What moved
Two flaws in PHP, the language behind much of the web, take government sites offline from the Netherlands to Japan
On Wednesday 21 October the developers of PHP, a programming language behind much of the web, released emergency fixes for two security flaws, and governments and companies in several countries took websites offline while they patched (Euronews; Daily Maverick, carrying Reuters). The flaws, CVE-2026-109618 and CVE-2026-109619, both lie in how PHP handles memory when certain errors occur; PHP said both were rated 9.2 out of 10 on the CVSS severity scale; CERT-EU said they could let an attacker run code on a server without logging in (Euronews; Anadolu; Rappler). Seven independent reports from newsrooms based in seven regions carried the story in our sources.
How they were found. Two security firms say they found the flaws with AI. Calif said in a blog post that it found them on 1 August with the help of a large language model; OpenAI said the model was its GPT-5.6 Sol, and SCMP says the work was an audit of PHP's code that OpenAI funded; Wiz, a Google-owned firm, said that weeks later it had found them independently, using its Wiz Atlas tool, Google's Gemini 4 Argon and GPT-5.6 Sol (Daily Maverick, carrying Reuters; SCMP). OpenAI said it led a coalition that found the flaw and that "frontier AI" had been key; the Guardian reports that the researcher who found it said they used publicly available models (The Guardian). The PHP Foundation said it saw signs of one of the bugs in a 2024 audit but found no route to an attack (Euronews; Meduza). The findings were kept private until the identifiers leaked online on Tuesday 20 October, before the fix was out; Euronews, SCMP and the BBC differ on when the fix had been due (Euronews; SCMP; BBC).
Who went dark, and when. On Wednesday the Netherlands' National Cyber Security Centre took its own site down, as did the DigiD identity system, the Overheid.nl portal and the lower house of parliament, and Finland's state IT provider Valtori switched off government web services "as a precautionary measure" (Euronews; Daily Maverick, carrying Reuters). Reuters says France's interior ministry put all of its websites into preventive maintenance; Euronews says prefecture websites; SCMP says local government sites, including the Paris police (Daily Maverick, carrying Reuters; Euronews; SCMP). Government sites also went down in Germany, Denmark and Belgium, and in the UK the government said on Thursday that 32 sites had been taken down, none a large public-facing service (Euronews; The Guardian; Meduza; BBC). On Thursday 22 October banks, businesses and ministries in Japan took sites offline after Prime Minister Sanae Takaichi's Wednesday-night post on X, and South Korea's science ministry raised its cyber crisis warning to "caution" (Japan Times; Yonhap).
How much of the web. The widely quoted 70 per cent is Wiz's estimate, which the BBC says it cannot verify (BBC; SCMP). Our sources quote the tracker W3Techs three ways: Reuters as roughly 75 per cent of websites whose language can be identified, Meduza as almost 70 per cent, Anadolu as about 69 per cent (Daily Maverick, carrying Reuters; Meduza; Anadolu).
Attacks. Sources differ on whether anyone has been hacked. Amazon's security chief, CJ Moses, said a decoy system was probed on 17 October, four days before disclosure, and Amazon said the flaws were "now being broadly exploited in the wild", while adding that it was unclear whether the attempts would have succeeded against real sites; Cloudflare's Matthew Prince said it had seen millions of attempts; the BBC reported on Friday, after the window closed, that no successful attacks had been reported (Daily Maverick, carrying Reuters; BBC). The PHP Foundation said it found no working exploit in the leaked code at release, Australia's cyber security centre said on Wednesday, before the fix was out, that it was not aware of active exploitation, and on Thursday New Zealand's said it was aware of reports of it (Euronews; Rappler; Anadolu).
What people are told to do. The patched versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the developers said there are "no complete mitigations" (Anadolu). The US National Security Agency, the UK's National Cyber Security Centre and CERT-EU told operators to patch at once, the NSA saying to take systems offline if they cannot and the other two to consider it (BBC; The Guardian; Rappler). Updating WordPress or its plugins does not fix it; PHP itself must be updated, and site owners who use a host should ask it (Anadolu; BBC).
Why it matters beyond this week. Volker Dusch, a security engineer at the PHP Foundation, told the Wall Street Journal it is PHP's most serious problem in more than a decade and compared it to Heartbleed in 2014 (SCMP). OpenAI said the discovery marks "a new phase" in which AI can find security bugs with "internet-scale impact" (SCMP).
