================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Friday, October 9, 2026 - 7:05 AM EDT ================================================================ Citrix told administrators to install a fix for a new critical NetScaler remote code execution flaw within hours of three research teams breaking a fully patched Google Pixel 10 at Pwn2Own Ireland, where 98 zero-days earned $1,262,000. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets | Feed Health EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Attackers keep landing first on edge gear, with unpatched AhsayCBS backup servers exploited via CVE-2026-105133 while Citrix ships its second critical NetScaler fix in a week. see: AhsayCBS Flaws Exploited With No Patch; Citrix Rushes Another NetScaler Patch * [UPDATE (new)] Anthropic's new OSS Scanner mails unreviewed, model-generated vulnerability findings to volunteer open-source maintainers, pushing triage cost onto the people maintaining libraries every enterprise already ships. see: Anthropic Sends AI Bug Reports to Maintainers * [TREND] Phone platforms look shakier as three teams remotely broke a fully patched Pixel 10 at Pwn2Own Ireland and Midnight Mimosa shipped preinstalled in low-cost Android firmware. see: Pwn2Own Ireland Breaks a Patched Pixel 10; Midnight Mimosa Ships Inside Android Firmware * [TREND] Let's Encrypt cutting certificates to 64 days in February 2027, plus Microsoft's Windows Update rotation deadline, turns certificate inventory into standing operations work rather than an annual chore. see: Certificate Lifetimes Shrink to 64 Days * [UPDATE (new)] Japan declared a cyberspace emergency as corporate breaches soared, while the Financial Stability Board found only four countries can credibly fund a failing bank through sale or wind-down. see: Japan Declares a Cyberspace Emergency; The Financial Stability Board Finds Most Countries Unready for a Bank Failure * [UPDATE (new)] Duquesne Light and IBEW Local 29 reached a tentative deal on the strike's eighth day, Obama endorsed Josh Shapiro, and 11 Westmoreland precincts moved polling places. see: Duquesne Light and IBEW Local 29 Reach a Tentative Deal; Obama Endorses Shapiro; Eleven Westmoreland Precincts Get New Polling Places SECURITY ---------------------------------------------------------------- 1. CITRIX RUSHES ANOTHER NETSCALER PATCH Vulnerabilities and Exploits · [patch, vulnerability, edge-device] Latest developments: Citrix released fixes on October 9, 2026 for CVE-2026-107406, a memory overflow in NetScaler ADC and NetScaler Gateway that carries an attacker to remote code execution or denial of service under specific configurations, SAML deployments among them, and told administrators to patch immediately. NetScaler ADC and Gateway terminate remote access and application traffic for large enterprises, and this is the second critical flaw Citrix has patched in the line inside a week, after attackers exploited CVE-2026-88779 to crash appliances. Administrators running SAML authentication on these appliances should install the new builds now. - BleepingComputer: https://www.bleepingcomputer.com/news/security/citrix-warns-admins-to-patch-new-netscaler-rce-flaw-immediately/ - The Hacker News: https://thehackernews.com/2026/10/citrix-patches-critical-netscaler-flaw.html - SecurityWeek: https://www.securityweek.com/citrix-urges-immediate-patching-of-critical-netscaler-vulnerability/ 2. PWN2OWN IRELAND BREAKS A PATCHED PIXEL 10 Vulnerabilities and Exploits · [zero-day, vulnerability] Latest developments: Three teams remotely exploited a fully patched Google Pixel 10 on October 8, 2026 at Pwn2Own Ireland in Cork, with Pixel 10 exploits paying $560,000 in all and Ikotas Labs taking the contest's $300,000 top prize and the overall win, and the event closed with $1,262,000 paid for 98 zero-days. Trend Micro's Zero Day Initiative runs Pwn2Own and requires every target device to carry current patches, then hands the flaws to the vendors. This year's targets reached past phones to printers, smart speakers, smart home hubs, and AI infrastructure and coding tools, so the 98 bugs now sit in vendor queues awaiting fixes. - The Hacker News: https://thehackernews.com/2026/10/three-teams-demonstrate-remote-hacks-of.html - BleepingComputer: https://www.bleepingcomputer.com/news/security/hackers-earn-1262000-for-98-zero-days-at-pwn2own-ireland/ - SecurityWeek: https://www.securityweek.com/google-pixel-10-exploits-earned-hackers-560000-at-pwn2own/ 3. CERTIFICATE LIFETIMES SHRINK TO 64 DAYS Identity and Trust Infrastructure · [pki, patch, post-quantum] Latest developments: