Chain Reactions, 18–24 October 2026

The protests that began in a French secondary school in September reached their most violent point last weekend. On Saturday 17th October, the Interior Ministry counted 550,000 people marching across France,¹ about 3,000 shops were damaged or looted,² and in Limoges, a city in central France, rioters set fire to the city hall, a listed building inaugurated in 1883. Its clock tower collapsed overnight.³

This week France counted the cost and tried to stop it happening again.

Arrests, curfews and a resignation refused

By Monday at least 2,400 people had been arrested, according to the Associated Press.⁴ By Tuesday the figure was about 2,500, of whom 123 were being held for trial, according to the justice minister, Gérald Darmanin.³ The prime minister, Sébastien Lecornu, said it was "a miracle" that no one had been killed.⁴

The interior minister, Laurent Nuñez, offered to resign, saying the authorities had "lost control" in some cities. President Emmanuel Macron refused and ordered an inquiry.⁴ Lecornu then asked the prefects, the state's representatives in each French département, to impose "very limited" local curfews. Parts of Paris, Bordeaux, Lille, Lyon, Nice and Marseille were placed under overnight curfews,³ and the nights that followed were mostly calm.⁵

In Limoges, prosecutors charged two men, aged 34 and 66, whom they link to what they called "radical-left networks", over the fire.⁶ On Friday Lecornu visited the city and promised that the state would rebuild the city hall exactly as it was.⁷ The city's mayor, Guillaume Guérin, told the BBC: "What happened here will have an influence on the upcoming presidential election."⁶ That election is due next spring, and Macron cannot stand again.

The students meet Macron

On Friday 23rd October about 20 representatives of secondary-school students' organisations met Macron at the Élysée Palace for around three hours. It was his first meeting with them since the protests began. According to the Élysée, he offered a "deep overhaul" of Parcoursup, the online system that allocates university places, along with more teachers and a reform of how pupils are represented in their schools. Detailed commitments are to follow when Lecornu meets them on Monday 26th October.⁷

The students were unconvinced. "We are not satisfied, we are waiting for our meeting with the prime minister," said Nathanaël Combary, president of the organisation Renouveau lycéen.⁸ They called for the protests to continue,⁹ and the private-sector unions called a strike for 5th November.⁹

Saturday under guard

For Saturday 24th October's national day of protest, the government deployed about 70,000 police and gendarmes, 20% more than the week before.⁹ The Louvre, the Musée d'Orsay and other Paris museums closed,² along with 24 metro stations.¹⁰ Nuñez said he had ordered "the utmost firmness".⁷ Protest bans in Marseille and Limoges were overturned in court,¹⁰ and in Orléans, where the National Rally party was holding its congress, the prefecture counted 11,000 people at a march against the far right.¹

The day was largely peaceful until its end. The Interior Ministry estimated that 410,000 people marched across France, 110,000 of them in Paris, against 550,000 the Saturday before; the unions put the total at about 800,000.¹¹ At the end of the Paris march, at Porte de Vincennes, groups of masked men threw bottles and stones at the police, who answered with tear gas, water cannon and stun grenades. Police also fired tear gas to keep marchers out of the centres of Lyon, Lille, Montpellier, Nantes and Toulouse, and bins were set alight in Marseille.¹² By the evening Nuñez said nearly 1,000 people had been arrested, a number he expected to rise, and that two had been seriously injured, one in Toulouse and one in Clermont-Ferrand. There was no repeat of the looting of the week before.¹¹

×

The same week elsewhere

The protests have spread beyond France since September, mostly over the cost of living, school funding and housing. This week:

• Italy: Giorgia Meloni's government adopted a security decree creating a crime of "violent participation in a demonstration",¹³ sent 500 soldiers to Milan and searched 150 homes before Saturday's marches.¹⁰ On Saturday the security operation in Milan stopped protesters from gathering.¹¹
• Portugal: police cleared cost-of-living protest camps in Lisbon and Porto on 21st October and arrested 55 people; protesters returned within hours.¹⁴
• Greece: thousands of students and teachers marched in Athens, Thessaloniki and Patras on 21st October.¹⁵
• Albania: the prime minister, Edi Rama, blamed a "hybrid war" for unrest that had injured about 300 people, more than half of them police.¹⁶ On Saturday riot police in Tirana fired tear gas at thousands of anti-government protesters.¹¹
• Spain and Belgium: in Barcelona more than 100 people were arrested on Saturday after a student protest turned violent, and there were clashes in Brussels.¹¹

The price of oil rose for a third week running. On Friday 23rd October Brent crude, the global benchmark, briefly passed $117 a barrel¹ and settled at $116.72, its highest since April.² Before the war between the United States and Iran began on 28th February it was about $72.¹

Traders were reacting to three things at once: Iran's claims of new attacks on tankers, the spread of the war to Saudi Arabia, and the prospect of American strikes on Iran resuming.

