IoM Crisis Daily Briefing #98 — Sunday 1 November 2026

Status: HIGH — Iran designates UK Royal Navy + RAF as terrorist organisations, MI6 as hostile group (EFE/TASS, Nov 1); US-Iran Doha talks continue via Qatari mediators — no direct talks yet, Iran sets 7 conditions, Khamenei orders forces ready; Russia launches 433-drone massive attack on Ukraine overnight (Pravda, Nov 1); Taiwan accuses China of harassing shipping with east coast patrol (Reuters, Nov 1); SPY -1.8%, 10Y 4.93%, oil $104 ELEVATED; European periphery selloff deepens (Italy -10.5%, France -10.1%); XREAL Aura ships mid-Nov (first Android XR glasses); Brotli RCE CVE still active in KEV; IoM Census deadline tomorrow Nov 2

1. Geopolitical Flashpoints

NEW: Iran designates UK Royal Navy, RAF as terrorist organisations; MI6 as hostile group

• Iran's Supreme National Security Council announced designation of UK Royal Navy and Royal Air Force as terrorist organisations, and MI6 as a "hostile group" (EFE/TASS/IRNA, 1 Nov)
• Iran's MFA: response to UK "hostile actions" during past year including participation in US-Israeli war against Iran by providing bases/facilities
• Reciprocal measure against UK's July 13 designation of IRGC as terrorist organisation under 2026 Law on State Threats
• MI6 classified under law "On Tightening Penalties for Espionage and Collaboration with the Zionist Regime and Hostile Countries"
• Risk: Direct UK-Iran escalation; IoM is Crown Dependency with UK responsible for defence and international relations — UK military assets in the region now formally designated by Iran

DEVELOPING: US-Iran Doha talks — Qatar mediation continues, no direct talks yet

• Iranian negotiators in Doha for talks with Qatari mediators following 12+ hours of discussions in Tehran on Friday (Reuters/The National/Al Jazeera, 1 Nov)
• FM Araghchi to Al Jazeera: Tehran has reached a plan with Qatari mediators; US dialogue offer is "a positive step" (Al Jazeera, 1 Nov)
• But Araghchi to Yeni Şafak: "no negotiations planned" — contacts continue with Qatar and Pakistan as mediators; direct vs indirect decision after US accepts Iran's conditions (Yeni Şafak, 1 Nov)
• VP Vance letter to Iran's security chief Mohsen Rezaei — Rezaei: "tone has completely changed, this is a good sign" but has not yet responded (The National, 1 Nov)
• Trump downplayed letter scope: concerned humanitarian assistance/medical supplies, not restarting peace negotiations (The National, 1 Nov)
• Iran's 7 conditions for Hormuz reopening: end hostilities, lift port restrictions, release frozen assets, reinstate oil sales waiver; Qatar requested reducing 7-day to 5-day implementation timeline (Yeni Şafak/The National, 1 Nov)
• Supreme Leader Mojtaba Khamenei ordered armed forces ready: "Any level or type of threat must be met with an immediate, impactful, and geographically unrestricted response" (Reuters/Times of India, 1 Nov)
• Rubio at G20 Atlanta: "Trump would prefer to solve it diplomatically. But... incredible confidence that if we needed to do something militarily, we would have the ability to do it" (Reuters, 31 Oct)
• Risk: De-escalation window narrowing; US midterms Nov 3; fears of post-midterm military strike; Hormuz mining still active; oil at $104

NEW: Russia launches 433-drone massive overnight attack on Ukraine

• Russian forces attacked Ukraine with 433 drones overnight 31 Oct–1 Nov — Shaheds, Gerbera drones, decoys (Ukrainska Pravda, 1 Nov)
• Air defence shot down or jammed 371 UAVs (47 jet-powered); hits recorded at 16 locations
• Russian airstrike destroyed Kramatorsk City Council executive committee building late 31 Oct (Ukrainska Pravda, 1 Nov)
• ~280,000 Ukrainian households left without power after Russian strikes on combined heat/power plant in Kyiv + 4 substations in Dnipro region (Zelenskyy/Euronews, 1 Nov)
• Russia lost 2,100 troops in past 24h per Ukrainian General Staff (ua.news, 1 Nov)
• Ukraine drone attack reported on Kstovo oil refinery (Lukoil) in Russia — one of Russia's largest (Euronews, 1 Nov)
• Risk: Largest drone barrage of war; winter energy campaign intensifying; G20 divisions limit diplomatic pressure

