Daily Brief, October 22, 2026
Daily Brief, October 22, 2026
Top Story
PHP's maintainers took no action on one of two critical flaws after a 2024 audit, then shipped emergency patches on October 21st
The patches cover PHP 8.2 and later, so anything older gets no fix at all, and Cisco Talos estimates roughly half of vulnerable systems may never be patched.
Source: The Record
Iran enforcement perimeter
The US Treasury's financial-crimes unit subpoenaed a Greek bank over potential ties to Iran and asked six other European banks about their ties to sanctioned Iranian institutions
The Treasury statement, as Iran International reported it, did not name the Greek bank.
Source: Iran International
Germany's financial regulator published that Bank Saderat Iran's Hamburg branch lost its banking license in November 2025 and has been ordered into liquidation
Roughly 200,000 euros of customer deposits need sanctions clearance from the Bundesbank, Germany's central bank, before any payout.
Source: BaFin
The US sanctioned Karnakis and Karnakis, a law firm in Panama and Greece, plus a ship manager, two shipping agencies and nine vessels over Iran's shadow oil fleet
Treasury named five individuals tied to the firm, ship manager Roxette Maritime, and the agencies Amigoz Singapore and Dubai's Whales Shipping Line.
Source: gCaptain
United States
Enforcement & Liability
A New Mexico judge cut the state's award against Meta over Facebook's handling of user data from $220 billion to $25 billion, with 15% annual interest until it is paid
A September jury found Meta broke New Mexico's unfair practices law 43 million times, at up to $5,000 a violation.
Source: The Record
Infrastructure & Capacity
The US Energy Department is lending out up to 315,000 barrels from the Northeast Home Heating Oil Reserve, with bids due October 27th
Borrowers return the same volume plus a premium so the reserve is refilled ahead of the 2027-2028 heating season, and Energy Secretary Chris Wright calls it a temporary measure to solve a temporary supply disruption.
Source: US Department of Energy
Around the World
Enforcement & Liability
A license letting companies wind down existing business with US-sanctioned French refiner La Nivernaise de Raffinage expires at 12:01am Eastern on October 23rd
General License AA, issued on August 24th, covers winding down or maintaining agreements already in force with the refiner and any entity it owns at least half of.
Source: Sanctions.org / TurboFAC
Kremlin-linked payments firm A7 processed at least 283 tons of cash rubles, worth more than $14 billion, most of it bound for China, the International Consortium of Investigative Journalists reports
Between November 2024 and July 2025, much of the cash came from Moscow wholesale markets such as Sadovod and was trucked to Promsvyazbank, the Russian state defense bank, and credited to A7 accounts.
Source: ICIJ
Haiti's central bank said no Haitian financial institution is authorized to negotiate with cybercriminals over ransom
The statement came on October 20th, after an anonymous source told The Haitian Times that the director of Capital Bank had been negotiating over a ransom demand.
Source: The Haitian Times
China's securities regulator proposed letting accounting and law firms pay defrauded investors up front and then recover from others responsible
[ZH · Caixin]
The draft would extend to accounting and law firms the arrangement under which a company's controlling shareholder or its securities firm pays investors their losses up front and then recovers from the other responsible parties, and it describes the payment as a voluntary civil settlement rather than a requirement.
Source: Caixin
A European court ruling means Spanish banks must refund customers for unauthorized payments within 24 hours and argue afterwards about whether the customer was negligent, a potential bill of close to a billion euros
[ES · Cinco Días]
Cinco Dias reports that an October 15th Court of Justice of the European Union ruling bars banks from refusing a refund because the customer was grossly negligent, so a bank must repay first and go after the customer later if it wants the money back.
Source: Cinco Días
Cyber Threats
US cybersecurity shares rose as European governments took websites offline over flaws in PHP, the software behind those sites, China's Yicai reports
[ZH · Yicai]
Yicai reports the Nasdaq cybersecurity ETF rose 2.72% on Wednesday, with Datadog up more than 6% and Zscaler, Cloudflare and Okta up more than 5%, as governments took sites offline.
Source: Yicai
Microsoft says Storm-0940, a China-aligned group, used a compromised cloud backup service from the software vendor ConnectWise, plus open-source AI agent software, to try to sign in to more than 2,250 organizations' Microsoft 365 accounts
Microsoft assesses that the group, active since 2021, took control of the credentials of ConnectWise cloud applications and drove sign-in attempts at up to 2,900 a minute, though it says most of the targeting did not succeed.
Source: Microsoft Threat Intelligence
Supply Chain Risk
Australian infrastructure fund IFM Investors agreed to buy 63.9% of Associated British Ports, the UK's largest port operator, in a deal Bloomberg says values the company at about 10 billion pounds
The deal needs shareholder and regulatory approvals including a national security review, and is expected to close in the first half of 2027.
Source: gCaptain
Ghana's president said he wants to end exports of raw materials by 2030
President John Dramani Mahama said at the Financial Times Africa summit in London on October 21st that he wants bauxite, manganese, lithium and iron processed inside Ghana rather than shipped out as ore.
Source: RFI Afrique
Creditors filed an involuntary Chapter 11 petition in New York against the US finance subsidiary of Brazilian petrochemical maker Braskem, over roughly $589 million of notes
[PT · Valor Econômico]
Braskem said on October 21st that FFI Fund, FYI and Olifant Fund filed against Braskem America Finance Company, an indirect subsidiary that raises money in international markets.
Source: Valor Econômico
Geopolitical Shocks
Iran's Revolutionary Guard says it struck four oil-carrying ships in the Persian Gulf and set them on fire
[RU · Interfax]
The claim is the Revolutionary Guard's own statement, which names no flag, owner or hull.
Source: Interfax
Infrastructure & Capacity
The Netherlands, Denmark, Finland and France took government and public-sector sites offline over flaws in PHP, the language most websites run on, among them the Port of Rotterdam and a Danish school platform
Reuters reports the sites went down as a precaution ahead of patching, and Amazon says the flaws are now broadly exploited in the wild.
Source: Reuters via Daily Maverick
Also Today
A tanker with capacity for 40,000 tons of diesel is due to sail for the US on October 22nd, Russia's first cargo after Putin agreed in a call with Trump to relax export limits
Source: gCaptain
Brent passed $111 after Houthi strikes on a Saudi oil field and an international airport, and the US ordered non-emergency staff out of the kingdom
Source: OilPrice
Get the full risk analysis every Sunday. Manage your subscription.
