Global Security Weekly Brief: 2026-W41

The week in brief #

1. Hormuz is now a shipping crisis: barrels exist, but moving them costs a record premium #

Context: Tanker attacks around Hormuz hit at least 12 in the week of 2026-09-28 to 10-05, the most in any week of the war (the next highest was 8, in the week of 2026-07-13). On 2026-10-09 the IRGC Navy said its enforcement "will not be limited to the Strait of Hormuz". Ships were then hit at anchor off the UAE and in the central Gulf off Qatar. Vessel transits fell to their lowest since 2026-07-23 (8 on 2026-10-06, per LSEG). Kpler puts Hormuz crude at 10.3M b/d for the week ended 2026-10-03, about 23% below the 13.5M b/d pre-war baseline. That is down from a brief return to pre-war rates in late September.
Impact: physical crude is pricing in the risk that futures are not. Dated Brent reached $136 on 2026-10-08 against $104 for ICE Brent futures, a $32 gap (about $19 on 2026-10-02). Gulf to East Asia VLCC rates passed $1.4M a day. The US Gulf adds a second squeeze: Hurricane Isaias shut in 1.46M b/d, 71.5% of Gulf oil output, on 2026-10-09. Diesel, jet fuel and anything priced off Dated Brent cost far more than the futures headline suggests. Asian importers carry the freight bill.
Confidence: moderate · Detail: Commodities, Shipping & Sanctions

2. Washington eased sanctions on Russian diesel and turned on Ukraine's refinery strikes, while Europe tightened #

Context: after a call with Putin on 2026-10-09, Trump announced Russian diesel deliveries: 300,000 t at once, 500,000 t in November and 1M t after that. OFAC issued General License 135, which authorizes Russian-origin diesel imports, including into the US, through 2027-04-07. Russia partly lifted its own export ban (500,000 t, effective 2026-10-10). On 2026-10-10 Trump said Zelensky "better damn well stop" striking refineries and that "it's time for Ukraine to get a new president". The Miami talks ended early, and ISW says the diesel announcement disrupted them. The EU moved the other way: ambassadors approved a 22nd package of about 1,700 listings on 2026-10-07, due for adoption on 2026-10-12.
Impact: the deal adds little supply. US diesel stands at $6.28/gal, about 70% higher, and analysts quoted by CNN expect little price relief. The signal matters more. A US license for Russian fuel and the pressure to stop the refinery strikes cut against the transatlantic sanctions regime. Firms trading Russian-origin products now face a widening split between US and EU compliance rules.
Confidence: moderate · Detail: Europe & Russia/Ukraine

3. The Houthi war on Saudi Arabia turned deadly, and US entry is a live question #

Context: the attack on Riyadh's King Khalid International Airport on 2026-10-10 killed at least 12 and injured 309. It was the third attack on the airport that week, and the two earlier ones killed four. The Houthis had not claimed it. Trump said the US "may" join strikes on the Houthis. Saudi Arabia, Pakistan and Turkey agreed on 2026-10-05 to deploy forces in Saudi Arabia. The Saudi-backed ground offensive that began on 2026-10-04 claims "effective control" of Bab el-Mandeb, but Times of Israel and ISW say the waterway is not secured. Trump has also ruled out attacking Iran before the 2026-11-03 midterms.
Impact: Lufthansa and Indian carriers suspended Riyadh flights, so Gulf aviation, business travel and events in Riyadh are directly exposed. Saudi Arabia's Red Sea bypass (Yanbu and the East-West pipeline) stays at risk, and France is studying naval protection for Yanbu. War-risk cover on both Saudi export routes stays high.
Confidence: moderate · Detail: Middle East & Gulf

4. Ethiopia and Eritrea are trading war claims at the UN #

Context: Ethiopia's letter to the UN, released on 2026-10-09, describes an Eritrean "all-out invasion" up to 60 km into Tigray and says Ethiopia has no option but to defend itself. Eritrea asked the Security Council to condemn Ethiopia's "declaration of war" under Chapter VII, but has not confirmed or denied that its troops crossed. ACLED reported drone strikes on Eritrean troops near Adigrat overnight 2026-10-07/08, and neither government has commented. Federal forces have held Mekelle since 2026-10-03. Egypt, Eritrea, Somalia and Sudan's army chief issued a joint declaration on 2026-10-04. Egypt is reported to be preparing a troop deployment to Somalia.
Impact: an Ethiopia-Eritrea war would threaten the Djibouti corridor, which carries Ethiopia's trade, and the Eritrean coast on the Red Sea, on top of the Houthi threat at Bab el-Mandeb. Aid operations in Tigray face a second crisis: close to four million people already needed humanitarian help.
Confidence: moderate (Mekelle), low (Eritrean troop presence) · Detail: Africa

5. Russia's winter campaign is killing civilians at scale; Ukraine keeps hitting refineries and data centres #

Context: Russian strikes killed 22 in Pryluky (2026-10-07), 33 on two buses in Kramatorsk (2026-10-08) and 20 in Zaporizhzhia (2026-10-10), and cut power, water and the metro in Kyiv. ISW says Russia's winter energy campaign began in late September. Ukraine struck the Omsk refinery, Russia's largest, 2,500 km away (2026-10-08). Volgograd has stopped all processing, and Yandex data centres were hit on consecutive days.
Impact: Ukraine's grid and transport face a hard winter. Russian refining losses already pushed Moscow to ban diesel exports in July, and they now feed straight into the US-Russia diesel deal. Disruption to Russian tech services (Yandex) is a new front.
Confidence: high (strike tempo), moderate (refinery effects) · Detail: Europe & Russia/Ukraine

6. Seven governments called out a Chinese contractor, and AI agents were used to breach banks #

Context: the UK, US, Australia, Canada, Japan, New Zealand and Spain issued a joint advisory on 2026-10-08 on actors linked to Integrity Technology Group. The FBI seized seven domains behind Flax Typhoon's MicroScan and FishHub tools, whose targets included a South Carolina power company and airports in Japan and Poland. CISA added five Flax Typhoon-exploited flaws a day later. CrowdStrike says a Chinese-speaking attacker used the ARTEX AI suite and Claude agents against Shinhan, KB Kookmin and Hana banks in South Korea.
Impact: state pre-positioning in power and aviation remains the main systemic cyber risk. AI-agent intrusions on major banks show these techniques are now in operational use. Regulators and insurers are likely to treat it that way.
Confidence: high (advisory), moderate (attribution of the bank attacks) · Detail: Cyber & Critical Infrastructure

Key judgments #

#	Judgment (estimative language)	Confidence	Basis
1	ICE Brent will likely stay above $95 through 2026-10-18, and Dated Brent will likely stay at least $10 above ICE Brent	moderate	Record freight, a war-high attack tempo and thin inventories. Trump's no-strike pledge and the Isaias restart timing are the main downside and upside risks
2	More merchant-ship attacks in or near Hormuz and the wider Gulf by 2026-10-17 are very likely; a US-Iran deal that normalises Hormuz traffic by then is very unlikely	moderate	12 attacks in one week, the IRGC's widened threat, and indirect talks via Qatar with no change in positions. Attack attribution rests mostly on unconfirmed IRGC claims
3	US kinetic action against the Houthis by 2026-10-24 is a roughly even chance; a US or Israeli strike on Iranian territory before 2026-11-03 is unlikely	low	Trump said the US "may" join after the Riyadh attack, but no decision has been announced. His public pledge not to strike Iran before the midterms conflicts with reports of Pentagon options
4	Russian strikes on Kyiv's energy, water or bridge infrastructure in the next two weeks are almost certain; Ukraine will likely keep striking Russian refineries despite US pressure	high (strikes), moderate (refineries)	Grid strikes on 10-08 and 10-10 and ISW's winter-campaign assessment. Zelensky's pledge and European backing; the reported US intelligence threat is unconfirmed and was denied
5	EU foreign ministers will likely adopt the 22nd Russia package by 2026-10-17	moderate	Ambassadors agreed on 2026-10-07 and adoption is scheduled for 2026-10-12. A late member-state hold is the main risk
6	Federal forces will very likely hold Mekelle through 2026-10-18; Eritrea publicly acknowledging that its troops are fighting Ethiopian forces by then is unlikely	moderate (Mekelle), low (Eritrea)	Several wires report federal control. Eritrea's response so far is a counter-accusation at the UN without confirming troop presence, and the Adigrat drone strikes are unattributed
7	Further Philippine-reported Chinese obstruction or dangerous encounters by 2026-11-10 are very likely	moderate	At least six engagements since 2026-10-01 and 101 Chinese vessels counted in September (up from 56). Counts come from a party to the dispute

