Crosswire — October 24, 2026

DAILY BRIEFING: 24 October 2026 GEOPOLITICS Ukraine: A Humanitarian Truce in Oleshky, With Mismatched Dates

What's new: Russia and Ukraine have both confirmed a localised ceasefire around occupied Oleshky (Aleshki in Russian usage) in Kherson region. It is meant to allow aid deliveries and evacuations. The White House credits First Lady Melania Trump with brokering it, building on her earlier back-channel with Putin over Ukrainian children. Roughly 34 children have reportedly been returned since 2025.

The dates don't line up:

• Washington: 29 October.
• Moscow: Chief of General Staff Gerasimov announced a "silence regime" on the Kherson axis from 04:00 Moscow time on 27 October.
• Kyiv: Confirmed the deal but has given no date.
• Duration: Nobody has announced one.

A two-day gap on a truce this small is not trivial. It matters most for aid convoys moving along mined roads.

Conditions on the ground:

• About 6,000 residents remain, including 200 children, down from 24,000 before the war.
• Residents report malnutrition, mined roads, one partially working hospital, and people eating weeds.
• Evacuees can choose to go to Russia or Ukraine.

How Moscow frames it: Russian forces will carry out "engineering reconnaissance" and guarantee the convoy safe passage. Peskov praised both sides' human rights ombudspersons and stressed that Moscow treats humanitarian cooperation as separate from military matters. The Russian account is silent on how dire conditions have become under occupation.

Why it matters: This is the first concrete, mutually confirmed ceasefire arrangement in this negotiating cycle, even if it is tiny. It gives the White House a deliverable ahead of the midterms and gives Moscow a goodwill gesture at low cost. The pattern resembles last week's release of Stephen Hubbard.

Watch: Whether firing actually stops on the 27th, whether the dates get reconciled, and whether evacuees are genuinely free to choose Ukraine.

Starlink Caps: Trump Says Fixed, Kyiv Says Not

What's new: Ukrainian defence ministry sources say the restrictions are still in place, despite Trump's claim that Musk "put it back."

• Drones lose connection above 100 mph (161 km/h).
• One soldier reports dropouts at 50 mph in a vehicle.

The blame game:

• Trump: Now says he hasn't spoken to Musk and will "get it straightened out" if needed. The Wall Street Journal separately reports he told Musk he was frustrated with the caps.
• Musk: Denies causing the slowdown and points to the Pentagon, which controls the military Starshield variant.
• White House: Denies deliberately limiting the network.

Every principal denies responsibility, yet the throttling continues. Someone with authority over the network is either choosing the caps or tolerating them.

Backdrop:

• The Trump–Zelensky row over Ukrainian strikes on Russian refineries continues. Zelensky says the US threatened to cut intelligence sharing; Trump denies it and has suggested Ukraine needs a new president.
• The sanctions waivers and Russian diesel import deal still stand.
• This year's fuel price rises are attributed mainly to the Iran war, not the refinery strikes. That undercuts the economic rationale for pressuring Kyiv over them.

Kremlin Response: "Don't Wear Rose-Tinted Glasses"

Peskov was asked whether restored Starlink access would mean renewed Ukrainian strikes on Russian territory. He said US–Ukrainian military cooperation "never stopped" and warned against seeing Washington through rose-tinted glasses.

The message is that Moscow will pocket US goodwill without treating it as a shift in Washington's position. It also keeps expectations low before talks.

Abu Dhabi: Peskov says Putin has outlined the agenda for the upcoming trilateral talks, which were previously floated for around 10 November. The focus is post-settlement "security arrangements" for both Russia and Ukraine. That is Moscow's preferred framing: architecture first, and no clear ceasefire-first sequence.

Trump–UK Call: Gas First, Ukraine Barely

According to a Bloomberg report, Trump spoke with the British prime minister, named in the report as Andrew Burnham.

