================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Friday, October 9, 2026 - 10:06 AM EDT ================================================================ Attackers began exploiting a maximum-severity SonicWall SMA1000 flaw three days after the patch, while Citrix shipped another emergency NetScaler fix and CISA gave federal agencies until October 11 to close five bugs Flax Typhoon rode into critical infrastructure. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets | Feed Health EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Attackers turned on SonicWall's SMA1000 three days after its hotfix, Citrix shipped a second critical NetScaler fix within a week, and AhsayCBS servers are falling with no patch. see: SonicWall SMA1000 Flaw Now Exploited; Citrix Rushes Another NetScaler Patch; AhsayCBS Flaws Exploited With No Patch * [TREND] Gear arrives already compromised or already exposed, with Midnight Mimosa preloaded in budget Android firmware across 150 countries and 8,547 wind and solar controllers answering the open internet. see: Midnight Mimosa Ships Inside Android Firmware; Wind and Solar Controls Sit Open on the Internet * [TREND] Anthropic's OSS Scanner now pipes unreviewed model findings to volunteer maintainers, while Zitron argues the debt-funded AI buildout faces a reckoning once the revenue fails to arrive. see: Anthropic Sends AI Bug Reports to Maintainers; Credit Crunch * [UPDATE (new)] Ransomware knocked out IDC Frontier's IDCF Cloud for eastern Japan the same week Tokyo declared a cyberspace emergency over surging attacks and dozens of corporate data leaks. see: Ransomware Knocks Out Japan's IDCF Cloud; Japan Declares a Cyberspace Emergency * [UPDATE (new)] CISA added five bugs Flax Typhoon abused to its Known Exploited Vulnerabilities catalog, including CVE-2015-3306, a decade-old 10.0-rated access control flaw in ProFTPD. see: Flax Typhoon Flaws Land on CISA's KEV List * [UPDATE (new)] Allegheny County confirmed a second measles case at the first patient's school, Pitt landed in a nine-university visa investigation, and Isaias points tropical rain at Sunday. see: Allegheny County Confirms a Second Measles Case; Pitt Joins a Nine-University Visa Investigation; Isaias Reaches Category 3 and Points Rain at Sunday SECURITY ---------------------------------------------------------------- 1. CITRIX RUSHES ANOTHER NETSCALER PATCH Vulnerabilities and Exploits · [patch, vulnerability, edge-device] Latest developments: Citrix released fixes on October 9, 2026 for CVE-2026-107406, a memory overflow in NetScaler ADC and NetScaler Gateway that carries an attacker to remote code execution or denial of service under specific configurations, SAML deployments among them, and told administrators to patch immediately. NetScaler ADC and Gateway terminate remote access and application traffic for large enterprises, and this is the second critical flaw Citrix has patched in the line inside a week, after attackers exploited CVE-2026-88779 to crash appliances. Administrators running SAML authentication on these appliances should install the new builds now. - BleepingComputer: https://www.bleepingcomputer.com/news/security/citrix-warns-admins-to-patch-new-netscaler-rce-flaw-immediately/ - The Hacker News: https://thehackernews.com/2026/10/citrix-patches-critical-netscaler-flaw.html - SecurityWeek: https://www.securityweek.com/citrix-urges-immediate-patching-of-critical-netscaler-vulnerability/ 2. FLAX TYPHOON FLAWS LAND ON CISA'S KEV LIST Nation-State Activity · [apt, exploited, patch] Latest developments: CISA added five vulnerabilities to its Known Exploited Vulnerabilities catalog on Thursday, October 8, 2026 after Flax Typhoon abused them, among them CVE-2015-3306, a 10.0-rated improper access control bug in the ProFTPD file transfer server, and set a remediation deadline of October 11, 2026 for federal civilian agencies. Flax Typhoon, which works for the sanctioned Beijing company Integrity Technology Group, used the vulnerability scanner MicroScan to find exposed systems and in some cases break in, and the FBI seized seven of its domains this week. Every organization running internet-facing ProFTPD and the other four products should patch on the federal timetable. - The Hacker News: https://thehackernews.com/2026/10/flax-typhoon-exploits-five-flaws-as.html - SecurityWeek: