· · · ·

Information War Update Oct 27, 2026: Doppelgänger Hits Three Elections

Information war: a Russian network targets Israeli, US and French voters, Israel removes election networks and CISA flags two PHP flaws.

ByPeter
Map for the Oct 27, 2026 Information War update marking Moscow, Jerusalem, Paris and Washington
Places named in this report, Oct 26–27, 2026; numbers match the footnotes. Markers show where claims or incidents were reported. Map: Peter's World; data: Natural Earth

Information War · at a glance

  • 4fronts covered
  • 45cited sources

Key Takeaways: 5 things to know

  1. A Russian network targeted Israel, US and French voters at once, with about 150,000 posts in three days, Alethea found (see Doppelgänger Campaign).
  2. Israel’s police removed two election networks on X and Facebook before the October 27 vote (see Israel Election).
  3. Yashar! said forged messages were sent in its name and asked the Central Elections Committee to investigate (see Israel Election).
  4. AI search tools repeated the Talarico deepfake claim before fact-checks, according to the Foundation for Defense of Democracies (see US Midterms).
  5. The US cyber defense agency listed two web-server software flaws as actively exploited, giving federal agencies until October 29 to patch (see Cyber Front).
Report detailsDetails
  • A Russian network targets Israeli, US and French voters, Israel’s police remove election networks and CISA flags two exploited PHP flaws.
Map for the Oct 27, 2026 Information War update marking Moscow, Jerusalem, Paris and Washington
Places named in this report, Oct 26–27, 2026; numbers match the footnotes. Markers show where claims or incidents were reported. Map: Peter’s World; data: Natural Earth

This information war update for October 27, 2026, covers a Russian influence network aimed at three elections, election-eve forgeries and takedowns in Israel, new detail on the Talarico deepfake and federal cyber warnings.[1] It follows the October 26 information war update, and the War Room, Middle East war update and Information War News Hub give context.

Doppelgänger Campaign

A Russian influence operation known as Doppelgänger targeted elections in Israel, the United States and France at the same time, according to a study by the intelligence firm Alethea published October 26.[15] Between October 7 and 9, more than 50 fake accounts on X posted coordinated messages in three waves, and more than 1,000 other accounts amplified them through about 150,000 quote-posts. Alethea attributed the operation with high confidence to two Russian entities, Social Design Agency and Structura.

The operators built clone sites that copied the Israeli outlet Walla! and the French papers Le Parisien and Le Point, on domains registered in May 2025 that sat dormant for about 17 months.[16] At least 12 of the fake articles had been indexed by Google, which researchers said could let false content reach AI assistants. In Israel and the United States the content claimed the alliance was collapsing and that Democrats were working against Israel, while in France it accused leaders of favoring defense and Ukraine aid over citizens.[17]

A separate Alliance4Europe report released October 21 found no evidence that a foreign actor started France’s October protests.[18] It found that a bot network it tied to Doppelgänger posted 639 coordinated messages seen about 7.4 million times in the six weeks before October 17. The Russian Pravda network published 1,018 articles across 28 sites in nine languages, and an unfounded claim that immigrants set fire to Limoges town hall spread 3.6 times more in English than in French.[19]

Israel Election

Israel Police said on October 25 that its Matzpen intelligence unit had secured the removal of two networks engaged in improper activity on X and Facebook, and the unit’s work was set to peak on election day.[20] Police said domestic actors were creating fake profiles, impersonating candidates and spreading AI-generated videos, and admitted they could stop only a small share of them.[21] Police Commissioner Danny Levy said on October 25 that “we will not allow violence, threats, incitement or criminality to harm the will of the voter.”[22]

The Yashar! party, led by former military chief Gadi Eisenkot, said fake messages had circulated impersonating its official communications, using its name and its unsubscribe phone number.[23] The party asked the Central Elections Committee’s cyber department to investigate. The Shin Bet had separately announced on October 22 the removal of accounts it said may have allowed foreign influence on the vote.[24]

US Midterms

New detail emerged on the deepfake videos targeting Texas Senate candidate James Talarico, which our October 23 update first reported.[25] The video was posted on October 20 from a new X account posing as a former student, Zyon Lewis, and NewsGuard said it was generated by AI and matched the format of Russia’s Storm-1516 operation, according to an FDD brief.[26] The real Lewis told fact-checkers the man in the videos was not him and that Talarico had never abused him.

