================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Tuesday, October 13, 2026 - 1:37 PM EDT ================================================================ Ivanti is racing an actively exploited Connect Secure zero-day while npm and Docker Hub patch flaws that let a stranger publish code as someone else. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets | Feed Health EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Package registries keep failing at ownership: npm's Trusted Publishing handed publish rights to anyone claiming an abandoned GitHub repository name, and a Docker Hub token flaw let one user impersonate another, CVE-2026-105445. see: npm Trusted Publishing Opened 1,500 Packages; Docker Hub Token Flaw Let Attackers Pose as Owners * [TREND] Attacks reached physical systems and state targets at once, with freezers warmed to 50 degrees at French supermarkets, drones shutting Yandex data centers in Sasovo, and MI5 flagging Iranian interest in British bases. see: French Supermarket Freezers Driven to 50 Degrees; Drones and DDoS Hit Russian Internet Infrastructure; Hybrid War Reaches NATO's Waters and Britain's Bases * [TREND] Enterprise gateways and build systems all need patching today: Ivanti Connect Secure has an exploited zero-day, GitLab fixed CVE-2026-97229, and SAP rated an OAuth2 SSRF maximum severity. see: Ivanti Connect Secure Zero-Day Under Attack; GitLab Patches a 10.0 Regex Compiler Flaw; SAP Patches a Maximum-Severity OAuth2 SSRF * [UPDATE (updated)] Booz Allen's frontier AI models cleared all eight attack objectives set against an isolated control-system testbed at its Chantilly, Virginia lab, finishing with a commandeered robotic arm. see: Frontier AI Clears Every Goal in Booz Allen's OT Lab * [UPDATE (updated)] Ahold Delhaize disconnected systems to contain an intrusion, with disruption now reported at Food Lion, Stop & Shop, Giant, and Albert Heijn stores on both sides of the Atlantic. see: Ahold Delhaize and Foschini Disconnect Systems * [UPDATE (new)] Locally, Loews signed a letter of intent for a convention center hotel, Sierra is opening two Allegheny County stores, and Breeze Airways takes the gates at Latrobe. see: Loews Signs On for a Convention Center Hotel; Sierra Opens Two Allegheny County Stores; Breeze Airways Takes the Latrobe Gates SECURITY ---------------------------------------------------------------- 1. CIRCUIT BOARD UNDER THE LEDGER SCREEN Ransomware and Cybercrime · [crypto, hardware, supply chain] Latest developments: SecurityWeek described the implant's construction on October 13, 2026: a small circuit board sat hidden under the screens of the Ledger signers, read user data, and transmitted it to the attackers, who drained roughly $86 million from wallets created on devices the Southeast Asian reseller CryptoBilis sold; Ledger says the implant captured recovery phrases, and Kim Zetter reported the same day that the scheme reached legitimate resellers in both Asia and Europe and put the total theft near $100 million. Ledger, the Paris-based hardware wallet maker, has paused sales through CryptoBilis and ties every confirmed theft to a device from that reseller. Anyone holding a Ledger signer bought through a third-party reseller should verify the device and move funds to a seed generated on hardware bought direct. - SecurityWeek: https://www.securityweek.com/86-million-crypto-heist-linked-to-ledger-signer-hardware-implant/ - Kim Zetter (Zero Day): https://www.zetter-zeroday.com/who-is-planting-backdoors-in-ledger-crypto-wallets/ - The Record: https://therecord.media/ledger-cryptocurrency-wallet-implant-theft - BleepingComputer: https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/ 2. AHOLD DELHAIZE AND FOSCHINI DISCONNECT SYSTEMS Ransomware and Cybercrime · [breach, retail] Latest developments: The Ahold Delhaize incident spans the Atlantic: the Dutch-Belgian owner of Food Lion, Stop & Shop, Giant, and Albert Heijn says it disconnected some systems to contain an intrusion, with disruption at stores in the United States, the Netherlands, and Belgium; The Foschini Group of South Africa disclosed a cyberattack on October 13, 2026 that hit its British arm TFG London, knocking out IT systems used by the Phase Eight, Hobbs, and Whistles fashion brands. Two large multinational retailers are working outages they attribute to network intrusions, with store operations rather than corporate email taking the damage. Neither company has named an attacker or confirmed data theft, and neither has given a restoration date. - The Record: https://therecord.media/cyberattack-groceru-ahold-delhaize - SecurityWeek: https://www.securityweek.com/cyberattack-prompts-ahold-delhaize-to-disconnect-systems/ - The Record: https://therecord.media/foschini-group-south-africa-cyber - BleepingComputer: https://www.bleepingcomputer.com/news/security/tfg-london-cyberattack-disrupts-systems-at-hobbs-and-whistles-retailers/ 3. FRENCH SUPERMARKET FREEZERS DRIVEN TO 50 DEGREES Critical Infrastructure Security · [ics, breach] Latest developments: The attack ran hotter than first reported: on the night of October 11, 2026 the attackers warmed refrigerators and freezers at hundreds of French supermarkets to 50 degrees Celsius, retail chains including Les Mousquetaires confirmed the losses, and the entry point was the single Danfoss controller that runs every cooling unit in a store, a device maintenance firms manage remotely. One remotely managed controller governs all the refrigeration in a store, which turns a single credential into spoiled stock across a chain. Grocery operators should inventory remote access held by refrigeration maintenance contractors and cut any path that reaches controllers from the open internet. - The Hacker News: https://thehackernews.com/2026/10/attackers-heat-french-supermarket.html - SecurityWeek: https://www.securityweek.com/refrigeration-controller-hack-spoils-food-across-european-supermarkets/ - Help Net Security: https://www.helpnetsecurity.com/2026/10/12/france-cyberattack-supermarket-freezers/ 4. DRONES AND DDOS HIT RUSSIAN INTERNET INFRASTRUCTURE Nation-State Activity · [hacktivism, ddos, critical infrastructure] Latest developments: Yandex named the damaged sites on October 13, 2026: drone strikes shut its data centers in Sasovo and Vladimir and knocked out part of its Kaluga infrastructure, and Yandex Cloud told customers on October 11, 2026 that the platform ran in emergency mode and they should fall back on their own disaster recovery plans; the same day, SkyNet, a major St. Petersburg internet provider, said a distributed denial-of-service attack that Ukrainian hackers claim has run against its network since October 6, 2026, degrading online gaming, voice calls, and video conferencing. Physical strikes and network floods are now hitting the same Russian digital infrastructure, taking down cloud storage, payments, and consumer connectivity. Organizations that depend on single-region Russian cloud capacity have lost access to files and have no restoration timeline from Yandex. - Help Net Security: https://www.helpnetsecurity.com/2026/10/13/ukraine-drone-strikes-yandex-data-centers/ - The Record: https://therecord.media/russian-internet-provider-skynet-reports-outages-ddos - BleepingComputer: https://www.bleepingcomputer.com/news/security/yandex-confirms-service-outage-as-users-lose-access-to-cloud-files/ 5. GITLAB PATCHES A 10.0 REGEX COMPILER FLAW Vulnerabilities and Exploits · [patch, zero-day, devops] Latest developments: GitLab's maximum-severity bug now carries an identifier and a mechanism: CVE-2026-97229 is an integer overflow in the CI/CD Regular Expression Compiler, it affects both Community Edition and Enterprise Edition, and an unauthenticated attacker reaches arbitrary code execution on the server through a specially crafted regular expression in a CI/CD configuration. Self-managed GitLab instances carry the risk; GitLab.com customers do not. Administrators should apply the patched releases immediately, since the flaw needs no account on the target. - The Hacker News: https://thehackernews.com/2026/10/gitlab-patches-cvss-100-flaw-that-could.html - Help Net Security: https://www.helpnetsecurity.com/2026/10/13/gitlab-ci-cd-regular-expression-compiler-vulnerability-cve-2026-97229/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/gitlab-warns-of-max-severity-rce-flaw-in-regex-compiler-engine/ 6. NPM TRUSTED PUBLISHING OPENED 1,500 PACKAGES Vulnerabilities and Exploits · [supply chain, patch] Latest developments: GitHub tightened the feature on October 13, 2026, expiring any unvalidated npm trusted publishing configuration 48 hours after someone creates it, with a configuration becoming permanent only after its first successful publish; Bloom Security had disclosed that the feature let an attacker publish new versions of another maintainer's package by registering a GitHub repository name the maintainer had abandoned, with no stolen credential anywhere in the chain, across more than 1,500 packages carrying over 10 million downloads. Trusted Publishing ties publish rights to a GitHub repository instead of a token, so a renamed or deleted repository leaves the claim open to whoever registers that name next. Maintainers should audit the repositories their npm packages trust and reclaim any name they have retired. - Help Net Security: https://www.helpnetsecurity.com/2026/10/13/slugfest-npm-trusted-publishing-flaw/ - The Hacker News: https://thehackernews.com/2026/10/github-tightens-npm-publishing-after.html 7. FRONTIER AI CLEARS EVERY GOAL IN BOOZ ALLEN'S OT LAB AI Security · [ai, ics] Latest developments: Booz Allen reported on October 13, 2026 that frontier AI models it set against an isolated industrial control testbed in its Chantilly, Virginia lab met all eight attack objectives the firm had defined, ending with a robotic arm the models found, controlled, and moved; Anthropic warned the same day that cheap television boxes already run capable AI models and that small models may soon spread across such devices on their own. The test puts a measured floor under claims that general-purpose models can run operational technology intrusions end to end, against the very equipment that moves physical things. Plant operators should assume exploit development against their known-vulnerable gear now costs an attacker hours instead of weeks and prioritize segmentation between business networks and production control. - Help Net Security: https://www.helpnetsecurity.com/2026/10/13/frontier-ai-ot-security-threat/ - SecurityWeek: https://www.securityweek.com/small-ai-models-may-soon-be-able-to-self-replicate-on-iot-devices-anthropic-warns/ 8. IVANTI CONNECT SECURE ZERO-DAY UNDER ATTACK Vulnerabilities and Exploits · [zero-day, patch, vpn] Latest developments: Ivanti told customers on October 13, 2026 to patch a zero-day in its Connect Secure remote access gateway immediately, saying attackers are exploiting the flaw now. Connect Secure terminates employee VPN and remote access sessions for enterprises and government agencies, which keeps it in attackers' sights. Administrators should apply the fix today and hunt for intrusion, since a patch leaves any existing foothold in place. - BleepingComputer: https://www.bleepingcomputer.com/news/security/ivanti-warns-of-connect-secure-zero-day-exploited-in-attacks/ 9. DOCKER HUB TOKEN FLAW LET ATTACKERS POSE AS OWNERS Vulnerabilities and Exploits · [supply chain, patch, containers] Latest developments: Docker disclosed CVE-2026-105445 on October 13, 2026, a critical Docker Hub flaw that let an attacker hold a personal access token, reach another user's container repositories, impersonate that user, and tamper with images. Docker Hub distributes the base images most container builds pull, so a hijacked identity there carries altered layers straight into production deployments. Teams should rotate personal access tokens, pin image digests, and review recent pushes to their own repositories. - BleepingComputer: https://www.bleepingcomputer.com/news/security/docker-hub-flaw-let-attackers-impersonate-users-tamper-with-images/ 10. SAP PATCHES A MAXIMUM-SEVERITY OAUTH2 SSRF Vulnerabilities and Exploits · [patch, ssrf] Latest developments: SAP shipped its October 2026 security updates on October 13, 2026, fixing 20 flaws across its product line, and rated one of them maximum severity: a server-side request forgery in the OAuth2 handling of SAP Cloud SDK for Python. The Cloud SDK for Python underpins custom applications and integrations that talk to SAP cloud services, and a server-side request forgery turns such an application into a relay for an attacker's requests into internal systems. SAP customers should work the October patch day notes and update affected SDK dependencies in their own builds. - BleepingComputer: https://www.bleepingcomputer.com/news/security/sap-warns-of-maximum-severity-oauth2-ssrf-security-flaw/ BUSINESS AND POLITICS ---------------------------------------------------------------- * Hybrid War Reaches NATO's Waters and Britain's Bases Latest developments: MI5 director general Ken McCallum said Tuesday, October 13, that Iran has made a "major shift" toward targeting United Kingdom military sites and that state-backed threats have quadrupled in a decade, Bulgaria pointed at Russia over a strike on a cargo ship in the Black Sea, and the Wall Street Journal reported that drone attacks on vessels skirting NATO waters now test the alliance's response. European governments have accused Moscow of assaults on their territory, and the strikes now extend to merchant ships just outside alliance waters, which puts war-risk insurance, Black Sea cargo routes, and NATO's threshold for collective defense into the same question. Volodymyr Zelenskyy added Tuesday that Kyiv's partners gave no warning of a Russian ballistic missile attack, stopping short of tying that intelligence gap to the Trump administration's threats to withdraw United States support. - FT World: https://www.ft.com/content/a0921eb6-637e-4fac-b15d-ea7aef441e6a?syn-25a6b1a6=1 - WSJ World News: https://www.wsj.com/world/europe/drone-attacks-on-ships-sailing-near-nato-waters-present-fresh-test-for-the-alliance-e36c333d?mod=rss_worldnews - FT World: https://www.ft.com/content/c6bd25b8-ef9e-41a3-90d2-29c132e10ec2?syn-25a6b1a6=1 - FT World: https://www.ft.com/content/da00e3ff-4392-46d8-bab5-13b4ccc49995?syn-25a6b1a6=1 * Iran's Attacks on Hormuz Shipping Reach