Crosswire — October 22, 2026

DAILY BRIEFING GEOPOLITICS Sudan: Army Drone Campaign Kills 300+ and Hits a UN-Patrolled Zone

What happened: Over Sunday and Monday, a wave of drone strikes reportedly killed more than 300 people across two areas. The army is blamed for the strikes.

• West Kordofan (about 150 dead):
• A truck carrying roughly 200 mourners was hit as it arrived in Al-Dabab, killing 145.
• A strike on a funeral tent killed five more.
• A market in Al-Mujlad was also hit; casualties are unknown.
• A conflict monitor traces the drones to army-held Kadugli. The army has not addressed these specific allegations and says it does not target civilians.
• Abyei (153 dead): A strike hit Amiet Market. The toll was revised up from 73.
• A Sudanese military source admitted the strike and called the market an RSF fuel depot.
• Satellite imagery shows heavy burning and at least one fuel tanker.
• That does not change the core problem. Abyei is a weapons-free zone with more than 2,800 UN peacekeepers, jointly administered with South Sudan.
• Khartoum: A separate drone strike near the airport killed four, including three children. The army says it shot down other RSF drones.

Why it matters:

• Cross-border risk. South Sudan has summoned Sudan's ambassador. Spillover fears are now concrete.
• Drones have become the war's default weapon. Foreign suppliers are arming both sides despite a partial embargo. Mass-casualty strikes on markets and funerals are becoming routine.
• The front has shifted south and west. Since the army retook Khartoum, fighting has moved into Kordofan and Darfur, where famine risk is highest. About 20 million people face acute hunger and over 14 million are displaced.

Watch: Any UN Security Council or peacekeeping response on Abyei, and whether Juba moves beyond diplomatic protest.

---

Russia–Ukraine–US: Talks Back On, Pressure on Kyiv Persists

What's new: After Putin met Steve Witkoff in St Petersburg, Kremlin aide Yuri Ushakov said Moscow is "ready in principle" to resume trilateral talks. These talks were frozen in February; Moscow blames Ukrainian strikes during its elections.

• Possible date and venue: Around 10 November in Abu Dhabi.
• Format: A US official says both Kyiv and Moscow accepted technical-level trilateral talks.
• Oslo meeting: Kyiv's acceptance came in Oslo, where Witkoff and Jared Kushner met Zelensky alongside the Norwegian and Finnish leaders. Reports conflict on whether this was Monday or Tuesday.

Read the fine print:

• Moscow wants the agenda framed around a post-war "security system." In practice, that means NATO posture rather than ceasefire lines.
• Ushakov dismissed the Oslo ideas as not very "useful."
• Putin claims Russia holds the "strategic initiative." Kyiv and European capitals describe a near-stalemate.
• "Ready in principle" plus a technical format means low commitment and high optionality for the Kremlin.

The US–Kyiv relationship. The sanctions waiver and diesel deal were covered earlier this week. What's new:

• Trump is escalating on Zelensky personally. He called him "not a good guy for us to deal with" and floated a new president or a different negotiator.
• The Patriot shortage is getting worse. One report says Ukraine has "only a couple" of interceptors left, amid a global shortage after the US-Iran war. This is unconfirmed by US officials.
• Early warning lapsed. Ballistic-missile early warnings were out for three days. Rubio denies any intelligence pause and blames a "software problem."
• A battlefield account of the satellite outage. A Ukrainian commander says his unit lost over $1M in drones when its Pentagon-funded Starshield link failed. Drones fell out of the sky, and front-line operations stopped for about three days. Separately, Zelensky says Starlink terminals cut out above about 130 km/h on parts of the front. That is likely a deliberate cap to stop the terminals being used on fast attack drones.
• Nobody claims the order. One report says the throttling order came from the White House; Rubio denies it. Trump denies that he or Musk ordered it. Musk suggests the US government may be responsible.

How the coverage diverges:

• Russian state-aligned outlets present the Starshield episode as recurring, front-wide paralysis. The evidence is one commander describing a three-day pause in his own unit.
• Western critical analysis leans heavily on Ukraine-sympathetic voices, including a former US ambassador to Kyiv and a European think tank.
• Several allegations remain unverified. The pattern of US moves is real, but its scale and intent are contested.

Signs of easing: After Oslo, Zelensky said early warning is restored and sounded optimistic on Patriots and Starlink.

The domestic driver: Trump blames Ukrainian refinery strikes for US fuel prices ahead of the midterms. Prices have been rising since the Iran war began. Expect continued pressure on Kyiv to scale back deep strikes.

Watch:

• Whether Abu Dhabi happens on schedule.
• Whether Kyiv is pressed to halt refinery strikes as an entry price.
• Patriot delivery numbers.
• Whether Congress reacts as the 60-day sanctions pause runs down.

---

Alberta Votes to Stay in Canada

What happened: Preliminary results show more than two-thirds of Alberta voters chose to remain in Canada.

Why it matters:

• A clear win for Carney. It comes during the US trade war and after Trump's repeated "51st state" taunts.
• A US contact admission. Separatist leaders acknowledged meeting State Department officials three times last year. They pitched an independent Alberta, including a possible oil pipeline through the US.

Carney's agenda:

• Energy: He is pitching Canada as an "energy superpower," including a Pacific pipeline to reach Asian markets.
• Trade diversification: This includes a still-uncertain offer of associate EU membership.
• US talks: He recently walked away from trade negotiations with Washington.