https://www.securityweek.com/us-disrupts-chinese-state-sponsored-hacking-tools/ - Help Net Security: https://www.helpnetsecurity.com/2026/10/09/fbi-flax-typhoon-microscan-fishhub-domains/ 3. PWN2OWN IRELAND BREAKS A PATCHED PIXEL 10 Vulnerabilities and Exploits · [zero-day, vulnerability] Latest developments: Three teams remotely exploited a fully patched Google Pixel 10 on October 8, 2026 at Pwn2Own Ireland in Cork, with Pixel 10 exploits paying $560,000 in all and Ikotas Labs taking the contest's $300,000 top prize and the overall win, and the event closed with $1,262,000 paid for 98 zero-days. Trend Micro's Zero Day Initiative runs Pwn2Own and requires every target device to carry current patches, then hands the flaws to the vendors. This year's targets reached past phones to printers, smart speakers, smart home hubs, and AI infrastructure and coding tools, so the 98 bugs now sit in vendor queues awaiting fixes. - The Hacker News: https://thehackernews.com/2026/10/three-teams-demonstrate-remote-hacks-of.html - BleepingComputer: https://www.bleepingcomputer.com/news/security/hackers-earn-1262000-for-98-zero-days-at-pwn2own-ireland/ - SecurityWeek: https://www.securityweek.com/google-pixel-10-exploits-earned-hackers-560000-at-pwn2own/ 4. CERTIFICATE LIFETIMES SHRINK TO 64 DAYS Identity and Trust Infrastructure · [pki, patch, post-quantum] Latest developments: Let's Encrypt said on October 8, 2026 that it will cut the lifetime of its free TLS certificates to 64 days beginning in February 2027, and Microsoft told customers the same week that devices running unsupported versions of Windows will stop receiving security updates after next year's Windows Update certificate rotation, while its PQC TLS Pilot Program asks organizations to test certificate ecosystems against post-quantum algorithms now. Let's Encrypt issues certificates for a large share of the public web, and a 64-day maximum lifetime forces renewal roughly every two months, which breaks any process a person still runs by hand. Enterprises face the same certificate dependency inside Windows Update, where an expiring trust chain cuts off patches for old builds. - Ars Technica Security: https://arstechnica.com/gadgets/2026/10/lets-encrypt-cuts-certificate-lifetimes-to-64-days-starting-february-2027/ - BleepingComputer: https://www.bleepingcomputer.com/news/microsoft/microsoft-outdated-windows-devices-will-lose-security-protection-next-year/ - Microsoft Security Blog: https://www.microsoft.com/en-us/security/blog/2026/10/08/post-quantum-authentication-why-organizations-should-start-testing-certificate-ecosystems-now/ 5. MIDNIGHT MIMOSA SHIPS INSIDE ANDROID FIRMWARE Ransomware and Cybercrime · [malware, supply-chain, mobile] Latest developments: Researchers named a campaign Midnight Mimosa on October 8, 2026 that arrives preinstalled in the firmware of low-cost Android smartphones sold in more than 150 countries, silently installs further applications, commits advertising fraud, and enlists each handset as a residential proxy node. Malware baked into firmware before a phone ships survives factory resets and sits below the applications a user controls, and the proxy function rents a buyer's home internet connection to whoever pays for it. Organizations that allow cheap Android handsets onto corporate networks or issue them to staff carry the exposure. - SecurityWeek: https://www.securityweek.com/pre-baked-firmware-malware-hits-budget-android-devices-in-150-countries/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/low-cost-android-phones-ship-with-residential-proxy-malware/ 6. ANTHROPIC SENDS AI BUG REPORTS TO MAINTAINERS AI Security · [ai, vulnerability, open-source] Latest developments: Anthropic launched OSS Scanner on October 9, 2026, a free service that runs its strongest models against the code of open-source maintainers who opt in and then forwards unreviewed, model-generated findings with reproduction steps and, when it has them, fixes, and the company separately engaged 11 firms to work on operational technology security. OSS Scanner grows out of Project Glasswing, the Anthropic effort that used Claude to find software flaws, and the company says human validation has become the bottleneck. Maintainers who sign up absorb the triage load, a month after Google stopped taking product reports through its Open Source Software Vulnerability Rewards Program over a flood of AI-generated submissions. - Help