Google’s Gemini and Microsoft Copilot presented the claim as a real accusation until fact-checks were published, FDD said.[27] X suspended the fake account. FDD noted that private researchers attributed the operation to Russia within a day while the US government has not publicly done so.[28]

Cyber Front

CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalog on October 26, confirming active attacks on the PHP2Shell flaws.[29] Both are rated 9.2 and allow remote code execution without a login, and federal civilian agencies must apply fixes by October 29.[30] A researcher reported successful code execution against honeypot systems on October 24, which preceded the listing.

A spyware kit called uCreator hides inside working copies of Telegram and WeChat and can steal Telegram two-factor passwords, according to an October 21 analysis reported October 26.[31] The tampered apps spread through sideloading outside official app stores, and the researcher could not confirm how every victim was infected.

Fact-checks of viral claims

  • False: 2
  • Unverified: 2
Fact-checks of viral claims
DateClaimWho said itVerdictEvidenceSource(s)
2026-10-20A former student says Senate candidate James Talarico abused him in 2012.New X account posing as Zyon LewisFalseNewsGuard said the video was generated by AI; the real Lewis said it was not him.fdd.org [32]
2026-10-07 to 09Articles on Walla!, Le Parisien and Le Point say the US-Israel alliance is collapsing.Doppelgänger clone sitesFalseThe articles ran on spoofed domains registered in May 2025, not on the real outlets.israeldefense.co.il [33]
2026-10-25 to 26Messages sent as official Yashar! party communications.Unidentified sendersDisputedThe party says the messages are forged and has asked for an investigation.israelnationalnews.com [34]
2026-10Immigrants set fire to Limoges town hall during France’s protests.Accounts on X and other platformsUnprovenAlliance4Europe called the claim unfounded; it spread 3.6 times more in English.alliance4europe.eu [35]

Date = date the claim was checked. Verdicts follow the cited fact-checkers and official records; “Unattributed viral post” means the report names no original author. Full citations are in the footnotes.

Domestic Affairs

In the United States, Chief Pentagon Spokesman Sean Parnell asked Congress to write the Department of War name into law, noting that the House and Senate Armed Services committees backed it in this year’s defense bill.[36] In Israel, police said impersonation and fake networks can be criminal offenses, but their immediate priority is stopping harmful activity rather than prosecuting everyone behind it.[37] No new Russian claim about “protecting compatriots” was found in this window.

War Crimes and Civilian Harm

Allegations are attributed; findings are not established unless stated.

Not applicable: no war crimes or civilian harm tied to information operations were reported in this window.

Statements by Officials

United States statements come first; statements by other governments, companies and state-linked voices follow and are labeled. Quotes are verbatim and attributed.

United States

Quotes: United States
DateSpeakerRole/OrgQuoteContext/TopicSource
2026-10-26Sean ParnellChief Pentagon Spokesman“Clarity strengthens alliances. Ambiguity invites adversaries to test them.”Department of War namewar.gov [38]
2026-10-26Sean ParnellChief Pentagon Spokesman“We prepare for war so that our adversaries never doubt the cost of starting one.”Deterrence messagingwar.gov [39]

Other governments

Quotes: Other governments
DateSpeakerRole/OrgQuoteContext/TopicSource
2026-10-25Danny LevyIsrael Police Commissioner“Preserving Israeli democracy is our mission. We will fulfill it impartially and without compromise.”Election securityjpost.com [40]
2026-10-26Israel PolicePolice statement“We are currently focused on monitoring the internet to identify and thwart activity across the various online platforms.”Election disinformationynetnews.com [41]

What to Watch

  • Whether Israel’s Central Elections Committee or police identify who sent the forged Yashar! messages.[42]
  • Whether US agencies publicly attribute the Talarico deepfake as midterm voting continues.[43]
  • Whether more PHP2Shell attacks hit federal systems after the October 29 patch deadline.[44]

Seven lenses

Analysis

About the framework

This analysis applies the Seven Lenses of Geopolitical Power to the day’s information fights.[2]

Geography & Strategic Position

The same Russian network reached voters in Israel, the United States and France at once, so one operation now spans the Middle East, North America and Europe.[3] Israel voted on October 27, the US midterms are under way and France faces a presidential race, which gives the operators three targets in a single campaign.

