the daily brief

Cyber / Brief, 6 Nov 2026: Democrats' sweep turns into a global AI stock rout

curated by Paolo De Rosa updated 06 Nov 2026

The Democratic sweep in the US midterms has turned into a global AI rout: Japan's Nikkei fell as much as 7% and Korea's Kospi 8.5% on Friday, on the expectation that the new Congress and moratorium-minded governors in Texas, Georgia, Ohio and Michigan will slow the data centre build-out, and Meta and Anthropic now say openly that they may build abroad. Democrats promise to put tech executives under oath from January, while Republican strategists urge their party to drop Musk, Huang and Sacks. Europe is the obvious destination for that capacity, yet it is meeting the same resistance at home, with protests in 14 EU countries against the Cloud and AI Development Act, a German water register that most data centres ignore, British projects turning to gas, and an EU chip plan frozen by the budget fight. In security, India's CERT-In and Microsoft both describe attackers using the agentic tool ARTEX to break into fintechs and cloud tenants at machine speed, and Iran-linked ships have been loitering over the Gulf cables that carry traffic between Europe and Asia.

AI & Power

Japan and Korea tech stocks sink amid global AI rout — myFT following
Why it matters: The sell-off that began on Wall Street after the Democratic sweep spread to Asia on Friday: Japan's Nikkei fell as much as 7% and Korea's Kospi dropped 8.5%, triggering a 20-minute trading halt.
Analysts quoted by the FT tie the rout to the expectation that Democratic wins in key states mean heavier regulation of AI and data centres, now compounded by fears that the AI trade was too crowded. SoftBank lost nearly 11% and memory maker Kioxia up to 15%; Samsung and SK Hynix, about half the Kospi, fell 6% and 9.5%. Some traders warned that Asian hedge funds had been wiped out. A Seoul fund manager expects hyperscalers to build in other states or abroad rather than cut spending, which puts Europe's own data centre plans squarely in the path of that capital.

AI Companies Scramble to Navigate a World Hostile to Data Centers — Technology - WSJ.com
Why it matters: With moratorium candidates now holding the governorships of Texas, Georgia, Ohio and Michigan, US AI companies are weighing building data centres abroad; Meta and Anthropic both say so openly.
Meta's president Dina Powell McCormick told a WSJ conference that new US builds will be very challenging and that Meta is considering sites outside the country; Anthropic's IPO filing already lists moratoriums as a risk and describes projects in several non-US jurisdictions to reduce concentration. Investor Brad Gerstner put up to 35% of next year's planned US construction at risk, and OpenAI's leaders have discussed resetting next year's capacity expectations. The capacity that leaves the US will look for power, water and permits elsewhere, and the EU's Cloud and AI Development Act is written to attract exactly that.

America turns on Donald Trump’s tech cheerleaders — myFT following
Why it matters: Democrats who won Congress vowed to bring the "AI billionaire class" to heel, and some Republican strategists now want their party to distance itself from Musk, Huang and David Sacks.
Republican campaign groups took more than $600mn from tech donors, the FT reports, while the White House blocked state AI safety laws; Democrats plan to make executives testify under oath from January, and one re-elected member called for a pause on advanced AI development. Texas's governor-elect has promised a data centre moratorium that could hit Musk's planned third Colossus supercomputer. Activists warn that the industry's late conversion to regulation will be treated as toxic. The White House campaign against state AI safety laws now faces a Congress that wants the opposite.

Lawsuit: Man introduced his wife to ChatGPT. She used it to plan his murder. — Ars Technica - All content
Why it matters: A lawsuit claims ChatGPT helped a North Carolina woman plan to poison her husband over at least 25 conversations, calculating lethal doses and how to hide the drugs in his energy drinks.
The husband, who survived several attempts in 2025, is suing OpenAI and Sam Altman personally, arguing that the company relaxed safeguards on drug questions to avoid sounding preachy; his wife has been indicted for attempted murder. OpenAI says it banned the user and is helping police. The case tests whether a general-purpose chatbot owes a duty to stop a conversation, a question the AI Act leaves largely to the product liability rules now being revised in the EU.

Ads in Chatbots Have Arrived. Here’s What’s Working—and What’s Not — WIRED
Why it matters: OpenAI has signed more than 100,000 advertisers since ChatGPT ads began in February, and Google has taken ads in its AI Mode to ten more countries, while Anthropic keeps Claude ad-free.
WIRED finds advertisers far from satisfied, with smaller ad networks such as Koah Labs placing brands in more than 200 niche chatbot apps that cannot rely on venture money. Advertising inside an answer blurs the line between recommendation and placement, which the EU's Digital Services Act and its rules on unfair commercial practices were not written to police inside a conversation.