Net Security: https://www.helpnetsecurity.com/2026/10/09/anthropic-oss-scanner-ai-security-scans/ - SecurityWeek: https://www.securityweek.com/anthropic-fast-tracks-ai-bug-reports-to-oss-maintainers-taps-11-firms-for-ot-security/ 7. SONICWALL SMA1000 FLAW NOW EXPLOITED Vulnerabilities and Exploits · [exploited, vulnerability, edge-device] Latest developments: Attackers began exploiting CVE-2026-102255, the maximum-severity server-side request forgery in SonicWall Secure Mobile Access 1000 appliances, BleepingComputer reported on October 9, 2026, three days after SonicWall shipped the hotfix and said it saw no evidence of exploitation. The flaw lets an unauthenticated remote attacker make the gateway issue requests on the attacker's behalf and reach internal functionality behind it. SMA1000 operators who skipped Tuesday's hotfix should apply it now and hunt for intrusions. - BleepingComputer: https://www.bleepingcomputer.com/news/security/max-severity-sonicwall-sma1000-flaw-now-exploited-in-attacks/ 8. AHSAYCBS FLAWS EXPLOITED WITH NO PATCH Vulnerabilities and Exploits · [exploited, vulnerability, backup] Latest developments: SecurityWeek reported on October 9, 2026 that attackers are exploiting two unpatched vulnerabilities in AhsayCBS, CVE-2026-105133 and CVE-2026-105134, which together let them bypass authentication and inject operating system commands. AhsayCBS is the server side of Ahsay's backup platform, which managed service providers run to hold client backups, so command execution on it reaches the copies of data victims would use to recover. No fix exists yet, leaving operators to restrict network access to the consoles and hunt for intrusions. - SecurityWeek: https://www.securityweek.com/unpatched-ahsaycbs-vulnerabilities-exploited-in-the-wild/ 9. WIND AND SOLAR CONTROLS SIT OPEN ON THE INTERNET Vulnerabilities and Exploits · [ics, exposure, critical-infrastructure] Latest developments: Modat and NCSC-NL, the Dutch government's cybersecurity center, reported on October 9, 2026 that they found 8,547 internet-facing systems at wind farms and solar parks across 35 countries in and around the European Union, including login screens and one turbine control page that offers a Stop button to any visitor with a browser, with operators in Spain, Greece, Italy, and Germany accounting for most of the confirmed systems. These are operational technology interfaces that belong on private networks, and the two organizations say the true count runs higher than what they confirmed. Renewable generators should pull these consoles behind VPNs and inventory what else their vendors left reachable. - Help Net Security: https://www.helpnetsecurity.com/2026/10/09/eu-renewable-energy-cybersecurity/ 10. RANSOMWARE KNOCKS OUT JAPAN'S IDCF CLOUD Ransomware and Cybercrime · [ransomware, cloud, breach] Latest developments: IDC Frontier disclosed on October 8, 2026 that a ransomware attack on its IDCF Cloud service caused an outage at a data center cluster serving eastern Japan, where government bodies rank among the customers, and the JPCERT Coordination Center in Tokyo published an alert the same day tying a sharp rise in Japanese personal data leaks to abuse of mobile application APIs and exploitation of known software flaws. IDC Frontier, a subsidiary in the SoftBank group, runs cloud and data center infrastructure for Japanese enterprises and public agencies, so the outage reaches tenants who never touched the attacker. JPCERT/CC named no attacker and no victim organization in its alert, and told operators to audit the APIs behind their mobile apps and patch exposed software such as Metabase. - BleepingComputer: https://www.bleepingcomputer.com/news/security/ransomware-attack-disrupts-japans-idcf-cloud-used-by-govt-clients/ - The Hacker News: https://thehackernews.com/2026/10/japan-sees-sharp-rise-in-web-data-leaks.html BUSINESS AND POLITICS ---------------------------------------------------------------- * China and the EU Pull Back From a Hybrid Car Trade War Latest developments: China and the European Union said Friday, October 9, that two days of talks in Beijing produced an understanding on hybrid vehicles, easing the full-scale trade conflict officials warned about earlier in the week. The European Commission's top trade negotiator met his Chinese counterpart in Beijing after Beijing rejected Brussels's request for voluntary curbs