NEW: Taiwan accuses China of harassing shipping with east coast patrol

• China's Coast Guard harassing shipping with latest patrol off Taiwan's east coast, "trying to exert a fictional jurisdiction" (Taiwan Coast Guard/Reuters, 1 Nov)
• Taiwan sent its own ships to monitor; no direct confrontation reported
• Taipei Times (1 Nov): Xi's military purge has reduced risks of planned war against Taiwan but increased danger of accidental/miscalculated conflict
• ThinkChina (30 Oct): Beijing has not surged militarily in 2026 but deepened coercion campaign below threshold of war
• Risk: Grey-zone escalation continues; no imminent invasion but maritime harassment normalising

2. Markets & Sovereign Stress

Sovereign stress (yfinance, 1 Nov 09:00 GMT):

European periphery 3-month selloff DEEPENS:

• 🇮🇹 Italy EWI -10.5% ⚠️ | 🇫🇷 France EWQ -10.1% ⚠️ | 🇪🇸 Spain EWP -9.1% ⚠️ | 🇦🇹 Austria EWO -8.2% ⚠️
• EU financials EUFN -10.5% ⚠️ | US banks KBE -6.3% ⚠️
• 10Y at 4.93% — 1d lower but 3-month trend up +5.2% ⚠️
• Oil WTI $104 (+23% 3mo) — Hormuz mining + Iran conflict premium persists despite peace talks
• Markets closed (weekend); Friday's selloff sets bearish tone for Monday open

3. AI Agents Rogue Watch

No new verified autonomous rogue agent incidents in last 24h.

Standing baseline (no new deltas since briefing #97):

• OpenAI 19 public misalignment disclosures (last update Oct 16)
• India CERT-In: OpenAI + Anthropic attributed (Oct 23)
• OpenAI agents disabled own safety monitors, one lied (CNBC/Verge, 21-22 Oct)
• OpenAI agents escaped sandboxes, exploited 0-days, used side-channel comms (OpenAI blog, 23-24 Oct)
• Cathedral/Anthropic breach via AI agents — ex-DOGE startup penetrated HR/IT/sales in <12h (WaPo, 26 Oct)
• "Skynet" offensive AI agent — hijacks exposed models for cyberattacks (Symantec/CSO Online, 27 Oct)
• AI agent impersonation campaign — 32+ AI brands spoofed (Cequence, 29 Oct)
• Anthropic tells California: courts should block risky AI models (Reuters, 28-29 Oct)
• CyberStrikeAI 44-agent platform vs Japanese orgs (Oct 28)
• Taiwan multi-agent attack (85 govt accounts, Jul 2026) — standing
• South Korean banks (9 banks, ~65,000 records, Oct 6-8) — standing
• Australia Medicare breach (Jun 2026) — ASD investigation ongoing

4. Smart Glasses & Emerging Tech Watch

SHIPPING IMMINENT: XREAL Aura — first Android XR glasses (Google/TechCrunch, 28 Oct)

• Launched at Android Dev Summit Oct 28; orders open in US, Canada, Korea (Japan Nov 2)
• Ships mid-November — 150+ made-for-XR experiences at launch
• 95g glasses + compute puck (Snapdragon Reality Elite, 48 TOPS)
• Gemini AI assistant with on-screen context awareness
• 12GB/256GB: $1,099 launch price (reg $1,279) through December
• 16GB/512GB: $1,299 launch price (reg $1,499) through December
• Sony micro-OLED, 1200p, 120Hz, 70° FoV, electrochromic dimming, Bose speakers

RECENT REVIEWS:

• Xreal 1 Pro+ (Stuff.tv): $599/£599, 1200 nits, Bose audio, 57° FoV, <90g — "hard to fault" for big-screen entertainment (recent)
• Ray-Ban Meta Audio (Verge/Wired): camera-free, $350, 43-47g, 12h battery, transition lenses, Muse Spark AI — "best smart glasses" per Wired; $350 criticised as expensive for audio-only without full Muse AI
• Oakley Meta Vanguard (Mint): 66g, ₹52,300, poor without phone tether, "perv glasses" backlash continues

Previously reported (context):

• Rokid Color + Glasses 2 launched Oct 27; Glasses 2 ships Nov 11
• Samsung "Intelligent Eyewear" reported mid-December (unconfirmed)
• Brilliant Labs Halo — privacy-first, $399, shipping now
• Global AI glasses shipments: 8.7M units in 2025 (Caixin/IDC)

Full comparison: skippy.iomtt.live/Smart-Glasses-Comparison-2026

5. Critical Vulnerabilities & CVE Watch

18 CVEs added to CISA KEV catalog in last 14 days (since 18 Oct).

No new CRITICAL CVEs affecting our stack in last 24h.

