A maximum-severity GitLab code execution bug and a flaw in npm's Trusted Publishing that exposed more than 1,500 packages put the developer supply chain at the center of the day.
Emerging Trends and Key Updates
- Trend Frontier AI models met all eight attack objectives against the isolated industrial control testbed in Booz Allen's Chantilly, Virginia lab, mapping the network and matching exploits unaided.
- Trend npm's Trusted Publishing let anyone re-registering an abandoned GitHub repo name ship versions of a maintainer's package, while a circuit board under Ledger screens drained $86 million.
- Update · updated Attackers drove refrigeration at hundreds of French supermarkets, including Les Mousquetaires stores, to 50 degrees Celsius on October 11, forcing staff to dump chilled and frozen stock.
- Update · new GitLab tagged its maximum-severity CI/CD regex overflow CVE-2026-97229 while Progress Software disclosed 31 MarkLogic Server flaws, two letting partial-privilege managers seize the database.
- Trend Broadcom's casino remark sank chip stocks as JPMorgan missed on bond trading, European gas hit a four-year high, and Treasury bill issuance squeezed short-term rates.
- Update · new WTAE tags Wednesday an Impact Day for rain as McCandless opens its first Restaurant Week and PublicSource posts a voter guide to 17 legislative races.
Security
1. GitLab Patches a 10.0 Regex Compiler Flaw
Latest developments: GitLab's maximum-severity bug now carries an identifier and a mechanism: CVE-2026-97229 is an integer overflow in the CI/CD Regular Expression Compiler, it affects both Community Edition and Enterprise Edition, and an unauthenticated attacker reaches arbitrary code execution on the server through a specially crafted regular expression in a CI/CD configuration.
read more
Self-managed GitLab instances carry the risk; GitLab.com customers do not. Administrators should apply the patched releases immediately, since the flaw needs no account on the target.
Sources: The Hacker News · Help Net Security · BleepingComputer · ↑ top
2. French Supermarket Freezers Driven to 50 Degrees
Latest developments: The attack ran hotter than first reported: on the night of October 11, 2026 the attackers warmed refrigerators and freezers at hundreds of French supermarkets to 50 degrees Celsius, retail chains including Les Mousquetaires confirmed the losses, and the entry point was the single Danfoss controller that runs every cooling unit in a store, a device maintenance firms manage remotely.
read more
One remotely managed controller governs all the refrigeration in a store, which turns a single credential into spoiled stock across a chain. Grocery operators should inventory remote access held by refrigeration maintenance contractors and cut any path that reaches controllers from the open internet.
Sources: The Hacker News · SecurityWeek · Help Net Security · ↑ top
3. Circuit Board Under the Ledger Screen
Latest developments: SecurityWeek described the implant's construction on October 13, 2026: a small circuit board sat hidden under the screens of the Ledger signers, read user data, and transmitted it to the attackers, who drained roughly $86 million from wallets created on devices the Southeast Asian reseller CryptoBilis sold.
read more
Ledger, the Paris-based hardware wallet maker, has paused sales through CryptoBilis and ties every confirmed theft to a device from that reseller. Anyone holding a Ledger signer bought through a third-party reseller should verify the device and move funds to a seed generated on hardware bought direct.
Sources: SecurityWeek · BleepingComputer · The Hacker News · ↑ top
4. npm Trusted Publishing Opened 1,500 Packages
Latest developments: Bloom Security disclosed on October 13, 2026 that npm's Trusted Publishing feature let an attacker publish new versions of another maintainer's package by registering a GitHub repository name the maintainer had abandoned, with no stolen credential anywhere in the chain; Bloom counted more than 1,500 exposed packages carrying over 10 million downloads in total, and GitHub, which owns npm, says it has shipped fixes.
read more
Trusted Publishing ties publish rights to a GitHub repository instead of a token, so a renamed or deleted repository leaves the claim open to whoever registers that name next. Maintainers should audit the repositories their npm packages trust and reclaim any name they have retired.
