Morning Brief, Friday 23 October

Volodymyr Zelenskyy said Russia fired 21 ballistic missiles at Kyiv in three waves, hitting homes, energy facilities, rail infrastructure, the metro, shopping centres, businesses and a monastery. He said the strikes reached 12 Ukrainian regions and put the provisional toll at two dead and 34 injured, including five children. Kyiv mayor Vitaliy Klitschko said parts of the metro infrastructure on the south bridge and an ambulance station in Pechersk district were damaged.

Ukraine also reported a wider Russian attack using Iskander-M, S-400, Zircon and Onyx missiles with 210 drones, while Moscow mayor Sergei Sobyanin said 630 drones headed towards the Moscow region overnight and injured two people. Russia's defence ministry said its systems destroyed 808 Ukrainian drones over 20 regions and Crimea, a claim made as both sides described large aerial attacks.

Vladimir Putin met Steve Witkoff in St Petersburg for more than three hours, with Kirill Dmitriev present and Jared Kushner joining remotely. Kremlin adviser Yuri Ushakov said Putin had agreed in principle to resume three-way negotiations involving Russia, the United States and Ukraine after 10 November, though he judged that proposals drafted in Oslo by Ukrainian and European representatives contained little of use. Zelenskyy backed a renewed push but proposed freezing the current front line as a first step and warned that major gaps remain over territory and security guarantees. He gave his mood in one line.

Two critical vulnerabilities in PHP, registered as PHP2Shell under CVE-2026-109618 and CVE-2026-109619, forced operators to switch off public websites while they installed fixes. The PHP project announced the flaws on 20 October and published corrected versions on 21 October, but the disclosure process broke down when Chainguard released its own fix a day earlier than agreed. The PHP Foundation said that gave attackers enough detail to build exploits, while Chainguard said signs already showed attackers had abused the flaws for several days.

Belgian sites including Smartschool and Universitair Ziekenhuis Antwerpen went offline for hours, and authorities, universities, hospitals and some banks in Germany disconnected pages as a precaution. In Mecklenburg-Vorpommern, the state government portal and the websites of Schwerin and Rostock were taken down, with the government portal returning late on 21 October and Rostock's city site restored on 22 October. Digitalisation minister Heiko Geue defended the cut-off.

Germany's Federal Office for Information Security rated the risk as extraordinarily high, because affected servers could expose databases, passwords and contact details, or give attackers a route into internal networks. Visitors' own phones and laptops are not directly threatened by the PHP flaw, but data protection officials warn that criminals may exploit the alarm with fake emails pretending to come from hosting firms, security agencies or online shops. Portugal, the European Commission, the US National Security Agency and Catalonia's cybersecurity agency all issued alerts.

A magnitude 7.0 earthquake struck northern Tibet at 22:33 local time on 22 October, with the US Geological Survey placing the epicentre east-northeast of Nagqu at a depth of 18km. Chinese accounts put the depth at 10km and located the epicentre in high-altitude, sparsely populated terrain averaging about 4,800 metres. Xinhua's Friday morning balance counted at least 16 dead and 54 injured, while local officials reported at least 339 collapsed homes and 20 livestock sheds.

The quake cracked walls in a municipal government building, triggered landslides and rockfalls, and forced authorities to close a section of National Highway 317. Communications failed in part of the region and railway authorities halted trains through the area. More than 1,600 local rescuers deployed, and supplies sent to the zone included 1,000 prefabricated housing units, around 3,000 tents, folding beds, flashlights and winter clothing. The government also sent 350 firefighting rescue workers and 83 vehicles.

The USGS recorded at least seven aftershocks, ranging from magnitude 4.3 to 5.2, all at a depth of 10km. Xinhua forecast intermittent snow in the earthquake region over the next three days, which complicates shelter and rescue work in a cold, thinly populated area more than 300km north of Lhasa. CCTV called it the biggest earthquake in the region in five years, and search and rescue work was still under way in the latest reports.

Emmanuel Macron convened a security council at the Élysée on 22 October after violence during demonstrations on 17 October, then urged that no demonstrations be held over the coming days. He said protests called by groups lacking legitimacy should be banned wherever possible, with the ban taking effect for Saturday, 24 October. Union marches are not barred outright, but prefects will propose alternative routes to protect city centres, shops and public buildings.

Paris banned gatherings on 22 October between 8:00 and 20:00 near the Élysée Palace, the seat of government and parliament, the Champs-Élysées, the Île de la Cité and the Louvre. Lyon banned all demonstrations for 24 October, while Grenoble barred protests in its centre and in areas hit by earlier violence until the morning of 25 October. Marseille, Lille, Le Havre and Rouen also imposed restrictions, with Le Havre and Rouen banning Saturday demonstrations.

Prime Minister Sébastien Lecornu was due to meet party representatives at Matignon with Interior Minister Laurent Nunez, Justice Minister Gérald Darmanin and security chiefs. Lecornu has pressed parties to choose between violence and the Republic, a line aimed at Jean-Luc Mélenchon's France Insoumise, which denies the government's charge that it fuels the protest. Macron also announced a Defence Council under his presidency for 23 October, and Lecornu plans broader talks with students, teachers, unions, employers, local authorities and parliamentarians on 26 October.

Owner-drivers kept pickets in Campania after most truckers' blockades were lifted elsewhere in southern Italy, and fuel became the immediate pressure point. Lorries on strike blocked tanker trucks from leaving refineries in Naples East, leaving 95% of petrol stations in the region dry. Queues formed at the few pumps still open across Naples, where petrol and diesel were reported at up to €4 a litre, and the Guardia di finanza opened checks into price gouging.

Naples mayor Gaetano Manfredi warned that the city had only one or two days of capacity before some waste categories could no longer be collected. He said full storage platforms, trouble moving organic waste, school transport and supermarket supplies all depended on a steady fuel flow, and he urged protesters to let supply vehicles through. Police escorted about a thousand trucks into Naples over two days, and supermarket distribution centres began reopening.

Rome approved a security decree to clear roadblocks and offered half a billion euros in relief until March for hauliers, farmers and fishermen. The blockade has also stopped buffalo mozzarella production in Campania, where about one million litres of milk collected on Wednesday could not be processed under protected-origin rules requiring cheesemaking within 60 hours. Pier Maria Saccani, director of the Mozzarella di Bufala Campana DOP consortium, put losses at €3m in 24 hours.