================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Monday, October 12, 2026 - 7:06 AM EDT ================================================================ A hardware implant hidden inside Ledger wallets sold by one Southeast Asian reseller drained more than $93 million, anchoring a day of attacks that reach the owner before the device ever powers on. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets | Feed Health EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] CyberXero paired Cobalt Strike with a Claude Code orchestration layer against Ukrainian infrastructure, while Northwestern found Claude Opus 4.7 patches that stop crashes still fail maintainers' tests. see: CyberXero Runs Claude Code Against Ukraine; AI Patches Pass Crashes and Fail Tests * [TREND] A hardware implant in Ledger wallets and the Midnight Mimosa firmware malware both reached buyers before first power-on, moving the attack surface into factories and resellers. see: Ledger Implant Drains $93 Million; Midnight Mimosa Ships Inside Android Firmware * [UPDATE (new)] Let's Encrypt will default to 64-day certificates from February 10, 2027, putting hand-renewed trust on a hard clock alongside the expiring Windows Update server certificates. see: Certificate Clocks Tighten for Web and Windows * [UPDATE (new)] Patchstack reported active exploitation of CVE-2026-85097, a 10.0-rated Bricksforge flaw letting unauthenticated attackers upload PHP and gain full remote code execution on WordPress sites. see: Bricksforge Flaw Hands Attackers WordPress Sites * [TREND] Zelenskyy says Russia hit power plants after Trump's truce, while fresh Houthi missiles on Saudi Arabia lifted tanker freight rates and Brussels capped Chinese hybrid imports. see: Zelenskyy Says Putin Is Breaking the Energy Ceasefire; Houthi Missiles Keep Falling on Saudi Arabia; Brussels Caps Chinese Hybrid Imports at 350,000 a Year * [UPDATE (new)] Pittsburgh began mailing $100 red-light camera citations at three intersections as IBEW Local 29 crews returned to Duquesne Light after ratifying their contract Sunday evening. see: Pittsburgh's Red-Light Cameras Start Charging $100; Duquesne Light Crews Head Back to Work SECURITY ---------------------------------------------------------------- 1. CERTIFICATE CLOCKS TIGHTEN FOR WEB AND WINDOWS Identity and Trust Infrastructure · [pki, patch, policy] Latest developments: Let's Encrypt said it will issue certificates valid for 64 days by default starting February 10, 2027, down from 90 days and ahead of a later move to 45 days, with the last 90-day certificate expiring May 11, 2027 and no revocations during the transition; Microsoft separately told customers to patch Windows before the certificates that authenticate Windows Update servers expire on May 17 or June 19, 2027, depending on the Windows version. Shorter web certificate lifetimes make manual renewal untenable and force teams onto automated ACME issuance, while Windows devices that miss Microsoft's certificate rotation updates will lose access to Windows Update and the security fixes it delivers. Subscribers already on Let's Encrypt's 45-day or 6-day certificates see no change; Windows administrators should confirm machines take the rotation updates well before May 2027. - SecurityWeek: https://www.securityweek.com/lets-encrypt-cuts-default-certificate-validity-to-64-days-ahead-of-45-day-switch/ - Help Net Security: https://www.helpnetsecurity.com/2026/10/12/lets-encrypt-64-day-certificate-lifetime/ - Help Net Security: https://www.helpnetsecurity.com/2026/10/12/microsoft-windows-update-certificate-rotation/ 2. LEDGER IMPLANT DRAINS $93 MILLION Ransomware and Cybercrime · [supply chain, cryptocurrency, hardware] Latest developments: Ledger, the Paris-based hardware wallet maker, said in a 72-hour update on X on October 11, 2026 that every confirmed case in the draining incident it disclosed on October 9, 2026 involves a device