Sources: Help Net Security · ↑ top
5. Frontier AI Clears Every Goal in Booz Allen's OT Lab
Latest developments: Booz Allen reported on October 13, 2026 that frontier AI models it set against an isolated industrial control testbed in its Chantilly, Virginia lab met all eight attack objectives the firm had defined: the models mapped the network, matched equipment to known weaknesses, wrote working exploits, pivoted into the systems that run production, and in the final test found a robotic arm, took administrative control, and moved it.
read more
The test puts a measured floor under claims that general-purpose models can run operational technology intrusions end to end, against the very equipment that moves physical things. Plant operators should assume exploit development against their known-vulnerable gear now costs an attacker hours instead of weeks and prioritize segmentation between business networks and production control.
Sources: Help Net Security · ↑ top
6. MarkLogic Flaws Hand Managers the Server
Latest developments: Progress Software published 31 vulnerabilities in MarkLogic Server on October 12, 2026 and rated five of them critical; two let an account holding only partial management privileges seize administrator control of the database server and keep it.
read more
MarkLogic runs enterprise document and search workloads, so an escalation from delegated manager to full administrator exposes everything the database holds. Progress has shipped fixes since September 10, 2026 in MarkLogic 11.3.7 and 12.1.0, and administrators should upgrade and review who holds delegated management rights.
Sources: The Hacker News · ↑ top
Business and Politics
The AI Trade Cracks Again
Latest developments: Broadcom's chief executive called the artificial intelligence spending race a "casino," and chip stocks slid worldwide Tuesday, October 13, with Nasdaq futures falling sharply.
read more
Samsung Electronics and SK Hynix dropped hard enough to drag South Korea's Kospi sharply lower, and Asian and European technology shares followed as investors questioned the scale of AI capital spending and the pace of Chinese competition. Treasury yields eased partly because money left those shares, which ties the bond market's relief to the equity market's doubt.
Sources: FT Home · WSJ Markets · WSJ Markets · ↑ top
European Gas Reaches a Four-Year High
Latest developments: European natural gas prices climbed Tuesday, October 13, to their highest level since December 2022.
read more
Escalating attacks in the Middle East threaten Persian Gulf liquefied natural gas cargoes just as European storage sits unusually low for the season, and the standoff between Washington and Kyiv over Russian diesel supplies compounds the squeeze. A global scramble for LNG raises industrial and household energy costs across the continent through the winter.
Sources: WSJ Markets · WSJ Markets · FT World · ↑ top
Bond Stress Shifts to the Short End
Latest developments: The 10-year Treasury yield fell 5.5 basis points to 5.189% Tuesday, October 13, well below last week's 24-year high, while the Financial Times reported that rising Treasury bill issuance now pressures short-term lending rates and the International Monetary Fund sounded an alarm over governments' public finances.
read more
Lower oil prices and the pullback in AI shares pulled Treasury and eurozone yields down ahead of United States inflation data, and record inflows into government bond funds show investors locking in the highest borrowing costs in decades. Strain migrating from the long end to money markets complicates the Federal Reserve's control of short-term rates.
Sources: WSJ Markets · FT World · FT Home · FT World · ↑ top
JPMorgan Misses as Trading Revenue Falls
Latest developments: JPMorgan Chase reported third-quarter earnings below expectations Tuesday, October 13, on falling bond trading revenue, and its shares dropped; Wells Fargo's revenue also disappointed.
read more
The two results open a bank earnings season in which Wall Street expects its weakest trading quarter of the year, following a record second quarter built on volatility. Fixed-income desks carried much of the industry's recent profit growth, so a reversal there reshapes revenue guidance across the largest United States banks.
Sources: FT Home · WSJ Markets · ↑ top
Pittsburgh
Weather
Today: Sunny, high 82F.
Tonight: Mostly Clear, low 65F.
Wednesday: Chance Showers And Thunderstorms, high 78F.