on surging Chinese hybrid car exports, a refusal that had pushed the Commission toward temporary import limits. Both governments also reported progress on other pieces of the trade relationship, which carries roughly a fifth of EU goods trade. - WSJ US Business: https://www.wsj.com/business/autos/china-eu-move-forward-on-trade-relationship-talks-0f3361b4?mod=pls_whats_news_us_business_f - FT World: https://www.ft.com/content/2823ef6f-b3d7-494b-b131-414c02d6a59f?syn-25a6b1a6=1 * Paris Riots Compound France's Debt Trouble Latest developments: French authorities have detained 7,000 people as rioting high school students swept Paris, the Financial Times reported Friday, October 9, piling political pressure on Emmanuel Macron's government in the middle of the sell-off in French government bonds. France's borrowing costs have stayed elevated through weeks of selling, with the spread over German Bunds at multiyear highs and Finance Minister Roland Lescure pledging to bypass parliament if he must to pass billions of euros of cuts. The Financial Times judged Friday that the European Central Bank will sit out the rout while drawing up contingency plans for emergency measures. - FT World: https://www.ft.com/content/7c0e4294-0b7c-488c-8b76-ab2d411b8f66?syn-25a6b1a6=1 - FT World: https://www.ft.com/content/084bf164-ee7b-4744-a869-4dea488459f8 * Pimco Warns of a 6% Ten-Year Treasury Latest developments: Pimco's chief investment officer told the Financial Times Friday, October 9, that a 10-year Treasury yield of 6%, a level last seen in 2000, looks "feasible" as investors unwind losing positions. Treasury yields edged higher Friday while long-dated yields stayed below the 24-year highs they touched earlier in the week, helped by falling oil; eurozone yields declined, the dollar held steady as bond investors hunted for an equilibrium level after the week's roller coaster, and gold gained more than 1%. The Financial Times also reported that bank shares are sliding even as rates surge, because rising funding costs threaten to reverse the widening margins lenders have enjoyed. - FT Home: https://www.ft.com/content/a752a86c-cf05-4152-b842-2ae6b6bf3fe0?syn-25a6b1a6=1 - WSJ Markets: https://www.wsj.com/finance/investing/u-s-treasury-yields-edge-higher-eurozone-bond-yields-decline-62cfd8c8?mod=rss_markets_main - WSJ Markets: https://www.wsj.com/finance/currencies/asian-currencies-mostly-consolidate-focus-on-u-s-data-fe613e38?mod=rss_markets_main - FT Home: https://www.ft.com/content/83993bb2-35dd-4ae1-a4b2-8b6c3762a84b?syn-25a6b1a6=1 - WSJ Markets: https://www.wsj.com/finance/commodities-futures/gold-rises-supported-by-potential-china-demand-08b60462?mod=rss_markets_main * Houthi Missiles Kill Three at Riyadh Airport as Oil Retreats Latest developments: A Houthi barrage on Riyadh's airport killed three Saudis and pushed several international carriers to suspend flights, while crude fell Friday, October 9, as traders weighed President Trump's pledge to hold off on striking Iran until after the November 3 midterms. Goldman Sachs put Brent's September risk premium at $22 a barrel, the second-highest monthly reading on record, as Iran and the Houthis mount a new round of attacks around the Strait of Hormuz. BP evacuated all personnel from its Na Kika and Thunder Horse platforms and curbed Gulf of Mexico production ahead of Hurricane Isaias, and Delta Air Lines cut its profit outlook Friday on fuel costs tied to the Iran conflict even as third-quarter revenue rose, with Chief Executive Ed Bastian also ruling out Starlink service on Delta jets. - FT World: https://www.ft.com/content/8a2354d5-08a0-4ba2-9768-d1d81353f4b5?syn-25a6b1a6=1 - WSJ World News: https://www.wsj.com/business/energy-oil/oil-prices-retreat-after-trump-appears-to-rule-out-iran-strikes-before-midterms-55b0e4d9?mod=rss_worldnews - WSJ Markets: https://www.wsj.com/finance/commodities-futures/oil-edges-lower-prices-likely-to-remain-high-in-short-term-c7024a73?mod=rss_markets_main - WSJ Markets: https://www.wsj.com/business/energy-oil/bp-curbs-production-at-two-platforms-in-gulf-of-mexico-due-to-hurricane-isaias-d582fc67?mod=rss_markets_main - FT World: https://www.ft.com/content/77d73223-3cfc-4892-a3c5-5502595f42d4?syn-25a6b1a6=1 - WSJ World News: https://www.wsj.com/world/middle-east/iran-and-houthis-try-to-regain-upper-hand-in-hormuz-with-spate-of-new-attacks-c845c4ab?mod=rss_worldnews * The Financial Stability Board Finds Most Countries Unready for a Bank Failure Latest developments: The Financial Stability Board warned Friday, October 9, that only the United States, the United Kingdom, Japan, and Hong Kong hold a credible public-sector backstop capable of funding a troubled lender through a sale or a wind-down. The Basel-based board, which coordinates financial regulation for the Group of 20, judged most jurisdictions still unprepared to resolve a failing bank, which leaves cross-border lenders dependent on improvised rescues and puts the burden on the handful of authorities that have built the machinery. - FT Markets: https://www.ft.com/content/ca31d01f-d5a0-4bd4-bcc2-4aaa68f4ca22?syn-25a6b1a6=1 * Japan Declares a Cyberspace Emergency Latest developments: Japan declared a cyberspace emergency Friday, October 9, as attacks on companies there soared and dozens of firms disclosed data leaks. The disclosed victims run from car rental operators and barbecue chains to the railway group JR East, and the declaration puts Tokyo on an emergency footing against a wave of intrusions hitting the world's fourth-largest economy. - FT World: https://www.ft.com/content/2d4333d1-8119-44a4-a5a5-2ee9ef2544fa?syn-25a6b1a6=1 PITTSBURGH ---------------------------------------------------------------- Weather: Today: Sunny, high 72F. Tonight: Mostly Cloudy, low 50F. Saturday: Mostly Cloudy, high 75F. Business: * Murph's Kitchen Takes Over the Strange Roots Taproom Latest developments: Pittsburgh Magazine profiled Murph's Kitchen on Friday, October 9, reporting that crowds have followed chef Les Murphy since he moved the operation into Millvale in July. Murphy, a North Versailles native and veteran chef, runs the food program inside Strange Roots Experimental Ales' taproom on East Ohio Street in Millvale under the tagline "Good Times Served Daily," taking over from the brewery's longtime purveyor, Pittsburgh Sandwich Society. - Pittsburgh Magazine: https://www.pittsburghmagazine.com/murphs-kitchen-millvale/ * U.S. Steel Hires on the Spot in Duquesne Latest developments: Pittsburgh Magazine's Friday, October 9, job board leads with a U.S. Steel Corp. hiring event for utility persons set for Wednesday, October 14, from 8 a.m. to 1 p.m. at 1 South Linden Street in Duquesne. U.S. Steel says applicants who register in advance and qualify can interview and receive an offer at the event. The listing heads a weekly roundup of 10 new Pittsburgh-area openings. - Pittsburgh Magazine: https://www.pittsburghmagazine.com/looking-for-work-10-new-job-openings-in-pittsburgh-this-week/ * Duquesne Light and IBEW Local 29 Reach a Tentative Deal Latest developments: Duquesne Light Co. and International Brotherhood of Electrical Workers Local 29 announced a tentative contract Thursday night, October 8, on the eighth day of the strike, and ratification would send roughly 1,000 workers back to the lines. The walkout, which began October 1, was the utility's first in half a century and forced Duquesne Light to bring in 80 line workers from outside the region to cover its crews. The timing matters: forecasters have the remnants of Hurricane Isaias dropping tropical rain on Western Pennsylvania on Sunday, October 11, the kind of weather that knocks down wires. - TribLive: https://triblive.com/local/valley-news-dispatch/duquesne-light-union-come-to-agreement-to-end-workers-strike/ - KDKA: https://www.cbsnews.com/pittsburgh/news/duquesne-light-workers-union-tentative-contract-agreement/ - WTAE: https://www.wtae.com/article/duquesne-light-strike-ibew-local-29-contract/74086204 - Pittsburgh Post-Gazette: https://www.post-gazette.com/business/powersource/2026/10/08/duquesne-light-union-deal-strike/stories/202610080080 * The Iron City Complex Hunts a Renewal Story Latest developments: TribLive reported Friday, October 9, that the deteriorating Pittsburgh Brewing Co. complex in Lawrenceville may yet find a second life, eight years after Cliff Forrest bought the company. Forrest, a coal magnate, acquired Pittsburgh Brewing Co. in 2018 planning to restore the historic Lawrenceville production plant where Iron City beer had been brewed since 1867. The buildings have crumbled since, and the complex's fate now turns on finding a use for them. - TribLive: https://triblive.com/business/could-lawrencevilles-crumbling-iron-city-complex-craft-a-renewal-story/ Around town: * Allegheny County Confirms a Second Measles Case Latest developments: The Allegheny County Health Department confirmed a second measles case Friday, October 9, and tied it to the county's first case because both patients attend the same school. The county reported its first resident case, an unvaccinated minor, on October 5, and flagged possible exposure at a Target store in McCandless. Pennsylvania's outbreak has passed 1,000 cases, the largest in the United States in decades, and the Post-Gazette reported Friday on a Pennsylvania pediatrician who now treats measles daily after a career expecting never to see it. - KDKA: https://www.cbsnews.com/pittsburgh/news/second-case-of-measles-allegheny-county-health-department/ - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/health/2026/10/09/measles-pennsylvania-doctor/stories/202610110040 * Pitt Joins a Nine-University Visa Investigation Latest developments: WTAE reported Friday, October 9, that the University of Pittsburgh is one of nine universities the Trump administration has placed under investigation over student visa programs, and United States Representative Chris Deluzio called the move "a bunch of nonsense." Vice President JD Vance named Pitt a day earlier, as the administration suspended Microsoft and other technology companies from the program that lets H-1B visa holders apply for green cards. Deluzio, a Democrat whose Western Pennsylvania district adjoins the university, pushed back publicly. - WTAE: https://www.wtae.com/article/pitt-university-visa-investigation-trump-vance-deluzio/74090457 * Isaias Reaches Category 3 and Points Rain at Sunday Latest developments: Isaias strengthened into a dangerous Category 3 hurricane Friday, October 9, on a track toward the Gulf Coast, and WTAE kept Sunday, October 11, tagged an Impact Day for tropical rain across Western Pennsylvania. Forecasters expect the storm's remnants to push the heaviest rain into the Pittsburgh region Sunday after a pleasant Friday. The timing lands as Duquesne Light's line workers weigh a tentative contract that ended an eight-day strike, and BP has evacuated two Gulf of Mexico platforms ahead of the storm. - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/weather-news/2026/10/09/hurricane-isaias-updates/stories/202610090036 - WTAE: https://www.wtae.com/article/isaias-pennsylvania-impacts/74079928 - WTAE: https://www.wtae.com/article/impact-day-sunday-rain-from-isaias/74088714 - KDKA: https://www.cbsnews.com/pittsburgh/news/pittsburgh-to-see-impact-from-hurricane-isaias-this-weekend-as-rain-is-expected/ * Obama Endorses Shapiro Latest developments: Former President Barack Obama endorsed Governor Josh Shapiro's reelection bid Friday, October 9, his latest step into the midterm campaign. Shapiro, a Democrat, faces Republican state Treasurer Stacy Garrity on November 3 after the race's only debate on October 7, and polling has shown Shapiro well ahead. Obama is picking his spots in key races as both parties measure the Pennsylvania result for 2028 signals. - KDKA: https://www.cbsnews.com/pittsburgh/news/obama-endorses-pennsylvania-governor-josh-shapiro/ * Paid Parental Leave Clears an Allegheny County Committee Latest developments: The Allegheny County Council health committee advanced the paid parental leave proposal Thursday, October 8, sending it toward a final vote. The policy would require employers with 15 or more eligible employees to give both parents at least 12 weeks of paid leave, a mandate that would reach a large share of the county's private workforce. - WTAE: https://www.wtae.com/article/allegheny-county-parental-leave-health-committee/74085943 * Eleven Westmoreland Precincts Get New Polling Places Latest developments: The Westmoreland County election board announced Friday, October 9, that voters in 11 precincts will cast ballots at a different location for the November 3 general election. County election officials move polling places when a host site becomes unavailable or unsuitable, and affected voters receive notice before the election. Checking the assigned location before Election Day avoids a wasted trip. - TribLive: https://triblive.com/local/westmoreland/election-board-announces-polling-place-changes-for-fall-election/ Events: * Nickelback Books Pittsburgh on Its 2027 Tour Latest developments: Nickelback announced the 2027 Everything Under the Sun Tour on Friday, October 9, a