a Wartime Peak Latest developments: The Financial Times reported Tuesday, October 13, that Iran has struck 24 tankers and other vessels in and around the Strait of Hormuz in two weeks, six of them on Sunday alone, the heaviest spate since the war began, while OPEC again trimmed its forecast for this year's oil demand growth. Saudi Arabia says its September crude output reached the highest level since the conflict started, and the renewed attacks on shipping this month put that recovery at risk. Oil prices fell Tuesday after three sessions of gains as traders weighed Persian Gulf supply risk against the Russian diesel President Trump has promised to bring to market, leaving insurers, charterers, and refiners exposed to a sudden halt in Gulf flows. - FT World: https://www.ft.com/content/a4ab83d4-81b5-4336-9569-a0708b41e894?syn-25a6b1a6=1 - FT World: https://www.ft.com/content/e4c33601-88e9-43fc-b920-1cecc2709dbd?syn-25a6b1a6=1 - WSJ World News: https://www.wsj.com/world/middle-east/oil-prices-fall-as-traders-weigh-middle-east-risks-russian-diesel-supplies-53840a01?mod=rss_worldnews - WSJ US Business: https://www.wsj.com/business/energy-oil/opec-cuts-demand-growth-forecast-again-as-gulf-supply-risks-mount-848d73a3?mod=pls_whats_news_us_business_f * The AI Trade Cracks Again Latest developments: Broadcom's chief executive called the artificial intelligence spending race a "casino," and chip stocks slid worldwide Tuesday, October 13, with Nasdaq futures falling sharply. Samsung Electronics and SK Hynix dropped hard enough to drag South Korea's Kospi sharply lower, and Asian and European technology shares followed as investors questioned the scale of AI capital spending and the pace of Chinese competition. Treasury yields eased partly because money left those shares, which ties the bond market's relief to the equity market's doubt. - FT Home: https://www.ft.com/content/e16f0422-cf75-4cc9-962d-4605e421dc63?syn-25a6b1a6=1 - WSJ Markets: https://www.wsj.com/finance/stocks/nasdaq-futures-fall-as-global-ai-selloff-intensifies-fe149717?mod=rss_markets_main - WSJ Markets: https://www.wsj.com/finance/stocks/asian-stocks-battered-as-geopolitical-tensions-sap-risk-appetite-5b3ebd81?mod=rss_markets_main * European Gas Reaches a Four-Year High Latest developments: European natural gas prices climbed Tuesday, October 13, to their highest level since December 2022. Escalating attacks in the Middle East threaten Persian Gulf liquefied natural gas cargoes just as European storage sits unusually low for the season, and the standoff between Washington and Kyiv over Russian diesel supplies compounds the squeeze. A global scramble for LNG raises industrial and household energy costs across the continent through the winter. - WSJ Markets: https://www.wsj.com/finance/commodities-futures/europe-heads-into-winter-with-low-gas-reserves-uncertain-gulf-supplies-78cd3507?mod=rss_markets_main - WSJ Markets: https://www.wsj.com/finance/commodities-futures/european-gas-prices-at-highest-since-late-2022-on-winter-supply-concerns-08c3ad4d?mod=rss_markets_main - FT World: https://www.ft.com/content/787acc7e-f0d3-4552-a369-4b4c967e4ca5?syn-25a6b1a6=1 * Bond Stress Shifts to the Short End Latest developments: The 10-year Treasury yield fell 5.5 basis points to 5.189% Tuesday, October 13, well below last week's 24-year high, while the Financial Times reported that rising Treasury bill issuance now pressures short-term lending rates and the International Monetary Fund sounded an alarm over governments' public finances. Lower oil prices and the pullback in AI shares pulled Treasury and eurozone yields down ahead of United States inflation data, and record inflows into government bond funds show investors locking in the highest borrowing costs in decades. Strain migrating from the long end to money markets complicates the Federal Reserve's control of short-term rates. - WSJ Markets: https://www.wsj.com/economy/central-banking/treasury-eurozone-yields-fall-as-markets-look-to-u-s-inflation-data-412d95a4?mod=rss_markets_main - FT World: https://www.ft.com/content/f5ca22c7-8340-4189-8c40-224a1e16c5ef - FT Home: https://www.ft.com/content/6fa735a2-a590-4461-b092-920ba489e7a8?syn-25a6b1a6=1 - FT World: https://www.ft.com/content/e03b74a1-6f7f-4f2c-ad39-c70b8e63ae39?syn-25a6b1a6=1 * JPMorgan Misses as Trading Revenue Falls Latest developments: JPMorgan Chase, Goldman Sachs, Wells Fargo, and Citigroup all reported third-quarter results Tuesday, October 13: JPMorgan's profit rose from a year earlier yet landed below expectations on weaker bond trading and its shares fell, Wells Fargo's revenue disappointed, Goldman's equities desks carried net income 30% higher, and executives across Wall Street played down investor fears that the trading boom has peaked. The results open a mixed Wall Street earnings