AI-written edition with a fictional anchor
Here is today's evening report. Sat, Oct 17, 18:08 HKT
13:00 HKT AOMEI Backupper update servers served backdoors, then legitimate files Rachel Lam explains what compromised backup software means for Hong Kong banks, where a successful recovery job cannot establish trust. read more
Rachel Lam, FINANCE & RISK
AI-authored analysis · Fictional correspondent, real sourcesAttackers replaced files on AOMEI Backupper’s own update servers for five to ten minutes at a time between May and July 2026, Kai Tanner reports today (the correct download address was helpfully supplying the wrong file).
An administrator could fetch the backdoor from the expected server. A later check could find the legitimate file restored. The address and the subsequent inspection could both look right.
So a successful backup job leaves an awkward question unanswered: can the program entrusted with recovery itself be trusted?
Cheung Kwok-keung’s filing on the October 15 banking scam alert supplies the customer-facing version of that problem. A convincing login screen can solicit credentials. The alert says banks do not send transaction links by SMS or email. In Tanner’s story, even the genuine delivery channel had been compromised.
For a Hong Kong bank, the relevant supervisory home is HKMA’s Banking Supervision Department, including its operational and technology risk division. SPM TM-G-1 covers institution-wide technology risk and IT controls. SPM TM-G-2 covers recovery strategies and testing. The public scam alert changes no supervisory obligation.
Neither filing establishes that a Hong Kong bank used the affected software. The consequence is in what recovery evidence can establish: a completed job records an operation; it cannot, by itself, establish the integrity of the program performing it.
Under SPM OR-2, banks were required to be operationally resilient by May 31, 2026. That expectation is already in force, including when the recovery software reports success.
13:05 HKT Philippines protests Chinese envoy's threat of force over disputed waters Mei Chen reports on Manila's protest over the Chinese ambassador's remarks, and the consequences for Philippine crews in disputed waters. read more
Mei Chen, GEOPOLITICAL
AI-authored analysis · Fictional correspondent, real sourcesBeijing is claiming the authority to decide where Philippine vessels belong, then describing enforcement of that decision as protection.
The Philippines has protested remarks by China's ambassador, its diplomatic representative in Manila, as a thinly veiled threat of force over the South China Sea dispute. The threat gives the territorial argument an immediate recipient: the Philippine crew expected to comply.
Beijing says the disputed islands and reefs fall outside Philippine territory. That assertion supplies the authority Beijing claims for its actions. Accept the premise and a Philippine vessel becomes an intruder before its crew has done anything except arrive.
Beijing describes China's measures as safeguarding sovereignty and maritime rights. Protection, in that account, includes deciding whose presence requires enforcement.
On October 12, this paper described Philippine crews facing encounters that Manila and Beijing explain under different rules. The ambassador's remarks carry that disagreement forward: Manila's objection now concerns a threat as well as a competing claim.
If Beijing enforces that claim through force, a Philippine crew will have to choose between leaving waters its government claims and facing the threatened action.
Continue reading
Trump Temporarily Waives Sanctions On Russia Amid Ukraine Rift
Washington's easing of pressure on Moscow leaves Ukraine seeking greater European support even as its remaining American assistance faces fresh uncertainty.
Congress imposed sanctions on Russia. President Trump has now temporarily waived them, the BBC reports, easing pressure on Moscow as his dispute with Ukraine's president intensifies. The change gives Russia relief through an American presidential decision, with Ukraine still fighting to sustain its war effort. Temporary describes the waiver's duration; it does not make the relief any less real while it applies. Washington has found something it can offer Moscow, at a moment when Kyiv is asking its allies for more.
This morning's edition led with Volodymyr Zelensky's request for another $79 billion from European Union leaders next year. Trump's waiver changes the context of that appeal. Ukraine is seeking additional European resources while the United States relaxes a measure intended to put pressure on Russia. These are distinct decisions, but they affect the same war: one concerns the support available to Ukraine, the other the constraints applied to its opponent. The request to Europe now carries a sharper political implication alongside its financial size.
The strain also extends beyond sanctions. The New York Times reports that the worsening Trump-Zelensky relationship threatens operational assistance Ukraine still receives from Washington, raising concerns for Kyiv and its European allies. That assistance has not been reported here as withdrawn. The distinction matters: a threat to support is not a completed cutoff, just as a temporary waiver does not establish that all sanctions have disappeared. Even within those limits, the direction is consequential. Presidential relations are becoming a source of uncertainty for assistance that serves an ongoing military purpose. Diplomacy apparently comes with a personal compatibility requirement.
The waiver means American policy is easing pressure on Russia while American support for Ukraine becomes less certain. Europe's funding discussion therefore concerns more than the size of another contribution. Ukraine needs resources to continue fighting, but it also needs allies whose decisions reinforce that support. More European money could strengthen Ukraine's position; it cannot by itself restore consistency to Washington's policy.
All episodes and how to subscribe →