Military & Security

Israel treated election interference as a security matter: the Shin Bet removed accounts it linked to possible foreign influence on October 22, and a police intelligence unit secured the removal of two networks.[4] The Pentagon’s chief spokesman argued on October 26 that the Department of War name tells adversaries plainly what the department is for.[5]

Alliances & Diplomatic Networks

Alethea found the network pushed claims in Israel and the United States that the alliance between the two countries was collapsing.[6] The messaging aimed at the US-Israel relationship itself rather than at any one candidate.

Economic & Industrial Power

In France the network accused leaders of putting defense budgets and aid to Ukraine ahead of citizens’ needs, turning cost-of-living anger against support for Kyiv.[7] A separate study found a Russian bot network repeated the same line before the October protests in France.[8]

Technology & Critical Infrastructure

At least 12 fake articles from the clone sites were indexed by Google, and AI tools repeated the Talarico claim before fact-checks caught up.[9][10] CISA ordered federal agencies to fix two PHP flaws now under active attack.[11]

Domestic Politics & Information

Israel’s police said they can identify and stop only a small share of the people running domestic influence networks.[12] In the United States, private researchers attributed the Talarico deepfake to Russia within a day, while the federal government has not publicly named a culprit.[13]

Strategic Leverage & Outcomes

Clone news sites, search indexing and AI answers give Russia a way to plant claims that outlast any single post.[14] Rating: Russia gained reach this window, while governments mostly responded with takedowns rather than public attribution.

Analysis by Peter’s World using the Seven Lenses framework. Numbered notes link to the footnotes at the end of this report. Scores, where shown, are judgments, not measurements.

Additional sources

  • Alliance4Europe’s full report covers 547,471 posts in nine languages and traces Russian activity back to September 1, 2026.[45]