The WMO says this El Niño could be "off the monitoring charts"; the Philippines, Indonesia and Peru put figures on the drought
On Wednesday 21 October, at a press conference in Geneva, Celeste Saulo, secretary-general of the World Meteorological Organization (WMO), said the current El Niño "could be unprecedented in strength" and "literally off the monitoring charts" (Euronews; The Hindu). The WMO's Global Seasonal Climate Update, shared that day, says sea surface temperatures in the tropical Pacific may rise to 3.8°C above average between November 2026 and January 2027 (UN News; Hindustan Times; The Hindu). Reuters gives the forecast as "about 3.8 deg C above normal" in the central Pacific, peaking around December (The Straits Times, carrying Reuters). Saulo said earlier record El Niños had reached "around three", so "we are beyond that limit" (The Straits Times, carrying Reuters). Only four independent reports in our sources carried the warning. Issue eight had seen government warnings in the Philippines and elsewhere in headlines only.
"Wrecking ball." The phrase is Tom Fletcher's, the UN's emergency relief coordinator, beside Saulo at the same press conference: "This El Niño is a behemoth. It is a wrecking ball," he said (OCHA; The Straits Times, carrying Reuters). He said 50 million people could face increased hunger, and that he had released more than $50 million from the Central Emergency Response Fund for 11 countries (OCHA; UN News).
Which record? An AFP piece carried by Dawn explains why agencies differ: Britain's Met Office calls the event "unprecedented" on raw sea-surface temperatures; the Japan Meteorological Agency declared it the strongest on record on the anomaly in the Niño3 region; and NOAA in the United States, which now measures the east-central Pacific against the rest of the tropical ocean, will rank it first in records back to 1950 if its three-month anomaly reaches 2.5°C or higher, a chance AFP reports as "high" but not yet certain (Dawn, carrying AFP). Emily Becker of the University of Miami told AFP it is very strong "by any measure" and can be ranked only afterwards (Dawn, carrying AFP).
The Philippines. The Department of Agriculture's bulletin of 21 October put damage from the dry spell at P8.57 billion, up from P6.87 billion in September, with 288,058 farmers affected (Inquirer; Philstar). At a Senate hearing on Wednesday the agriculture secretary, Francisco Tiu Laurel Jr., said losses might reach about P20 billion; the department has set aside P10.81 billion in production support (Inquirer). The weather bureau's assessment of 19 October, presented at a briefing by Ana Liza Solis on Thursday, put nine provinces in meteorological drought (Philstar). The Philippines has 115.8 million people (World Bank, 2024).
Indonesia, Thursday 22 October. The disaster agency BNPB said it was preparing for the rains to arrive late, possibly in early 2027; parts of Central Java and Yogyakarta had gone 131 days without rain, and the weather agency BMKG expects a late start to the rains across about 61.08 per cent of the country's land (Antara, in Indonesian).
Peru, Thursday 22 October. President Keiko Fujimori and the economy minister, Elmer Cuba, announced an additional 18 billion soles for 2027, about 2.5 billion soles of it for temporary payments to vulnerable families; individual amounts, the number of recipients and the timetable were not given (RPP, in Spanish). Reuters gives the figure as 18 billion soles ($5.22 billion), announced on Thursday (The Straits Times, carrying Reuters). Peru has 34.2 million people (World Bank, 2024).
Why it matters beyond this week. Saulo said the event would peak towards the end of 2026 and its effects would be felt long after; Fletcher said the humanitarian system "cannot alone cope" (UN News; OCHA; Euronews).
Nigeria confirms its first Ebola case since 2014, in Abuja, and Kenya's count rises to nine
Nigeria's government said on Tuesday 20 October that laboratory tests had confirmed a case of Ebola in the capital, Abuja, in a woman who had arrived from Uganda, its first since the 2014 outbreak; the health minister, Muhammad Ali Pate, said 44 contacts had been identified (Daily Trust; Daily Maverick, carrying Reuters; PBS, carrying AP). On Wednesday the Nigeria Centre for Disease Control and Prevention (NCDC) said three molecular tests had identified the Bundibugyo strain, the one behind the outbreak in the Democratic Republic of the Congo that the two previous issues reported (Al Jazeera; Dawn). Newsrooms based in six regions carried it in our sources. Nigeria has 232.7 million people (World Bank, 2024).
