The FBI and the Secret Service say the FortiBleed campaign still runs, with 86,644 Fortinet firewalls compromised across 194 countries and some owners locked out of their own appliances.
Emerging Trends and Key Updates
- Trend FortiBleed has drained credentials from 86,644 Fortinet firewalls while SonicWall rushes hotfixes for its SMA 1000 appliances, making edge gear this week's rotation and audit priority.
- Trend Public proof-of-concept code now sets the patch clock: Atlassian's CVE-2026-21589 drew unauthenticated attacks within two hours, and Pwn2Own Ireland burned 32 zero-days on day one.
- Trend Anthropic's merged Glasswing program, which verified 129,000 flaws since April, pushes the bottleneck toward triage and ownership, while Newport argues the frontier labs now warrant outside investigation.
- Update · new Google traced counterfeit TLS certificates to compromised .gh, .sl, and .as registry operators, while police detained the teenager suspected of leading ShinyHunters mid-extortion of a Boeing spin-off.
- Update · updated The 30-year Treasury yield reached its highest level since 2002 as the bond selloff resumed, and Houthi missiles aimed at Riyadh pushed Brent back above $100.
- Update · new Tropical Storm Isaias aims Sunday rain at Western Pennsylvania, Monroeville closes Abers Creek Road on Thursday, and Davanzo faces Rogers again in the 58th District November 3.
Security
1. Atlassian Flaw Exploited Two Hours After PoC
Latest developments: Attackers began exploiting CVE-2026-21589, the 9.3-rated arbitrary file access flaw Atlassian disclosed on October 5, 2026, within two hours of the first public technical details and proof-of-concept code, and the attacks need no authentication.
read more
The bug lets an attacker with no login read specific files in the web application root directory of eight self-hosted Data Center products, among them Bitbucket, Confluence, Jira Software, and Jira Service Management. Anyone running those products should install Atlassian's fixed versions now and treat any internet-facing instance as probed.
Sources: BleepingComputer · The Hacker News · SecurityWeek · BleepingComputer · ↑ top
2. AI Agents Industrialize Vulnerability Discovery
Latest developments: Anthropic merged its Cyber Verification Program and Project Glasswing into one three-tier program on October 6, 2026, lifting automated blocks on malware analysis and vulnerability testing for approved security professionals, and said Glasswing verified at least 129,000 software vulnerabilities between April and July 2026; Google's PageBreak agent found 500 flaws in Google's own web applications, and the OpenSSH maintainers, shipping version 10.6 the same day, said AI models now generate so many of the security reports they receive that they will cut releases more often to keep up.
read more
Vendors run models as bug hunters at a volume human researchers cannot match, which shifts the bottleneck to triage, ownership, and patching inside the projects that receive the reports. OpenSSH 10.6 also turns on a post-quantum signature algorithm, so anyone holding the earlier experimental keys has to replace them.
Sources: The Hacker News · Help Net Security · Dark Reading · Help Net Security · ↑ top
3. Chrome, Android, and SonicWall Ship Fixes
Latest developments: Google released Chrome 155 with 247 vulnerability fixes, four of them critical use-after-free defects in Chromecast, Browser, Navigation, and Track, and its October 2026 Android updates closed 25 flaws including a critical privilege escalation in the System component; SonicWall patched four bugs in its Secure Mobile Access 1000 series appliances, among them CVE-2026-102255, which lets an unauthenticated remote attacker direct the appliance to issue requests on the attacker's behalf and reach internal functionality; and X.Org fixed 12 flaws in xorg-server 21.1.25 and xwayland-24.1.14, nine of which carry arbitrary code execution.
read more
SonicWall says it sees no evidence that anyone exploits the SMA 1000 bugs yet, and those appliances sit at the network edge where attackers have hunted all year. Administrators should restart Chrome to take the update, push the October Android patch level, and rebuild X servers on Linux desktops and workstations.
