MAGNET S2 SNAPSHOT 260927-1800z

U.S. retail diesel reached a new record of $6.51/gal on 21 Sep and held near $6.50 on 25 Sep, per AAA data. California averages $8.42, up from $5.16 a year ago, and diesel exceeds $6 in 49 states. Texas remains lowest at $5.97, reflecting Gulf Coast refining proximity and lower fuel taxes.

The root cause is refining capacity, not crude oil. Strikes on Russian refineries and war damage in the Middle East have tightened global diesel supply, and damaged facilities will take time to rebuild. Domestically there is no slack: EIA data for the week ending 11 Sep showed commercial crude stocks about 1% above the five-year average, but distillate stocks about 13% below it, with refineries running at 96.8% utilization. U.S. plants cannot make up lost foreign output, so the shortfall passes directly into price.

The Great Lakes premium traces to Exxon's 275,000 bpd Joliet, IL refinery, which shut down after a power failure on ComEd supply lines triggered its safety flare; a later filing disclosed that floodwater overwhelmed a plant pump. Joliet produces about 11 million gallons of gasoline and diesel daily, mostly for Midwest consumers. Power has been restored, but a production restart is not confirmed. Reports that BP's Whiting, IN refinery is contributing were described by GasBuddy as misstated.

Household impact: grocery prices do not yet reflect the spike (August food-at-home CPI flat month over month, +2.2% YoY). Because retail food prices react to cost changes with a lag, freight-driven increases are assessed as likely in the coming months – an S2 analytic judgment, not a USDA forecast. About 5 million Northeast households heat with oil, the same distillate product in short supply; EIA's winter outlook is due in October. Propane-heating households face lower risk, with inventories ~22% above average.

Airfares in August were 23.4% higher than a year earlier, versus 3.4% for overall consumer prices. At a 16 Sep investor conference, American said the latest fuel spike adds about $1 billion to fourth-quarter costs and is cutting some December flights; Southwest has halved its planned 2026 capacity growth; United has dropped some December flights and warned of further adjustments in early 2027. Jet fuel averaged $4.51/gal for the week ending 18 Sep, nearly 80% above a year ago. Cuts are concentrated in lower-fare, less-profitable flights, so travelers should expect fewer bargain seats and fewer nonstop options.

On 22 Sep the extortion group ShinyHunters defaced FBIjobs.gov and claimed to have stolen data on nearly all FBI agents and job applicants. The FBI confirmed it is investigating and stated the point of breach – a third-party provider or the FBI's own systems – is undetermined. A 5,000-record sample (names, phone numbers, home addresses) was judged authentic by 404 Media and Reuters; claims of 2–3 TB of data remain unverified. Reported intrusion path: an Oracle PeopleSoft HR server, then a pivot into an Amazon-hosted government cloud (group claim via press; unconfirmed). The group is not seeking payment; it demands withdrawal of a May 2026 FBI advisory on its methods and threatens a full leak within a week. Principal concern is counterintelligence: stolen personal data could be used by foreign services to coerce agents or their families.

Actor profile: ShinyHunters, active since 2019 and led under the handle “shinycorp,” is affiliated with “The Com,” a loose English-speaking cybercrime community. Since 2025 it has operated with Scattered Spider and LAPSUS$ under the “Scattered LAPSUS$ Hunters” banner, with a reported division of labor: Scattered Spider gains initial access, ShinyHunters steals and publishes data, LAPSUS$ members amplify extortion. Its methods rely on social engineering and stolen identity/SaaS credentials rather than software exploits. 2026 victims include Canvas/Instructure (~275M student records), Carnival, ADT (~5.5M records), Charter, Kemper and McGraw-Hill – meaning many Americans' data is already in circulation from this group. Law enforcement actions (a 2022 arrest and U.S. extradition of a French national; four French arrests in June 2025; the October 2025 seizure of BreachForums) have not significantly disrupted operations, and those arrested were assessed as affiliates rather than core leadership. Attribution caveat: overlapping membership means claims under the ShinyHunters name may come from core operators, collaborators or brand borrowers.

CVE-2026-87902 (CVSS 9.2) lets an unauthenticated attacker make WordPress load a local PHP file from outside the theme directories, enabling remote code execution under certain theme and server conditions. Patchstack recorded the first exploitation attempt at 11:49 UTC on 22 Sep – the same day WordPress shipped 7.1.2 and backports (7.0.6, 6.9.9, 6.8.10). Researchers observed attackers from multiple countries deploying web shells. No actor has been named; activity is consistent with automated mass scanning. Because the flaw is in WordPress Core rather than a plugin, every unpatched site is exposed – including the small-business, church, nonprofit and community websites that make up much of the platform's footprint.

In-person early voting for the 3 Nov midterms began 18 Sep in Virginia, with in-person absentee voting in several other states. On 24 Sep CISA released its Election Infrastructure Security Plan, 40 days before the election, outlining threats to election systems and available services for election officials. The plan does not name specific 2026 threats from Russia, Iran or China. Election security is added as a watch item through 3 Nov.