Nigeria, Tuesday 20 October. Pate said she was treated at a private hospital in Abuja for several days before the diagnosis and is in isolation (Daily Maverick, carrying Reuters). The WHO says her symptoms began on 7 October, she sought care on 11 October and the diagnosis came on 20 October; Kaseya of the Africa CDC told the BBC her symptoms began on 6 October (UN News; BBC). The NCDC and the WHO date her arrival to 3 October, an NCDC official on Arise TV to 5 October (Al Jazeera; The Straits Times, carrying Reuters; The Straits Times, carrying Reuters). Reports of her condition differ: an unnamed official told AFP on Wednesday that she had deteriorated into "multi-organ failure"; Pate told the BBC she was "stable, she's improving", and the WHO's representative in Nigeria, Pavel Ursu, said on Thursday her biochemical markers were improving (Al Jazeera; Dawn; BBC; The Straits Times, carrying Reuters).
Where she was infected. Uganda reported 20 cases in May and June, mostly imported from Congo, and the WHO declared it free of the virus in August (Daily Maverick, carrying Reuters). Uganda's health ministry said in a statement on Tuesday that the patient was a Nigerian national who had travelled to eastern Congo for business and only transited through Uganda, that "travel through Uganda does not establish that infection occurred here", and that Uganda had "no confirmed active Ebola cases" (PBS, carrying AP; Channels TV; Daily Trust). The Africa CDC's director-general, Jean Kaseya, said on Channels Television on Thursday that she is "without any doubt" Ugandan-born, lives in Abuja, went to Uganda, where her husband joined her, and returned on 3 October (Channels TV; Premium Times). He told AFP she did not go to Congo, though on Channels Television he also said she still needed to tell the authorities whether she had flown to Congo, and an Africa CDC colleague, Wessam Mankoula, said there was "no validated information" that she had (Punch, carrying AFP; The Straits Times, carrying Reuters). Reuters, citing a statement by Switzerland's Federal Department of Foreign Affairs on Thursday, describes her as the Ugandan-born wife of a Swiss diplomat; the statement says she is believed to have caught the virus "whilst travelling to Uganda", about two weeks before (The Straits Times, carrying Reuters). The WHO said the information it had received did not include travel outside Uganda, and its emergency manager Patrick Otim said the source of infection was still unknown (The Straits Times, carrying Reuters; UN News).
Kenya, Tuesday 20 October. The health ministry said a 24-year-old man, a close family member of the first patient, had tested positive on 19 October while already in quarantine, the ninth case (The Star; Al Jazeera). Patrick Amoth, the director-general for health, said the cases all "belong to one cluster", that the eight survivors were stable, and that 134 of 135 contacts had been traced and quarantined; those quarantined since 6 October may go home from 25 October if they stay well, and Kenya has imposed no restrictions on travel, trade or gatherings (Al Jazeera; The Star). On Thursday Amoth said all 135 were accounted for (The Straits Times, carrying Reuters). Kenya has 56.4 million people (World Bank, 2024).
The outbreak as a whole. The European Centre for Disease Prevention and Control, as reported by Premium Times, recorded 9,552 confirmed cases and 4,602 deaths in Congo across eight provinces, on data to 18 October (Premium Times). Congo has 109.3 million people (World Bank, 2024). UN News calls Nigeria the fifth country to detect the virus, counting one country outside Africa, which it names as France in one report and the Netherlands in another; Reuters and AFP call it the fourth in Africa (UN News; UN News; The Straits Times, carrying Reuters; Punch, carrying AFP). Kaseya wrote on X that the outbreak was "the most geographically extensive in history" and said he would convene Africa's health ministers next week (PBS, carrying AP; Al Jazeera).
Why it matters beyond this week. Reuters calls this the fastest-spreading Ebola outbreak on record, and the Bundibugyo virus has no approved vaccine or treatment (The Straits Times, carrying Reuters). The WHO says a trial in Congo is testing whether the Ervebo vaccine, made for the Zaire Ebola virus, protects against Bundibugyo, with no preliminary data yet (UN News).
The United States envoy meets Zelenskyy in Oslo and Putin in Saint Petersburg; Russia frees an American and says it is ready "in principle" for three-way talks
Steve Witkoff, the United States' special envoy, met Volodymyr Zelenskyy, Ukraine's president, in Oslo on Tuesday 20 October and Vladimir Putin, Russia's president, in Saint Petersburg on Wednesday 21 October (BBC; The Hindu). After the second meeting the Kremlin said Russia was "in principle" ready to resume talks with the United States and Ukraine, and Putin announced the release of Stephen Hubbard, a 74-year-old retired American teacher jailed in Russia since 2022 (Al Jazeera; The Guardian; BBC). Sixteen newsrooms in our sources carried it. Ukraine has 37.9 million people and Russia 143.7 million (World Bank, Ukraine, 2024; World Bank, Russia, 2024).