Sources: SecurityWeek · Help Net Security · SecurityWeek · Help Net Security · ↑ top
4. FortiBleed Locks Admins Out of Fortinet Firewalls
Latest developments: The FBI and the United States Secret Service issued a joint advisory on Tuesday, October 6, 2026 saying the FortiBleed credential-harvesting campaign against internet-facing Fortinet FortiGate firewalls and SSL VPN gateways remains active, cited SOCRadar's verified count of 86,644 compromised devices in 194 countries, and warned that victims lose access to their own Fortinet devices when the attacker deletes or alters administrator credentials.
read more
FortiBleed works through reused and leaked credentials plus Fortinet's legacy SHA-256 password storage, which hands attackers working logins on gateways that terminate remote access for whole organizations. Administrators should rotate every account on the appliance, pull credentials that predate the current password scheme, restrict management interfaces, and check administrator lists for deletions and additions.
Sources: Help Net Security · The Hacker News · The Record · ↑ top
5. Ransomware Hits Advantest and Osaka Metropolitan University
Latest developments: Advantest Corporation, the Japanese maker of semiconductor test equipment, began notifying individuals on October 7, 2026 that the ransomware attack it suffered in February 2026 took personal information off its servers, and Osaka Metropolitan University said on October 6, 2026 that a suspected ransomware attack had canceled classes and left its internal network, email, and a range of administrative and academic systems unavailable.
read more
Two Japanese institutions in the same week show both halves of the damage: Advantest faces breach notification duties eight months after the intrusion, and Osaka Metropolitan University lost the systems that run teaching. People who hear from Advantest should treat their data as public and monitor accounts.
Sources: BleepingComputer · SecurityWeek · The Record · ↑ top
6. Counterfeit TLS Certificates Out of Three Registries
Latest developments: Google named the three country-code domain registries on Tuesday, October 6, 2026: attackers compromised the third-party operators of .gh for Ghana, .sl for Sierra Leone, and .as for American Samoa, changed the authoritative DNS records, and used that control to obtain HTTPS certificates for several Google domains and for domains belonging to other large organizations.
read more
Control of a registry's DNS puts every domain under that ending at risk, because certificate authorities validate ownership through DNS and will issue to whoever answers. Organizations holding domains under .gh, .sl, or .as should check Certificate Transparency logs for certificates they never requested and revoke them.
Sources: Help Net Security · Ars Technica Security · ↑ top
7. ShinyHunters Extorted a Boeing Spin-Off
Latest developments: Brian Krebs reported on October 7, 2026 that police detained Rey, the teenager from Amman, Jordan whom investigators suspect of leading ShinyHunters, while the group was extorting a business unit Boeing recently divested, and SecurityWeek reported the same day that Japan detained a Qilin ransomware suspect in May 2026 and has now extradited him to Germany to face hacking charges.
read more
Rey cooperates with the FBI to identify other ShinyHunters members, the data theft and extortion crew behind a long run of corporate breaches. Organizations with Salesforce, Snowflake, and similar cloud tenancies should keep hunting for the group's access even as arrests mount.
Sources: Krebs on Security · SecurityWeek · ↑ top
8. Arizona's Court System Loses a Million Records
Latest developments: The Arizona Supreme Court said attackers copied personal information on more than 1 million people out of the state court system, reaching records as far back as 30 years.
read more
Anyone who passed through an Arizona court over three decades—as a party, a juror, or a witness—may sit in the stolen set. Those people should freeze credit, watch for identity theft, and take up whatever monitoring the court offers.
Sources: SecurityWeek · ↑ top
9. Pwn2Own Ireland Opens With 32 Zero-Days
Latest developments: Researchers opened Pwn2Own Ireland 2026 on October 6, 2026 by exploiting 32 zero-day vulnerabilities and collecting $388,500, and two separate entries took over the Samsung Galaxy S26.
read more
The contest pays cash for working exploits against fully patched phones, routers, printers, and smart-home devices, then hands the technical details to the vendors. Owners of the Galaxy S26 and the other targeted gear should expect firmware updates in the coming weeks and install them.