Last week's judgments, scored:

ICE Brent above $95 through 2026-10-11: held; the range was about $100 to $105.
Dated Brent at least $10 above ICE: held; the gap was $32 on 2026-10-08.
No Hormuz deal before 2026-10-18 (very unlikely): on track.
More ship attacks (very likely): happened; the week to 10-05 set a war record.
Strike on Saudi energy or export sites by 2026-10-18 (likely): not yet confirmed. Houthi claims against Aramco in Riyadh and against Petro Rabigh are unconfirmed. Riyadh's airport was hit three times with fatalities, but that is not an energy target.
Federal forces hold Mekelle through 2026-10-11: held.
Acknowledged Ethiopia-Eritrea clash by 2026-10-18 (unlikely): partly overtaken. Ethiopia's UN letter claims an invasion and a right of self-defence. Eritrea has not acknowledged fighting.
Strikes on Kyiv infrastructure through October (very likely): on track: the Northern Bridge on 10-04, the grid on 10-08 and 10-10.
No deliberate attack on NATO: holding. Spillover: drone attacks sank a ship off Bulgaria, and Moldova pulled border staff from crossings.
One more edge-device KEV addition: correct (Citrix NetScaler CVE-2026-88779, listed 2026-10-04).

Watch list for next week #

[Commodities] The Dated-ICE Brent spread (about $32 on 2026-10-08) against $19 and $10; Kpler Hormuz crude against 10.3M b/d; weekly attack tallies (UKMTO, JMIC) against 12
[Commodities] The first cargoes under OFAC General License 135 (vessels, destinations, tonnage against 300,000 t), and any EU or congressional move against it
[Commodities] Hurricane Isaias landfall and Gulf restart reports; US diesel against $6.28/gal; TTF against €80
[Middle East] A US decision on strikes against the Houthis after the Riyadh attack; Saudi or Aramco confirmation of any hit on Yanbu, the East-West pipeline or Riyadh energy sites
[Middle East] Pakistani or Turkish forces arriving in Saudi Arabia; who actually holds Mokha, Perim and the Bab el-Mandeb shore
[Middle East] Iran's reply on enrichment via Qatar or Moscow; any change to its seven conditions; another blockade-runner disabled by CENTCOM (four so far)
[Europe] EU adoption of the 22nd package on 2026-10-12; any US step against Ukraine's refinery strikes (an intelligence restriction or sanctions); the Witkoff-Kushner Moscow trip
[Europe] Kyiv grid, water and bridge strikes; Black Sea ship attacks off Bulgaria and Romania; Lithuania's Kaliningrad-border deployment and any Russian mobilization decree
[Africa] An Eritrean statement on its troops in Tigray, or wire-verified Ethiopia-Eritrea fire; UN Security Council action on the two letters; Egyptian troops arriving in Somalia
[Africa] A settled UN count for the Abu Shandi strike in Blue Nile; WHO Ebola figures against 4,205 deaths and 8,728 cases; a second case in Kenya
[Indo-Pacific] The Philippine count of Chinese vessels for October against 101; the next Second Thomas Shoal resupply or medevac; new aircraft types at Ban Keun, Laos
[Indo-Pacific] A North Korean ballistic launch and any pre-APEC US-DPRK contact
[Cyber] Further government action naming Flax Typhoon or Integrity Technology; South Korean regulators' findings on the ARTEX bank intrusions; an official advisory on Iranian attacks on US water systems
[Americas] The judge's in-camera review of the boat-strike memo and Rubio's reply on the Venezuela oil-deal text (both due 2026-10-14); Brazil's runoff polling ahead of 2026-10-25
[Space-Arctic] Any official description of the US on-orbit weapon; sourced GNSS jamming in the Gulf, Baltic or Black Sea; the Belarus exercise from 2026-10-12 to 10-16

Cross-desk links #

Hormuz, then physical oil, then freight, then Asia. IRGC attacks pushed Hormuz crude to about 10M b/d. Physical Dated Brent rose $32 above futures, and VLCC rates passed $1.4M a day. Japan, Korea, India and China pay most of that freight. Hurricane Isaias, which shut in 71.5% of US Gulf output, removes the main Atlantic offset at the same time.
Diesel ties the two wars together. Ukrainian strikes on refineries led Russia to ban diesel exports in July. Global diesel tightness, with US diesel at $6.28, prompted the Trump-Putin deal and GL 135. Asked about the deal, Trump told Kyiv to stop striking refineries. The Middle East shortage is now shaping US policy on Ukraine.
The Red Sea is squeezed from both shores. The Houthi war on Saudi Arabia threatens the Yanbu bypass and Bab el-Mandeb. Across the water, the Ethiopia-Eritrea crisis and the Egypt-Eritrea-Somalia-Sudan declaration (which says Red Sea control "should remain with the coastal states") put the African coast in play. Assessment, not a sourced link: a Horn war would remove the remaining safe margin on Red Sea routing that shippers counted on when they used Yanbu as a hedge against Hormuz.
Cyber meets shipping. Investigators found hackers had accessed the propulsion system of the US-bound tanker Prosperity this summer. As attacks on tankers rise, cyber risk to vessels becomes part of the same war-risk underwriting.
China across desks. Flax Typhoon's targets included airports in Japan and Poland. Chinese vessel numbers around the Philippines nearly doubled. A Chinese-speaking attacker used AI agents against Korean banks. Asian importers that depend on China-adjacent shipping lanes are also paying the Hormuz freight premium.

Desk assessments #

Middle East & Gulf #

Bottom line: The Hormuz tanker campaign and the Houthi war on Saudi Arabia now form one Gulf-wide pressure campaign on energy and aviation, and the deadly Riyadh airport attack makes US entry into the Yemen fight a live question. Trump's pledge not to strike Iran before 2026-11-03 removes US counter-strike risk for Iran for about three weeks, so escalation risk sits with Saudi Arabia, the Red Sea and Gulf shipping.

Developments

At least 12 people were killed and 309 injured in an attack on King Khalid International Airport in Riyadh on 2026-10-10. It was the third attack on the airport that week; the two earlier ones killed four. The Houthis had not claimed it. The Saudi-led coalition vowed a "firm" response, and Trump said of joining strikes on the Houthis: "We may. We're going to look at it." reported (Middle East Eye; Al-Monitor)
ISW-CTP assesses that the Houthis "almost certainly" conducted the 2026-10-10 attack (its assessment). The Houthis claimed earlier strikes on Riyadh airport on 2026-10-08, and on Abha and Riyadh airports on 2026-10-07. Lufthansa suspended Riyadh flights through 2026-10-16. reported (ISW; Times of Israel)
Saudi Arabia, Pakistan and Turkey agreed on 2026-10-05 to "rapidly deploy military forces and capabilities in Saudi Arabia". France's armed forces chief said French options to help protect the Yanbu terminal are under study. reported (Haaretz/Reuters; Middle East Eye)
The Yemeni ground offensive's gains are contested.
- Yemen's information minister told Reuters on 2026-10-05 that government forces have "effective control" of Bab el-Mandeb.
- Times of Israel reported on 2026-10-10 that government troops are "yet to secure" the waterway.
- ISW (2026-10-09) says the Houthis can still hit shipping from the Hanish Islands or from positions near Mokha.
- ISW also reports that the Houthis cut the last government road into Taiz City (2026-10-07).
- Control claims unconfirmed (Al-Monitor/Reuters; Times of Israel; ISW 10-09; ISW 10-07)
The IRGC Navy claimed a series of tanker attacks and said "encounters with offending vessels will not be limited to the Strait of Hormuz". Maritime Executive counts 59 incidents since July, 41 of them involving commercial shipping in Hormuz. A tanker was struck at anchor off the UAE on 2026-10-09, and security consultancies named a strike on the Chinese-owned VLCC Gem No. 2. IRGC claim unconfirmed; incidents reported (Maritime Executive)
UKMTO 162 (2026-10-10): an outbound tanker in Hormuz was struck by an unknown projectile, causing a fire; the crew is safe. Masters near Ras Al Khaimah were told by VHF to move from their anchorages. The IRGC separately claimed that a supertanker hit a mine on an "unauthorized" route; CENTCOM says the lane has no mines. UKMTO confirmed; IRGC claim unconfirmed (UKMTO 162; Middle East Eye; Press TV)
CENTCOM says a US fighter jet struck the stern of the Panama-flagged M/V Ocean Molica ("Arika Sun") in the Gulf of Oman on 2026-10-10. The strike disabled its propulsion without harming the crew, after the ship left an Iranian port. CENTCOM counts four vessels disabled and 135 turned around under the blockade. reported (US military statement; DVIDS; US News/Reuters)
Trump on 2026-10-08: "We will not be attacking Iran at any time prior to the midterm elections to be held in the United States on November 3rd," citing "productive discussions". Indirect talks continue through Qatar. Vance told Reuters that Iran must make a "meaningful" cut in enrichment capacity. The Kremlin says Putin passed Iran's position on a deal to Trump. reported (Al-Monitor/Reuters; Al-Monitor explainer; Asharq Al-Awsat)
Anonymous officials say Iran has preserved missile and drone production and can quickly add more. Haaretz reports that IDF officials acknowledge Iran has replenished much of its ballistic missile stockpile. The White House rejected the assessment. unconfirmed (The Japan Times; Haaretz)
Lebanon's Health Ministry counts 4,386 killed and 12,424 injured by Israeli attacks from 2026-03-02 to 2026-10-10. Two sources told Reuters that Hezbollah received $200M from Iran for displaced Lebanese; the US State Department says the money "is not there". Toll reported; transfer unconfirmed (Middle East Eye; Al-Monitor/Reuters)

