Elon Musk’s public endorsement this week of a potential $3.5 trillion merger between SpaceX SPCX.O and Tesla TSLA.O has rattled some insiders involved in the discussions, who worry his comments could invite shareholder scrutiny and delay the process by several weeks, according to a person with direct knowledge of the talks.

The disclosure created a “mess” for the process, as it could lead to questions about how well Tesla shareholders’ interests would be represented, the person said. The concerns reflect similarities some participants see with Tesla’s 2016 acquisition of SolarCity, which sparked years of litigation over Musk’s role in the deal.

Musk, who serves as CEO of both SpaceX and Tesla and owns significant stakes in each company, this week told investors that the two companies were examining what would be the largest corporate transaction in history and revealed that both had formed special committees to evaluate it. The backlash to those remarks is reported here for the first time.

The parties have hired advisers, but discussions are at an early stage, three sources familiar with the matter said. SpaceX approached Tesla in recent weeks, and the companies have been discussing a range of transaction structures, including a SpaceX acquisition of Tesla or a merger under a newly formed holding company, the person familiar with the matter said. They are weighing different forms of merger consideration, including an all-stock deal, the person said. These details of the talks have not been previously reported.

Tesla, SpaceX and Musk did not respond to requests for comment.

SolarCity deal raises legal concerns

In related-party transactions such as a SpaceX-Tesla merger, independent board members typically oversee the process to safeguard public shareholders’ interests.

That issue loomed large in Tesla’s 2016 acquisition of SolarCity, which triggered years of litigation after shareholders alleged the world’s richest man had influenced the process to bail out his investment in the struggling rooftop solar company. At the time, Musk owned roughly 22% of both Tesla and SolarCity, which was founded by his cousins.

Shareholders argued that Musk’s involvement and public support undermined the deal’s fairness. Central to the case were claims that despite his minority stake, Musk was a controlling shareholder of Tesla due to his ties to board members and domineering style.

The Delaware Supreme Court later noted that plaintiffs’ contention of the absence of an independent committee, together with “certain other facts concerning Musk’s involvement in and public support for the transaction,” warranted the finding of unfair dealing.

The courts ultimately upheld the acquisition as fair, though it took several years for the case to be resolved and Tesla directors settled allegations for $60 million.

Musk excluded from merger negotiations

Musk owns nearly a fifth of Tesla and just under half of SpaceX, and analysts have said a merger would give him control of the combined entity. On Tuesday’s call with investors, Musk acknowledged that as a conflicted party he cannot be part of the discussions of the special committees. Advisers are also in contact with his lawyers to ensure Musk is recused from the merger discussions, the source familiar with the talks said.

Eric Talley, a law professor at Columbia University, said a merger could benefit shareholders by eliminating the need for Musk to divide his time between the two companies. He added that any legal challenge may be harder to predict than the SolarCity case because Tesla is now incorporated in Texas rather than Delaware.

“The Texas thing is a wild card. No one knows how Texas deals with cases like this because Texas never dealt with cases like this,” Talley said, noting that Texas has sought to establish itself as a business-friendly alternative to Delaware, and Musk’s comments so far were not necessarily problematic.

Ultimately, he said, litigation risk would hinge on the terms of any transaction.

“Who’s going to get the better side of this deal? And that’s usually what gives rise to litigation,” Talley said.

Public comments could delay historic deal

People involved in the process worry Musk’s public endorsement of the merger and disclosure of talks could intensify investor scrutiny, as interested parties typically avoid expressing views publicly while independent directors evaluate a deal, the source said.

The SolarCity case could become a reference point for investors and courts assessing any future SpaceX-Tesla transaction if advisers fail to fully insulate the special committees from Musk’s influence, the source added.

A tie-up between Tesla and SpaceX would be the biggest deal in history, creating one of the world’s largest industrial and technology groups. It would surpass Musk’s acquisition earlier this year of his artificial intelligence company xAI by SpaceX, which ranks among the largest corporate transactions ever announced.

A deal of this size would also face scrutiny from global regulators, especially due to Tesla’s business in China and SpaceX’s work in US defense and AI.