bought from the Southeast Asia reseller CryptoBilis, and on-chain researchers put suspected losses above $93 million. Attackers planted a hidden hardware implant in Ledger cryptocurrency wallets that passed through one regional reseller, then emptied the wallets of customers across Southeast Asia. Ledger says its own systems and direct sales channels stayed clean; owners who bought through CryptoBilis should treat their seed phrases as compromised and move funds to a device sourced directly. - Help Net Security: https://www.helpnetsecurity.com/2026/10/12/ledger-wallets-compromised-via-hardware-implant/ 3. BRICKSFORGE FLAW HANDS ATTACKERS WORDPRESS SITES Vulnerabilities and Exploits · [patch, wordpress, exploit] Latest developments: Patchstack reported active exploitation of CVE-2026-85097, a 10.0-rated flaw in the Bricksforge WordPress plugin that lets an attacker with no login upload and run arbitrary PHP code, which carries full remote code execution on the site. Bricksforge extends the Bricks page builder and runs on commercial WordPress sites; the bug needs no authentication and no user interaction. Site owners should update the plugin immediately and audit for unfamiliar PHP files and administrator accounts. - The Hacker News: https://thehackernews.com/2026/10/attackers-exploit-cvss-100-bricksforge.html 4. CYBERXERO RUNS CLAUDE CODE AGAINST UKRAINE AI Security · [apt, ai, breach] Latest developments: Researchers attributed to CyberXero a two-pronged initial access campaign that pairs Cobalt Strike with an orchestration layer built on Anthropic's Claude Code, hits WordPress sites, e-commerce platforms, and critical infrastructure operators in Ukraine, and has taken more than 628,000 Ukrainian records. CyberXero uses the AI layer to pick targets, generate access attempts, and hand successful footholds to standard post-exploitation tooling. Organizations operating in Ukraine should hunt for Cobalt Strike beacons and harden internet-facing web applications and e-commerce stacks. - The Hacker News: https://thehackernews.com/2026/10/cyberxero-uses-claude-code-in-campaign.html 5. MIDNIGHT MIMOSA SHIPS INSIDE ANDROID FIRMWARE Ransomware and Cybercrime · [malware, supply chain, mobile] Latest developments: Bitdefender claimed the research behind Midnight Mimosa and narrowed the affected hardware to budget Android phones from several brands built on MediaTek platforms, saying the malware sits in the device firmware, runs before the owner first switches the phone on, and resists uninstallation. Midnight Mimosa arrives preinstalled on cheap Android handsets sold through online marketplaces, installs further applications, commits advertising fraud, and enlists each phone as a residential proxy node. Buyers of low-cost MediaTek-based phones from unfamiliar brands cannot remediate by removing an app and should replace the device. - Help Net Security: https://www.helpnetsecurity.com/2026/10/12/midnight-mimosa-malware-cheap-android-phones/ 6. AI PATCHES PASS CRASHES AND FAIL TESTS AI Security · [ai, patch, research] Latest developments: Researchers at Northwestern University ran AI coding agents against 112 real security bugs and found that with Claude Opus 4.7 a third of the patches that stopped the crash still failed the tests the projects' own maintainers wrote for the fix. Most AI patching benchmarks grade a fix by whether the crash disappears, a bar well below what maintainers accept. Security teams piloting automated remediation should score candidate patches against upstream maintainer test suites before merging anything. - Help Net Security: https://www.helpnetsecurity.com/2026/10/12/ai-vulnerability-patching-grading-problem/ BUSINESS AND POLITICS ---------------------------------------------------------------- * Zelenskyy Says Putin Is Breaking the Energy Ceasefire Latest developments: Volodymyr Zelenskyy said Monday, October 12, that Russia hit Ukrainian power plants after President