Morning Brief, Saturday 24 October

The White House said Melania Trump had secured a temporary ceasefire between Russia and Ukraine in Oleshky, an occupied city on the Dnipro River across from Kherson. The stated aim is narrow and practical: bring in humanitarian aid, assess residents at home and open routes for civilians who want to leave. Dmytro Lubinets, Ukraine's parliamentary human rights commissioner, confirmed the operation on Telegram and described three parts, a guaranteed ceasefire, aid delivery and free movement for civilians. The White House said an American media organisation would document the work on the ground.

Moscow also acknowledged the discussions. Dmitry Peskov said an evacuation would take several days and that Russia and Ukraine were discussing dates, while the Kremlin thanked Melania Trump for her efforts. Reports differ on timing, with most giving 29 October and one Dutch report giving 27 October. That discrepancy will matter to residents who have spent months with little food, water, power or medical care.

The numbers are grim enough without embellishment. Adnkronos and El País put the number of civilians trapped in Oleshky and nearby settlements at about 6,000, including 200 children. Oleksandr Prokudin, head of the Kherson Regional Military Administration, gave a lower estimate of about 2,000 people, nearly 50 of them children. The UN human-rights monitoring mission said no food supplies had reached the city since 26 May. Ukraine and Russia also exchanged 270 prisoners of war each on 22 October, shortly before the truce was announced.

French anti-terror prosecutors expanded their investigation after a gunman opened fire from a car in Trappes, then in nearby La Verrière, before police stopped him in Coignières. One adult died and five people were injured, three seriously, according to the latest reports. Among the wounded was a 12-year-old girl in La Verrière, who Europa Press said was hit by eight bullets and remains in serious condition after doctors stabilised her.

The suspect is a 39-year-old French citizen known to police but not listed in France's database of radicalised people, according to police sources cited by French media. Europa Press reported that he used a Second World War-era STEN submachine gun. The national anti-terrorism prosecutor's office opened an inquiry into murder linked to a terrorist enterprise, aggravated by an alleged motive tied to race, ethnicity, nation or religion. Interior Minister Laurent Nuñez called the shooting a terrorist attack.

Emmanuel Macron travelled to Yvelines to meet families, rescuers and local officials. He called the attack a racist terrorist act and said France had not previously seen people attacked for the colour of their skin. Ali Rabeh, the mayor of Trappes, said one critically wounded person was of Maghrebi origin and said the courts must determine whether the suspect acted from a racist motive. Prime Minister Sébastien Lecornu said the suspect had been detained and placed in custody, with security and judicial services fully mobilised.

Israeli forces killed two gunmen after a firefight lasting more than 20 minutes near the Judea junction close to Hebron. Israeli army and medical sources reported at least five Israelis wounded, two seriously, while another account gave six soldiers wounded, two critically. The army said the two gunmen were 27-year-old Hebron residents, apparently relatives, and that troops found an M16 rifle, a pistol and a large amount of ammunition in their vehicle.

Benjamin Netanyahu said the army would enter the neighbourhoods the attackers came from, evacuate residents, search homes one by one and destroy what he called terror infrastructure. Israel Katz, the defence minister, wrote that the attackers' clan neighbourhood would be evacuated so that terrorist infrastructure could be dismantled. The army imposed a blockade on Hebron and nearby areas, launched raids on homes of attackers and suspects, and sealed several villages in the district. Netanyahu also asked for preparations for a total closure of the West Bank starting on 23 October.

Italy pushed back publicly. Antonio Tajani, Italy's foreign minister, said in Istanbul that he opposed the planned closure while supporting Israel's security and a Palestinian state. He also said Hamas must be disarmed and Gaza stabilised.

The reports do not say how many Hebron residents would be evacuated, and the accounts still differ on the number of wounded. Israeli authorities have already moved from a local blockade to preparations for district raids and a West Bank-wide closure.

