WIRE home · World Instability · Business · Economics · Tech & Cyber · Orthodox · Archive · Subscribe
Download PDF · Dashboard image · All Technology & Cyber editions
UNCLASSIFIED // OPEN SOURCE | Thursday, 22 October 2026 | Vol. 2026-295 | First edition | As of 220730 EDT OCT 26
BLUF. The first WIRE Technology & Cyber edition opens at ENVIRONMENT FOR CRISIS (↑), set by space and ground-segment infrastructure (TEC-T3): Starlink ground equipment serving Ukraine was set on fire in Poland (23 Sep) and Bulgaria (9 Oct), and an arson attempt failed in Lithuania (18 Oct). Polish ministers and Lithuania's prime minister have blamed Russia. Separately, a Russian satellite, Cosmos 2612, closed to about a third of a mile of the commercial ICEYE-X36 radar satellite on 17 Oct. Critical-infrastructure cyber is at NO CRISIS (=): 9 KEV additions last week, ransomware leak-site victims 16% above the 8-week mean, and one new Item 1.05 cyber 8-K this month. Chips are at NO CRISIS (=), but China's rare-earth suspension legally lapses on 10 Nov unless a new notice is published. AI governance is at NO CRISIS (=) after an override (see §IV).
| TOPIC | CRISIS LEVEL | DOM. INDICATOR | KEY DRIVER (today) | TREND |
|---|---|---|---|---|
| TEC-T3 Space and undersea infrastructure | ENVIRONMENT FOR CRISIS | SIGNIFICANT | O-1: three attacks on Starlink ground sites (PL 23 Sep, BG 9 Oct, LT 18 Oct); O-3: Cosmos 2612 approach to ICEYE-X36 | ↑ |
| TEC-T1 Critical-infrastructure cyber | NO CRISIS | ABNORMAL | K-2: joint advisory AA26-281A on China-linked actors targeting infrastructure sectors (8 Oct); SafePay advisory AA26-293A (20 Oct) | = |
| TEC-T4 AI governance and incidents | NO CRISIS | ABNORMAL | AI-3: Google Cloud europe-west2 outage of 6h10m (power, not AI); AI-1: DHS DeepSeek exclusion order published 20 Oct | = |
| TEC-T2 Semiconductors and compute | NO CRISIS | ROUTINE | X-1: no new BIS rule in October; MOFCOM suspensions lapse 10 and 27 Nov; X-2: TSMC Sep revenue −0.6% m/m | = |
Family level = highest topic level (TEC-T3). Roll-up per WIRE_METHOD §1a. Trend key: ↑ toward crisis, ↓ away, = no net change.
Change line. First edition; all four topics were scored for the first time today.
Moved indicators (vs 21 Oct). None. This is the first edition, so every score is a first score. The Statements of Normalcy are below.
Statement of Normalcy. In the normal state, there is no attributed sabotage of satellite ground stations or subsea cables in a 30-day window. Baltic GNSS interference continues at its post-2022 level, and there are no destructive or close-approach counterspace events against Western commercial satellites. Ground stations. On 23 Sep, two masked people set fire to the Exatel-operated Starlink station at Wola Krobowska in Poland, which carries traffic to Ukraine. Poland's prosecutors are investigating sabotage on behalf of a foreign intelligence service. Two Turkish citizens living in Germany were charged on 7 Oct and arrested in Nürtingen on 12 Oct. The minister coordinating Poland's special services said Russian intelligence was behind it. On 9 Oct, antennas at the Plana teleport south of Sofia were set on fire. Sofia prosecutors charged two German nationals in absentia on 14 Oct, and the court authorised arrest warrants on 19 Oct. At about 02:00 on 18 Oct, attackers used Molotov cocktails on Starlink equipment at a Delska site near Vilnius. The control unit was slightly scorched, and service was not