Criminals have picked up the AI attack frameworks state crews pioneered, with Microsoft catching the financially motivated Storm-3358 driving ARTEX at banks while researchers count 1,122 public repositories leaking secrets through Claude Code.
Emerging Trends and Key Updates
- Trend Microsoft's Storm-3358 turned the ARTEX agentic framework on banks while Apiiro found Claude Code writing live passwords and API keys into 1,122 public GitHub repositories.
- Trend Unit 42's teardown of Europe's refrigeration intrusions lands with CISA hardening advice as Perry Johnson subsidiaries settle with four states over a 2023 healthcare hack.
- Update · updated SonicWall's CVE-2026-19868 lets anyone holding one set of SSL-VPN credentials walk past SAML-enforced multifactor authentication on SonicOS, with the mechanism now spelled out in detail.
- Trend U.S. intelligence warned Jensen Huang that a romantic partner was a recruited Chinese asset, while European agencies traced coordinated bomb hoaxes to pro-Kremlin activists.
- Update · new Allegheny County will mandate designated paid sick days as its parental leave law draws rollout questions and a Westmoreland family's nursing home search exposes Pennsylvania's care shortage.
- Trend Pennsylvania courts may require filers to verify AI-generated citations even as Intuit's Sasan Goodarzi describes rebuilding tax and accounting products around the same paradigm shift.
Security
1. SonicWall SSL-VPN Flaw Defeats SAML Logins
Latest developments: SecurityWeek and BleepingComputer spelled out the mechanism on November 7, 2026: CVE-2026-19868 lets an attacker who already holds credentials for one login method walk past SAML checks on SonicOS SSL-VPN, SAML-enforced multifactor authentication included, and attackers are using it now.
read more
SonicWall shipped updates for seven SonicOS firewall flaws, the exploited authentication bypass among them, and CISA placed that bug in its Known Exploited Vulnerabilities catalog. Administrators running SonicOS firewalls with SSL-VPN should install the new firmware and rotate VPN credentials.
Sources: SecurityWeek · BleepingComputer · ↑ top
2. ARTEX Abuse Reaches the Financial Sector
Latest developments: Microsoft Threat Intelligence reported late on November 6, 2026 that Storm-3358, a financially motivated actor, began aiming the agentic AI offensive framework ARTEX at financial sector organizations in October 2026, which moves the tool out of the espionage column that CrowdStrike's Vapor Panda attribution had defined.
read more
ARTEX is an open-source multi-agent penetration-testing framework whose operators automate reconnaissance, exploitation, and the work that follows a break-in, including scraping GitHub for OAuth application secrets to take authenticated actions inside victims' cloud tenants. Banks and insurers should hunt their public code for live application secrets and audit third-party application consent inside their identity platforms.
Sources: Microsoft Security Blog · ↑ top
3. Claude Code Approvals Leak Keys to GitHub
Latest developments: The Hacker News reported on November 7, 2026 that the software security company Apiiro found passwords and API keys sitting in 1,122 public GitHub repositories, put there by Claude Code when developers approved a command with the do-not-ask-again option.
read more
Anthropic's coding assistant saves an approved command word for word in a project settings file, secret included, and developers then commit that file to source control where anyone can read it. Teams should rotate every credential ever typed into a Claude Code command and strip the settings file from their repositories and history.
Sources: The Hacker News · ↑ top
4. Unit 42 Dissects Europe's Refrigeration Attacks
Latest developments: Unit 42, the Palo Alto Networks research group, published its own examination of the European refrigeration intrusions on November 6, 2026 with defense and mitigation steps, while SecurityWeek detailed the call from CISA, the FBI, Health and Human Services, the Department of Agriculture, and the Department of Transportation for operators to harden refrigeration controllers, and Dark Reading traced the speed of the spread to shared controller platforms across the grocery industry.
read more
Intruders reached cooling systems at supermarkets in Belgium, Sweden, Ireland, Estonia, and Luxembourg and at three sites of the Établissement français du sang, the French civilian blood service, switching evaporators into defrost and heating cycles that spoiled stock and risked equipment damage and fire. Operators should segment controller networks, close remote management to the internet, and alarm on temperature setpoint changes.