Oslo, Tuesday 20 October. Norway and Finland hosted; Zelenskyy, Finland's president Alexander Stubb, Norway's prime minister Jonas Gahr Støre and Witkoff attended (Euronews). Zelenskyy said afterwards that American early warning of Russian missiles "works now", after at least a week in which he had said Kyiv was not receiving it, and that "one of the important ideas" was a three-way meeting of leaders (SCMP; Meduza). The adjectives are the participants' and Washington's own: Støre said "good and constructive", Stubb "genuine progress" without details, an unnamed US official "very productive and constructive", and Marco Rubio, the US secretary of state, "positive" (Anadolu; BBC; France 24). Russian attacks that day killed at least 10 people, Ukrainian officials said, by the BBC's count; SCMP says at least nine (BBC; SCMP).
Saint Petersburg, Wednesday 21 October. Witkoff met Putin at the Constantine Palace for about three hours, with Kremlin aide Yuri Ushakov at the table (The Hindu; BBC). Witkoff called Oslo "productive", with "some degree of momentum" (Channels TV). Putin opened by saying Hubbard was already at Pulkovo airport; Witkoff told him "you are a humanitarian also, sir" (Meduza; BBC). Trump wrote that "there was no 'swap' necessary"; Dmitry Peskov, the Kremlin's spokesman, said Putin acted out of "humanitarian considerations" (The Guardian; PBS, carrying AP). Meduza states that Hubbard "fought on Ukraine's side" in the Kharkiv region's territorial defence; the BBC and Euronews say he was jailed for "allegedly" fighting for Ukraine (Meduza; BBC; Euronews). Witkoff also thanked Putin for this month's diesel deal; issue seven reported that the European Council "regrets" its lifting of US sanctions (BBC).
What was agreed, in each side's words. Ushakov said Putin was "in principle" ready to resume three-way talks at a technical level and focused on security after the war; the date is mid-November in Al Jazeera, around 10 November in the BBC and on or after 10 November in SCMP, possibly in Abu Dhabi (Al Jazeera; BBC; SCMP). On the Oslo ideas Ushakov is quoted three ways: "there wasn't really much substance in them" (Al Jazeera, France 24), "these nuances, so to speak, do not entirely satisfy us" (SCMP, The Moscow Times), not very "useful" (BBC) (Al Jazeera; France 24; SCMP; The Moscow Times; BBC). Witkoff called the talks "constructive" with "important work left to do" (Euronews). Zelenskyy, returning to Kyiv, said Ukraine wanted the meeting "no later than early November", and told Fox News he would accept a freeze along the current front line as a "minimum" (Al Jazeera; BBC).
The strikes went on. As Witkoff arrived, Kyiv said Russian strikes had killed at least four people, two in the capital and an elderly couple in the Kharkiv region; The Hindu, citing the city's military administration, gives three dead in Kyiv overnight, Al Jazeera, citing the emergency service, two (France 24; The Hindu; Al Jazeera). On Wednesday night a new missile attack hit several houses in Kyiv and injured six people, the mayor, Vitaliy Klitschko, said (BBC).
The framing differed by newsroom. Al Jazeera led with both presidents backing the US proposal; the BBC with the missile attack hours after Russia said "in principle"; Euronews with Lavrov, Russia's foreign minister, ruling out "any political concessions"; The Guardian said the release "appeared to be" Moscow's latest calculated move and noted Putin is wanted by the International Criminal Court; TASS, Russia's state news agency, reported Oslo through an Axios correspondent's source and wrote "Kiev" (Al Jazeera; BBC; Euronews; The Guardian; TASS).
Why it matters beyond this week. SCMP lists Putin's aims as full control of Donetsk, no NATO membership for Ukraine and a peace deal rather than a ceasefire; the Donetsk demand, The Moscow Times says, Kyiv has repeatedly rejected (SCMP; The Moscow Times). The UN has confirmed more than 17,500 civilians killed in Ukraine since February 2022 and says the true toll is likely to be significantly higher (The Guardian).
The attacks on Saudi Arabia reach Dammam's airport and an oil field, and a missile strike on a Yemeni training camp kills 73 by the province's count
King Fahd International Airport in Dammam, in Saudi Arabia's Eastern Province, was attacked on the evening of Wednesday 21 October; Saudi Arabia's General Authority of Civil Aviation said on Thursday that two people were killed, a Saudi citizen and an Indian national, eight were injured, and operations had resumed (Daily Maverick, carrying Reuters; Channels TV; Egypt Independent). Also on Wednesday, the energy ministry said debris from a drone intercepted near an Aramco processing facility at the Shaybah oil field killed two people, Nepali and Filipino nationals, and injured a Pakistani and an Indian; it did not say who sent the drone (The Hindu; Philstar). Saudi Arabia has 35.3 million people and Yemen 40.6 million (World Bank, 2024; World Bank, 2024). The story was carried by ten newsrooms in our sources.
