Crosswire — October 23, 2026

DAILY BRIEFING — 23 October 2026 GEOPOLITICS Russia–Ukraine: Talks Back On Paper, Missiles Still Flying What's new: US envoy Steve Witkoff met Putin in St Petersburg. A day earlier he met Zelensky and the Norwegian and Finnish leaders in Oslo, with Jared Kushner joining by video. Hours after Moscow said it was "ready in principle" to resume talks, Russian missiles hit Kyiv overnight, damaging houses and injuring six people. Where each side stands: Moscow: Kremlin aide Yuri Ushakov dismissed the US proposals as not very "useful." He also floated a new round of talks around 10 November in Abu Dhabi, framed around a post-war "security system." Putin told Witkoff that Russian forces are advancing everywhere and hold the "strategic initiative." Kyiv: Zelensky says the talks covered security guarantees and a ceasefire on energy infrastructure. He would accept a freeze along current lines as a minimum starting point, with guarantees to follow. That is a notably flexible opening position. Washington: Trump says a deal is "maybe now the closest we've been." He has said this before with nothing to show for it. The battlefield: Ukraine and European governments describe a near-stalemate, which contradicts Putin's claims. Russia holds roughly 20% of Ukraine. The goodwill gesture: Russia freed Stephen Hubbard, a 74-year-old American sentenced to nearly seven years for allegedly fighting for Ukraine. No swap was involved. Witkoff called Putin a "humanitarian." JD Vance later recast the remark as diplomatic courtesy, not endorsement. The release cost Moscow little and bought it goodwill with the White House at a useful moment. Context (covered earlier this week): This round comes amid the US freeze on congressionally mandated sanctions, the Russian diesel waiver, and Kyiv's disputes with Washington over Starlink throttling and intelligence sharing. Intelligence sharing: Zelensky has softened his position and now says sharing "works." Starlink: A bipartisan Senate group wants an investigation into the throttling. Leadership: Trump's suggestion that Ukraine needs a new president and that "somebody else" should negotiate hangs over everything. On the ground: Ukrainian soldiers quoted in a US press report describe Russian troops fighting from old Soviet-era pipelines. They have set up machine-gun nests, sandbag barricades and living quarters inside. Ukraine is reportedly building a deep, brigade-level underground command post in Sumy region. Russian coverage attributes this to rapid Russian advances there. That claim is unverified and fits Moscow's preferred narrative. The more reliable takeaway is structural: drone saturation is pushing both armies underground. Analysis: Moscow is running a familiar playbook. It signals openness, rejects the substance, sets its own venue and agenda, and keeps striking. The "security system" framing points toward Russian demands on NATO and Ukraine's alignment, not just territory. Zelensky's offer to freeze the lines removes Trump's main complaint that Kyiv is the obstacle. That increases pressure on Washington to show what it is getting from Moscow in exchange for its concessions. Watch: Whether Abu Dhabi on 10 November actually happens, and who attends. Whether strikes on energy infrastructure pause or escalate as winter approaches. Whether Congress acts on the sanctions freeze before the 60-day window closes. --- Yemen War Spills Further Into Saudi Arabia What happened: A Houthi attack on King Fahd International Airport in Dammam killed two people and injured eight. The Houthis claimed it as part of a 48-hour wave of drones and missiles that they say also targeted: the defense ministry in Riyadh, an Aramco facility in Yanbu, Abha airport. Separately, debris from an intercepted drone killed two foreign workers near the Shaybah oil field. Nobody has claimed that attack. Scale: Saudi losses: At least 21 people have been killed in attacks on Saudi airports since early October. The 10 October Riyadh airport strike killed 13 and injured 308, the worst attack in the kingdom in over a decade. Yemeni losses: Casualty figures vary enormously by source. The Houthi-run health ministry reports 155 civilian deaths in three months. The government health ministry reports at least 1,574 deaths over the same period. Neither figure is verified. Displacement: More than 256,000 Yemenis have been displaced. Foreign response: The US has ordered some diplomats out of Saudi Arabia. The UK is deploying jets to help defend the kingdom. How the truce