Let's Encrypt said on October 8, 2026 that it will cut the lifetime of its free TLS certificates to 64 days beginning in February 2027, and Microsoft told customers the same week that devices running unsupported versions of Windows will stop receiving security updates after next year's Windows Update certificate rotation, while its PQC TLS Pilot Program asks organizations to test certificate ecosystems against post-quantum algorithms now. Let's Encrypt issues certificates for a large share of the public web, and a 64-day maximum lifetime forces renewal roughly every two months, which breaks any process a person still runs by hand. Enterprises face the same certificate dependency inside Windows Update, where an expiring trust chain cuts off patches for old builds. - Ars Technica Security: https://arstechnica.com/gadgets/2026/10/lets-encrypt-cuts-certificate-lifetimes-to-64-days-starting-february-2027/ - BleepingComputer: https://www.bleepingcomputer.com/news/microsoft/microsoft-outdated-windows-devices-will-lose-security-protection-next-year/ - Microsoft Security Blog: https://www.microsoft.com/en-us/security/blog/2026/10/08/post-quantum-authentication-why-organizations-should-start-testing-certificate-ecosystems-now/ 4. MIDNIGHT MIMOSA SHIPS INSIDE ANDROID FIRMWARE Ransomware and Cybercrime · [malware, supply-chain, mobile] Latest developments: Researchers named a campaign Midnight Mimosa on October 8, 2026 that arrives preinstalled in the firmware of low-cost Android smartphones sold in more than 150 countries, silently installs further applications, commits advertising fraud, and enlists each handset as a residential proxy node. Malware baked into firmware before a phone ships survives factory resets and sits below the applications a user controls, and the proxy function rents a buyer's home internet connection to whoever pays for it. Organizations that allow cheap Android handsets onto corporate networks or issue them to staff carry the exposure. - SecurityWeek: https://www.securityweek.com/pre-baked-firmware-malware-hits-budget-android-devices-in-150-countries/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/low-cost-android-phones-ship-with-residential-proxy-malware/ 5. ANTHROPIC SENDS AI BUG REPORTS TO MAINTAINERS AI Security · [ai, vulnerability, open-source] Latest developments: Anthropic launched OSS Scanner on October 9, 2026, a free service that runs its strongest models against the code of open-source maintainers who opt in and then forwards unreviewed, model-generated findings with reproduction steps and, when it has them, fixes, and the company separately engaged 11 firms to work on operational technology security. OSS Scanner grows out of Project Glasswing, the Anthropic effort that used Claude to find software flaws, and the company says human validation has become the bottleneck. Maintainers who sign up absorb the triage load, a month after Google stopped taking product reports through its Open Source Software Vulnerability Rewards Program over a flood of AI-generated submissions. - Help Net Security: https://www.helpnetsecurity.com/2026/10/09/anthropic-oss-scanner-ai-security-scans/ - SecurityWeek: https://www.securityweek.com/anthropic-fast-tracks-ai-bug-reports-to-oss-maintainers-taps-11-firms-for-ot-security/ 6. AHSAYCBS FLAWS EXPLOITED WITH NO PATCH Vulnerabilities and Exploits · [exploited, vulnerability, backup] Latest developments: SecurityWeek reported on October 9, 2026 that attackers are exploiting two unpatched vulnerabilities in AhsayCBS, CVE-2026-105133 and CVE-2026-105134, which together let them bypass authentication and inject operating system commands. AhsayCBS is the server side of Ahsay's backup platform, which managed service providers run to hold client backups, so command execution on it reaches the copies of data victims would use to recover. No fix exists yet, leaving operators to restrict network access to the consoles and hunt for intrusions. - SecurityWeek: https://www.securityweek.com/unpatched-ahsaycbs-vulnerabilities-exploited-in-the-wild/ BUSINESS AND POLITICS ---------------------------------------------------------------- * Pimco Warns of a 6% Ten-Year Treasury Latest developments: Pimco's chief investment officer told the Financial Times Friday, October 9, that a 10-year Treasury yield of 6%, a level last seen in 2000, looks "feasible" as investors unwind losing positions. Treasury yields edged higher Friday while long-dated yields stayed below the 24-year highs they touched earlier in the week, helped by falling oil; eurozone yields declined, the dollar held steady as bond investors