Good morning, ladies and gentlemen, and welcome back. I hope you had a lovely weekend, and for those of you in Europe, that you enjoyed the extra hour of sleep.
Last week started with a piece of software most people have never heard of. On Tuesday the people who look after PHP, the programming language behind roughly seven out of ten websites, warned that an emergency fix was on its way. An AI had found a hole in it. By Wednesday the details were out, and by Thursday hackers were trying that hole millions of times.
Then on Friday it was oil’s turn. Brent, the international price for crude, closed at $116.72 a barrel. That’s up 6.2% on the week and the highest close since April, after rebels in Yemen claimed strikes on Saudi oil sites. Saudi Arabia says nothing was damaged.
You’d expect dearer oil to push up what governments pay to borrow. America’s ten-year rate fell instead, by 9 basis points to 5.00%, a basis point being one hundredth of a percentage point. Stocks looked calm as well, with the S&P 500 down just 0.5%. That number hides a rough Thursday for technology companies. And in France, borrowing got dearer, and fast.
This week’s chapters
Oil is pricing a threat to Saudi supply
AI found a hole in the internet, and Wall Street took notes
When France pays more, Europe pays more
The Credit Grind: companies pay the most in a year to borrow
The Scoreboard
Oil went up and America’s smaller companies went up. Nearly everything else on the board went down, including what America and Japan pay to borrow.
In America, the week looked quieter than it was. The S&P 500 slipped 0.5% to 7,623.68 and the Nasdaq Composite 0.7%. The Russell 2000, an index of smaller American companies, actually gained 2.0%. Borrowing got cheaper for every length of loan, and more for long loans than short ones: the two-year rate fell 5 basis points to 4.69%, the thirty-year 11 to 5.32%.
Over in Europe, it was a harder week. The Euro Stoxx 50, which tracks the fifty largest listed companies in the euro area, lost 2.2%. The extra rate Italy pays over Germany to borrow for ten years widened by 16 basis points to 122.
Asia had it worse still. Japan’s Nikkei 225 fell 4.0% and Korea’s KOSPI 2.1%. Japan’s ten-year borrowing rate dropped 14 basis points to 2.79%. Gold fell 3.8% to about $4,008, more than most stock markets lost. Bitcoin, meanwhile, didn’t move at all, finishing near $81,600.
That big green circle is oil. The two large terracotta ones are Japan’s stock market and gold. And the strip of government borrowing costs underneath is terracotta almost everywhere, which for bonds means borrowing got cheaper.
1. Oil is pricing a threat to Saudi supply
Let’s start with oil. Houthi fighters in Yemen said this week they’d hit Aramco’s site at Yanbu and its refinery at Rabigh. Yanbu matters a great deal right now. Since Iran closed the Strait of Hormuz in July, it’s been Saudi Arabia’s main way of getting crude out to the world.
Oil goes into fuel, freight, plastics and fertiliser, so when a barrel gets dearer, other prices follow a few weeks later. Central banks raise their lending rates to slow rising prices, which is why they keep a close eye on oil.
Saudi Arabia says its forces intercepted missiles aimed at Yanbu and Taif, and it hasn’t confirmed any damage. One analysis citing the trade publication Argus contradicted the reports of fires. Traders bought anyway, and Brent settled at $116.72 on Friday. You can already see the cost in the data. UK inflation rose to 3.5% in September with diesel at its highest since July 2022, and petrol in Canada cost 27.8% more than a year earlier.
The best argument for staying calm is right there in the Saudi statement. Nothing has been confirmed damaged, and the market can take that premium out as quickly as Friday put it in. America’s central bank, the Fed, meets on Tuesday and Wednesday. Futures traders, whose contracts on the Fed’s decisions imply a probability, see about an 80% chance of a rate rise in December.
Wednesday’s statement will be the first sign of whether oil has changed the Fed’s thinking. Two readings this week pointed somewhere calmer. New claims for US unemployment support came in at 194,000, below the 200,000 forecast. And in Canada, the central bank’s preferred measures of underlying inflation averaged 1.85%, the lowest in six years.
