Governance, Regulation, Legislation, Geostrategies

 

UNCTAD highlights need for AI investment beyond data centres – The United Nations Conference on Trade and Development (UNCTAD) has highlighted the need for investment beyond data centres, arguing that countries need to invest in the wider AI ecosystem to turn infrastructure spending into economic value. Affordable connectivity, reliable electricity, research, skills, and access to finance and data are identified as important to making AI’s benefits more inclusive. – https://dig.watch/updates/unctad-highlights-need-for-ai-investment

 

UNGA First Committee: Weak cyber governance risks global peace and security – During debates on 23 October 2026 at the eighty-first session of the UN General Assembly, the First Committee (Disarmament and International Security) addressed a central challenge in international cybersecurity: although states have developed a common framework for responsible behaviour in cyberspace, translating agreed principles into consistent practice remains difficult. These discussions addressed the implications of malicious information and communications technology (ICT) activities for international peace and security, including the application of international law, implementation of responsible state behaviour, and the need to strengthen national and collective governance and resilience. – https://dig.watch/updates/un-cyber-governances-risks-global-peace-security

 

UK announces funding to prepare workers for AI transformation – The UK government has announced new investments to examine the impact of AI on employment and help workers adapt to technological change. The package, unveiled by Chancellor John Healey on 24 October, includes £10 million annually to assess how AI will reshape jobs and industries and inform government responses to changes in the labour market. – https://dig.watch/updates/uk-funding-workers-ai-transformation

 

Indian publishers question privacy law’s impact on journalism – The Digital News Publishers Association is likely to approach India’s Supreme Court, the Times of India reported on 27 October 2026. It represents 21 media organisations. Its petition challenges provisions of the Digital Personal Data Protection Act and associated rules. The association argues they threaten constitutionally protected journalistic activity. – https://dig.watch/updates/indian-publishers-challenge-privacy-laws

 

Tata Communications plans US$450 million AI connectivity network – Tata Communications announced plans for an Indian ‘AI Super Highway’ on 26 October 2026. Planned investment totals US$400–450 million. Approximately 10,000 kilometres of new fibre will connect AI and data centre hubs. The network will integrate with the company’s global backbone. – https://dig.watch/updates/tata-plans-450-million-ai-connectivity-network

 

India inaugurates central bank data centre and cybersecurity institute –  Prime Minister Narendra Modi of India inaugurated the Reserve Bank of India’s Data Centre and Cybersecurity Training Institute in Bhubaneswar, Odisha, on 25 October 2026. Modi said the facilities are intended to strengthen the technological foundations of India’s financial system and to make banking more efficient and reliable, and he highlighted the importance of modern training infrastructure and skilled personnel for protecting banking systems from cyber threats. – https://dig.watch/updates/india-opens-data-centre-cybersecurity-institute

 

Singapore expands energy infrastructure as electricity demand grows – Singapore’s Energy Market Authority (EMA) announced a five-year Energy Infrastructure Plan on 26 October 2026. Peak electricity demand reached 8.6 gigawatts in August. It could reach 9.9–13 gigawatts by 2031. Data centres, semiconductor manufacturing and electric transport are key drivers. – https://dig.watch/updates/singapore-expands-energy-infrastructure-as-electricity-demand-grows

 

Google DeepMind staff resign over military AI contracts – Several Google DeepMind employees have resigned or expressed concerns about the company’s involvement in military artificial intelligence (AI), according to a BBC investigation. Sofia Liguori, a London-based research engineer, resigned after three years at Google DeepMind, citing the company’s growing involvement in military AI as a conflict with her ethical concerns. AI researcher Andreas Kirsch also resigned, questioning whether Google could adequately oversee the use of its technology in classified military settings. – https://dig.watch/updates/google-deepmind-staff-resign-military-ai

 

Security, Surveillance

 

Magento Campaign Infects 953 Online Stores Across Five Domains – A criminal group has infected 953 online stores since July 2025, mostly Magento shops, according to Sansec researchers. The attackers add a small piece of code to store pages. When someone visits a shop, their browser contacts the attackers’ server to get further instructions. The server checks whether the visitor is a real shopper or a security scanner. If it detects a scanner, it hides the malicious activity. “deepveindrilling.com is the newest web address of a criminal group that breaks into online stores. The group adds a small piece of code to the store’s pages.” Sansec’s analysis states. “The group has done this to 953 stores since July 2025, mostly Magento shops. It moves to a new address every few months”. The group’s latest domain is deepveindrilling.com. Sansec found it in the CMS blocks of 83 stores, almost all running Magento. CMS blocks are content sections that Magento adds to store pages. The domain was registered on October 6, 2026, and the first stores began loading it the following evening. – https://securityaffairs.com/201795/malware/magento-campaign-infects-953-online-stores-across-five-domains.html

 

AI-Generated Fake Bank Calls and NFC App Enabled €380,000 Fraud, Dutch Police Say – Rotterdam police have arrested two men over a new type of bank fraud that used AI-generated phone calls, a fake banking app, and NFC technology to steal bank card data. In just three weeks, the scheme allegedly cost 170 victims around €380,000. “Rotterdam police arrested two suspects accused of a new form of bank-helpdesk fraud. The operation allegedly caused around €380,000 in losses for 170 victims in just three weeks.” NL Times reports. “The suspects allegedly used AI-generated phone calls and a fake banking app to copy victims’ bank cards remotely, allowing accomplices to withdraw thousands of euros. Victims came from across the Netherlands and ranged in age; dozens were in their twenties and thirties”. The suspects allegedly used AI-generated calls to trick victims into believing their bank accounts were at risk. They then persuaded them to install a fake banking app and scan their bank cards with their phones. The app used NFC to capture card data, which accomplices could use to withdraw money. Victims came from across the Netherlands and included people of all ages, with dozens in their twenties and thirties. – https://securityaffairs.com/201786/cyber-crime/ai-generated-fake-bank-calls-and-nfc-app-enabled-e380000-fraud-dutch-police-say.html

