1. Critical PHP flaws send governments scrambling
Several European governments took official websites offline this week as the PHP project rushed out emergency fixes for two critical flaws in the programming language, used by about 70% of websites whose server-side language is known, according to W3Techs. The bugs, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10, let attackers run code on servers without a password. PHP released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October, warning that "updating is the only safe choice". Amazon says attackers started probing the flaws on 17 October, four days before the patches; details had leaked online ahead of the planned disclosure, according to the PHP team. The flaws are "now being broadly exploited in the wild", said CJ Moses, Amazon Web Services' security chief, adding that it was unclear whether the early attempts would have worked on real systems. The US National Security Agency advised organisations that cannot update at once to "take the system offline"; Britain's National Cyber Security Centre told them to consider it. Germany, France, Belgium, the Netherlands, Finland and the Czech Republic shut some official sites, Al Jazeera reported; CNN also cited Denmark. Calif, working with OpenAI, and Alphabet's Wiz reported the flaws in August.
2. Lockheed's backlog hits $292 billion as fuel sinks American
Two sets of results on Thursday 22 October showed how differently missile demand and costly fuel are playing out for American companies. Lockheed Martin reported a record backlog of $292.0 billion, up 27% in a quarter, including $52.5 billion from a multi-year order for PAC-3 MSE interceptors, the missiles fired by Patriot air-defence batteries. Third-quarter sales rose 11% to $20.7 billion and net earnings 14% to $1.8 billion, while sales at its missiles division jumped 24% as production of PAC-3, THAAD and other missiles ramped up. The group raised its 2026 forecasts and now expects free cash flow of $7.8 billion to $8.0 billion. "The sustained financial momentum across our portfolio gives us confidence to increase our outlook," said chief executive Jim Taiclet. It also warned that costs on an F-35 contract now exceed its funding. American Airlines posted record third-quarter revenue of $16.3 billion, up 19%, but a net loss of $269 million, as its fuel bill jumped 67.5% to $4.6 billion: it paid $3.85 a gallon, against $2.37 a year earlier. It expects about $4.70 in the fourth quarter, nearly double a year earlier, and an adjusted loss of $1.00 to $1.60 a share for 2026.
3. Washington targets a law firm, and a Greek bank, in its Iran hunt
The US Treasury on Wednesday 21 October sanctioned Karnakis and Karnakis, a law firm based in Panama and Greece that it says has supported illicit Iranian shipping for years by registering companies owning "shadow fleet" vessels, which carried hundreds of millions of dollars' worth of Iranian steel, petroleum and petrochemicals. Sofianos, Konstantinos and Ioanis Karnakis Kosmas and Pedro and Roberto Ortega Jones, all Panamanian nationals, some also Greek, were also designated, as were a ship manager, Roxette Maritime, and its seven Panama-flagged vessels, a Singapore port agent, Amigoz, and a Dubai firm, Whales Shipping Line, with two support vessels: nine ships. The Treasury's financial intelligence unit, FinCEN, said it had issued its first administrative subpoena under section 5318(k) of the Bank Secrecy Act to advance its investigation into "a Greek bank's potential ties to Iran and its proxies". That section lets Treasury subpoena records from foreign banks with correspondent accounts in the US. FinCEN did not name the bank, and said it was working with European partners, "including in Greece". "Whether you are conducting illegal oil transfers at sea or sitting in the corner office of a law firm, if you are supporting the Iranian regime, we will find you and sanction you," said Treasury Secretary Scott Bessent.
4. Interpol arrests 1,462 in an African cybercrime sweep
Police in 20 African countries and the United States arrested 1,462 suspected cybercriminals in Operation Serengeti III, Interpol said on Thursday 22 October from its headquarters in Lyon. Run from 29 June to 31 August, the operation disrupted 10,909 malicious networks, recovered more than $105 million and identified 65,929 victims of schemes linked to more than $385 million in losses. In Uganda, police dismantled two transnational rings running investment and pension fraud aimed at victims in Asia, arresting 365 foreign nationals. In Angola, they shut two illegal cryptocurrency mining centres, arresting nine people and seizing more than 2,000 mining devices and six illegal power transformation stations. In Nigeria, one suspect was arrested over a phishing operation that had amassed about 2.1 million email addresses, and another over an investment fraud promoted on messaging apps that moved more than $2.4 million in suspected proceeds, much of it through crypto. Tanzania dismantled a malicious mobile-loan app scheme and Gabon a vehicle-import fraud network run on social media. "Cybercrime networks operate without regard for borders, exploiting technology to target victims on an unprecedented scale," said Neal Jetton, Interpol's director of cybercrime. It is the third such operation: the 2024 and 2025 editions led to 1,006 and 1,209 arrests.
5. Bukele vows to rescue four soldiers missing in Haiti
El Salvador's president, Nayib Bukele, said on Wednesday 21 October that he had launched a military operation to rescue four Salvadoran soldiers, aviation technicians missing in Haiti since gangs attacked their armoured vehicle on Sunday 18 October in Santo, in Croix-des-Bouquets on the outskirts of Port-au-Prince. The men fled the burning vehicle and have not been seen since. They serve with the UN-backed Gang Suppression Force, which has more than 2,000 personnel from countries including El Salvador, Chad, Jamaica and Guatemala; it was the first major attack on the force since it began operating. "Today's attack is nothing compared to what is coming if they do not release the four hostages alive," Bukele wrote on X, in AP's translation, without saying who would take part. Haiti's government called their release an "absolute priority". No group has claimed the attack; AP says gangs including 400 Mawozo, Chèn Méchan and Kraze Barye control the area. Gangs control an estimated 70% of the capital. Bukele says his contingent is non-combat, made up of pilots and technical staff, but a law passed in early October widened its mandate. At home, Rafael Aguirre, presidential candidate of the opposition FMLN, demanded on 19 October that the soldiers be pulled out of Haiti.
6. US embassy accuses Canadian politicians of meddling in the midterms
The US embassy in Canada accused Canadian politicians on Wednesday 21 October of seeking to influence the 3 November US midterm elections, in a fact sheet that cited Ottawa's push against Donald Trump's tariffs. It named Industry Minister Mélanie Joly, who said in August that Canada was "targeting products that will target states in the US" and met Democratic officials in Boston and Chicago in September, and Ontario's premier, Doug Ford, whose anti-tariff advertisement using clips of Ronald Reagan led Trump to call off trade talks in October 2025. It also listed 11 people charged or sentenced for voting illegally in US elections between 2012 and 2024, without presenting evidence linking them to any Canadian government effort, Al Jazeera reported. "All Canadians should refrain from attempting to participate in or influence U.S. elections in any way," the embassy said. Joly and Ford rejected the allegations, Euronews reported. Days earlier, Prime Minister Mark Carney had said: "we don't get ourselves involved in their elections, they don't get themselves involved in our elections." On 21 October, Carney and Ford announced billions of dollars in support for Ontario's steel and car industries, hit by US tariffs. "Their approach has changed. So must ours," Carney said.
Today
