daily plain-text briefing: security, markets, business, and pittsburgh
Prosecutors charged two alleged TeamPCP operators over the Shai-Hulud supply-chain worm as maximum-severity flaws hit ServiceNow, WordPress, and cPanel.
Latest developments: Wordfence and Patchstack disclosed five critical flaws across the WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP, topped by authentication-bypass bug CVE-2026-76581 at CVSS 9.8, while cPanel patched CVE-2026-65643, which lets a single hosting customer seize root on the whole server.
The WordPress bugs enable authentication bypass, account takeover, and arbitrary code execution on affected sites. The cPanel flaw touches all supported versions of cPanel and WHM through domain-parking and addon-domain features, turning one tenant into root over every site on a shared server.
Sources: The Hacker News · The Hacker News · BleepingComputer · ↑ top
Latest developments: Authorities arrested and charged two alleged members of the hacking group TeamPCP, tying them to the self-propagating Shai-Hulud worm that infected more than 1,000 organizations, harvested 500,000 credentials, and reached OpenAI.
TeamPCP ran a relentless supply-chain campaign whose Shai-Hulud worm, named for the Dune sandworm, spread automatically to steal credentials from victims worldwide. The charges mark the first named suspects in a spree that hit OpenAI and thousands of other targets.
Sources: Ars Technica Security · Graham Cluley · ↑ top
Latest developments: ServiceNow patched four flaws in its AI Platform, three rated a perfect 10.0, that let an unauthenticated attacker run code, inject SQL, and escalate privileges in certain configurations.
ServiceNow pushed the fix to its hosted instances and handed it to partners and self-hosted customers, who now carry the burden of patching. Organizations running the platform on their own infrastructure face unauthenticated code and SQL execution until they apply the update.
Sources: The Hacker News · BleepingComputer · ↑ top
Latest developments: Google announced that Android 17 will carry system-wide Encrypted Client Hello, hiding the domain names of sites a user visits from network operators and eavesdroppers, alongside new cellular and home-network privacy defenses.
ECH closes a gap that leaves visited domains visible even over HTTPS, blocking the profiling and tracking that carriers and snoops build from that data. The batch also hardens Android against Wi-Fi tracking and cellular vulnerabilities.
Sources: The Hacker News · Help Net Security · ↑ top
Latest developments: Recorded Future's Insikt Group tied a previously undocumented backdoor called HOOKEDGE, a lightweight Windows batch script, to Russia's APT28 in campaigns against government and diplomatic organizations in Romania, Spain, and Türkiye from late September 2025 through early April 2026.
HOOKEDGE arrives through targeted delivery and gives APT28 persistent access to foreign ministries and government networks. The disclosure extends the group's long-running espionage push across European Union member states.
Sources: The Hacker News · ↑ top
Latest developments: Huntress investigations identified suspected North Korean remote workers hired into sales, marketing, and medical roles, broadening a fraud scheme that once centered on information-technology jobs.
DPRK operatives trick companies into hiring them under false identities and often perform the work, funneling wages back to the regime. The widening job range strains detection, since defenders can no longer watch only technical hires.
Sources: Help Net Security · ↑ top
Latest developments: Venezuela's opposition and Maduro-government hardliners both denounced the pact on August 29, the opposition calling it potentially illegal and loyalists casting it as a betrayal, while the White House offered no detail beyond Trump's social-media post.
President Trump's announced joint venture would hand the United States control of much of Venezuela's proven reserves—roughly 65 billion barrels, about a fifth of the country's oil—which he says will lower American gasoline prices; analysts warn the arrangement gives Washington and Caracas a shared reason to forestall a democratic transition.
Sources: FT · The Economist · ↑ top
Latest developments: Federal Reserve Chair Kevin Warsh's Jackson Hole address, parsed in Saturday takeaways August 29, raised the stakes for the central bank's next meeting and set him on a collision course with President Trump, who wants lower borrowing costs before the November midterms.
Warsh used the Kansas City Fed's symposium to renew his inflation-fighting credentials and chart a forward-looking approach signaling that rates may rise in coming months, a shift markets read as putting a September increase in play.
Tonight: Partly Cloudy, low 65F.
Sunday: Mostly Sunny, high 88F.
Sunday Night: Mostly Cloudy then Slight Chance Rain Showers, low 69F.
Latest developments: Robert Wholey & Co. ran its eighth annual lobster grab on August 29.
Wholey's Market, the seafood institution anchoring Pittsburgh's Strip District, held its eighth annual lobster grab, a recurring promotion that pulls crowds into the historic fishmonger.
Sources: Pittsburgh Post-Gazette · ↑ top
Latest developments: The Ligonier Valley School District will shut all its buildings starting Monday, August 31, to begin mold remediation, widening a problem that had already closed three classrooms at R.K. Mellon Elementary.
The Westmoreland County district, which serves Ligonier and surrounding communities, said positive mold tests forced the closure of every building for cleanup, disrupting the opening weeks of the school year.
Latest developments: A large water main break early Saturday, August 29, sent water across two streets in Baldwin Borough, damaging homes, with a contractor helping affected residents.
The break in Baldwin Borough, in Allegheny County's South Hills, flooded a roadway and several homes before crews and a contractor responded.
Latest developments: A poll reported August 29 found John Fetterman's support among Pennsylvania Democrats sliding further even as his backing among Republicans rose.
Fetterman, elected Pennsylvania's junior U.S. senator in 2022, has watched his standing with the state's Democratic base steadily deteriorate, a rift the latest Post-Gazette survey widens.
Sources: Pittsburgh Post-Gazette · ↑ top
Latest developments: ESPN's Adam Schefter reported August 29 that the Steelers dealt offensive tackle Broderick Jones and a fourth-round pick to the Dallas Cowboys for third- and sixth-round picks.
Jones, 25, the Steelers' 2023 first-round pick—14th overall out of Georgia—made 38 career starts and had recently landed on injured reserve, and Pittsburgh moved the former top pick as it settled its offensive line for the season.
Sources: Post-Gazette Steelers · ↑ top
Latest developments: The Pirates said August 29 that rookie shortstop Konnor Griffin will begin a rehab assignment with Double-A Altoona on Sunday, August 30.
Griffin, the Pirates' top prospect, takes the first step toward a return as the club's offense sputters through the second half of the season.
Sources: Post-Gazette Pirates · ↑ top
Latest developments: A Post-Gazette feature published August 29 examined why general manager Omar Khan and the Steelers keep drafting and signing Iowa Hawkeyes.
The piece traces Pittsburgh's pipeline from Iowa City—defensive lineman Yahya Black and lineman Gennings Dunker among them—arguing the Hawkeyes' pro-style development and toughness match the Steelers' identity beyond the shared black and gold.
Sources: Post-Gazette Steelers · ↑ top
S&P 500 7,689.72 = -0.0% Dow 53,517.57 ▲ +0.5% Nasdaq 26,241.09 ▼ -0.2% WTI crude 84.04 ▼ -1.2% EUR/USD 1.1648 ▲ +0.1% GBP/USD 1.3603 = +0.0% USD/JPY 159.40 ▲ +0.3%