Governance, Regulation, Legislation, Geostrategies

 

Dublin Declaration on trustworthy AI adopted by participating EU states – Participating EU member states adopted the Dublin Declaration on Trustworthy, Safe and Sovereign Artificial Intelligence on 14 October, setting out shared priorities for the development and deployment of AI that is safe, trustworthy, human-centric, and aligned with democratic values. The declaration identifies seven priority areas: advancing AI safety and resilience; accelerating the adoption of trustworthy AI across public services and industry; strengthening European AI sovereignty; investing in infrastructure, skills, and computing capacity; promoting the sustainability of AI technologies; driving public-sector innovation; and deepening European and international cooperation on AI governance and innovation. – https://dig.watch/updates/dublin-declaration-on-ai-adopted-eu-states

 

Brazil allocates R$147.6 million to AI-powered environmental monitoring – Brazil’s National Bank for Economic and Social Development (BNDES) has approved R$147.6 million from the Amazon Fund for a project using artificial intelligence (AI) to improve environmental monitoring across the country’s biomes. Announced on 16 October 2026, the five-year SIM-Biomas initiative will be implemented by the Foundation for Science, Applications and Space Technology (Funcate), with technical execution by the National Institute for Space Research (INPE). – https://dig.watch/updates/brazil-million-ai-environmental-monitoring

 

Denmark introduces new electricity grid rules for data centres – Denmark has introduced new rules prioritising access to its electricity grid, placing data centres in the lowest of four categories when network capacity is limited. The regulation, adopted on 9 October and effective from 19 October 2026, establishes a framework for electricity network operators to assess competing connection requests according to their importance and impact on available grid capacity. The framework in Denmark gives the highest priority to households, certain smaller businesses and critical societal functions, followed by projects supporting the green transition and electrification. Energy storage facilities occupy the third category, while data centres primarily providing data processing, storage and related IT services fall into the fourth. Data centres supporting critical societal functions may qualify for the highest category. – https://dig.watch/updates/denmark-electricity-grid-rules-data-centres

Milan area mayors seek greater say over data centres – Rho’s mayor, Andrea Orlandi, and 51 other mayors in Milan’s metropolitan area have appealed to Lombardy’s regional government for changes to its data centre legislation. The Municipality of Rho announced the appeal on 19 October 2026, seeking municipal involvement in revising Regional Law No. 11 of 2026. The mayors say principal authorisation powers rest with national or regional authorities, leaving municipalities to address residents’ concerns without sufficient influence over decisions. They also identify a lack of shared planning involving municipalities, the metropolitan authority and citizens.  – https://dig.watch/updates/milan-mayors-seek-greater-say-on-data-centres

 

EFTA and Vietnam sign FTA, reference digital trade standards – On 18 October, the European Free Trade Association (EFTA) – Iceland, Liechtenstein, Norway, and Switzerland – signed a comprehensive free trade agreement (FTA) with Vietnam. This follows an announcement at the EFTA Ministerial meeting in Reykjavík, Iceland on 22 June and a note the conclusion of negotiations from 2 July. The comprehensive EFTA-Vietnam FTA is described as modern and covers several topics affecting digital trade in goods and services, including trade facilitation; technical barriers to trade (TBTs); intellectual property rights (IPRs); government procurement; sustainable development; small and medium‑sized enterprises; and cooperation and capacity building. – https://dig.watch/updates/efta-vietnam-fta-digital-trade-standards

 

Vietnam and Switzerland seek closer cooperation in technology and investment – Vietnam and Switzerland have pledged to deepen their Comprehensive Partnership, focusing on trade, investment, financial services and emerging technologies. The commitment followed a meeting between Vietnamese Prime Minister Le Minh Hung and Swiss President Guy Parmelin in Ha Noi on 17 October. Le called for stronger economic ties, urging Swiss companies and investment funds to expand their presence in Vietnam, particularly in banking, manufacturing, biotechnology and pharmaceuticals. He also proposed cooperation in green finance, fintech, carbon credits and asset management, as well as Swiss support for Vietnam’s planned International Financial Center. He highlighted the potential for a free trade agreement between Vietnam and the European Free Trade Association (EFTA) countries to boost bilateral trade. – https://dig.watch/updates/vietnam-switzerland-technology-cooperation

UK invests £15 million in digital twin project for clean transport – The UK is investing £15 million in a project that will use digital twin technology to support the development of zero-emission transport and energy systems at Belfast Harbour. Announced on 15 October 2026, the investment comes through UK Research and Innovation’s Local Innovation Partnerships Fund and will support the Zero Emissions Transport and Energy Cluster (ZETEC), led by Artemis Technologies. – UK funds £15m digital twin project at Belfast Harbour

 