Context and baseline

Riyadh. Before W41, Houthi fire at Riyadh had produced intercepts (W39) and an unconfirmed Aramco claim (W40). This week's 12 dead is, per Middle East Eye, the deadliest attack in the kingdom in more than a decade.
Ship attacks. At least six vessels were hit in the week to 2026-10-02, and a war-record 12 in the week to 2026-10-05. The target area has widened from the strait to anchorages off the UAE and Qatar.
Blockade. CENTCOM's count of ships turned around went from 122 in late September to 135.
US posture. US action against the Houthis would be the first since Operation Rough Rider ended in May 2025 (ISW).

Third-party analysis

ISW-CTP (AEI; hawkish on Iran) judged on 2026-10-05 that the offensive would likely take Mokha. By 2026-10-07 it said the Taiz losses showed the government "did not set sufficient political conditions". On 2026-10-09 it read the Houthi campaign against Saudi infrastructure as an effort to force Riyadh out of Yemen. (10-05, 10-09)
Rose Kelanic (Defense Priorities) and Sal Mercogliano, in Responsible Statecraft (Quincy; restraint school).
- Kelanic: "Iran can't fully close the strait, but the U.S. can't fully open it either".
- Mercogliano: the volume recovery rests on "longer voyages, ship-to-ship transfers, rerouting, and extraordinary war risk costs".
- (Responsible Statecraft)
Jim Lamson, War on the Rocks, argues that cumulative strikes caused "severe damage" to Iran's missile and drone industry, against the officials' view of rapid restocking. (War on the Rocks)
Zvi Bar'el, Haaretz (left-liberal Israeli daily), argues that defending Riyadh could draw the US into a wider Iran war. (Haaretz)
Wendy Ramadan-Alban, Responsible Statecraft, notes that 32 Iranian conservatives called for leaving the NPT on 2026-09-28. (Responsible Statecraft)
Where the evidence points:
- On missiles, the IDF officials' concession supports restocking of existing types now, while long-run production capacity is damaged. Sourcing is thin on both sides.
- On Hormuz, the volume-recovery and rising-risk views are both true. Volume returned through bypasses and ship-to-ship transfers, while risk to dark transits rose.

Assessment

Further merchant-ship attacks in or near Hormuz and the Gulf by 2026-10-17 are very likely, and a deal that normalises traffic is very unlikely (moderate).
US kinetic action against the Houthis by 2026-10-24 is a roughly even chance (low).
A US or Israeli strike on Iranian territory before 2026-11-03 is unlikely (low to moderate).
The main gaps: UKMTO reports lag events, and most attack attribution rests on IRGC claims.

Business and commodity impact

Prices and freight. Brent was about $104.50 on 2026-10-09. Responsible Statecraft cites VLCC rates of $1.2M a day out of the Persian Gulf.
Aviation. Riyadh airport closed and flights diverted on 2026-10-10. Carrier suspensions run to mid-October.
Events. Riyadh's upcoming energy and investment conferences carry security and insurance risk.
Saudi exports. The Yanbu bypass, which carries about 4M b/d per Kpler as cited by Responsible Statecraft, is now within the Houthi target set.

Framing vs. primary data

Bab el-Mandeb. A NY Post headline said Yemen "retakes" Bab el-Mandeb, and Anadolu quoted a Saudi envoy saying it was "cleared". Times of Israel and ISW say it is not secured. The headlines repeated a party's claim as fact.
Mines. The IRGC says a tanker hit a mine. CENTCOM says the lane has no mines. UKMTO reports only "unknown projectile" strikes.

Commodities, Shipping & Sanctions #

Bottom line: The shortage is in delivery and insurance, not barrels: Gulf crude recovered in September, then Hormuz-only flows fell back to about 10M b/d as attacks hit a war high, opening a $32 gap between physical and futures Brent. Policy relief (G7/IEA stocks, China's export restart, the Russian diesel license) is real but small next to the Isaias shut-in and drained inventories.

Developments

Hormuz traffic. Transits fell to their lowest since 2026-07-23: LSEG counted 8 vessels on 2026-10-06. Kpler shows crude volume down 27%. JMIC confirmed six attacks from 2026-10-03 to 10-06. reported (Maritime Executive)
Attack count. Three maritime security sources counted at least 12 attacks on tankers around Hormuz in the week of 2026-09-28 to 10-05, the highest of the war (the next highest was 8, week of 2026-07-13). The IMO recorded 9. reported (gCaptain/Reuters)
Prices and freight. After the 2026-10-07 attack in the central Gulf, Brent futures rose to $104, Dated Brent hit $136, and Gulf-East Asia tanker rates passed $1.4M a day. UKMTO counted the 13th strike of the month. Supertanker rates rose 40% in the first week of October after a September record above $1M a day (Bloomberg data). reported (Maritime Executive; OilPrice.com)
Diesel deal. OFAC General License 135 authorizes the sale, delivery, offloading and importation of Russian-origin diesel, including into the US, through 2027-04-07. Trump announced 300,000 t at once, 500,000 t in November and 1M t after that. Timing and destinations are not established. US diesel is up about 70% to $6.28/gal (Reuters). reported (gCaptain; OFAC; Euromaidan Press)
Russian exports. Russia partly lifted its diesel export ban, allowing 500,000 t to foreign markets from 2026-10-10. It banned exports in July after Ukrainian strikes. reported (Kyiv Independent)
Hurricane Isaias. Operators shut in 1,458,814 b/d, 71.51% of Gulf oil output, plus 58.84% of Gulf gas, as of 2026-10-09 (per the agency named in the report). Nearly 500,000 b/d of refining capacity lies in the projected path. reported (OilPrice.com; gCaptain/Bloomberg)
Iran sanctions. On 2026-10-08 Treasury designated 17 vessels under "Operation Economic Outcast", and the State Department sanctioned 5 more vessels, 10 entities and 6 individuals: 22 tankers in all. TankerTrackers.com says 173 Iran-linked tankers remain unsanctioned. confirmed (gCaptain; Al-Monitor/Reuters)
Emergency stocks and China. IEA members backed accelerating the March stock releases, prioritizing diesel. The G7 set a four-month deadline for the last 100M bbl. China restarted fuel exports after a one-week pause, with 3.7M t approved for October (trading sources via Reuters). reported (Hellenic Shipping News; Hellenic Shipping News; OilPrice.com)
European gas. TTF rose 2.8% to €80.20/MWh on 2026-10-08, then fell to €78.00 on 2026-10-09. IEEFA warns that low storage could force a 7% EU demand cut. reported (Hellenic Shipping News; Hellenic Shipping News; OilPrice.com)
Inventories. Aramco CEO Amin Nasser says the world has lost nearly 3 billion barrels of gross supply since the war began, leaving inventories "scarily thin" (a producer's view). reported (OilPrice.com)
Russian shadow fleet. Japan sanctioned 35 individual shadow-fleet vessels for the first time, effective 2026-10-02. The UK and Japan targeted Sovcomflot-linked ships. reported (Splash247; Hellenic Shipping News)

Context and baseline The Hormuz numbers measure different things:

Series	Figure	Period
Kpler, Hormuz-only crude	13.5M b/d (equal to pre-war)	seven-day figure at the late-September peak
Kpler, Hormuz-only crude	10.3M b/d, about 23% below 13.5M	week ended 2026-10-03 (Hellenic Shipping News/CNBC)
Windward, Hormuz crude	9 to 10M b/d against a 14.5M baseline	early October
Vortexa, Gulf crude and condensate, all routes	91% of pre-war	September (gCaptain/Reuters)
Vortexa, Gulf total oil including products	about 81% of pre-war	September

Monthly regional averages include the Fujairah and Red Sea bypasses. Weekly Hormuz-only figures do not, which is why "back to pre-war" and "down a quarter" can both be true. Other moves this week:

ICE Brent: about $100 to $105, against $107.24 on 2026-09-28.
Brent-WTI: about $12.5, against $13.14 on 2026-09-28.
TTF: €78 to €80, against €71.90 on 2026-10-02.
VLCC rates: above $1.4M a day, against $1.27M in September.