The Cyprus Chamber of Commerce and Industry (Keve) announced on Wednesday that existing businesses can apply for funding of up to €100,000 per project under a new €1.5 million grant scheme aimed at accelerating the development and commercialisation of innovative cybersecurity products and services.

The programme was announced by the Office of the Commissioner of Communications’ Digital Security Authority (DSA), acting as Cyprus’ designated National Cybersecurity Coordination Centre (NCC-CY), in cooperation with the Research and Innovation Foundation (RIF).

The scheme aims to help existing enterprises rapidly develop and bring competitive cybersecurity solutions to market, with funding available for innovative software, hardware and educational material.

The educational component covers material designed for critical infrastructure operators, small and medium-sized enterprises (SMEs) and students.

The total budget stands at €1.5 million, with individual projects eligible for grants of up to €100,000.

The call for proposals was launched on October 9, with applications due by December 8, 2026.

The scheme is co-funded by the Republic of Cyprus and the European Union’s Digital Europe Programme under the European project N4CY2, titled “Advancing the NCC-CY – The Next Chapter of the National Cybersecurity Coordination Centre of Cyprus”.

Interested businesses can find details of the funding conditions and submit proposals through the RIF’s IRIS platform.

Applicants can locate the relevant funding call by visiting the platform’s calls for proposals section.

The NCC-CY and RIF will hold an online information webinar on October 26 to explain the scheme and provide further details to prospective applicants.

The session will run from noon to 1pm, with interested businesses able to register through the official webinar registration page.

Keve encouraged eligible enterprises to review the scheme’s provisions and consider applying for funding to support the development and market introduction of cybersecurity innovations.

Government websites in Europe and elsewhere went offline on Wednesday after the disclosure of critical vulnerabilities in a widely used programming language sent website operators around the world scrambling to protect their systems.

Developers of the PHP programming language on Wednesday released urgent new fixes to vulnerabilities that had been lurking in their software for years until they were uncovered using AI, saying all users were “encouraged to update immediately.”

With tech firms warning that some hackers were already exploiting the flaws, government agencies across Europe were among those that took sites offline as a precaution.

Because a fix is now public and artificial intelligence tools are able to reverse engineer the bug with little effort, experts said they were bracing for a wave of intrusions as hackers jumped to get ahead of the updates.

AI was powering a “race to exploit,” said Costin Raiu, co-founder of cybersecurity research and incident response firm TLP:Black. He said the next step was the “mass compromise of every vulnerable web server on the internet.”

PHP — a language that dates back to the early 1990s and initially stood for “Personal Home Page” — underpins huge parts of the public-facing web and is baked into WordPress, Drupal, Joomla and Magento sites, meaning any critical vulnerability potentially has enormous knock-on consequences.

“All servers using any version of PHP released in the last 20 years will be vulnerable,” said Tiffany Farriss, the interim chief executive of the Drupal Association. “This issue impacts the majority of the internet.”

Cybersecurity agencies around the world have urged PHP users to update immediately or take websites offline until patches can be applied.

According to data from Censys, the internet intelligence firm, about 1.5 million out of 2.6 million hosts report running a version of PHP for which there is no fix.

The Dutch cybersecurity agency itself went offline, saying it had done so as a precaution because of the vulnerabilities. The operator of the online encyclopedia Wikipedia also said it had taken down an unspecified number of systems until they could be safely patched, while the Internet Archive, the sprawling online library, said it also briefly went offline to deal with the issue.

Even some world leaders weighed in. The Dutch prime minister said he was closely monitoring the situation. Japanese Prime Minister Sanae Takaichi in a post on X said website owners should “check whether your live site uses PHP and prepare to apply the new fix.”

BUG FOUND WITH AI

The flaw in PHP was discovered using artificial intelligence, two cybersecurity companies said in independent reports. Calif said in a blog post it found the flaws with the help of a large language model on August 1 and had been working on a fix ever since. Alphabet-owned GOOGL.O cybersecurity company Wiz said in a blog post that it too had discovered it with the help of Wiz Atlas, its autonomous AI vulnerability research tool, as well as Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol.

The vulnerabilities remained hidden in the PHP codebase for more than a decade and would have been extraordinarily complicated for a human hacker to take advantage of, Wiz’s post said.