Footnotes

  1. [1] Israel Defense, “Russian Network Targeted Israel, US and France with 150,000 Fake Posts”, https://www.israeldefense.co.il/en/node/72123. Published: Oct 26, 2026, 9:36 AM ET. Retrieved: 2026-10-28. Reports a study by the intelligence firm Alethea.
  2. [2] Peter’s World, “Seven Lenses of Geopolitical Power”, https://petersworld.org/seven-lenses-of-geopolitical-power/. Published: 2026. Retrieved: 2026-10-28.
  3. [3] Israel Defense, “Russian Network Targeted Israel, US and France with 150,000 Fake Posts”, https://www.israeldefense.co.il/en/node/72123. Published: Oct 26, 2026, 9:36 AM ET. Retrieved: 2026-10-28. Reports a study by the intelligence firm Alethea.
  4. [4] The Jerusalem Post, “Police remove X accounts involved in attempting to influence election”, https://www.jpost.com/israel-news/crime-in-israel/article-912811. Published: Oct 25, 2026, 3:01 PM ET. Retrieved: 2026-10-28. Background, before the window; includes the Shin Bet’s Oct 22 removal of accounts.
  5. [5] US Department of War (war.gov), “What’s In a Name: ‘War’ Sends Clarifying Message to Adversaries About Departmental Mission”, https://www.war.gov/News/News-Stories/Article/Article/4634063/whats-in-a-name-war-sends-clarifying-message-to-adversaries/. Published: Oct 26, 2026, 6:47 PM ET. Retrieved: 2026-10-28.
  6. [6] Israel Defense, “Russian Network Targeted Israel, US and France with 150,000 Fake Posts”, https://www.israeldefense.co.il/en/node/72123. Published: Oct 26, 2026. Retrieved: 2026-10-28. Alethea findings on messaging by audience.
  7. [7] Israel Defense, “Russian Network Targeted Israel, US and France with 150,000 Fake Posts”, https://www.israeldefense.co.il/en/node/72123. Published: Oct 26, 2026. Retrieved: 2026-10-28. Alethea findings on messaging by audience.
  8. [8] Alliance4Europe, “EU Unrest Report: How France’s October 2026 protests were manipulated, then retold abroad”, https://alliance4europe.eu/report/eu-unrest-report-how-frances-october-2026-protests-were-manipulated-then-retold-abroad. Published: Oct 21, 2026. Retrieved: 2026-10-28. Data window Oct 11-18, 2026.
  9. [9] Israel Defense, “Russian Network Targeted Israel, US and France with 150,000 Fake Posts”, https://www.israeldefense.co.il/en/node/72123. Published: Oct 26, 2026. Retrieved: 2026-10-28. Alethea findings on clone sites and search indexing.
  10. [10] Foundation for Defense of Democracies, “Russian Operatives Plant Deepfake Targeting U.S. Midterm Elections”, https://www.fdd.org/analysis/russian-operatives-plant-deepfake-targeting-u-s-midterm-elections/. Published: Oct 26, 2026. Retrieved: 2026-10-28. On AI search tools repeating the claim.
  11. [11] Cybersecurity and Infrastructure Security Agency (cisa.gov), “CISA Adds Two Known Exploited Vulnerabilities to Catalog”, https://www.cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog. Published: Oct 26, 2026. Retrieved: 2026-10-28.
  12. [12] Ynet News, “Israel Police race to stop election disinformation as voting nears”, https://www.ynetnews.com/article/hkaoikp2mg. Published: Oct 26, 2026. Retrieved: 2026-10-28. Police statements on tactics and limits.
  13. [13] Foundation for Defense of Democracies, “Russian Operatives Plant Deepfake Targeting U.S. Midterm Elections”, https://www.fdd.org/analysis/russian-operatives-plant-deepfake-targeting-u-s-midterm-elections/. Published: Oct 26, 2026. Retrieved: 2026-10-28. On the federal government’s public silence.
  14. [14] Israel Defense, “Russian Network Targeted Israel, US and France with 150,000 Fake Posts”, https://www.israeldefense.co.il/en/node/72123. Published: Oct 26, 2026. Retrieved: 2026-10-28. Alethea findings on clone sites and search indexing.
Show 31 more sources
  1. [15] Israel Defense, “Russian Network Targeted Israel, US and France with 150,000 Fake Posts”, https://www.israeldefense.co.il/en/node/72123. Published: Oct 26, 2026, 9:36 AM ET. Retrieved: 2026-10-28. Reports a study by the intelligence firm Alethea.
  2. [16] Israel Defense, “Russian Network Targeted Israel, US and France with 150,000 Fake Posts”, https://www.israeldefense.co.il/en/node/72123. Published: Oct 26, 2026. Retrieved: 2026-10-28. Alethea findings on clone sites and search indexing.
