The Daily 9 archive for October 22, 2026 carries a U.S. stablecoin rule with a future effective date, safer authentication and software, and a clearer route from industrial AI demos to certification. The source dates below are October 20–21, 2026; availability is called out where it differs.

1. OCC finalizes the U.S. payment-stablecoin rule

On October 21, the Office of the Comptroller of the Currency issued its final rule implementing most of the GENIUS Act for payment stablecoins. It sets requirements for permitted U.S. and foreign issuers under OCC jurisdiction, plus certain custody activities by supervised institutions. Bank Secrecy Act, anti-money-laundering and sanctions provisions will come through a separate rulemaking. The rule and statute take effect January 18, 2027; the OCC says it will announce separately when issuer applications and waiver requests open. Original source: OCC.

2. Fold opens Reserve and widens credit-card access

Fold said on October 20 that Fold Reserve had become available on October 13, alongside wider eligibility for its bitcoin-rewards credit card. The important detail is what Reserve is not: the company says it is closed-loop stored value, not a bank or savings account, and it is not FDIC- or SIPC-insured. Higher reward rates depend on balances and monthly spending limits; the advertised 5% card rate requires a $100,000 Reserve balance and applies only to the first $5,000 of eligible monthly purchases. Original source: Fold.

3. Azerbaijan Airlines turns AZAL Miles into a spending wallet

Comarch said on October 20 that Azerbaijan Airlines had rebuilt AZAL Miles on its loyalty platform. The program now ties status miles to ticket spend and adds a digital-wallet model intended to reward both travel and everyday purchases. That is a broader product change than a points-table refresh: the airline is moving a frequent-flyer program toward payment-style engagement. The claims come from Comarch’s company-issued announcement, so the practical customer experience and merchant reach still need to be judged in use. Original source: Comarch.

4. KDDI launches SIM-based phone verification through Firebase

KDDI began commercial service for Number Verification v2 on October 21 through Google’s Firebase developer platform. The API checks a phone number against carrier SIM-contract information, so users do not have to receive or type an SMS code. KDDI positions that as both a faster login flow and protection against real-time phishing that steals one-time passwords. The service follows GSMA Open Gateway and Linux Foundation CAMARA specifications, and appears in Firebase as Phone Number Verification for supported implementations. Original source: KDDI.

5. Cisco publishes fixes for a new Snort 3 advisory set

Cisco’s Product Security Incident Response Team published its October 21 advisory set and told customers to move to the fixed software listed in each notice. The batch includes a critical Snort 3 hardening release covering four CVEs with a 9.0 base score, a high-severity arbitrary-command-execution flaw in the open-source Snort 3 control-channel socket, and medium-severity denial-of-service issues. Cisco lists no workaround in the umbrella notice, making the version-specific upgrade guidance the practical action for affected deployments. Original source: Cisco.

6. Axonius ships IoT and OT asset coverage

Axonius made Cyber-Physical Assets generally available on October 21 after an early-access phase. The product brings IoT and operational-technology devices into the same asset model as conventional IT, using passive network taps and targeted device identification to avoid broad scans of fragile industrial systems. It also maps network connections and adds operational context beyond CVE scores. Axonius said its Post-Quantum Cryptography Readiness and Context360 features are now generally available too, rather than preview-only additions. Original source: Axonius.

Cloudflare added full-transaction detections and response rules to its web application firewall on October 21. The new logic evaluates an incoming request together with the application’s response, which can reveal whether an exploit actually produced data exposure or a dangerous server behavior. Response rules can then stop the outbound response before it reaches the requester. Cloudflare says the feature is meant to catch successful exploitation and misconfiguration that request-only signatures can miss; customers should still treat it as one defensive layer, not proof that an application is secure. Original source: Cloudflare.

8. Logitech picks two materials projects for manufacturing trials

Logitech named Woamy and ZCJ winners of its fourth Future Positive Technology Challenge on October 21. Woamy is developing cellulose-based foam as a potential substitute for expanded polyethylene packaging, while ZCJ is working on lower-carbon steel production using hydrogen-based energy. The result is not a product launch: the teams now get the opportunity to work with Logitech on proof-of-concept projects and explore whether the technologies can scale into its supply chain. Logitech said this year’s challenge drew more than 240 applications. Original source: Logitech.

9. Robot certification gets a simulation-led route

At GTC Berlin on October 21, TÜV SÜD and Accenture presented the concept for a Physical AI Safety Suite. It uses digital twins, simulation and AI agents to test factory layouts, robot fleets and site-specific operating conditions before equipment is installed. TÜV SÜD retains responsibility for independent assessment and certification; this is a demonstrated concept, not a generally available certification product. The partners say earlier evidence gathering could reduce late safety rework, while any speed claims remain their estimates rather than independently verified results. Original source: Accenture.