October 23, 2026

Day in review: Brazil’s tightening race, Europe’s heat toll and global disruptions

1. Lula closes gap on Flávio Bolsonaro before Brazil’s runoff

   What happened

   New polling put Brazil’s presidential runoff between incumbent Luiz Inácio Lula da Silva and Senator Flávio Bolsonaro almost level. The polls show Lula narrowing the lead Bolsonaro held in earlier second-round surveys.

   What changed today

   • Ipespe/Abrapel put Bolsonaro at 50.5% and Lula at 49.5% of valid-vote intentions.
   • Datafolha’s polling sequence moved from a Bolsonaro lead to a 50%–50% tie.

   What is confirmed

   • Confirmed Brazil’s presidential runoff between incumbent Luiz Inácio Lula da Silva and Senator Flávio Bolsonaro is scheduled for October 25, 2026.

   Unknown or disputed

   • Who will win the October 25 runoff?
   • Will the polling movement result in Lula overtaking Bolsonaro before voting?
   • What will the final polling estimates show?

2. PHP flaws force online services offline as hacking attempts reach millions

   What happened

   Two critical PHP flaws prompted service suspensions and urgent patching as Cloudflare reported a rapid surge in exploitation attempts. Amazon said its honeypots recorded an attempt before the vulnerability details became public.

   What changed today

   • Cloudflare CEO Matthew Prince described attempts climbing from thousands to millions.
   • Amazon’s threat intelligence team said it logged an attempt on October 17.
   • Some Japanese companies and government agencies temporarily suspended online services.

   What is confirmed

   • Confirmed Researchers at Calif and Wiz used AI tools in their security work to identify the flaws, which sources say had remained in the software for years.
   • Statement by Matthew Prince, Cloudflare CEO Matthew Prince said Cloudflare saw thousands of exploit attempts in the 10 hours before public disclosure, tens of thousands in the following 45 minutes, hundreds of thousands within two hours and millions by the time of his post.
   • Statement by Amazon's threat intelligence team Amazon's threat intelligence team logged an exploitation attempt against its MadPot honeypots on 17 October, before the vulnerability details became public.
   • Confirmed In Japan, operators including Nomura, Mitsubishi UFJ Financial Group, ANA and East Japan Railway temporarily suspended some online services; several government agencies also restricted services.

   Unknown or disputed

   • How many systems were vulnerable or successfully compromised, and who was behind the attempts?
   • Did any named organisation suffer a breach?
   • When were patches available? Reports give conflicting accounts of the release timeline.

3. Europe’s summer heat killed an estimated 50,000 in cities, researchers find

   What happened

   Researchers estimated that heat killed 50,391 people across 854 European urban areas during summer 2026. Their analysis attributed about 65% of those deaths to human-caused warming.

   What changed today

   • The estimate was 71% higher than the previous peak in the analysis, recorded in 2022.
   • Researchers said about one-third of the estimated deaths occurred between June 17 and July 1.

   Unknown or disputed

   • What is the estimate’s uncertainty range, and how many deaths occurred across Europe beyond the urban areas studied?
   • How many additional deaths resulted from the May heatwave excluded from the estimate?

4. Ucayali expects up to 230,000 for Pope Leo XIV’s visit, governor says

   What happened

   Pope Leo XIV is scheduled to visit Pucallpa in Peru’s Ucayali region on November 15. Governor Manuel Gambini said as many as 230,000 people could mobilize for the visit and that lodging was fully booked.

   What changed today

   • The reported itinerary places a Mass at the Ucayali Villa Deportiva and meetings with missionaries and representatives of Amazonian peoples in Pucallpa.
   • Gambini gave crowd estimates for the Mass venue, nearby areas and Boulevard de Yarinacocha.
   • The governor proposed opening schools to visitors needing somewhere to camp.

   What is confirmed

   • Statement by Manuel Gambini, governor of Ucayali Gambini said that up to 230,000 people were expected to mobilize in the region for the Pope’s visit.
   • Statement by Manuel Gambini, governor of Ucayali Gambini said the Mass venue would receive 150,000 people, the surrounding area up to 200,000, and Boulevard de Yarinacocha another 35,000, exclusively Indigenous people.

   Unknown or disputed

   • How many people will actually attend the events in Ucayali?
   • Will the proposal to let visitors camp in schools be approved?
   • Will the Indigenous welcome programme change before the visit?

5. Storm Austen forces French rail suspensions as Ireland and UK face disruption

   What happened

   Storm Austen brought heavy rain and travel disruption to Ireland, while warnings covered parts of the United Kingdom and France. Rail suspensions were prepared in France for Friday, October 23.

   What changed today

   • Met Éireann named Austen as the first named storm of the 2026–2027 season.
   • Orange rain and wind alerts covered parts of Ireland and France.
   • Some UK schools closed or delayed opening, and ferry sailings were cancelled.

   Unknown or disputed

   • What was the final extent of storm-related damage, flooding, injuries or power outages?
   • When will all suspended rail services resume after weather and safety checks?

6. India sets deadline to tie WhatsApp accounts to active SIMs

   What happened

   India’s Department of Telecommunications gave messaging platforms until December 31 to meet SIM-binding requirements, which are expected to apply from January 1, 2027. The rules require a registered Indian mobile number to be linked to an active SIM or eSIM on the device.

   What changed today

   • The government said the measure aims to curb cyber fraud and misuse of Indian mobile numbers.
   • Reports say removing or deactivating a registered SIM could interrupt access or lead to account suspension.

   What is confirmed

   • Confirmed The DoT set 31 December 2026 as the compliance deadline for messaging platforms to implement SIM-binding requirements, which are expected to apply from 1 January 2027.
   • Confirmed Under the requirements, an app using an Indian mobile number for registration must verify that the number is linked to an active SIM or eSIM present on the device.
   • Statement by The Department of Telecommunications (DoT) / the government The stated aim of SIM binding is to curb cyber fraud and the misuse of Indian mobile numbers.
   • Statement by The DoT The DoT says fraud networks have used Indian SIM cards to register messaging accounts and then operated those accounts from outside India.

   Unknown or disputed

   • What will verification mean in practice for linked devices and secondary phones?
   • Will Signal be covered? Reports disagree, and the final scope for Signal and Snapchat is unconfirmed.
   • Has a final formal order or notification been published?