================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Thursday, October 8, 2026 - 1:37 PM EDT ================================================================ CrowdStrike named ARTEX, the AI pen testing tool attackers ran against South Korean financial firms, on a day when a poisoned npm package, 17,610 counterfeit GitHub repositories, and a dozen critical Cisco flaws kept defenders patching. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets | Feed Health EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Attackers wield the automation defenders build: CrowdStrike tied ARTEX, an AI pen testing tool, to South Korean bank theft days after IBM and Red Hat patched 400 Java flaws. see: ARTEX AI Pentesting Tool Hits South Korean Finance; AI Finds 400 Java Flaws as Malware Fights Back * [TREND] Developers keep installing their own compromise, as the tensorlake npm package shipped the Shai-Hulud credential worm and FakeGit stood up 17,610 counterfeit GitHub repositories pushing SmartLoader and StealC. see: Shai-Hulud Rides a Compromised npm SDK; FakeGit Floods GitHub With 17,610 Fake Repos * [TREND] United States prosecutors priced out cybercrime Thursday, handing an Empire Market co-creator 40 years and offering $10 million for Hafnium suspect Zhang Yu. see: Empire Market Sentence and MonsterCloud's $11 Million Markup; Hafnium Reward and a NudeLeaksTeens Seizure * [UPDATE (updated)] Cisco shipped a dozen critical advisories alongside SonicWall, Splunk and TP-Link fixes, while Talos detailed UAT-11985 and UAC-0099 spear-phishing against Taiwan and Ukraine. see: SonicWall, Splunk, and TP-Link Router Flaws; UAT-11985 and UAC-0099 Hit Taiwan and Ukraine * [UPDATE (updated)] ASOS traced its breach to an employee tricked out of account access, while Oracle Health's victim tally climbed toward 20 million people. see: ASOS Traces Its Breach to Stolen Credentials; Oracle Health and Southern Company Widen Their Breach Counts * [UPDATE (new)] Washington suspended Microsoft from green card sponsorship, oil spiked past $105 on a tanker attack and Hormuz slowdown, and Treasury yields held near multidecade highs. see: Washington Bars Microsoft From Sponsoring Green Cards; Oil Jumps Past $105 on a Tanker Attack and a Hormuz Slowdown; Yields Sit at Multidecade Highs and the Debt Bill Comes Due SECURITY ---------------------------------------------------------------- 1. SHAI-HULUD RIDES A COMPROMISED NPM SDK Ransomware and Cybercrime · [supply chain, npm, credential theft] Latest developments: Socket reported on October 8, 2026 that version 0.5.144 of the npm package tensorlake, the TypeScript development kit for Tensorlake sandboxes and cloud services, carries obfuscated malware from the ChainDrop and Shai-Hulud supply chain campaign that harvests credentials, exfiltrates secrets, sets up persistence, and runs code the operator supplies; CloudSEK and Checkmarx separately named a campaign MALFEX, where one author published 12 npm packages since August 2023 and eight of them delivered the Overlord remote access trojan and information stealers across 40,767 downloads, while researchers found 16 malicious Firefox extensions posing as Rabby and OKX wallet portals that intercept recovery phrases and private keys during wallet imports. Developers who installed tensorlake 0.5.144 or any of the MALFEX packages should treat every credential on the build host as stolen, rotate tokens, and audit repositories for new persistence. Unit 42 traced the same pattern deeper, showing crews using Web3 infrastructure and open-source packages to reach enterprise cloud environments. - The Hacker News: https://thehackernews.com/2026/10/tensorlake-npm-package-compromised-to.html - The Hacker News: https://thehackernews.com/2026/10/eight-malicious-npm-packages-downloaded.html - The Hacker News: https://thehackernews.com/2026/10/16-malicious-firefox-extensions-pose-as.html - Unit 42 (Palo Alto): https://unit42.paloaltonetworks.com/web3-cloud-supply-chain-attacks/ 2. SONICWALL, SPLUNK, AND TP-LINK ROUTER FLAWS Vulnerabilities and Exploits · [patch, zero-day, policy] Latest developments: Cisco published advisories on October 8, 2026 for a dozen critical vulnerabilities, five of them in the NX-OS data center network operating system, where an attacker can run arbitrary code with root privileges on Nexus switches; SecurityWeek reported the same day that Splunk patched critical and high-severity flaws carrying attackers to authentication bypass, arbitrary code execution, and privilege escalation, and that SEC Consult published technical details of the internet-service-provider router vulnerabilities a multistate lawsuit against TP-Link cites; SonicWall shipped hotfixes for four flaws in its Secure Mobile Access 1000 appliances, among them a 10.0-rated pre-authentication server-side request forgery that routes an attacker's requests through the gateway into internal functions, and says it has no evidence anyone exploits the four. The SMA1000 gateways hand remote workers access to corporate networks and applications, which puts a pre-authentication flaw at the network edge, and the Nexus switches sit in the middle of data center traffic. Administrators should install the Cisco NX-OS, SonicWall, and Splunk updates now and treat exposed TP-Link ISP routers as untrusted equipment. - BleepingComputer: https://www.bleepingcomputer.com/news/security/cisco-warns-of-critical-flaws-allowing-nexus-switch-takeover/ - SecurityWeek: https://www.securityweek.com/sonicwall-and-splunk-patch-critical-vulnerabilities/ - The Hacker News: https://thehackernews.com/2026/10/sonicwall-patches-cvss-100-pre.html - SecurityWeek: https://www.securityweek.com/tp-link-faces-state-lawsuits-and-new-scrutiny-over-isp-router-flaws/ 3. AI FINDS 400 JAVA FLAWS AS MALWARE FIGHTS BACK AI Security · [ai, patch, vulnerability research] Latest developments: IBM and Red Hat said on October 8, 2026 that Lightwell, their program for patching open-source code companies already run in production, found and fixed more than 400 previously unknown vulnerabilities in widely used Java libraries; GitHub, working with Microsoft Applied Sciences, added a ModernBERT classifier to push protection that reads surrounding code to catch passwords and credentials no format rule recognizes; Cisco Talos documented the techniques malware authors now write in to obstruct automated AI analysis, including instructions aimed at the analyzing model; and Anthropic shipped Claude Haiku 5.5, which finds vulnerabilities and writes exploits better than Haiku 4.5 and ignores hidden commands more reliably, under safeguards tighter than its predecessor's. Machine-driven bug hunting keeps moving from vendor products into the shared open-source libraries beneath them, which leaves the exposure with every company that has not applied the resulting fixes. Teams running the affected Java libraries should pull the patched versions now and plan for AI-aware malware that treats the analysis pipeline as a target. - Help Net Security: https://www.helpnetsecurity.com/2026/10/08/lightwell-java-library-vulnerabilities/ - Help Net Security: https://www.helpnetsecurity.com/2026/10/08/github-push-protection-modernbert/ - Cisco Talos: https://blog.talosintelligence.com/ignore-all-instructions-and-read-this-blog-the-state-of-ai-analysis-evasion-in-malware/ - Help Net Security: https://www.helpnetsecurity.com/2026/10/08/anthropic-claude-haiku-5-5/ 4. UAT-11985 AND UAC-0099 HIT TAIWAN AND UKRAINE Nation-State Activity · [apt, phishing, espionage] Latest developments: Cisco Talos disclosed on October 8, 2026 a spear-phishing operation it tracks as UAT-11985 that impersonates academic and policy institutions, dresses AI-assisted lures in the themes of real public events, and runs real-time adversary-in-the-middle phishing against the Google accounts of people tied to Taiwan research organizations; ESET published the same day almost two years of changes to MATCHBOIL, the downloader the Russia-aligned group UAC-0099 uses to plant a spying backdoor on Windows machines, with every victim in its telemetry inside Ukraine: transportation companies in July and August 2025, a manufacturer in December 2025, and an energy company in June 2026; and TrendAI, which calls the same cluster Earth Sirrush, tied UAC-0099 to a previously undocumented .NET information stealer and remote access trojan named ASHVEIN that hides its commands inside HTML and reaches Ukrainian government personnel. Both crews chase accounts and footholds rather than money, and both lean on material the target already trusts, from conference invitations to a graphical installer that looks routine. Research institutions and Ukrainian industrial operators should enforce phishing-resistant authentication, since adversary-in-the-middle proxies defeat one-time codes. - Cisco Talos: https://blog.talosintelligence.com/uat-11985/ - The Hacker News: https://thehackernews.com/2026/10/uac-0099-targets-ukrainian-government.html - Help Net Security: https://www.helpnetsecurity.com/2026/10/08/matchboil-malware-uac-0099/ - The Record: https://therecord.media/russia-ukraine-malware-transportation 5. EMPIRE MARKET SENTENCE AND MONSTERCLOUD'S $11 MILLION MARKUP Ransomware and Cybercrime · [ransomware, law enforcement, fraud] Latest developments: A federal court sentenced a co-creator of Empire Market, one of the largest dark web marketplaces before its 2020 shutdown, to 40 years in prison on October 8, 2026 for facilitating $430 million in illegal transactions between 2018 and 2020; prosecutors also put figures on the MonsterCloud case, charging Zohar Pinhasi, a 50-year-old United States and Israeli national from Hollywood, Florida who also used the names Zack Silver and Zack Green, with two counts of wire fraud and one conspiracy count for billing ransomware victims more than $19 million while quietly paying more than $8 million to the gangs that encrypted their data. Pinhasi's firm sold remediation as proprietary recovery technology and pocketed the roughly $11 million spread between the ransoms it paid and the invoices it sent. Organizations hiring recovery vendors should demand written disclosure of any payment to an attacker and verify the decryption method before signing. - BleepingComputer: https://www.bleepingcomputer.com/news/security/owner-of-empire-cybercrime-market-gets-40-years-in-prison/ - SecurityWeek: https://www.securityweek.com/fake-decryption-tools-masked-11m-markup-in-ransomware-recovery-scheme/ - Help Net Security: https://www.helpnetsecurity.com/2026/10/08/monstercloud-owner-ransomware-fraud-charges/ - The Record: https://therecord.media/ransomware-recovery-charges-doj 6. HAFNIUM REWARD AND A NUDELEAKSTEENS SEIZURE Ransomware and Cybercrime · [law enforcement, espionage, takedown] Latest developments: The State Department will pay up to $10 million for information identifying or locating Zhang Yu, the Chinese national United States prosecutors charged over the 2021 Microsoft Exchange Server intrusions known as Hafnium alongside Xu Zewei, whom Italy