×

Seven tankers, by Iran's count

The Strait of Hormuz, the narrow passage out of the Gulf, carried about a fifth of the world's oil before the war, according to the US Energy Information Administration.³ Since February Iran has demanded that ships seek its permission and use a route close to its coast, while the US Navy escorts ships along a southern route near Oman.

On Thursday 22nd October Iran's Islamic Revolutionary Guard Corps said its forces had hit four oil tankers at once in the northern Gulf, and that three more had struck mines in the strait the night before. It was the largest number Iran had claimed in a single day of the war. The claims have not been verified. US Central Command, which runs American forces in the region, said the mine claims were incorrect and that 95% of ships were getting through.⁴ Trump wrote that Iran was "making up fake hits, mines, and everything else" to raise oil prices before the US midterm elections on 3rd November.⁵

The United Kingdom Maritime Trade Operations centre, which collects reports from ships, confirmed one attack that day: a tanker was hit by an unknown projectile about seven nautical miles north-east of Limah, in Oman, and continued its voyage.⁶ Its counts are a minimum, because many ships no longer report to it. It has recorded 135 incidents since the war began.⁷

Oil from an earlier attack reached the shore this week. The United Arab Emirates closed the beaches of Umm Al Quwain after a spill washed up, and BBC Verify traced the slick to the Gem No.2, a tanker struck on 9th October.⁸

The war reaches Saudi airports

The Houthi movement in Yemen, which is aligned with Iran, extended its attacks on Saudi Arabia. On 21st October a strike on King Fahd International Airport in Dammam killed two people and injured eight, according to The Jerusalem Post, and Saudi Arabia's energy ministry said debris from a drone shot down over Saudi Aramco's Shaybah oilfield killed two residents, from the Philippines and Nepal. The United States ordered its non-emergency staff and their families to leave Saudi Arabia.⁹ By Friday it was also reducing staff at its embassies in Jordan, Lebanon, Qatar and the UAE, after the US director of national intelligence warned that Iranian plots against Americans abroad had "reached advanced stages".⁵

Britain stepped up its support for Saudi Arabia. On Tuesday 20th October, the day before the Dammam strike, the Defence Secretary, Wes Streeting, approved further military help: "RAF Typhoons will fly defensive air missions to help protect Saudi airspace from drones and missiles." Britain is also extending the air-to-air refuelling it provides for Saudi air operations. The Ministry of Defence said the jets would have a defensive role and would not attack the Houthis.¹⁰

"Another little Epic Fury"

Speaking at a campaign rally in Fort Myers, Florida, on Friday,¹¹ Trump said: "We may do another little Epic Fury, or they'll agree."¹² Operation Epic Fury was the name of the American strikes that started the war.

Iran's answer came on Saturday from the chief of staff of its armed forces, Ali Abdollahi, on state television: "We will not allow US military ships in the Persian Gulf under any circumstances … He will take that dream to his grave."¹²

Later on Saturday, after voting early in Florida, Trump was asked whether he would strike again. "Maybe tomorrow... There's a possibility I will. There's also a possibility we'll have a nice, big, beautiful agreement," he said.¹³ Iran's president, Masoud Pezeshkian, blamed Washington for the collapse of the earlier deal but said both sides should return to it and "conclude it".¹⁴ No new American strike had been reported by Sunday morning.

The Houthis kept up their attacks over the weekend. Saudi Arabia's civil defence said two ballistic missiles were fired towards Mecca and Medina on Saturday and warned of falling debris after they were intercepted; the Houthis called that claim a "huge lie" and said they had aimed at three Saudi airports, oil infrastructure and an airbase. Yemen's government said two missiles were fired at Aden's airport, the fourth such attack this month. Early on Sunday the Saudi-led coalition said it had shot down a missile aimed at Riyadh, whose airport had just announced it would reopen after a two-week closure.¹⁵

In Istanbul, foreign ministers from Britain, France, Germany, Italy, Turkey, Saudi Arabia, Pakistan and Egypt urged both sides to return to diplomacy. "We cannot afford another escalation," they said.¹⁶

Where it stands

A deal signed in June to reopen the strait collapsed over the summer, and no new round of talks has been announced, although Iran's foreign minister, Abbas Araghchi, said on 18th October that Tehran's proposal to reopen the strait within seven days was still on the table.¹³ Asked by the Financial Times whether the war could last another year, Mike Waltz, the US ambassador to the United Nations, said: "I'm not going to put out hypotheticals," according to CBS News.⁵ The open question is whether the United States strikes again, before its elections or after them, and whether Iran answers at sea.