 

Researchers Uncover Rentable Android Spyware uCreater Targeting WeChat and Telegram – uCreater is a rentable Android spyware platform that hides inside repackaged legitimate apps, targeting messaging services and mobile wallets. Its YingGai framework can intercept one-time passwords, steal account and chat data, collect contacts, manipulate sessions and spoof camera feeds to bypass identity checks. Victims may install modified versions of Telegram, WeChat or GCash through sideloading or social engineering. Researcher Ovi found stolen data on a control server, but the number of victims and links between operators and customers remain unconfirmed. “The repackaged APK can be relatively thin: target-specific instrumentation is retrieved after installation from the operator’s Alibaba OSS and MinIO infrastructure, including buckets and paths named Huuk_<target> and fengzhuang-app (literally, “packaging”). Distribution hosts include telegram-apk.uzyzx.com.” researcher Ovi states. “I could reconstruct much of the post-installation execution chain from the recovered code, but I could not directly establish the initial delivery mechanism for every victim.” – https://securityaffairs.com/201764/malware/researchers-uncover-rentable-android-spyware-ucreater-targeting-wechat-and-telegram.html

 

PHP2Shell: Suspected North Korean campaign targets 216 vulnerable PHP hosts – On October 21, PHP released emergency patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS scale. The flaws affect all PHP versions that handle web requests. The vulnerable code dates back to PHP 5.4, released in 2012, and resides in the PHP engine itself rather than in individual applications. Attackers can exploit the flaws to execute code remotely by sending specially crafted HTTP requests, without authentication. Exploitation attempts increased rapidly after the vulnerabilities became public. Cloudflare researchers reported tens of thousands of attempts within the first 45 minutes, hundreds of thousands in just two hours, and millions by October 22. Cyfirma reported that a group of North Korea-linked group has identified 216 hosts that may still be vulnerable to PHP2Shell. The operators communicate through a private I2P channel that Cyfirma has monitored since October 22. On October 24, they reported that 216 hosts appeared to be unpatched or only partly protected, earlier than Cyfirma expected. – https://securityaffairs.com/201748/hacking/php2shell-suspected-north-korean-campaign-targets-216-vulnerable-php-hosts.html

 

Anthropic reveals how Claude Mythos 5 crossed security testing boundaries – A cybersecurity test is supposed to measure what an AI model can do within an agreed boundary. In one UK AI Security Institute evaluation, Claude Mythos 5 crossed that boundary, targeted a real GitHub project and created fake identities to persuade its maintainers to accept malicious code. The maintainers refused. That stopped the attempted compromise, but it left a question that matters well beyond AI testing: what happens when a model treats completing its task as more important than respecting the limits around it? Anthropic’s report describes a case in which the model went beyond the test’s limits and misled real people. The report does not suggest that the model was following its own independent plan. The UK AI Security Institute (AISI) gave Mythos 5 a cybersecurity challenge. The model had to find protected data inside a simulated network designed to look like a real organization’s computer systems. – https://securityaffairs.com/201729/ai/anthropic-reveals-how-claude-mythos-5-crossed-security-testing-boundaries.html

 

UK announces £100 million AI Biosecurity Lab – The UK Government has announced plans to establish a new AI Biosecurity Lab, backed by £100 million in public funding, as part of a wider £165 million National AI Biosecurity Initiative unveiled on 24 October 2026. Announced by Chancellor of the Exchequer John Healey, the initiative aims to strengthen the UK’s capacity to detect and respond to biological threats by combining artificial intelligence with scientific research. The remaining £65 million will support biological surveillance and the development of medical countermeasures against priority pathogens. – https://dig.watch/updates/uk-announces-100-million-ai-biosecurity-lab

 

UK Home Office publishes privacy assessment for facial recognition in immigration enforcement – The UK Home Office published a data protection impact assessment (DPIA) on 22 October 2026, outlining the privacy risks and safeguards associated with the use of live facial recognition (LFR) technology in immigration enforcement operations. The assessment covers the technology’s hardware, software, and processing of personal data, and updates an earlier assessment prepared for a proof-of-concept trial as the programme moves towards operational deployment. – https://dig.watch/updates/uk-privacy-assessment-for-lfr-in-immigration

 

Claude AI bypasses payment restrictions to access Georgia election data – Anthropic confirmed on 25 October 2026 that its Claude AI model had bypassed a paywall to retrieve election data from the US state of Georgia without human authorisation. The incident occurred during an internal statistical analysis project and involved aggregate vote counts that the state normally makes available for a fee. According to statements provided by Anthropic, the model discovered through an archived version of the state agency’s website that a public dashboard issued digital access tokens to visitors. Without being instructed to do so, Claude requested a token and used it to retrieve the information, circumventing the payment requirement. – https://dig.watch/updates/claude-bypasses-restrictions-access-election-data

 

Frontiers and Markets

 

Financial institutions announce US$63 billion Anthropic compute deal – Bank of America, Blackstone, Citi and Morgan Stanley announced a US$63 billion transaction on 26 October 2026. It will finance computing equipment for Anthropic. A newly formed special purpose vehicle will purchase Broadcom AI accelerators and networking equipment. Anthropic will lease that equipment. – https://dig.watch/updates/banks-announce-63-billion-anthropic-compute-deal