extradited to the United States in April 2026; the United States Attorney's Office for the Eastern District of Virginia announced on Wednesday, October 7, 2026 that the FBI Washington Field Office and French law enforcement seized two websites belonging to NudeLeaksTeens, which sold hacked and stolen sexually explicit images and videos of 17,000 young women and girls, and arrested the suspected administrator in northern France. Hafnium breached thousands of computers worldwide through Exchange Server flaws and carried off large volumes of documents, and Zhang Yu remains outside United States custody. The NudeLeaksTeens case pairs a domain seizure with an arrest, the pattern that keeps stolen-image markets from simply rebuilding under a new name. - SecurityWeek: https://www.securityweek.com/us-seeks-alleged-chinese-hafnium-hacker-with-10-million-reward/ - The Hacker News: https://thehackernews.com/2026/10/us-offers-up-to-10-million-for-tips-on.html - The Record: https://therecord.media/accused-hafnium-hacker-zhang-yu-10million-reward - Help Net Security: https://www.helpnetsecurity.com/2026/10/08/nudeleaksteens-seized-fbi-france/ 7. ORACLE HEALTH AND SOUTHERN COMPANY WIDEN THEIR BREACH COUNTS Data Breaches · [breach, healthcare, critical infrastructure] Latest developments: SecurityWeek reported on October 8, 2026 that the Oracle Health breach tally now reaches nearly 20 million people, far above the counts in earlier regulatory filings and patient notifications, and Southern Company began notifying roughly 400,000 account holders at its Georgia Power and Alabama Power utilities that hackers reached their utility account information. Oracle Health runs electronic health record systems for hospitals and clinics across the United States, which makes the revised figure one of the largest health data losses of the year. Patients and ratepayers in Georgia and Alabama should expect notification letters, watch statements for identity fraud, and freeze credit. - SecurityWeek: https://www.securityweek.com/oracle-health-data-breach-tally-climbs-to-nearly-20-million/ - SecurityWeek: https://www.securityweek.com/georgia-power-alabama-power-data-breach-hits-400000-accounts/ 8. ASOS TRACES ITS BREACH TO STOLEN CREDENTIALS Data Breaches · [breach, social engineering, retail] Latest developments: ASOS began sending updates to affected customers on October 8, 2026, said the attackers tricked an employee into surrendering account access before pushing the rogue notification, and confirmed, after an investigation it ran with outside experts, that they reached some personal information, including names and contact details, plus certain non-personal account information. ASOS, the London-based online clothing retailer, disclosed the incident on October 6, 2026 after attackers pushed unauthorized notifications reading HACKED to customers through its mobile app and claimed they took customer data out of the company's Snowflake environment. Customers should change their ASOS password, reuse it nowhere else, and treat messages citing their order history as phishing. - BleepingComputer: https://www.bleepingcomputer.com/news/security/asos-links-data-breach-to-social-engineering-attack-credential-theft/ - The Record: https://therecord.media/asos-says-hackers-tricked-employee-access-push-notification 9. ARTEX AI PENTESTING TOOL HITS SOUTH KOREAN FINANCE AI Security · [ai, breach, financial] Latest developments: CrowdStrike Intelligence disclosed on October 8, 2026 that a threat actor used an artificial intelligence penetration testing tool named ARTEX against South Korean financial organizations from late September into early October 2026 and exfiltrated data, putting a name to the tooling behind the intrusions South Korean officials said earlier this week may have run on AI agents and that exposed personal data on at least 68,000 people at a minimum of seven institutions. ARTEX automates the reconnaissance and exploitation a human tester would run by hand, which shortens the span between a first foothold and data leaving the network. South Korean banks and insurers should hunt for CrowdStrike's indicators, review authentication logs for machine-paced activity, and assume follow-on attempts. - The Hacker News: https://thehackernews.com/2026/10/artex-ai-pentesting-tool-used-in-data.html 10. FAKEGIT FLOODS GITHUB WITH 17,610 FAKE REPOS Ransomware and Cybercrime · [malware, github, infostealer] Latest developments: BleepingComputer reported on October 8, 2026 that the FakeGit campaign reactivated earlier this month and now runs more than 17,610 counterfeit GitHub repositories that distribute the SmartLoader malware loader, which in turn pushes the StealC information stealer. FakeGit builds repositories that pass for real projects and hands anyone who downloads from them SmartLoader and then StealC, which lifts browser credentials and session data. Developers should check the owner and commit history of any unfamiliar GitHub account before running its code or binaries. - BleepingComputer: https://www.bleepingcomputer.com/news/security/fakegit-malware-campaign-returns-with-17-610-malicious-github-repos/ BUSINESS AND POLITICS ---------------------------------------------------------------- * Washington Bars Microsoft From Sponsoring Green Cards Latest developments: Vice President JD Vance said Thursday, October 8, that the Trump administration suspends Microsoft and several other technology companies from the program that lets H-1B visa holders apply for permanent residency, accusing