season in which fixed-income desks, the engine of a record second quarter built on volatility, gave way while stock trading held up. Because bond trading drove much of the industry's recent profit growth, the split reshapes revenue guidance across the largest United States banks. - FT Home: https://www.ft.com/content/56f4a46e-3ae5-4aea-8cf3-71506b286091 - WSJ Markets: https://www.wsj.com/livecoverage/stock-market-today-bank-earnings-10-13-2026?mod=rss_markets_main - WSJ Markets: https://www.wsj.com/finance/banking/jpmorgan-goldman-profit-jumps-as-banks-kick-off-earnings-3e78b37d?mod=rss_markets_main - FT Home: https://www.ft.com/content/bd1f3385-1985-4a8a-a781-22cbe1292d2d?syn-25a6b1a6=1 PITTSBURGH ---------------------------------------------------------------- Weather: This Afternoon: Sunny, high 82F. Tonight: Mostly Clear, low 65F. Wednesday: Showers And Thunderstorms Likely, high 78F. Business: * Loews Signs On for a Convention Center Hotel Latest developments: State officials announced that Loews Hotels has signed a letter of intent to build a hotel at the David L. Lawrence Convention Center downtown, Pittsburgh Magazine reported Tuesday, October 13. The luxury brand's hotel would sit closer to the convention center's halls than any property that serves it today, giving groups that book the center rooms within a walk. Pittsburgh's convention and hospitality business has pushed for attached lodging for years. - Pittsburgh Magazine: https://www.pittsburghmagazine.com/david-l-lawrence-convention-center-hotel/ * Sierra Opens Two Allegheny County Stores Latest developments: TribLive reported Tuesday, October 13, that the discount outdoor retailer Sierra will open two locations in Allegheny County, its first stores in southwestern Pennsylvania. Sierra sells off-price outdoor and athletic gear and has had no store in the Pittsburgh region until now. The two openings put the chain into a retail market where big-box apparel space has turned over steadily. - TribLive: https://triblive.com/local/north-hills/2-sierra-discount-outdoor-stores-are-coming-to-pittsburgh-area/ * Breeze Airways Takes the Latrobe Gates Latest developments: Breeze Airways announced Tuesday, October 13, that it will fly out of Arnold Palmer Regional Airport in Latrobe, with service to Myrtle Beach, South Carolina, starting in February and Orlando, Florida, in May; the Westmoreland County airport authority approved the carrier's plan the same day the new terminal opened to the public. Westmoreland County's airport has had no commercial passenger service since Spirit Airlines folded in May, and the low-cost carrier's arrival answers the question county officials left open when they unveiled the terminal. Breeze gives travelers in the Alle-Kiski and Laurel Highlands corridor an alternative to driving to Pittsburgh International Airport. - KDKA: https://www.cbsnews.com/pittsburgh/news/breeze-airways-arnold-palmer-regional-airport-myrtle-beach-orlando/ - WPXI: https://www.wpxi.com/news/local/breeze-airways-coming-arnold-palmer-regional-airport-latrobe/27QTE5CMH5ACJPESDF3UI5UGOE/ - WTAE: https://www.wtae.com/article/arnold-palmer-regional-airport-breeze-airways/74112280 - TribLive: https://triblive.com/local/westmoreland/airport-authority-approves-breeze-airways-plan-for-passenger-service-at-westmoreland-airport/ * Mothers Press the Magee Board on Nurse Staffing Latest developments: WTAE reported Tuesday, October 13, that mothers who delivered at UPMC Magee-Womens Hospital asked the hospital's board to fix nurse staffing levels while contract talks with the newly organized nurses union continue. The women told WTAE that thin staffing is driving nurses out of the profession at the Oakland hospital, which handles more births than any other in Western Pennsylvania. Their appeal lands in the middle of first-contract bargaining between UPMC and the Magee nurses who voted to unionize. - WTAE: https://www.wtae.com/article/pittsburgh-magee-womens-hospital-nurse-staffing-concerns/74112145 * Dining Out Gets Expensive on Both Sides of the Table Latest developments: The Post-Gazette reported Tuesday, October 13, that Pittsburgh restaurant owners describe profitability as down quite a bit while customers absorb higher menu prices. Rising food, labor, and occupancy costs have narrowed margins across Pittsburgh restaurants, and operators tell the Post-Gazette they pass only part of the increase to diners. The squeeze bears on one of the region's larger employers of hourly workers. - Pittsburgh Post-Gazette: https://www.post-gazette.com/life/dining/2026/10/13/pittsburgh-restaurants-cost/stories/202610080055 * Verizon Retires Its Copper Lines Latest developments: Verizon told TribLive on Tuesday, October 13, that its copper landline phaseout will not disconnect customers. Michele Vanetta, who has lived