collapsed: July: The informal four-year truce began breaking down when the Houthis declared a "maritime embargo" on Saudi Arabia, citing a Saudi blockade and a strike on Sanaa airport. September: Houthi forces seized part of the Red Sea coast near the Bab al-Mandab Strait. That pushed oil prices higher, on top of six months of US/Israel–Iran war. Now: Saudi-backed forces claim to have retaken high ground overlooking the strait. Fighting continues there and around Taiz, Marib, al-Jawf, Dhale and Shabwa. Why it matters: This is now a hot war hitting Saudi civilian aviation and energy infrastructure, with a global chokepoint contested. Combined with the Iran war and Trump's complaints about Ukrainian refinery strikes, energy prices are becoming a major driver of US foreign policy, including its softer line on Russia. Watch: Strikes on Aramco export infrastructure. Shipping insurance rates through Bab al-Mandab. Whether Western defensive deployments drift toward offensive roles. --- Israel Votes 27 October: First Post–7 October Election The race: Polls show a tight contest between Benjamin Netanyahu and former IDF chief Gadi Eisenkot, who founded the Yashar Party and is running on accountability for 7 October. Other players: Naftali Bennett and Avigdor Lieberman on the right. Yair Golan on the left. Two Arab blocs, which nearly all major Jewish parties refuse to work with. The math: A majority needs 61 of 120 seats. Netanyahu likely needs far-right partners again, some of whom advocate West Bank annexation and Palestinian "migration" from Gaza. Critics say that could amount to forced displacement. Where the camps actually differ: Gaza: Not by much. Both camps back Trump's plan, under which Hamas disarms in exchange for a phased Israeli withdrawal. Eisenkot pledges to end Hamas rule within 18 months, by force if needed. West Bank: This is the real gap. Eisenkot opposes the E1 settlement project, which would effectively bisect the territory, and promises to act against extremist settlers. Netanyahu's camp backs continued expansion. UN data show settler violence at record levels. Two-state solution: No leading Jewish party is campaigning for one. On the ground in Gaza: A year into the ceasefire, Israel controls more than half of Gaza and strikes nearly every day. The Hamas-run health ministry reports more than 74,000 deaths. The UN considers the ministry's figures reliable, but they have not been independently verified. Other issues: Ultra-Orthodox conscription exemptions, the judicial overhaul, and cost of living. Watch: Exit polls at 20:00 GMT on 27 October and official results on 4 November. Coalition talks could drag on for weeks. Israel held five elections between 2019 and 2022, so a hung outcome is entirely plausible. --- Haiti: Bukele Threatens Escalation Over Captured Airmen What happened: Four Salvadoran air force personnel serving with the UN-approved Gang Suppression Force went missing after an ambush in gang-held Croix-des-Bouquets. An explosive set their armored vehicle on fire. El Salvador says they were pilots and technicians handling medical evacuations, not combatants. The response: Bukele launched a military rescue operation and warned that Wednesday's action was "nothing" compared with what will follow if all four are not returned alive. The GSF reports clashes backed by helicopters and several gang members killed. No group has claimed the abduction. Context: Gangs control about 85% of Port-au-Prince and are expanding into rural areas. The UN warns that gangs are adapting and stepping up reprisals against civilians. Haiti has held no elections since 2016, and the planned 13 December vote has been postponed indefinitely. Why it matters: Bukele's domestic brand rests on crushing gangs. He now has personal political stakes in a foreign theater, which raises the risk of a heavy-handed operation in a dense urban area. This is also the first major test of whether the GSF can protect its own personnel. --- TECH & AI Anthropic's Draft IPO Prospectus: Huge Growth, Huge Bills These figures come from press reports on a draft filing, not a final prospectus. The headline numbers: Revenue: $16.3B in H1 2026, up from $1.1B a year earlier. Roughly 15x growth is extraordinary at this scale. Net loss: $80.7B in H1 2026. About $72B of that is non-cash write-downs from revaluing convertible bonds and other fundraising instruments. The operating loss is far smaller than the headline suggests, though still substantial. Compute and infrastructure spending: About $9B in H1, more than all