Last week Hindsight reported Kyiv's relationship with Washington at its lowest point since February 2025: Ukraine's drones had lost speed on Starshield, the military version of SpaceX's Starlink satellite network, and Donald Trump had waived new sanctions on Russia. This week some of that pressure eased, and diplomacy began to move again.

The link comes back

On Saturday 24th October Ukraine's defence minister, Yevhenii Khmara, said the armed forces were again recording stable connections on drones and vehicles moving at more than 400 kilometres an hour. "The connection is stable," he said.¹ Unnamed sources had told Reuters that during the limits, which began on 14th October, service had failed above about 160 kilometres an hour.¹ Khmara credited "direct dialogue" with Washington, and said the link mattered "for our front, for the military, the work of drones, logistics and communications".²

Who ordered the limits is still disputed. Elon Musk, SpaceX's chief executive, had said they were set by the US military and ultimately the president; Reuters had reported, citing officials, that the order came from inside the White House; and Trump denied a role.² On 23rd October Trump said: "if there is a problem, I'll get it straightened out."³

Hours after the link came back, Musk gave a different account. "Ukraine military violated Starlink terms of service and used it for offensive drone strikes to kill people. That loophole was closed last week," he wrote on X. The Associated Press reported this as an admission that SpaceX had throttled the civilian Starlink service, though Musk maintained that the US government controlled any changes to Starshield.⁴

The same day Reuters reported, citing six former senior US officials, that both the Biden and Trump administrations had for years asked SpaceX to switch Starlink on or off in particular places: off for terminals used by Hezbollah in Lebanon in 2023 and by the Houthis in Yemen in 2024, and on in Iran and Ukraine.³ SpaceX did not comment.

Canada's prime minister, Mark Carney, said in Istanbul that the slowdown had "real consequences, human consequences, direct casualties". He did not say who was responsible.⁵

Talks in Abu Dhabi

On Tuesday 21st October Trump's envoy, Steve Witkoff, met Vladimir Putin in St Petersburg. Putin agreed to resume three-way talks between American, Russian and Ukrainian officials, and Russia freed Stephen Hubbard, a 74-year-old American held since 2022.⁶ The Kremlin's spokesman, Dmitry Peskov, said the talks were scheduled for the first half of November in Abu Dhabi.⁷

The release came with a darker account. Two Ukrainians who had shared cells with Hubbard told BBC News that guards had beaten him and used a stun gun and dogs on him. The allegations have not been independently verified.⁸

A truce for one town

On Thursday 23rd October the White House said that Melania Trump, acting as what it called an "Exclusive Intermediary", had secured a ceasefire between Russia and Ukraine limited to Oleshky.⁹ Oleshky is a town in the Kherson region, on the left bank of the Dnipro river opposite the Ukrainian-held city of Kherson. Russian forces have occupied it since February 2022, the first days of the full-scale invasion,¹⁰ and about 90% of it was flooded when the Kakhovka dam was destroyed in June 2023.⁹

"Oleshky is a front-line war city on the brink of disaster," Melania Trump said.⁹ According to the White House, between 1,700 and 2,000 residents remain, most of them elderly, including about 50 children. The ceasefire is meant to stop all military action in the town so that humanitarian aid can enter and civilians can leave through a safe corridor, to Russia or Ukraine as they choose.⁹

The White House said the truce would begin on 29th October.⁹ Russia's General Staff announced a "silence regime" from 04:00 Moscow time on 27th October,¹¹ and Ukraine's General Staff confirmed a start at the same moment, according to the Kyiv Independent.¹² Pope Leo XIV, the head of the Catholic Church, had asked Putin for a humanitarian ceasefire in Oleshky in a phone call on 16th October, and urged Volodymyr Zelenskyy to cooperate with Russia on aid three days later.¹³