“Pre-AI, this manual work would be difficult to implement and even harder to scale,” it said. “With AI, this is no longer a barrier.” Calif and Wiz said they coordinated with one another and the PHP team and OpenAI on the discovery.

In a statement, the White House said it was made aware of the flaw on Friday.

In a blog post late on Wednesday, Amazon AMZN.O security chief CJ Moses said the tech giant’s security team detected an attempt to exploit the vulnerabilities against one of its decoy “honeypot” systems on October 17, four days before public disclosure.

The attempt on the system came from an anonymous internet address, suggesting the activity was conducted by a threat actor, Moses said, adding it was unclear how the actor learned of the flaws while they were under embargo.

More attempts followed on Wednesday by multiple actors before the embargo lifted. Amazon said it was still unclear whether any of the attempts would have worked against real websites, adding the flaws were “now being broadly exploited in the wild.”

CRITICAL SOFTWARE

PHP is a programming language used to run websites. When a visitor loads a page, a server running PHP assembles the content and sends it to the browser. It is free, open-source software maintained by volunteers.

Its ubiquity — PHP runs roughly 75% of websites whose programming language can be identified, according to web technology tracker W3Techs — has made experts anxious. AI-assisted hacking campaigns, which have proliferated in recent weeks, could wreak havoc on unpatched servers, said Lukasz Olejnik, a visiting senior research fellow at King’s College London.

“The scale is huge, and with AI, exploitation may happen instantly,” Olejnik said.

WordPress.com operator Automattic said users of its hosted solutions and Tumblr were safe from the bug. Risks were higher for small PHP-powered websites run by individuals or organizations with limited technical resources, often on shared hosting services where customers do not directly manage the underlying servers.

MASS OUTAGES

In the Netherlands, several organizations followed the example of the National Cyber Security Centre and took public-facing websites offline, including the Port of Rotterdam, government portal Overheid.nl, the national soccer association KNVB, the websites for the country’s five largest political parties and several hospital websites.

Danish municipal IT company Kombit said it had shut down several services, including the national school communication platform.

Disruption was even more widespread in Finland, where state IT services provider Valtori said government public network services had been taken offline “as a precautionary measure.”

France’s Interior Ministry said it had placed all of its websites into preventive maintenance.

The European Commission on Wednesday announced that it has opened formal proceedings against Booking.com to investigate whether the accommodation platform breached EU digital rules by failing to tackle fraudulent property listings and phishing scams, and by not clearly identifying paid-for search results as advertisements.

The investigation will assess whether the company complied with the Digital Services Act (DSA), which requires major online platforms to identify and mitigate systemic risks and ensure advertising transparency.

The Commission will examine whether Booking.com adequately identified and assessed risks associated with illegal content, including fake listings for non-existent properties, impersonation fraud and accommodation offers that do not comply with applicable requirements.

It will also assess whether the platform introduced effective measures to reduce these risks, including removing fraudulent and non-compliant listings, which can undermine consumer protection.

A second area of investigation concerns phishing scams exploiting reservation and guest data.

The Commission will examine whether Booking.com properly assessed and addressed the risks posed by such scams, particularly in relation to how reservation and guest information is shared with accommodation providers and how the platform’s messaging service is designed and operates.

It will also investigate whether sufficient safeguards are in place to prevent data from being misused to carry out phishing attacks or solicit fraudulent payments from customers.

The third area concerns paid-for listings that receive greater visibility in search results.

Accommodation providers can improve their ranking on Booking.com by paying higher commissions, but the Commission said users should be able to recognise clearly when such boosted listings are advertisements.

The investigation will assess whether the platform complies with advertising transparency requirements, including whether users can readily identify who is behind each advertisement, who paid for it, why it is being shown to them and how they can change the settings determining which advertisements they see.

Under the DSA, users must be able to understand when an advertisement is shown and on whose behalf it appears, allowing them to distinguish between listings that rank prominently because they match a search and those promoted through paid visibility.

If the suspected failures are established, they could constitute breaches of Articles 34 and 35 of the DSA, which require very large online platforms and search engines to identify, analyse, assess and mitigate systemic risks, as well as Article 26(1), which requires online platforms to ensure advertisements and related information are clearly identifiable.

The Commission said it would conduct an in-depth investigation as a matter of priority, gathering further evidence through additional requests for information, interviews or inspections.