Third-party analysis

Amrita Sen, Energy Aspects: futures are "disconnected from reality", and physical crude should be closer to $150. (OilPrice.com)
Russell Hardy, Vitol CEO: ship-to-ship transfers in the Gulf of Oman prevent a $200 scenario, but "There aren't any more inventories to drain in the West". (OilPrice.com; Hellenic Shipping News)
Michelle Brohard, Kpler, suspects Gulf producers are paying Iran a toll for safe passage. This is unverified, and the Gulf states oppose Iranian tolls. (OilPrice.com)
Bob McNally (Rapidan), Richard Meade (Lloyd's List) and Michelle Wiese Bockmann (Windward). McNally: "Nobody in Washington thinks this is sustainable financially". Meade: the market is "becoming more efficient at operating under sustained insecurity". Bockmann puts attacks at about 2 per 100 transits in Q3. (Hellenic Shipping News/CNBC)
Iran sanctions. Brett Erickson (Obsidian Risk Advisors) calls the vessel sanctions "economic warfare conducted in the rearview mirror". Treasury says the action neutralizes most of the shadow fleet. (Al-Monitor/Reuters)
European gas. Goldman sees upside risk, with a tail case of €150/MWh. UBS forecasts €75 in Q4. (Hellenic Shipping News; Hellenic Shipping News)
Where the evidence points: toward the pessimists on sustainability. Hormuz-only volumes fell and attacks peaked. The strong September figures depend on bypass and ship-to-ship chains that tie up tankers, which is why freight hit $1.4M a day.

Assessment

ICE Brent above $95 through 2026-10-18 is likely, with a plausible range of $95 to $115 (moderate).
Dated Brent at least $10 above ICE is likely (moderate).
Russian diesel landed in the US above 100,000 t by 2026-10-25 is unlikely (low).
Hormuz attacks at or above 8 in the week of 2026-10-12 are likely (moderate).

Business and commodity impact

Crude. Physical buyers pay a $32 premium over futures. Asian refiners are shifting away from long-haul US cargoes as freight soars.
Freight. VLCC rates above $1.4M a day, up 40% in a week. Trafigura bought seven tankers from SFL for $275M.
Diesel. $6.28/gal in the US. Russia's first 300,000 t is about 2.2M bbl, small against the gap. France and Germany are releasing reserves.
Gas. TTF €78 to €80, with a Goldman tail case at €150. Henry Hub was about $3.02 on 2026-10-05.
Sanctions precedent. GL 135 is the first US opening for Russian fuel since March 2022 (Kyiv Independent). Australia says it will keep Russian fuel out.

Framing vs. primary data

"Gulf exports back above pre-war" headlines cite peak days and all-route regional totals. Hormuz-only weekly crude is about 23% below the baseline.
Treasury says the vessel action hits "the vast majority" of the shadow fleet. TankerTrackers.com counts 173 Iran-linked tankers still unsanctioned.
One OilPrice.com market note had oil "nearing the $110 per barrel mark" on 2026-10-09, while other prints that day were $102.83 to $105. The $110 figure could not be matched to a front-month settlement.

Europe & Russia/Ukraine #

Bottom line: The week's biggest shift was political: the US licensed Russian diesel and then told Ukraine to stop hitting Russian refineries, putting Washington against Kyiv's most effective pressure tool as Russia opens its winter strike campaign. The EU went the other way with its largest sanctions package, so the transatlantic split on Russia is now visible in sanctions law.

Developments

US license and Trump's demands. OFAC's General License 135 authorizes Russian-origin diesel until 2027-04-07. Trump said on 2026-10-10: "I think it's time for Ukraine to get a new president". He said Zelensky "better damn well stop" striking Russian refineries and "could have settled this war many times". Zelensky called the deal "a weak decision by our strong partners." reported (Euromaidan Press; Kyiv Independent)
Reported intelligence threat. Axios, citing a Ukrainian official, reports that envoys Witkoff and Kushner threatened to cut Ukraine's access to US intelligence over the refinery strikes. A US official denied it. unconfirmed (Ukrainska Pravda)
Miami talks. The talks among the US, Ukraine, European countries and NATO ended earlier than planned. ISW says Trump's diesel announcement disrupted the meeting with Witkoff and Kushner. ISW also says Putin used his 2026-10-09 call to blame Ukraine and that Russia's war aims are unchanged. reported (Ukrainska Pravda; ISW)
Mass-casualty strikes.
- Pryluky, 2026-10-07: 22 killed (State Emergency Service).
- Kramatorsk, 2026-10-08: a glide bomb hit two buses and killed 33.
- Zaporizhzhia, 2026-10-10: 20 killed and 32 injured. Ukrainska Pravda says three of the dead were children; BBC says four.
- reported (Euromaidan Press; Meduza; Ukrainska Pravda; BBC)
Kyiv grid and bridges. A drone barrage on 2026-10-08 cut power across parts of Kyiv Oblast, interrupted water and halted metro trains. A daytime attack on 2026-10-10 hit the grid again. Russia struck the Northern Bridge on 2026-10-04 after earlier hits closed the Southern Bridge. The city administration urged residents to stock water and food because "the intensity of the attacks is increasing". reported (Kyiv Independent; Euromaidan Press; Ukrainska Pravda)
Winter campaign. ISW says Russia began its winter 2026-27 energy strike campaign in late September, and that jet-powered Gerans let it concentrate missiles on fewer targets. reported (Euromaidan Press)
Ukrainian deep strikes.
- Ukraine struck the Omsk refinery, Russia's largest, more than 2,500 km from the border, on 2026-10-08.
- Reuters reports that the Volgograd refinery (about 14 Mt a year, roughly 5% of Russian refining) stopped all processing after a strike on 2026-10-02.
- Yandex data centres were hit in Sasovo (2026-10-08), Kaluga Oblast (2026-10-09) and Vladimir (2026-10-10). Ukraine has not claimed all of them.
- reported (Ukrainska Pravda; Meduza; The Record; Kyiv Independent)
Refining capacity claim. Ukraine's Defence Ministry says more than 51% of Russian refining capacity has been put out of action. It did not publish its method. unconfirmed (Euromaidan Press)
EU 22nd package. EU ambassadors approved the package on 2026-10-07, about 1,700 listings per Vlasiuk. Euronews, via Meduza, counts 743 people and 826 organizations. Formal adoption is expected on 2026-10-12. Estonia's PM urged Europe to help Ukraine "blast Russia's oil refineries to smithereens". reported (Euromaidan Press; Meduza; Euromaidan Press)
NATO flank.
- Lithuania will deploy up to 100 soldiers to the Kaliningrad border, citing signals of a possible Russian mobilization.
- Poland will station Patriots in the Lublin region and announced a 102.4 billion zloty ($26.4B) civil-defence plan for 2027 to 2031.
- Sweden will send a Patriot unit to guard the NATO logistics hub in Poland from December.
- Denmark's PET says Russia stepped up sabotage against Danish firms that supply Ukraine.
- reported (Euromaidan Press; Kyiv Independent; Defence Industry Europe; Kyiv Independent)
Black Sea and spillover.
- Unidentified drones attacked two merchant ships about 110 km off Bulgaria and sank one. Reuters called it the first such attack in Bulgarian waters since the war began, and a source pointed to Russia.
- A Turkish-owned grain ship sank after being hit on 2026-10-05: Zelensky blamed Russian drones, and Romania reported two dead.
- Moldova pulled border staff off joint crossings on Ukrainian soil after drone strikes nearby.
- reported (Meduza; BBC; Euromaidan Press)
Front line. ISW says Ukraine is advancing east of Sloviansk and Kramatorsk, which Russian milbloggers acknowledge. It calls the Russian MoD's claim of 414 km² seized in northern Kharkiv Oblast "exaggerated". reported (Euromaidan Press; ISW)
Other.
- The US sanctioned the International Criminal Court on 2026-10-09. Eight allied foreign ministers said they "regret and strongly disagree". reported (Kyiv Independent)
- Montenegro detained and deported Rybar founder Mikhail Zvinchuk on 2026-10-09. reported (ISW)

Context and baseline

Strikes. The first-ever strikes on Kyiv's Dnipro bridges came on 2026-10-01 to 10-03. This week extended them to the grid, water and the metro.
Civilian casualties. OHCHR verified about 15,280 civilian casualties in January to August 2026, 55% more than a year earlier (via Euromaidan Press).
Refinery campaign. W39 added Novoshakhtinsk and Lukoil-Perm. W41 adds Volgograd and Omsk (above 21 Mt a year).
Ground war. ISW's September balance was a net Russian loss of 80.81 km², and the Sloviansk-Kramatorsk counterattacks extend that pattern.