Security, Surveillance

G7 to war-game AI-driven cyberattacks on global financial architecture – At a landmark meeting on the sidelines of the International Monetary Fund gatherings in Bangkok, G7 finance ministers and central bank governors formally approved a coordinated initiative to conduct simulated tabletop exercises targeting AI-enabled cyber threats, as confirmed by Japanese Finance Minister Satsuki Katayama, chair of the IMF-World Bank Joint Development Committee. Rather than treating artificial intelligence merely as a tool for financial optimization or conventional threat detection, global financial leadership is now explicitly treating frontier AI models as potent force-multipliers for hostile actors aiming to destabilize the international banking ecosystem. – https://dig.watch/updates/g7-ai-driven-cyberattacks-on-financial

Deepfakes and Election Manipulation: UK Watchdog Seeks Faster Detection – The UK’s Electoral Commission is building an AI-powered system to tell candidates about significant deepfakes within three hours of posting. Its chief executive, Vijay Rangarajan, said so at a panel at the Conservative Party’s annual conference last week, as Tech Policy Press points out that it’s a rare public intervention from a man who has run the regulator since 2024 and who mostly speaks to Parliament in evidence sessions. He began with an example from another country. During Ireland’s 2025 presidential election, a deepfake video falsely showed candidate Catherine Connolly saying the election had been cancelled and that she was withdrawing from the race. The video also urged her supporters not to vote. None of this was true, and Connolly went on to win the election. Rangarajan said a similar video during a UK election could influence a significant number of votes. However, he stressed that the Electoral Commission has clear limits to its role. It does not settle disputes over political claims made during a campaign. Its focus is on false statements that could disrupt the election process itself“. “If that happens to the British election, that will move a significant amount of votes,” he said, adding that it was not the Electoral Commission’s role to arbitrate rival claims made by candidates during the cut and thrust of a campaign, but rather to focus on statements such as this one that could undermine the administration of the election itself. – https://securityaffairs.com/201307/uncategorized/deepfakes-and-election-manipulation-uk-watchdog-seeks-faster-detection.html

 

Cyberattack on French supermarkets tells us more about food security than AI safety – The cyberattack last week that hit hundreds of French supermarket refrigerators had Europeans wondering if the nonstop warnings about AI risks had finally landed in the real world. They hadn’t — at least, not yet. Experts say the attack, which forced hundreds of retailers to throw away defrosted food and spoiled milk, was mostly a reminder of the importance of old-school cybersecurity in safeguarding essential goods and services. The attack is a “typical example” of how “low-key cyber-enabled sabotage can affect very crucial supply for society,” said Ferdinand Gehringer, hybrid threats lead at FTI Consulting. – https://www.politico.eu/article/cyberattack-french-supermarkets-food-security-ai-safety/

US Cybersecurity Job Postings Fall 26%, Hitting Four Year Low – Cybersecurity job postings in the US fell by 26.4% year-over-year from January to September 2026, according to analysis by CyberSN. A total of 235,786 cybersecurity roles were posted on the job market intelligence platform JobSpikr in 2026. This is the lowest amount of US-based cybersecurity jobs advertised in the four years CyberSN has undertaken its analysis, compared to 273,498 in 2023, 244,911 in 2024 and 320,210 in 2025. There was a particularly significant drop in leadership roles. CISO postings fell from 4632 in January to September 2025 to 2832 in the same period in 2026, a 38.9% reduction. – https://www.infosecurity-magazine.com/news/cybersecurity-job-postings-fall/

Meta wants to scrape your website to train its AI, and you can’t say no – At the end of the month, Meta plans to change its commercial terms in a way that matters to every company advertising or selling through its platforms. The new language takes effect on October 30, 2026. It lets Meta collect content from websites associated with business customers and use it to train AI models or otherwise improve its products, according to The Register. Meta defines “business customer” broadly. It includes anyone who uses ads or marketing messages, sells or lists products, develops apps, uses a product catalog, manages a Page, runs a Group for business purposes, or uses tools such as Ads Manager or Meta Business Suite. At least one million businesses already use Meta’s AI agents in WhatsApp and Messenger. Nieman Lab also points out that almost every news publisher has at least one Meta business account. The contract clearly explains which tools Meta can use. By accepting the terms, you allow Meta, or anyone working on its behalf, to use automated tools such as web scrapers, bots, spiders and crawlers to access and index your websites, pages and URLs. These tools can also revisit your sites regularly to collect updates. – https://securityaffairs.com/201300/ai/meta-wants-to-scrape-your-website-to-train-its-ai-and-you-cant-say-no.html