The proceedings also empower the Commission to take further enforcement measures, including interim measures and decisions establishing non-compliance, or to accept commitments offered by Booking.com to address the concerns.

However, opening proceedings does not prejudge the outcome of the investigation or affect enforcement action by other authorities under separate regulatory frameworks.

The decision also removes the powers of member states’ Digital Services Coordinators and other competent authorities to supervise and enforce the DSA in relation to the suspected Article 26(1) infringement covered by the proceedings.

The Commission’s decision follows a preliminary investigation that examined Booking.com’s risk assessment reports submitted in 2026 and the preceding three years, its transparency reports, and its responses to formal information requests sent on September 23, 2025, and May 26, 2026.

The Commission is cooperating with the Dutch Authority for Consumers and Markets, the Digital Services Coordinator in the member state where Booking.com is established, in overseeing the company’s compliance with the DSA.

Booking.com was designated a Very Large Online Platform under the EU legislation on April 25, 2023.

Cyprus-based technology distributor Asbis surpassed $1 billion in monthly sales for the first time in its history in September, generating estimated consolidated revenues of $1.05 billion, a 216 per cent increase compared with the same month last year, the company announced on Wednesday.

The Limassol-headquartered group’s revenues rose from $332 million in September 2025, making the latest month both its strongest September on record and its highest-revenue month ever.

“September 2026 will go down in ASBIS history as the month in which we achieved the highest sales in the Group’s history,” said Serhei Kostevitch, chief executive officer of Asbis Group.

“Revenues of $1.05bn and 216 per cent year-on-year growth confirm the enormous potential of our company, the scale of our operations and the opportunities offered by our presence across multiple markets,” he added.

Kostevitch said the record performance had been achieved through the group’s regular business activities, reflecting the strength of its business model, broad product portfolio and relationships with global manufacturers and trading partners.

“Most importantly, this result is the outcome of our regular operating activities and demonstrates the strength of our business model, broad product portfolio and relationships with global manufacturers and trading partners,” he said.

The company attributed its performance partly to growing demand for artificial intelligence solutions, computing infrastructure and other advanced technologies across its international markets.

“Growing demand for AI solutions, computing infrastructure and modern technologies is creating new opportunities for the entire industry,” Kostevitch said.

“We have good visibility and our pipeline of projects suggest a continuation of AI development,” he added.

Kazakhstan, the United Arab Emirates and Ukraine generated the largest shares of Asbis’ September revenues, followed by Slovakia and Poland, which continues to account for a significant portion of the group’s sales.

The company also reported particularly strong growth in servers and server components, while smartphones delivered another solid performance.

“In product terms, we recorded the largest sales growth in September in the servers and server components segment,” Kostevitch mentioned.

“The smartphone segment also performed very well, which means we are growing beyond the AI segment as well,” he stated.

The latest figures extend a period of exceptional growth for Asbis, which recorded its most profitable quarter in its 36-year history during the second quarter of 2026, as demand for artificial intelligence infrastructure, servers and smartphones strengthened across its markets.

Record quarterly and half-year results

Asbis generated revenues of $1.69bn in the second quarter, an increase of 78.7 per cent from $949.3m in the corresponding period of 2025.

Net profit for the quarter more than tripled to $44.3m from $12.1m a year earlier.

For the first half of 2026, consolidated revenues reached $2.97bn, up 76 per cent year on year, while net profit after tax climbed to $80.6m from $19.4m in the first six months of 2025.

The strong results followed further monthly revenue increases over the summer.

In August, Asbis reported estimated revenues of $604m, up 91 per cent from $316m in August 2025.

July revenues had risen by 89 per cent year on year to $531m, compared with $281m in the corresponding month of 2025.

September’s estimated revenues therefore represented a substantial acceleration in growth, taking monthly sales above the $1bn threshold for the first time.

The developers of the widely used PHP programming language said on Wednesday they would release patches for two critical vulnerabilities, as EU cybersecurity officials warned organisations unable to apply the fixes should take affected websites offline.

PHP is used across large parts of the internet, and speculation has circulated over the past day that websites running the software could be exposed to serious cyber intrusions.

