A malware infection at Nippon Columbia, a Daiichi Kosho contractor, spilled more than 8.7 million customer and employee records on the same day CISA's deadline to patch the five flaws Flax Typhoon exploits ran out for federal civilian agencies.
Quiet day: only 13 security items in the last 48 hours.
Emerging Trends and Key Updates
- Trend A contractor malware infection at Nippon Columbia spilled 8.7 million customer records while one stolen ASOS employee identity carried thieves from a mobile app into corporate systems.
- Trend Decade-old defects do much of the work: CISA's Flax Typhoon deadline for CVE-2015-3306 in ProFTPD lands today while hundreds of GPU servers still expose NVIDIA's DCGM Exporter.
- Trend Money inside the security industry now chases AI, with Dark Reading counting 117 acquisitions in one quarter and many buyers arriving from outside security entirely.
- Update · new Trump declared a Russia-Ukraine energy ceasefire that Moscow never confirmed and Kyiv disputes, while a projectile struck Riyadh's airport terminal a second day running.
- Update · new IBEW Local 29 members ratified a contract with Duquesne Light, ending its first strike in fifty years, as Isaias remnants soaked Pittsburgh and cancelled Ligonier's festival finale.
- Update · new Jaylen Warren locked down the Steelers' starting running back job as Aaron Rodgers hit Pat Freiermuth for two touchdowns in the offense's best day yet.
Security
1. Exposed NVIDIA GPU Monitors Crash on Command
Latest developments: Lava reported that hundreds of internet-exposed GPU servers run NVIDIA's DCGM Exporter open to CVE-2026-47483, an 8.2-rated flaw that lets an unauthenticated attacker crash the monitoring service and disrupt the AI work the machines carry, and SecurityWeek noted the same exposed monitors leak telemetry about the hardware behind them.
read more
DCGM Exporter reports the health of NVIDIA graphics processors on servers built for AI and machine learning. NVIDIA published its bulletin and fix on July 28, 2026; operators should install it and take the exporter's port off the public internet.
Sources: Help Net Security · SecurityWeek · ↑ top
2. Nippon Columbia Malware Spills 8.7 Million Records
Latest developments: Daiichi Kosho, the Japanese maker of commercial karaoke and entertainment systems, disclosed on October 11, 2026 that a malware infection at its contractor Nippon Columbia exposed more than 8.7 million customer and employee records, among them records on 8.6 million karaoke fans.
read more
The exposed data covers both Daiichi Kosho's karaoke customer base and company employees, and the infection sat at the contractor rather than at Daiichi Kosho itself. Any company that hands a customer database to a processor should ask that processor what endpoint controls it runs and how quickly it reports an infection.
Sources: BleepingComputer · ↑ top
3. Flax Typhoon Patch Deadline Lands Today
Latest developments: The remediation deadline CISA set for the five vulnerabilities the China-linked group Flax Typhoon exploits falls today, October 11, 2026, for federal civilian agencies, among them CVE-2015-3306, a 10.0-rated improper access control flaw in the ProFTPD file transfer server that dates to 2015.
read more
CISA added the five flaws to its Known Exploited Vulnerabilities catalog on October 8, 2026 after Flax Typhoon abused them against government, law enforcement, healthcare, and religious targets across Southeast Asia. Anyone still running ProFTPD and the other affected software should patch today or disconnect the systems.
Sources: The Hacker News · ↑ top
4. One ASOS Identity Opened the Network
Latest developments: Dark Reading reported on October 9, 2026 that the one employee identity attackers took at ASOS carried them past the customer-facing mobile app and deep into the retailer's corporate network, the path behind the "HACKED" notifications customers received and the data theft out of its Snowflake environment.
read more
ASOS, the London online clothing retailer, lost customer names and contact details after attackers tricked an employee into surrendering account access. Companies running customer-facing software as a service should put phishing-resistant authentication on every identity that administers it.
Sources: Dark Reading · ↑ top
5. Cyber Partisans Claim Moscow's Health Network
Latest developments: The Belarusian Cyber Partisans confirmed on October 9, 2026 that they spent months inside the network of the Moscow Department of Health in 2023, agreeing with Russian researchers who had traced the intrusion to them.
read more
The Cyber Partisans, a Belarusian hacktivist group that attacks Belarusian and Russian state systems, now own a breach of a Russian state healthcare network that went unclaimed for three years. The admission shows how long an undetected foothold in public health infrastructure can last.