in Jeannette her whole life and kept the same number for nearly 40 years at her current house, is among the Westmoreland County customers whose service moves off copper. Verizon says it will carry those lines onto replacement technology rather than cut them. - TribLive: https://triblive.com/local/westmoreland/phone-home-copper-landline-phaseouts-wont-disconnect-customers-verizon-says/ * Shorty's, Apteka, and Northside Sandwich Week Latest developments: Pittsburgh City Paper's weekly food column, published Tuesday, October 13, carries updates on Shorty's Social Kitchen, New Amsterdam, Apteka, Northside Sandwich Week, and a new Sheetz meat line. The column tracks openings, menu changes, and fall cocktail programs across Pittsburgh restaurants and bars, with Northside Sandwich Week giving North Side shops a week of promotion. Readers get the week's operating news on independent kitchens in one place. - Pittsburgh City Paper: https://www.pghcitypaper.com/food-drink/sheetz-meatz-north-side-sandwiches-fall-cocktails-and-more-pittsburgh-food-news/ Around town: * PennDOT Closes Commercial Street and Forward Avenue Latest developments: WPXI reported Tuesday, October 13, that the Pennsylvania Department of Transportation will close Commercial Street and Forward Avenue, along with the Nine Mile Run Trail, starting Friday evening, October 16, for paving. The closure takes a main route between Pittsburgh's East End neighborhoods and the Parkway East out of service while crews lay new surface, and it shuts the adjoining Nine Mile Run Trail to walkers and cyclists. Drivers and trail users need another path for the duration of the work. - WPXI: https://www.wpxi.com/news/local/commercial-streetforward-avenue-close-paving-operations/A6OUWJCPIJGLFNCXKIVWOASVBI/ * PittsBirds Land Along the University Line Latest developments: Pittsburgh Magazine reported Tuesday, October 13, on PittsBirds, the city public art project installing 20 bird-inspired artworks along Pittsburgh Regional Transit's new University Line. The city has wrapped traffic signal control boxes and other infrastructure along the bus rapid transit route with the pieces, which the project describes as a visual thread tying the corridor together. The University Line runs between downtown Pittsburgh and Oakland. - Pittsburgh Magazine: https://www.pittsburghmagazine.com/pittsbird-art-installations-2026-university-line/ * Craig's Closet Opens at Perry High School Latest developments: KDKA's Jessica Riley reported Tuesday, October 13, that Steelers defensive tackle Cam Heyward brought his Craig's Closet initiative to Perry High School, debuting a space that outfits students for interviews, ceremonies, and other milestones. Heyward and his team built the room inside the Pittsburgh Public Schools high school so students can pick out clothing at no cost for life's bigger moments. The initiative carries the name of Heyward's late father, Craig Heyward. - KDKA: https://www.cbsnews.com/pittsburgh/video/cam-heyward-brings-craigs-closet-initiative-to-perry-high-school/ * Deluzio and Guy Debate on KDKA+ Latest developments: KDKA reported Tuesday, October 13, that United States Representative Chris Deluzio, a Democrat, and his Republican challenger, Tony Guy, meet in a televised debate on KDKA+ on Tuesday. The two candidates for the Western Pennsylvania congressional seat take questions three weeks before the November 3 election. KDKA is carrying the debate on its KDKA+ channel and streaming platform. - KDKA: https://www.cbsnews.com/pittsburgh/news/chris-deluzio-tony-guy-televised-debate/ * Penn-Trafford Weighs Closing McCullough Elementary Latest developments: TribLive laid out the Penn-Trafford School Board's consolidation plan Tuesday, October 13, along with what parents say about it. The board would close McCullough Elementary School, the Westmoreland County district's oldest building, and redistribute grade levels among the schools that remain. Parents have pushed back on the shifts the plan would force on their children's buildings and bus routes. - TribLive: https://triblive.com/local/westmoreland/why-penn-trafford-is-considering-closing-its-oldest-school-building-and-what-parents-are-saying/ * A Voter Guide to 17 Legislative Races Latest developments: PublicSource published its 2026 voter guide Tuesday, October 13, three weeks before the November 3 election. The guide covers 17 contested legislative races in Allegheny County and prints candidates' answers on Immigration and Customs Enforcement activity, the war, and data center development, the issues readers flagged. Those three subjects have driven the fall campaign across Western Pennsylvania. - PublicSource: https://www.publicsource.org/pittsburgh-voter-guide-2026-midterms/ * Rachel Carson EcoVillage Shows Progress Latest developments: TribLive reported