Vincent Santis has turned his personal VHS collection into Lost Lizard, a movie rental shop on Butler Street. Santis stocks the store from a tape hoard he built himself and sells browsing as the product, betting Pittsburgh renters want shelves to wander rather than a streaming menu. - NEXTpittsburgh: https://nextpittsburgh.com/features/lost-lizard-restores-the-art-of-browsing-for-movie-rentals-to-pittsburgh/ Around town: * Innamorato's 2027 Budget Holds Taxes Flat Latest developments: Allegheny County Executive Sara Innamorato presented the numbers to County Council on Tuesday, October 6: a $1.25 billion operating budget inside a roughly $3 billion plan for 2027, with no property tax increase and no layoffs. Innamorato wrote the plan around millions of dollars in cuts forced by federal policy changes that hit county programs. County Council now reviews the proposal, and a separate bill creating county-wide paid parental leave sits in committee ahead of a final vote expected later this month. - WPXI: https://www.wpxi.com/news/local/allegheny-county-executive-presents-2027-operating-budget-proposal-no-tax-increase-included/AL73EFVVSRGLVFJ7KCDUZ5HT4I/ - WTAE: https://www.wtae.com/article/allegheny-county-budget-2027-no-tax-increase/74059234 - KDKA: https://www.cbsnews.com/pittsburgh/video/allegheny-county-council-committee-to-review-paid-parental-leave-proposal-before-final-vote/ * Pennsylvania Collects at Least $516 Million From Meta Latest developments: Spotlight PA reported Wednesday, October 7, that Pennsylvania will receive at least $516 million from a settlement with Meta, and that the windfall sets up a political fight in Harrisburg over who decides how to spend it. The sum arrives as the General Assembly breaks to campaign for the November 3 election and as Allegheny County and the city of Pittsburgh both cut budgets. Spotlight PA is a nonprofit newsroom covering state government; TribLive carried its report. - TribLive: https://triblive.com/news/pennsylvania/pa-is-getting-at-least-516m-from-a-meta-settlement-it-could-spark-a-political-fight/ * Amtrak Sets November 18 for the Second New York Train Latest developments: WTAE reported Tuesday, October 6, that Amtrak's second daily Pittsburgh-to-New York round trip starts November 18, with stops at Harrisburg and Philadelphia. The addition doubles service on the Pennsylvanian line, which has run a single daily train for decades, and officials expect the extra Pittsburgh-to-Harrisburg frequency to lift business along the route. - WTAE: https://www.wtae.com/article/amtrak-pittsburgh-new-york-trains/74059136 Events: * Chelsea Wolfe Brings The Dark to Homestead Latest developments: Pittsburgh City Paper previewed the show Wednesday, October 7, built around The Dark, Chelsea Wolfe's tenth album. Wolfe, the doom-pop songwriter whose new record works through sleep paralysis and self-doubt, plays the Carnegie of Homestead Music Hall, the 1898 hall at 510 East 10th Avenue in Munhall, during the city's Halloween season. - Pittsburgh City Paper: https://www.pghcitypaper.com/arts-entertainment-2/chelsea-wolfe-brings-ethereal-new-record-the-dark-to-carnegie-of-homestead/ * Penny Pours Runs at Coven Brewing on Steelers Sundays Latest developments: Pittsburgh City Paper detailed the promotion Wednesday, October 7, ahead of the Steelers' 1 p.m. kickoff at Indianapolis on Sunday, October 11. Coven Brewing pours one-cent drafts from kickoff until the Steelers score their first points of the game, and shows the game for anyone who wants to watch it there. - Pittsburgh City Paper: https://www.pghcitypaper.com/arts-entertainment-2/predicting-the-steelers-season-with-penny-pours-at-coven-brewing/ SPORTS ---------------------------------------------------------------- Steelers (2-2) Up Next · Colts @ Steelers · Sun Oct 11, 1:00 PM https://plaintextsports.com/nfl/2026/week5/ind-pit Penguins (2-1-0) Up Next · Penguins @ Capitals · Wed Oct 7, 7:30 PM https://plaintextsports.com/nhl/2026-10-07/pit-wsh Around the Teams: * Bruce Arians Sits Down With Not Just Football Latest developments: Cam Heyward's Not Just Football posted its Wednesday episode, October 7, with Bruce Arians going through his Steelers years, the game-winning drive in Super Bowl XLIII, and his dealings with Antonio Brown, Tom Brady, Andrew Luck, and Larry Fitzgerald. Arians coached the Steelers' receivers and then their offense before leaving in 2012, and he later won a Super Bowl as head coach at Tampa Bay. Heyward and co-host Hayden close the episode on the loss at Cleveland and the Week 5 trip to the Indianapolis Colts. - Not Just Football with Cam Heyward: https://www.youtube.com/watch?v=yr7j5Bpg8Oc * Sam McDowell Dies at 84 Latest developments: The Post-Gazette reported Tuesday, October 6, that Sam McDowell, the Central Catholic graduate who pitched for the Pirates, has died at 84. McDowell, a left-hander from Pittsburgh, led the American League in strikeouts five times with the Cleveland Indians before pitching for his hometown Pirates in the early 1970s. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/10/06/sam-mcdowell-die-pitcher-obituary/stories/202610060043 Team USA: * The United States Closes an Unbeaten Window Past Canada Latest developments: The United States men beat Canada 1-0 on Tuesday, October 6, for a second consecutive clean sheet, and coach Mauricio Pochettino told his players afterward to carry the window's intensity back to their clubs. Canada, under Jesse Marsch, played the match physically against a young American side, and right back Alex Freeman answered with an assist and an 8-out-of-10 rating from ESPN while steadying the back line. The result ends a four-match October window that included wins over Chile and Mexico and leaves Pochettino's teenagers ahead of schedule in the cycle toward the 2030 World Cup. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/50121924/youthful-usmnt-rises-challenge-presented-feisty-physical-canada - ESPN Soccer: https://www.espn.com/soccer/story/_/id/50121769/usmnt-player-ratings-alex-freemans-two-way-play-earns-8-win-canada - ESPN Soccer: https://www.espn.com/soccer/story/_/id/50121804/pochettino-urges-usa-players-bring-international-intensity-back-clubs * Ashley Sanchez Returns to the Women's Camp Latest developments: Ashley Sanchez, this season's leading scorer in the National Women's Soccer League, said she is working to get "up to speed" with the United States women after her first call-up in nearly two years. Sanchez lost her place in the national team picture after the 2023 World Cup and scored her way back in club play. Coach Emma Hayes has brought her into camp as the Americans prepare for their matches against Spain, which Chelsea defender Naomi Girma misses with a calf problem. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/50120804/nwsl-goals-leader-sanchez-uswnt READING ---------------------------------------------------------------- * Ed Zitron -- Credit Crunch Zitron turns to the credit financing the artificial intelligence build-out, extending the running analyses of Nvidia, Anthropic, and OpenAI that anchor his newsletter. https://www.wheresyoured.at/credit-crunch/ * Cal Newport -- It’s Time to Investigate the AI Labs Newport calls the recent conduct of the two leading frontier labs brazen, pointing to a series of carefully staged announcements, and argues the moment has come for outside investigation. https://calnewport.com/its-time-to-investigate-the-ai-labs/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,726.72 ▲ +0.3% Dow 51,159.75 ▼ -0.7% Nasdaq 27,200.12 ▲ +1.1% WTI crude 90.65 ▼ -1.7% EUR/USD 1.1278 ▼ -1.0% GBP/USD 1.3232 ▼ -0.2% USD/JPY 157.72 ▼ -0.1% FEED HEALTH ---------------------------------------------------------------- Security: 24 of 24 feeds loaded, 62 items in the 24-hour window. No recent items: Krebs on Security, Securelist (Kaspersky), Sophos News, Unit 42 (Palo Alto), Google Online Security Blog, Graham Cluley, Google Project Zero, The DFIR Report, Kim Zetter (Zero Day), Frank on Fraud, Wired Security. Pittsburgh: 9 of 9 feeds loaded, 60 items in the 48-hour window. Business and Politics: 8 of 8 feeds loaded, 60 items in the 36-hour window. Events: 4 of 4 feeds loaded, 12 items in the 120-hour window. No recent items: NEXTpittsburgh Arts & Entertainment. Sports media: 6 of 6 feeds loaded, 19 items in the 96-hour window. Team USA: 3 of 3 feeds loaded, 29 items in the 72-hour window. Reading: 3 of 3 feeds loaded, 12 items in the 336-hour window. Markets (Yahoo Finance): 7 of 7 rows Weather (NWS): 3 forecast periods Scores (ESPN, plaintextsports): 2 teams via ESPN Summaries: 3 model call(s) served by claude-opus-5 (338s of model time; $1.76 at API list price). ================================================================ Generated 2026-10-07 07:06 EDT. Updated weekdays at about 7:05 AM, 10:05 AM, 1:35 PM, and 7:35 PM ET, and weekends at about 8:05 AM and 7:35 PM ET. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 3 Team USA feeds; WSJ World News, WSJ Markets, WSJ US Business, WSJ Politics, The Economist, FT Home, FT World, FT Markets; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN or plaintextsports.com. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================