Morning Brief, Thursday 22 October

Steve Witkoff asked Vladimir Putin to restart trilateral talks between Ukraine, Russia and the United States, after first meeting Volodymyr Zelenskyy and European leaders in Oslo. He brought documents setting out ideas for a possible peace agreement and said the Oslo meetings had created some momentum. Putin praised Donald Trump's attention to the war, and Witkoff thanked him for freeing Stephen Hubbard, who is expected to return to his family after more than four years in Russian custody.

Zelenskyy told Fox News that Ukraine could accept freezing the conflict along the current front line as the minimum Russia must offer before a settlement. He said Kyiv would then seek security guarantees from the United States and European partners, and he added that any deal must pass through Ukraine's parliament. Ukraine still expects a new delivery of NASAMS air-defence systems in November 2026, while Zelenskyy said limits on Starlink services remain to be fixed.

Moscow and Kyiv both signalled willingness to hold talks under US mediation, but not on the same timetable. Kremlin adviser Yuri Ushakov said Russia could resume talks around 10 November, after the US midterm elections, while Zelenskyy wants a meeting sooner. Ushakov dismissed proposals from Kyiv and European capitals as thin, which leaves the two sides apart even as Trump says the end of the war is nearer than ever.

PHP maintainers released patched versions after researchers disclosed two critical remote-code-execution flaws in the open-source language, which Axios says runs on nearly 70% of websites. The bugs, tracked as CVE-2026-109618 and CVE-2026-109619, each scored 9.2 out of 10 on the CVSS 4.0 scale. The maintainers warned that configuration changes do not fully protect a server, so operators must upgrade to close the gap.

Governments and public bodies took services offline while they applied fixes. Germany's ITZBund disconnected a number of federal sites, French prefecture pages went dark, and Dutch portals including Rotterdam port, Overheid, hospitals and political party sites were disabled. Belgium's foreign ministry suspended online resources, while Denmark and Finland also took down some government sites. Officials said the shutdowns were preventive and did not necessarily mean attacks had occurred.

Researchers at Calif and Wiz found the flaws using new AI models, including Gemini and ChatGPT, and Wiz said the bugs had gone unnoticed for more than 10 years. OpenAI said one of its models helped uncover a vulnerability and helped PHP researchers build a fix. The White House, CISA, the NSA, Britain's NCSC, Spain and Portugal all urged immediate patching, and officials advised isolating exposed systems that cannot be upgraded at once.

Judge Francis J. Mathew of the State District Court in Santa Fe ordered Meta to pay $25 billion after a jury found that Facebook deceived users about data privacy. The penalty, disclosed in a court filing, is tied to the Cambridge Analytica scandal and ranks among the largest levied against the company.

New Mexico sued Meta in 2021 after Cambridge Analytica collected personal data from up to 87 million Facebook users through a third-party app. The state accused Meta of lying to New Mexico users about who could access their information and also said the company misled people about hate speech, false information and internal policies. After a two-week trial, the jury found more than 43 million violations of state consumer-protection law, with each violation carrying a possible penalty of up to $5,000.

Attorney General Raul Torrez said state law sends the entire penalty to New Mexico's school system. The ruling is the second adverse verdict against Meta in the state within six months, after jurors in March found that the company deceived users about the safety of young people on Facebook, Instagram and WhatsApp. Meta has already paid roughly $6 billion to the US government to close investigations linked to the broader scandal.

The UK government approved production from the Jackdaw gas field, ending months of uncertainty over a North Sea project operated by Adura, a Shell and Equinor joint venture. The field lies about 241 kilometres from Aberdeen, and ministers said first gas could be produced by the end of October, with flow to the national grid expected by the end of the year. Prime Minister Andy Burnham framed the approval as a way to protect hundreds of jobs and heat homes with domestic reserves.

Jackdaw was first approved in 2022, then stalled after ecological groups and local communities challenged it. Scotland's Court of Session ruled in 2025 that Jackdaw and Rosebank had been approved unlawfully because ministers had not considered emissions from burning the fuel. Labour had promised not to grant new licences, but Burnham ordered a review after taking office in July and cited the energy emergency. Energy Secretary Miatta Fahnbulleh then cleared Jackdaw after a further review.

The government says Jackdaw will supply about 5% of UK gas production over 11 years, while Adura puts the figure at about 6% of North Sea gas production. Ministers also concede that the approval will not lower household bills because North Sea gas sells at international market prices. Fahnbulleh drew a line between Jackdaw and Rosebank, saying the first serves the domestic market while the second would produce oil mainly for export.

The US embassy in Riyadh ordered American embassy personnel and their families to leave Saudi Arabia, according to a diplomatic source cited by AFP. Families of staff at US missions in the United Arab Emirates, Jordan, Qatar and Bahrain were also told to depart. Reuters had earlier reported preparations for the move, with officials pointing to fears of renewed fighting and Houthi attacks from Yemen. The State Department had not publicly confirmed the order when the reports appeared.

Saudi Arabia has faced near-daily missile and drone attacks since the start of October. A 10 October strike on Riyadh's international airport killed 13 people and injured more than 300, and the US mission's alert warned of possible attacks on airports, airspace closures and flight cancellations. Washington had already required US government employees in Saudi Arabia to obtain special authorisation before using any airport in the kingdom.

The same day, Saudi Arabia said wreckage from an intercepted drone fell on the Shaybah oil field in the southeast, killing two foreign workers and injuring two others. The Saudi-led coalition said it had shot down drones heading for the kingdom, while Houthi military spokesman Yahia Sari denied sending drones toward Medina or carrying out an operation against Saudi Arabia that day. The ministry reported no effect on oil-field operations (33e05d7e-4eea-b4e4-3af48730784b).

An ordered departure is mandatory for the staff and family members it covers, but it does not by itself close an embassy. Riyadh's King Khalid International Airport remains suspended for many international services, and several carriers have pulled flights until mid-November.