Third-party analysis

ISW (pro-Ukraine framing) calls the diesel waiver a "unilateral US concession" that will "support the Kremlin's efforts to stonewall US efforts to end the war". (ISW 10-09)
Phillips O'Brien (St Andrews) argues that the real story is the US "increasingly emerging as a supporter of Russia in this war". (Substack)
Dan Pickering (Pickering Energy Partners) and Gregory Brew (Eurasia Group). Pickering calls the deal "more politics than a game changer". Brew suspects Putin expects Ukraine to halt refinery strikes in return. (Euromaidan Press, via CNN)
Marko Mihkelson (Estonian parliament, foreign affairs chair; Baltic hawk) says Russia's strategic goals are unchanged.
Where the evidence points: both readings hold. The volumes are too small to move prices. The license runs for six months, however, and the pressure on the refinery campaign is real, so the strategic reading (O'Brien, ISW) carries more weight than the price effect.

Assessment

Strikes on Kyiv's energy, water or bridges in the next two weeks are almost certain (high).
Ukraine will likely keep striking refineries despite US objections (moderate).
A deliberate Russian attack on a NATO member within a month is very unlikely (moderate). Further drone spillover into Moldova, Romania, Bulgaria or Poland is likely.

Business and commodity impact

Diesel. The first 800,000 t compares with US demand of about 16M t a month (Kovalenko, via Euromaidan Press), so the price effect is negligible.
Black Sea. The Bulgarian sinking widens the high-risk zone for grain and cargo insurance.
Russian tech. Yandex outages hit Avito, Megafon, Russian Railways and T-Bank users. Yandex has added drone attacks to its force-majeure terms.
EU sanctions. The 22nd package targets defence-industrial inputs: electronics, machine tools and drones.

Framing vs. primary data

Refining capacity. Ukraine's "more than 51% of Russian refining" claim has no published method. The plant-level facts are Volgograd offline (about 5%) and Omsk hit.
EU package size. Counts range from about 1,570 (Euronews: 743 plus 826) to about 1,700 (Vlasiuk). The gap is likely a counting basis.
Kharkiv claim. The Russian MoD's 414 km² claim is not supported by ISW or by Russian milbloggers.

Africa #

Bottom line: Federal forces hold Mekelle, and the Ethiopia-Eritrea dispute has moved from rhetoric to dueling letters at the UN Security Council, with drone strikes reported on Eritrean troops near Adigrat. Combined with the Egypt-Eritrea-Somalia-Sudan axis and a reported Egyptian deployment to Somalia, the Horn is aligning into rival camps along the Red Sea.

Developments

Mekelle. Government forces and allied fighters entered Mekelle on 2026-10-03 and took the airport. The TPLF says it "temporarily moved out". confirmed (Al Jazeera; The Africa Report)
Ethiopia's letter to the UN. In a letter shared with Reuters on 2026-10-09, Ethiopia said an "all-out invasion" by Eritrean forces left it no option but to defend itself. Al Jazeera reports the letter says Eritrean troops advanced up to 60 km into Tigray. reported (Ethiopian government claim; US News/Reuters; Al Jazeera)
Eritrea's response. Eritrea asked the Security Council to "forcefully condemn" Ethiopia's "declaration of war" and take "deterrent measures" under Chapter VII. Its information minister did not confirm or deny troop crossings. reported (Eritrean government claim; Al Jazeera)
Eritrean troops in Tigray. Witnesses told Reuters they saw dozens of Eritrean soldiers in trucks in Adigrat on 2026-10-07; Reuters could not verify. A Tigray Peace Force commander says the Eritrean army "has entered Tigray". unconfirmed (Al Jazeera)
Adigrat drone strikes. ACLED says "multiple drone strikes" hit Eritrean troops and ammunition in the Adigrat area overnight 2026-10-07/08. A witness said some Eritrean lorries were destroyed. Neither government has commented. reported (Yahoo News/Euronews; US News/Reuters)
El-Alamein declaration. The leaders of Egypt, Eritrea and Somalia and Sudan's army chief Burhan issued a joint declaration on 2026-10-04 saying control of the Red Sea "should remain with the coastal states". confirmed (Al Jazeera; Hiiraan Online)
Egypt and Somalia. Egyptian military teams are reportedly preparing to deploy army troops to Somalia, the first such move since a 2024 cooperation agreement. reported (Hiiraan Online)
Blue Nile strike. A drone strike on a displacement shelter at Abu Shandi, Wad El Mahi locality, on 2026-10-09 killed at least 30 (Blue Nile government) and up to 41 (Emergency Lawyers). These are counts of one incident at different times. The regional government and rights groups blame the RSF. The RSF-aligned Tasis alliance blames Egyptian warplanes. Toll reported; attribution unconfirmed (Dabanga; BBC; Sudan War Monitor)
Kidal. Mali's transitional government says its army retook Kidal. RFI reports that the FLA separatists and JNIM jihadists withdrew before the army arrived. UNHCR says Mali, Burkina Faso and Niger now count nearly 4 million displaced people and refugees, almost double the 2020 figure. reported (AP; RFI Afrique; RFI Afrique)
Ebola. WHO had recorded 8,728 confirmed cases and 4,205 confirmed deaths in the DRC as of 2026-10-06. Kenya's first imported case died on 2026-10-05. confirmed (Al Jazeera; Premium Times)
DRC diplomacy. An African Union delegation met the Rwanda-backed rebels in eastern Congo. President Tshisekedi asked the UN to back the demobilisation of FDLR fighters. reported (US News/Reuters; Jeune Afrique)
Nigeria. The Nigerian Air Force says 25 people were aboard the military aircraft that crashed on 2026-10-05. Early reports gave 32. reported (Premium Times)

Context and baseline

Tigray. The last comparable episode is the 2020 to 2022 war, in which as many as 600,000 may have died (Weldemariam, The Conversation). Close to four million Tigrayans were already in humanitarian crisis before fighting resumed in September (The New Humanitarian).
Ebola. As of 2026-10-02: 4,018 deaths and 8,300 cases. As of 2026-10-06: 4,205 deaths and 8,728 cases, about 187 more deaths in four days.
Blue Nile. Nearly 100,000 people have been displaced in Blue Nile this year (UN figures via Al Jazeera).
Sudan sanctions. The UN Security Council extended the Darfur arms embargo. Russia and China blocked a broader US sanctions push.
Somalia. Ethiopia's reported drawdown from Somalia has not been officially confirmed, and no new AFRICOM strike count was published.

Third-party analysis

Horn Review (Addis Ababa; federal-government lean) reads the Ethiopian minister's statement as "official confirmation that Eritrea has embarked on an invasion". (Horn Review; Ethiopia's Northern Crisis)
Sheriff Bojang Jnr, The Africa Report, writes that the two countries are "closer to war with each other than at any point since their 2018 rapprochement", and asks whether Assab port is the real prize. (The Africa Report)
Alemayehu Fentaw Weldemariam (Indiana University) roots the conflict in "an unresolved constitutional struggle over federalism". (The Conversation)
Eritrea denies backing the TPLF.
Where the evidence points: toward a serious risk of Eritrean incursion, not yet a confirmed Ethiopia-Eritrea firefight. Horn Review's "direct engagement" reading rests on Ethiopian statements and unverified witnesses.

Assessment

Federal forces very likely hold Mekelle through 2026-10-18 (moderate).
Eritrea acknowledging that its troops are fighting Ethiopian forces by then is unlikely (low).
Further drone strikes on civilian and displacement sites in Blue Nile near the Ethiopian border are likely through 2026-10-18 (moderate).
Gap: no UN, ICRC or MSF confirmation of control in Tigray.