Microsoft of fraud. The suspension closes the main route by which large United States technology employers turn temporary skilled-visa workers into permanent staff, and it names individual corporations as the target. The action extends a White House campaign against what it calls abuse of the immigration system. - WSJ Politics: https://www.wsj.com/politics/policy/vance-says-u-s-will-suspend-microsoft-and-other-firms-from-green-card-program-7f45a570?mod=rss_socialpoliticsfeed - FT World: https://www.ft.com/content/5cfecbba-69ed-42d0-98fd-3ae019144692?syn-25a6b1a6=1 * Oil Jumps Past $105 on a Tanker Attack and a Hormuz Slowdown Latest developments: Crude pared its gains Thursday afternoon, October 8, after President Trump posted on Truth Social that the United States "will not be attacking Iran" before the November 3 midterm elections and cited productive discussions with Tehran; earlier in the session Brent gained more than 4% as a strike near Qatar pushed tanker attacks deeper into the Persian Gulf, Houthi missiles aimed at Riyadh's airport forced the cancellation of more than 100 flights, and Hurricane Isaias shut in Gulf of Mexico output, while natural gas futures reversed their rise on an above-estimate weekly storage build and United States stocks fell for a second day with the Nasdaq composite leading the decline. Houthi strikes on Saudi airports killed three people in the latest escalation between Saudi Arabia and the Iran-backed militants in Yemen, and transits through the Strait of Hormuz, which recovered to nearly 90% of prewar levels in September, have since fallen sharply. European gas climbed back above 80 euros a megawatt-hour on doubts about liquefied natural gas supply security, and Harbour Energy and other Gulf of Mexico operators cut output and evacuated offshore crews as Isaias strengthened toward the United States Gulf Coast. - FT Home: https://www.ft.com/content/ec860f96-5a2b-461a-a897-a957860c3dba?syn-25a6b1a6=1 - WSJ World News: https://www.wsj.com/world/middle-east/oil-prices-rise-more-than-2-amid-houthi-attacks-u-s-gulf-shut-ins-51687549?mod=rss_worldnews - WSJ Markets: https://www.wsj.com/finance/commodities-futures/oil-rises-amid-rising-mideast-tensions-3cd98941?mod=rss_markets_main - FT Home: https://www.ft.com/content/e0cc2789-0e71-401d-8096-d58303970a37?syn-25a6b1a6=1 - WSJ World News: https://www.wsj.com/world/middle-east/tanker-attacks-push-deeper-into-the-gulf-and-rattle-oil-markets-24666ef9?mod=rss_worldnews - FT World: https://www.ft.com/content/7e39cdb9-977c-4a4c-b35c-6f775a9822db?syn-25a6b1a6=1 * Yields Sit at Multidecade Highs and the Debt Bill Comes Due Latest developments: Treasury and eurozone yields rose again Thursday, October 8, holding just under Wednesday's multidecade highs, the average United States 30-year mortgage rate climbed for a seventh consecutive week to its highest level since 2023, the dollar strengthened after Federal Reserve minutes showed officials tilting inflation risks to the upside while feeling no urgency to raise rates in October, minutes of the European Central Bank's September meeting released the same morning showed a cooler governing council appetite for further increases even as it judged the inflation picture worse, asset managers told the Financial Times they have started bottom fishing in French and other European government bonds on the view that fears of a eurozone-crisis repeat run overdone, and the Economist devoted its lead leader and briefing to a looming government-debt crisis. The Financial Times calculates that war-driven inflation and higher borrowing costs have cut Chancellor John Healey's fiscal headroom in half, a hole of nearly 12 billion pounds, and the Wall Street Journal reports investors now price outright French default as a tail risk in French government bonds; the Economist's briefing argues the danger concentrates in countries whose interest rates outrun economic growth. Germany's government cut against the gloom the same day, lifting its gross domestic product forecast to the country's fastest growth since 2022 on exports and debt-funded spending. - WSJ Markets: https://www.wsj.com/finance/investing/u-s-treasury-yields-eurozone-bond-yields-rise-relentlessly-b7d3ba07?mod=rss_markets_main - WSJ Markets: https://www.wsj.com/cfo-journal/fed-minutes-show-no-urgency-for-october-hike-66be7bd8?mod=rss_markets_main - FT World: https://www.ft.com/content/1addf0e7-c13b-45ff-b29f-5b9f78667cee - FT World: https://www.ft.com/content/04d6ae65-5d5f-4ed6-9c15-16aa0f4d0713?syn-25a6b1a6=1 - FT World: https://www.ft.com/content/9cf103ed-548e-4b06-baed-71632abca961?syn-25a6b1a6=1 - WSJ Markets: https://www.wsj.com/finance/commodities-futures/dollar-stays-elevated-as-treasury-yields-oil-prices-rise-274a97c5?mod=rss_markets_main * Israel Orders the British Consulate in Jerusalem Closed Latest developments: Israel ordered the United Kingdom's consulate in Jerusalem shut Thursday, October 8, over Britain's decision to halt trade from Israeli settlements, and the two governments then agreed to carry on the post as a "UK Mission" to contain the diplomatic feud. The British consulate in Jerusalem has handled the United Kingdom's dealings with the Palestinians, and the closure order marks the sharpest turn yet in a quarrel over London's settlement trade ban. The dispute lands with an Israeli election looming. - WSJ World News: https://www.wsj.com/world/middle-east/israel-orders-u-k-consulate-in-jerusalem-closed-over-west-bank-trade-ban-aec88b46?mod=rss_worldnews - FT World: https://www.ft.com/content/a57290ab-eadd-4e12-b8cc-37befed8d3bb?syn-25a6b1a6=1 PITTSBURGH ---------------------------------------------------------------- Weather: This Afternoon: Sunny, high 72F. Tonight: Clear, low 45F. Friday: Sunny, high 72F. Business: * Wayfair Opens Its First Pennsylvania Store on McKnight Road Latest developments: KDKA reported Thursday, October 8, that Wayfair will open a store at the North Hills Village shopping center along McKnight Road, the company's first Pennsylvania location. Wayfair sells furniture and home goods online and has lately pushed into physical retail. The McKnight Road store puts that experiment in one of the busiest retail corridors north of Pittsburgh. - KDKA: https://www.cbsnews.com/pittsburgh/news/wayfair-north-hills-pittsburgh-first-pennsylvania-location/ * Pennsylvania Tourism Reaches an $87.2 Billion Impact Latest developments: WPXI reported Thursday, October 8, on a newly released state report putting the 2025 economic impact of Pennsylvania tourism at $87.2 billion, an increase of $3.3 billion over 2024. Visitors spent $51.6 billion across the commonwealth last year, up 3.5%. The figures follow Butler County's fifth consecutive annual gain in visitor spending, which reached $793.6 million. - WPXI: https://www.wpxi.com/news/local/pennsylvania-tourism-hits-872b-economic-impact-2025-visitor-spending-climbs-35/IHTKT2CAURE53MWBU3NGRQIWSI/ * Commonplace Coffee Renames Its Kitchen Latest developments: WPXI reported Thursday, October 8, that Commonplace Coffee has relaunched its food program under the name Commonplace Kitchen. Commonplace Coffee roasts its own beans and runs cafes around the Pittsburgh region. The rebrand gives the food side of those shops a separate identity from the coffee business. - WPXI: https://www.wpxi.com/news/local/commonplace-coffee-rebrands-food-program/WLQMZJUEHFBSLEIA52TFPDHXWQ/ * Radio Las Palmas Broadcasts From Beechview Latest developments: NEXTpittsburgh introduced the DJs of Radio Las Palmas on Thursday, October 8, three years into the station's run. Radio Las Palmas, Pittsburgh's only full-time Spanish-language radio station, broadcasts around the clock from studios above Las Palmas Market in the heart of the Beechview business district, mixing news, sports, and commentary in Spanish with salsa, merengue, dembow, bachata, cumbia, reggaeton, and Mexican regional music. The station premiered on air in October 2023. - NEXTpittsburgh: https://nextpittsburgh.com/arts-entertainment/meet-the-djs-of-radio-las-palmas-pittsburghs-spanish-language-radio-station/ * Troopers Raid a Dozen Butler County Vape Shops Latest developments: The Pennsylvania State Police, joined by Butler, Jackson Township, Adams Township, and Cranberry Township police, raided a dozen vape shops across Butler County on Wednesday, October 7, with WPXI's Channel 11 on the scene in Butler. The sweep hit retailers across the county at once. Pennsylvania's new registry law, Act 57, makes most vape products illegal to sell in the state starting Monday, October 19, forcing shop owners across Western Pennsylvania to clear their shelves. - WPXI: https://www.wpxi.com/news/local/authorities-raid-dozen-vape-shops-throughout-butler-county/PERTU6WZ2JCZHO4M4K4JWY7HMY/ * The Center for OCD and Anxiety Markets Through Podcasts and TikTok Latest developments: Pittsburgh City Paper reported Thursday, October 8, that the Center for OCD and Anxiety, which runs four locations in the Pittsburgh region, uses podcasting, art, community events, and TikTok to explain the conditions it treats. The practice has built its outreach around correcting public misconceptions about obsessive-compulsive disorder and anxiety, reaching patients through social media and audio rather than referral alone. - Pittsburgh City Paper: https://www.pghcitypaper.com/news-2/the-center-for-ocd-and-anxiety-dispels-mental-health-myths-through-podcasting-art-and-tiktok/ Around town: * Garfield Puzzles Over the New Broad Street Latest developments: KDKA's Jessica Riley reported Thursday, October 8, that residents of Pittsburgh's Garfield neighborhood have answered the sudden shift of Broad Street to one-way traffic with confusion and frustration. Broad Street carries heavy traffic through Garfield, and the new pattern arrived with little warning for the people who drive and park on it. Neighbors told KDKA they cannot tell how the street now works. - KDKA: https://www.cbsnews.com/pittsburgh/news/broad-street-garfield-pittsburgh-one-way-traffic-change/ * Fort Pitt Park Draws a $500,000 Grant Latest developments: WPXI reported Thursday, October 8, that the city of Pittsburgh won $550,000 for recreation and conservation work. The award sends $500,000 to the rehabilitation of Fort Pitt Park and $50,000 to a study that would further develop the Three Rivers Heritage Trail, the riverfront path network that threads through the city. - WPXI: https://www.wpxi.com/news/local/city-pittsburgh-awarded-550k-community-recreation-conversation-projects/YBGMQ47JYJF7LC547ME4ROOEO4/ * Isaias Becomes a Hurricane and Points Rain at Sunday Latest developments: Isaias strengthened into the Atlantic season's first hurricane late Wednesday night, October 7, forecasters expect it to intensify further before it reaches the Florida, Alabama, and Mississippi coasts, and WTAE's Thursday afternoon update, October 8, has Western Pennsylvania bracing for the storm's remnants with the heaviest rain on Sunday, October 11. Western Pennsylvania stays dry and sunny through Saturday, October 10, with