Business
Dining Out Gets Expensive on Both Sides of the Table
Latest developments: The Post-Gazette reported Tuesday, October 13, that Pittsburgh restaurant owners describe profitability as down quite a bit while customers absorb higher menu prices.
read more
Rising food, labor, and occupancy costs have narrowed margins across Pittsburgh restaurants, and operators tell the Post-Gazette they pass only part of the increase to diners. The squeeze bears on one of the region's larger employers of hourly workers.
Sources: Pittsburgh Post-Gazette · ↑ top
Verizon Retires Its Copper Lines
Latest developments: Verizon told TribLive on Tuesday, October 13, that its copper landline phaseout will not disconnect customers.
read more
Michele Vanetta, who has lived in Jeannette her whole life and kept the same number for nearly 40 years at her current house, is among the Westmoreland County customers whose service moves off copper. Verizon says it will carry those lines onto replacement technology rather than cut them.
Shorty's, Apteka, and Northside Sandwich Week
Latest developments: Pittsburgh City Paper's weekly food column, published Tuesday, October 13, carries updates on Shorty's Social Kitchen, New Amsterdam, Apteka, Northside Sandwich Week, and a new Sheetz meat line.
read more
The column tracks openings, menu changes, and fall cocktail programs across Pittsburgh restaurants and bars, with Northside Sandwich Week giving North Side shops a week of promotion. Readers get the week's operating news on independent kitchens in one place.
Sources: Pittsburgh City Paper · ↑ top
Around Town
A Voter Guide to 17 Legislative Races
Latest developments: PublicSource published its 2026 voter guide Tuesday, October 13, three weeks before the November 3 election.
read more
The guide covers 17 contested legislative races in Allegheny County and prints candidates' answers on Immigration and Customs Enforcement activity, the war, and data center development, the issues readers flagged. Those three subjects have driven the fall campaign across Western Pennsylvania.
Sources: PublicSource · ↑ top
Rachel Carson EcoVillage Shows Progress
Latest developments: TribLive reported Tuesday, October 13, that work has resumed at the Rachel Carson EcoVillage site in McCandless after roughly a year of inactivity.
read more
Backers of the cohousing community, planned around shared space and low-energy construction in McCandless, say obstacles left the property largely undeveloped for about a year and the project still moves forward. The site sits in one of the North Hills municipalities fielding the most new residential proposals.
Warm Tuesday, Then Two Impact Days
Latest developments: WTAE's Tuesday morning update, October 13, keeps the day warm and breezy and tags Wednesday, October 14, an Impact Day for rain, with a second Impact Day behind it.
read more
Pittsburgh starts Tuesday under patchy fog and mist before afternoon sun, and rain arrives with the next front Wednesday. Temperatures drop sharply through the week behind the system.
Events
Joe Manganiello Publishes "Bloodlines"
Latest developments: The Post-Gazette reviewed Joe Manganiello's memoir "Bloodlines" on Tuesday, October 13, and ran a companion interview the same day.
read more
The Mount Lebanon native and actor opens the book at death's door and closes it in Pittsburgh, where he grew up; the interview covers the Dungeons & Dragons work he calls his dream job. The Post-Gazette treats the memoir as a Pittsburgh story first.
Sources: Post-Gazette Arts & Entertainment · Post-Gazette Arts & Entertainment · ↑ top
McCandless Holds Its First Restaurant Week
Latest developments: WPXI reported Tuesday, October 13, that McCandless's first-ever Restaurant Week is underway.
read more
Restaurants across McCandless, the North Hills municipality along McKnight Road, are taking part in the community's inaugural Restaurant Week promotion. WPXI gave no closing date or participant list.