disrupted. Prime Minister Sinkevičius called it part of Russia's hybrid war. The interior minister said the culprit was "not clear," and Lithuania raised the alert level at more than 15 critical sites from 19 Oct (YAC News, 20 Oct; UPI, 19 Oct; Poland MSWiA). Orbit. LeoLabs data show Cosmos 2612 closed a gap of nearly 250 miles to about one-third of a mile from ICEYE-X36. Vantor imaged the approach on 17 Oct, and LeoLabs says the Russian satellite began drifting away on 18 Oct (Axios, 22 Oct). No direct-ascent ASAT test was found. Subsea and GNSS. No cable fault this month has an official sabotage attribution. The PPC-1 break (6 Oct) and the EAC-C2C outage (2 Oct) have no published cause (Submarine Cable Status). Latvian airspace logged 795 GPS-interference cases from January to September, 25% fewer than in the same period of 2025, and 48 in September against 91 a year earlier (LGS via BB.LV, 20 Oct). Indicators. O-1 attributed ground-station and cable sabotage: SIGNIFICANT (2+ in 30 days). O-2 GNSS interference: ROUTINE (↓). O-3 counterspace: ABNORMAL (a close approach, not a test). Roll-up: 1 Significant + 1 Abnormal = ENVIRONMENT FOR CRISIS (↑). Analyst Comment. The attacks share a method: two people travel in from abroad, strike at night with accelerant, and leave within hours. That points to one commissioning hand, not copycats, so a further attempt in the next few weeks is likely. Defenders have now been warned, though, and the Vilnius attempt failed. This tracks WIRE World Instability R-5 (hybrid sabotage, SIGNIFICANT). It is scored here as damage to the ground segment, and there as Russian hybrid escalation. An Extreme reading needs a cut that isolates a country, or a coordinated outage.
Statement of Normalcy. The normal state is fewer than 10 KEV additions a week (the June–October weekly median is 6) with no emergency directive, ransomware leak-site victims within ±25% of the 8-week mean, and isolated single-facility healthcare outages without national-scale disruption. Facts. CISA added 9 entries to KEV from 15 to 21 Oct: Plex (4), EG Secure Solutions SiteGuard, Siemens Software Center, BeyondTrust Remote Support, Fortinet and Atlassian (CISA KEV feed). On 8 Oct, CISA, FBI, NSA and partners issued AA26-281A. It names Chinese government-linked actors, enabled by Integrity Technology Group, who target critical-infrastructure sectors including healthcare and IT (CISA). On 20 Oct, AA26-293A described SafePay, a criminal ransomware group with about 600 victims (CISA). Ransomware.live recorded 270 leak-site victims from 15 to 21 Oct, against a mean of 232 for the prior eight weeks (+16%) (ransomware.live data). EDGAR full-text search shows one Item 1.05 8-K in October, from Park Dental Partners on 13 Oct (EDGAR). Health-ISAC counted a record 317 health-sector ransomware events in Q3 (Health-ISAC, 21 Oct). Indicators. K-1 KEV: ROUTINE (9). K-2 state-actor joint advisory: ABNORMAL (AA26-281A, still inside 30 days). K-3 confirmed utility, pipeline or hospital-chain disruption: ROUTINE (none confirmed). K-4 ransomware victims: ROUTINE (+16%). K-5 Item 1.05 8-Ks: ROUTINE (1). Roll-up: 1 Abnormal = NO CRISIS (=). Analyst Comment. The health sector is the soft spot: Q3 attack volume hit a record even while the aggregate leak-site count stayed in band. The SafePay advisory lists known edge-device CVEs, which suggests the vulnerabilities being exploited are old, unpatched ones rather than new zero-days.
