Governance, Regulation, Legislation, Geostrategies

‘The clock on AI regulation is ticking’, warns UN rights chief – The world is running out of time to put guardrails on artificial intelligence, UN High Commissioner for Human Rights Volker Türk warned Monday, as a “ruthless race” between companies and countries raises concerns about human safety and even humanity’s survival. Speaking in the UK at an AI and Human Rights Summit in Oxford on Monday, Mr. Türk said the technology could deliver dazzling advances in science, health, education – and even human rights work. But its tools are being built and controlled by a select few, without public oversight, and are already doing things their creators cannot fully predict or manage. – https://news.un.org/en/story/2026/10/1168529

India and Indonesia join more than 90 signatories of UN Convention against Cybercrime – India and Indonesia have signed the UN Convention against Cybercrime, which now has more than 90 signatories. Indonesia’s Foreign Minister signed on 24 September at UN headquarters in New York, where he was leading the country’s delegation to the 81st UN General Assembly. India’s External Affairs Minister signed the following day. Indonesia’s Foreign Ministry said it will now prepare for ratification and take the steps needed to implement the convention in national law. Indonesia joins several other ASEAN members that have signed, including Malaysia, Brunei, Cambodia, Laos, the Philippines, Thailand, and Vietnam. The convention was adopted by the UN General Assembly on 24 December 2024 and is the first comprehensive global treaty on cybercrime. It is different from the Budapest Convention and provides a framework for international cooperation in addressing transnational cybercrime, including the sharing of electronic evidence related to serious crimes. – https://dig.watch/updates/india-and-indonesia-join-more-than-90-signatories-of-un-convention-against-cybercrime

Security, Surveillance

It’s not just misuse: AI-enabled biological research also runs the risk of accidents – Discussions of AI’s biosecurity risks often imagine malicious actors wielding AI to build destructive bioweapons. But as AI capabilities accelerate and become embedded in legitimate research, accidental risks may warrant at least as much attention. Policymakers must contend with established vulnerabilities like lab accidents and pathogen escapes and prevent them from growing as AI capabilities expand across an unevenly governed global research infrastructure. – https://www.atlanticcouncil.org/dispatches/its-not-just-misuse-ai-enabled-biological-research-also-runs-the-risk-of-accidents/

 

Norway plans to introduce a temporary ban on smart glasses in certain public settings – On 5 October, the government of Norway announced plans to introduce a temporary ban on AI-powered smart glasses, including devices such as Meta’s smart glasses, in certain public and privacy sensitive locations. The proposal responds to concerns about the ability of wearable devices equipped with cameras, microphones and AI capabilities to collect information about individuals without their knowledge. The proposed restrictions could cover locations such as schools, kindergartens, playgrounds, healthcare facilities, swimming pools, gyms and changing rooms, as well as certain public spaces, including parks, beaches, museums, shopping centres and public events. The propsal also emphasised that children are entitled to special protection. The government intends to submit the necessary legislation to parliament, meaning the restrictions are not yet in force. – https://dig.watch/updates/norway-temporary-ban-on-smart-glasses

ClickFix campaign in Ukraine compromises over 100 websites to spread Lunex malware – Hackers compromised more than 100 websites to infect Ukrainian users with information-stealing malware, according to a new report. Ukraine’s computer emergency response team, CERT-UA, said the campaign, discovered in September, involved attackers injecting malicious code into legitimate websites. Visitors to those sites were shown a fake Cloudflare verification page that told them to copy and run a command in PowerShell, a Windows command-line tool, to prove they were human. Instead, following the instructions downloaded and installed Lunex Stealer, malware that can steal passwords, authentication tokens, and cryptocurrency wallet data, as well as give attackers remote access to infected computers. – https://therecord.media/clickfix-campaign-ukraine-lunex-stealer

Osaka Metropolitan University cancels classes after suspected ransomware attack – One of Japan’s largest universities canceled classes and shut down a large part of its IT infrastructure following a suspected ransomware attack that began late last week. Osaka Metropolitan University said on Tuesday that the outage left its internal network, email and a range of administrative and academic systems unavailable. OMU said it believes ransomware caused the disruption and is investigating the attack with outside cybersecurity specialists. It has not identified the attackers or said whether it received a ransom demand. – https://therecord.media/osaka-university-cancels-classes-ransomware

