EconomyThe Hindu, Page 1GS3Must read
India's core sector grew 7.9% in September 2026 over September 2025, according to provisional data released by the Office of Economic Adviser (OEA), Department for Promotion of Industry and Internal Trade (DPIIT), on 21 October 2026. It is the fastest growth since April 2024, the first month for which the new series, with base year 2022-23, gives year-on-year growth. The index stood at 118.3 against 109.6 a year earlier, when growth had been only 3.1%. Growth for August 2026 was revised up from 4.8% to 5.9%. Cumulative growth for April to September 2026 was 5.1%, against 2.5% in the same period of 2025.
Prelims facts
- The Index of Core Industries grew 7.9% in September 2026 (provisional), the fastest since April 2024 in the 2022-23 base series.
- Iron ore (18.4%), electricity (11.4%), coal (10.7%) and refinery products (10.3%) led; fertilisers, natural gas and crude oil contracted.
- The ICI is compiled by the Office of Economic Adviser, DPIIT, and released around the 20th of the following month.
- Since 20 July 2026 the ICI has base year 2022-23 and nine industries, with iron ore added; electricity has the highest weight (30.93%).
- Core industries are 32.88% of the IIP's weight in the new series, down from 40.27% in the 2011-12 series.
Read the full story, model answer and deep dive
Science and technologyThe Hindu, NewsGS3Must read
Eight intermediate certificates issued under eMudhra, a Bengaluru-based certifying authority (CA), were found to have private keys so weak that anyone could recover them. Mozilla received the report from an external researcher, forwarded by the Chrome Root Program, on 17 October 2026, and independently recovered the keys within hours. The keys were P-384 elliptic-curve keys, which should be random 384-bit numbers; each of the eight was an integer below 256, and one was the number 4. Six of the certificates could sign website (TLS) certificates and were trusted by Chrome, Mozilla, Microsoft and Apple; two were code-signing intermediates trusted by Microsoft.
Prelims facts
- Eight eMudhra intermediate certificates had P-384 private keys smaller than 256, recoverable by trying at most 256 values.
- Six were website (TLS) intermediates trusted by Chrome, Mozilla, Microsoft and Apple; two were code-signing intermediates trusted by Microsoft.
- Mozilla and Chrome blocked them on 17 October 2026; eMudhra revoked them on 18 October, and Mozilla moved to distrust the emSign ECC Root CA - G3.
- In India, certifying authorities are licensed by the Controller of Certifying Authorities, appointed under Section 17 of the IT Act, 2000.
Read the full story, model answer and deep dive
International relationsThe Hindu, NewsGS2GS3Must read
Turkiye, Qatar, Pakistan and Indonesia signed a defence cooperation memorandum called 'Badr' in Doha on Wednesday, 21 October 2026. Badr means 'full moon', and reports say the name symbolises the complementarity of the four countries. The memorandum was signed by their defence ministries in the presence of Turkish Defence Minister Yasar Guler, Qatar's Deputy Prime Minister and Minister of State for Defence Affairs Sheikh Saud bin Abdulrahman bin Hassan Al Thani, Pakistan's Defence Minister Khawaja Muhammad Asif and Indonesia's Deputy Defence Minister. Turkiye's Presidency of Defence Industries and Pakistan's defence production organisation also took part.
Prelims facts
- The Badr memorandum on defence industry cooperation was signed in Doha on 21 October 2026 by Turkiye, Qatar, Pakistan and Indonesia.
- Its focus is military production, research and development, technical training, technology transfer and supply-chain integration; no mutual defence clause has been reported.
- The Mecca Joint Defence Agreement of 7 August 2026 (Saudi Arabia, Turkiye, Pakistan) treats an armed attack on one as an attack on all.
- Pakistan and Turkiye are parties to both the Mecca agreement and the Badr memorandum.
Read the full story, model answer and deep dive
Science and technologyThe Hindu, Page 10GS3GS2
In mid-October 2026 Ukrainian defence officials said they had lost access to satellite communications on Starshield, the government version of SpaceX's Starlink network, which their forces use to guide drones. Elon Musk denied SpaceX's involvement, saying Starshield systems are owned and controlled by the US government. Taking this as its cue, a Hindu explainer on 22 October 2026 asked how exposed India is to foreign-controlled technology. It argues that a single company, not a government, can restrict a critical service, and it separates three risks: deliberate restriction, platform-level disruption such as the 2024 CrowdStrike faulty update that hit Indian airlines, airports and securities firms, and the slow erosion of home-grown capability.
Prelims facts
- Only three NavIC satellites (IRNSS-1B, IRNSS-1I, NVS-01) were providing signals in July 2026; at least four are needed for standalone positioning.
- India's licensed satellite broadband providers are Starlink, Eutelsat OneWeb's Indian arm and Jio Satellite Communications, all using foreign-controlled constellations.
- SIPRI (March 2026): India was the second-largest arms importer in 2021-25 with 8.2% of global imports; Russia supplied 40% of India's imports, down from 70% in 2011-15.
- UPI is run by NPCI, but leading UPI apps such as PhonePe (Walmart majority-owned) and Google Pay are foreign-controlled.
Read the full story, model answer and deep dive
Polity and governanceThe Hindu, Page 1GS3GS2
The State Bank of India (SBI) told the stock exchanges on 21 October 2026 that it had identified 3,897 customer records containing personally identifiable information in data allegedly leaked on the dark web. SBI said it received alerts on 16 October from its threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In). A preliminary review of about 3.75 lakh records found the 3,897 with personal data, including names, dates of birth, gender, residential addresses, registered mobile numbers, email addresses, customer information file (CIF) numbers, lead IDs and metadata linked to loans.
Prelims facts
- SBI disclosed on 21 October 2026 that 3,897 customer records with personal data were found among about 3.75 lakh records leaked on the dark web.
- The alerts came on 16 October 2026 from SBI's threat intelligence provider, the Defence Cyber Agency and CERT-In.
- Under the DPDP Act, 2023 a data fiduciary must intimate a breach to the Data Protection Board and each affected person; the Rules require a detailed Board report within 72 hours.
- The DPDP Act's core duties apply only from 13 May 2027, 18 months after the Rules were notified in November 2025.
- CERT-In's directions of 28 April 2022 require cyber incidents to be reported within six hours.
Read the full story, model answer and deep dive