Iran Hits US Base, Claims Submarine Capture

The rootkit found inside F5 BIG-IP Access Policy Manager environments does not write files. It hooks the PHP file-loading process and injects a fileless web shell straight into memory, which means every disk-based integrity check a bank runs against its BIG-IP estate this week will come back clean. That is not a design flaw in the detection tooling. It is the design goal of the rootkit.

Hong Kong and Singapore banks running BIG-IP APM as their access-control front end sit inside the scope of the HKMA's Technology Risk Management guideline, which assumes periodic configuration and integrity reviews catch drift. A review that only reads disk state now misses the compromise entirely. The check that would have caught this is memory forensics on the APM host, not a file hash comparison, and few TRM audit programmes currently ask for one.

Pair this with Tuesday's Patch Tuesday load: Microsoft shipped fixes for 974 flaws, two already under active exploitation, the same week CISA moved N-able N-central's pre-authentication remote-code-execution bug into its Known Exploited Vulnerabilities catalog. Patching cadence is not the control that stops the F5 rootkit. Runtime memory inspection on internet-facing access infrastructure is, and it belongs on the audit list before the next TRM review, not after an incident report explains why it wasn't there.

Iran's threat of "economic warfare" against the United States this week ran through the Strait of Hormuz. The PBOC's open-market desk watches a narrower channel: the price of Brent when Chinese refiners settle their October term contracts, since Sinopec and PetroChina carry roughly half their crude on long-term deals priced off a basket that moves when Gulf shipping risk repricing hits the spot benchmark, and a sustained move above 90 dollars a barrel forces the State Administration of Foreign Exchange to choose between defending the yuan's crawl against the dollar or letting import costs pass through to a producer price index that has been negative for three straight quarters.

The August financing, a follow-on to the 360 billion yuan tobacco-funded package the finance ministry ran through China Reinsurance and the big state lenders last week, or, more precisely, the mechanism the ministry is now testing is whether it can route a second tranche through the National Council for Social Security Fund without booking it as new sovereign debt, matters because SAFE's reserve managers hold roughly 3.3 trillion dollars in mostly dollar assets that would normally absorb an oil-price shock through valuation gains. If Beijing needs the social security fund's balance sheet to backstop banks at the same moment Hormuz risk pushes import costs up, the PBOC's foreign currency desk has until the September MLF rollover to decide whether reserve deployment defends the yuan or subsidizes the rescue. It cannot fund both from the same account.

Look, $45 billion in fresh capital for banks and insurers is not what you inject when the problem is capital adequacy. China's large state banks have been running core tier-1 ratios north of 12 percent, comfortably above the 8.5 percent regulatory floor for systemically important lenders. So this is not a solvency patch. It is a directive dressed as a recapitalization, aimed at loan books that have been shrinking anyway (corporate lending demand has been soft enough that banks were parking cash in the interbank market rather than pushing it out the door). The insurers get folded into the same package because their asset side holds the same problem: too much of the float sitting in government bonds, not enough moving into equities or credit.

For the HKEX-listed banks and insurers that report H-share results against this backdrop, the injection reads as a floor under earnings estimates, not a ceiling on risk. A trading desk pricing mainland financial names into late September has to run the assumption that loan growth targets get hit whether or not the credit is genuinely wanted at the borrower end, and that provisioning lines absorb the difference. The number to watch is the December year-end NPL ratio disclosure, when the capital either shows up as loans on the books or sits idle and reveals the demand problem was never about capital at all.

Nine months. That's how long it took the Buildings Department to go from "we are investigating" to actually charging anyone over Wang Fuk Court. Today the department laid 259 charges against project consultants. Not the developer's name in lights, not a press conference with tears. Two hundred and fifty-nine separate charge sheets, filed on a Wednesday, against the engineers and consultants who signed off on the building.

168 people died in that fire, and 79 were injured.

Here's the thing about 259 charges. That's not one big case, that's every corner they could find something wrong. Every inspection report, every sign-off, every "yes this is fine" that maybe wasn't. It tells you the fire wasn't one bad decision, it was a lot of small ones stacked up until the building couldn't survive a fire it should have survived. For the families still in temporary housing, it's proof somebody was finally doing the maths instead of just doing the ribbon-cutting.

The Kang Kon carries 104 missile cells across five configurations, eight inclined amidships launchers and eight short-range tubes, and North Korea commissioned it this week to coincide with the start of joint US-Japan-South Korea drills. Kim Jong Un did not schedule the ceremony around the drills by accident. A second nuclear-capable destroyer entering service during an allied exercise is not deterrence theater aimed at deployed ships; it is Pyongyang telling Washington, Tokyo and Seoul that its naval buildup now runs on its own clock, not theirs. The same week, Beijing and Moscow sent anniversary messages to Kim reaffirming what state media called strategic ties, the first joint signal of its kind on the Korean Peninsula register this year.

What changes if that read holds: the next allied drill cycle will have to plan against a North Korean surface fleet that can shadow it in real time, and Beijing's public alignment with Pyongyang removes the option of treating Chinese pressure on North Korea as a lever Washington can still pull.

Luka Doncic spent the summer in Slovenia building chemistry with a Lakers roster that looks nothing like the one he was traded into eight months ago, and he came back saying the quiet part out loud: this team is coming for a championship. Charles Barkley did him one better, comparing the retooled Lakers to the 2024 Dallas Mavericks, the team Doncic dragged to the Finals before the front office decided he was more useful to Los Angeles. The Lakers have spent the offseason rebuilding around him, and the guy who once made a conference finals appearance look inevitable is now saying the same thing about a franchise that has not been past the second round since he arrived.

Here is what the ceremony around this story keeps skipping: the Lakers did not get Doncic because Dallas miscalculated a max contract or fumbled a draft pick. They got the best player of his generation in his prime for what amounted to a challenge trade, and the roster now being built around him is the second act of that decision, not the first. Barkley's comparison to the Mavericks team that made the Finals is not nostalgia, it is a reminder that the Lakers are trying to buy back, with cap space and chemistry trips to Slovenia, the exact kind of run Dallas got for free and then gave away. Doncic is not warning the league. He is collecting on a debt the Mavericks wrote off eight months ago.