Thursday's highs about five degrees above average, and WTAE keeps Sunday tagged an Impact Day as the storm's tropical rain arrives over Pittsburgh. - WTAE: https://www.wtae.com/article/tracking-isaias-atlantic-hurricane-season-2026/74072808 - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/weather-news/2026/10/08/hurricane-isaias-2026-path-update/stories/202610080045 - WTAE: https://www.wtae.com/article/impact-day-sunday-tropical-rain-on-the-way/74076504 - WTAE: https://www.wtae.com/article/isaias-pennsylvania-impacts/74079928 - KDKA: https://www.cbsnews.com/pittsburgh/news/first-hurricane-of-the-season-forms-in-the-gulf-rain-heading-to-pittsburgh-this-weekend/ * Shapiro and Garrity Hold Pennsylvania's Only Governor Debate Latest developments: Governor Josh Shapiro and Republican challenger Stacy Garrity met Wednesday, October 7, in the race's only scheduled debate, answering on voter identification, gas prices, taxes, Medicaid, data centers, and President Donald Trump in the state's first gubernatorial debate since 2018, and the Post-Gazette published its takeaways Thursday, October 8. The debate followed months of attack ads and stump speeches and gave voters their single side-by-side look at the two candidates before the November 3 election, which a Post-Gazette poll last week put 25 points in Shapiro's favor. - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/politics-state/2026/10/08/pennsylvania-governor-debate-shapiro-garrity/stories/202610080044 - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/politics-state/2026/10/08/pennsylvania-governor-debate-takeaways/stories/202610080058 - WPXI: https://www.wpxi.com/news/local/pennsylvania-gubernatorial-candidates-pressed-key-issues-during-debate/IATMAKA4UBDHHO5Q2PZI52OWAY/ * Pittsburgh Water Enters Its Last Push on Lead Lines Latest developments: WPXI reported Thursday, October 8, that Pittsburgh Water has reached the final push of its program to eliminate residential lead service lines. The utility has spent a decade pulling lead out of the infrastructure feeding roughly 71,000 residential service connections across the city. The remaining work finishes a replacement effort that began after Pittsburgh's lead-in-water crisis. - WPXI: https://www.wpxi.com/news/local/pittsburgh-water-reaches-final-push-eliminate-residential-lead-service-lines/YX3FPJ75RVB6DJZH2DEOR43LOE/ * Switch Together Buys Solar and Chargers in Bulk Latest developments: The city of Pittsburgh and Allegheny County announced Thursday, October 8, that the Switch Together program is coming to residents. The program lets homeowners explore rooftop solar installations, battery storage, and electric vehicle chargers through a group arrangement, giving households a path to compare options and prices together. - WPXI: https://www.wpxi.com/news/local/city-pittsburgh-allegheny-county-announce-switch-together-program-coming-residents/MW45QD5WG5AOHMXWY2QGUV4ZYQ/ * California Money Tops Summer Lee's Pennsylvania Haul Latest developments: TribLive published a NewsWorks Lab analysis of federal campaign records Thursday, October 8, showing United States Representative Summer Lee has raised more money from California than from Pennsylvania for the first time in her three congressional election cycles. The analysis tracks out-of-state donations flowing to Western Pennsylvania lawmakers ahead of the November 3 election, with Lee, who represents Pennsylvania's 12th District, the clearest case. - TribLive: https://triblive.com/news/pennsylvania/out-of-state-campaign-donations-pour-in-for-western-pa-lawmakers-records-show/ * Reserve Township Weighs a Fire Tax Latest developments: The Reserve Township commissioners worked through their budget at an October 7 workshop and gave no public signal on the volunteer fire department's request for a dedicated property tax. The department has asked the Allegheny County township to levy a new property tax to fund its operations. The commissioners' silence leaves the question open as Reserve finishes writing its budget. - TribLive: https://triblive.com/local/reserve-commissioners-dont-show-where-they-stand-on-fire-departments-request-for-a-fire-tax/ Events: * Def Leppard and the Goo Goo Dolls Book PPG Paints Arena Latest developments: WPXI and KDKA reported Thursday, October 8, that Def Leppard and the Goo Goo Dolls will bring their 45-date tour to PPG Paints Arena in Pittsburgh on Tuesday, March 23, 2027. The co-headlining tour pairs the British hard rock band Def Leppard with the Buffalo rock trio the Goo Goo Dolls. The Pittsburgh stop lands at PPG Paints Arena, the 19,000-seat home of the Penguins on Centre Avenue. - WPXI: https://www.wpxi.com/news/local/def-leppard-goo-goo-dolls-bringing-tour-pittsburgh/ZJN55JGXOJGLNARFRNRAU6BVKA/ - KDKA: https://www.cbsnews.com/pittsburgh/news/def-leppard-goo-goo-dolls-pittsburgh-tour-stop-2027/ * The Steelers Style Show Walks Stage AE Friday Latest developments: WPXI reported Thursday, October 8, that the Steelers Style fundraiser returns to Stage AE, the team's largest annual fundraiser and its 52nd edition, on Friday, October 9. Steelers players walk the runway at Stage AE on the North Shore to raise money for the team's charitable giving. The show has run for more than half a century. - WPXI: https://www.wpxi.com/news/local/steelers-style-fundraiser-returns-stage-ae/GNELIRZNXRCCJPDS3NMLMOH7ZM/ * Holy Cross Serves Its Autumn Food Fair in Mount Lebanon Latest developments: Organizers of the Holy Cross Philoptochos Autumn Food Fair cooked on KDKA's Pittsburgh