Sources: The Record · ↑ top
6. Wyden Presses the White House on License Plate Reads
Latest developments: Senator Ron Wyden demanded the privacy review report covering the license plate surveillance program the White House runs through the High Intensity Drug Trafficking Areas program, 404 Media reported on October 9, 2026, after its own investigation surfaced the collection.
read more
HIDTA task forces pool federal, state, and local drug enforcement, and the program reads and stores license plates through them. Wyden's request asks what privacy review the White House completed before the program began logging drivers.
7. AI Buyers Push Security Deals to 117 in a Quarter
Latest developments: Dark Reading counted 117 strategic cybersecurity acquisitions announced in the latest quarter and reported on October 9, 2026 that many of the buyers come from outside the security industry, chasing AI capability.
read more
Consolidation at this rate moves the vendors and products enterprises already run into new ownership, often under acquirers with no security track record. Security leaders should identify which of their suppliers sit in play and press each one on support and roadmap commitments after a sale.
Sources: Dark Reading · ↑ top
Business and Politics
Trump Declares an Energy Ceasefire Kyiv Does Not See
Latest developments: President Trump said Sunday, October 11, that Russia and Ukraine have agreed to an "energy ceasefire," Moscow never confirmed it and Kyiv reported that attacks continued, his officials pressed European capitals and threatened to block arms for Ukraine over Ukrainian strikes on Russian refineries, and six senators from both parties demanded the administration reverse its plan to buy Russian diesel, citing a 2022 law.
read more
Trump announced Friday, October 9, that Vladimir Putin would ship hundreds of thousands of tons of diesel to United States and global markets to pull down fuel prices, and he has since told Ukraine to stop hitting Russian refineries and suggested Volodymyr Zelenskyy should be replaced, remarks that shocked Kyiv and European governments. Ukrainian strikes have given Russia its worst gasoline shortages since the Soviet Union collapsed, and the senators argue that buying Russian fuel finances the war; the dispute puts American intelligence sharing and weapons deliveries to Ukraine in play three weeks before the November 3 midterm elections.
Sources: WSJ World News · FT Home · FT Home · FT World · FT Home · ↑ top
Riyadh's Airport Takes a Second Strike
Latest developments: A projectile hit the same passenger terminal at Riyadh's international airport on Sunday, October 11, a day after a Houthi missile killed 12 people and injured hundreds there, BP and other oil company chiefs skipped the World Petroleum Council congress in the Saudi capital, and airlines abandoned the Saudi airspace corridor that links Europe to Asia.
read more
Iran-backed Houthi rebels in Yemen have widened their missile and drone campaign from Saudi ports and southern airports to Riyadh itself, and The Economist judges that Saudi Arabia, which has committed 100 fighter jets to a Yemeni ground push on Sana'a and Bab el-Mandab, holds no good options against the strikes. The attacks cut flight paths between two of the world's largest economic engines, keep a risk premium in crude and tanker freight, and threaten the kingdom's standing as a safe place to site capital and hold meetings.
Sources: FT World · FT Home · FT Home · WSJ World News · The Economist · ↑ top
U.S. Strikes a Tanker Off Iran
Latest developments: United States Central Command said Sunday, October 11, that American forces hit a commercial tanker in the Gulf of Oman after the ship tried to break through the naval blockade of Iranian ports, the command's first such attack in a month.
read more
Washington has blockaded Iran's ports during the United States-Israel war on Iran, and the strike puts military force behind the cordon on the tanker lanes running out of the Strait of Hormuz, where Iranian attacks on shipping have already lifted crude and freight rates. Owners, insurers, and charterers now price the risk that a cargo lifted anywhere near Iran draws fire.
New Delhi Locks Down Against the Voter-Rolls Movement
Latest developments: Police sealed the heart of New Delhi on Sunday, October 11, to thwart a voter-rights march, and a court ordered the release of Abhijeet Dipke, the Cockroach Janta Party leader whom officers escorted off a flight in the capital a day earlier.
read more
The youth-led Cockroach Janta Party has turned anger over India's voter lists into a national protest movement that carries the grievances of young Indians who cannot find work, and its leaders have called for more demonstrations. The confrontation strains the politics of the world's fastest-growing major economy while the Reserve Bank of India spends reserves to hold the rupee off record lows.
Sources: WSJ World News · FT Home · FT World · FT Markets · ↑ top
Pittsburgh
Weather
Tonight: Slight Chance Rain Showers then Cloudy, low 58F.
Columbus Day: Mostly Cloudy, high 72F.
Monday Night: Partly Cloudy, low 59F.
