Evening Brief, Wednesday 21 October

Russia freed Stephen Hubbard, a 74-year-old former teacher from Michigan, while Steve Witkoff met Vladimir Putin in St Petersburg. Russian agencies said Hubbard was at Pulkovo airport awaiting repatriation after a closed-door conviction in 2024 over allegations that he fought with Ukrainian forces. The US had classified him as wrongfully detained under the Biden administration, and Donald Trump said he had asked Putin in mid-October to release him without a swap.

The release gave the White House a visible result from a visit that also mixed war diplomacy with trade. Putin told Witkoff that the first ship carrying 40,000 tonnes of Russian diesel for the United States would leave within two or three days, under a US Treasury sanctions waiver that runs until 7 April. Moscow also said it wants to restore economic cooperation with Washington, a line that will annoy Kyiv because the fighting continues and Russia still holds Ukrainian territory.

Witkoff had met Volodymyr Zelenskyy in Oslo before flying to Russia, but his push for a settlement has not moved the two sides close to a deal. Zelenskyy rejected any formula decided without Ukraine and said a possible Trump-Putin-Xi Jinping meeting around the APEC summit in Shenzhen would be acceptable only if Kyiv had a seat at the table. Russian and Ukrainian strikes continued, including a Russian drone hit on a passenger bus in Zaporizhzhia and Ukrainian strikes on energy and telecom sites in occupied areas.

Administrators across Europe took government, hospital and transport websites offline after details of two critical PHP flaws appeared on a hacker forum and then spread on X. The bugs, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell, let attackers run code remotely on affected servers. NOS rated each flaw at 9.2 on the ten-point CVE scale, and the PHP Foundation said the problem reaches back to PHP 5, released in July 2004.

Finland pulled all government websites offline, France said local-administration sites were temporarily unreachable and Dutch services including DigiD, Thuisarts.nl and the lower house website went dark. Belgian school platform Smartschool, hospitals around Antwerp, the Berlin Charite and Germany's federal building ministry also switched off services. Rotterdam's port said it saw no operational problems, which is exactly the sort of sentence ports prefer to be saying when their website has vanished.

The patch arrived around 16:00, after exploit code had already circulated for hours. Cloudflare's Dane Knecht said the company was updating firewall rules while waiting for operators to install the fix.

Security experts treated the update as mandatory, not optional. Lukasz Olejnik, an independent security consultant and visiting senior research fellow at King's College London, warned that PHP underpins millions of systems and called the episode bluntly:

The UN Environment Programme said the world will pass the Paris Agreement's 1.5C limit, calling the overshoot imminent and unavoidable after years of weak action on fossil-fuel emissions. Its Emissions Gap Report 2026, titled The Point of Return, lands before COP31 in Antalya and turns a once-narrow target into a salvage operation. Inger Andersen said the window for staying below 1.5C has closed.

The least-bad pathway still requires steep cuts from 2025 levels: 18% by 2030, 45% by 2035 and 69% by 2040. Under that route, warming peaks around 1.7C to 1.8C near mid-century, with roughly a 50% chance of returning to 1.5C or below by 2100. António Guterres said the required reductions amount to almost 6% a year until 2035.

Current policy points to 2.8C of warming this century, and even full delivery of national climate plans would lower that only to 2.6C. The report says 167 countries have submitted plans covering 83% of global greenhouse-gas emissions, but those pledges cut emissions by only 5-8% by 2030. UNEP also links the worsened outlook to the US withdrawal from the Paris Agreement and to revised estimates of past emissions.

Helen Haines, the independent federal MP for Indi, lost both legs after a vehicle struck her near her electorate office in Wangaratta, about 200km north-east of Melbourne. Reports say a Toyota Land Cruiser SUV hit the woman MP on Monday and then reversed to hit her again. Surgeons removed her left leg that day and amputated her right leg on Wednesday after efforts to save it failed.

Her husband, Phil Haines, said she is now stable after being in critical condition. He said her heart and mind are in good shape, and warned that recovery will be long. The couple have three children and two grandchildren, and their 40th wedding anniversary falls in November.

Brendan Nugent, a 43-year-old man from Tarrawingee, appeared at Wangaratta Magistrates' Court and did not seek bail or enter a plea. He faces charges including dangerous driving causing serious injury, intentionally causing serious injury and causing harm to a federal official, plus cannabis cultivation and possession. Police describe the attack as targeted, say they have not found earlier contact between the accused and Helen Haines, and have not determined a motive. MPs in Canberra received detailed security briefings on Wednesday after federal authorities reported rising harassment and threats against elected officials.

France's ten-year government-bond yield crossed 5% for the first time since 2002, then eased back during the session. The move came as Emmanuel Macron's government tries to pass a tough 2027 budget through a divided parliament, after days of protests and looting sharpened market anxiety. Reports placed the peak between 5.005% and 5.08%, depending on the outlet and timestamp.

The spread over German debt widened to around 159 basis points, its highest level in roughly 15 years by some accounts. That gauge is the market's simple way of saying investors now want a much larger premium to hold French debt. The draft budget seeks €43bn of effort to bring the deficit down to 5% of GDP, still far above the EU's 3% ceiling, while public debt sits near 120% of GDP.

France borrowed at about 4.96% on ten-year debt in one intraday snapshot, above Spain's 4.07% and Italy's 4.59%, while Germany stood at 3.43%. That comparison stings in Paris because Italy and Spain long carried the euro zone's weak-link label. The figures are not closing prices, but they show how quickly a budget fight can become a bond-market problem when social unrest sits just outside the chamber doors.

Nigeria confirmed its first Ebola case in the current regional outbreak, a woman diplomat who had travelled from Uganda to Abuja about two weeks earlier. Tests identified the Bundibugyo strain, the same virus driving the outbreak in the Democratic Republic of the Congo. Officials said the patient started showing symptoms on 7 October, entered a private hospital on 11 October, and is now isolated and receiving care.

Health Minister Muhammad Pate said authorities had identified 44 contacts, including health workers, patients, caregivers and people the woman may have met during her journey. Uganda said it had no active cases and denied that the Nigerian case originated there, although it acknowledged that the patient passed through its territory. Kenya has also recorded cases linked to travel from Congo via Uganda.

The Congo outbreak has reached at least eight provinces and is being described by the WHO as the fastest-growing Ebola outbreak in history. ECDC figures cited in the reports put the toll at 9,552 cases and 4,602 deaths as of 18 October, and the Bundibugyo strain has no approved vaccine or drug. Africa CDC has called health ministers to an extraordinary virtual meeting on 28 October, and Jean Kaseya said the politics now need to catch up with the epidemiology.