2. AI found a hole in the internet, and Wall Street took notes
Now to the story that had people talking all week. Back in August, security researchers at a firm called Calif and at Wiz, which belongs to Google, were using AI models to hunt for bugs, OpenAI’s GPT-5.6 Sol among them. They found two flaws in PHP that had been sitting there for well over a decade. Together they let an attacker take over a web server from the outside, with no account, and read what’s stored on it, passwords included. The flaws now go by the name PHP2Shell.
OpenAI, which sells the models that found the flaw, calls this the defender’s window: AI spotted the hole before attackers did, and the people fixing it got two months’ head start. The window closed earlier than planned. Details leaked, and Amazon’s security team saw the first attempts to use the flaw on 17 October, four days before it went public. The patch came out on Wednesday, a day ahead of schedule. Cloudflare, which sits in front of millions of websites, counted tens of thousands of attack attempts in the first 45 minutes and millions by Thursday.
America’s National Security Agency and Europe’s cybersecurity agency told companies to patch immediately, and several European governments took public websites offline while they did. The FBI went further: companies that couldn’t update straight away should take their systems offline altogether.
Finding a weakness like this used to take a skilled team months of work. AI has made it fast and cheap, for the people defending systems and for the people attacking them. Chris Krebs, who used to run America’s cyber defence agency, told CNBC that 3% of all critical software flaws ever recorded were found in the past month alone. People in the industry have started calling it Black October.
Investors reached a simple conclusion: everyone with a website is going to spend more protecting it. Security stocks jumped 5% to 7% on Wednesday alone. By Friday, Palo Alto Networks and CrowdStrike were up about 11% on the week, Okta 14% and Cloudflare 9%.
The same week, investors got a lot less patient with the companies building AI. These companies pay up front for chips and data centres and hope the revenue arrives later. A stock price is a bet on that later money, so every extra billion they spend raises the bar.
On Wednesday Meta reported 26% revenue growth and raised the bottom of its 2026 spending plan to $135 billion. Tesla went the other way and cut its plan to about $20 billion. On Thursday the Nasdaq fell 2.6% and chip stocks 6.7%. Money moved into sectors with little AI in them: health care stocks gained 1.45% over the week, while communication services, home to Meta and Alphabet, lost 4.36%. So in a single week investors paid up for protection against AI and asked harder questions about the bill for AI itself.
There’s a fair case for calm on both counts. The PHP fix exists, and Cloudflare pushed protective rules to every customer within hours, free users included. The real risk sits with older servers nobody looks after, and nobody knows how many of those are out there. On spending, the S&P 500 trades at 18.7 times the profits analysts expect for next year, meaning buyers pay $18.70 for every dollar of expected profit. That’s below its five-year average of 19.8. Alphabet and Microsoft report on Wednesday and will tell us whether Thursday was a one-day fright.
Two parts of the week held up nicely. The Russell 2000 gained 2.0% as money rotated toward smaller companies. And China’s economy grew 4.5% in the third quarter, above the 4.4% forecast, with exports doing much of the work.
3. When France pays more, Europe pays more
Over to Paris. France’s ten-year borrowing cost closed the week near 5.04%, and on Thursday it briefly touched 5.14%, the highest since 2002.
The euro-area countries use one currency, but they carry very different debts. Investors who lend to the weaker ones want an extra payment on top of what Germany, the safest borrower, pays. France is big enough that when its extra payment grows, everyone else’s moves with it.
Germany pays about 3.36% for ten years, which puts France’s gap at roughly 168 basis points, the widest since 2011. Behind it is a 2027 budget that aims for a deficit of 5% of the country’s yearly output. It still has to get through a divided parliament, with protesters out in the streets.
And the extra charge spread. Italy’s gap to Germany widened 16 basis points to 122, and at about 4.56%, Italy now pays less than France to borrow for ten years. France’s main stock index, the CAC 40, fell 2.2%, and the luxury group Kering lost 16.6% after its results.
After Friday’s close, the rating agency Moody’s kept France at Aa3 with a negative outlook, which means a downgrade is on the table. Moody’s tied that downgrade to parliament failing to stop debt costs from getting worse. S&P, the other big agency, looks at France next on 27 November.