OpenCode Breach Could Affect OpenAI, Anthropic and Google – A security breach affecting open-source AI agent framework provider OpenCode could expose API keys linked to users of Anthropic, OpenAI and Google AI models. On October 17, OpenCode confirmed a security breach that occurred the night before and affected its Console service, which allows teams to share access to AI models through centrally managed API credentials. Rather than exposing the underlying OpenAI, Anthropic or Google keys to individual team members, Console stores each workspace’s credentials and uses them to authenticate requests to the respective providers. OpenCode is a widely used AI agent platform designed for software developers. It has 217 stars on GitHub. In a July 2026 interview with Y Combinator – financial backer of Anomaly, the company which develops and maintains OpenCode – the founder and CEO Jay V claimed OpenCode had reached approximately 13 million monthly active users and 4.6 million weekly active users. – https://www.infosecurity-magazine.com/news/opencode-breach-openai-anthropic/

Plex2Shell Exploit Used to Turn Vulnerable Plex Servers Into Crypto Miners – Plex Media Server is designed to make movies, music, and other media available across devices. But when a server is exposed to the internet and runs vulnerable software, it can become an entry point for attackers who have little interest in your film collection. On October 16, 2026, security researcher Zach Main published technical details and proof-of-concept (PoC) code for a vulnerability chain dubbed Plex2Shell. Within a day, researchers had observed attackers using the exploit against an internet-facing honeypot, deploying cryptocurrency-mining malware and proxy software. The incident is a reminder of how quickly a public exploit can be weaponized by threat actors. The chain combines four vulnerabilities in Plex Media Server: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. Together, they can allow attackers to execute arbitrary code on vulnerable servers without valid credentials, provided the required conditions are met. The code runs with the privileges of the Plex service, giving attackers an opportunity to install additional software and abuse the host. – https://securityaffairs.com/201324/hacking/plex2shell-exploit-used-to-turn-vulnerable-plex-servers-into-crypto-miners.html

Big Fish: OpenBSD Root Exploit Chains a 37-Year-Old BSD Bug With a Kernel Flaw – Cybersecurity firm Calif published a full exploit and write-up this week for a local privilege escalation on OpenBSD 7.9 that chains two separate kernel flaws, one of them a 37-year-old integer overflow inherited from the original BSD sources. The exploit bypasses OpenBSD’s KARL address randomization and the SMAP and SMEP hardware protections without needing any information disclosure vulnerability at all. OpenBSD already shipped patches for both issues in September: the integer overflow fix in errata 018 on September 14, and the related use-after-free fix in errata 026 on September 30. Both are available through syspatch and cover all architectures. The shared memory attachment counter, shm_nattch, was defined as a signed 16-bit integer in BSD source code in 1988. It could hold a maximum value of 32,767. OpenBSD inherited this definition and never changed it. By mapping 127 shared memory segments and creating 259 processes through forking, an attacker can push the counter beyond its limit, causing it to wrap around to a negative value. This triggers a use-after-free vulnerability through a race condition. The corrupted counter makes the kernel free memory that other processes are still using. – https://securityaffairs.com/201285/hacking/big-fish-openbsd-root-exploit-chains-a-37-year-old-bsd-bug-with-a-kernel-flaw.html

Attackers Abuse Stolen ConnectWise Application Credentials to Target Microsoft 365 – ConnectWise suspended its Cloud Backup service and took both SaaS Security and Cloud Management offline over the weekend after discovering that unknown attackers had obtained unauthorized access to seven of its application identities. The company discovered the incident on October 14 through internal monitoring, disabled the compromised identities on October 17, and is still investigating how attackers obtained the credentials. “We have taken protective action following unauthorized access to application identities associated with ConnectWise Cloud Backup, formerly known as SkyKick. Our investigation remains ongoing. Since implementing the mitigations described below, we have not observed successful threat activity in the environments we monitor.” reads the alert published by the company on October 17. “Out of an abundance of caution, we suspended Cloud Backup service by revoking certificates used for affected application connections across all users. This removed ConnectWise’s access through those connections. The shared credentials previously used for Cloud Backup are no longer valid and cannot be used. In addition to mobilizing our internal security teams and Security Operations Center (SOC), we have engaged a reputable third-party incident response firm to support our investigation and containment efforts. Together, these teams are actively monitoring our backup infrastructure and broader environment, with the investigation extending across all partner-facing services. At this time, we have no indication that any other ConnectWise product, service, or offering is impacted.” – https://securityaffairs.com/201236/hacking/attackers-abuse-stolen-connectwise-application-credentials-to-target-microsoft-365.html