The PHP Project released urgent fixes for two critical flaws, CVE-2026-109618 and CVE-2026-109619, after Amazon Threat Intelligence said attackers had tried to exploit one of them on 17 October, four days before public disclosure. Amazon caught the attempt through MadPot, its decoy system, and later identified proof-of-concept code and fresh attempts from anonymised infrastructure. Cloudflare also warned of early attacks against PHP sites on its platform.

The flaws matter because PHP still sits underneath a huge share of the web. Wiz's security team found the bugs with help from AI, and ANSA reported that the weakness had remained hidden for more than a decade. ZDNet said each flaw carries a critical severity score of 9.2 and affects most PHP builds. Researchers described one attack chain as exceptionally complex, but said frontier AI models reduced the barrier to finding it.

Precautionary shutdowns spread across banking, transport, government and health services from Tokyo to Helsinki. Mitsubishi UFJ Financial Group and Nomura suspended some web pages and digital access for urgent maintenance in Japan. Dutch government websites went offline on Wednesday as a precaution, and hospital websites were unreachable. Ministries, courts, health networks and social-security portals in several European countries also temporarily cut public traffic.

CERT-EU, Portugal's cybersecurity centre and the US Cybersecurity and Infrastructure Security Agency told organisations unable to patch quickly to take affected systems off the internet. Dan Guido, chief executive of Trail of Bits, said ordinary users could protect their own devices but could not fix the services they rely on.

The Justice Department filed a federal lawsuit in Alaska asking a judge to block certification of the Senate race if Republican incumbent Dan S. Sullivan loses to Democrat Mary Peltola by fewer votes than those cast for Daniel J. Sullivan Jr. The department argues that the similar names could confuse voters and produce a result lacking integrity. The case would matter only after election day and only if the incumbent loses narrowly.

Donald Trump said he personally directed the department to file the case. Speaking to reporters, he made the chain of command unusually plain.

Daniel J. Sullivan Jr., a retired teacher from Petersburg, says he is running on his own. Republicans call him a Democratic plant, pointing to his recent Republican registration, work with a Democratic strategist to get on the ballot and donations to Democratic candidates. Democrats deny any connection. The Alaska Supreme Court ruled in June that he could remain on the ballot, and the ballot identifies the incumbent as a Republican and the challenger as having no party affiliation.

Election-law specialists gave the suit a cold reception. Richard H. Pildes, a New York University professor, said it had little legal basis.

David Becker of the Center for Election Innovation & Research said federal authorities have no power to tell Alaska when and how to certify its election. Alaska votes on 3 November, with control of the Senate potentially tied to the result.

Brent crude traded at $116.90 a barrel on Friday after gaining more than 3.3% during the session. West Texas Intermediate stood at $103, up 3.5% intraday. Analysts at ING Think said markets were increasingly uneasy about a fresh escalation in the Persian Gulf that could disrupt oil flows, even though supply has so far held up. Reports that Donald Trump is weighing renewed strikes on Iran after the midterms also pushed prices higher.

Houthi rebels in Yemen said they had carried out four high-level operations within 48 hours using ballistic missiles and drones. Their spokesman, Yahya Sari, named targets including the Saudi defence ministry in Riyadh, the airports of Dammam and Abha, and the Yanbu refinery on the Red Sea. The Saudi-led coalition said it intercepted two drones in the south and a missile aimed at the capital. Saudi Aramco ordered staff at its Dhahran headquarters to work remotely, and the US State Department ordered some diplomats and family members to leave Saudi Arabia.

Iran also raised the stakes. Mohsen Rezaei, secretary of Iran's Supreme National Security Council, said Iran would strike oil facilities in up to seven Gulf countries, plus undersea telecoms cables, data centres and artificial-intelligence facilities, if the US and Israel launch a new bombing campaign. US Central Command said a naval blockade of Iranian ports had kept Tehran from exporting crude worth at least $25bn.

The election calendar now sits beside the shipping lanes. Israel holds legislative elections on 27 October, and Donald Trump has promised not to attack Iran before the US midterms on 3 November.