Trump announced the truce Sunday, and diesel futures slipped anyway on the prospect of Russian supply. Trump said Sunday, October 11, that Moscow and Kyiv had agreed to stop striking each other's energy infrastructure, pairing the claim with his deal for Vladimir Putin to ship hundreds of thousands of tons of diesel into world markets before the November 3 midterms. Washington has since lobbied European capitals and threatened to block arms for Ukraine over Ukrainian strikes on Russian refineries, tying global fuel prices and the war's trajectory to an agreement Moscow has never confirmed. - FT Home: https://www.ft.com/content/863619b6-c4a7-4b1a-8a53-6950d47d1833?syn-25a6b1a6=1 - FT World: https://www.ft.com/content/a663781e-2709-41f2-99df-4fb5a6162e6b?syn-25a6b1a6=1 - FT World: https://www.ft.com/content/68fd8c4f-6f34-4f6e-a52c-76f635164031?syn-25a6b1a6=1 - WSJ World News: https://www.wsj.com/logistics-report/trumps-russian-diesel-move-draws-pushback-skepticism-89a5e65e?mod=rss_worldnews * Brussels Caps Chinese Hybrid Imports at 350,000 a Year Latest developments: An European Union official attached numbers Monday, October 12, to the understanding trade commissioner Maros Sefcovic reached in Beijing: a cap of 350,000 Chinese hybrid and plug-in hybrid vehicles a year for the next four years, with the aim of halving China's share of the bloc's market. Beijing rejected Brussels's request for voluntary export curbs on October 7, pushing the European Commission toward import limits that officials warned could set off a serious trade conflict; two days of talks produced a safeguard arrangement both sides frame as compliant with World Trade Organization rules. European carmakers welcome the ceiling, and other European industries warn that China's trade surplus persists without further action. - WSJ World News: https://www.wsj.com/economy/trade/eu-to-cap-chinese-hybrid-vehicle-imports-at-350-000-units-annually-official-says-2198522f?mod=rss_worldnews - FT World: https://www.ft.com/content/7e48dd50-957c-4f45-ad24-ce628ca7e06a?syn-25a6b1a6=1 * Houthi Missiles Keep Falling on Saudi Arabia Latest developments: Houthi forces fired a fresh round of missiles at Saudi Arabia on Monday, October 12, Riyadh answered defiantly, and oil tanker freight rates surged as attacks and longer routes squeezed vessel availability in the Middle East, ANZ said. Houthi strikes on Riyadh's international airport killed 12 people and injured hundreds Saturday, October 10, the deadliest attack inside the kingdom in more than a decade, and a projectile hit the same terminal a day later. Chief executives of the international oil companies skipped the World Petroleum Council congress in the capital, Brent crude traded above $105 a barrel Monday morning before easing, and the Wall Street Journal reports the campaign now squeezes Crown Prince Mohammed bin Salman, whose diversification drive rests on an economy weakened by heavy spending and a miscalculation of the Houthi threat. - FT World: https://www.ft.com/content/ad0b6e93-708c-46c6-a1f2-e6248c934faf?syn-25a6b1a6=1 - WSJ World News: https://www.wsj.com/world/middle-east/iran-backed-militants-are-tightening-the-screws-on-saudi-arabias-crown-prince-e7b9e789?mod=rss_worldnews - WSJ Markets: https://www.wsj.com/finance/commodities-futures/oil-falls-on-hopes-that-russian-diesel-can-ease-global-fuel-shortages-db1651af?mod=rss_markets_main * The Reserve Bank of India Mounts a Rupee Defense Latest developments: The rupee jumped Monday, October 12, after the Reserve Bank of India unveiled a package of currency-defense measures over the weekend. India's central bank raised its policy rate October 7 for the first time in three years and has intervened repeatedly as the rupee sank toward record lows against a dollar that has gained for four straight weeks. ING expects the dollar to stay firm on decent United States growth and above-target inflation, which keeps expectations