Statement of Normalcy. The normal state is routine BIS rules, China's 2023–25 licensing regimes for gallium, germanium and rare earths in place but with the 2025 escalations suspended, TSMC monthly revenue within ±15% m/m, and no fab outages. Facts. BIS has published no export-control rule in the Federal Register since 1 Oct; its only October document is a 14 Oct tariff-content notice (Federal Register API). TSMC's September revenue was NT$511.86B, −0.6% m/m and +54.6% y/y (TSMC, 8 Oct). MOFCOM Announcement No. 70 (2025) suspends the October 2025 rare-earth package until 10 Nov 2026, and No. 72 suspends the US-specific gallium/germanium/antimony ban until 27 Nov 2026. Announcement No. 18 (2025), which covers licensing for seven medium and heavy rare earths, remains in force (MOFCOM No. 18; AsiaAI.FYI tracker). Indicators. X-1 BIS/MOFCOM actions: ROUTINE. X-2 TSMC revenue: ROUTINE. X-3 materials licensing: ROUTINE (watch 10 Nov). X-4 fab outage: ROUTINE (none found). Roll-up: NO CRISIS (=). Analyst Comment. The risk here is a legal deadline. Unless replacement notices appear, three suspensions lapse in November: China's rare-earth package, the US Affiliates Rule (from 10 Nov) and the gallium ban (27 Nov). A lapse would move X-1 and X-3 to at least ABNORMAL at once.
Statement of Normalcy. The normal state is scheduled rulemaking (EU AI Act phase-ins, US guidance), single-zone or short cloud outages, and no AI incident that disrupts a critical service. Facts. On 20 Oct, the Federal Register published a DHS order, issued on 24 Jul, that excludes DeepSeek products from federal civilian procurement and removes them from civilian agency IT, including third-party products built on DeepSeek (FR 2026-21447; CNBC). Google Cloud's europe-west2 region was disrupted for 6h10m on 19–20 Oct (Pacific time). The facility lost grid power, and both PLCs failed to start the backup generators, so zone europe-west2-b went dark when its UPS batteries ran out. Failover traffic then saturated the other zones (Google preliminary incident report, 22 Oct). The EU's AI omnibus, Regulation (EU) 2026/1744, defers the high-risk obligations (EUR-Lex). Indicators. AI-1 regulatory actions: ABNORMAL (a government-wide exclusion of a major AI model provider). AI-2 serious AI incidents: ROUTINE (none verified). AI-3 major cloud outage with a post-incident report: ABNORMAL. Formula: 2 Abnormal = ENVIRONMENT FOR CRISIS. Override −1 to NO CRISIS: neither item is an AI incident; the outage was a facility power fault, and the DeepSeek order covers federal civilian IT only. Analyst Comment. The Google report shows how one zone's power failure can spread across a region: the failover traffic and the control-plane dependencies did more damage than the zone loss itself.
None to resolve (first edition). New (dated 2026-10-22; logged in the prediction ledger): - TEC-01: Police, prosecutors or a government ministry publicly confirm a new arson or sabotage attack (including a failed attempt) on a Starlink or other satellite ground station in an EU or NATO European state, occurring 23 Oct–30 Nov 2026. 60%, likely. Resolve by 2026-11-30. - TEC-02: MOFCOM publishes, on or before 10 Nov 2026, an announcement that extends or replaces the suspension in Announcement No. 70 (2025) beyond 10 Nov 2026. 70%, likely. Resolve by 2026-11-10. - TEC-03: CISA KEV adds 10 or more entries in at least one Monday–Sunday week from 26 Oct to 22 Nov 2026 (per the KEV feed's dateAdded). 65%, likely. Resolve by 2026-11-23.
CISA KEV feed; CISA AA26-281A and AA26-293A; ransomware.live; SEC EDGAR full-text search; Health-ISAC (21 Oct); TSMC (8 Oct); Federal Register (BIS, DHS 2026-21447); MOFCOM; AsiaAI.FYI; EUR-Lex 2026/1744; Google Cloud Service Health; CNBC (20 Oct); YAC News (20 Oct); UPI (19 Oct); Poland MSWiA; Axios (22 Oct); Submarine Cable Status; BB.LV/LGS (20 Oct).
WIRE Technology & Cyber | WIRE Desk | Open-source analysis. Not investment, legal or voting advice. UNCLASSIFIED // OPEN SOURCE.
Every WIRE, every morning. Unsubscribe anytime.
Prefer the website? Subscribe on Substack.
WIRE home · World Instability · Business · Economics · Tech & Cyber · Orthodox · Archive · Subscribe
