Daily Briefing | 23 October 2026: Escalating conflict in the Middle East pushes Brent crude above US$110; Meta’s shift to negative cash flow sparks concerns over AI funding

Automatically translated. Read the Chinese original.

Today's main theme

On 22 October, both the energy and technology sectors came under pressure simultaneously. In the Middle East, *The New York Times* reported that the US and Israel had drawn up plans to resume air strikes against Iran following the US mid-term elections; the Iranian Revolutionary Guard claimed that several vessels in the Persian Gulf had been struck or hit by mines; and the Houthi rebels launched another attack on Dammam Airport in Saudi Arabia. Brent crude rose to a high not seen in over five months, closing at around US$113 per barrel. On the technology front, Meta reported negative quarterly free cash flow for the first time in over a decade, fuelling market concerns that AI infrastructure is being sustained by debt and share issues; the Nasdaq fell 2.6 per cent on the day, whilst the Philadelphia Semiconductor Index dropped 6.7 per cent. Funds were withdrawn from technology stocks and redirected towards defensive sectors such as US Treasuries and consumer staples, with the yield on 10-year US Treasuries falling back to around 5 per cent. Separately, two high-risk vulnerabilities in PHP that allow remote code execution were disclosed, one of which was discovered with the assistance of AI; China’s National Development and Reform Commission (NDRC) issued a new version of the ‘Measures for the Administration of Outward Investment’; and following Russia’s agreement to resume negotiations, large-scale mutual attacks broke out between Russia and Ukraine that same evening.

Key News

1. The US is reportedly planning to resume air strikes against Iran following the mid-term elections; attacks in the Gulf have pushed Brent crude to a five-month high

The New York Times, citing US officials, reported that the US and Israeli militaries have drawn up plans to resume strikes against Iran following the US mid-term elections on 3 November. The operation has been described as “short and intense”, with targets likely to include energy facilities, nuclear facilities, and stockpiles of missiles and drones. On the same day, the Iranian Revolutionary Guard Corps Navy stated that four vessels involved in “illegal oil transfers” in the northern Persian Gulf had been struck and set alight, whilst three other vessels had struck mines west of the Strait of Hormuz; it warned that it would launch a wider-ranging response against US bases in the region. In Saudi Arabia, the authorities attributed the attack on King Fahd International Airport in Dammam to the Houthi rebels; the attack left two people dead and eight injured. Saudi Arabia also reported that an Aramco oil field had come under attack. US State Department spokesperson Pigott stated that the non-essential personnel evacuation order issued the previous day applied only to Saudi Arabia, citing an increase in attacks by the Houthi rebels on civilian targets.

Oil prices rose sharply on the day. During the Asian trading session, Brent crude rose by around 2.5 per cent to US$111.5, climbing to around US$113 before the close—an increase of approximately 4 per cent and its highest level in more than five months; WTI rose by around 2.3 per cent to around US$99.4. Since the outbreak of the conflict in Iran in late February, Brent has risen by more than 50 per cent in total. Key points to watch going forward include whether the US will publicly respond to reports of airstrike plans, the passage of vessels through the Strait of Hormuz and insurance premiums, as well as whether the Houthi rebels will continue to target Saudi airports and oil fields.

Source:CNBC Africa、Just Security News Round-up (including links to reports from Reuters, the BBC and The Wall Street Journal)、Investing.com Market Close Review

2. Meta is ‘burning through cash’ for the first time in over a decade, bringing the issue of funding for AI infrastructure to the fore

Meta’s third-quarter results, released the previous day, showed that capital expenditure for the quarter was close to US$35 billion, whilst free cash flow stood at a negative US$2.12 billion, compared with a positive US$10.63 billion a year earlier. According to Reuters, this marks the first time in over a decade that Meta has recorded a quarterly net cash outflow. The company has also raised the lower end of its 2026 capital expenditure guidance from US$130 billion to US$135 billion, and plans to issue non-voting Class C shares to fund its AI investments. On 22 October, Meta’s share price fell by approximately 7 per cent – its steepest decline since July – whilst the price of its credit default swaps (CDS) hit a record high.

