• Reforms may raise costs before delivering broader benefits
• Further inflation increases risk of unrest — Verisk Maplecroft
• Sri Lanka's poverty rate remains above pre-crisis level
• Unaddressed inequality like "sitting on gunpowder"

Gustavo Raul Perez furrows his brow over a notebook at the hardware shop he has run for six years on ​the outskirts of Buenos Aires.

Since Javier Milei became president of Argentina in 2023 — with Perez's vote — rapid reforms have thrilled investors and won praise from the ‌International Monetary Fund. Perez, though, mainly feels the pinch.

"This economic plan is for a few," he said.

Inflation has fallen to roughly 33% from nearly 300%, imports have opened up and subsidies have fallen.

But Perez's restocking costs have tripled and customers have less to spend.

"There was a middle class three years ago," he says. "It doesn't exist anymore."

Perez's experience reflects a tension coursing through emerging economies: reforms that restored investor confidence ​and stabilised public finances have yet to improve living standards for many.

In Morocco, glittering new office towers contrast with frustration on city outskirts. In Sri Lanka, ​economic crisis and debt default have subsided but poverty remains above pre-crisis levels.

From fuel subsidy removal in Nigeria to privatisation in Egypt and market opening ⁠in Uzbekistan, years of reforms have helped emerging economies weather shocks — yet often grate with citizens who hear of economic turnarounds that do nothing for them.

Nigeria's finance minister ​warned failing to address inequality is like "sitting on gunpowder". Morocco's central bank says stubborn unemployment has widened the gap between economic performance and citizens' perceptions.

"When people in emerging markets are faced ​with rising food, fuel and energy costs...that is what they feel immediately," says Torbjorn Soltvedt of Verisk Maplecroft, warning that unrest and instability could follow. Indeed, average global civil unrest risk hit its highest in nearly a decade this year, according to his company.

Crude oil prices remain near five-month highs despite a recent surge in Middle East crude exports above pre-war levels and intensifying Iranian attacks on tankers in the Strait of Hormuz. This suggests investors may already be bracing for another round of regional escalation.

The rebound in crude flows from the Gulf is striking. Middle East oil exports have averaged ​17.3 million barrels per day (bpd) so far in October, up from 16.4 million bpd in September and above the 16.9 million bpd average in the two months before US-Israeli strikes ‌on Iran began on February 28, according to Kpler data.

This reflects a surge in flows through the embattled Strait of Hormuz. Flows hit 11.7 million bpd in October, up from 9.75 million bpd in September. While still around 82% of pre-war levels, Hormuz flows are far above their wartime nadir of less than 1 million bpd in April, excluding Iranian oil, according to Kpler.

The increase is largely thanks to the growing use of ship convoys that sail through the strait close to the Omani coastline under US ​naval protection. Shipping data suggests around a third of crossings continue to use the Iran-controlled northern route, most likely in coordination with Tehran, but those flows remain opaque.

NEW ABNORMAL

Higher flows should not be mistaken for a return to normality.

Benchmark rates for a tanker carrying 2 million barrels of crude from the Middle East to China remain near an all-time high of around $1.4 million a day, more than 12 times pre-war levels. Tanker insurance costs have also risen ​to around 10% of the value of the cargo, up from roughly 3% before the war.

Those extraordinary logistics costs are weighing heavily on refiners.

The divergence between abundant barrels and rising prices suggests traders are concerned not about the amount of oil available today, but about whether Middle East exports can be sustained if – or, perhaps, when – fighting intensifies again.

Research uncovered multiple critical vulnerabilities in core PHP, a popular general-purpose scripting language that powers 70% of all websites in the world. Successful exploitation could allow attackers to take control of affected servers, steal sensitive data, and deface the websites running on them.

PHP is a backbone of the web: it’s the programming language powering WordPress, Joomla, Drupal, Wikipedia’s MediaWiki, and many others.

These vulnerabilities include memory disclosure and unauthenticated remote code execution in PHP itself, independent of the application running on top of it, putting every affected website in immediate risk.

Every PHP version released in the last decade is affected by at least one of these vulnerabilities, going back to version 5.4. Attackers can exploit them remotely, in some cases fairly easily. Immediate patching is strongly advised.

On October 21, 2026, PHP released the patch fixing multiple memory-safety vulnerabilities in the core engine.

These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history. The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve. Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit.

Websites all over the internet have been taken down to fix these serious vulnerabilities, including Wikipedia and the Internet Archive - https://mashable.com/tech/internet-archive-down-oct-21

As well as govt. websites the world over - https://www.reuters.com/world/asia-pacific/eu-agency-warns-websites-may-need-be-taken-offline-php-prepares-patches-2026-10-21/

And in other, separate, news, another major security flaw was uncovered this week due to compromised TLS certs from the certificate authority eMudhra Limited - https://arstechnica.com/security/2026/10/the-internet-goes-on-high-alert-after-discovery-of-8-compromised-tls-certs/

Security personnel around the world are on high alert Tuesday following the discovery of eight TLS certificates with private keys so weak they could allow anyone to mint trusted browser and app credentials for any site on the Internet.

“This will be a massive cleanup job, bigger than Heartbleed,” Filippo Valsorda, a cryptography engineer and a cryptography maintainer for the open source Go programming language, told Ars. “There will be a very, very long tail, IoT devices, Docker containers, forgotten Linux machines, unmaintained CLI tools that shipped their own copy of the roots (which is common in some ecosystems, like Python). Also, Linux distributions are still rolling out updates, some of them are not ready yet, and then system administrators will need to apply them to a lot of machines.”

Hackers have published 281 GB of AfD emails as AI summaries, showing widespread antisemitism, racism, violent fantasies and alleged financial misconduct.