Business
Duquesne Light Workers Ratify a Contract and End the Strike
Latest developments: The Post-Gazette reported Sunday evening, October 11, that members of International Brotherhood of Electrical Workers Local 29 approved a new contract with Duquesne Light Co., ending the utility's first strike in half a century.
read more
Roughly 1,000 line workers walked off the job in early October, and Duquesne Light covered the gap with 80 line workers brought in from outside the region plus contracted crews, including through the rain and wind the remnants of Isaias delivered Sunday. The two sides reached a tentative agreement Thursday, October 8, and Sunday's ratification vote sends the crews back to the lines across Allegheny and Beaver counties.
Sources: Pittsburgh Post-Gazette · ↑ top
Pennsylvania's Skill Games Go Dark
Latest developments: With the removal deadline in force after the Supreme Court of Pennsylvania refused to extend it, the Post-Gazette laid out the fallout Sunday, October 11, and TribLive's editorial board asked why the General Assembly never fixed the law.
read more
The slots-like skill game terminals that sit in Pennsylvania bars, social clubs, VFW posts, and convenience stores must come out, ending a revenue stream small operators and veterans' organizations count on. The General Assembly adjourned to campaign without passing a bill to regulate and tax the machines, and the industry's court options ran out.
Sources: Pittsburgh Post-Gazette · TribLive · ↑ top
Pennsylvania Water Bills Rank Among the Nation's Highest
Latest developments: The Post-Gazette reported Sunday, October 11, on a study placing four of the ten most expensive water companies in the United States inside Pennsylvania.
read more
Pennsylvania households pay water rates near the top of the national range, a line item that compounds across the state's industrial and commercial users as well. The ranking lands while Pittsburgh Water finishes replacing residential lead service lines and the Allegheny County Sanitary Authority starts its $4.5 billion Clean Water tunnel project, both of which ratepayers fund.
Sources: Pittsburgh Post-Gazette · ↑ top
Enjoy Wrestling Closes After Five Years
Latest developments: TribLive reported Sunday, October 11, that Enjoy Wrestling, the independent promotion Kurt Hackimer built in Pittsburgh, has shut down after a five-year run.
read more
Hackimer founded Enjoy Wrestling on the premise that Pittsburgh wrestling should be, in his phrase, "for everyone," and ran independent shows in the city for five years before folding the operation.
Around Town
Isaias Soaks Pittsburgh
Latest developments: Isaias's remnants carried heavy rain and wind northeast into the central Appalachians through Sunday, October 11, forcing organizers in Ligonier to cancel the festival's final day, and WTAE's evening update turns Monday warmer and drier before two more cold fronts bring rain ahead of next weekend.
read more
Isaias came ashore on the Florida Panhandle as the Atlantic season's first hurricane, killed at least four people, and cut power to more than 800,000 customers across Florida, Alabama, and Georgia before its moisture tracked northeast. Steady rain fell over Western Pennsylvania through Sunday morning, scattered showers lingered into the evening, and overnight lows settle into the 50s.
Sources: KDKA · WPXI · WTAE · WTAE · WPXI · WPXI · ↑ top
Trump Asks Fetterman to Switch Parties
Latest developments: President Trump publicly urged Senator John Fetterman on Saturday, October 10, to leave the Democratic Party and register as a Republican.
read more
Fetterman, the former Braddock mayor and Pennsylvania lieutenant governor now in his first Senate term, has split with his party on Israel and immigration, and Trump's invitation lands on Pennsylvania Democrats three weeks before the November 3 election. Fetterman's seat stays off the ballot until 2028.
Sources: Pittsburgh Post-Gazette · WTAE · ↑ top
Shapiro and Garrity on Taxes and Skill Games
Latest developments: The Post-Gazette published a side-by-side Sunday, October 11, of where Governor Josh Shapiro and Republican challenger Stacy Garrity stand on taxes, state spending, and skill games.
read more
Shapiro seeks a second term against Garrity, the state treasurer, in the November 3 election, and a poll last week gave him a 25-point lead. Skill games anchor the fiscal argument: the machines come out of Pennsylvania businesses this month, and whoever wins inherits the choice of whether to legalize, regulate, and tax them.
Sources: Pittsburgh Post-Gazette · ↑ top
Sports
Steelers (3-2)
Sun Oct 11 · Colts 22 · Steelers 34 · Final
Jaylen Warren's brilliance leads the Steelers past the Colts 34-22
Up Next · Steelers @ Buccaneers · Sun Oct 18, 1:00 PM
Penguins (3-2-1)
Sat Oct 10 · Stars 1 · Penguins 2 · Final (SO)
Rickard Rakell scores in shootout to lift Penguins over Stars, 2-1
Up Next · Penguins @ Blackhawks · Tue Oct 13, 8:00 PM
Around the Teams
Warren Wins the Running Back Job
Latest developments: Post-Gazette columnist Noah Hiles wrote Sunday evening, October 11, that Jaylen Warren has finally run away with the Steelers' starting running back job, and the paper's Week 5 report card handed Warren an A-plus.
read more
Warren piled up 188 total yards and two long touchdowns against the Indianapolis Colts at Acrisure Stadium, a week after the Post-Gazette had already called him Pittsburgh's workhorse and its best offensive player. The report card graded the rest of the roster against the Colts, whose running back Jonathan Taylor the Steelers had spent the week calling their first priority.