of further Federal Reserve increases alive and the strain on emerging-market currencies and debt in place. - WSJ Markets: https://www.wsj.com/finance/currencies/rupee-jumps-after-india-central-bank-unveils-currency-defense-measures-26b7caa0?mod=rss_markets_main - WSJ Markets: https://www.wsj.com/finance/currencies/asian-currencies-consolidate-but-mideast-tensions-could-weigh-9ec0bb96?mod=rss_markets_main PITTSBURGH ---------------------------------------------------------------- Weather: Columbus Day: Mostly Cloudy, high 72F. Tonight: Partly Cloudy, low 59F. Tuesday: Sunny, high 82F. Business: * Duquesne Light Crews Head Back to Work Latest developments: International Brotherhood of Electrical Workers Local 29 said its members return to work after ratifying the contract Sunday evening, October 11, closing out the walkout. Roughly 1,000 line and service workers struck Duquesne Light Co. starting October 1, the utility's first walkout in half a century, and the company covered the gap with 80 line workers imported from outside the region plus contractors through the remnants of Hurricane Isaias. The two sides reached a tentative deal on the eighth day of the strike, and the ratification vote ends it. - TribLive: https://triblive.com/local/duquesne-light-union-will-return-to-work-after-ratifying-new-contract/ - WPXI: https://www.wpxi.com/news/local/ibew-members-ratify-contract-with-duquesne-light-co-following-strike/KVLZ32LL35B4HICDKZLXKXFY6A/ * Harvest Moon Coffee & Chocolates Closes Both Shops Latest developments: Owner Desiree Singleton announced on Facebook Sunday, October 11, that both Harvest Moon Coffee & Chocolates locations have closed. Harvest Moon sold coffee and house-made chocolates at two storefronts in the Alle-Kiski Valley, and TribLive's Valley News Dispatch reported the shutdown of both. Singleton delivered the news to customers herself through the business's Facebook page. - TribLive: https://triblive.com/local/valley-news-dispatch/harvest-moon-coffee-chocolates-announces-closure-of-its-2-locations/ * Arts Council and SisTers PGH Post Openings Latest developments: Pittsburgh City Paper's hiring column, published Monday, October 12, lists verified openings at the Greater Pittsburgh Arts Council, SisTers PGH, and the restaurant The Vandal. City Paper combs social media and local job boards each week and publishes only the postings it verifies. This edition draws from the region's arts administration, nonprofit, and restaurant employers. - Pittsburgh City Paper: https://www.pghcitypaper.com/columns/now-hiring/now-hiring-in-pittsburgh-greater-pittsburgh-arts-council-sisters-pgh-the-vandal-and-more/ Around town: * Pittsburgh's Red-Light Cameras Start Charging $100 Latest developments: The city began mailing $100 citations for red-light violations caught by automated cameras at three Pittsburgh intersections, the first time such camera tickets carry a fine here. The cameras ran in warning mode until now, and drivers who run the light at those three intersections get a citation in the mail. The step extends a camera-enforcement network that already covers most of the city and has produced a record number of tickets and tens of millions of dollars in fines. - KDKA: https://www.cbsnews.com/pittsburgh/news/pittsburgh-red-light-enforcement-fines-citations/ - WPXI: https://www.wpxi.com/news/local/pittsburgh-begins-issuing-100-red-light-camera-citations-3-intersections/ZWESEXMXIRGAVI4HVIDPAEKTPY/ - WTAE: https://www.wtae.com/article/red-light-cameras-in-pittsburgh-will-start-issuing-tickets/74104044 * The Turnpike Grades Its Allegheny Mountain Tunnel Response Latest developments: The Pennsylvania Turnpike Commission released a 19-page report detailing its response and the corrective actions it will take after the June 4 vehicle fire inside the Allegheny Mountain Tunnel. The fire forced the evacuation of roughly 150 people from the tunnel, which carries the turnpike under