Sources: Unit 42 (Palo Alto) · SecurityWeek · Dark Reading · ↑ top
5. Perry Johnson Subsidiaries Settle With Four States
Latest developments: The attorneys general of Connecticut, New Jersey, New York, and Michigan settled on November 6, 2026 with the medical transcription, coding, and imaging subsidiaries of Perry Johnson Companies, the Nevada-based parent, over a 2023 hack that exposed sensitive patient records.
read more
The subsidiaries process dictation, billing codes, and medical images for hospitals and physician practices, which parks patient records in a vendor far from the doctor who collected them. Health systems should map which business associates hold their patient data and check what each one owes them after a breach.
Sources: The Record · ↑ top
Business and Politics
Hegseth Digs In Against Impeachment
Latest developments: The Wall Street Journal reported Saturday, November 7, that Hegseth has mounted an aggressive campaign to fight the impeachment vote set for next week.
read more
Defense Secretary Pete Hegseth faces a congressional vote on his impeachment next week and has refused to step back, and critics in Congress warn that a defiant Pentagon chief could put military funding at risk.
Sources: WSJ Politics · ↑ top
U.S. Intelligence Links Huang to an Alleged Chinese Spy
Latest developments: The Financial Times reported Saturday, November 7, that American intelligence officials warned Nvidia Chief Executive Jensen Huang he had carried on a romantic relationship with an executive whom China recruited to gather information on the company.
read more
Nvidia sits at the center of the artificial-intelligence build-out and of Washington's export controls on Beijing, and the warning drops its chief executive's personal conduct into that national-security fight.
Europe Traces Mass Bomb Hoaxes Toward Russia
Latest developments: European security agencies now work from the hypothesis that pro-Kremlin activists or hacking groups produced the coordinated threats, the Financial Times reported Saturday, November 7.
read more
A wave of bomb threats and hacks hit Europe this week, diverting dozens of flights and forcing media outlets to evacuate, and authorities across several countries still cannot name who sent them.
Sources: FT Home · WSJ World News · ↑ top
Pittsburgh
Weather
Today: Mostly Cloudy then Chance Rain Showers, high 52F.
Tonight: Mostly Cloudy, low 38F.
Sunday: Sunny, high 58F.
Business
Allegheny County Will Require Designated Paid Sick Days
Latest developments: TribLive reported Saturday, November 7, that a new Allegheny County policy will require employers to provide designated paid sick days, a change to the county's existing sick leave rules that moved through with little public debate.
read more
Allegheny County drew heavy attention for its 12-week paid parental leave mandate, and alongside it the county rewrote its paid sick leave requirements, obliging employers to set aside specific paid sick days for workers.
Questions Follow the Paid Parental Leave Law
Latest developments: TribLive reported Saturday, November 7, that Allegheny County's paid parental leave law now faces open questions about its rollout.
read more
Allegheny County passed legislation in October 2026 requiring employers to provide paid parental leave, the first mandate of its kind for the county, and employers and advocates want to know how the county will put it into effect.
A Westmoreland Nursing Home Search Shows the Squeeze
Latest developments: TribLive published the Steffey family's search Saturday, November 7, as a measure of how little long-term care capacity Pennsylvania has left.
read more
Brigid and Al Steffey Sr. of Westmoreland County hunted for a nursing home bed knowing time ran against them, and their search traces the staffing and capacity shortage running through Pennsylvania's long-term care industry.
Around Town
Pittsburgh Regional Transit Plans a Carnegie Station Rebuild
Latest developments: Pittsburgh Regional Transit will hold a virtual meeting on the project, WPXI reported Saturday, November 7.
read more
Carnegie Station sits at the terminus of the West Busway in Carnegie borough, and Pittsburgh Regional Transit wants to modernize the existing transit facility there.
Pennsylvania Courts Move on AI Citations
Latest developments: The Post-Gazette reported Saturday, November 7, that Pennsylvania may require lawyers and other court filers to verify citations that artificial intelligence generates.
read more
Judges across the country have caught filings built on fabricated case citations, and Pennsylvania's court system is now weighing a rule putting the burden of verification on the lawyers and self-represented parties who file them.