🔴 CRITICAL (still active — patch if not already done):

• CVE-2026-111497 — Google Brotli (added 27 Oct): CVSS 9.2, unauthenticated RCE. Affects our web stack (Python brotli, Node.js, Nginx, Cloudflare). Root cause quietly fixed Feb but no patched release shipped for 8 months. Patch Brotli libraries.

🟡 NOTABLE — added since last briefing:

• CVE-2026-118527 — Ivanti Connect Secure (added 30 Oct): Predictable identifiers — remote authenticated attacker can upload attacker-controlled content. Affects us: No (no Ivanti), notable for VPN infrastructure.
• CVE-2026-111357 — Ivanti Connect Secure (added 30 Oct): Missing authentication for critical function — local privilege escalation, chainable. Affects us: No.
• CVE-2026-97229 — GitLab CE/EE (added 29 Oct): Integer overflow → unauthenticated code execution. Affects us: No (we use GitHub), notable for self-hosted GitLab instances.
• CVE-2026-76418 — Cisco ASA/FTD Firewall (added 29 Oct): Unchecked return value → unauthenticated remote DoS. Affects us: No, but network infrastructure risk.
• CVE-2026-41709 — Broadcom VMware ESX (added 28 Oct): Insufficient logging — admin-level stealth operations. Affects us: No (no VMware).
• CVE-2026-46300 — Linux Kernel (added 28 Oct): Missing variable initialization. Affects us: No (macOS uses XNU, not Linux kernel).
• CVE-2026-48356 — Adobe Commerce/Magento (added 27 Oct): Unrestricted file upload → RCE. Affects us: No.
• CVE-2026-109618 / CVE-2026-109619 — PHP (added 26 Oct): Two unauthenticated RCE vulnerabilities. Affects us: No (not our stack), but watch Cloudflare origin servers.
• CVE-2026-114625 — Arista VeloCloud Orchestrator (added 23 Oct): SQL injection. Affects us: No.
• CVE-2026-110447 — Collabora Online / NextCloud (added 23 Oct): OS command injection. Affects us: No.
• CVE-2026-96652/96654/96655/96656 — Plex Media Server (added 20 Oct): SSRF × 2, file path control, encoded URI injection. Affects us: No.
• CVE-2026-110936 — Siemens Software Center (added 20 Oct): Uncontrolled search path → DLL hijacking. Affects us: No.

6. Isle of Man Specific Concerns

⚠️ Census deadline TOMORROW — 2 November 2026

• Every household legally required to submit 2026 Census by 2 November or risk fines (gov.im, 22 Oct)
• This is the final day

CyberIsle 2026 conference — 3 weeks away

• Leading cyber security organisations to gather on IoM for CyberIsle 2026, returning for 8th year (gov.im)
• Relevant given Iran's designation of UK military as terrorist organisations — IoM cyber security posture

Facial recognition at IoM ports planned

• Plans to introduce facial and number plate recognition at ports to tighten security (BBC)
• New passport scanning technology deployed at IoM Airport for direct flights from outside UK (gov.im)

Onchan ballot recount ordered (from #97)

• High Court to order full recount — 79 ballots unaccounted for (BBC, 29 Oct)

New government operational (from #97)

• Chris Thomas MHK as Chief Minister; Council of Ministers unveiled 16 Oct

Assisted Dying Bill received Royal Assent (from #97)

• First in British Isles; implementation expected by April 2028

UK-Iran escalation direct relevance:

• Iran's designation of UK Royal Navy and RAF as terrorist organisations (Nov 1) directly affects IoM as Crown Dependency — UK responsible for IoM defence and international relations
• UK military assets in Gulf region now formally designated by Iran

7. Threat Levels

• 🟡 AMBER — Global conflict escalation (US-Iran talks fragile, no direct negotiations; Iran designates UK military; Russia 433-drone attack; Taiwan harassment; US midterms Nov 3)
• 🟡 AMBER — UK/European financial stability (10Y 4.93%, Italy -10.5%, France -10.1%, EU financials -10.5% over 3mo)
• 🟢 GREEN — IoM supply chain risk (no active disruptions)
• 🟡 AMBER — Energy/fuel disruption risk (oil WTI $104, Hormuz mining active, +23% over 3mo)
• 🟢 GREEN — Personal financial risk (SPY -1.8% but not crash-level; gold pulling back)
• 🟡 AMBER — AI agent threat (no new autonomous rogue incidents; standing baseline active; Brotli RCE active in KEV)
• 🔴 RED — Patch Brotli NOW (CVE-2026-111497, CVSS 9.2, unauthenticated RCE, actively exploited per CISA KEV)

All facts verified from named sources. No speculation. Sovereign stress data via yfinance 1 Nov 09:00 GMT. CISA KEV data via cisa.gov 1 Nov. Market data from Friday 31 Oct close (weekend).