Who claimed what. On Wednesday the coalition spokesman Turki al-Malki said drones launched towards the kingdom had been intercepted over the Eastern Province and Medina, without saying who launched them, and the Houthi spokesman Yahya Saree said his forces had carried out no "deep" operations in Saudi territory (Al Jazeera). On Thursday the Houthis said the Dammam airport was among the sites they said they had targeted, with drones and missiles, in the preceding 48 hours, along with the defence ministry in Riyadh, an Aramco facility in Yanbu and Abha airport; Saree did not claim the Shaybah drone, and The Hindu reported no immediate Saudi confirmation of attacks in Riyadh or Yanbu (BBC; The Hindu). The running toll differs: the BBC, citing Saudi authorities, gives at least 21 people killed at Saudi airports in Houthi attacks since October began; Channels TV gives 22, citing an AFP tally of official figures (BBC; Channels TV).
Responses. The US State Department ordered non-emergency employees and their families to leave Saudi Arabia, citing the Houthi attacks (Egypt Independent, carrying CNN). On Tuesday the UK Ministry of Defence said Typhoon jets would fly "defensive counter air missions" over Saudi Arabia and would not strike the Houthis (Euronews; Al Jazeera). NPR says the airport attacks forced the kingdom to cancel the investment forum known as Davos in the Desert, scheduled for next week; Channels TV says a major investment conference was postponed, without naming it (NPR; Channels TV).
Yemen, Monday 19 October. Three ballistic missiles struck al-Alam camp in Shabwa province, where recruits to the internal security forces were training, Yemen's government forces said (BBC; Al Jazeera). Shabwa's media office first said 53 were killed and 200 injured, then on Tuesday that an investigative committee had put the dead at 73 with 14 missing (BBC; The Straits Times, carrying Reuters). Saree said the missiles targeted "Saudi enemy" forces at a camp which, he said, was run by Saudi officers; the information minister, Moammar al-Eryani, called the strike a war crime; the BBC calls it the deadliest attack reported since the escalation began (BBC). Reuters says the Houthis are besieging Taiz, the last major city held by anti-Houthi forces in the southern highlands (The Straits Times, carrying Reuters); NPR reports that the World Health Organization says the city's hospitals have a few days of fuel left (NPR). The Houthi-run health ministry says 155 civilians have been killed since the war flared three months ago; the government's health ministry says at least 1,574 people have been killed over the same period (BBC). NPR says the UN counts more than a quarter of a million people displaced in recent weeks (NPR).
Why it matters beyond this week. The BBC dates the unravelling of a four-year informal ceasefire to July, when the Houthis declared what they called a maritime embargo on Saudi Arabia and started striking its airports, oil facilities and tankers; Reuters says the two sides have traded attacks since September, when the Houthis advanced towards the Bab el-Mandeb Strait at the mouth of the Red Sea (BBC; The Straits Times, carrying Reuters). Burcu Ozcelik of the Royal United Services Institute told Al Jazeera it is unclear whether the UK missions will deter attacks "while Saudi air defences and interceptor stockpiles are stretched" (Al Jazeera).
Still happening
India's Cockroach Janta Party leaders are freed after seven days, then summoned by the Crime Branch
Issue seven reported that a Delhi magistrate's court sent Saurav Das and Ashutosh Ranka, leaders of the youth-led Cockroach Janta Party (CJP), to five days' judicial custody on Wednesday 14 October after they climbed into Jantar Mantar, a closed protest site; issue eight saw only headlines. On Monday 19 October a special executive magistrate extended their custody by two days, citing a possible disturbance to public peace, and rejected their sureties as inadequate; police said the pair had broken an 11 October undertaking by calling people to the site (The Hindu). Al Jazeera, citing Indian media, said police wanted more time to question them (Al Jazeera). India has 1,450.9 million people (World Bank, 2024).
On Wednesday 21 October, after they withdrew their High Court challenge to the extension, the bench having advised them to await the magistrate's decision, the special executive magistrate, who in Delhi is a police officer, accepted fresh sureties and ordered their release; Delhi Police had sought three more days on law-and-order grounds (The Hindu; Scroll, citing Bar and Bench). The two undertook not to call any protest at Jantar Mantar while it remains denotified and not to do anything that would breach the peace (The Hindu; The Guardian).