Sources: BleepingComputer · ↑ top
10. Ninja Forms Flaw Backdoors WordPress Sites
Latest developments: Attackers exploit stored cross-site scripting vulnerabilities in two unrelated WordPress plugins, Ninja Forms and WPC Product Bundles for WooCommerce, to install backdoors and create rogue administrator accounts, BleepingComputer reported on October 6, 2026.
read more
Both plugins run on large numbers of lead-capture and WooCommerce storefronts, and a stored script lands in the database where any visiting administrator executes it. Site owners should update both plugins, delete administrator accounts they cannot account for, and hunt for injected JavaScript in posts, forms, and product data.
Sources: BleepingComputer · ↑ top
Business and Politics
Court of Appeal Quashes Barclays Traders' Rate-Rigging Convictions
Latest developments: London's Court of Appeal threw out the rate-rigging convictions of former Barclays traders Wednesday, October 7, extending the collapse of the Libor prosecutions that began when Tom Hayes's guilty verdict fell last year.
read more
The Serious Fraud Office built a decade of criminal cases against bank traders over manipulation of benchmark interest rates after the financial crisis, and the appeal judges have now unwound them. The ruling resets how British courts treat trader conduct that banks' own submission practices encouraged.
Sources: FT Markets · ↑ top
The Bond Rout Resumes and the IMF Tells Governments to Cut
Latest developments: The selloff restarted Wednesday, October 7, after a single day of relief: the 30-year Treasury yield reached its highest level since 2002, French, Italian, and British paper came under pressure in volatile trading, the Dow industrials, Nasdaq composite, and S&P 500 all fell back a day after two of them set records, French central bank head Emmanuel Moulin said the European Central Bank need not intervene to calm the rout and denounced "Trump-style" threats against him from the far left, and International Monetary Fund Managing Director Kristalina Georgieva told governments to rein in spending and face "very tough political choices."
read more
Long-dated government debt has repriced worldwide for two weeks, with French paper carrying the widest risk premium in the euro area as the government of Finance Minister Roland Lescure fights for billions of euros in cuts. The Wall Street Journal describes France's economy as trapped in a negative feedback loop of weak growth and rising debt, and the Financial Times traces how United States mortgage bond hedging amplifies each move in Treasury yields.
Sources: WSJ Markets · FT Home · FT Home · WSJ Markets · FT World · WSJ Markets · ↑ top
Houthi Missiles Reach Riyadh as Brent Tops $100
Latest developments: Houthi rebels fired a new missile barrage at Riyadh and at Aden on Wednesday, October 7, widening Tuesday's strikes on two Saudi airports, Brent crude climbed back above $100 a barrel, and Tropical Storm Isaias formed in the southwestern Gulf of Mexico the same morning, curtailing some United States Gulf oil output and lifting natural gas futures.
read more
The barrage follows the Saudi-backed Yemeni government offensive launched October 5 to retake the Bab el-Mandab strait, which the Houthis have used to disrupt tanker traffic, and it now reaches the Saudi capital itself. Shell said the Middle East conflict and the global fuel squeeze will push its third-quarter refining margin to a record high.
Sources: FT Home · WSJ US Business · WSJ Markets · WSJ Markets · WSJ US Business · ↑ top
India Raises Rates for the First Time in Three Years
Latest developments: The Reserve Bank of India raised its policy rate Wednesday, October 7, its first increase in three years, citing higher inflation and energy costs and shifting its stance to tightening.
read more
India's central bank joins the global turn back toward tighter money as the war around Iran drives up crude and refined fuel prices in a country that imports most of its oil. The move lands the same week the Bank of Japan's wage data cleared the way for further tightening there and markets priced a Bank of England increase.
Sources: FT World · FT World · ↑ top
Pittsburgh
Weather
Today: Sunny, high 74F.
Tonight: Partly Cloudy, low 53F.
Thursday: Sunny, high 72F.
Business
Arnold Palmer Regional Airport Hunts a Carrier
Latest developments: TribLive's editorial board asked Wednesday, October 7, whether Westmoreland County's Arnold Palmer Regional Airport turns into a relic or buys its way to a new airline.
read more
The airport, outside Latrobe, has courted Allegiant Air, Breeze Airways, and Frontier Airlines to fly from the gate it built, and the editorial frames the county's choice as paying to land a carrier or watching scheduled service fade. The piece opens on New York City's City Hall subway station, which took its first train in 1904 and now sits abandoned.
