infosecfollow

daily plain-text briefing: security, markets, business, and pittsburgh

Prosecutors charged two alleged TeamPCP operators over the Shai-Hulud supply-chain worm as maximum-severity flaws hit ServiceNow, WordPress, and cPanel.


Emerging Trends and Key Updates

Security

1. Critical WordPress and cPanel Server Flaws

Vulnerabilities and Exploits · [patch, rce, wordpress]

Latest developments: Wordfence and Patchstack disclosed five critical flaws across the WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP, topped by authentication-bypass bug CVE-2026-76581 at CVSS 9.8, while cPanel patched CVE-2026-65643, which lets a single hosting customer seize root on the whole server.

read more

The WordPress bugs enable authentication bypass, account takeover, and arbitrary code execution on affected sites. The cPanel flaw touches all supported versions of cPanel and WHM through domain-parking and addon-domain features, turning one tenant into root over every site on a shared server.

Sources: The Hacker News · The Hacker News · BleepingComputer · ↑ top

2. TeamPCP Members Charged Over Shai-Hulud Worm

Ransomware and Cybercrime · [supply-chain, arrest, worm]

Latest developments: Authorities arrested and charged two alleged members of the hacking group TeamPCP, tying them to the self-propagating Shai-Hulud worm that infected more than 1,000 organizations, harvested 500,000 credentials, and reached OpenAI.

read more

TeamPCP ran a relentless supply-chain campaign whose Shai-Hulud worm, named for the Dune sandworm, spread automatically to steal credentials from victims worldwide. The charges mark the first named suspects in a spree that hit OpenAI and thousands of other targets.

Sources: Ars Technica Security · Graham Cluley · ↑ top

3. Three CVSS 10.0 Flaws Hit ServiceNow AI Platform

Vulnerabilities and Exploits · [patch, rce, sql-injection]

Latest developments: ServiceNow patched four flaws in its AI Platform, three rated a perfect 10.0, that let an unauthenticated attacker run code, inject SQL, and escalate privileges in certain configurations.

read more

ServiceNow pushed the fix to its hosted instances and handed it to partners and self-hosted customers, who now carry the burden of patching. Organizations running the platform on their own infrastructure face unauthenticated code and SQL execution until they apply the update.

Sources: The Hacker News · BleepingComputer · ↑ top

4. Android 17 Adds OS-Wide Encrypted Client Hello

Data Privacy · [privacy, mobile, encryption]

Latest developments: Google announced that Android 17 will carry system-wide Encrypted Client Hello, hiding the domain names of sites a user visits from network operators and eavesdroppers, alongside new cellular and home-network privacy defenses.

read more

ECH closes a gap that leaves visited domains visible even over HTTPS, blocking the profiling and tracking that carriers and snoops build from that data. The batch also hardens Android against Wi-Fi tracking and cellular vulnerabilities.

Sources: The Hacker News · Help Net Security · ↑ top

5. APT28 HOOKEDGE Backdoor Hits European Governments

Nation-State Activity · [apt, espionage, backdoor]

Latest developments: Recorded Future's Insikt Group tied a previously undocumented backdoor called HOOKEDGE, a lightweight Windows batch script, to Russia's APT28 in campaigns against government and diplomatic organizations in Romania, Spain, and Türkiye from late September 2025 through early April 2026.

read more

HOOKEDGE arrives through targeted delivery and gives APT28 persistent access to foreign ministries and government networks. The disclosure extends the group's long-running espionage push across European Union member states.

Sources: The Hacker News · ↑ top

6. North Korean Workers Expand Beyond IT

Nation-State Activity · [apt, fraud, insider]

Latest developments: Huntress investigations identified suspected North Korean remote workers hired into sales, marketing, and medical roles, broadening a fraud scheme that once centered on information-technology jobs.

read more

DPRK operatives trick companies into hiring them under false identities and often perform the work, funneling wages back to the regime. The widening job range strains detection, since defenders can no longer watch only technical hires.

Sources: Help Net Security · ↑ top

Business and Politics

U.S.-Venezuela Oil Deal Draws Fire at Home and Abroad

Latest developments: Venezuela's opposition and Maduro-government hardliners both denounced the pact on August 29, the opposition calling it potentially illegal and loyalists casting it as a betrayal, while the White House offered no detail beyond Trump's social-media post.

read more

President Trump's announced joint venture would hand the United States control of much of Venezuela's proven reserves—roughly 65 billion barrels, about a fifth of the country's oil—which he says will lower American gasoline prices; analysts warn the arrangement gives Washington and Caracas a shared reason to forestall a democratic transition.