global arena run that includes a Pittsburgh stop. The Canadian rock band tours behind its 11th studio album, "Everything Under The Sun," which Virgin Music Group releases October 30, with the English four-piece Don Broco as direct support across North America, the United Kingdom, Europe, and Australia. Its single "Rattle The Cage," featuring guitarist John 5, holds the No. 1 spot at Active Rock radio. - WPXI: https://www.wpxi.com/news/local/nickelback-announces-everything-under-sun-tour-with-stop-pittsburgh/DYLJ6MZ6UJDHJL3FRKOGADL6UU/ * Bellevue Opens Its Houses and Shops October 17 Latest developments: Pittsburgh Magazine reported Friday, October 9, that Bellevue's eighth Live, Worship, Shop House Tour returns Saturday, October 17. The tour opens homes, houses of worship, and storefronts across Bellevue, the Allegheny County borough drawing attention for the rapid growth of its commercial district, and organizers pitch it as a walk through the borough's community initiatives. - Pittsburgh Magazine: https://www.pittsburghmagazine.com/bellevues-8th-live-worship-shop-house-tour-will-return-this-month/ * Peak Foliage Hits the Laurel Highlands Latest developments: WTAE reported Friday, October 9, that the weekend of October 10 and 11 brings peak fall color to the Laurel Highlands, with the best display now at the highest elevations. The Laurel Highlands, the ridge country southeast of Pittsburgh, turns color first on its ridgetops. Drivers heading out Sunday should account for the tropical rain Isaias sends into Western Pennsylvania that day. - WTAE: https://www.wtae.com/article/laurel-highlands-peak-fall-foliage-weekend/74090211 * Alice Takes Over the Phipps Fall Flower Show Latest developments: The Post-Gazette walked the Phipps Fall Flower Show on Friday, October 9, and found Alice, the Cheshire Cat, and company worked into the autumn displays. The Fall Flower Show at Phipps Conservatory and Botanical Gardens in Oakland builds this year's show around Alice's adventures, mixing autumn plantings with Halloween touches through the season. - Pittsburgh Post-Gazette: https://www.post-gazette.com/life/garden/2026/10/09/phipps-fall-flower-show-alices-adventures-autumn-halloween/stories/202610090022 * David Chang Eats His Way Through Pittsburgh on CNN Latest developments: TribLive reported Friday, October 9, that the Pittsburgh episode of CNN's "The Detour with David Chang" airs at 10 p.m. Saturday, October 10, with the actress Gillian Jacobs guiding the chef around town. Chang, a chef and restaurateur, left Pittsburgh off a list he made of "The Five Best NFL Cities for Sandwiches," and the omission prompted the visit that became the episode. - TribLive: https://triblive.com/aande/movies-tv/tv-talk-gillian-jacobs-guides-david-changs-pittsburgh-visit-in-cnns-the-detour/ * Thomas Jefferson at West Allegheny Is the WPIAL Game of the Week Latest developments: KDKA picked Thomas Jefferson at West Allegheny for Friday night's Steelers High School Showcase, with kickoff at 7 p.m. October 9. The game runs at Joe P. DiMichela Stadium in Imperial, home of West Allegheny, in Week 7 of the WPIAL season, and KDKA publishes watch details for the broadcast. - KDKA: https://www.cbsnews.com/pittsburgh/news/how-to-watch-tonight-thomas-jefferson-west-allegheny-wpial-game-of-the-week/ SPORTS ---------------------------------------------------------------- Steelers (2-2) Up Next · Colts @ Steelers · Sun Oct 11, 1:00 PM https://plaintextsports.com/nfl/2026/week5/ind-pit Penguins (2-2-0) Up Next · Penguins @ Blue Jackets · Fri Oct 9, 7:00 PM https://plaintextsports.com/nhl/2026-10-09/pit-cbj Around the Teams: * The Pirates' Farm System Turns In a Good Year Latest developments: The Post-Gazette laid out the five biggest storylines from the Pittsburgh Pirates' minor-league season Friday, October 9, calling the year a success for the organization's prospects. The system produced while the major-league club finished a winning season short of the playoffs, and the Pirates spent this week reshaping their amateur operation, promoting Justin Newman to lead the draft process. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/10/09/pirates-prospects-hernandez-curiel-murf-termarr/stories/202610090033 - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/10/08/pirates-draft-justin-newman-justin-horowitz/stories/202610080077 * Hiles Puts the Fix on the Steelers Defense Latest developments: Post-Gazette columnist Noah Hiles wrote Friday, October 9, that the Steelers' defense has to reverse course Sunday at Indianapolis against quarterback Daniel Jones and the Colts. The unit has slipped since the Joey Porter Jr. trade to Dallas and the loss of defensive tackle Derrick Harmon to injured reserve, and it gave up the winning drive at Cleveland in Week 4. Kickoff is 1 p.m. Eastern on Sunday, October 11, on CBS. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/10/09/steelers-defense-daniel-jones-colts/stories/202610090018 - Pittsburgh Steelers (YouTube): https://www.youtube.com/shorts/CYlLcHpTnU8 Team USA: * The United States Women Measure Themselves Against Spain Latest developments: ESPN published an assessment Friday, October 9, of what the second-ranked United States women can take from Spain, the top-ranked side and reigning World Cup champion, before the two meet. Emma Hayes's team treats the Spain pair as its benchmark ahead of next summer's Women's World Cup in Brazil, with midfielder Rose Lavelle using that word for the fixtures earlier in the week. Spain's possession game has set the standard other national teams now chase. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/50136992/what-uswnt-learn-world-cup-champions-spain * Evan Bates Warns About Abuse of Teenage Skaters Latest developments: Olympic gold medalist Evan Bates said in comments ESPN published Friday, October 9, that figure skaters as young as 13 face a rising volume of abusive comments on social media. Bates, the American ice dancer, raised the warning as the sport's youngest competitors carry public profiles built on social platforms, and he tied the abuse to the pressure these athletes absorb during competition seasons. - ESPN Olympics: https://www.espn.com/olympics/figureskating/story/_/id/50138965/teenage-figure-skaters-increasingly-targeted-social-media-abuse READING ---------------------------------------------------------------- * Stratechery -- An Interview with Katie Harbath About Disrupting Politics at Facebook Ben Thompson interviews Katie Harbath, Facebook's former head of global elections, about her book "Disrupting Politics" and how the company's relationship with campaigns and governments changed through the 2010s. https://stratechery.com/2026/an-interview-with-katie-harbath-about-disrupting-politics-at-facebook/ * Ed Zitron -- Credit Crunch Zitron argues that the artificial intelligence buildout now runs on debt rather than cash flow, and that the lenders financing data centers and chips face a reckoning when the revenue fails to arrive. https://www.wheresyoured.at/credit-crunch/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,776.55 ▲ +1.2% Dow 51,275.53 = -0.0% Nasdaq 27,400.00 ▲ +1.9% WTI crude 89.95 ▼ -1.7% EUR/USD 1.1235 ▼ -1.1% GBP/USD 1.3229 ▼ -0.1% USD/JPY 158.00 ▲ +0.2% FEED HEALTH ---------------------------------------------------------------- Security: 24 of 24 feeds loaded, 58 items in the 24-hour window. No recent items: Krebs on Security, Schneier on Security, CISA Advisories, Securelist (Kaspersky), Sophos News, Unit 42 (Palo Alto), Google Online Security Blog, Graham Cluley, Google Project Zero, The DFIR Report, Kim Zetter (Zero Day), Frank on Fraud. Pittsburgh: 9 of 9 feeds loaded, 60 items in the 48-hour window. Business and Politics: 8 of 8 feeds loaded, 60 items in the 36-hour window. Events: 4 of 4 feeds loaded, 17 items in the 120-hour window. Sports media: 6 of 6 feeds loaded, 30 items in the 96-hour window. Team USA: 3 of 3 feeds loaded, 24 items in the 72-hour window. Reading: 3 of 3 feeds loaded, 12 items in the 336-hour window. Markets (Yahoo Finance): 7 of 7 rows Weather (NWS): 3 forecast periods Scores (ESPN, plaintextsports): 2 teams via ESPN Summaries: 3 model call(s) served by claude-opus-5 (333s of model time; $1.98 at API list price). ================================================================ Generated 2026-10-09 10:06 EDT. Updated weekdays at about 7:05 AM, 10:05 AM, 1:35 PM, and 7:35 PM ET, and weekends at about 8:05 AM and 7:35 PM ET. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 3 Team USA feeds; WSJ World News, WSJ Markets, WSJ US Business, WSJ Politics, The Economist, FT Home, FT World, FT Markets; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN or plaintextsports.com. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================