Information War Weekly Roundup: Starlink, PHP Flaws, SafePay

This information war weekly roundup covers the five Information War daily reports Peter’s World published from Oct. 18 to Oct. 24, 2026. No Information War edition ran on Oct. 21, Oct. 22 or Oct. 25. The roundup gathers the week’s main threads, then adds our analysis. Each fact appears once, with its source, and the full daily list is at the end.

The week in brief

Starlink: one service, four accounts

The week’s longest-running dispute was over Ukraine’s satellite internet. Secretary of State Marco Rubio said on Oct. 17 that no one at the White House ordered Ukraine’s Starlink service slowed, according to the State Department transcript. Two days later he said Ukraine has benefited from Starshield, the military version he had said it lacked, according to a second transcript. President Trump then said Elon Musk “put it back,” Ukrainska Pravda reported, while Kyiv called reports of restored speeds false. Six Democratic lawmakers sent Musk five questions on the limits and asked for answers by Oct. 31, The Kyiv Independent reported.

Hybrid attacks on infrastructure

Lithuania’s prime minister said a forewarned company foiled an arson attempt on its Starlink equipment store. A drone that exploded in Lithuanian airspace remains unattributed after Poland’s Defense Ministry said its radar did not confirm the object crossing from Poland, The Kyiv Independent reported. Data centers became targets on both sides of the war. A Russian missile strike destroyed the Kyiv data center of telecoms operator Datagroup, and Russian tech firm VK said a drone hit its Leningrad Region data center without disrupting services, according to TASS. No one could independently check VK’s account.

State claims that could not be verified

Russia’s foreign intelligence service accused Kyiv of training at least 80 Mexican cartel fighters as drone operators, a claim reported by TASS that no US agency has confirmed. On the Iran war, Trump said Iran is faking hits in the Strait of Hormuz, while Iran’s Revolutionary Guards said seven ships were hit without naming their flags, Al Jazeera reported. Trump also said Russia “has been fine on Ukraine” on the day a Russian drone killed six people in a Kharkiv-region park, The Kyiv Independent reported.

Elections and AI fakes

Two senior Democrats said after a classified briefing that Russia is targeting pro-Ukraine midterm candidates with AI-boosted disinformation. Taiwan’s National Security Bureau said Chinese election interference has become more targeted before November local elections, Focus Taiwan reported. Fact-checkers at Full Fact found an AI-generated video of flags atop the Eiffel Tower among fakes shared during France’s riots.

Cyber operations and warnings

Researchers said Russian military intelligence hackers breached defense firms in two NATO countries, including a naval shipbuilder, between July and September, The Record reported. Iranian state-linked hackers used a US server to target dissidents, researchers told Iran International, and North Korea’s internet likely faced a 32-hour denial-of-service attack, a network monitoring firm said.

In the United States, the FBI urged urgent patching of two PHP flaws, and the Cybersecurity and Infrastructure Security Agency (CISA) added an exploited Collabora flaw to its catalog. The Department of Homeland Security ordered DeepSeek products removed from federal civilian systems.

Internet freedom and public influence

Freedom House said internet freedom fell for a 16th straight year, worsening in 16 of 38 countries, with Iran declining most. Rubio publicly urged Cubans to work with the CIA, and Cuba’s deputy foreign minister mocked the appeal as public recruitment, Al Jazeera reported.

What changed this week

Analysis (Peter’s World’s view): The information war turned inward on the Western side. The sharpest contradictions of the week were not between Moscow and Kyiv but among Washington, Kyiv and a private company over who controls Ukraine’s communications. Meanwhile, physical attacks on the digital layer spread. Data centers in Kyiv and near St. Petersburg were hit, and a Starlink depot in Lithuania was targeted.

Why it matters

Analysis (Peter’s World’s view): When official accounts conflict, every side’s claim becomes easier to doubt, including accurate ones. That helps actors who rely on confusion, such as unverified intelligence claims and unnamed “hit” ships. With US midterms and Taiwan’s local elections both due in November, the reported AI-boosted campaigns put election offices and platforms under pressure to label or remove fakes quickly.

What to watch next week

Oct. 31: The deadline lawmakers set for Musk’s answers on Starlink.
Nov. 3: US midterms. Watch for official attributions of foreign influence campaigns.
Whether Lithuania or NATO attributes the drone and the arson attempt.
Further exploitation of the PHP and Collabora flaws, and new CISA catalog entries.

This week’s daily reports

For every report in this theater, see the Information War news hub or the War Room dashboard.

Sources

Additional sources

CISA: CISA, FBI and partners warn organizations about SafePay ransomware actors
U.S. Department of State: Statement on the fourth U.S.-Singapore Cyber Dialogue
U.S. Department of State: Imposing sanctions to protect Americans from intellectual property theft
Focus Taiwan: Over half blame CCP for undermining cross-strait ties
Iran International: Iran speaker urges Persian Gulf states to stop backing AI firms
Global Times: US-Japan Keen Sword 27 drills to begin amid protests

Information War Weekly Roundup: Starlink, PHP Flaws, Ransomware