Critical Medical Devices Unable to Support PQC Transition – Most medical devices cannot be upgraded to post-quantum cryptography (PQC), leaving sensitive healthcare data vulnerable to future quantum-enabled attacks, an investigation by Forescout has found. An analysis of more than 2.5 million devices across more than 50 healthcare delivery organizations (HDOs) observed that just 6% of Internet of Medical Things (IoMT) devices and 16% of medical operational technology (OT) devices use Secure Shell (SSH) implementations capable of supporting a transition to PQC. This is significantly below the 50% of traditional IT devices that can support PQC implementation. PQC refers to new cryptographic algorithms designed to protect data from attacks launched from quantum computers, which are predicted to be capable of breaking existing encryption methods in the next five years. The Forescout report, published on October 6, highlighted that healthcare environments are highly dependent on IoMT, OT and IoT devices. Many of these systems are directly involved in patient care, such as infusion pumps, patient monitors, imaging systems, and laboratory equipment. Yet these devices often have long lifecycles, limited upgrade paths and slower adoption of modern cryptographic standards. Daniel dos Santos, VP of research at Forescout, warned: “Our research shows that the devices least prepared for the transition are often the same devices healthcare organizations depend on most for delivering patient care. Visibility into those assets and the data they handle is essential for building a practical migration strategy.” – https://www.infosecurity-magazine.com/news/medical-devices-pqc-transition/

Police Urge Passkey Use After Surge in Cybercrime Profits – The UK’s Report Fraud service has launched a new public awareness campaign urging internet users to switch to passkeys, after revealing a major increase in sums stolen from victims. The fraud reporting service said that cybercrime linked to email and social media hacking netted scammers £6.3m ($8.3m) in 2025/6, up from £1.2m ($1.6m) the year previously. The number of reports for this type of account takeover increased by a third (34%) over the same period. Report Fraud didn’t go into much detail about the tactics cybercriminals use to monetize their access to victims’ accounts, aside from claiming that one of the most common is impersonating family and friends. – https://www.infosecurity-magazine.com/news/police-urge-passkey-surge/

Ransomware Affiliate Double-Crosses RaaS Operator to Steal Victim Funds – A Russian-speaking cybercriminal betrayed his ransomware-as-a-service (RaaS) partners to make off with funds extorted from over two dozen global victims, CloudSEK has revealed. The threat intelligence specialist detailed the double cross in a new report, The Gentlemen Files, published on October 5. They researchers found two exposed servers managed by “Azazel” – an affiliate of The Gentlemen RaaS outfit – containing several terabytes of data stolen from logistics, insurance, pharmaceutical, AI, medical device, and government victims across six countries. “Azazel was not running a standard affiliate playbook,” the report revealed. “He built and operated his own independent leak site under the brand Leakned, publishing victim data and collecting extortion proceeds without routing them through the Gentlemen program, a betrayal of the RaaS operator running alongside the betrayal of victims.” – https://www.infosecurity-magazine.com/news/affiliate-doublecrosses-raas/

ASOS Customers Receive Bizarre “Hacked” Message Amid Suspected Snowflake Compromise – Customers of online fashion retailer ASOS have received a strange mobile notification claiming the company has been hacked via a Snowflake compromise. Appearing as a legitimate ASOS push notification, the message, issued on October 6, read: “Dear Asos DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it”. The message was signed ‘xuanyewengateway’ and provided a link to a Telegram channel. DPO stands for data protection officer, the person appointed by an organization to oversee how personal data is collected, stored, used and protected. The General Data Protection Regulation (GDPR) requires any organization operating in the UK or the EU to have a DPO. Snowflake is a cloud-based data platform that companies use to store, manage, analyze and share large amounts of data. Rather than keeping data on a company’s own physical servers, Snowflake provides cloud infrastructure that allows organizations to centralize data and access it from different systems and locations. Cyber threat actors frequently attempt to gain unauthorized access to companies via Snowflake compromises. The latest large-scale known incident affecting Snowflake occurred in May 2024, when threat actors used stolen credentials – harvested by infostealer malware – to log directly into customer Snowflake tenants that did not have multifactor authentication (MFA) enforced. More recently, in August 2026, security researchers at Wiz, part of Google Cloud, discovered a critical script injection vulnerability in one of Snowflake’s public repositories on GitHub through the cloud service provider’s HackerOne vulnerability disclosure program. – https://www.infosecurity-magazine.com/news/asos-customers-message-suspected/