Sources: FT · The Economist · ↑ top

Warsh Opens Door to Rate Hikes at Jackson Hole

Latest developments: Federal Reserve Chair Kevin Warsh's Jackson Hole address, parsed in Saturday takeaways August 29, raised the stakes for the central bank's next meeting and set him on a collision course with President Trump, who wants lower borrowing costs before the November midterms.

read more

Warsh used the Kansas City Fed's symposium to renew his inflation-fighting credentials and chart a forward-looking approach signaling that rates may rise in coming months, a shift markets read as putting a September increase in play.

Sources: FT · FT · ↑ top

Pittsburgh

Weather

Tonight: Partly Cloudy, low 65F.

Sunday: Mostly Sunny, high 88F.

Sunday Night: Mostly Cloudy then Slight Chance Rain Showers, low 69F.

Business

Wholey's Holds 8th Annual Lobster Grab

Latest developments: Robert Wholey & Co. ran its eighth annual lobster grab on August 29.

read more

Wholey's Market, the seafood institution anchoring Pittsburgh's Strip District, held its eighth annual lobster grab, a recurring promotion that pulls crowds into the historic fishmonger.

Sources: Pittsburgh Post-Gazette · ↑ top

Around Town

Ligonier Valley Closes Every School for Mold

Latest developments: The Ligonier Valley School District will shut all its buildings starting Monday, August 31, to begin mold remediation, widening a problem that had already closed three classrooms at R.K. Mellon Elementary.

read more

The Westmoreland County district, which serves Ligonier and surrounding communities, said positive mold tests forced the closure of every building for cleanup, disrupting the opening weeks of the school year.

Sources: WTAE · ↑ top

Water Main Break Floods Baldwin Homes

Latest developments: A large water main break early Saturday, August 29, sent water across two streets in Baldwin Borough, damaging homes, with a contractor helping affected residents.

read more

The break in Baldwin Borough, in Allegheny County's South Hills, flooded a roadway and several homes before crews and a contractor responded.

Sources: WTAE · WPXI · ↑ top

Poll Shows Fetterman Losing Pennsylvania Democrats

Latest developments: A poll reported August 29 found John Fetterman's support among Pennsylvania Democrats sliding further even as his backing among Republicans rose.

read more

Fetterman, elected Pennsylvania's junior U.S. senator in 2022, has watched his standing with the state's Democratic base steadily deteriorate, a rift the latest Post-Gazette survey widens.

Sources: Pittsburgh Post-Gazette · ↑ top

Sports

Around the Teams

Steelers Trade Broderick Jones to Cowboys

Latest developments: ESPN's Adam Schefter reported August 29 that the Steelers dealt offensive tackle Broderick Jones and a fourth-round pick to the Dallas Cowboys for third- and sixth-round picks.

read more

Jones, 25, the Steelers' 2023 first-round pick—14th overall out of Georgia—made 38 career starts and had recently landed on injured reserve, and Pittsburgh moved the former top pick as it settled its offensive line for the season.

Sources: Post-Gazette Steelers · ↑ top

Konnor Griffin Starts Rehab Assignment

Latest developments: The Pirates said August 29 that rookie shortstop Konnor Griffin will begin a rehab assignment with Double-A Altoona on Sunday, August 30.

read more

Griffin, the Pirates' top prospect, takes the first step toward a return as the club's offense sputters through the second half of the season.

Sources: Post-Gazette Pirates · ↑ top

Steelers' Pull Toward Iowa Players

Latest developments: A Post-Gazette feature published August 29 examined why general manager Omar Khan and the Steelers keep drafting and signing Iowa Hawkeyes.

read more

The piece traces Pittsburgh's pipeline from Iowa City—defensive lineman Yahya Black and lineman Gennings Dunker among them—arguing the Hawkeyes' pro-style development and toughness match the Steelers' identity beyond the shared black and gold.

Sources: Post-Gazette Steelers · ↑ top

Reading

Markets

weekly average, change vs prior week

S&P 500     7,689.72  = -0.0%
Dow        53,517.57  ▲ +0.5%
Nasdaq     26,241.09  ▼ -0.2%
WTI crude      84.04  ▼ -1.2%
EUR/USD       1.1648  ▲ +0.1%
GBP/USD       1.3603  = +0.0%
USD/JPY       159.40  ▲ +0.3%