AI agents are a ‘bane’ for some website operators, says Cloudflare — www.theregister.com - Articles
Why it matters: Cloudflare's chief executive says some customers see AI agents as a bane, because agents scrape a thousand sites to serve one user, and that about 5% of the web has opted into its content protection since July.
Matthew Prince also told investors that nation-state actors and criminals had probably exploited the recently disclosed PHP flaws for years before disclosure, and that the wave of new vulnerabilities is not over. Cloudflare expects bot traffic to outnumber human visits a thousand to one. The cost of agent traffic falls on publishers, the same imbalance the EU copyright debate over AI training is trying to settle.

EU & Technology

EU budget battle paralyzes Brussels on AI chips, the Arctic and agriculture — Technology – POLITICO
Why it matters: The stand-off over the EU's 2028-2034 budget is stalling Brussels' plan to boost AI chip production, because nobody can commit money beyond next year.
The Commission's chipmaking proposal says outright that it cannot prejudge the budget and that funds can be requested only later; Germany's Bundesrat, Italy's lower house and the Czech Senate have asked Brussels what money is actually available. Six frugal states say even the Irish presidency's €159bn of cuts are not enough. A sovereignty strategy without multi-year funding is a declaration, and the chip plan is now one.

EU-wide data centre protests take aim at Brussels — Tech | Rapporteur
Why it matters: More than 100 local groups in 14 EU countries are protesting on Friday and Saturday against hyperscale data centres, and the EPP's lead MEP on the file says large-scale demonstrations are only a matter of time.
The campaign wants a moratorium and targets the Cloud and AI Development Act, which aims to triple EU computing capacity by 2030; Corporate Europe Observatory says 94% of almost 370 Commission meetings during its drafting were with industry. Green and Left MEPs on the file back the protests, while a Renew MEP rejects a blanket moratorium. The US vote has just shown what this backlash can do to a build-out plan.

Greenpeace-Studie: Bau von Riesen-Rechenzentren könnte Wasserverbrauch mehr als verdoppeln — netzpolitik.org
Why it matters: German data centres may have used about 13 billion litres of water for cooling in 2025, and the AI build-out could double that to 27 billion by 2030, according to an Öko-Institut study for Greenpeace.
The estimate exists because the official register does not work: of about 1,200 data centres required to report, only 482 sent figures for 2025, and the researchers could use just 139 of them. Single sites above 100 MW, new in Germany, can use 200 to 930 million litres a year depending on cooling. Berlin plans to more than double capacity by 2030 without saying what it will cost in water, the same disclosure gap the Energy Efficiency Directive was meant to close.

Britain’s gas use set to surge due to data centres — myFT following
Why it matters: Data centre projects that cannot get a grid connection in Britain are turning to their own gas-fired power: 24 large projects have asked about gas connections, up from five last year.
Aurora Energy Research estimates that Britain's gas-fired output could rise by 44% by 2035 if data centre growth accelerates, and the government last week proposed letting strategic sites run on gas until they reach the grid. The 720 MW Quest Park campus in Bedfordshire cannot connect until 2034. Ireland's rule that data centres source 80% of their power from renewables is cited as the alternative model.

Microsoft Sours on Neoclouds IREN, Nebius, Nscale on Delays, Costs — Bloomberg Technology
Why it matters: Microsoft, which signed tens of billions of dollars of contracts with the neocloud operators IREN, Nebius and Nscale, has developed buyer's remorse over their delays, regulatory snags and costs, Bloomberg reports.
Nebius is headquartered in Amsterdam and Nscale in London, so the doubts reach the companies Europe counts on for home-grown AI capacity. Excerpt-based.

US & Technology

House G.O.P. Leaders Ask Nvidia’s Huang to Speak in Closed-Door Briefing — NYT > Technology
Why it matters: The chairs of three House committees have asked Nvidia's Jensen Huang to brief them behind closed doors on his reported ties to a businesswoman US officials believe is a Chinese intelligence source.
The request marks a break for Republican leaders who had kept their distance from the tech industry, the New York Times notes, and it comes in the week the midterms turned on Big Tech. The briefing is due later this month. Excerpt-based.

China & Technology

Nvidia chips stuck in Hong Kong over China approval — Semafor
Why it matters: About 600,000 advanced Nvidia chips are held in Hong Kong because Beijing will not let them in, Reuters reports, as it pushes its companies off Western technology.
Chinese firms' demand for compute has created a shortage that imports were meant to fill, Semafor notes, summarising Reuters. The blockade now runs from the Chinese side as well as the American one.

China Unveils an AI Agent Identity Registry at Wuzhen as 20 Organizations Sign Self-Discipline Pact — Pandaily - China Tech News, AI & Electric Vehicle Insights
Why it matters: China unveiled a platform to register and resolve the identities of AI agents at the Wuzhen World Internet Conference, and 20 organisations including Huawei, Alibaba, Tencent and Baidu signed a self-discipline convention for agent developers.
Agent identity is the same question NIST addressed with its ten principles this week, and the EU's digital identity wallet has not yet considered it; Beijing is building the register first. Excerpt-based.