×

The war continues

None of this has stopped the fighting. On the night of 23rd to 24th October Ukrainian drones caused a blackout across occupied Crimea,¹⁴ and Ukraine's General Staff said it had struck a petrochemical plant in Tolyatti, in Russia's Samara region; the Kyiv Independent could not verify that claim.¹⁵ At the Organization for Security and Co-operation in Europe, the UK's representative said Russia had kept attacking Ukraine's energy system after the United States called for a halt, and said: "Only Ukraine can make decisions about its security and its sovereignty."¹⁶

What remains open is the substance. A ceasefire for one town of 2,000 people and an agreement to meet are not a settlement, and the questions that stalled earlier rounds, above all Russia's demand for the rest of the Donbas region, have not been answered. Nor is it settled who decides what Ukraine may use the satellite link for, now that the company that runs it says some of its uses broke the rules.

On Wednesday 21st October, government websites across Europe went dark on purpose. In Britain the Metropolitan Police site and council sites in Edinburgh, Oxford, Bristol, Lambeth and Barnet were among those taken offline,¹ and Finland, the Netherlands, Germany, France, Belgium and Australia did the same with some of their own.²

None of them had been hacked, as far as their operators knew. They were hiding from a flaw in PHP, the programming language that runs on the web servers behind most of the internet's websites.

What PHP is, and what went wrong

When someone opens a page on a PHP site, PHP builds the page on the server before sending it to their browser. WordPress, the most widely used website software, is written in it. According to W3Techs, which surveys the web's most visited sites, PHP runs 69.3% of the websites whose server language it can identify.³

The PHP project announced two flaws, which security researchers named PHP2Shell. Both allow what is called unauthenticated remote code execution: someone anywhere on the internet, without logging in, can send a crafted request that makes the server run their own commands, which amounts to taking control of it.⁴ Both were rated 9.2 out of 10 for severity.⁴ According to Wiz, one of the security companies that reported them, they affect every PHP version released in the past decade.⁵

The fixes, PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, were released on 21st October.⁴ Britain's National Cyber Security Centre, or NCSC, told organisations to update at once. Those that could not apply its temporary mitigations in time, it said, "should consider taking the system offline until it can be fully mitigated."⁶

That advice is why so many sites went down. On 22nd October a minister told the House of Lords that 32 government services were unavailable and four partly so, most as a precaution, according to The Register. She said the government was not aware of any confirmed compromise of central government systems.²

×

A secret that didn't hold

Serious flaws are normally fixed under an embargo: the people who know keep quiet until a patch is ready, so that defenders and attackers learn about it at the same moment. This one leaked.

According to the PHP Foundation, which funds the language's development, the flaws' official identifiers appeared on forums and social media at about 15:00 UTC on 20th October. That evening the project brought its release forward by a day, and a security firm called Calif mistakenly published a video showing a working attack. At 07:41 UTC on the 21st, Chainguard, a company that sells ready-built software, published fixed versions of PHP more than six hours before the coordinated release. The foundation said that "any attacker could now study the fix in binary form while every other PHP user was still waiting for the release".⁷

Chainguard's chief executive, Dan Lorenc, said his company had not leaked anything, pointing to the public attack demonstrations and reports that the flaws were already being exploited.⁸

There was some evidence that they were. Amazon Web Services said its decoy servers, which are built to attract attackers, recorded an attempt to exploit PHP2Shell on 17th October, four days before the disclosure, and that it was "unclear how the actor acquired exploit information".⁹ Its chief information security officer, CJ Moses, wrote: "An embargo protects defenders only until someone else finds the same bug."⁹ Cloudflare's chief executive, Matthew Prince, said attempts on its network rose to the millions after the disclosure.¹⁰

Found by researchers using AI

The PHP Foundation credits three teams with finding the flaws, and all of them used Artificial Intelligence models in their work. A researcher at Calif, working under OpenAI's Patch the Planet programme, which uses AI to search open-source software for security holes, reported the first on 11th August. Wiz reported on 24th August, and OpenAI reported further ways to exploit them on 18th September.⁷ Wiz, which is owned by Google, credits models from both Google and OpenAI.⁵

The underlying weakness was not new. A 2024 audit of PHP had found the first signs of it, and the foundation says the volunteer security team then failed to agree a fix for two years, which it called a structural failure.⁷ Who deserves credit for the discovery is disputed: The Record reported that Calif credited another researcher with first finding the flaw and writing an exploit.¹¹

Moses argued that AI also helps the other side: "AI-assisted analysis makes it cheaper to turn a patch diff or advisory into a working exploit."⁹ A patch shows what was broken, so the time between a fix and a working attack is shrinking, and he recommended that companies measure their patching in hours rather than days.⁹

Where it stands

On 23rd October PHP disclosed a third flaw in the same area, which it described as an "unlikely" route to remote code execution. It will be fixed in the next regular release, and until then the project advises switching off a setting called session upload progress.⁴

Most of the sites taken offline came back once they were patched. What remains unknown is whether anyone used the four days before disclosure, or the hours before patching, to get into servers that have not yet found the intrusion. About a third of PHP sites run versions 7 or older, which the project no longer maintains,³ and for those the fix depends on their operators.