the Allegheny Front between Somerset and Bedford counties. The commission's review covers how crews handled the evacuation and what it changes next. - WPXI: https://www.wpxi.com/news/local/pennsylvania-turnpike-posts-review-allegheny-tunnel-vehicle-fire-where-some-150-people-evacuated/UMVHTG6GXVEEJFC6XVEPNDCDAI/ * Drizzle Monday, Two Cold Fronts to Come Latest developments: Patchy fog and mist greeted the Monday morning commute, October 12, and KDKA meteorologist Mary Ours has a seasonable day of cloudy skies and drizzle over Western Pennsylvania. The week starts warmer and drier than the weekend, when the remnants of Isaias soaked the region. WTAE has two more cold fronts bringing rain before next weekend arrives. - KDKA: https://www.cbsnews.com/pittsburgh/news/cloudy-skies-are-in-todays-pittsburgh-area-weather-forecast/ - WTAE: https://www.wtae.com/article/patchy-am-fogmist-for-the-am-commute/74105299 - WTAE: https://www.wtae.com/article/impact-day-rain-and-wind-for-western-pa-isaias/74100985 Events: * John Cameron Mitchell Brings Hedwig to the Roxian Latest developments: Pittsburgh City Paper interviewed John Cameron Mitchell on Monday, October 12, ahead of his Roxian Theatre stop on the 25th anniversary tour of "Hedwig and the Angry Inch." Mitchell wrote and starred in "Hedwig and the Angry Inch," the story of an East German genderqueer rock singer, and he promises the Roxian Theatre in McKees Rocks "a wonderful orgy of Hedwig." He talked with City Paper about essential oils, playing Mary Todd Lincoln, and the film's lasting queer legacy. - Pittsburgh City Paper: https://www.pghcitypaper.com/arts-entertainment-2/john-cameron-mitchell-on-essential-oils-playing-mary-todd-lincoln-and-the-lasting-queer-legacy-of-hedwig/ * The Pittsburgh Tattoo Art Museum Opens Its Archive Latest developments: The Post-Gazette's Off the Beaten Path column visited the Pittsburgh Tattoo Art Museum on Monday, October 12, where Nick Ackman pairs fresh ink with a history lesson in vintage American tattooing. Ackman runs the museum as a working shop and an archive, displaying the designs, machines, and imagery of early American tattoo artists alongside the chairs where customers get tattooed. Walk-in visitors can tour the collection. - Post-Gazette Arts & Entertainment: https://www.post-gazette.com/local/city/2026/10/12/pittsburgh-tattoo-art-museum-nick-ackman-vintage-american/stories/202610110103 SPORTS ---------------------------------------------------------------- Steelers (3-2) Sun Oct 11 · Colts 22 · Steelers 34 · Final Jaylen Warren's brilliance leads the Steelers past the Colts 34-22 https://plaintextsports.com/nfl/2026/week5/ind-pit Up Next · Steelers @ Buccaneers · Sun Oct 18, 1:00 PM https://plaintextsports.com/nfl/2026/week6/pit-tb Penguins (3-2-1) Up Next · Penguins @ Blackhawks · Tue Oct 13, 8:00 PM https://plaintextsports.com/nhl/2026-10-13/pit-chi Around the Teams: * Germie Bernard Grows Into the Offense Latest developments: The Post-Gazette's Week 5 analysis, published Monday, October 12, argues that receiver Germie Bernard's continued development can raise the Steelers' offensive ceiling. Bernard has taken on a larger share of the work with Michael Pittman Jr. on injured reserve, which leaves the Steelers leaning on DK Metcalf and a young receiver room. The paper treats Bernard's progress as the variable that decides how far the passing game goes. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/10/12/germie-bernard-steelers-role-offense/stories/202610110098 * A Thinned Secondary Holds Up Latest developments: The Post-Gazette wrote Sunday night, October 11, that the Steelers' depleted secondary made the key plays against the Indianapolis Colts, with Asante Samuel Jr. and rookie cornerback Daylen Everette in the middle of them. Cornerback Jamel Dean and safety DeShon Elliott both sat out the game, pushing Everette deeper into defensive coordinator Patrick Graham's plans in a group already short on bodies after the Joey Porter Jr. trade to the Dallas Cowboys. Samuel and Everette answered. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/10/11/steelers-cornerbacks-asante-samuel-daylen-everette/stories/202610110095 * The Postgame Podium and Press Pass Latest developments: The Steelers posted their Week 5 postgame news conference Sunday, October 11, with head coach Mike McCarthy, running back Jaylen Warren, defensive lineman Cameron Heyward, and quarterback Aaron Rodgers, plus a Press Pass session with Alex Highsmith, Troy Fautanu, Asante Samuel Jr., Pat Freiermuth, and Payton Wilson. The team's YouTube channel carries both sessions in full, and Cam Heyward's Not Just Football ran a live postgame show the same evening. Together they cover the locker room's read on the Colts game before the Steelers travel to Tampa Bay. - Pittsburgh Steelers (YouTube): https://www.youtube.com/watch?v=aGl8ma20Qaw - Pittsburgh Steelers (YouTube): https://www.youtube.com/watch?v=JHZAtfCKpz0 - Not Just Football with Cam Heyward: https://www.youtube.com/watch?v=ztoPoxF9Dt0 READING ---------------------------------------------------------------- * Ed Zitron -- Premium: The Hater's Guide To Junk Zitron walks through the junk bond market, the below-investment-grade debt that lenders prefer to call high-yield or speculative-grade, and argues that a once-sleepy corner of finance now bankrolls an era of corporate garbage. https://www.wheresyoured.at/premium-the-haters-guide-to-junk/ * Stratechery -- An Interview with Katie Harbath About Disrupting Politics at Facebook Ben Thompson interviews Katie Harbath, Facebook's former head of global elections, about her book "Disrupting Politics" and how the company's relationship with campaigns and governments changed over the 2010s. https://stratechery.com/2026/an-interview-with-katie-harbath-about-disrupting-politics-at-facebook/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,794.31 ▲ +1.5% Dow 51,371.13 ▲ +0.4% Nasdaq 27,435.06 ▲ +2.0% WTI crude 90.10 ▼ -1.3% EUR/USD 1.1228 ▼ -0.9% GBP/USD 1.3234 = -0.0% USD/JPY 158.02 ▲ +0.3% FEED HEALTH ---------------------------------------------------------------- Security: 24 of 24 feeds loaded, 15 items in the 24-hour window. No recent items: Krebs on Security, Schneier on Security, Dark Reading, CISA Advisories, The Record, Ars Technica Security, Securelist (Kaspersky), Sophos News, Unit 42 (Palo Alto), Google Online Security Blog, Cisco Talos, Graham Cluley, Microsoft Security Blog, Google Project Zero, The DFIR Report, Kim Zetter (Zero Day), 404 Media, Frank on Fraud, Wired Security. Pittsburgh: 9 of 9 feeds loaded, 60 items in the 48-hour window. No recent items: NEXTpittsburgh, Pittsburgh Magazine. Business and Politics: 8 of 8 feeds loaded, 60 items in the 36-hour window. Events: 4 of 4 feeds loaded, 12 items in the 120-hour window. Sports media: 6 of 6 feeds loaded, 30 items in the 96-hour window. No recent items: Footbahlin with Ben Roethlisberger, Ben Roethlisberger / Channel Seven (YouTube). Team USA: 3 of 3 feeds loaded, 23 items in the 72-hour window. Reading: 3 of 3 feeds loaded, 12 items in the 336-hour window. No recent items: Cal Newport. Markets (Yahoo Finance): 7 of 7 rows Weather (NWS): 3 forecast periods Scores (ESPN, plaintextsports): 2 teams via ESPN Summaries: 3 model call(s) served by claude-opus-5 (311s of model time; $1.61 at API list price). ================================================================ Generated 2026-10-12 07:06 EDT. Updated weekdays at about 7:05 AM, 10:05 AM, 1:35 PM, and 7:35 PM ET, and weekends at about 8:05 AM and 7:35 PM ET. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 3 Team USA feeds; WSJ World News, WSJ Markets, WSJ US Business, WSJ Politics, The Economist, FT Home, FT World, FT Markets; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN or plaintextsports.com. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================