Daily Brief
2026-10-22
Top Story
Signs of one of two critical PHP flaws surfaced in a 2024 audit, but the fix stalled until researchers showed in August that attackers could run their own code on servers
PHP, the programming language behind much of the web, shipped emergency patches October 21st for versions 8.2 and later. Older versions get no regular update. Cisco Talos, Cisco's threat-research unit, estimates early on that about half of PHP systems will not receive a patch.
FinCEN, the US Treasury's financial-crimes unit, used a subpoena power for the first time in its investigation of a Greek bank's possible ties to Iran
FinCEN is working with European partners, including in Greece, under the Bank Secrecy Act, the US anti-money-laundering law. It also sent multiple requests for information about banks' relationships with Iranian financial institutions under US sanctions. Treasury did not name the bank.
Germany's financial regulator, BaFin, says a court has appointed a liquidator to wind up the Hamburg branch of Iran's Bank Saderat, whose banking license it pulled in November 2025
BaFin ordered the liquidation on June 11th and the bank dropped its appeal in September. About 200,000 euros of customer deposits need sanctions clearance from the Bundesbank, Germany's central bank, before any payout.
The US sanctioned Karnakis and Karnakis, a law firm in Panama and Greece, plus a ship manager, two shipping agencies and nine vessels over Iran's shadow oil fleet
Treasury named five individuals tied to the firm, ship manager Roxette Maritime, and the agencies Amigoz Singapore and Dubai's Whales Shipping Line.
United States
A New Mexico judge cut the state's award against Meta over Facebook's handling of user data from $220 billion to $25 billion, with 15% annual interest until it is paid
A September jury found Meta broke New Mexico's unfair practices law 43 million times, at up to $5,000 a violation.
The US Energy Department is lending out up to 315,000 barrels from the Northeast Home Heating Oil Reserve, with bids due October 27th
Borrowers return the same volume plus a premium so the reserve is refilled ahead of the 2027-2028 heating season, and Energy Secretary Chris Wright calls it a temporary measure to solve a temporary supply disruption.
Around the World
A license letting companies wind down existing business with US-sanctioned French refiner La Nivernaise de Raffinage expires at 12:01am Eastern on October 23rd
General License AA, issued on August 24th, covers winding down or maintaining agreements already in force with the refiner and any entity it owns at least half of.
Kremlin-linked payments firm A7 processed at least 283 tons of cash rubles, worth more than $14 billion, most of it bound for China, the International Consortium of Investigative Journalists reports
Between November 2024 and July 2025, much of the cash came from Moscow wholesale markets such as Sadovod and was trucked to Promsvyazbank, the Russian state defense bank, and credited to A7 accounts.
Haiti's central bank said no Haitian financial institution is authorized to negotiate with cybercriminals over ransom
The statement came on October 20th, after an anonymous source told The Haitian Times that the director of Capital Bank had been negotiating over a ransom demand.
China's securities regulator proposed letting accounting and law firms pay defrauded investors up front and then recover from others responsible
The draft would extend to accounting and law firms the arrangement under which a company's controlling shareholder or its securities firm pays investors their losses up front and then recovers from the other responsible parties, and it describes the payment as a voluntary civil settlement rather than a requirement.
A European court ruling means Spanish banks must refund customers for unauthorized payments within 24 hours and argue afterwards about whether the customer was negligent, a potential bill of close to a billion euros
Cinco Dias reports that an October 15th Court of Justice of the European Union ruling bars banks from refusing a refund because the customer was grossly negligent, so a bank must repay first and go after the customer later if it wants the money back.
US cybersecurity stocks jumped on Wednesday after governments took websites offline over two flaws in PHP, the web programming language
Yicai, a Chinese business outlet, reports a Nasdaq fund that tracks cybersecurity stocks rose 2.72%, with Datadog, a software-monitoring company, up more than 6% and Zscaler, Cloudflare and Okta up more than 5%.
Microsoft says Storm-0940, a China-aligned group, used a compromised cloud backup service from the software vendor ConnectWise, plus open-source AI agent software, to try to sign in to more than 2,250 organizations' Microsoft 365 accounts
Microsoft assesses that the group, active since 2021, took control of the credentials of ConnectWise cloud applications and drove sign-in attempts at up to 2,900 a minute, though it says most of the targeting did not succeed.
Australian infrastructure fund IFM Investors agreed to buy 63.9% of Associated British Ports, the UK's largest port operator, in a deal Bloomberg says values the company at about 10 billion pounds
The deal needs shareholder and regulatory approvals including a national security review, and is expected to close in the first half of 2027.
Ghana's president said he wants to end exports of raw materials by 2030
President John Dramani Mahama said at the Financial Times Africa summit in London on October 21st that he wants bauxite, manganese, lithium and iron processed inside Ghana rather than shipped out as ore.
Creditors who say they hold about $272 million of Braskem bonds asked a US bankruptcy court in New York to force the US financing arm of the Brazilian petrochemical maker into Chapter 11 bankruptcy
Braskem said on October 21st that three investment funds, holding about 47% of the bonds due 2041, filed against Braskem America Finance Company, which has about $589 million of notes. The US Bankruptcy Court for the Southern District of New York has not yet ruled on whether to accept the petition. The parent and other group companies are not debtors, and the filing is separate from Braskem's out-of-court restructuring in Brazil.
Iran's Revolutionary Guard says it struck four oil-carrying ships in the Persian Gulf and set them on fire
The claim is the Revolutionary Guard's own statement, which names no flag, owner or hull.
Public bodies in the Netherlands, Denmark, Finland and France took sites offline over flaws in PHP, the web programming language, among them the Port of Rotterdam and Denmark's national school platform
Yicai, a Chinese business outlet, names the four countries and the sites. Reuters reports government agencies across Europe took sites offline as a precaution. Amazon's security chief says a decoy server it runs caught an exploitation attempt on October 17th and calls the flaws broadly exploited, but says it is unclear whether any attempt would have worked on a real site.