On Tuesday 20 October Delhi Police had moved two cases against them to its Crime Branch, citing their sensitivity; after the release it summoned Das, Ranka and a third member, Ajinkya Shinde, to appear for questioning on Thursday 22 October over allegations including trespass and obstructing police (The Hindu).
The underlying dispute stands. The CJP and opposition parties want Chief Election Commissioner Gyanesh Kumar to resign over a revision of the electoral rolls that the BBC says has removed around 130 million names; the commission says the exercise is meant to remove ineligible, dead and duplicate entries, and, by Al Jazeera's account, says the lists included 28 million dead, 63 million who had moved and 30 million who could not be traced, which our sources do not reconcile with the 130 million total; it and the governing BJP reject the claim that it favours the BJP (BBC; Al Jazeera). On Thursday the Lok Sabha Speaker, Om Birla, said any fresh impeachment motion against Kumar would follow the laid-down procedure; the opposition's first notices were rejected by both houses and a second set is pending, Hindustan Times reports (Hindustan Times).
The slow story
Twelve dead off Lesvos and Samos, and a year's count that is still filling in
Our watchlist reads the International Organization for Migration's count of people recorded dead or missing on migration routes this year. Issue seven reported 4,887 with data to 11 October; it now stands at 4,985 with data to 19 October, a rise of 98 (IOM Missing Migrants Project, incident file). Only 15 of that rise is incidents dated after 11 October: two boats that overturned off Lesvos and Samos, Greece, on Monday 19 October, and three dead or missing in the Meriç river at Edirne, Türkiye, on 15 October (IOM Missing Migrants Project, incident file). The other 83 is older incidents added or revised after our copy of 16 October (IOM Missing Migrants Project, incident file). Greece has 10.4 million people (World Bank, 2024).
Two batches of late entries make up most of the 83: a row dated 9 October recording 30 people missing from a boat that left Sfax, Tunisia, and 40 rows citing the Pima County medical examiner in Arizona, United States, each one person, dated between June and September (IOM Missing Migrants Project, incident file).
Lesvos, Monday 19 October. A speedboat carrying people from Türkiye collided with a coast guard vessel and overturned about 3.5 nautical miles south of Agrilia; Reuters, citing Greek authorities, puts it early on Monday, while a coast guard spokesperson told AP it happened late on Sunday, which matters because IOM's file dates the row 19 October; the coast guard said it recovered the bodies of four men, one woman and an infant, and that eight people survived (The National Herald, carrying AP; Daily Maverick, carrying Reuters; The Straits Times, carrying Reuters). A coast guard official gave AFP a different breakdown, a baby and four women among the six dead (The Hindu, carrying AFP); Il Fatto Quotidiano gives four women, one man and a baby (Il Fatto Quotidiano). IOM's file, citing the coast guard, records one female, four males and one child (IOM Missing Migrants Project, incident file). On who struck whom, two accounts agree and one does not: shipping minister Vassilis Kikilias said the evidence so far indicated the speedboat struck the coast guard vessel's left side, with the circumstances under investigation (Daily Maverick, carrying Reuters); the official told AFP the speedboat "collided with the port side of a police patrol vessel" (Punch, carrying AFP); Il Fatto Quotidiano alone writes that the patrol boat hit the migrants' boat (Il Fatto Quotidiano).
Samos, the same morning. Five men and one woman died when a speedboat from Türkiye overturned after a sudden manoeuvre, roughly four nautical miles north of Samos, the coast guard said; fourteen men survived, one of them arrested on suspicion of smuggling (The Straits Times, carrying Reuters). The coast guard told AFP it was a small boat that capsized (The Hindu, carrying AFP). Reuters, carried by the Straits Times, says, citing authorities, that both boats capsized as the coast guard chased them; Greek Reporter has the coast guard itself saying the Lesvos collision happened during a pursuit, with the migrants' boat running without navigation lights (Greek Reporter; The Straits Times, carrying Reuters). The file records six dead, none missing and 14 survivors, while a coast guard spokesperson told AP that a vessel and a helicopter were still searching for three missing passengers (The National Herald, carrying AP; IOM Missing Migrants Project, incident file).