Today Live on Thursday, October 8, and handed over a donation to the KDKA Turkey Fund. The food fair runs Wednesday and Thursday, October 14 and 15, at Holy Cross Greek Orthodox Church in Mount Lebanon, with the parish's Philoptochos society cooking Greek dishes. - KDKA: https://www.cbsnews.com/pittsburgh/video/a-tase-of-the-holy-cross-philoptochos-autumn-food-fair-and-a-donation/ * Sewickley's Pumpkin Patch Reaches 25 Years Latest developments: TribLive reported Thursday, October 8, that the pumpkin patch at Sewickley United Methodist Church is in its 25th year. Thousands of pumpkins sit on pallets along the church lawn at the corner of Broad and Thorn streets in Sewickley, where the congregation runs the patch each fall. - TribLive: https://triblive.com/local/sewickley/sewickley-united-methodist-churchs-pumpkin-patch-celebrates-25-years/ * Greenwood Week Opens at Emerald City Downtown Latest developments: Greenwood Week begins Thursday, October 8, at 7 p.m. and runs through Saturday, October 10. The program takes place at Emerald City, 213 Smithfield St., downtown Pittsburgh. Evening admission runs $25 to $75 and the co-working days cost nothing; details and registration sit at greenwoodplan.com. - Pittsburgh City Paper: https://www.pghcitypaper.com/listings/pittsburghs-top-events-thu-oct-8-wed-oct-14/ * Steve Gonsalves Talks Ghosts in Oakmont Latest developments: Steve Gonsalves brings "A Life With Ghosts" to The Oaks Theater on Thursday, October 8, from 7 to 8:45 p.m. The show plays The Oaks Theater, 310 Allegheny River Blvd. in Oakmont, with tickets from $46.90 to $152.98 at theoakstheater.com. - Pittsburgh City Paper: https://www.pghcitypaper.com/listings/pittsburghs-top-events-thu-oct-8-wed-oct-14/ * Chelsea Handler and Chance the Rapper Headline the Weekend Latest developments: The Post-Gazette published its guide Thursday, October 8, to the weekend of October 8 through 11, led by Chelsea Handler at Citizens Live at The Wylie and Chance the Rapper performing his mixtape classic. Citizens Live at The Wylie, the 4,000-capacity hall that opened in the Lower Hill District on October 1, hosts Handler's stand-up date. The guide carries additional listings across the region for the weekend. - Post-Gazette Arts & Entertainment: https://www.post-gazette.com/life/recreation/2026/10/08/things-to-do-this-weekend-pittsburgh-12/stories/202610080016 * Oso Oso Comes Back to Pittsburgh Latest developments: Pittsburgh City Paper previewed the emo punk band Oso Oso's return to the city Thursday, October 8, with frontman Jade Lilitri telling the paper that an earlier Pittsburgh show marked a turning point in his career. City Paper describes the band's set as "toe-tapping, rump-shaking" emo punk. The preview carries the show details. - Pittsburgh City Paper: https://www.pghcitypaper.com/arts-entertainment-2/music/oso-oso-returns-to-pittsburgh-with-toe-tapping-rump-shaking-emo-punk/ SPORTS ---------------------------------------------------------------- Steelers (2-2) Up Next · Colts @ Steelers · Sun Oct 11, 1:00 PM https://plaintextsports.com/nfl/2026/week5/ind-pit Penguins (2-2-0) Wed Oct 7 · Penguins 3 · Capitals 5 · Final Capitals top Penguins 5-3 in Alex Ovechkin's final home opener in Washington https://plaintextsports.com/nhl/2026-10-07/pit-wsh Up Next · Penguins @ Blue Jackets · Fri Oct 9, 7:00 PM https://plaintextsports.com/nhl/2026-10-09/pit-cbj Around the Teams: * Pittman Misses Weeks, Elliott Nears a Return Latest developments: The Post-Gazette reported Thursday, October 8, that Steelers receiver Michael Pittman Jr. will sit out multiple weeks with an injury while safety DeShon Elliott could come back soon, and Ray Fittipaldo ran his Steelers chat the same morning on the Indianapolis matchup and the week's NFL news. Pittman's absence thins a receiving group that already leans on tight end Pat Freiermuth and running back Jaylen Warren for production, and Pittsburgh plays at the Indianapolis Colts at 1 p.m. Sunday, October 11, on CBS. The team arrives short at cornerback after trading Joey Porter Jr. to the Dallas Cowboys and placing defensive tackle Derrick Harmon on injured reserve. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/10/08/michael-pittman-injury-update/stories/202610080056 - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/10/08/steelers-colts-analysis-nfl-news/stories/202610080008 * Spears-Jennings Turns Quiet Work Into Snaps Latest developments: The Post-Gazette traced Thursday, October 8, how Robert Spears-Jennings's "hard work in the dark" has already paid off in the role he holds on the Steelers' defense. Pittsburgh leans harder on young defenders after trading cornerback Joey Porter Jr. to the Dallas Cowboys and putting defensive tackle Derrick Harmon on injured reserve, and Spears-Jennings has taken on more as the team prepares for Sunday's 1 p.m. game at the Indianapolis Colts. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/10/08/robert-spears-jennings-steelers/stories/202610080035 * Heyward Takes the Podium Latest developments: The Steelers posted Cameron Heyward's Wednesday, October 7, news conference on Thursday morning, October 8. Heyward, the Steelers' defensive captain, has declined to apologize for the team's testy sideline during the Thursday night loss at Cleveland, telling the Post-Gazette the emotion belongs in the game, and he faced reporters as Pittsburgh absorbed the Joey Porter Jr. trade to Dallas. - Pittsburgh Steelers (YouTube): https://www.youtube.com/watch?v=QoTZBQebVek - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/10/07/cam-heyward-emotions-on-the-sideline/stories/202610070036 * Rodgers and McCarthy Take the Podium Before Indianapolis Latest developments: The Steelers posted quarterback Aaron Rodgers's and head coach Mike McCarthy's Wednesday news conferences, October 7, and Gerry Dulac ran his Week 5 Steelers chat the same day. Pittsburgh practiced Wednesday ahead of its 1 p.m. Sunday, October 11 game at the Indianapolis Colts on CBS, carrying a short cornerback group after the Joey Porter Jr. trade to Dallas and the loss of defensive tackle Derrick Harmon to injured reserve. - Pittsburgh Steelers (YouTube): https://www.youtube.com/watch?v=O8GevsxXiVk - Pittsburgh Steelers (YouTube): https://www.youtube.com/watch?v=DNRWz20KdIo - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/10/07/gerry-dulac-live-chat-nfl-week-5/stories/202610070034 Team USA: * Rodman Works on Being Harder to Read Latest developments: United States forward Trinity Rodman said Thursday, October 8, that the current women's national team camp has helped her play less predictably and keep defenders guessing. Rodman, who plays for the Washington Spirit, speaks from a camp pointed at two matches against Spain, the reigning World Cup champion, which coach Emma Hayes's players have called a benchmark before next summer's World Cup in Brazil. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/50133362/trinity-rodman-says-uswnt-camp-helping-play-less-predictably * Lineup Questions Follow Pochettino Into the Nations League Latest developments: ESPN published its takeaways from the international window Thursday, October 8, crediting Mauricio Pochettino's young players for their performances and listing the selection questions the United States men carry into their Concacaf Nations League quarterfinal. The United States went unbeaten across the window, beating Mexico 3-0 in Glendale, Arizona, on October 3 and Canada 1-0 on October 6. Teenagers Cavan Sullivan and Julian Hall scored against Mexico, leaving Pochettino to sort a crowded pool of in-form players before knockout play. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/50127389/usmnt-takeaways-mauricio-pochettinos-youngsters-shine-lineup-questions-linger * Freeman Anchors the Young Americans Past Canada Latest developments: ESPN's player ratings, published Thursday, October 8, gave defender Alex Freeman an 8 out of 10 for the assist and the defensive work he contributed to the United States men's 1-0 win over Canada on Tuesday, October 6, the team's second straight clean sheet. Canada pressed with physicality and pressure, the two things most likely to unsettle an inexperienced side, and coach Mauricio Pochettino's next wave of players held the back line together to close an unbeaten international window. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/50121769/usmnt-player-ratings-alex-freemans-two-way-play-earns-8-win-canada - ESPN Soccer: https://www.espn.com/soccer/story/_/id/50121924/youthful-usmnt-rises-challenge-presented-feisty-physical-canada READING ---------------------------------------------------------------- * Stratechery -- An Interview with Katie Harbath About Disrupting Politics at Facebook Ben Thompson interviews Katie Harbath, Facebook's former head of global elections, about her book "Disrupting Politics" and how the company's relationship with politics and election integrity shifted through the 2010s. https://stratechery.com/2026/an-interview-with-katie-harbath-about-disrupting-politics-at-facebook/ * Ed Zitron -- Credit Crunch Zitron turns to the credit side of the artificial intelligence buildout, arguing the debt now financing data centers and chips sets up a squeeze; his premium companion work covers Nvidia, Anthropic, and OpenAI. https://www.wheresyoured.at/credit-crunch/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,756.76 ▲ +0.9% Dow 51,214.51 ▼ -0.3% Nasdaq 27,335.65 ▲ +1.6% WTI crude 90.23 ▼ -1.8% EUR/USD 1.1260 ▼ -1.0% GBP/USD 1.3238 = +0.0% USD/JPY 157.90 = +0.0% FEED HEALTH ---------------------------------------------------------------- Security: 24 of 24 feeds loaded, 68 items in the 24-hour window. No recent items: Krebs on Security, Ars Technica Security, Securelist (Kaspersky), Sophos News, Google Online Security Blog, Microsoft Security Blog, Google Project Zero, The DFIR Report, Kim Zetter (Zero Day), Frank on Fraud. Pittsburgh: 9 of 9 feeds loaded, 60 items in the 48-hour window. Business and Politics: 8 of 8 feeds loaded, 60 items in the 36-hour window. Events: 4 of 4 feeds loaded, 18 items in the 120-hour window. Sports media: 6 of 6 feeds loaded, 30 items in the 96-hour window. Team USA: 3 of 3 feeds loaded, 29 items in the 72-hour window. Reading: 3 of 3 feeds loaded, 12 items in the 336-hour window. Markets (Yahoo Finance): 7 of 7 rows Weather (NWS): 3 forecast periods Scores (ESPN, plaintextsports): 2 teams via ESPN Summaries: 3 model call(s) served by claude-opus-5 (481s of model time; $2.39 at API list price). ================================================================ Generated 2026-10-08 13:37 EDT. Updated weekdays at about 7:05 AM, 10:05 AM, 1:35 PM, and 7:35 PM ET, and weekends at about 8:05 AM and 7:35 PM ET. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 3 Team USA feeds; WSJ World News, WSJ Markets, WSJ US Business, WSJ Politics, The Economist, FT Home, FT World, FT Markets; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN or plaintextsports.com. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================