hunted for an equilibrium level after the week's roller coaster, and gold gained more than 1%. The Financial Times also reported that bank shares are sliding even as rates surge, because rising funding costs threaten to reverse the widening margins lenders have enjoyed. - FT Home: https://www.ft.com/content/a752a86c-cf05-4152-b842-2ae6b6bf3fe0?syn-25a6b1a6=1 - WSJ Markets: https://www.wsj.com/finance/investing/u-s-treasury-yields-edge-higher-eurozone-bond-yields-decline-62cfd8c8?mod=rss_markets_main - WSJ Markets: https://www.wsj.com/finance/currencies/asian-currencies-mostly-consolidate-focus-on-u-s-data-fe613e38?mod=rss_markets_main - FT Home: https://www.ft.com/content/83993bb2-35dd-4ae1-a4b2-8b6c3762a84b?syn-25a6b1a6=1 - WSJ Markets: https://www.wsj.com/finance/commodities-futures/gold-rises-supported-by-potential-china-demand-08b60462?mod=rss_markets_main * Houthi Missiles Kill Three at Riyadh Airport as Oil Retreats Latest developments: A Houthi barrage on Riyadh's airport killed three Saudis and pushed several international carriers to suspend flights, while crude fell Friday, October 9, as traders weighed President Trump's pledge to hold off on striking Iran until after the November 3 midterms. Goldman Sachs put Brent's September risk premium at $22 a barrel, the second-highest monthly reading on record, as Iran and the Houthis mount a new round of attacks around the Strait of Hormuz. BP evacuated all personnel from its Na Kika and Thunder Horse platforms and curbed Gulf of Mexico production ahead of Hurricane Isaias, and Delta Air Lines cut its profit outlook Friday on fuel costs tied to the Iran conflict even as third-quarter revenue rose, with Chief Executive Ed Bastian also ruling out Starlink service on Delta jets. - FT World: https://www.ft.com/content/8a2354d5-08a0-4ba2-9768-d1d81353f4b5?syn-25a6b1a6=1 - WSJ World News: https://www.wsj.com/business/energy-oil/oil-prices-retreat-after-trump-appears-to-rule-out-iran-strikes-before-midterms-55b0e4d9?mod=rss_worldnews - WSJ Markets: https://www.wsj.com/finance/commodities-futures/oil-edges-lower-prices-likely-to-remain-high-in-short-term-c7024a73?mod=rss_markets_main - WSJ Markets: https://www.wsj.com/business/energy-oil/bp-curbs-production-at-two-platforms-in-gulf-of-mexico-due-to-hurricane-isaias-d582fc67?mod=rss_markets_main - FT World: https://www.ft.com/content/77d73223-3cfc-4892-a3c5-5502595f42d4?syn-25a6b1a6=1 - WSJ World News: https://www.wsj.com/world/middle-east/iran-and-houthis-try-to-regain-upper-hand-in-hormuz-with-spate-of-new-attacks-c845c4ab?mod=rss_worldnews * The Financial Stability Board Finds Most Countries Unready for a Bank Failure Latest developments: The Financial Stability Board warned Friday, October 9, that only the United States, the United Kingdom, Japan, and Hong Kong hold a credible public-sector backstop capable of funding a troubled lender through a sale or a wind-down. The Basel-based board, which coordinates financial regulation for the Group of 20, judged most jurisdictions still unprepared to resolve a failing bank, which leaves cross-border lenders dependent on improvised rescues and puts the burden on the handful of authorities that have built the machinery. - FT Markets: https://www.ft.com/content/ca31d01f-d5a0-4bd4-bcc2-4aaa68f4ca22?syn-25a6b1a6=1 * Japan Declares a Cyberspace Emergency Latest developments: Japan declared a cyberspace emergency Friday, October 9, as attacks on companies there soared and dozens of firms disclosed data leaks. The disclosed victims run from car rental operators and barbecue chains to the railway group JR East, and the declaration puts Tokyo on an emergency footing against a wave of intrusions hitting the world's fourth-largest economy. - FT World: https://www.ft.com/content/2d4333d1-8119-44a4-a5a5-2ee9ef2544fa?syn-25a6b1a6=1 PITTSBURGH ---------------------------------------------------------------- Weather: Today: Sunny, high 72F. Tonight: Mostly Cloudy, low 50F. Saturday: Mostly Cloudy, high 75F. Business: * Duquesne Light and IBEW Local 29 Reach a Tentative Deal Latest developments: Duquesne Light Co. and International Brotherhood of Electrical Workers Local 29 announced a tentative contract Thursday night, October 8, on the eighth day of the strike, and ratification would send roughly 1,000 workers back to the lines. The walkout, which began October 1, was the utility's first in half a century and forced Duquesne Light to bring in 80 line workers from outside the region to cover its crews. The timing matters: forecasters have the remnants of Hurricane Isaias dropping tropical rain on Western Pennsylvania on