• Content: Trump says they mostly discussed reviving North Sea gas development and touched on foreign conflicts only "very superficially."
• Timing: It is reportedly their first contact since the Russian diesel deal.
• London's aim: Britain is said to be lobbying Washington not to turn on Zelensky.

This is single-source, secondhand reporting. The pattern still fits: European allies are trying to anchor Washington while the White House treats energy as its main lens.

---

MIDDLE EAST West Bank: Hebron Under Cordon Four Days Before Israel Votes

What happened: Two Palestinian gunmen killed two Israeli soldiers and wounded three at a checkpoint outside Hebron before being shot dead. The military says ammunition found in their car points to a larger planned attack on Route 35.

Response:

• Netanyahu vowed to "destroy" the attackers' neighbourhood, and demolitions have begun.
• He imposed cordons on Hebron (about 200,000 people) and nearby Halhul.
• He says he has reviewed plans for the largest West Bank operation in decades.
• Israeli rights groups call punitive demolitions collective punishment.

Coalition pressure:

• Smotrich wants a Gaza- or Lebanon-style campaign.
• Ben Gvir wants the Palestinian Authority dismantled.

The election angle: The vote is four days away. Likud cancelled campaign events, and Foreign Minister Katz accused the opposition, including frontrunner Gadi Eisenkot and Naftali Bennett, of undermining security. The attack lets the government shift the campaign onto security, its strongest ground.

Context: UN figures for the West Bank this year, excluding Friday's attack, show at least 96 Palestinians killed by Israeli forces or settlers and 4 Israelis killed by Palestinians. Settler violence during the olive harvest is adding fuel.

Watch: Whether a major operation launches before the vote, and how far it reaches beyond Hebron.

Hormuz Fallout: Oil Slick Hits UAE Coast

What happened: A slick from the Panama-flagged tanker Gem No.2, struck on 9–10 October, now stretches more than 35 km. It is washing ashore near Umm Al Quwain, closing some beaches. UAE authorities say containment is underway. All 22 Indian crew were rescued.

Context:

• The strike came during a record surge of attacks on shipping around the Strait of Hormuz.
• Analysts link the surge to Iran trying to assert control over the strait as US escorts increase.
• Both Iranian and US forces have attacked vessels in the ongoing conflict.
• Iranian state media claimed the tanker used an "unauthorized" exit route.

Environmental risk: The slick is near the Siniyah and Khor Al Beidah islands, a Key Biodiversity Area with corals, seagrass, green turtles and the critically endangered Halavi guitarfish. The full damage is not yet known. A similar slick hit Iran's Qeshm Island in August.

Why it matters: The war's costs are now landing physically on Gulf states that are not combatants.

---

AFRICA Sudan: Investigation Alleges Systematic RSF Targeting of el-Fasher Hospitals

Findings: A media investigation drawing on sources on the ground and six doctors documents:

• at least 43 attacks on health facilities between May 2024 and October 2025;
• 55 medical workers killed, 120 injured and 10 abducted or missing since April 2023.

The pattern doctors describe:

• Repeated shelling, with up to 25 precision drone strikes a day on the Saudi Hospital.
• Strikes on facilities after they relocated.
• Drones tracking patient transfers.

The culmination: The 25 October 2025 storming of the Saudi Hospital, where more than 460 patients and companions were allegedly killed. Satellite imagery appeared to show clusters of bodies, and the WHO condemned the reported killings.

Reactions:

• UN rights chief Volker Türk: Called the findings "deeply disturbing," consistent with his office's monitoring, and possibly war crimes.
• RSF: Calls it army propaganda, says the South Hospital was used as a military base, and argues the testifying doctors are aligned with the army along ethnic lines.

Weighing it:

• The investigators found no independent evidence for the RSF's military-use claim.
• The testimony comes from one side of a polarised war, though it matches UN monitoring.
• The army faces its own accusations: it is believed to be behind the March 2026 drone strikes on al-Daein hospital, which killed dozens. It denies responsibility.
• UN investigators have said el-Fasher bore "hallmarks of genocide" against non-Arab groups.