Ming-Na Wen Writes the Chinatown Inn Into a Cookbook
Latest developments: Pittsburgh City Paper reported Wednesday, October 7, on the first cookbook from the actress Ming-Na Wen, "Have You Eaten Yet? Family Recipes from a Restaurant Daughter."
read more
Wen, who played Mulan and appears in the Star Wars series, grew up in the apartment above the Chinatown Inn, her family's restaurant in downtown Pittsburgh, and the book turns those family recipes into an adult's account of a restaurant childhood.
Sources: Pittsburgh City Paper · ↑ top
Butler Works Lands $75 Million From the Energy Department
Latest developments: The United States Department of Energy awarded Cleveland-Cliffs' Butler Works $75 million, and Energy Secretary Chris Wright toured the Butler County mill Tuesday, October 6, talking through steel tariffs and the industry's future with KDKA.
read more
The money expands Butler Works' output of electrical steel, the material that goes into transformers and the nation's power grid, and it marks the Trump administration's latest cash infusion into American steelmaking. Butler Works is one of the largest industrial employers north of Pittsburgh.
Sources: KDKA · WPXI · KDKA · ↑ top
Springdale Seniors Fight the Skill Games Ban
Latest developments: Senior citizens in Springdale turned out Tuesday, October 6, to press Pennsylvania's state senators to spare skill games, calling the machines their main entertainment and the clubs that hold them their community, as the removal deadline closes in.
read more
Pennsylvania's ban forces businesses to physically haul out skill game terminals, and the revenue loss has already put VFW posts and social clubs across the region on notice that they may not keep their doors open. Springdale's protest follows a Green Tree rally by operators on October 3.
Lost Lizard Reopens the Video Store on Butler Street
Latest developments: NEXTpittsburgh reported Wednesday, October 7, that Vincent Santis has turned his personal VHS collection into Lost Lizard, a movie rental shop on Butler Street.
read more
Santis stocks the store from a tape hoard he built himself and sells browsing as the product, betting Pittsburgh renters want shelves to wander rather than a streaming menu.
Sources: NEXTpittsburgh · ↑ top
Around Town
Isaias Points Sunday Rain at Western Pennsylvania
Latest developments: Tropical Storm Isaias formed in the southwestern Gulf of Mexico on Wednesday morning, October 7, and forecasters expect it to strengthen rapidly into a dangerous hurricane before landfall on the northern Gulf Coast later this week, sending its rain toward Pittsburgh by Sunday, October 11.
read more
Western Pennsylvania stays dry and sunny through Saturday, October 10, with mornings in the upper 30s and low 40s and afternoons near the low 70s. WTAE has tagged Sunday an Impact Day, and KDKA attributes the weekend rain to the storm's remnants.
Sources: Pittsburgh Post-Gazette · WTAE · WTAE · KDKA · WPXI · ↑ top
Davanzo and Rogers Meet Again in the 58th District
Latest developments: TribLive laid out the November 3 rematch Wednesday, October 7, in Pennsylvania's 58th state House District, where the Republican incumbent Davanzo seeks a fourth term against the Democrat Rogers, who lost to him in 2024.
read more
The district runs from the Mon Valley into western Westmoreland County. The race is one of several Western Pennsylvania rematches on the ballot as the General Assembly breaks to campaign.
Abers Creek Road Closes in Monroeville
Latest developments: WPXI reported Wednesday, October 7, that a stretch of Abers Creek Road near Cavitt Road in Monroeville closes at 9 a.m. Thursday, October 8, for repairs to Abers Creek Bridge No. 3.
read more
The closure adds to a crowded Allegheny County construction calendar that already includes the Parkway East bathtub work downtown and ramp reconstruction at Lebanon Church and Curry Hollow roads.