The constraint: The US still takes about 70% of Canadian exports, so a long trade war hurts.

Watch: Nine other referendum questions covered provincial powers, immigration costs and constitutional change. The final tallies will give Edmonton leverage in federal-provincial bargaining.

---

TECH & AI Two Serious Security Incidents at Once

PHP: critical RCE with exploits already in the wild

• The flaws: Two vulnerabilities, each rated 9.2/10, allow remote code execution on servers, according to security firm watchTowr. The bug has reportedly existed since 2012.
• Discovery: Researchers at Calif reportedly found it with help from an AI model called "GPT-5.6 Sol." That model name cannot be verified, so treat it cautiously. AI-assisted discovery of decade-old bugs is a real and accelerating trend, though.
• Active exploitation: A public exploit exists, and attacks reportedly began before patches shipped. Cloudflare says it has seen early attack attempts.
• Uneven patch coverage:
• 8.2–8.5: Official patches.
• 7.4–8.1: Only a minimal source fix you must build yourself.
• Older than 7.4: Nothing.
• Exposure: PHP runs most of the server-side web, and a large share of deployments run versions older than 8.2. If older versions are also vulnerable, about 884,000 servers could stay unpatched indefinitely.
• Government reaction: The Netherlands and Finland have reportedly taken some government services offline as a precaution. This is unconfirmed.

eMudhra: broken certificate keys

• The flaw: Researchers reportedly found 8 TLS certificates from the Indian CA eMudhra with keys that would allow impersonating any website.
• The reported cause: Keys were said to be 3–8 bits instead of 384 bits; one was reportedly just the number "4." Those details are bizarre enough to wait for the official incident report.
• Patch status: Major browsers have reportedly mitigated it. Linux distros, IoT devices and neglected servers may be exposed for years. A Mozilla engineer has published a test site to check your browser.

Why it matters: Both incidents show the same gap. The patched core of the internet moves fast, while the long tail of legacy systems stays exposed. Any admin running PHP older than 8.2 should treat this as an emergency today.

---

Anthropic's Draft IPO Numbers: Explosive Growth, Concentrated Risk

These figures come from reporting on a draft prospectus that has not been filed or verified.

• Revenue: $16.3B in H1 2026, up from $1.1B a year earlier, roughly 15x.
• Net loss: $80.7B. About $72B of that is non-cash write-downs on convertible bonds and other financing instruments, so the headline overstates operating burn.
• Compute: Almost $9B in H1, more than all of 2025.
• Cloud commitments: About $450B over 7–10 years:
• ~$111B to Google
• ~$110B to AWS
• ~$31B to Microsoft
• Up to $86B for Nvidia capacity via smaller AI-focused clouds
• The real red flag: Most revenue reportedly came from just two customers. The company expects future revenue to remain concentrated.
• Risk factors: They take up about a third of the draft. They include possible real-world harm from models, a potentially uninsurable "catastrophic AI incident," and local resistance to data-center construction.

Why it matters: This is the clearest look yet at frontier-lab economics. Revenue is exploding, but it depends heavily on a few clients and a few hyperscalers that are also competitors and investors.

---

Musk Weighs a Tesla–SpaceX Merger

The proposal:

• Both boards have formed special committees to examine a merger. No terms have been agreed.
• Musk favours the deal but has recused himself from the committees as a conflicted party.
• Tesla shareholders would have to approve it by at least 50%.

Scale: Tesla is valued at about $1.5T and SpaceX at about $2T. That would make it one of the largest mergers ever.

SpaceX results (first nine months):

• Revenue of $27B, up from $13.7B.
• A $1.1B loss over the period, but a $4.4B profit last quarter.
• Cloud compute for clients including Anthropic and Google brought in $7.5B in the quarter, up from $813M. This is now the growth engine.
• Starlink revenue was $5.2B, up from $3B.

Market reaction: SpaceX shares rose 8% after hours, Tesla 2%.

Why it matters:

• This continues Musk's consolidation. SpaceX already absorbed xAI and X before its June IPO, and the two companies share a chip venture, Terafab.
• It deepens the national-security tangle. The same conglomerate would run Starshield, which is at the center of the Ukraine throttling dispute. It would also sell compute to AI labs, including Anthropic, whose draft prospectus shows how dependent labs are on compute providers.

---

HEALTH Ebola Reaches Nigeria

The case:

• Nigeria confirmed a case in a non-Nigerian woman, reportedly a diplomat's wife, who travelled from Uganda to Abuja.
• She developed symptoms four days after arrival and is in isolation.
• Health officials have identified 44 close contacts.

Disputed travel history:

• Uganda says she had been in eastern DR Congo and only transited Uganda without symptoms. Uganda reports no active cases.
• Nigeria's health minister presumes she was infected in Uganda.

The wider outbreak:

• DR Congo's Bundibugyo-strain outbreak, which began in May, has caused more than 9,500 cases and at least 4,600 deaths.
• There is no approved vaccine or treatment for this strain, though trials are under way.
• Kenya has at least nine cases, and the US has raised its travel advisory for Kenya.

Why it matters: This is the first jump to West Africa's most populous country. Nigeria contained Ebola in 2014 and has stepped up traveller screening, but there is no vaccine for this strain.

Watch: Whether any of the 44 contacts become secondary cases over the next 21 days.