“PHP is everywhere. It quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and an awful lot of software that doesn’t even advertise that it runs PHP under the hood,” cybersecurity company Huntress said in a blog post.

In a security update, PHP said both vulnerabilities were rated 9.2 on the CVSS v4.0 severity scale and urged users to “upgrade as soon as the release is available”.

It said a patch for both vulnerabilities was scheduled for 1400 GMT on Wednesday.

Dane Knecht, the chief technology officer of Web and cloud security firm Cloudflare NET.N, said that attacks were emerging and Cloudflare was updating its firewall rules as a stopgap measure.

“We are seeing early attacks emerging and are updating mitigations as new vectors show up. This is a STOPGAP only. Patch as soon as PHP releases the update,” he said on X.

The European Union Computer Emergency Response Team (CERT-EU) said on Tuesday in an advisory that the 9.2 rating indicated a risk of unauthenticated remote code execution, a type of flaw that can allow attackers to run malicious code on vulnerable systems without logging in.

CERT-EU urged organisations to prepare for the immediate patching of affected assets and said those unable to do so should consider taking affected sites offline.

The Australian Cyber Security Centre (ACSC) issued similar guidance, urging organisations to identify PHP systems in their environments, prepare to apply patches and monitor applications for signs of malicious activity.

“ACSC is currently not aware of active exploitation related to these vulnerabilities,” the agency said.

Web hosting provider GoDaddy said the flaws could allow attackers to execute code on affected servers over the internet, potentially leading to data theft, website defacement or full system compromise.

Wordfence, a security plugin that protects WordPress websites, said all WordPress sites run on a PHP-installed server. It warned that automatic updates would not apply the fix and advised site owners to find out who is responsible for updating PHP on their sites.

PHP’s security team said details of the vulnerabilities, affected versions and the fixed releases would be published when patches are issued.

CERT-EU and the ACSC said all PHP versions from PHP 5 onward could be affected, although PHP has not disclosed which versions are vulnerable.

Marshal Insurance, the corporate insurance brand operating since 1985, is now offering technology companies a way to apply for three of their main business insurance covers at once. One application goes in. One quote comes back, covering professional indemnity, cyber insurance and general liability.

What a technology company actually needs to insure

The typical technology company owns very little that an insurer of 40 years ago would recognise. There is no factory and no fleet of vans, and the stock room is a laptop. What it has is code, client data and a reputation. Even so, it tends to collect insurance policies the way an office collects phone chargers, one at a time and from different places, and none of them quite fits the others.

That is because trouble can come from three sides. A client can say the software failed and cost them money. This is a matter for professional indemnity insurance, which the sector also calls technology errors and omissions. Criminals can lock the company’s systems or walk off with its data, and cyber insurance exists for that. And somebody can still trip over a cable in the office, which is general liability, the oldest of the three covers and easily the dullest.

The gap between cyber insurance and professional indemnity

Bought separately, these covers mean three forms, three quotes and often three insurers. The paperwork is a nuisance. The bigger worry is that real incidents do not stay in one category. A ransomware attack on a software provider is a cyber loss on Monday. By Wednesday, when the provider’s own customers still cannot log in, it can be a professional indemnity claim as well. Two insurers then have to agree on who pays for what, and that conversation rarely happens at a convenient time.

One application, one insurance quote

The single application asks about the company once: what it sells, who its largest clients are, how its contracts limit liability, how it backs up data, whether staff log in with multi-factor authentication. Underwriters then assess the three covers together and return one insurance quote. The price still depends on the answers, and every application is assessed individually.

“In a lot of tech companies, the person filling in the insurance form is the same person running the business,” said Antonis Theofanous, Director. “Three forms down to one, and one figure to look at at the end. That is time they get back for the actual work.”

Insurance for software, SaaS and IT companies

The option is open to software developers, SaaS providers, IT consultancies and hosting companies. For a start-up, the trigger is often a first large contract with an insurance clause in it. For an established firm, it is the yearly renewal of policies that were never designed to sit together.

Technology companies have spent two decades removing forms from other people’s lives. It seems fair that someone has removed a couple from theirs.

