HKMA and HKUST Launch PQC Toolkit to Accelerate Banking Sector Transition by 2030

quantumcomputingreport.com Nov 8, 2026

HKMA and HKUST Launch PQC Toolkit to Accelerate Banking Sector Transition by 2030

Curated by Shubham · TechCapsules · Nov 8, 2026

AI-summarised brief · reviewed before publication

The Hong Kong Monetary Authority (HKMA) and the Hong Kong University of Science and Technology (HKUST) unveiled a Post‑Quantum Cryptography (PQC) Toolkit at the FiNETech 8 forum, creating an operational and supervisory framework for licensed banks to replace vulnerable classical public‑key encryption. The move follows a July 2026 baseline audit that gave Hong Kong’s banking sector a Quantum Preparedness Index (QPI) of 2.3 out of 10, prompting a target of a perfect 10.0 by 2030. Co‑developed by HKMA supervisors and HKUST faculty, the toolkit guides banks in inventorying public‑key dependencies in transaction engines, SWIFT gateways and hardware security modules, and provides templates for auditing third‑party vendors. Ongoing updates will align the framework with evolving NIST standards and supervisory best practices.

💡 Why It Matters

· By institutionalising a clear migration path, Hong Kong aims to safeguard its financial infrastructure against future quantum attacks before global standards solidify.

Read full article on quantumcomputingreport.com

QNu Labs Introduces Corporate Quantum-Safe Training Supported by National Quantum Mission

Bengaluru‑based quantum cybersecurity firm QNu Labs has launched a 12‑hour corporate training program through its QNu Academy, aimed at preparing enterprise security teams for quantum‑safe migration. Backed by India’s National Quantum Mission, the three‑day curriculum targets CISOs, network architects and risk officers, teaching them to assess cryptographic vulnerabilities and plan transitions against threats such as “harvest now, decrypt later.” Modules cover quantum communications, Quantum Key Distribution, Quantum Random Number Generation, Post‑Quantum Cryptography, asset inventory management and algorithm selection, using case studies from QNu’s deployments in Indian defence and banking networks. Instruction is co‑led by QNu engineers and faculty from IITs, NITs and IISERs, with participants earning an NQM‑certified assessment. The program is offered as on‑site workshops for 15‑50 professionals and half‑day executive briefings for senior management.

💡 It equips Indian enterprises with practical skills to safeguard data before quantum computers become capable of breaking current encryption.

thehackernews.com · Nov 6

Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on…

A newly disclosed OpenSSH flaw, CVE‑2026‑123158 (SSHole), allows attackers to authenticate to accounts with no password set on musl‑based Linux systems, including Alpine Linux, by supplying oversized passwords. The vulnerability stems from a 2016 patch that misinterpreted failed hash attempts as successful logins when the account’s password field contains an asterisk. Within nine hours of disclosure, threat actors achieved root access on an Alpine honeypot, demonstrating the flaw’s immediacy. Users must upgrade to OpenSSH 10.6p2 and review logs for unauthorized password acceptance.

💡 The rapid exploitation underscores the urgency of patching OpenSSH on musl‑based distributions, as the flaw grants attackers full account privileges without credential theft. Prompt updates and vigilant log monitoring are essential to prevent potential lateral movement and infrastructure compromise.

thehackernews.com · Nov 6

Installing the Fix for an Exploited WordPress Flaw Can Expose Some Sites…

WordPress sites can still be compromised while installing the patch for CVE‑2026‑119977, a flaw actively exploited in versions 4.7 through 7.1.3. Researcher Umut Bayram of Picus Security discovered that the updater unpacks the new package using the site’s existing, vulnerable code, creating a temporary wp‑content/upgrade folder that remains web‑accessible. An attacker who predicts the folder name can execute code, modify wp‑config.php and overwrite the live site before WordPress deletes the temporary copy. The fix, released in version 7.1.4 and back‑ported to older branches, randomizes the folder name, but the installation process itself still exposes the window. Bayram recommends blocking web access to wp‑content/upgrade or performing manual, off‑root updates. CISA added the vulnerability to its exploited‑vulnerabilities catalog after confirming active attacks.

💡 Because the updater runs vulnerable code before the patch is applied, routine updates can become a fleeting yet exploitable entry point, letting attackers seize control while administrators believe they are securing their sites.

thequantuminsider.com · Nov 6

ZeroTier Partners With Redapt to Deliver Post-Quantum Networking

ZeroTier announced a partnership with Redapt to embed its ZeroTier Quantum platform into Redapt’s infrastructure, cloud and managed‑service portfolio. The solution uses post‑quantum cryptographic standards ML‑KEM‑1024 (FIPS 203) and ML‑DSA‑87 (FIPS 204) to protect connectivity across data‑center, cloud and edge environments. Redapt will assess, design, deploy and manage the platform for enterprise clients while also providing cybersecurity advisory and virtual CISO services to ZeroTier. Both firms target sectors such as government, defense, finance and regulated gaming, offering a turnkey path to quantum‑resilient networking without redesigning existing architectures. ZeroTier Quantum, the first end‑to‑end quantum‑secure networking platform, incorporates the ZeroTier Transport Protocol with hybrid FIPS‑compliant post‑quantum encryption and perfect forward secrecy. The collaboration also includes joint go‑to‑market campaigns and shared support resources.

💡 Enterprises can now adopt quantum‑grade protection today, sidestepping costly network overhauls and mitigating long‑term data‑exfiltration risks.

thehackernews.com · Nov 6

Experts Demonstrate Barracuda Email Security Gateway Chain Enabling Root Access Without Login

Security researchers disclosed a two‑stage attack against Barracuda’s Email Security Gateway appliance that grants unauthenticated attackers root privileges without logging in. The chain combines CVE‑2026‑116606, an authorization bypass that lets a remote user restore a crafted configuration backup and alter global settings, with CVE‑2026‑111560, a command‑injection flaw that normally requires an admin account but is enabled by the bypass. Together they allow arbitrary root‑level commands on the gateway. Barracuda issued firmware patches on Monday, fixing the gateway in version 9.4.0.030 and updating five related products for the injection issue. Mandiant rated the bypass 9.3/10 and the injection 8.6/10. WatchTowr released a detection tool but no public exploit, and the vulnerabilities are not listed in CISA’s KEV catalog as of today.

💡 The exploit proves that even well‑protected email gateways can be compromised without credentials, forcing organizations to reassess firmware update policies and validation of backup mechanisms.

thehackernews.com · Nov 6

Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands…

Researchers at QiAnXin’s XLab discovered a backdoor embedded in the Control Web Panel (CWP) web server, a Linux hosting management tool. The malicious code, dubbed “cwpdoor,” replaces the legitimate cwpsrv binary for versions 1.15.10 and 1.24.0 and executes attacker‑supplied commands delivered via web requests that bypass access logs. Installation requires root privileges, indicating the attackers have already compromised the host. The backdoor masquerades as an update, restores file timestamps, and evades detection, showing zero hits on VirusTotal’s 63 scanners. A recent archive containing the payload was uploaded to VirusTotal from Brazil on September 30, suggesting active infections, though the exact number of compromised servers remains unknown. Researchers also noted the presence of the unrelated Ebury SSH backdoor in the same archive.

💡 The hidden backdoor lets intruders run commands without leaving traceable logs, giving them persistent, stealthy control over compromised Linux hosting environments.