Tuesday, October 13, that work has resumed at the Rachel Carson EcoVillage site in McCandless after roughly a year of inactivity. Backers of the cohousing community, planned around shared space and low-energy construction in McCandless, say obstacles left the property largely undeveloped for about a year and the project still moves forward. The site sits in one of the North Hills municipalities fielding the most new residential proposals. - TribLive: https://triblive.com/local/after-lengthy-delay-signs-of-progress-appear-at-rachel-carson-ecovillage-site-in-mccandless/ * Warm Tuesday, Then Two Impact Days Latest developments: WTAE's Tuesday update, October 13, keeps the day warm and breezy and tags Wednesday, October 14, an Impact Day for rain, with a second Impact Day behind it; WPXI has southwest wind gusting 20 to 25 mph pushing highs near 80 degrees, and KDKA calls Tuesday's warmth likely the year's last run at that mark. Pittsburgh starts Tuesday under patchy fog and mist before afternoon sun, with lows in the 60s overnight, and rain arrives with the next front Wednesday. Temperatures drop sharply through the week behind the system. - WTAE: https://www.wtae.com/article/warm-breezy-today-impact-day-with-rain-wednesday/74116549 - WTAE: https://www.wtae.com/article/patchy-am-fogmist-for-the-am-commute/74105299 - KDKA: https://www.cbsnews.com/pittsburgh/news/high-temperatures-in-the-pittsburgh-area-will-be-near-80-degrees-today/ - WPXI: https://www.wpxi.com/weather/sunny-breezy-with-wind-that-will-push-highs-around-80-degrees/ACR43LCZABAABCGVCQTLGRMPDI/ Events: * The Pittsburgh Walk of Fame Inducts Its Second Class Latest developments: The Pittsburgh Walk of Fame added 10 inductees at a ceremony in the Strip District on Tuesday, October 13, among them Mario Lemieux, Franco Harris, Myron Cope, Jimmy Stewart, and H.J. Heinz, and Lemieux told the crowd he fell in love with the city when he arrived 42 years ago. The Walk of Fame, laid into the sidewalks of the Strip District, honors Pittsburghers who made a mark nationally and began with an inaugural class last year. WPXI and KDKA carried the induction live. - KDKA: https://www.cbsnews.com/pittsburgh/news/pittsburgh-walk-of-fame-second-class-inductees-ceremony/ - WTAE: https://www.wtae.com/article/pittsburgh-walk-of-fame-10-new-inductees/74119740 * Glass Pumpkins at the Pittsburgh Glass Center Latest developments: Pittsburgh Magazine's weekend guide, published Tuesday, October 13, leads with Halloween Make-It-Now on Saturday, October 17, at the Pittsburgh Glass Center. Visitors make their own glass pumpkin in a color of their choosing with a local artist's help, and the Make-It-Now format also offers short tries at glassblowing, flameworking, and fusing, with activities starting at about 20 minutes. Pittsburgh Magazine lists no ticket price. - Pittsburgh Magazine: https://www.pittsburghmagazine.com/things-to-do-this-weekend-in-pittsburgh/ * Joe Manganiello Publishes "Bloodlines" Latest developments: The Post-Gazette reviewed Joe Manganiello's memoir "Bloodlines" on Tuesday, October 13, and ran a companion interview the same day. The Mount Lebanon native and actor opens the book at death's door and closes it in Pittsburgh, where he grew up; the interview covers the Dungeons & Dragons work he calls his dream job. The Post-Gazette treats the memoir as a Pittsburgh story first. - Post-Gazette Arts & Entertainment: https://www.post-gazette.com/ae/books/2026/10/13/review-joe-manganiello-bloodlines/stories/202610130002 - Post-Gazette Arts & Entertainment: https://www.post-gazette.com/ae/books/2026/10/13/joe-manganiello-pittsburgh-dungeons-and-dragons/stories/202610130004 * McCandless Holds Its First Restaurant Week Latest developments: WPXI reported Tuesday, October 13, that McCandless's first-ever Restaurant Week is underway. Restaurants across McCandless, the North Hills municipality along McKnight Road, are taking part in the community's inaugural Restaurant Week promotion. WPXI gave no closing date or participant list. - WPXI: https://www.wpxi.com/news/local/communitys-first-ever-restaurant-week-kicks-off-mccandless/6ODTTEYNBBAUXFCZJZE66HHFQM/ SPORTS ---------------------------------------------------------------- Steelers (3-2) Up Next · Steelers @ Buccaneers · Sun Oct 18, 1:00 PM https://plaintextsports.com/nfl/2026/week6/pit-tb Penguins (3-2) Up Next · Penguins @ Blackhawks · Tue Oct 13, 8:00 PM https://plaintextsports.com/nhl/2026-10-13/pit-chi Around the Teams: * Rodgers Grades Out Elite at Indianapolis Latest developments: The Post-Gazette published its Week 5 Steelers player grades Tuesday, October 13, rating quarterback Aaron Rodgers and six other players elite for the game at the Indianapolis Colts. The grade sheet marks every Steelers player's performance from the trip to Indianapolis, with Rodgers heading a group of seven the paper rated at the top of its scale. It follows the paper's report card, which gave running back Jaylen Warren an A-plus. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/10/13/nfl-player-grades-colts-week5/stories/202610130030 * Ranking All 41 Pirates by Their Odds of Returning Latest developments: The Post-Gazette ranked all 41 players on the Pittsburgh Pirates' roster Tuesday, October 13, by the likelihood each comes back for 2027. The list runs from Konnor at the near-certain end to Kirby at the other and frames the arbitration, option, and roster-crunch calls general manager Ben Cherington's front office faces this winter. It arrives as the club's offseason decisions begin after a minor-league season the paper graded a success. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/10/13/pirates-2027-roster-mlb-offseason/stories/202610130020 * McCarthy Turns to Tampa Bay Latest developments: The Steelers posted head coach Mike McCarthy's Monday, October 12, news conference previewing Week 6 at the Tampa Bay Buccaneers, set for Sunday, October 18, at 1 p.m. Eastern on CBS. Linebackers Nick Herbig and Patrick Queen and guard Mason McCormick took the podium the same day on the team's YouTube channel. The Buccaneers trip follows a four-game stretch that has cost Pittsburgh receivers and defensive backs to injury. - Pittsburgh Steelers (YouTube): https://www.youtube.com/watch?v=eS6kQD9tk6Y - Pittsburgh Steelers (YouTube): https://www.youtube.com/watch?v=pkSwnylL9y4 * SNR Drive Takes a Victory Monday Latest developments: Matt Williamson and Wes Uhler spent Monday's SNR Drive, October 12, on the Steelers' Week 5 win over the Indianapolis Colts, with Rob King, the voice of the Steelers, calling in. The team-produced show worked through the game, the rest of the Week 5 NFL slate, and a segment the hosts labeled "winning is better than losing." The hosts note their opinions belong to them rather than the franchise. - Pittsburgh Steelers (YouTube): https://www.youtube.com/watch?v=XQa_pkGnb6I READING ---------------------------------------------------------------- * Ed Zitron -- Annualized Enron Rate Zitron attacks the annualized revenue run rates that artificial intelligence companies quote to investors, arguing the metric flatters unprofitable businesses and invites comparison with Enron-era accounting. https://www.wheresyoured.at/annualized-enron-rate/ * Stratechery -- SpaceX Buys More Spectrum, Musk and Market Structure, Distributed Cellular Ben Thompson argues that SpaceX's latest spectrum purchase clarifies a mobile strategy built on distributed cellular service from orbit, and that the approach has a real chance of working against incumbent carriers. https://stratechery.com/2026/spacex-buys-more-spectrum-musk-and-market-structure-distributed-cellular/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,800.97 ▲ +1.3% Dow 51,487.66 ▲ +0.7% Nasdaq 27,388.78 ▲ +1.3% WTI crude 90.96 ▲ +0.4% EUR/USD 1.1228 ▼ -0.9% GBP/USD 1.3234 = -0.0% USD/JPY 158.02 ▲ +0.3% FEED HEALTH ---------------------------------------------------------------- Security: 24 of 24 feeds loaded, 55 items in the 24-hour window. No recent items: Krebs on Security, Schneier on Security, Ars Technica Security, Securelist (Kaspersky), Unit 42 (Palo Alto), Google Online Security Blog, Cisco Talos, Microsoft Security Blog, Google Project Zero, The DFIR Report, Frank on Fraud, Wired Security. Pittsburgh: 9 of 9 feeds loaded, 60 items in the 48-hour window. Business and Politics: 8 of 8 feeds loaded, 60 items in the 36-hour window. Events: 4 of 4 feeds loaded, 9 items in the 120-hour window. No recent items: NEXTpittsburgh Events, NEXTpittsburgh Arts & Entertainment. Sports media: 6 of 6 feeds loaded, 30 items in the 96-hour window. No recent items: Footbahlin with Ben Roethlisberger, Ben Roethlisberger / Channel Seven (YouTube). Team USA: 3 of 3 feeds loaded, 20 items in the 72-hour window. No recent items: Guardian Olympics. Reading: 3 of 3 feeds loaded, 12 items in the 336-hour window. No recent items: Cal Newport. Markets (Yahoo Finance): 7 of 7 rows Weather (NWS): 3 forecast periods Scores (ESPN, plaintextsports): 2 teams via ESPN Summaries: 3 model call(s) served by claude-opus-5 (399s of model time; $2.12 at API list price). ================================================================ Generated 2026-10-13 13:37 EDT. Updated weekdays at about 7:05 AM, 10:05 AM, 1:35 PM, and 7:35 PM ET, and weekends at about 8:05 AM and 7:35 PM ET. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 3 Team USA feeds; WSJ World News, WSJ Markets, WSJ US Business, WSJ Politics, The Economist, FT Home, FT World, FT Markets; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN or plaintextsports.com. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================