Japan’s SiteGuard WAF flaw CVE-2026-106931 is already being exploited – EG Secure Solutions published an urgent alert warning of CVE-2026-106931, an OS command injection bug in SiteGuard Server Edition. Threat actors are already exploiting it in the wild. A successful exploit lets them run commands with root or SYSTEM privileges on the server where the product runs. SiteGuard is a Japanese web application firewall (WAF) that runs directly on the web server it protects. The vulnerability affects its statistics feature, which is enabled by default. The vendor and JVN rated the vulnerability with a CVSS 4.0 score of 8.5 and a CVSS 3.0 score of 7.8. An attacker needs local access and low-level privileges to exploit this vulnerability. This suggests the flaw may be used after an attacker has already gained access to a system. – https://securityaffairs.com/201258/security/japans-siteguard-waf-flaw-cve-2026-106931-is-already-being-exploited.html

16-Year-Old Broadcom Wi-Fi Bug Lets Attackers Take Over Routers Without a Password – Researcher Quentin Kaiser presented a talk at Hexacon in Paris documenting a vulnerability in Broadcom’s proprietary 802.11 implementation that has been present in their SDK since at least 2010. The bug allows an attacker to get unauthenticated remote code execution on affected routers without knowing the WiFi password or going through the normal WPS setup process. As of October 15, 2026, none of the affected devices in Belgium had received a patch. “A vulnerability affecting Broadcom’s proprietary implementation of 802.11 has been present in their SDK since at least 2010. An incomplete patch was silently released in 2018, followed by Broadcom’s recommendation to move to hostapd instead, making it a definitive forever day on eCos-based platforms (BCM3380, BCM3383, BCM33834) and a potential forever day on Linux platforms (BCM3390, BCM65xx, BCM68xx) unless affected Original Equipment Manufacturers (OEMs) are willing to migrate.” states Kaiser. “The vulnerability can be triggered remotely over WiFi without knowledge of the network key or completion of a normal WPS enrollment. Exploitation provides controlled information disclosure and arbitrary code execution.” – https://securityaffairs.com/201268/iot/16-year-old-broadcom-wi-fi-bug-lets-attackers-take-over-routers-without-a-password.html

Defence, Military

Investigation reveals Swiss military rejected Palantir software on five occasions – A new investigation published on 15 October 2026 by Swiss media outlet Republik and the WAV investigative collective has revealed that Switzerland’s Armed Forces and Federal Office for Defence Procurement (Armasuisse) considered software developed by US technology company Palantir on five occasions between 2020 and 2026 but decided against proceeding each time. According to the investigation, which draws on internal government documents, freedom of information requests and interviews with officials, concerns about data sovereignty and control over sensitive information contributed to at least three of these decisions. – https://dig.watch/updates/swiss-military-rejected-palantir-software

 

5 fights that will shape NATO’s next Russia war plan – NATO is beginning talks this month on the forces and weapons allies would need to defend against a Russian attack — and how they would pay for them. The talks will set capability targets for 2029, requiring each of NATO’s 32 member countries to provide specific forces and equipment. The deadline raises the stakes: European officials have warned that Russia could be ready to attack a NATO country by then. At the same time, the Trump administration is weighing a sharp reduction in U.S. forces in Europe, which could leave the alliance short of troops and critical capabilities with fewer like refueling aircraft, long-range missiles and intelligence, surveillance and reconnaissance assets. The negotiations will test how much each country is willing to spend, how much Europe can do without the U.S. and whether NATO’s military plans should make greater use of technologies such as robotics and artificial intelligence. “It’s going to be tough,” said one senior NATO diplomat, who, like others, was granted anonymity to speak freely on the sensitive issue. “Burden sharing, the U.S., how to combine the level of ambition with political priorities … it’s huge”. NATO allies will begin discussing the broad mandate for the new targets — known as Political Guidance — in the coming days. It’s the first step in a five-part effort called the NATO  Defence Planning Process. “The ambition … is for this to be a transformation cycle and not one that’s just off the shelf,” said French Adm. Pierre Vandier, NATO’s Supreme Allied Commander Transformation and the alliance’s chief for future warfare. POLITICO spoke to 15 current and former NATO officials and diplomats to get a sense of the five key debates likely to define the negotiations. – https://www.politico.eu/article/5-fights-nato-russia-war-plan/

Frontiers and Markets

Google Quantum AI demonstrates magic state cultivation on Willow chip – Google Quantum AI has demonstrated a technique called magic state cultivation on its Willow quantum processor, reducing errors by approximately 40-fold compared with states prepared without cultivation. Published in Science, the research addresses a major resource bottleneck in developing fault-tolerant quantum computers. Magic states are essential for universal quantum computers because they enable operations needed to run a broad range of quantum algorithms. However, preparing reliable magic states can be resource-intensive, with some estimates suggesting that the process could consume up to 95% of a quantum computer’s capacity. Cultivation aims to reduce this overhead by using coordinated measurements to detect errors and discard unsuccessful attempts during state preparation. – https://dig.watch/updates/google-quantum-ai-magic-state-cultivation-willow