Sunday, October 11, the kind of weather that knocks down wires. - TribLive: https://triblive.com/local/valley-news-dispatch/duquesne-light-union-come-to-agreement-to-end-workers-strike/ - KDKA: https://www.cbsnews.com/pittsburgh/news/duquesne-light-workers-union-tentative-contract-agreement/ - WTAE: https://www.wtae.com/article/duquesne-light-strike-ibew-local-29-contract/74086204 - Pittsburgh Post-Gazette: https://www.post-gazette.com/business/powersource/2026/10/08/duquesne-light-union-deal-strike/stories/202610080080 * The Iron City Complex Hunts a Renewal Story Latest developments: TribLive reported Friday, October 9, that the deteriorating Pittsburgh Brewing Co. complex in Lawrenceville may yet find a second life, eight years after Cliff Forrest bought the company. Forrest, a coal magnate, acquired Pittsburgh Brewing Co. in 2018 planning to restore the historic Lawrenceville production plant where Iron City beer had been brewed since 1867. The buildings have crumbled since, and the complex's fate now turns on finding a use for them. - TribLive: https://triblive.com/business/could-lawrencevilles-crumbling-iron-city-complex-craft-a-renewal-story/ Around town: * Obama Endorses Shapiro Latest developments: Former President Barack Obama endorsed Governor Josh Shapiro's reelection bid Friday, October 9, his latest step into the midterm campaign. Shapiro, a Democrat, faces Republican state Treasurer Stacy Garrity on November 3 after the race's only debate on October 7, and polling has shown Shapiro well ahead. Obama is picking his spots in key races as both parties measure the Pennsylvania result for 2028 signals. - KDKA: https://www.cbsnews.com/pittsburgh/news/obama-endorses-pennsylvania-governor-josh-shapiro/ * Paid Parental Leave Clears an Allegheny County Committee Latest developments: The Allegheny County Council health committee advanced the paid parental leave proposal Thursday, October 8, sending it toward a final vote. The policy would require employers with 15 or more eligible employees to give both parents at least 12 weeks of paid leave, a mandate that would reach a large share of the county's private workforce. - WTAE: https://www.wtae.com/article/allegheny-county-parental-leave-health-committee/74085943 * Eleven Westmoreland Precincts Get New Polling Places Latest developments: The Westmoreland County election board announced Friday, October 9, that voters in 11 precincts will cast ballots at a different location for the November 3 general election. County election officials move polling places when a host site becomes unavailable or unsuitable, and affected voters receive notice before the election. Checking the assigned location before Election Day avoids a wasted trip. - TribLive: https://triblive.com/local/westmoreland/election-board-announces-polling-place-changes-for-fall-election/ Events: * Alice Takes Over the Phipps Fall Flower Show Latest developments: The Post-Gazette walked the Phipps Fall Flower Show on Friday, October 9, and found Alice, the Cheshire Cat, and company worked into the autumn displays. The Fall Flower Show at Phipps Conservatory and Botanical Gardens in Oakland builds this year's show around Alice's adventures, mixing autumn plantings with Halloween touches through the season. - Pittsburgh Post-Gazette: https://www.post-gazette.com/life/garden/2026/10/09/phipps-fall-flower-show-alices-adventures-autumn-halloween/stories/202610090022 * David Chang Eats His Way Through Pittsburgh on CNN Latest developments: TribLive reported Friday, October 9, that the Pittsburgh episode of CNN's "The Detour with David Chang" airs at 10 p.m. Saturday, October 10, with the actress Gillian Jacobs guiding the chef around town. Chang, a chef and restaurateur, left Pittsburgh off a list he made of "The Five Best NFL Cities for Sandwiches," and the omission prompted the visit that became the episode. - TribLive: https://triblive.com/aande/movies-tv/tv-talk-gillian-jacobs-guides-david-changs-pittsburgh-visit-in-cnns-the-detour/ * Thomas Jefferson at West Allegheny Is the WPIAL Game of the Week Latest developments: KDKA picked Thomas Jefferson at West Allegheny for Friday night's Steelers High School Showcase, with kickoff at 7 p.m. October 9. The game runs at Joe P. DiMichela Stadium in Imperial, home of West Allegheny, in Week 7 of the WPIAL season, and KDKA publishes watch details for the broadcast. - KDKA: https://www.cbsnews.com/pittsburgh/news/how-to-watch-tonight-thomas-jefferson-west-allegheny-wpial-game-of-the-week/ SPORTS ---------------------------------------------------------------- Steelers (2-2) Up Next · Colts @ Steelers · Sun Oct 11, 1:00 PM https://plaintextsports.com/nfl/2026/week5/ind-pit Penguins (2-2-0) Up Next · Penguins @ Blue Jackets · Fri Oct 9, 7:00 PM https://plaintextsports.com/nhl/2026-10-09/pit-cbj Around the Teams: * Hiles Puts the Fix on the Steelers Defense Latest developments: Post-Gazette columnist Noah Hiles wrote Friday, October 9, that the Steelers' defense has to reverse course Sunday at Indianapolis against quarterback Daniel Jones and the Colts. The unit has slipped since the Joey Porter Jr. trade to Dallas and the loss of defensive tackle Derrick Harmon to injured reserve, and it gave up the winning drive at Cleveland in Week 4. Kickoff is 1 p.m. Eastern on Sunday, October 11, on CBS. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/10/09/steelers-defense-daniel-jones-colts/stories/202610090018 - Pittsburgh Steelers (YouTube): https://www.youtube.com/shorts/CYlLcHpTnU8 Team USA: * The United States Women Measure Themselves Against Spain Latest developments: ESPN published an assessment Friday, October 9, of what the second-ranked United States women can take from Spain, the top-ranked side and reigning World Cup champion, before the two meet. Emma Hayes's team treats the Spain pair as its benchmark ahead of next summer's Women's World Cup in Brazil, with midfielder Rose Lavelle using that word for the fixtures earlier in the week. Spain's possession game has set the standard other national teams now chase. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/50136992/what-uswnt-learn-world-cup-champions-spain * Evan Bates Warns About Abuse of Teenage Skaters Latest developments: Olympic gold medalist Evan Bates said in comments ESPN published Friday, October 9, that figure skaters as young as 13 face a rising volume of abusive comments on social media. Bates, the American ice dancer, raised the warning as the sport's youngest competitors carry public profiles built on social platforms, and he tied the abuse to the pressure these athletes absorb during competition seasons. - ESPN Olympics: https://www.espn.com/olympics/figureskating/story/_/id/50138965/teenage-figure-skaters-increasingly-targeted-social-media-abuse READING ---------------------------------------------------------------- * Stratechery -- An Interview with Katie Harbath About Disrupting Politics at Facebook Ben Thompson interviews Katie Harbath, Facebook's former head of global elections, about her book "Disrupting Politics" and how the company's relationship with campaigns and governments changed through the 2010s. https://stratechery.com/2026/an-interview-with-katie-harbath-about-disrupting-politics-at-facebook/ * Ed Zitron -- Credit Crunch Zitron argues that the artificial intelligence buildout now runs on debt rather than cash flow, and that the lenders financing data centers and chips face a reckoning when the revenue fails to arrive. https://www.wheresyoured.at/credit-crunch/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,776.55 ▲ +1.2% Dow 51,275.53 = -0.0% Nasdaq 27,400.00 ▲ +1.9% WTI crude 89.95 ▼ -1.7% EUR/USD 1.1235 ▼ -1.1% GBP/USD 1.3229 ▼ -0.1% USD/JPY 158.00 ▲ +0.2% FEED HEALTH ---------------------------------------------------------------- Security: 24 of 24 feeds loaded, 64 items in the 24-hour window. No recent items: Krebs on Security, Securelist (Kaspersky), Sophos News, Unit 42 (Palo Alto), Google Online Security Blog, Graham Cluley, Google Project Zero, The DFIR Report, Kim Zetter (Zero Day), Frank on Fraud. Pittsburgh: 9 of 9 feeds loaded, 60 items in the 48-hour window. Business and Politics: 8 of 8 feeds loaded, 60 items in the 36-hour window. Events: 4 of 4 feeds loaded, 17 items in the 120-hour window. Sports media: 6 of 6 feeds loaded, 30 items in the 96-hour window. Team USA: 3 of 3 feeds loaded, 32 items in the 72-hour window. Reading: 3 of 3 feeds loaded, 12 items in the 336-hour window. Markets (Yahoo Finance): 7 of 7 rows Weather (NWS): 3 forecast periods Scores (ESPN, plaintextsports): 2 teams via ESPN Summaries: 3 model call(s) served by claude-opus-5 (322s of model time; $1.80 at API list price). ================================================================ Generated 2026-10-09 07:05 EDT. Updated weekdays at about 7:05 AM, 10:05 AM, 1:35 PM, and 7:35 PM ET, and weekends at about 8:05 AM and 7:35 PM ET. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 3 Team USA feeds; WSJ World News, WSJ Markets, WSJ US Business, WSJ Politics, The Economist, FT Home, FT World, FT Markets; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN or plaintextsports.com. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================