Business and commodity impact

Red Sea and the Horn. The El-Alamein declaration and Ethiopia's renewed demand for sea access put Assab, Massawa and the Djibouti corridor at risk. A wider war would likely raise war-risk cover and rerouting for Horn trade; the magnitude cannot be estimated from current data.
Ebola. Growth and border screening in Kenya and Somalia add regional travel and trade friction.

Framing vs. primary data

Blue Nile toll. The figures were 30 (regional government), 31 (Sudan Doctors Network), 40 (OCHA initial) and 41 (Emergency Lawyers) for the same strike. The difference is timing and counting party.
Invasion reading. Horn Review's "official confirmation" of invasion goes beyond the minister's actual words, which were that Eritrean forces "must leave Ethiopian territory without delay".

Indo-Pacific #

Bottom line: China's pressure on the Philippines has become sustained rather than episodic, with Chinese vessel counts nearly doubling in September and a second Second Thomas Shoal operation obstructed in two weeks. The China-Laos base imagery shows trainer-class aircraft, not combat basing, and the Hormuz freight premium is the main near-term cost for Asian importers.

Developments

Dangerous encounters. Philippine and Chinese forces engaged dangerously at least six times from the start of October, at Scarborough, Second Thomas and the Spratlys. A new point of tension has opened in the Luzon Strait near Batanes. reported (USNI News)
Vessel counts. The Philippine military tracked 101 Chinese navy and coast guard vessels around four disputed areas in September, against 56 in August and 48 in July. A Chinese J-16 made unsafe approaches to a Philippine aircraft near Scarborough. unconfirmed (party to the dispute; Yahoo/AFP)
Second Thomas Shoal. The Philippine Coast Guard says a China Coast Guard vessel delayed a medical evacuation from BRP Sierra Madre on 2026-10-08 by several hours. The China Coast Guard says it helped. ISW reads this, with the block on 2026-09-24, as Beijing no longer honouring the 2024 arrangement (its judgment). unconfirmed (ISW)
Ban Keun, Laos. Vantor satellite images show what analysts quoted by Reuters believe are eight K-8 light attack jets and more than two dozen support vehicles at the new China-Laos base. Olli Pekka Suorsa (Rabdan Academy) identifies them as JL-8/K-8 basic jet trainers. PLA media call the site a joint support and training centre. reported (US News/Reuters; The Diplomat)
Taiwan's east coast. Reuters reported the first known sighting, in mid-August, of a Chinese militia boat off Taiwan's east coast, illustrated with an APEX Aviation image of the fishing boat Minfudingyu 07902. The US called Chinese actions there "deeply destabilising". reported (US News/Reuters; The Straits Times)
Pratas. Taiwan's Coast Guard expelled two likely state-sponsored Chinese fishing boats from restricted waters around Pratas. reported (ISW)
North Korean missile test. North Korea tested a ballistic missile on 2026-10-03. South Korea's JCS says it flew 700 km. Pyongyang claims an IRBM with a hypersonic warhead that flew 1,000 km. JCS figure reported; DPRK claim unconfirmed (ISW)
South Korean hypersonic test. President Lee observed South Korea's first test of a domestic hypersonic glide vehicle on 2026-10-08. reported (NK News)
DMZ mine blast. South Korea attributes the 2026-09-21 DMZ blast that wounded two soldiers to a North Korean mine. Kim Yo Jong calls the accusation "groundless". unconfirmed (The Straits Times)

Context and baseline

Second Thomas Shoal. The 2024 Provisional Understanding allowed 13 resupply missions without incident. The interferences on 2026-09-24 and 2026-10-08 are the first two since.
Taiwan ADIZ. ISW gives an average of over 160 sorties a month in 2026, against about 300 a month in 2024 and 2025. Taiwan's defence ministry tracked 21 aircraft and seven vessels on one day this week (Taiwan News).
DPRK tempo. The 2026 tally to 2026-09-20 was 15 missiles on 9 occasions (Japan MoD), about one launch occasion a month.
Korea-US talks. South Korea's NIS sees about a "50 percent chance" of US-DPRK talks around the November APEC summit (via ISW).

Third-party analysis

Ban Keun, as quoted by Reuters.
- Collin Koh (RSIS) questions whether Laos's aircraft are serviceable.
- Alexander Neill (Pacific Forum) suggests the runway may be built for larger, possibly signals-intelligence, aircraft.
- Rachel Vandenbrink (ASPI) calls the site a "target of opportunity".
Olli Pekka Suorsa, The Diplomat, argues that many hawkish claims "lack evidence and realism". He notes the apron "can only support a dozen trainers".
Ying Yu Lin, The Diplomat, sees "only a limited direct threat" to the South China Sea or Taiwan. (The Diplomat)
Hunter Marston, Lowy Institute: "A modest training centre on paper, but any upgrade would alarm capitals well beyond Southeast Asia." (The Interpreter)
ISW reads Pyongyang's hypersonic claims as an information operation. (ISW)
Where the evidence points: on Ban Keun, the imagery favours the trainer reading. Runway expansion is the open question.

Assessment

Further Philippine-reported obstruction or dangerous encounters by 2026-11-10 are very likely (moderate). The frequency partly reflects Philippine reporting.
PLA combat-aircraft basing at Ban Keun by 2026-11-10 is very unlikely (low).
Another North Korean ballistic launch by 2026-11-10 is a roughly even chance (low). The base rate points higher, but NIS reads restraint ahead of APEC.

Business and commodity impact

Oil and freight. Japan, Korea, India and China bear most of the $1.4M-a-day VLCC freight and the Dated Brent premium. No country-level import volumes were published this week.
Shipping lanes. Tension in the Luzon Strait and Bashi Channel would, if it escalated, affect routes linking China, Taiwan, Japan, Korea and the Philippines. This is speculative.

Framing vs. primary data

Ban Keun aircraft. Reuters' analysts call them "light attack jets". Suorsa identifies the same eight aircraft as basic trainers. The imagery count matches; the interpretation differs.
North Korean missile range. Pyongyang claims 1,000 km; South Korea's JCS reports 700 km.

Cyber & Critical Infrastructure #

Bottom line: State-linked operations against critical operators drove the week: seven governments named a Chinese contractor behind Flax Typhoon and the FBI seized its tooling, while AI agents were used in intrusions on major South Korean banks. Criminal access at systemic scale continued through FortiBleed, offset by arrests in the Qilin and ShinyHunters cases.

Developments

Joint advisory on Integrity Technology Group. The UK and partner agencies from Australia, Canada, Japan, New Zealand, Spain and the US named China-linked Integrity Technology Group in an advisory on 2026-10-08. The FBI seized seven domains that Flax Typhoon used to run the MicroScan scanning and FishHub spearphishing tools. Named MicroScan targets include a South Carolina power company and airports in Japan and Poland. confirmed (NCSC UK; CyberScoop)
CISA deadline. CISA added five flaws exploited by Flax Typhoon and gave federal agencies until 2026-10-11 to patch or stop using the affected products. reported (The Hacker News)
AI-agent attacks on Korean banks. CrowdStrike says a Chinese-speaking attacker used the ARTEX AI penetration-testing suite and Claude agents against Shinhan, KB Kookmin and Hana banks from late September to early October. The ARTEX instance ran on DeepSeek v4.1-flash. The Record reports at least 68,000 people exposed across at least seven institutions. South Korea's Financial Services Commission held an emergency meeting. reported (BleepingComputer; The Record)
FortiBleed. An FBI and Secret Service alert of 2026-10-06 says the campaign remains active and serves as initial access for ransomware affiliates including INC/Lynx and Payload. SOCRadar verified more than 86,644 compromised devices in 194 countries when the campaign was first found. reported (CyberScoop)
Hafnium reward. The State Department offers $10M for Zhang Yu of Shanghai Firetech, accused of Hafnium intrusions for China's Ministry of State Security. The FBI says Hafnium targeted over 60,000 US entities and victimized more than 12,700. reported (The Record)
Tanker propulsion breach. FBI and Coast Guard investigators found hackers had accessed the propulsion system of the laden tanker Prosperity, bound for Galveston, this summer. Officials report no operational disruption so far. reported (gCaptain/Bloomberg)
ccTLD hijack. Attackers breached the DNS operators for .gh, .sl and .as and obtained valid HTTPS certificates for Google domains. Certificate Transparency logs show other brands affected. reported (BleepingComputer)
Arrests. Germany arrested an alleged core Qilin ransomware member after Japan extradited him; Qilin has targeted more than 2,350 organizations in 62 countries. Canadian security executive Edward Dubrovsky was arrested in Pennsylvania in a case reports link to the ShinyHunters crackdown. reported (BleepingComputer)
Denmark. Denmark's Central Population Register breach affects about 8.8 million people. reported (BleepingComputer)
Japan. A ransomware attack on IDC Frontier's IDCF Cloud caused an outage at a data-centre cluster serving eastern Japan. reported (BleepingComputer)
Ukraine. ESET says Russian-aligned UAC-0099 targeted Ukrainian transport, manufacturing and energy firms. reported (The Record)
Iran and US water systems. A CyberScoop opinion piece says Iranian hackers attacked water systems in 12 US states this summer. No government confirmation is available. unconfirmed

Context and baseline

KEV additions. At least 6 this week, 1 of them an edge device (Citrix NetScaler CVE-2026-88779 on 2026-10-04). That compares with 3 of 7 in W40 and 6 of 10 in W39. The five Flax Typhoon flaws carry 2015 to 2023 CVE years, so they are old bugs.
AI-enabled offence. The Korean bank intrusions are the first documented case with named victims at sector scale. Earlier documented cases were research or single-target incidents.