The sell-off quickly spread across the entire AI sector. Lam Research fell by around 12 per cent following its earnings report, Nvidia dropped by around 4 per cent, and the Philadelphia Semiconductor Index fell by 6.7 per cent, with chip stocks recording their worst single-day performance since late June. Emerging cloud service providers were hit even harder: CoreWeave fell by around 10 per cent, with yields on its unsecured bonds having already risen to 15 per cent the previous week; Nebius fell by around 7 per cent despite announcing a $3.5 billion credit facility from Citigroup. Analysts at Bank of America believe CoreWeave requires approximately US$20 billion in funding to fulfil its customer contracts. Matthew Maley of Miller Tabak stated that the core question for the market is the return on these investments, noting that returns may materialise more slowly than expected; he also pointed out that large companies have no shortage of financing channels, and that the real pressure lies with small and medium-sized AI firms.

The significance of this development lies in the fact that market focus has shifted from ‘how much is being invested in AI’ to ‘who is funding it and at what cost’. With US Treasury yields still hovering around 5 per cent, the model of expanding computing power through debt and equity financing will come under closer scrutiny. Key points to watch: capital expenditure guidance in next week’s earnings reports from Microsoft, Alphabet and Amazon, as well as refinancing developments at companies such as CoreWeave.

Source:Reuters (reprinted by Investing.com)

3. Two high-severity vulnerabilities in PHP that allow remote code execution have been disclosed; AI played a part in their discovery

The PHP team released a security update on 21 October, addressing two vulnerabilities: CVE-2026-109618 and CVE-2026-109619. Both are classified as ‘Critical’, with a CVSS v4.0 score of 9.2; an attacker could execute code remotely on the server without needing to log in. The former relates to the incomplete initialisation of request data when memory is insufficient, whilst the latter relates to the misuse of a released request state by the subsequent request. Deployment methods such as PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed are all affected, with mod_php posing the highest risk; the PHP team has demonstrated an exploit that can be triggered before application code executes. The official recommendation is to upgrade to versions 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and it is stated that temporary mitigation measures can only reduce the risk; they do not provide complete protection.

On the same day, OpenAI disclosed that the security firm Calif had discovered one of the vulnerabilities using its GPT-5.6 Sol model, whilst Wiz had independently discovered and reported two others; the relevant fixes were led by PHP maintainers, following approximately two months of prior coordination. According to the BBC, the Finnish government temporarily shut down some online services at one point, whilst Edinburgh City Council and the BBC also took some pages offline to apply patches. PHP underpins a vast number of websites and content management systems; this incident demonstrates that AI has begun to play a practical role in vulnerability discovery, which may consequently narrow the time gap between attackers and defenders. Points to watch: whether the vulnerabilities will be exploited on a large scale in the wild, and how users of older, end-of-life PHP versions will manage the situation.

Source:Official PHP Security Advisory、OpenAI

4. The National Development and Reform Commission has issued a new version of the ‘Measures for the Administration of Outward Investment’, which will come into force on 1 December.

On 22 October, the National Development and Reform Commission published the ‘Measures for the Administration of Outward Investment’, comprising six chapters and 76 articles, divided into General Provisions, Guidance and Services for Outward Investment, Supervision of Outward Investment, Protection of Outward Investment, Legal Liability and Supplementary Provisions. The Measures shall come into force on 1 December 2026, The “Measures for the Administration of Overseas Investment by Enterprises”, issued in 2017, are repealed simultaneously. The new Measures define the scope of investors as domestic enterprises, other organisations and resident individuals, and support the conduct of outward investment in accordance with market principles; investors may continue to invest in overseas financial markets through channels such as QDII, Stock Connect and the Cross-Border Wealth Management Connect.

With regard to the protection of rights and interests, the Measures have refined the reporting system for material adverse events and established an annual reporting system for outbound investment information, in response to discriminatory measures imposed by certain countries and regions requiring Chinese enterprises to provide technology, data or dispose of equity interests and assets. With regard to risk prevention, the Measures refine the reporting system for overseas reinvestment and establish a reporting system on preliminary work for projects involving substantial sums or those affecting bilateral diplomatic relations.

This document has been issued against the backdrop of Chinese enterprises accelerating their expansion into overseas markets, whilst some countries are tightening their scrutiny of Chinese investment. The new regulations provide institutional support for enterprises expanding overseas, whilst also strengthening prior oversight of large-scale and sensitive projects; they will have a significant impact on sectors with extensive overseas operations, such as new energy, automotive and mining. Key points to watch: the specific operational guidelines for approval and filing procedures; whether the catalogue of sensitive projects will be adjusted; and the supporting regulations to be issued by the Ministry of Commerce and the State Administration of Foreign Exchange.