  3. [17] Israel Defense, “Russian Network Targeted Israel, US and France with 150,000 Fake Posts”, https://www.israeldefense.co.il/en/node/72123. Published: Oct 26, 2026. Retrieved: 2026-10-28. Alethea findings on messaging by audience.
  4. [18] Alliance4Europe, “EU Unrest Report: How France’s October 2026 protests were manipulated, then retold abroad”, https://alliance4europe.eu/report/eu-unrest-report-how-frances-october-2026-protests-were-manipulated-then-retold-abroad. Published: Oct 21, 2026. Retrieved: 2026-10-28. Data window Oct 11-18, 2026.
  5. [19] Alliance4Europe, “EU Unrest Report: How France’s October 2026 protests were manipulated, then retold abroad”, https://alliance4europe.eu/report/eu-unrest-report-how-frances-october-2026-protests-were-manipulated-then-retold-abroad. Published: Oct 21, 2026. Retrieved: 2026-10-28. On the Pravda network and AI tools.
  6. [20] Ynet News, “Israel Police race to stop election disinformation as voting nears”, https://www.ynetnews.com/article/hkaoikp2mg. Published: Oct 26, 2026, 10:51 AM ET. Retrieved: 2026-10-28.
  7. [21] Ynet News, “Israel Police race to stop election disinformation as voting nears”, https://www.ynetnews.com/article/hkaoikp2mg. Published: Oct 26, 2026. Retrieved: 2026-10-28. Police statements on tactics and limits.
  8. [22] (statement) Israel Police Commissioner Danny Levy, via The Jerusalem Post, “Police remove X accounts involved in attempting to influence election”, https://www.jpost.com/israel-news/crime-in-israel/article-912811. Statement made Oct 25, 2026; published Oct 25, 2026. Retrieved: 2026-10-28.
  9. [23] (statement) Yashar! party statement, via Israel National News, “Yashar Party urges Central Elections Committee to investigate fake messages sent in its name”, https://www.israelnationalnews.com/flashes/696036. Statement made Oct 25-26, 2026; published Oct 26, 2026. Retrieved: 2026-10-28.
  10. [24] The Jerusalem Post, “Police remove X accounts involved in attempting to influence election”, https://www.jpost.com/israel-news/crime-in-israel/article-912811. Published: Oct 25, 2026, 3:01 PM ET. Retrieved: 2026-10-28. Background, before the window; includes the Shin Bet’s Oct 22 removal of accounts.
  11. [25] Peter’s World, “Information War Update, Oct 23, 2026”, https://petersworld.org/information-war-update-oct-23/. Published: Oct 23, 2026. Retrieved: 2026-10-28. Earlier coverage of the Talarico videos.
  12. [26] Foundation for Defense of Democracies, “Russian Operatives Plant Deepfake Targeting U.S. Midterm Elections”, https://www.fdd.org/analysis/russian-operatives-plant-deepfake-targeting-u-s-midterm-elections/. Published: Oct 26, 2026, 4:19 PM ET. Retrieved: 2026-10-28. Policy brief citing NewsGuard, Graphika, AFP Fact Check and Lead Stories.
  13. [27] Foundation for Defense of Democracies, “Russian Operatives Plant Deepfake Targeting U.S. Midterm Elections”, https://www.fdd.org/analysis/russian-operatives-plant-deepfake-targeting-u-s-midterm-elections/. Published: Oct 26, 2026. Retrieved: 2026-10-28. On AI search tools repeating the claim.
  14. [28] Foundation for Defense of Democracies, “Russian Operatives Plant Deepfake Targeting U.S. Midterm Elections”, https://www.fdd.org/analysis/russian-operatives-plant-deepfake-targeting-u-s-midterm-elections/. Published: Oct 26, 2026. Retrieved: 2026-10-28. On the federal government’s public silence.
  15. [29] Cybersecurity and Infrastructure Security Agency (cisa.gov), “CISA Adds Two Known Exploited Vulnerabilities to Catalog”, https://www.cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog. Published: Oct 26, 2026. Retrieved: 2026-10-28.
  16. [30] The Hacker News, “CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution”, https://thehackernews.com/2026/10/cisa-confirms-active-exploitation-of.html. Published: Oct 27, 2026, 12:37 AM ET. Retrieved: 2026-10-28.
  17. [31] The Hacker News, “uCreator Android Spyware Can Steal Telegram 2FA Passwords and Clone WeChat Accounts”, https://thehackernews.com/2026/10/ucreator-android-spyware-can-steal.html. Published: Oct 26, 2026, 5:54 AM ET. Retrieved: 2026-10-28. Cites researcher Ovi’s Oct 21 analysis and Doctor Web.
