Washington moved closer to Moscow, a peace track opened anyway, and Ukraine answered with the deepest strikes of the war. In the Gulf, oil climbed toward a deadline that had not passed when the week ended.
The week began with the United States openly easing pressure on Russia. Trump exempted Russia from a congressionally passed sanctions law, and Rubio confirmed a 60-day review before any new penalties apply (NYT, Monday). On Tuesday Trump called Russia’s conduct in Ukraine “fine”, and Ukraine said it was receiving 12 Patriots a month, down from 48 (Kyiv Independent, Tuesday). Kyiv stopped hiding the rift. On Wednesday Kallas said US negotiators had pushed Ukraine toward capitulation for 18 months, and Zelensky’s trust rating rose from 43% to 57% in a week (Kyiv Independent, Wednesday).
Diplomacy continued anyway, and Oslo was at the centre of it. Støre and Stubb hosted Zelensky. Witkoff went from Oslo to Putin and back again, and by Thursday Russia had agreed to team-level trilateral talks in early November, probably in Abu Dhabi. Zelensky accepted a ceasefire along the current front line (United24, Thursday). The agreement was thin. By Friday Peskov had confirmed that Putin presented no peace proposal and had not formed a delegation. The concessions went one way: the US reportedly offered to restart Nord Stream, and the first Russian diesel cargo under the new commercial deal was heading for New York (ISW, Friday; TVP World, Saturday). The only concrete result was a local ceasefire for Oleshky, brokered by Melania Trump. Moscow and Washington gave it different start dates, 27 and 29 October (Reuters).
The Starlink story changed every day, and the account by the end of the week was not consistent. On Wednesday the WSJ reported that Musk personally ordered the throttling (WSJ). On Friday Trump said access was restored, and Kyiv denied it. On Saturday Reuters reported that the US government had asked SpaceX for years to alter service in Ukraine (Reuters). On Sunday full speeds returned after more than ten days, and Musk took the blame himself, citing breaches of the terms of use, which Kyiv denies (AP, Sunday). The coverage does not settle who decided. The episode had one clear effect: Ukraine began to reduce its dependence on Starlink, including more than €300M in Finnish agreements on sovereign satellite communications (ICEYE).
On the battlefield Ukraine was moving forward. Its strike range grew through the week: more than 1,000 drones on Sunday 18 October, all four Moscow airports closed overnight on 22–23 October, and Omsk, about 2,500 km away, by the weekend. A strike on the Taman substation blacked out Crimea (Militarnyi, Kyiv Independent). Rosneft admitted that refinery losses were becoming unsustainable, and ISW counts a net Russian loss of 241 km² since 1 September (Kyiv Independent). Russia struck Kyiv almost every night, including within hours of agreeing “in principle” to talks (BBC). In the Gulf, Brent rose from $110 on Monday to $112 on Friday and $117 on Saturday. During the same week a third US carrier deployed, US diplomats were ordered out of Saudi Arabia, and Iran declared the Gulf closed to the US Navy. On Sunday the talks collapsed and Trump hinted at “a strike or a deal” that day (Al Jazeera). The record ends before that deadline.
For self-hosters, the week had a pattern too. Plex was exploited in the wild on Tuesday, and PHP2Shell, the first finding from OpenAI’s Patch the Planet initiative, followed on Thursday. A counter-analysis argues that it is not a Log4Shell moment (Elias Taylor). Two separate breaches targeted AI-provider API keys: the trojanized LiteLLM 1.107.0 and Railway’s CI compromise (Aikido, Railway). Attackers now treat LLM API keys as valuable loot in their own right.
Running storylines
Posed this week:
cd /home/jbe/repos/josse-posten && claude --resume c44667b1-1025-48f1-828d-395d17484627