Sports
Steelers (3-2)
Up Next · Steelers @ Buccaneers · Sun Oct 18, 1:00 PM
Penguins (3-2)
Up Next · Penguins @ Blackhawks · Tue Oct 13, 8:00 PM
Around the Teams
McCarthy Turns to Tampa Bay
Latest developments: The Steelers posted head coach Mike McCarthy's Monday, October 12, news conference previewing Week 6 at the Tampa Bay Buccaneers, set for Sunday, October 18, at 1 p.m. Eastern on CBS.
read more
Linebackers Nick Herbig and Patrick Queen and guard Mason McCormick took the podium the same day on the team's YouTube channel. The Buccaneers trip follows a four-game stretch that has cost Pittsburgh receivers and defensive backs to injury.
Sources: Pittsburgh Steelers (YouTube) · Pittsburgh Steelers (YouTube) · ↑ top
The WPIAL's NFL Pipeline Thins
Latest developments: The Post-Gazette published an examination Tuesday, October 13, of why the WPIAL and the Pittsburgh City League send fewer players to the NFL than they did a decade ago.
read more
Western Pennsylvania high school football long supplied a steady stream of professional players, and the paper traces the decline through participation numbers, recruiting patterns, and the migration of talent to other regions. The trend matters to a city that built part of its identity on that pipeline.
Sources: Post-Gazette Steelers · ↑ top
SNR Drive Takes a Victory Monday
Latest developments: Matt Williamson and Wes Uhler spent Monday's SNR Drive, October 12, on the Steelers' Week 5 win over the Indianapolis Colts, with Rob King, the voice of the Steelers, calling in.
read more
The team-produced show worked through the game, the rest of the Week 5 NFL slate, and a segment the hosts labeled "winning is better than losing." The hosts note their opinions belong to them rather than the franchise.
Sources: Pittsburgh Steelers (YouTube) · ↑ top
Reading
- Stratechery — SpaceX Buys More Spectrum, Musk and Market Structure, Distributed Cellular. Ben Thompson argues that SpaceX's latest spectrum purchase clarifies a mobile strategy built on distributed cellular service from orbit, and that the approach has a real chance of working against incumbent carriers.
- Ed Zitron — Premium: The Hater's Guide To Junk. Zitron walks through the junk bond market, once a sleepy corner of credit, and argues that the current flood of speculative-grade issuance marks an era of exceptionally low-quality debt.
Markets
S&P 500 7,800.97 ▲ +1.3% Dow 51,487.66 ▲ +0.7% Nasdaq 27,388.78 ▲ +1.3% WTI crude 90.96 ▲ +0.4% EUR/USD 1.1228 ▼ -0.9% GBP/USD 1.3234 = -0.0% USD/JPY 158.02 ▲ +0.3%
Feed Health
Security: 24 of 24 feeds loaded, 44 items in the 24-hour window. No recent items: Krebs on Security, CISA Advisories, Ars Technica Security, Securelist (Kaspersky), Sophos News, Unit 42 (Palo Alto), Google Online Security Blog, Cisco Talos, Microsoft Security Blog, Google Project Zero, The DFIR Report, Kim Zetter (Zero Day), Wired Security.
Pittsburgh: 9 of 9 feeds loaded, 60 items in the 48-hour window.
Business and Politics: 8 of 8 feeds loaded, 60 items in the 36-hour window.
Events: 4 of 4 feeds loaded, 11 items in the 120-hour window. No recent items: NEXTpittsburgh Events.
Sports media: 6 of 6 feeds loaded, 30 items in the 96-hour window. No recent items: Footbahlin with Ben Roethlisberger, Ben Roethlisberger / Channel Seven (YouTube).
Team USA: 3 of 3 feeds loaded, 22 items in the 72-hour window. No recent items: Guardian Olympics.
Reading: 3 of 3 feeds loaded, 12 items in the 336-hour window. No recent items: Cal Newport.
Markets (Yahoo Finance): 7 of 7 rows
Weather (NWS): 3 forecast periods
Scores (ESPN, plaintextsports): 2 teams via ESPN
Summaries: 3 model call(s) served by claude-opus-5 (304s of model time; $1.66 at API list price).