AI-written edition with a fictional anchor
Here is today's morning report. Sat, Oct 17, 07:06 HKT
06:48 HKT AOMEI Backupper update servers served backdoors for five to ten minutes Kai Tanner explains how brief substitutions on AOMEI's update servers left the correct download address delivering an attacker's backdoor. read more
Kai Tanner, CYBER INTEL
AI-authored analysis · Fictional correspondent, real sourcesA successful backup job cannot establish the integrity of the program running it.
Attackers repeatedly replaced files fetched by AOMEI Backupper from the vendor’s own update servers between May and July 2026. Each substitution lasted five to ten minutes. The download came from the expected address. The file available later could be the expected file too.
An administrator checking both could miss the delivery entirely.
The vendor address is supposed to help establish where an update came from. Here, attackers used that address to deliver a backdoor. The administrator could reach the correct destination and receive the attacker’s file.
That matters particularly in backup software. A recovery process depends on the program reading and restoring the saved data. A completed job establishes that the operation ran; it leaves the integrity of that program unanswered.
Elsewhere, attackers are exploiting CVE-2026-110447, a command execution flaw in Nextcloud’s Collabora Online built-in CODE Server app, to backdoor Nextcloud servers. Restoring a compromised server puts the backup program in a position of considerable trust. The AOMEI incident gives that trust its own verification problem.
An update signature checked against a separately protected signing key would make control of the download server alone insufficient to substitute executable code. Whether that check protected the affected downloads is not established here.
The brief substitutions also determine where useful evidence must survive: in records of the earlier download or on the machine that received it. A clean inspection of the update server later cannot settle what the administrator’s machine downloaded earlier.
Sources06:42 HKT Hong Kong police arrest two over six break-ins costing victims HK$1.7 million Cheung Kwok-keung reports on arrests over six Kowloon break-ins, with victims' reported losses reaching HK$1.7 million. read more
Cheung Kwok-keung, HK DESK
AI-authored analysis · Fictional correspondent, real sourcesFinishing that Granville Road fight video earns you absolutely no neighbourhood-watch qualifications. You can replay the grappling. You can decide who looks toughest. You can give your verdict with enormous confidence. At least five men appeared in the footage shared online on October 16. That gives you plenty to look at. It tells you very little about what else has happened around Kowloon.
Police have arrested two men over alleged involvement in at least six break-ins. The reported losses total HK$1.7 million across three months. For the people burgled, the trouble comes with no replay button. Something that belonged to them has gone. Knowing somebody has been arrested cannot, by itself, fix that.
The fight footage makes being informed feel wonderfully easy. Watch the clip, inspect the punches, become the district's unpaid security consultant. Burglary spoils that comfortable little routine. A street can produce a video everyone discusses while residents elsewhere are dealing with losses nobody can understand by watching it.
The arrests are welcome news. But a missing possession stays missing until somebody gets it back.
06:36 HKT HKMA's renminbi bond buyers face conversion costs when funding in Hong Kong dollars Rachel Lam explains why Hong Kong dollar funding rates cannot establish the cost of buying the government's renminbi bonds. read more
Rachel Lam, FINANCE & RISK
AI-authored analysis · Fictional correspondent, real sourcesThe two-year government bond reopening announced by the HKMA on October 15 comes with a currency designation that matters more to the treasury dealer than the government name on the instrument (Hong Kong can issue the bond without making it a Hong Kong dollar asset).
The tender is on October 22. It is denominated in renminbi. The ten-year Hong Kong dollar reopening is on October 21. Those adjacent dates put different funding calculations on the same desk.
So the cheaper funding number on our screen needs its currency attached. The Wang Report’s money panel recorded one-month HIBOR at 2.71% on October 16, down 13 basis points from September 4. That measures Hong Kong dollar funding. It supplies no renminbi borrowing rate for the dealer pricing the October 22 purchase.
A desk using Hong Kong dollars would also have to price the currency conversion and any hedge. The available HIBOR fixing alone cannot establish its cost of holding the bond.
On October 22, the tender will put a price on two-year renminbi government debt. The buyer’s funding calculation has to close in renminbi too.
Sources- 06:52 HKT Street Fighter heads for $30 million opening at low end of expectations Joy Lee has Street Fighter's opening estimate and Hollywood's continuing discovery that corporate consolidation cannot purchase an audience.
Continue reading
Zelensky Asks Europe For Another $79 Billion
Ukraine's appeal puts a larger bill before European allies just as deteriorating relations with Washington threaten the operational support money alone cannot replace.
Volodymyr Zelensky has asked European Union leaders for another $79 billion next year to sustain Ukraine's war effort, the South China Morning Post reports. The request puts a figure on the support Kyiv is seeking from Europe. It arrives alongside a more difficult problem: the New York Times reports that his deteriorating relationship with Donald Trump threatens American operational support. European allies already helping sustain Ukraine now face uncertainty about what Washington will continue to provide.
The sequence matters because Ukraine's need for support has not disappeared with battlefield progress. The BBC reports that Ukrainian forces are regaining territory in the Donbas through Operation Vivaldi, with help from Starlink. Those gains show that Ukraine can still advance with outside assistance. They do not establish that the assistance will remain available. The worsening relationship with Trump therefore clouds an operation in which external support is already contributing to results on the ground.
Zelensky's appeal brings the financial part of that uncertainty directly to Brussels. Another $79 billion is a request for European governments to commit more resources to sustaining the war next year. But the American support described by the Times is operational, which makes this more than a question of dividing a larger bill among allies. The reports establish neither a complete American withdrawal nor a European agreement to meet the request. What has changed is the pressure on Europe to consider a larger commitment while the reliability of another major contributor is in doubt.
For Ukraine, the military and diplomatic developments lead to the same conclusion: territorial gains still depend on support whose continuation Kyiv cannot decide for itself. Europe is being asked to provide more money while uncertainty grows over American operational assistance. A European funding commitment could help sustain the war effort, but it would not, by itself, settle what happens to that American support. Ukraine's progress on the battlefield has made the value of assistance visible. Its diplomacy exposes how conditional that assistance remains.
All episodes and how to subscribe →