Third-party analysis

Jake Knott (watchTowr) says the NetScaler SAML flaw "doesn't work out of the box against every NetScaler deployment". (CyberScoop)
Ensar Seker (SOCRadar CISO) says FortiBleed is "broader and more serious than we understood". This is a vendor estimate.
Alex Soukhanov (True North Group) on Prosperity: "Every mariner should be extremely concerned." Svante Einarsson (DNV) counters that most vessels can fall back on other systems. Officials' "no disruption" finding favours the narrower reading for now.
ESET and TrendAI both tie UAC-0099 to Russia but report different malware families. (The Hacker News)

Assessment

Another government action naming Flax Typhoon or Integrity Technology by 2026-10-17 is likely (moderate).
An official advisory confirming Iran-linked compromise of US water utilities by then is unlikely (low).

Business and commodity impact

Power and aviation. Pre-positioning in power and airports raises compliance and incident-response costs for operators.
Banks. Korean banks face remediation and regulatory costs, and AI-agent intrusions are now a live underwriting factor.
Maritime. The Prosperity case adds cyber questions to hull and cargo cover as kinetic war-risk rises.

Framing vs. primary data

FortiBleed scale. 86,644 devices verified at discovery against 400,000 to 450,000 firewalls "targeted" by the wider operation. These are different measures, not a contradiction.
Denmark. The account of a misused private-company access path differs from the Danish data-protection agency's reported description of brute-force enumeration. The two are not yet reconciled.

Americas #

Bottom line: Operation Southern Spear announced one lethal boat strike this week, and the campaign's cumulative toll is contested across tallies of 221 to 238 dead. Brazil's 2026-10-25 runoff will decide whether the region's largest economy joins the US-led Shield of the Americas; the Panama earthquake hit the economy but not the canal.

Developments

Boat strike. SOUTHCOM announced a lethal strike on a suspected drug boat in the Caribbean on 2026-10-04, killing four. CBS counts at least 235 deaths in 70 strikes. reported (CBS News)
Maduro charges. US prosecutors added a conspiracy-to-torture charge against Nicolás Maduro and Cilia Flores, relating to the alleged torture of US citizens held in Venezuela. confirmed (BBC; Al Jazeera)
Brazil first round. Flávio Bolsonaro won 47.04% and Lula 45.15% of valid votes (TSE), and the runoff is on 2026-10-25. Flávio Bolsonaro says he would join the Shield of the Americas. Lula's adviser Celso Amorim calls the Shield "an attempt to encircle Brazil" (translated). Brazil's Supreme Court ordered Eduardo Bolsonaro to begin a 4-year, 2-month sentence. reported (The Rio Times; BBC; Folha; The Rio Times)
Panama earthquake. A magnitude 7.7 earthquake (USGS) struck the Azuero peninsula on 2026-10-09 at 17:56 UTC. Panama's geosciences institute revised its estimate from 7.2 to 7.5. No deaths were reported by that evening. The Panama Canal Authority said operations continued normally. The US is mobilizing help at Panama's request, and CAF offered a credit line of up to $50M. reported (MercoPress; The Rio Times)
Quebec. The Parti Québécois won the most seats. Leader Paul St-Pierre Plamondon is set to become premier and promises an independence referendum in his first term. It was not yet clear whether the party had a majority. reported (Al Jazeera; BBC)
Ecuador. An Ecuadorian judge acquitted 32 fishermen whose boats US forces sank in September, finding no proof they helped traffickers. reported (The Rio Times)
Panama drones. SOUTHCOM and Panama expanded the deployment of Corsair maritime drones against trafficking. reported (CiberCuba)
Haiti. Haiti's electoral council postponed the December elections indefinitely. unconfirmed (single source; Folha)

Context and baseline

Strike pace. One strike this week, against the Lead IG Q3 pace of about 1.5 vessels a week (19 vessels, about 56 killed, 2026-04-01 to 06-30). Cumulative tallies vary by cutoff and by whether strikes or vessels are counted:

Tally Deaths Strikes

CNN 221 67 vessels

USNI 234 70

CBS 235 70

InSight Crime 238 79
Panama. The last comparable regional quake was a 7.4 in Colombia's Chocó on 2026-08-10, which killed 335 (MercoPress).
Cuba. No mobilization orders, NOTAMs or evacuation advisories surfaced.

Tally	Deaths	Strikes
CNN	221	67 vessels
USNI	234	70
CBS	235	70
InSight Crime	238	79

Third-party analysis

InSight Crime (Steven Dudley, Victoria Dittmar, Deborah Bonello) on Sinaloa: "The nature of the violence has changed, not stopped." (InSight Crime)
Latin American Post (opinion) argues that the Ecuador acquittal exposes the due-process problem of the strikes. SOUTHCOM says it had "confirmed intelligence"; the judge found "no proof". (Latin American Post)
Air & Space Forces Magazine reports that a surge of MQ-9 Reapers to SOUTHCOM could widen intelligence collection against cartels. (Air & Space Forces)
Where the evidence points: the legality question is unresolved in the public record. No new Just Security or Lawfare analysis appeared this week.

Assessment

At least one more announced lethal boat strike by 2026-10-17 is likely (low).
A Flávio Bolsonaro runoff win is likely (low). If he wins, Brazil joining the Shield within six months is likely (moderate on intent).
A US strike on Cuba by 2026-11-09 is unlikely (moderate).
A first land strike on cartels in Q4 remains a roughly even chance (low).

Business and commodity impact

Panama. The USGS PAGER model put possible losses at 3% to 30% of GDP. That is a model range, not a damage count.
Panama Canal. Operating normally. It is the main exposure if damage spreads to operating assets.
Brazil. A MercoPress headline reported São Paulo stocks up 8% after the first round. A runoff loss by Flávio Bolsonaro would reverse that move.

Framing vs. primary data

Strike toll. The tallies above diverge by cutoff and method, and no primary cumulative figure was published.
Quebec. BBC says the party "secured a minority". Al Jazeera says a majority was "not yet clear".

Space & Arctic #

Bottom line: Sourced news this week was diplomatic and institutional, led by Rubio's Iceland visit, detail on the Greenland pact and an EU collective space-defence framework. Counterspace and GNSS threats rose in rhetoric and analysis but not in observed effects.

Developments

Iceland. Secretary of State Rubio arrived in Iceland late on 2026-10-05 at the start of a three-nation tour. He said the US would not do anything in Iceland without Iceland's consent and was open to talks on the former Keflavik presence. confirmed (AP via Yahoo)
Greenland pact. El País reports the US-Denmark-Greenland agreement:
- envisions a defence area covering Narsarsuaq and Mestersvig;
- bars non-NATO military installations without the consent of all three parties;
- commits Greenland to remain in NATO if it becomes independent.
- reported (El País; NBC)
US on-orbit weapons. Air Force Secretary Troy Meink said the US has fielded "on-orbit space control weapons", with no system details. AP says the type remains unclear. confirmed (OC Register/AP)
RUSI on Russian counterspace. A RUSI study says Russia has strong incentives to develop nuclear and electronic-warfare capabilities against US satellites. reported (SpaceNews)
EU space framework. EU Council Decision 2026/2195 gives the EU a collective response framework for threats to satellites. reported (Breaking Defense)
Arctic shipping and the Northern Fleet. The sanctioned Chinese heavy-lift carrier Ya Qing Hai Yang, used for Arctic LNG 2 shipments, is anchored near Norway's border with Russia, with apparently distorted tracking data. A CSTO delegation visited the Northern Fleet from 2026-10-05 to 10-07. unconfirmed (single source; Barents Observer)
Shahed navigation. Russia is fitting Shahed drones with 32-element anti-jam satellite-navigation antennas, replacing 16-element versions. unconfirmed (single source; NV)

Context and baseline

Iceland. The US kept a permanent military presence in Iceland until 2006 (AP).
Satellites. About 16,810 functioning satellites are in orbit today, against 128 at the end of 1967 (Jonathan McDowell via AP).
ASAT and GNSS. No destructive ASAT test or proximity operation was reported. No sourced GNSS jamming in the Gulf, Baltic or Black Sea was reported this week.