About Marshal Insurance

Marshal Insurance has been arranging insurance since 1985 and serves more than 10,000 clients in 45 countries. It works with companies and international groups whose risks cross borders, across corporate liability, employee benefits, commercial specialty and sector cover. Its website is available in English, Russian and German.

To learn more about the available insurance solutions, visit: ⁠Marshal Insurance. Explore our coverage options, including ⁠Technology Errors and Omissions Insurance, ⁠Cyber Insurance and ⁠General Public Liability Insurance.

For more information or to request a quotation, please ⁠contact our team.

The Digital Cooperation Organisation (DCO), which counts Cyprus among its members, has launched the second edition of its Digital Prosperity Awards, inviting applications and nominations for digital solutions that deliver measurable economic and social benefits.

The awards are open to solutions from the public sector, private sector and civil society across DCO member states and worldwide, recognising the use of technology and innovation to accelerate digital transformation and promote a more inclusive, sustainable and prosperous digital economy.

Under the theme “Building the Future, Today”, the second edition will highlight initiatives that are already shaping the digital future by improving access to services, empowering people and communities, supporting business growth, advancing innovation and broadening participation in the digital economy.

The awards build on the inaugural edition, which recognised seven winners from the public sector, private sector and civil society at a ceremony held alongside the DCO’s fourth General Assembly in Jordan in February 2025.

Two of the seven recipients received the flagship Digital Prosperity for All prizes.

DCO secretary-general Deemah AlYahya said the awards would help bring effective digital solutions to a wider audience and connect their creators with new opportunities for collaboration.

“A prosperous digital future is taking shape today through the vision, commitment and creativity of governments, innovators, organisations and communities that embrace digital cooperation,” she said.

“Together, they are turning possibility into progress and technology into tangible, measurable impact in people’s lives,” she added.

Through the second edition, the organisation aims to celebrate solutions that advance digital prosperity and connect them with wider networks, new opportunities and partners capable of extending their reach and impact.

“We call on innovators and organisations across our member states and around the world to step forward and share the solutions that can transform lives, strengthen communities and open new pathways to opportunity,” AlYahya said.

“Your ideas, determination and leadership can help ensure that the digital future we build is inclusive, sustainable and prosperous; one in which every person and every community has the opportunity to thrive,” she added.

The second edition is structured around three core pillars: Digital Enablers, Digital Innovation and Digital Society, covering seven categories, alongside three flagship prizes recognising exceptional contributions to digital prosperity across DCO member states and beyond.

Alaa Abdulaal, the DCO’s chief of digital economy intelligence, said the assessment would prioritise evidence of results rather than ambition alone.

“We are looking for solutions that can prove their value, not simply describe their ambition,” she said.

“The strongest entries will show that they are solving a real challenge, delivering measurable results, and have the potential to extend that impact beyond their current context,” she added.

The assessment process will consider initiatives addressing local, regional or global challenges and require applicants to demonstrate tangible, measurable impact.

Entries will first undergo eligibility and due diligence checks before being assessed by a judging panel comprising international experts, leaders, innovators and specialists.

The panel will evaluate submissions against the awards’ approved criteria, with the winners to be honoured at a ceremony in 2027.

Applications and nominations close on January 4, 2027. Full category descriptions, eligibility requirements and entry guidance are available online.

Founded in 2020, the DCO describes itself as the world’s first standalone international intergovernmental organisation dedicated to accelerating the growth of an inclusive and sustainable digital economy.

It brings together the communications and information technology ministries of its 16 member states, which collectively represent nearly US$3.5 trillion in gross domestic product and a market of more than 800 million people, over 70 per cent of whom are under the age of 35.

Following a DCO Council decision in July 2026, nine additional countries began the process of joining the organisation.

The DCO works with governments, businesses, civil society and international organisations to promote digital inclusion, enable cross-border data flows, empower women and young people, and support entrepreneurs and small and medium-sized enterprises.

It also facilitates the coordination of digital policies across borders and holds observer status at the United Nations General Assembly and other international bodies.

Worldwide shipments of desktop computers, laptops and workstations fell 21.2 per cent year-on-year to 58.1 million units in the third quarter of 2026, as higher component costs pushed up prices and weakened demand, according to research firm Omdia.

Desktop shipments, including desktop workstations, dropped 23.5 per cent to 11.7 million units, while laptop shipments, including mobile workstations, declined 20.6 per cent to 46.4 million units.

