Evening Brief, Thursday 22 October

Vladimir Putin gave Steve Witkoff a qualified opening after more than three hours of talks in St Petersburg. Kremlin adviser Yuri Ushakov said Moscow was ready in principle to restart trilateral negotiations with Washington and Kyiv around 10 November, with security as the focus. Dmitry Peskov said Kirill Dmitriev joined for Russia and Jared Kushner joined remotely. Ushakov also said proposals discussed earlier in Oslo by Ukrainian and European representatives contained little that would help a settlement, so the offer came with familiar Russian resistance built in.

Russia freed Stephen Hubbard on the same day. Donald Trump said he had asked Putin in an October phone call to release the 74-year-old retired teacher from Michigan and said the United States gave nothing in return. Hubbard had been sentenced in 2024 to nearly seven years in closed proceedings after accusations that he signed a contract with the Ukrainian military, a charge his legal team disputes. Steve Witkoff thanked Putin and called him compassionate, which drew anger from Republican senator Thom Tillis and congressman Don Bacon; Vice President JD Vance defended Witkoff by saying the return of an American hostage mattered more than the words used to secure it.

Volodymyr Zelenskyy said Ukraine favours a trilateral meeting with Russia and the United States as soon as possible. In a Fox News interview, he said freezing the current front line was, in his view, the real way to end the war. He also said US security guarantees must be part of any agreement and that any deal should pass through parliament.

Two critical PHP vulnerabilities kept spreading practical trouble through public services and private platforms. The flaws, CVE-2026-109618 and CVE-2026-109619, carry a CVSS 4.0 severity score of 9.2 out of 10 and could let attackers run code remotely on affected servers. WatchTowr calls the pair PHP2shell and says attackers could take control of sites, alter them or steal data. Spain's digital ministry told public and private organisations to update immediately, while INCIBE issued an alert.

Governments chose outages over risk. Dutch government websites, including the digital ID login service, became unavailable, and Finland took public services offline. The UK's National Cyber Security Centre advised organisations that could not update immediately to consider taking systems offline, and some UK council websites and NHS Scotland paused services for a period. Japan reported no damage, according to Chief Cabinet Secretary Minoru Kihara, but he urged citizens to install patches.

Japanese banks joined the retreat. MUFG Bank halted some online transactions, Mizuho Bank and Daiwa Securities carried out emergency maintenance, and Shizuoka Bank disabled its online banking app until safety was confirmed. Japan Airlines and All Nippon Airways suspended some website functions without affecting flight operations, and East Japan Railway halted three services, including its credit card app. The Japan Bankers Association said the domestic fund-settlement network had seen no impact so far.

Germany turned the outage into a spending argument. Ralph Brinkhaus said the incident showed how vulnerable systems were, and Konstantin von Notz demanded real political action on IT security. RP Online reported that most German websites taken offline were back online after updates were installed.

France crossed an uncomfortable market line. Its 10-year government bond yield broke through 5% on 21 October, then BFMTV recorded it at 5.082% against 5.079% for the US 10-year Treasury. The gap is tiny, but investors were briefly demanding a higher return to lend to Paris than to Washington for ten years. N-tv put the spread over German Bunds at almost 162 basis points, a record high, and flagged the risk of a downgrade.

• France 10-year OAT5.08
• US 10-year Treasury5.08

The sell-off feeds on politics as well as arithmetic. France has faced protests over living costs, rents, austerity and public services, and the interior ministry reported nearly 2,400 arrests after Saturday's unrest. Parliamentary gridlock has blocked Emmanuel Macron's pension and spending plans, while Prime Minister Sebastien Lecornu runs a minority government. The Guardian reported a 2025 deficit of 5.1% of GDP and debt at 115.6% of GDP.

Pressure also spread to other euro-zone bonds. Deutsche Bank's Jim Reid said Italian and Spanish spreads over German Bunds widened, and Carsten Brzeski of ING said higher yields reinforced the European Central Bank's restrictive stance before its rate decision in the week of 26 October. Carrefour shares fell 13.8% after looting, and the retailer cut its annual outlook, now expecting an operating-profit hit of 80 million to 200 million.

The next public marker is Moody's review of France's rating on Friday evening. Lecornu wants to bring the deficit back to 5% of GDP, but the government is still struggling to pass next year's budget.

Saudi Arabia's aviation authority said an attack struck King Fahd International Airport in Dammam late on 21 October. The General Authority of Civil Aviation first reported one person dead and eight injured, then raised the toll to two, a Saudi national and an Indian national. It said the injured, of several nationalities, were taken to hospital and that damage to airport facilities was still being assessed.

A separate Saudi Energy Ministry statement said debris from an intercepted drone killed two people and injured two others at Shaybah, an Aramco-operated oil field in the country's southeast. The falling debris set a contractor's vehicle on fire. The ministry identified the dead as a Nepali national and a Filipino national, and said the injured were Pakistani and Indian nationals.

The US State Department ordered some diplomats and family members of US government employees to leave Saudi Arabia, citing Houthi attacks on civil airports and other critical infrastructure. The order covers the embassy in Riyadh and the consulates. A diplomatic source told AFP that all staff at the US embassy in Saudi Arabia and their families had been ordered out, and that families of embassy staff in the United Arab Emirates, Jordan, Qatar and Bahrain were also being evacuated.

The Houthis separately claimed a ballistic missile strike on Saudi military targets at Aden airport in Yemen the same day. Israeli and US officials also told Axios that dozens of Israeli jets flew over Syria and Iraq on 19 October toward the Iranian border in what Israel called a deterrence exercise, after telling Washington in advance.

Nigeria confirmed its first Ebola case in more than a decade after a 42-year-old woman returned from Uganda. Odianosen Ehiakhamen of the Nigeria Centre for Disease Control said she reached Abuja on 5 October via Addis Ababa, fell ill two days later and went to a private hospital on 11 October with malaria-like symptoms. Officials tested her for Ebola on 19 October, and the positive result came the following day.

Health minister Muhammad Ali Pate said the woman had spent about two and a half weeks in Kampala before returning to Abuja and had not travelled elsewhere in Nigeria since. Officials identified 44 contacts, none of whom is known to show symptoms while in isolation. Aviation minister Festus Keyamo ordered 46 people suspected of contact with her barred from air travel and said airports across Nigeria would screen arrivals and departures.

Authorities said the case belongs to the Bundibugyo strain, the same strain circulating in the Democratic Republic of the Congo. Cases have also been recorded in Uganda and Kenya, while Uganda later declared its outbreak over nationwide. Officials say the strain kills about half of those infected and has no approved treatment or vaccine, which leaves tracing, isolation and hospital vigilance as the immediate tools.

WHO Africa regional director Mohamed Janabi said the continent faces a more complex outbreak situation. Africa CDC chief Jean Kaseya called for urgent measures and political leaders involved at the highest level. WHO Nigeria head Pavel Ursu said the woman is showing signs of recovery in isolation, and the ministry urged the public not to panic while hospitals watch for suspected cases.