The Ebola epidemic that began in the Democratic Republic of the Congo in May reached West Africa this week. On Tuesday 20th October Nigeria, Africa's most populous country, confirmed its first case: a woman in the capital, Abuja, who had travelled from Uganda.¹

It is a single case, and Nigeria's health minister, Muhammad Ali Pate, called it "a contained single case".² What worries health officials is that nobody yet agrees how she was infected.

×

One case, 44 contacts

According to the World Health Organization's office for Africa, the woman developed symptoms on 7th October, four days after arriving in Nigeria. She went to a private clinic in Abuja on 11th October, and laboratory tests confirmed Ebola on 20th October. Forty-four people who had contact with her are being monitored.¹

The disease is caused by the Bundibugyo virus, one of several species of Ebola virus. It is named after Uganda's Bundibugyo district, where an outbreak in 2007 led to its discovery.³ There is no licensed vaccine or treatment for it.⁴ The vaccine used against earlier Ebola epidemics, Ervebo, was made for a different species.⁵

Where did she catch it?

Three accounts emerged in three days. Uganda's health ministry said the woman was a Nigerian businesswoman who had been to eastern Congo and only passed through Uganda: "Travel through Uganda does not establish that infection occurred here."⁶ On 23rd October the Swiss foreign ministry said she was the Ugandan-born wife of a Swiss diplomat in Abuja, had not been to Congo, and was believed to have been infected while travelling with her husband in Uganda. A Ugandan government spokesman called that suggestion "preposterous".⁷

The Africa Centres for Disease Control and Prevention, or Africa CDC, pointed to a coincidence: the woman and Kenya's first Ebola patient both left Uganda's Entebbe airport on 3rd October.⁷ Marion Koopmans, a Dutch virologist on the WHO's Ebola emergency committee, was sceptical: "Random presence at the same location, a large airport, is not a supported epidemiological link by any standard of what we currently know."⁷

Then, on 23rd October, Pate said genetic sequencing showed that Nigeria's virus was "closely related to the strain detected in Kenya's index case".⁸ That is the first genetic link between the two, but it does not show where either person was infected. Uganda, which had 20 cases earlier this year and declared its own outbreak over in August,⁹ announced on Friday that people who had travelled to Congo could no longer transit the country.¹⁰

Kenya's cluster

Kenya's cases all trace back to one man, who travelled from Congo by road through Uganda, flew to Nairobi on 3rd October and died there two days later.⁴ By 20th October Kenya had nine confirmed cases, all of them his relatives or the health and care workers who treated him.⁴ On 23rd October the health ministry announced a second death,¹¹ a 65-year-old woman who was a close relative of the first patient. "All cases remain within one cluster of known contacts, and there is no evidence of community spread," it said.¹²

The scale in Congo

The cases outside Congo are a tiny part of the epidemic. By 20th October Congo had recorded 9,704 confirmed cases and 4,687 deaths, most of them in Ituri province, according to the WHO.⁴ To put that in context, it is the second-deadliest Ebola epidemic on record, after the West African epidemic of 2014 to 2016, in which more than 11,000 people died.⁷ The WHO declared it a public health emergency of international concern on 17th May.¹³

On 23rd October the first volunteer was vaccinated in Bunia, the main city of Ituri, in a trial that will test Ervebo first and then candidate vaccines made specifically for Bundibugyo.⁵ "There is still no licensed vaccine against Bundibugyo virus, and the cost of that absence is being counted in the DRC every day," said Richard Hatchett, chief executive of the Coalition for Epidemic Preparedness Innovations, or CEPI, which helps fund it.⁵

What remains open

Nigeria's 44 contacts are still being watched, and the WHO says it is revising its assessment of the risk to the region.⁴ Until investigators establish where the Abuja patient was infected, they cannot rule out a chain of transmission that nobody has yet found.