Innamorato's 2027 Budget Holds Taxes Flat
Latest developments: Allegheny County Executive Sara Innamorato presented the numbers to County Council on Tuesday, October 6: a $1.25 billion operating budget inside a roughly $3 billion plan for 2027, with no property tax increase and no layoffs.
read more
Innamorato wrote the plan around millions of dollars in cuts forced by federal policy changes that hit county programs. County Council now reviews the proposal, and a separate bill creating county-wide paid parental leave sits in committee ahead of a final vote expected later this month.
Sources: WPXI · WTAE · KDKA · ↑ top
Pennsylvania Collects at Least $516 Million From Meta
Latest developments: Spotlight PA reported Wednesday, October 7, that Pennsylvania will receive at least $516 million from a settlement with Meta, and that the windfall sets up a political fight in Harrisburg over who decides how to spend it.
read more
The sum arrives as the General Assembly breaks to campaign for the November 3 election and as Allegheny County and the city of Pittsburgh both cut budgets. Spotlight PA is a nonprofit newsroom covering state government; TribLive carried its report.
Amtrak Sets November 18 for the Second New York Train
Latest developments: WTAE reported Tuesday, October 6, that Amtrak's second daily Pittsburgh-to-New York round trip starts November 18, with stops at Harrisburg and Philadelphia.
read more
The addition doubles service on the Pennsylvanian line, which has run a single daily train for decades, and officials expect the extra Pittsburgh-to-Harrisburg frequency to lift business along the route.
Events
Allentown Night Market Heads a Full Weekend
Latest developments: NEXTpittsburgh published its guide Wednesday, October 7, to October 8 through 11, naming more than a dozen things to do.
read more
The list leads with the Allentown Night Market, a fall flower show, and a performance billed as The Last Splash, and runs through fall festivals, outdoor recreation, and arts events across the city.
Sources: NEXTpittsburgh Events · ↑ top
Dancing With the Stars Returns to PPG Paints Arena
Latest developments: WTAE reported Wednesday, October 7, that the Dancing with the Stars live tour plays PPG Paints Arena in 2027, its fifth consecutive year on a Pittsburgh stage.
read more
The touring version of the ABC competition brings the show's professional dancers and celebrity contestants to the Uptown arena that hosts the Penguins.
Chelsea Wolfe Brings The Dark to Homestead
Latest developments: Pittsburgh City Paper previewed the show Wednesday, October 7, built around The Dark, Chelsea Wolfe's tenth album.
read more
Wolfe, the doom-pop songwriter whose new record works through sleep paralysis and self-doubt, plays the Carnegie of Homestead Music Hall, the 1898 hall at 510 East 10th Avenue in Munhall, during the city's Halloween season.
Sources: Pittsburgh City Paper · ↑ top
Penny Pours Runs at Coven Brewing on Steelers Sundays
Latest developments: Pittsburgh City Paper detailed the promotion Wednesday, October 7, ahead of the Steelers' 1 p.m. kickoff at Indianapolis on Sunday, October 11.
read more
Coven Brewing pours one-cent drafts from kickoff until the Steelers score their first points of the game, and shows the game for anyone who wants to watch it there.
Sources: Pittsburgh City Paper · ↑ top
Sports
Steelers (2-2)
Up Next · Colts @ Steelers · Sun Oct 11, 1:00 PM
Penguins (2-1-0)
Up Next · Penguins @ Capitals · Wed Oct 7, 7:30 PM
Around the Teams
The Pirates Face Their Non-Tender Calls
Latest developments: The Post-Gazette worked through the Pirates' arbitration decisions Wednesday, October 7, weighing whether the club keeps or non-tenders catcher Henry Davis.
read more
Davis, the first pick of the 2021 draft, has yet to hold a major league job, and the paper runs the same keep-or-cut math on Oneil Cruz, Jared Triolo, Carmen Mlodzinski, and Paul Skenes as general manager Ben Cherington sets the winter roster.
Sources: Post-Gazette Pirates · ↑ top
Bruce Arians Sits Down With Not Just Football
Latest developments: Cam Heyward's Not Just Football posted its Wednesday episode, October 7, with Bruce Arians going through his Steelers years, the game-winning drive in Super Bowl XLIII, and his dealings with Antonio Brown, Tom Brady, Andrew Luck, and Larry Fitzgerald.
read more
Arians coached the Steelers' receivers and then their offense before leaving in 2012, and he later won a Super Bowl as head coach at Tampa Bay. Heyward and co-host Hayden close the episode on the loss at Cleveland and the Week 5 trip to the Indianapolis Colts.