of 2025 ($7.3B). Long-term commitments: About $450B over 7–10 years: ~$111B to Google Cloud ~$110B to AWS ~$31B to Microsoft up to $86B for Nvidia capacity rented through smaller AI cloud providers The red flag: Most revenue came from two customers, and Anthropic expects that concentration to continue. Public-market investors will discount that heavily. Risk disclosures: Roughly a third of the document covers risks, including a "catastrophic AI incident" whose damage could be too large to insure, and growing local opposition to data centers. Why it matters: This is the first audited-style look inside a frontier lab's economics. It confirms that revenue can scale fast while capital commitments scale faster. Anthropic is now effectively a counterparty to all three hyperscalers at once. The $450B commitment only works if the revenue curve keeps compounding, and if those two key customers stay. Watch: The identity of the two major customers. Changes between the draft and final filing. How the market prices a frontier lab whose legal filings warn it could cause uninsurable harm. --- The PHP Flaw Found by AI, and Exploited at Machine Speed What happened: Discovery: OpenAI's model "GPT-5.6 Sol" reportedly found and verified two critical PHP vulnerabilities in late summer. Patches: After about two months of coordinated work, fixes for the four most recent PHP versions shipped on 21 October. OpenAI also released a Codex "skill" that scans sites for the flaws. Exploitation: Cloudflare's Matthew Prince says attempts hit millions by the morning of 22 October. Thousands of attempts appeared before public disclosure, and hundreds of thousands within two hours of it. Industry reaction: Satya Nadella described an exceptionally long day and night for security teams, unlike anything he had seen in a long time. Exposure: PHP runs roughly 69% of websites. Precautionary shutdowns around the world: Russia: Many sites on Russian hosts went dark before patches arrived. Bitrix24 and Beget restricted some features. UK: A major British broadcaster briefly took its website offline. Japan: Sega, Bandai Namco, MUFG, ANA, JR East, Nomura and Tokio Marine paused services. The finance ministry and tax agency restricted site access. South Korea: The government put the private sector on cyber-threat alert. Netherlands and Finland: Dutch hospital and party sites went offline. Both governments had already restricted sites on 21 October. Germany and Austria: Universities limited access. Status: No major confirmed breaches yet. Why it matters: This is the clearest real-world case so far of AI-driven vulnerability discovery at internet scale. The patch-to-exploit window has shrunk to hours. Attempts before disclosure suggest either leaks during the two-month coordination period or independent rediscovery, and either explanation is worrying. The same capability works for defenders and attackers alike. The broader pattern: October is shaping up to be brutal for security teams. Railway: The cloud host says attackers may have accessed customer API keys and database passwords, apparently targeting keys for AI services. It paused all deployments and told customers to rotate every credential. Scope and attribution are not confirmed. Railway links the breach to a broader campaign against developer platforms. GitLab: It patched a CVSS 10.0 flaw allowing unauthenticated remote code execution, which reportedly existed for about 12 years. Self-hosted administrators should update now. Watch: The first confirmed mass breaches from unpatched PHP servers. Any investigation into exploitation before disclosure. Whether regulators start asking how AI labs handle the zero-days their models find. --- Qwen3-Coder: Less Secure Code for "American" Clients? The claim: A reported test asked Alibaba's coding model, available since last year, to build a service for two hypothetical contractors. Apps for the US client were exploitable 70% of the time, versus 59% for the Chinese client. Explicitly requesting secure code pushed the US figure to 74%. The caveat: This circulated as a meme. Methodology, sample size and statistical significance are unclear, and it is not evidence of deliberate sabotage. Why it still matters: Code security shifting based on an irrelevant cue like client nationality is a real reliability problem, whatever the cause. It will feed procurement arguments against Chinese models in Western codebases. Watch: Independent replication, and whether similar effects appear in Western models when the nationalities are swapped.