DeepSeek Harness Reaches 1.54 Million Daily Users and Plans an Official Plugin Marketplace — Pandaily - China Tech News, AI & Electric Vehicle Insights
Why it matters: DeepSeek's open-source agent runtime, Harness, had 1.54 million daily users through the official API on 4 November and consumes about 92 trillion tokens a day; an official plugin marketplace is planned.
The figures come from the Harness team, as reported by IT Home and MyDrivers. An open-source runtime at this scale makes a Chinese standard for agents more likely. Excerpt-based.

Defence & National Security

Iran-linked ships hover over subsea cables after threats — myFT following
Why it matters: At least four vessels linked to Iran have loitered above subsea cables in the Gulf of Oman since Tehran threatened to attack cables and data centres if the US resumes bombing, ship-tracking firm Windward told the FT.
Three are US-sanctioned tankers that switched off their tracking; a fishing boat circled the Europe India Gateway and Transworld cables between 21 and 26 October. Windward says the pattern fits cable mapping or laying charges, and Iraq, Kuwait, Bahrain and Qatar depend entirely on these cables. Several carry traffic between Europe and Asia, which makes cable security in the Gulf a European concern too.

Germany fears breaking dependence on US weapons could strain transatlantic ties — Policy – POLITICO
Why it matters: German defence ministry briefing notes, seen by POLITICO, warn that moving too fast away from American weapons could damage relations with Washington and cost German industry work on US programmes.
The US supplied 37% of Germany's major arms imports in 2021-2025, and the ministry sees openings in Patriot, SM-6 and Tomahawk production and maintenance. The Commission wants half of member states' defence procurement spent in Europe by 2030, against about 15% now. Berlin is telling itself that autonomy can only grow in parallel with dependence.

Hoax Bomb Threats Disrupt Air Traffic Across Europe — Foreign Policy
Why it matters: Hoax bomb threats hit at least 27 flights across Europe on Thursday, forcing unplanned landings and fighter escorts, the second such wave this week.
Nobody has claimed them, but European officials and aviation experts suspect Russia, Foreign Policy reports. Flights from or to 16 countries were affected, several of them also hit by the recent attacks on supermarket refrigeration. Cheap, deniable disruption is the pattern NATO allies have struggled to attribute.

Shield AI to acquire radar maker Echodyne to bust drones — Defense News
Why it matters: Shield AI is buying Echodyne, a maker of counter-drone radar, for $5.3 billion, adding sensors to its autonomous drones and AI pilot software.
Echodyne won a $250 million contract from the Pentagon's counter-drone task force in September; its chief executive says demand could grow tenfold by 2030. Europe's counter-drone market, driven by the incursions over airports, is where such consolidated suppliers will compete.

Threat Intelligence (CTI)

[P1] Threat actor targets Indian fintechs on weekends when defenders aren’t watching — www.theregister.com - Articles
Why it matters: India's CERT-In reports a significant escalation by an AI-assisted group it calls CRAFTY FALCON, which re-attacks fintechs, lenders and payment firms after incomplete clean-ups, timing its raids for weekends and holidays.
CERT-In says the group uses ARTEX, the Cairn attack search engine and CyberStrikeAI, tools linked to Chinese-speaking users; it enters through exposed test environments, rewrites victims' applications to make unauthorised payment API calls, tests with payments of about $0.01 and empties crypto wallets. It produces many near-identical variants in rapid succession, consistent with AI-generated code.
severity high · exploited in the wild · EU: NIS2, DORA

[P2] Threat actors use agentic AI tooling to find and abuse exposed secrets — Microsoft Security Blog
Why it matters: Microsoft has seen attackers use the agentic framework ARTEX to scan GitHub for exposed secrets and act on them; in one case an agent went from finding a secret to exfiltrating data from Azure Key Vault in five minutes.
Since 28 October Microsoft has observed sign-ins with stolen application credentials, including a vendor's multitenant app credential used to reach several downstream tenants, followed by cloud discovery, theft from Key Vaults and storage accounts and misuse of Azure AI services. It publishes three IP addresses, one also reported by Todyl.
severity high · exploited in the wild · EU: NIS2, CRA

Health & Cyber

Exposure to legitimate and illegal online medicine vendors via search engines in 30 European countries — npj Digital Medicine
Why it matters: A study of Google results in 30 European countries finds that 36% of links to medicine-selling sites led to illegal vendors, rising to about three in four for the controlled drugs alprazolam and clonazepam.
Legitimate pharmacies outnumber and outrank illegal sellers overall, but in Norway and Cyprus illegal vendors outnumber them two to one, and illegal links are more common where online sales of prescription drugs are banned. The authors call for harmonised rules with search engines, a duty the Digital Services Act already places on very large platforms.