Nikkei Discloses Two Employee Cloud Account Compromises – Japanese media group Nikkei has disclosed unauthorized access to two employee cloud accounts, one of which was used to send around 9000 phishing emails to staff and to people its journalists had been in contact with. In a statement published October 4, the company said an employee’s Google Workspace account had been accessed from outside since late July, potentially exposing the names and email addresses of 1646 employees, business partners and others. Nikkei learned of the access in early August through a notification from Google and changed the account’s password immediately. It said it has seen no further unauthorized logins and has not confirmed any secondary harm. The exposed information does not include details of readers or news sources, Nikkei said. It has reported the incident to Japan’s Personal Information Protection Commission. In a second disclosure the same day, Nikkei said an employee’s Microsoft 365 account had been compromised and used on September 30 to send around 9000 emails directing recipients to malicious websites, both inside the company and to news sources and other contacts of several employees. – https://www.infosecurity-magazine.com/news/nikkei-employee-cloud-account/

Red Hat’s Lightwell Project Remediates 400 Open-Source Vulnerabilities – Red Hat’s open-source security initiative Lightwell has remediated over 400 novel vulnerabilities across foundational Java libraries since the project’s launch in June. This comes as the company announced at the general availability of the Lightwell Clearinghouse following a pilot testing phase. The company, alongside parent IBM, was among the first to respond to the influx of AI-powered vulnerability reporting, creating processes to validate and address genuine flaws while reducing the burden of noisy or inaccurate submissions on open-source maintainers. The initiative was backed by a $5bn investment from IBM and Red Hat, 20,000 in-house engineers dedicated to it as well as “early adopters” from the financial sector, including Bank of America, BNY, Citi, Goldman Sachs, JPMorganChase, Mastercard, Morgan Stanley, Royal Bank of Canada, State Street, Visa and Wells Fargo. Gunnar Hellekson, VP at Red Hat and general manager of Lightwell, said the emergence of AI agents “shifted the threat landscape overnight, exploiting old dependencies at machine speed”. “They do not care if a codebase is ten years old or otherwise considered stable, because one small crack is all it takes to chain an attack together,” he added. This ultimately resulted in the pursuit of the Lightwell initiative. – https://www.infosecurity-magazine.com/news/red-hat-lightwell-remediates-400/

FBI Drops Accenture Contractor After Sensitive Data Breach – The FBI pulled an Accenture contractor off its account on Monday, and the reason is almost mundane compared to the damage it caused. One update didn’t get installed on time. “The ‌Federal Bureau of Investigation removed an Accenture contractor on Monday over their role in a damaging data breach that exposed sensitive personal details of thousands of bureau employees, two sources familiar with the matter told Reuters.” Reuters reports. “The development comes as the FBI is still trying to ascertain the ramifications of the breach, ​which some former bureau officials have described as a major blow to the organization’s operational security”. Two sources told Reuters the bureau cut ties with the contractor over their role in a breach that exposed sensitive personal data on thousands of FBI employees. Former bureau officials are calling it a serious hit to the organization’s operational security, not just an embarrassing headline. That’s a strong statement coming from people who used to run the place. – https://securityaffairs.com/200468/data-breach/fbi-drops-accenture-contractor-after-sensitive-data-breach.html

Dell Urges Customers to Patch Critical DSU Flaw That Can Give Attackers Root Access – Dell urged customers to patch a critical flaw, tracked as CVE-2026-86360 (CVSS score of 9.6), in its System Update (DSU) tool. The vulnerability is a path traversal issue that can let attackers execute code with root privileges on unpatched PowerEdge servers. This flaw could give attackers full control of vulnerable servers. DSU is used by enterprise IT teams to deploy BIOS, firmware and software updates on Linux and Windows systems. The vendor recommends applying the available security updates as soon as possible to prevent exploitation. – https://securityaffairs.com/200458/security/dell-urges-customers-to-patch-critical-dsu-flaw-that-can-give-attackers-root-access.html

 

ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure – FortiGuard Labs researchers spotted a Linux malware family they call ClingSTUN, and the name gives away its trick immediately. Instead of relying on a dedicated command server, the malicious code leans on STUN, the protocol that helps devices behind a router figure out their real public IP address. Video calling apps use it constantly, which means ClingSTUN’s network traffic hides inside something that already looks completely normal. “ClingSTUN functions as a back-connect proxy backdoor, turning infected systems into remotely controlled proxy nodes. It abuses public STUN (Session Traversal Utilities for NAT) infrastructure to discover externally mapped IP addresses and ports, maintain NAT bindings, and improve connectivity between compromised hosts and remote operators.” reads the report published by Fortinet. “Because many of the STUN servers it contacts are legitimate public services, the resulting traffic easily blends with normal VoIP and WebRTC communications”. The attack starts with a familiar problem: old, unpatched devices exposed to the internet. Fortinet first spotted the campaign exploiting a known command injection flaw in Hytec Inter routers. As the campaign evolved, the attackers changed their download infrastructure and expanded the list of vulnerabilities they were exploiting. – https://securityaffairs.com/200450/uncategorized/clingstun-linux-backdoor-abuses-public-stun-infrastructure.html