No settlement is in sight.

---

TECH & CYBERSECURITY "php2shell": The Fastest Mass-Exploitation Wave Yet

What happened: The PHP Foundation disclosed critical flaws in the PHP language itself, spanning many past versions. Under certain conditions, an unauthenticated attacker can execute code remotely.

Scale:

• Wiz, which helped find the flaws, puts PHP at about 70% of websites. Treat that as a vendor estimate.
• In Russia's .ru zone, PHP is around 94% of sites.

Exploitation curve, per Cloudflare CEO Matthew Prince:

• "Thousands" of attempts in the 10 hours before disclosure, which suggests leakage or parallel discovery.
• Tens of thousands within 45 minutes after disclosure.
• "Millions" by Thursday.

UK impact:

• 32 government services were unavailable and 4 partially unavailable, mostly as a precaution. The services were not named.
• The government says no major critical public-facing services were affected.
• Small businesses were hit. Garages, for example, couldn't issue MOT certificates online.
• The government says it is working with OpenAI and international partners. It did not explain OpenAI's role, which likely relates to AI-assisted detection or patching.

Elsewhere:

• Finnish government sites, a Dutch cybersecurity agency and parts of Wikipedia briefly went offline and have recovered.
• Orange suspended some services globally while it deployed fixes.
• Amazon reported exploit attempts but said its sites ran normally.
• Russia: A letter attributed to the FSB reportedly orders government agencies, banks, telecoms, and energy, transport and healthcare firms to patch PHP, audit servers and check logs. If they can't patch quickly, they are told to restrict access "up to and including shutting servers down." The letter hasn't been published and doesn't name the flaw. Given PHP's dominance in .ru, broad compliance could cause wide disruption.

Status: The UK's National Cyber Security Centre calls the event "unprecedented" but sees no confirmed breaches so far. Experts warn compromises may take months to surface. Patching is underway but lagging.

The Bigger Trend: Vulnerability Counts Doubling

The PHP episode fits a broader pattern.

• Volume: About 85,000 software vulnerabilities have reportedly been logged so far in 2026, roughly double last year. The past three months ran at 12,000–14,000 a month.
• Exploitation: The number of flaws actually exploited has also reportedly nearly doubled.
• Speed: NCC Group says the window from disclosure to exploitation has shrunk from weeks to days or hours.

Caveats: The data source behind these figures wasn't specified. AI-assisted exploit writing is the obvious suspect, and plausible. Expanded CVE reporting, automated discovery and cataloguing changes could also inflate the numbers.

Why it matters: Even if the causes are mixed, the operational conclusion holds. Patch cycles built on weeks of lead time no longer work. PHP is the stress test, and many organisations are failing it.

Watch: Breach disclosures over the coming weeks and months, and whether governments start requiring faster patching.

Nvidia Courts Kazakhstan as an AI Compute Hub

What happened: Jensen Huang visited Kazakhstan and pitched it as a major AI compute hub serving Europe, citing its energy resources and its ambition to be an "AI nation."

The deal elements:

• Data Center Valley, Ekibastuz: 300 MW available now, with plans for 1 GW.
• Partners: Firebird AI KZ and Kazakhtelecom.
• Ecosystem: Huang highlighted Higgsfield as Kazakhstan's first tech unicorn and called the cooperation "just the beginning."
• Recognition: President Tokayev awarded him the Order of Dostyk, First Class.

Market context: Nvidia is reported at about $5.13T in market value, edging Apple at about $5.08T.

The read:

• This is Nvidia's sovereign-AI sales strategy extended to energy-rich Central Asia.
• Questions to watch: export-control compliance, given Kazakhstan's proximity to Russia and China, and whether a 1 GW buildout is actually financed.

On AI safety: Huang also pushed back on Dario Amodei's call to slow AI development for safety reasons. His position: a company unsure of its product should hold back that product, but the industry shouldn't pause as a whole. The split between the leading chip supplier and a leading lab over pace is now openly public.