Gambia, not yet in the file. The file has no October row for Gambia or Senegal (IOM Missing Migrants Project, incident file). Yet on Thursday 15 October, before the window opened, the Gambia Red Cross Society said that at least 12 people had died when a boat carrying migrants sank off Jinack Kajata, and that "the number of people missing remains uncertain" (Euronews); Channels Television, also citing the Red Cross, gives 12 bodies recovered and an unknown number missing (Channels TV).
| Year | 1 January to 19 October | Incidents in that period | Full year |
|---|---|---|---|
| 2014 | 4,345 | 447 | 5,443 |
| 2015 | 5,571 | 721 | 6,961 |
| 2016 | 6,081 | 1,194 | 8,253 |
| 2017 | 5,405 | 1,161 | 6,403 |
| 2018 | 4,261 | 1,372 | 5,017 |
| 2019 | 4,009 | 1,464 | 5,432 |
| 2020 | 3,062 | 1,052 | 4,331 |
| 2021 | 4,906 | 1,502 | 6,278 |
| 2022 | 5,760 | 1,877 | 7,205 |
| 2023 | 6,833 | 2,130 | 8,755 |
| 2024 | 7,204 | 2,338 | 9,202 |
| 2025 | 5,975 | 1,916 | 7,927 |
| 2026 | 4,985 | 1,423 | year not complete |
People recorded dead or missing on all migration routes, the file's column "Total Number of Dead and Missing", with the number of recorded incidents. Source: sums of the IOM Missing Migrants Project incident file, retrieved on 23 October 2026, with incidents to 19 October 2026.
On these figures 2026 is 17 per cent below the same dates of 2025 and 31 per cent below 2024, and the lowest since 2021 (IOM Missing Migrants Project, incident file). But 83 of this week's 98 was incidents dated on or before 11 October, entered or revised after 16 October, and no row for the Gambia sinking has been entered (IOM Missing Migrants Project, incident file). The 4,985 is a count still being filled in.
Confidence. IOM says its data in all regions "represent a minimum estimate of the number of migrant deaths"; the date in each row is the estimated date of death or, failing that, the date bodies were found; and the number missing rests on the number reported on board, often by survivors or witnesses (IOM, methodology). Mediterranean data come from national authorities through IOM field missions, US-Mexico border data from county medical examiners, and African data from media and NGOs; IOM says the data over-represent regions with better media coverage and official reporting, Europe and the Mediterranean among them (IOM, methodology). The Greek boats of 19 October were in the file by 23 October; the Arizona deaths, dated June to September, entered it after 16 October.
Pattern watch
- Ebola in the Democratic Republic of Congo. From issue three. Nigeria's first case, Kenya's ninth, and the outbreak's reach as the sources describe it; see above.
- The El Niño projection. From issue two. The WMO says the event could be unprecedented in strength; see above. NOAA's index, which the thread will be checked against, was unchanged since the previous issue's reading.
- Hormuz and Bab el-Mandeb. From issue one. The attacks on Saudi airports and oil facilities and the strike on a Yemeni camp; see above. Seen in headlines only, not read: Iran saying seven tankers were damaged in the Strait of Hormuz and warning of a wider response, and oil prices near a six-month high.
- India's voter rolls. From issue four. The protest leaders freed and summoned again, and a fresh impeachment motion discussed; see "Still happening".
- Displacement out of Yemen. From issue one. Read, inside the piece on the Saudi attacks: NPR reports the United Nations counting more than a quarter of a million people displaced in recent weeks, as the Houthis besiege Taiz. This is displacement inside Yemen, which issue five also reported under this thread.
- Ethiopia and Tigray. From issue two. Seen in headlines only, not read: fighting continuing in Tigray with federal forces reported retaking a town, the TPLF's leader saying his forces are still fighting, the prime minister warning Eritrea of "extremely severe consequences" if it keeps supporting rebels, the United States reported to be mediating between Ethiopia and Eritrea without the TPLF, and drone strikes reported to have killed schoolchildren in Amhara and civilians in Tigray.
- Venezuela's transition. From issue two. Seen in headlines only, not read: a third round of talks between the government and the opposition ending on Wednesday 21 October without an announced agreement, the opposition back on the streets on Thursday 22 October in what Spanish-language outlets called the first national protest in nearly two years, demanding an election date, and a Brazilian outlet reporting that Washington is negotiating the transition with Delcy Rodríguez and without María Corina Machado.
- Brazil's presidential run-off. From issue four. Seen in headlines only, not read: Datafolha's final poll on Thursday 22 October putting Flávio Bolsonaro and Lula level at 50 per cent of valid votes each, three days before the vote; a letter from Catholic bishops calling the challenger a threat to democracy; and a dispute before the electoral court over the candidates' financial records.
- Attacks on civilians in Sudan's war. From issue six. Seen in headlines only, not read: a BBC investigation finding that hospitals in El Fasher were deliberately targeted by RSF fighters, Amnesty International marking a year since the city's capture with a report of unlawful killings, detention and torture, the African Union condemning drone strikes in Sudan and Abyei, and the Red Cross warning that aerial attacks are driving up civilian harm.