Source:21 Economic Network (reprinted from CCTV News)

5. Just hours after the Russian side agreed to resume negotiations, large-scale attacks broke out between Russia and Ukraine

Kremlin adviser Ushakov stated on 21 October that, following Putin’s meeting with US Special Envoy Witkov in St Petersburg, Putin had agreed in principle to resume trilateral talks between Russia, the US and Ukraine after 10 November; this would be the first round of US-mediated negotiations since February. Zelenskyy expressed his support, though he remained cautious, saying, “Let’s see how this goes.” However, that same evening, Russian forces launched 21 ballistic missiles at Kyiv in three waves and deployed drones, resulting in one death and 22 injuries. At least four people were killed across Ukraine, including two who died when a market in Lozova, Kharkiv Oblast, was struck. The Russian Ministry of Defence claimed to have shot down 808 Ukrainian drones overnight, whilst Moscow Mayor Sobyanin stated that 630 of them were heading towards the capital; as a result, flights to and from Moscow’s airports were temporarily restricted.

The fact that negotiations are taking place alongside large-scale air strikes suggests that both sides are stepping up military pressure ahead of the talks in order to secure a more favourable negotiating position. From a market perspective, the Russia-Ukraine negotiations could ease the risk premium on European energy and refined oil products; however, until a ceasefire framework is finalised, such expectations of an easing remain uncertain. Key points to watch: the specific date and venue of the trilateral talks; whether an agreement on a mutual moratorium on strikes against energy infrastructure can be reached first; and whether air traffic and refineries around Moscow will continue to be affected.

Source:Associated Press (reprinted by ClickOnDetroit)、Associated Press (reprinted by Arab News)

Market Correlation and Today's Observation

On 22 October, US equities exhibited a typical flight-to-safety trend: the S&P 500 fell 1.2 per cent to 7,664.99 points, the Nasdaq dropped 2.6 per cent to 26,008.86 points—its worst performance since 5 June—whilst the Dow Jones Industrial Average remained largely unchanged; During the session, the consumer staples and healthcare sectors performed strongly, whilst the technology sector fell by nearly 3 per cent. Funds flowed into US Treasuries, with the 10-year yield falling by around 12 basis points at one point to dip below 5 per cent, having stood at around 5.13 per cent the previous day; Gold fell by approximately 2 per cent, whilst Bitcoin dipped below US$82,000. Initial jobless claims for the week fell to 194,000, a three-month low, indicating that the labour market remains stable; the recent decline was driven more by AI funding and geopolitical risks than by weakening economic data.

Looking at several news stories from today in conjunction: whilst the situation in the Middle East has pushed up oil prices—which should have boosted inflation expectations and yields—US Treasury yields have instead fallen sharply. This suggests that the market is currently more concerned about the valuations of risk assets and financing pressures than about inflation. For the AI industry chain, the combined effects of high oil prices, high interest rates and uncertainty regarding returns on capital expenditure are placing the greatest pressure on emerging cloud service providers and semiconductor equipment stocks, which carry higher levels of debt. China’s revised regulations on outbound investment and the Russia-Ukraine negotiations, meanwhile, represent medium-term variables with limited short-term impact on the market.

Checklist:

• Official responses from the US or Israel to reports of ‘air strikes resuming after the election’, as well as shipping in the Strait of Hormuz and oil tanker insurance premiums
• Will Brent hold steady at $110, and will the yield on 10-year US Treasuries continue to fall back below 5 per cent?
• Capital expenditure and AI revenue figures in next week’s earnings reports from Microsoft, Alphabet and Amazon, as well as trends in yields on Meta CDS and CoreWeave bonds
• Interest rate forecasts ahead of the Federal Reserve’s monetary policy meeting on 28 October
• Supplementary Rules to the ‘Measures for the Administration of Outward Investment’
• Will the trilateral talks between Russia, the US and Ukraine take place as scheduled after 10 November?

Source:Investing.com Market Close Review、Benzinga、Yahoo Finance

Cover image:Anatoly Maltsev / Unsplash