Sources: Pittsburgh Post-Gazette · ↑ top
The Bell-to-Bell Phone Ban Rests on Districts
Latest developments: Experts told the Post-Gazette in a story published Saturday, November 7, that the outcome of Pennsylvania's bell-to-bell school cellphone ban depends entirely on how districts carry it out.
read more
Pennsylvania schools must keep student phones away from bell to bell, and the researchers and educators the Post-Gazette interviewed say enforcement, storage, and exceptions will decide whether the policy changes anything in classrooms.
Sources: Pittsburgh Post-Gazette · ↑ top
Events
'The Pitt' Must Answer the 'ER' Lawsuit
Latest developments: A judge has allowed the suit to go forward, the Post-Gazette reported Friday, November 6.
read more
The lawsuit claims that "The Pitt," the hospital drama set and filmed in Pittsburgh, amounts to an unauthorized reboot of "ER," and the case now proceeds past the stage where the show's side sought dismissal.
Sources: Post-Gazette Arts & Entertainment · ↑ top
A Thomas Jefferson Percussionist Goes Viral With 'Thunderstruck'
Latest developments: WTAE spoke with the student Saturday, November 7, who said the scale of the attention stunned them.
read more
A Thomas Jefferson High School senior played AC/DC's "Thunderstruck" on mallet percussion with the marching band, and video of the performance has drawn millions of views.
Sources: WTAE · Post-Gazette Arts & Entertainment · ↑ top
Sports
Steelers (6-2)
Up Next · Steelers @ Bengals · Sun Nov 15, 8:20 PM
Penguins (5-9)
Up Next · Penguins @ Kings · Sat Nov 7, 9:00 PM
Team USA
Reyna Leaves Hurt Before Nations League Camp
Latest developments: ESPN reported Saturday, November 7, that Gio Reyna scored for Strasbourg and then exited the loss with an apparent injury, putting his availability for the United States squad in question.
read more
Reyna was due to report to the United States men's national team for the Concacaf Nations League quarterfinal against Haiti, a window in which coach Mauricio Pochettino has already lost defender George Campbell to injury and called in Mark McKenzie to replace him.
Sources: ESPN Soccer · ↑ top
Reading
- Ed Zitron — Premium: Fault Lines. Zitron, who normally keeps politics out of the newsletter, reads Tuesday's election night as the first abundant source of hope in two grim years and works through the fault lines the result exposed.
- Stratechery — An Interview With Intuit CEO Sasan Goodarzi About Accounting and AI. Ben Thompson interviews Intuit Chief Executive Sasan Goodarzi on running one of technology's oldest software companies and on how Intuit is reorganizing its accounting and tax products around the artificial-intelligence paradigm shift.
Markets
S&P 500 7,505.91 ▼ -2.4% Dow 51,987.12 ▼ -0.5% Nasdaq 25,033.45 ▼ -4.3% WTI crude 92.40 ▼ -9.5% EUR/USD 1.1204 ▲ +0.3% GBP/USD 1.3433 ▲ +0.6% USD/JPY 157.98 ▲ +0.2%
Feed Health
Security: 24 of 24 feeds loaded, 35 items in the 24-hour window. No recent items: Krebs on Security, SANS Internet Storm Center, CISA Advisories, Help Net Security, Securelist (Kaspersky), Sophos News, Google Online Security Blog, Cisco Talos, Graham Cluley, Google Project Zero, The DFIR Report, Kim Zetter (Zero Day), Frank on Fraud.
Pittsburgh: 9 of 9 feeds loaded, 60 items in the 48-hour window.
Business and Politics: 8 of 8 feeds loaded, 60 items in the 36-hour window.
Events: 4 of 4 feeds loaded, 16 items in the 120-hour window.
Sports media: 6 of 6 feeds loaded, 26 items in the 96-hour window.
Team USA: 3 of 3 feeds loaded, 29 items in the 72-hour window.
Reading: 3 of 3 feeds loaded, 12 items in the 336-hour window. No recent items: Cal Newport.
Markets (Yahoo Finance): 7 of 7 rows
Weather (NWS): 3 forecast periods
Scores (ESPN, plaintextsports): 2 teams via ESPN
Summaries: 3 model call(s) served by claude-opus-5 (278s of model time; $1.63 at API list price).