- Iraq after the coalition. From issue three. Closed in this issue; see below. Seen in headlines only, not read: Iraq closing border crossings with Iran to review security after the attacks on Saudi Arabia, and saying it will not allow its territory to be used for attacks on Saudi Arabia or other countries in the region.
- The trade truce between the United States and China. From issue three. Closed in this issue; see below. Seen in headlines only, not read: China's commerce ministry saying the United States violated the Xi-Trump understanding with its ban on DeepSeek, and the Kremlin saying a three-way summit of Putin, Xi and Trump is being prepared.
Three threads closed. The closing rule, in force since the previous issue, closes any thread on which nothing has been read for six issues, with the count as the reason. At the end of this run it closed three: deaths in custody in Nigeria, from issue two, last read in issue three; Iraq after the coalition, from issue three, carried since on headline sightings of a new cabinet and, this week, of border crossings closed with Iran; and the trade truce between the United States and China, also from issue three, which has not been read since the issue that opened it. A headline seen but not read does not keep a thread alive, which is why the Iraq sightings above did not. A closed thread reopens, with its history, if its story reaches the pool again; the full register, with the reason on each closed thread, is at what we are following.
What this issue does not contain, and why
The highest-scoring story that did not run was the United States secretary of state's visit to India, scored eight on its marks, above the Ukraine talks, the Saudi attacks, Kenya's Ebola count and the India follow-up, which scored seven and carried by four newsrooms in our sources: its headlines report a visit and its agenda, the world's largest oil refinery, Russian oil and a trade deal, where the two stories chosen ahead of it report things that happened inside the window, talks held and a prisoner freed, and attacks that killed people and closed airports. The rubric asks for that reason to be written down when a lower score runs ahead of a higher one, and this is it. A jury's order that Meta pay $25 billion to the state of New Mexico scored seven, with nine independent reports, and was passed over as one company's penalty in one state, under appeal by the headlines. Japan's launch of a mission to the Martian moon Phobos was the most widely carried story in the pool once its two groups were merged, twenty-seven independent reports from newsrooms based in seven regions, and scored six with a low mark for scale. A car attack that cost an Australian member of parliament both legs was carried by fifteen newsrooms and scored six on its marks, as an attack on one person in what police called an isolated incident. A group of news-brief headlines from one Indian newspaper is held below the corroboration floor with two independent reports once three strays were set aside. All counts are of our own sources, and every candidate is on the scorecard below with its marks.
How this issue was made
Researched and written by an AI system working to a published rubric, with every source linked. The issue covers four days, Monday to Thursday, and was written on the Friday. The window is set by when our sources published, in universal time. The window's 25,895 headlines were sorted into 16,532 clusters; 37 candidates were carried forward and merged to 34 stories, each marked by one AI and checked by a second that saw only the marks. Seven were researched and written up, two of them as one piece, and the slow story was written from the watchlist's own file. Every figure above was fetched and read during this run.
The second AI disputed four marks, and the first AI's marks stand with the disputes printed beside them: it would have put the pope's results, the attack on the Australian member of parliament and a prize for the International Criminal Court at the bottom of the scale, where the first AI put them one step up, and it would have given a billionaire's pledge of shares to children no mark for attention. None of the four changes the order. It also noted that the first AI called several widely carried stories thinly covered, among them the two Ebola stories and the Saudi attacks, which by the pool's own standard were in its top third; the first AI's reasons stand as written, and the point is printed with them. Headlines the software had attached to the wrong story were set aside by hand, on the word of the first AI, which named them but could not set them aside itself: among them an explainer on a livestock virus grouped with the PHP flaws, an opinion piece on Saudi policy grouped with the Houthi attacks, and two reports of Nigeria's Ebola case grouped with Kenya's count. Each is listed on the scorecard, where its label reads "set aside by the grouping check".
Two things about the grouping this week are worth knowing. The PHP story and the Houthi attacks were each split across several groups that never reached the pool, so the published counts for both understate how widely our sources carried them; the headlines from those groups were fetched and read for the pieces above, and the counts stayed as the record computed them. The software also failed to fold Premium Times NG with Premium Times Nigeria, and Vanguard with Vanguard News, so the scorecard's newsroom counts for Nigeria's and Kenya's Ebola stories each include one organisation twice; the pieces above give no newsroom count for either. And the second AI repeated a standing note, that newsrooms not on our own list are placed in the region of the Google News edition that surfaced them, not where they are based, which lifts the computed corroboration mark on product and science stories. That is a known problem, listed on the how stories are chosen page; it did not decide any story that ran.