  18. [32] Foundation for Defense of Democracies, “Russian Operatives Plant Deepfake Targeting U.S. Midterm Elections”, https://www.fdd.org/analysis/russian-operatives-plant-deepfake-targeting-u-s-midterm-elections/. Published: Oct 26, 2026, 4:19 PM ET. Retrieved: 2026-10-28. Policy brief citing NewsGuard, Graphika, AFP Fact Check and Lead Stories.
  19. [33] Israel Defense, “Russian Network Targeted Israel, US and France with 150,000 Fake Posts”, https://www.israeldefense.co.il/en/node/72123. Published: Oct 26, 2026. Retrieved: 2026-10-28. Alethea findings on clone sites and search indexing.
  20. [34] Israel National News, “Yashar Party urges Central Elections Committee to investigate fake messages sent in its name”, https://www.israelnationalnews.com/flashes/696036. Published: Oct 26, 2026. Retrieved: 2026-10-28.
  21. [35] Alliance4Europe, “EU Unrest Report: How France’s October 2026 protests were manipulated, then retold abroad”, https://alliance4europe.eu/report/eu-unrest-report-how-frances-october-2026-protests-were-manipulated-then-retold-abroad. Published: Oct 21, 2026. Retrieved: 2026-10-28. On the Pravda network and AI tools.
  22. [36] US Department of War (war.gov), “What’s In a Name: ‘War’ Sends Clarifying Message to Adversaries About Departmental Mission”, https://www.war.gov/News/News-Stories/Article/Article/4634063/whats-in-a-name-war-sends-clarifying-message-to-adversaries/. Published: Oct 26, 2026, 6:47 PM ET. Retrieved: 2026-10-28.
  23. [37] Ynet News, “Israel Police race to stop election disinformation as voting nears”, https://www.ynetnews.com/article/hkaoikp2mg. Published: Oct 26, 2026. Retrieved: 2026-10-28. Police statements on tactics and limits.
  24. [38] (statement) Chief Pentagon Spokesman Sean Parnell, via war.gov, “What’s In a Name: ‘War’ Sends Clarifying Message to Adversaries About Departmental Mission”, https://www.war.gov/News/News-Stories/Article/Article/4634063/whats-in-a-name-war-sends-clarifying-message-to-adversaries/. Statement made Oct 26, 2026; published Oct 26, 2026. Retrieved: 2026-10-28.
  25. [39] (statement) Chief Pentagon Spokesman Sean Parnell, via war.gov, “What’s In a Name: ‘War’ Sends Clarifying Message to Adversaries About Departmental Mission”, https://www.war.gov/News/News-Stories/Article/Article/4634063/whats-in-a-name-war-sends-clarifying-message-to-adversaries/. Statement made Oct 26, 2026; published Oct 26, 2026. Retrieved: 2026-10-28.
  26. [40] (statement) Israel Police Commissioner Danny Levy, via The Jerusalem Post, “Police remove X accounts involved in attempting to influence election”, https://www.jpost.com/israel-news/crime-in-israel/article-912811. Statement made Oct 25, 2026; published Oct 25, 2026. Retrieved: 2026-10-28.
  27. [41] Ynet News, “Israel Police race to stop election disinformation as voting nears”, https://www.ynetnews.com/article/hkaoikp2mg. Published: Oct 26, 2026. Retrieved: 2026-10-28. Police statements on tactics and limits.
  28. [42] Israel National News, “Yashar Party urges Central Elections Committee to investigate fake messages sent in its name”, https://www.israelnationalnews.com/flashes/696036. Published: Oct 26, 2026. Retrieved: 2026-10-28.
  29. [43] Foundation for Defense of Democracies, “Russian Operatives Plant Deepfake Targeting U.S. Midterm Elections”, https://www.fdd.org/analysis/russian-operatives-plant-deepfake-targeting-u-s-midterm-elections/. Published: Oct 26, 2026. Retrieved: 2026-10-28. On the federal government’s public silence.
  30. [44] The Hacker News, “CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution”, https://thehackernews.com/2026/10/cisa-confirms-active-exploitation-of.html. Published: Oct 27, 2026, 12:37 AM ET. Retrieved: 2026-10-28.
  31. [45] Alliance4Europe, “EU Unrest Report: How France’s October 2026 protests were manipulated, then retold abroad”, https://alliance4europe.eu/report/eu-unrest-report-how-frances-october-2026-protests-were-manipulated-then-retold-abroad. Published: Oct 21, 2026. Retrieved: 2026-10-28. Data window Oct 11-18, 2026.

Sources

Related coverage

More from the War Room today

Recommended articles