Sources: Not Just Football with Cam Heyward · ↑ top
Sam McDowell Dies at 84
Latest developments: The Post-Gazette reported Tuesday, October 6, that Sam McDowell, the Central Catholic graduate who pitched for the Pirates, has died at 84.
read more
McDowell, a left-hander from Pittsburgh, led the American League in strikeouts five times with the Cleveland Indians before pitching for his hometown Pirates in the early 1970s.
Sources: Post-Gazette Pirates · ↑ top
Team USA
The United States Closes an Unbeaten Window Past Canada
Latest developments: The United States men beat Canada 1-0 on Tuesday, October 6, for a second consecutive clean sheet, and coach Mauricio Pochettino told his players afterward to carry the window's intensity back to their clubs.
read more
Canada, under Jesse Marsch, played the match physically against a young American side, and right back Alex Freeman answered with an assist and an 8-out-of-10 rating from ESPN while steadying the back line. The result ends a four-match October window that included wins over Chile and Mexico and leaves Pochettino's teenagers ahead of schedule in the cycle toward the 2030 World Cup.
Sources: ESPN Soccer · ESPN Soccer · ESPN Soccer · ↑ top
Ashley Sanchez Returns to the Women's Camp
Latest developments: Ashley Sanchez, this season's leading scorer in the National Women's Soccer League, said she is working to get "up to speed" with the United States women after her first call-up in nearly two years.
read more
Sanchez lost her place in the national team picture after the 2023 World Cup and scored her way back in club play. Coach Emma Hayes has brought her into camp as the Americans prepare for their matches against Spain, which Chelsea defender Naomi Girma misses with a calf problem.
Sources: ESPN Soccer · ↑ top
Reading
- Stratechery — Apple and LG, The House For Everyone Else, Agent Standards and Amazon. Ben Thompson reads Apple's partnership with LG as a smarter, more integrated run at the smart home than he expected, and then argues Amazon needs its own answer on agent standards.
- Ed Zitron — Credit Crunch. Zitron turns to the credit financing the artificial intelligence build-out, extending the running analyses of Nvidia, Anthropic, and OpenAI that anchor his newsletter.
- Cal Newport — It’s Time to Investigate the AI Labs. Newport calls the recent conduct of the two leading frontier labs brazen, pointing to a series of carefully staged announcements, and argues the moment has come for outside investigation.
Markets
S&P 500 7,726.72 ▲ +0.3% Dow 51,159.75 ▼ -0.7% Nasdaq 27,200.12 ▲ +1.1% WTI crude 90.65 ▼ -1.7% EUR/USD 1.1278 ▼ -1.0% GBP/USD 1.3232 ▼ -0.2% USD/JPY 157.72 ▼ -0.1%
Feed Health
Security: 24 of 24 feeds loaded, 55 items in the 24-hour window. No recent items: CISA Advisories, Securelist (Kaspersky), Sophos News, Unit 42 (Palo Alto), Google Online Security Blog, Graham Cluley, Google Project Zero, The DFIR Report, Kim Zetter (Zero Day), Frank on Fraud, Wired Security.
Pittsburgh: 9 of 9 feeds loaded, 60 items in the 48-hour window.
Business and Politics: 8 of 8 feeds loaded, 60 items in the 36-hour window.
Events: 4 of 4 feeds loaded, 13 items in the 120-hour window.
Sports media: 6 of 6 feeds loaded, 22 items in the 96-hour window.
Team USA: 3 of 3 feeds loaded, 28 items in the 72-hour window.
Reading: 3 of 3 feeds loaded, 12 items in the 336-hour window.
Markets (Yahoo Finance): 7 of 7 rows
Weather (NWS): 3 forecast periods
Scores (ESPN, plaintextsports): 2 teams via ESPN
Summaries: 3 model call(s) served by claude-opus-5 (379s of model time; $2.03 at API list price).