Sources: Post-Gazette Steelers · Post-Gazette Steelers · ↑ top
Rodgers Finds Freiermuth Twice
Latest developments: Aaron Rodgers threw two touchdown passes to tight end Pat Freiermuth on Sunday, October 11, and the Post-Gazette's game story credited the quarterback and Jaylen Warren for the Steelers' best offensive showing of the season against the Indianapolis Colts.
read more
Pittsburgh played the Colts at Acrisure Stadium without cornerback Jamel Dean and safety DeShon Elliott and with receiver Michael Pittman Jr. on injured reserve, 10 days after head coach Mike McCarthy said the team needed to clean up its house following the trip to Cleveland. Christopher Carter ran the Post-Gazette's live chat and analysis through the afternoon.
Sources: Post-Gazette Steelers · Post-Gazette Steelers · ↑ top
Team USA
Hayes Finds Progress in the Spain Loss
Latest developments: Speaking after Spain's 2-0 win Saturday, October 10, United States coach Emma Hayes said her team's inability to score frustrated her and pointed to signs of progress with next summer's World Cup ahead, while ESPN's analysis credited Spain's finishing for the gap.
read more
The second-ranked United States women opened a two-match set against Spain, the reigning World Cup champion, and conceded to Patri Guijarro and Eva Navarro inside the first 14 minutes. Hayes, Trinity Rodman, and their teammates treated the night as a measuring stick for a squad still being assembled for the 2027 World Cup.
Sources: ESPN Soccer · ESPN Soccer · ↑ top
Reading
- Ed Zitron — Premium: The Hater's Guide To Junk. Zitron walks through the junk bond market, arguing that the once-sleepy world of below-investment-grade debt has swollen into an era of garbage credit dressed up as high yield. He treats the appetite for that paper as a measure of how much risk investors have talked themselves into carrying.
- Stratechery — An Interview with Katie Harbath About Disrupting Politics at Facebook. Ben Thompson interviews Katie Harbath, Facebook's former head of global elections, about her book Disrupting Politics. Harbath traces how campaigns learned to use the platform through the 2010s and how that pressure changed the company from inside.
Markets
S&P 500 7,794.31 ▲ +1.5% Dow 51,371.13 ▲ +0.4% Nasdaq 27,435.06 ▲ +2.0% WTI crude 90.10 ▼ -1.3% EUR/USD 1.1228 ▼ -0.9% GBP/USD 1.3234 = -0.0% USD/JPY 158.02 ▲ +0.3%
Feed Health
Security: 24 of 24 feeds loaded, 13 items in the 48-hour window. No recent items: Schneier on Security, Dark Reading, CISA Advisories, The Record, Ars Technica Security, Securelist (Kaspersky), Sophos News, Unit 42 (Palo Alto), Google Online Security Blog, Cisco Talos, Graham Cluley, Microsoft Security Blog, Google Project Zero, The DFIR Report, Kim Zetter (Zero Day), Frank on Fraud.
Pittsburgh: 9 of 9 feeds loaded, 60 items in the 48-hour window. No recent items: Pittsburgh City Paper, NEXTpittsburgh, Pittsburgh Magazine.
Business and Politics: 8 of 8 feeds loaded, 60 items in the 36-hour window.
Events: 4 of 4 feeds loaded, 13 items in the 120-hour window.
Sports media: 3 of 6 feeds loaded, 17 items in the 96-hour window. Failed: Not Just Football with Cam Heyward (HTTPError: HTTP Error 404: Not Found); Pittsburgh Steelers (YouTube) (HTTPError: HTTP Error 404: Not Found); Ben Roethlisberger / Channel Seven (YouTube) (HTTPError: HTTP Error 404: Not Found). No recent items: Footbahlin with Ben Roethlisberger.
Team USA: 3 of 3 feeds loaded, 23 items in the 72-hour window.
Reading: 3 of 3 feeds loaded, 12 items in the 336-hour window.
Markets (Yahoo Finance): 7 of 7 rows
Weather (NWS): 3 forecast periods
Scores (ESPN, plaintextsports): 2 teams via ESPN
Summaries: 3 model call(s) served by claude-opus-5 (317s of model time; $1.72 at API list price).