Third-party analysis

Victoria Samson (Secure World Foundation; peaceful-use advocacy) says the weapons "could be non-kinetic weapons such as jammers", and that talks stall on defining a space weapon.
Clayton Swope (CSIS) calls the EU framework a step toward "deterring space threats" that adds no new military capability.
Burak Oktenli (Eurasia Review) argues the real crisis risk is ambiguity during a satellite outage. (Eurasia Review)
Jessica West (Project Ploughshares) and Michelle Hanlon (University of Mississippi) call the Outer Space Treaty's silence on conventional weapons a gap.
Where the evidence points: the evidence supports "type unknown". The non-kinetic reading rests on one analyst's inference.

Assessment

The US on-orbit weapon is likely non-kinetic (low confidence; thinner support than before).
A destructive Russian or Chinese ASAT test in Q4 is very unlikely (moderate).
Arctic militarisation through Q4 is almost certain (moderate).

Business and commodity impact

Greenland. The pact's bar on non-NATO control of sensitive sectors, including resource extraction, weighs on Chinese-linked mining interest.
Arctic LNG 2. Continued sanctioned heavy-lift activity raises compliance risk for Arctic LNG 2 logistics. The magnitude is unknown.

Framing vs. primary data

Weapons deployment. A headline said "U.S. announces space weapons deployment", but Meink gave no system details.
The Sun. A Sun headline again names Putin for the "full-scale space war" threat, and the speaker remains unverified.

Cross-cutting: commodities and markets #

Driver	Affected market	Direction	Magnitude or evidence	Horizon
Hormuz tanker attacks (12 in a week)	Dated Brent, physical crude	Up	$136 Dated against $104 ICE (2026-10-08)	Weeks
Gulf war risk	VLCC freight	Up	Above $1.4M/day Gulf-East Asia, +40% in a week	Weeks
Hurricane Isaias	US Gulf crude, gas, refining	Supply down	1.46M b/d (71.5%) shut in; 500,000 b/d refining in path	Days to weeks
Product shortfall; Russian diesel ban	Diesel	Up, then capped	US $6.28/gal; GL 135 adds 300,000 t now	Weeks to months
Gulf LNG disruption, low storage	European gas (TTF)	Up	€78 to €80, against €71.90 on 2026-10-02	Winter
Houthi strikes on Riyadh	Gulf aviation, events insurance	Up (cost)	Flight suspensions to mid-October	Weeks
US Iran sanctions (22 tankers)	Iranian exports	Marginal	173 Iran-linked tankers remain unsanctioned	Months
EU 22nd package	Russian defence-industrial imports	Down	About 1,570 to 1,700 listings	Months
Ethiopia-Eritrea crisis	Horn and Red Sea routing	Risk up	Not quantified	Months
Panama quake	Panama economy; canal	Down; canal flat	PAGER 3% to 30% of GDP (model); canal normal	Months

Framing checks #

Hormuz. "Gulf flows back above pre-war" headlines rest on September all-route averages and peak days. Hormuz-only crude was 10.3M b/d in the week ended 2026-10-03, against 13.5M pre-war (Kpler). The difference is the bypass routes and the time window.
Russian diesel. Headlines speak of "millions of tons". The first tranches total 800,000 t, against US demand of about 16M t a month. The deal's significance lies in sanctions policy, not supply.
Ukrainian refinery claim. The "51% of refining capacity" figure has no published method. Plant-level facts (Volgograd offline, Omsk hit) are confirmed.
Bab el-Mandeb. Headlines said "retakes" and "cleared", repeating the government and a Saudi envoy. Times of Israel and ISW say the waterway is not secured.
Ban Keun. "Light attack jets" against "basic trainers": same imagery, different interpretation.
Boat-strike toll. Tallies run from 221 to 238 dead depending on cutoff and counting basis.
Shadow fleet. Treasury says "the vast majority" of the shadow fleet is neutralized. TankerTrackers.com counts 173 Iran-linked tankers outside sanctions.

Sources #

Middle East: Middle East Eye, Riyadh · Al-Monitor, Riyadh · ISW 10-05 · ISW 10-07 · ISW 10-09 · ISW 10-10 · Times of Israel, airport · Times of Israel, Bab el-Mandeb · Haaretz/Reuters, deployment · Middle East Eye, Yanbu · Al-Monitor/Reuters, Bab el-Mandeb · Maritime Executive, IRGC · UKMTO 162 · Middle East Eye, anchorages · Press TV · DVIDS · US News/Reuters, blockade · Al-Monitor/Reuters, midterms · Al-Monitor, enrichment explainer · Asharq Al-Awsat · The Japan Times · Haaretz, IDF · Haaretz, Bar'el · Middle East Eye, Lebanon toll · Al-Monitor/Reuters, Hezbollah · Responsible Statecraft, Hormuz · Responsible Statecraft, NPT · War on the Rocks

Commodities: Maritime Executive, transits · Maritime Executive, prices · gCaptain/Reuters, attacks · OilPrice.com, tanker rates · gCaptain, diesel deal · OFAC · Kyiv Independent, Russian ban · OilPrice.com, Isaias · gCaptain/Bloomberg, refining · gCaptain, 22 tankers · Al-Monitor/Reuters, sanctions · HSN, IEA · HSN, G7 · OilPrice.com, China exports · HSN, TTF up · HSN, TTF down · OilPrice.com, EU storage · OilPrice.com, Aramco · Splash247, Japan · HSN, Sovcomflot · HSN/CNBC, Hormuz · gCaptain/Reuters, Gulf flows · OilPrice.com, Energy Aspects · OilPrice.com, Vitol · HSN, Vitol · OilPrice.com, Kpler toll · HSN, Goldman · HSN, UBS

Africa: Al Jazeera, Mekelle · The Africa Report, Mekelle · US News/Reuters, letter · Al Jazeera, Eritrea · Al Jazeera, Adigrat witnesses · Yahoo/Euronews · US News/Reuters, drones · Al Jazeera, declaration · Hiiraan, Alamein · Hiiraan, Egypt-Somalia · Dabanga · BBC, Blue Nile · Sudan War Monitor · AP, Kidal · RFI, Kidal · RFI, Sahel displacement · Al Jazeera, Ebola · Premium Times, Kenya · US News/Reuters, AU · Jeune Afrique · Premium Times, crash · The New Humanitarian · Horn Review · Horn Review, crisis · The Africa Report, Assab · The Conversation

Indo-Pacific: USNI News · Yahoo/AFP · ISW China-Taiwan 10-09 · ISW China-Taiwan 10-06 · ISW Korea 10-07 · US News/Reuters, Laos · The Diplomat, Suorsa · The Diplomat, Lin · Lowy Interpreter · US News/Reuters, militia boat · The Straits Times, US reaction · Taiwan News · NK News · The Straits Times, mine

Cyber: NCSC UK · CyberScoop, seizures · The Hacker News, KEV · BleepingComputer, ARTEX · The Record, Korea · CyberScoop, FortiBleed · The Record, Hafnium · gCaptain, Prosperity · BleepingComputer, ccTLD · BleepingComputer, Qilin · BleepingComputer, Denmark · BleepingComputer, IDCF · The Record, UAC-0099 · The Hacker News, UAC-0099 · CyberScoop, NetScaler

Americas: CBS News · BBC, Maduro · Al Jazeera, Maduro · The Rio Times, Brazil · BBC, Brazil · Folha, Amorim · The Rio Times, Eduardo Bolsonaro · MercoPress, quake · The Rio Times, Panama aid · Al Jazeera, Quebec · BBC, Quebec · The Rio Times, Ecuador · CiberCuba, Corsair · Folha, Haiti · InSight Crime · Latin American Post · Air & Space Forces

Space & Arctic: AP via Yahoo, Iceland · El País · NBC · OC Register/AP · SpaceNews · Breaking Defense · Barents Observer · NV · Eurasia Review

How this was made: methodology and limits.