Evening Brief, Friday 23 October

A gunman fired from a Renault Clio on public roads in Trappes and La Verrière, about 40 kilometres west of Paris, before police stopped him in Coignières near a commercial zone. Interior Minister Laurent Nuñez said the attacker hit five people in several locations, and reports put the burst of shootings at less than 15 minutes from around 10:30 local time.

Police first reported one person dead and four injured, while some reporting cited Laurent Nuñez with five wounded. The dead person was identified as a 26-year-old man. Three wounded people were described as in very serious condition, though Nicolas Dainville, the mayor of La Verrière, later said a 12-year-old girl who had been hit was stable after earlier serious concerns. Two men aged 29 and 49 were hospitalised and later described as out of danger.

The National Anti-Terrorism Prosecutor's Office opened an investigation into murder linked to a terrorist enterprise, with an aggravating circumstance for targeting people over real or supposed race, ethnicity, nation or religion. Police sources identified the suspect as Kévin T., a 39-year-old French citizen known to police but not listed in radicalisation databases. Reports said he used a Second World War STEN submachine gun, and Laurent Nuñez said investigators were still examining whether anyone helped him.

Emmanuel Macron thanked police for detaining the attacker, while Prime Minister Sébastien Lecornu said security and judicial resources were fully mobilised. Ali Rabeh, the mayor of Trappes, described the attack as terrorist, racist and likely Islamophobic, but Laurent Nuñez said the inquiry would establish the motive and whether the racial aggravating circumstance applies.

Donald Trump said Starshield had been turned back on in Ukraine after the Wall Street Journal reported that he had called Elon Musk and asked him to lift restrictions on the military version of SpaceX's Starlink network. The paper, citing American and Ukrainian officials, said the system worked more smoothly soon after that conversation, but Trump would not confirm whether he personally made the call.

The dispute goes to the front line. Ukrainian forces use Starshield for communications and drones, and Ukrainian equipment reportedly began losing its SpaceX link on 14 October once it exceeded about 160 km/h. That limit hit interceptor and offensive drones designed to catch Russian jet-powered drones, which can fly up to 600 km/h. Ukrainian officials told the Journal that throughput had improved, but another Ukrainian source said the network was still capped at 161 km/h, and Volodymyr Zelenskyy said Starlink speeds had not been restored.

Elon Musk wrote that limits were decided by the Pentagon and ultimately by the president. Defence Secretary Pete Hegseth said the Pentagon had made no decision to limit Starshield, and Donald Trump denied direct responsibility. The arguments leave Kyiv exposed to a supplier and a government whose authority over the network is now publicly contested.

The European Commission urged SpaceX on 21 October to restore full access for Ukraine. Europe's backup remains awkward: Eutelsat's OneWeb is the only European low-Earth-orbit communications constellation, but its antennas weigh 12 to 20 kilograms and cost more than $5,000, against a few kilograms and a few hundred dollars for Starlink hardware.

A firefight near the Judea junction, close to Hebron in the West Bank, lasted more than 20 minutes. The Israeli army and Israeli medical sources said two armed men were killed and at least five Israelis were wounded, two of them seriously. After a brief chase, Israeli forces killed two Palestinians suspected of carrying out the attack and imposed a blockade on several villages in the area.

Benjamin Netanyahu ordered an immediate blockade of Hebron city and told security forces to prepare a total blockade of Judea and Samaria, the West Bank, starting that day. He cancelled electoral events and said forces were conducting large waves of arrests. His office said the army would enter neighbourhoods from which the attackers set out, evacuate residents, search homes and destroy what it called terror infrastructure.

Defence Minister Israel Katz said the Jenin refugee camp model was arriving in Hebron and said the neighbourhood of the clan the attackers came from would be evacuated. Bezalel Smotrich said he had ordered the immediate demolition of unauthorised Arab buildings near the attack site, with work to continue in the afternoon. Those steps extend the response beyond the immediate search for suspects.

Antonio Tajani, Italy's foreign minister, opposed a total closure of the West Bank and said Italy supports a Palestinian state living in peace with Israel, whose security must be guaranteed. He also called for Hamas to be disarmed.

