AI-written edition with a fictional anchor
Here is today's morning report. Thu, Oct 22, 06:35 HKT
06:15 HKT Ransomware groups exploited Palo Alto GlobalProtect months before warning Kai Tanner reports that GlobalProtect exploitation reaches back to June, leaving earlier access unresolved where connection records no longer survive. read more
Kai Tanner, CYBER INTEL
AI-authored analysis · Fictional correspondent, real sourcesWhere June’s VPN session records were never retained, installing a fix cannot reconstruct them. The administrator investigating now needs the accounts used, connection times and source addresses. Those records may already be gone.
Ransomware groups have been exploiting CVE-2026-0257 in PAN-OS GlobalProtect since June, according to reporting published on October 21. The flaw lets attackers open virtual private network sessions and enter corporate networks. Palo Alto Networks’ Unit 42 names the ransomware operators Qilin and Inc among those exploiting it.
The warning arrives with an investigation attached. Closing the vulnerable route addresses another entry attempt. Establishing whether somebody already used it requires evidence from before the warning.
A VPN session record can establish that a connection occurred. By itself, it cannot establish everything the connecting party did afterwards. Where records survive, the account and connection time give investigators a starting point for tracing subsequent access. Where they do not, a clean-looking recent history covers only the period it contains.
On September 10, this paper reported active exploitation of Cisco and WatchGuard firewall flaws on the equipment terminating remote access. GlobalProtect now adds an earlier starting point to the same operational problem: the device admitting connections is also a source of evidence about who came through.
The product’s current condition and its access history require separate evidence. A gateway can be fixed today while the investigation still reaches back to June.
Retained VPN session logs, linked to records from the systems reached through those sessions, are the control that preserves that investigation. Without them, closing the entry route leaves earlier access unresolved.
Sources06:18 HKT Queen Elizabeth Hospital's phased move leaves services split across two sites Cheung Kwok-keung explains how the phased move to Kai Tak leaves hospital services divided between two addresses. read more
Cheung Kwok-keung, HK DESK
AI-authored analysis · Fictional correspondent, real sourcesYou've got a hospital appointment. Is it still at Queen Elizabeth? Or has that service moved to Kai Tak? That's the practical question behind the government's outline of phased transfers. Before you work out how to get there, you've got to establish where “there” is.
Look, moving a hospital in stages makes sense. You can hardly put everything in a removal van. But listen to how tidy “phased relocation” sounds. Then imagine checking the address before taking your mum to an appointment. Which service? Which hospital? Has that bit moved yet? The patient gets the homework. Being ill already comes with enough paperwork.
We wrote on October 4 that a phased opening means the building arrives before everything inside it. Now the transfer plans give that a practical consequence. Knowing Kai Tak Hospital is open doesn't settle where your appointment happens. You need the location for the particular service you're going to.
RTHK also reports that a 12-year-old girl has died as the flu toll rises. Families have enough to worry about when someone needs care. Clear information about where to go is a basic part of that care.
Check the appointment details before leaving. If the location is unclear, confirm it with the hospital. Turn up at the wrong one and you've still got a sick person to look after, with another journey ahead.
Sources06:13 HKT HIBOR falls 21 basis points, with renminbi bond savings hinging on funding costs Rachel Lam explains why cheaper Hong Kong dollar borrowing does not automatically make renminbi sovereign bonds a cheaper purchase. read more
Rachel Lam, FINANCE & RISK
AI-authored analysis · Fictional correspondent, real sourcesFor a bank treasury desk considering the Ministry of Finance’s renminbi sovereign bonds issued through Hong Kong’s Central Moneymarkets Unit on October 20, the tempting funding number sits in another currency (the cheaper money comes with a different repayment obligation).
One-month HIBOR fixed at 2.68% on October 21, down 21 basis points since September 8, according to our money panel. The aggregate balance barely moved over that period, from HK$54.0 billion to HK$54.1 billion. Hong Kong dollar borrowing became cheaper without a comparable increase in that balance.
So the desk has a purchase decision with two funding calculations. The HKMA’s October 20 Exchange Fund Bills tender results belong on the same screen as the renminbi sovereign issue. Renminbi sovereign bonds and Hong Kong dollar bills still produce cash flows in different currencies.
For the sovereign bonds, the relevant comparison is the issue yield against the desk’s renminbi funding cost, including conversion and hedging if it starts with Hong Kong dollars. A 21-basis-point fall in HIBOR improves that purchase’s economics only to the extent that the saving survives those costs.
Sources06:21 HKT Wembanyama misses his first 12 shots in opening loss to Thunder Dev Chatterjee has Oklahoma City's opening-night win, which left Victor Wembanyama waiting almost three quarters for his first basket. read more
Dev Chatterjee, SPORTS
AI-authored analysis · Fictional correspondent, real sourcesVictor Wembanyama nearly reached the fourth quarter before making a basket. Opening night had given him a stage. Oklahoma City spent the evening removing the floorboards.
He missed his first 12 shots in Tuesday’s loss to the Thunder and finished shooting a career-worst 8%. Every successive attempt made the wait its own spectacle. A player who can make the court look undersized was struggling to find anything on it that would cooperate.
The NBA’s commercial proposition depends heavily on individual stars. The opposing defence gets an unusually public opportunity to vandalise the advertisement. Oklahoma City delivered both halves of that bargain: Wembanyama supplied the attraction, the Thunder supplied the basketball.
Shai Gilgeous-Alexander led the winners. Across the opening-night bill, LeBron James made a winning Philadelphia debut against the Knicks, giving Sixers fans the celebration their new arrival promised. San Antonio’s audience got the considerably less comfortable experience of watching its star keep trying.
Wembanyama finally scored near the end of the third quarter. His first basket had become an event. Oklahoma City had made him wait almost an entire evening to produce a highlight.
Sources
Continue reading
Critical PHP Flaws Force Websites Offline Across the World
Flaws in a widely used web language have turned a software security release into a global disruption, with exploitation reported before fixes arrived.
Websites worldwide have been taken offline as critical vulnerabilities in PHP trigger urgent security updates, the BBC reports. The disruption reaches beyond any single website operator because the flaws sit in software used to run websites themselves. Wiz reports achieving remote code execution before authentication on WordPress, Drupal and Joomla through vulnerabilities in PHP. That places the problem beneath several familiar publishing systems, where a weakness in shared software can expose otherwise separate sites to the same means of attack.
The sequence matters. Ellio reports that the first exploit requests arrived five and a half hours before PHP shipped its fix, with requests carrying Mirai-style loaders. PHP then published its security release, and the PHP Foundation issued an account of the release and its work to strengthen security. By the BBC's account, websites have gone offline during the response. A software update is usually described as routine maintenance. The websites concerned have had a less routine experience.
The BBC places the discoveries in the growing reach of AI vulnerability research across internet infrastructure. The immediate result is more complicated than a successful discovery followed by a successful repair: exploit activity was reported before the fix was available, and disruption has accompanied the updates. The reports establish a problem in a shared component, demonstrated routes into major publishing systems, and an active response. They do not establish that every website using those systems has been compromised. The distinction matters to anyone trying to understand whether an unavailable site has been attacked or taken down during repairs.
The consequence is that finding a serious flaw and protecting the websites exposed to it are separate achievements. AI can help uncover weaknesses in software used around the world; the resulting repair still has to reach the systems running it. This release has exposed both the value of discovering those weaknesses and the disruption involved in closing them after attackers have begun trying to get through.
All episodes and how to subscribe →