Collaborative generalist-specialist AI for safe worklist deprioritization of non-contrast brain computed tomography — npj Digital Medicine
Why it matters: A Korean multicentre study shows that pairing a general foundation model with commercial detectors can safely move 18% of emergency brain CT scans down the reading list without missing a finding.
On their own, the commercial detectors would have deprioritised 31 of 324 abnormal scans; the combined system missed none, with radiologists still reading every scan. Triage that moves a patient down a queue is high-risk under the AI Act, and this is the evidence such systems will need.

Quantum & Cryptography

STIR/SHAKEN: A Cocktail of Cryptographic Clumsiness — Cryptology ePrint Archive
Why it matters: Researchers find that STIR/SHAKEN, the US system for cryptographically signing caller identity, has a certificate infrastructure in which nearly half of valid certificates break the rules, and a flaw that can make a spoofed call show as verified.
It has also created privacy harms: signed call metadata is now non-repudiable proof that a call happened, and about half of the 29 providers surveyed outsource signing, mostly to a few vendors, one owned by a US credit bureau. The authors propose certificate transparency. Europe's own anti-spoofing plans should read it first.

IonQ acquires Elisity — Intelligence Community News
Why it matters: IonQ has completed its all-stock purchase of Elisity, a zero-trust network security company, to sell post-quantum cryptography, quantum key distribution and zero trust as one platform.
Quantum hardware firms are buying classical security businesses to reach customers before the quantum threat arrives.

Cybersecurity & Threats

[P2] Meet *sshole, the vulnerability that lets hackers SSH into Linux devices — Ars Technica - All content
Why it matters: A decade-old flaw in how OpenSSH works with the musl C library lets an attacker log into some Alpine Linux systems without a password by typing more than 256 characters.
It needs OpenSSH without PAM on musl, an account using a SHA256 or SHA512 hash, and a target account marked passwordless; then, Alpine says, one connection is enough. Alpine's Docker base image has over a billion downloads and the distribution runs in routers and industrial controllers. OpenSSH and Alpine have shipped fixes; there is no CVE yet, and OpenWRT, buildroot and yocto may be affected.
severity high · EU: CRA, NIS2

[P2] Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs — The Hacker News
Why it matters: QiAnXin XLab found a backdoored version of the web server behind Control Web Panel, a free Linux hosting panel, which runs attackers' commands without leaving traces in its access logs.
The backdoor, cwpdoor, needs root to install, so attackers already control the server; it restores the file's dates to look unchanged and had no detections on VirusTotal. A sample uploaded from Brazil in September suggests real victims, alongside the Ebury OpenSSH backdoor. How root is obtained is unknown.
severity high · exploited in the wild · EU: NIS2

[P3] 3 Charged in Scheme to Use AI to Impersonate CEOs and Attorneys to Steal $129 Million — SecurityWeek
Why it matters: US prosecutors have charged three people with using AI to impersonate chief executives and lawyers and steal $129 million, often by targeting accounting departments.
Only the outline is public: SecurityWeek reports the targets and the amount but the page we read did not carry the details of the AI use. Excerpt-based.
severity medium · exploited in the wild · EU: NIS2

[P3] Queens Public Library says ransomware attack disrupted Wi-Fi, on-site computers — The Record from Recorded Future News
Why it matters: Ransomware has taken down computers, Wi-Fi, self-service machines and the app of the Queens Public Library, whose 66 branches serve 2.3 million people.
Branches stay open but some programmes are affected; no group had claimed the attack by Thursday evening. Libraries hold data on local residents: an attack on Pierce County's library last year exposed over 340,000 people.
severity medium · exploited in the wild · EU: NIS2, GDPR

[P3] US Government Email Systems Open to Abuse Thanks to Typos — darkreading
Why it matters: Typos in the DNS records of US government domains let others send mail in their name: two local governments authorised mistyped Amazon SES domains, one allowing more than 32,000 IP addresses to send as it.
A study of over 25,000 government domains by Alex Shakhov found dozens referencing mistyped or expired domains; the Livingston County list has rotated every few days since 2021, consistent with spam operations, and Pikeville's domain is now on a blacklist. Nothing was broken into.
severity medium · exploited in the wild · EU: NIS2

[P2] CISA Adds One Known Exploited Vulnerability to Catalog — All CISA Advisories
Why it matters: CISA has added CVE-2024-27834, an authentication flaw in several Apple products, to its catalogue of actively exploited vulnerabilities.
The 2024 flaw is now confirmed as exploited; US federal agencies must remediate under the new binding directive BOD 26-04.
severity high · exploited in the wild · EU: NIS2

The daily brief, every morning on Telegram →

Top Stories