Benjamin Netanyahu praised settlers as heroes and said Israel would build settlement infrastructure in place of what it destroys.

Amazon Threat Intelligence said attackers tried to exploit the PHP flaws on 17 October, four days before the bugs became public. Its MadPot decoy system caught an attempt from an IP address linked to a commercial anonymisation network, and Amazon later saw proof-of-concept exploits and further attempts from other anonymised infrastructure.

The PHP Project published CVE-2026-109618 and CVE-2026-109619 on 21 October and released an urgent security update the same day. ZDNet reported that each flaw carries a critical severity score of 9.2 and affects most PHP builds. Wiz's security team found the bugs with AI help, and it says PHP runs on about 70% of the world's websites, which explains why even precautionary shutdowns travelled quickly across sectors.

Banks, brokerages, government services, health networks and court websites suspended public access from Tokyo to Helsinki. In Japan, Mitsubishi UFJ Financial Group and Nomura paused web pages and digital services for urgent maintenance. In the Netherlands, government websites went offline as a precaution, and hospitals could not be reached through their public sites.

CERT-EU, Portugal's cybersecurity centre and the US CISA told organisations that cannot patch immediately to take affected systems off the internet or isolate public-facing applications. Emily Austin of Censys said end users can do little beyond using unique passwords, while Dan Guido of Trail of Bits urged automatic updates for devices and routers.

Guido said companies running services must deploy fixes faster and limit the damage from compromised systems.

A magnitude 7 earthquake struck northern Tibet on Thursday night, with the United States Geological Survey placing the epicentre 191 kilometres east-northeast of Nagqu at a depth of 18 kilometres. The China Earthquake Networks Center gave a shallower depth of 10 kilometres, and early uncertainty gave way to a clearer picture as rescuers reached high-altitude communities.

Chinese state media, citing local authorities, reported at least 16 people dead and 65 injured, including 11 in serious condition. CCTV said 339 buildings had collapsed or been damaged, and local media said more than 300 homes had come down. Power and telecommunications were cut in the county seat, though some electricity had returned by Friday morning.

Authorities declared a state of emergency and sent more than 300 police officers and 347 fire-service units into the affected area. The regional emergency command reported 12,489 people evacuated as of 10:00 local time on Friday. Premier Li Qiang called for urgent measures covering rescue work, medical care, relocation and proper housing for residents.

Rockfalls closed roads and slowed access to the worst-hit mountain zones. The USGS recorded seven tremors near the epicentre, with the strongest at magnitude 5.2 and 10 kilometres deep. In Maru municipality, deputy head Lhawang Dagpo said cracks opened in office walls as the shaking hit. Reports described the quake as the strongest in the area in five years.

Italy's cabinet approved a decree-law allocating €175.2 million to sectors hit by higher diesel prices, as trucker and farmer blockades started to loosen in parts of the south. Road haulage gets €105.2 million, agriculture €60 million and fishing €10 million. Sources also reported a broader €540 million figure when previously allocated money is counted, which explains why trade groups and ministers are arguing over what is new.

The package adds money to a diesel tax credit, gives farmers non-repayable grants covering 20% of fuel spending up to 45 cents per litre, and supports fishing companies with grants worth 10% of fuel spending. It also suspends some vehicle leasing payments expiring between November 2026 and March 2027 until 31 March. The decree does not include the €590 million promised for renewing the truck fleet, which the government expects to handle later, probably through the budget law.

Campania's last highway roadblocks in the Caserta and Salerno areas were removed overnight into 23 October, and a blockade near a Naples refinery was dissolved. Police escorted vehicles to petrol stations to restart deliveries, while supermarkets began restocking. Michele Di Bari, prefect of Naples, said around 150 trucks were queuing to load fuel and that full normality would still take a few more days.

Giorgia Meloni thanked associations that chose talks and warned those still blocking roads or threatening drivers.

Haulage associations want a fixed fuel price for professional transport, tax cuts and the reactivation of the transport cost observatory.