Anthropic Mythos Found A Bug in Rejetto HFS. Attackers Are Now Exploiting It – A Rejetto HFS vulnerability, tracked as CVE-2026-61500 (CVSS score of 9.3), discovered with the help of the Anthropic Mythos AI model is now being exploited in the wild, turning an interesting security research experiment into a much more practical warning for defenders. The vulnerability affects Rejetto HTTP File Server (HFS) 3.x. Attackers can exploit it to bypass authentication, obtain administrative access and ultimately execute arbitrary code on the server. VulnCheck observed reconnaissance activity targeting vulnerable systems. “Earlier today, VulnCheck‘s Canary Intelligence network started detecting probes for CVE-2026-61500, a session-forgery-via-weak-signing-key vulnerability in Rejetto HFS, an open-source file server.” VulnCheck warned. “The vulnerability was discovered by Horizon3.ai‘s Zach Hanley and published through the VulnCheck CNA on July 13, 2026”. The story is interesting for two reasons. The first is the vulnerability itself. The second is how Horizon3 found it. – https://securityaffairs.com/200444/ai/anthropic-mythos-found-a-bug-in-rejetto-hfs-attackers-are-now-exploiting-it.html

Defence, Military

Russian Doctrine Designs Fire-Strike Complex Its Own Army Is Assembling by Hand – Russian military doctrine proposed a Fire Engagement Complex (FEC) linking sensors, artificial intelligence, communications, navigation, and weapons into a software-defined network designed to dramatically compress the detect-to-strike cycle. Frontline forces are already improvising sensor-to-shooter networks, combining fiber-optic first-person view (FPV) drones, reconnaissance systems, electronic maps, radar, and mobile fire teams to create effective but largely manual kill chains. Battlefield experience exposes major weaknesses in Moscow’s envisioned architecture. Fiber-optic drones cannot integrate into wireless networks, communications remain vulnerable to electronic warfare, and Russian forces lack a deployed alternative to satellite navigation. Russia’s greatest obstacle may be institutional rather than technological, as poor coordination between formations, incentives discouraging cooperation, falsified battlefield reporting, and personnel fatigue undermine the integrated command structure the FEC requires. The FEC represents an aspirational effort to replicate Ukrainian technological advantages, but organizational shortcomings make operational-scale deployment unlikely without improvements in integration, navigation infrastructure, decision-support systems, and battlefield reporting. – https://jamestown.org/russian-doctrine-designs-fire-strike-complex-its-own-army-is-assembling-by-hand/

Frontiers

WMO highlights digital advances in early warnings across five countries – The World Meteorological Organization (WMO) has published new findings on efforts to strengthen multi-hazard early warning systems in Bangladesh, Haiti, Liberia, Mozambique, and Somalia, highlighting improvements in observation networks, data exchange, forecasting, and digital warning infrastructure.  The work formed part of the Early Warnings for All initiative and focused on detection, observation, monitoring, analysis, and forecasting. In Mozambique, meteorological and hydrological staff received training on international observation and data-exchange systems, while digital platforms were developed to improve access to monitoring data, forecasts, and alerts. The project also supported Common Alerting Protocol (CAP) alerts and standard operating procedures, alongside work to improve data exchange through WMO’s WIS 2.0 system. – https://dig.watch/updates/wmo-digital-early-warnings-five-countries

 

Anthropic launches Claude Frontier Academy to train 10,000 AI engineers – Anthropic has launched Claude Frontier Academy, a USD 100 million initiative designed to train 10,000 Frontier Deployed Engineers (FDEs) by the end of 2027. The programme aims to address what the company describes as a growing shortage of people with the skills needed to move AI projects from experimentation to deployment within organisations. Engineers from companies including Accenture, Bain, Capgemini, Commonwealth Bank of Australia, Deloitte, McKinsey, Morgan Stanley, and Novo Nordisk are participating in the first cohorts. The academy’s first programme, the Frontier Deployed Engineer (FDE) Residency, combines in-person training with a 12-week placement in which participants lead a Claude-related project within their own organisation. Participants learn from Anthropic engineers, work through simulated enterprise deployments, and are assessed before receiving credentials. Anthropic said the programme is modelled on professional residency approaches in which practical experience forms a central part of training. – https://dig.watch/updates/anthropic-claude-frontier-academy