“After sustained pull-forward activity buoyed the PC market in the first half of the year, this sharp drop in shipment volumes comes as no surprise,” said Ishan Dutt, research director at Omdia.

He explained that the decline reflected warnings from major manufacturers during the previous earnings cycle, when they forecast double-digit falls in unit sales in the second half of the year.

Retailers have also reported double-digit increases in average selling prices alongside falling sales, as higher component costs have been passed on to consumers and business technology buyers.

Manufacturers and their production partners began cutting output in the third quarter, while distributors continued to work through high inventory levels.

Supply chain pressures have also intensified, with rising memory and storage costs compounded by shortages of processors, graphics cards and other integrated circuit components.

“The cost share of DRAM and SSDs in PCs has risen sharply from a typical level of around 15 per cent to nearly 40 per cent, with price increases more than fourfold,” said Ben Yeh, principal analyst at Omdia.

He added that repeated price increases by computer manufacturers had yet to fully offset the additional costs, warning that the pressures were likely to continue.

Omdia forecasts that the PC market will contract by 24 per cent in the fourth quarter of 2026, followed by a further 7 per cent decline over the whole of 2027.

Despite double-digit shipment declines among most leading manufacturers, the global rankings remained largely unchanged both quarter-on-quarter and year-on-year.

Lenovo retained first place, shipping 14.9 million units and holding a 26 per cent market share.

HP ranked second, with shipments falling 31 per cent to 10.3 million units, the steepest decline among the leading manufacturers. Its market share slipped to 18 per cent, almost three percentage points below the level recorded a year earlier.

Dell remained third with 7.6 million units and a 13 per cent share, while Apple held fourth place with 6.8 million units, an 11 per cent annual decline.

Apple nevertheless gained more than one percentage point of market share, as its premium positioning helped cushion the impact of higher prices.

Asus completed the top five, recording the smallest decline among the leading manufacturers, with shipments of 5.4 million units and its market share rising to 9.3 per cent year-on-year.

Artificial intelligence (AI) is reshaping the retail sector, with 80 per cent of retail leaders planning to increase investment in the technology, although cybersecurity threats and regulatory constraints could limit its benefits, according to professional services firm EY.

The firm’s CEO Outlook Survey found that 80 per cent of retail leaders were also optimistic about their ability to expand the responsible use of AI and customer data across their businesses, despite pressure on costs and prices, geopolitical disruption and economic uncertainty.

However, EY warned that greater reliance on AI could expose weaknesses in retailers’ strategies, governance and operating models, particularly as digital adoption increases the risks surrounding customer privacy and cybercrime.

The survey found that 24 per cent of retail leaders identified cybersecurity and data privacy threats as a leading business risk for the following year.

EY said retailers should prepare for different possible futures rather than assume current investment trends would continue uninterrupted.

Its analysis uses a four-scenario framework developed by Jim Dator of the University of Hawaii.

The scenarios range from a constrained future, in which economic pressures, regulation, cyberattacks, outdated systems and poor data restrict AI adoption, to continued growth through sustained investment.

A third scenario envisages a fundamental transformation of society and the economy around new technologies, while a fourth considers systemic breakdown, in which a small number of powerful technology platforms dominate access to AI models and charge premium prices, potentially restricting access to larger retailers.

In a more constrained future, retailers could focus AI investment on lower-risk back-office functions such as finance, procurement, inventory management and logistics, while customer-facing applications struggle to expand amid regulatory uncertainty and declining public trust.

EY highlighted the European Union’s AI Act, China’s state-led AI governance and interventions by individual US states as examples of regulatory measures shaping the sector.

At the same time, cyber threats are increasing as malicious uses of AI develop.

The World Economic Forum’s Global Cybersecurity Outlook 2026 found that 87 per cent of organisations had experienced rising cyber risks linked to AI vulnerabilities, while 94 per cent expected malicious AI to have a significant effect on cybersecurity in 2026.

EY said retailers were particularly exposed because customer data, payment systems, older technology infrastructure and complex supply chains create numerous potential points of attack.

The firm said retailers’ future success would depend on combining technological investment with clear strategies that account for different possible outcomes.