The calmer reading starts with the safest euro borrowers. What top-rated euro governments pay barely moved this week, so the whole rise came from the extra charge for risk, while the base cost of money held steady. Germany had some steadier news too. The ZEW, a monthly survey of financial analysts, showed its reading of current conditions improving to −35.9 from −47.1. And German business activity stayed above 50, the line between growth and shrinking, for a fourth month.
Data Check
Eight releases came out this week. Three beat the forecast and three fell short. Both European business surveys disappointed: the ZEW and the flash purchasing managers’ index, a monthly survey that asks companies whether their activity went up or down.
Euro-area business activity slipped to 51.9 from 53.1, three times the drop economists expected. France fell to 48.4, below the line of 50, so its private sector shrank.
In Britain, consumer prices rose 3.5% over the year, against 3.4% expected. Core inflation, which leaves out food and energy, climbed to 2.8% from 2.6%. A Bank of England rate rise in November now looks more likely.
And one correction to last week. Its calendar said Trading Economics expected the Bank of Korea to raise rates. Reuters asked 34 analysts, every one of them expected a hold, and the bank held at 3.00%.
The Credit Grind
Euro-area companies with weak credit ratings now pay 354 basis points more than governments to borrow. That’s 3.54 percentage points extra, and the most in a year.
Any company that borrows pays two prices added together: the base cost of money, set by what governments pay, and a surcharge for the chance that this particular company stops paying.
Last week the surcharge only rose for the weakest borrowers. This week it reached the strongest ones too. US investment-grade companies, the safest tier, rose 5 to 89 basis points, which puts them in the 96th percentile. In other words, investors were paid less than this on 96% of the past year’s days.
The base cost hardly changed. What top-rated euro-area governments pay for ten years fell 1 basis point to 3.38%, and for two years it rose 1 to 3.01%. The surcharge did all the moving. Euro high yield, the index of riskier borrowers, rose 18 to 354, its highest in 52 weeks, and the US equivalent rose 17 to 340. Europe has now been the dearer of the two for three weeks running, by 14 basis points.
These numbers stop on Thursday, before oil’s jump on Friday and before Moody’s spoke on France. Anyone holding a euro corporate bond fund is being paid more than at any point this year to lend to weak borrowers. Next week’s data will tell us whether Thursday was the peak.
The Onchain Pour
Bitcoin had a remarkably quiet week while stocks lurched around it. It finished near $81,600, up 0.2%, after dipping under $80,000 the week before. Ether ended near $2,404, down 0.7%.
US spot bitcoin funds, which hold actual coins and trade on a stock exchange, took in about $301 million over the week, even though $774 million left on Thursday and Friday. Ether funds lost about $221 million, on preliminary numbers. October is on track to close below its opening price of $83,576, which would make it bitcoin’s first down month since July.
The news that mattered most for crypto came out of Washington. On Wednesday the OCC, the US bank regulator, finalised its first rule under the GENIUS Act, the law that governs stablecoins, which are digital tokens pegged to the dollar. From 18 January 2027, issuers have to publish their reserves every month. The final rule also dropped an earlier proposal that would have treated rewards paid on stablecoins by third parties as presumptively unlawful.
One more number to keep in mind. CryptoQuant data show stablecoin balances on the exchange Binance at $41.6 billion, a one-year low. That suggests traders are keeping less cash there, ready to buy.
The Week Ahead
This is a big one. Three central banks decide within three days of each other, starting with the Fed on Wednesday and finishing with the Bank of Japan on Friday. On Thursday America also publishes its first estimate of third-quarter growth and the inflation gauge the Fed targets, with the largest technology companies reporting results on either side.
A quick note on timing. Europe’s clocks went back on Sunday, but America’s only change on 1 November. So for this one week, US releases land an hour earlier in CET than usual, and the familiar 14:30 slot becomes 13:30.
Brazil also voted in its presidential runoff on Sunday. Its currency and government bonds are the first thing to check on Monday morning, and they tend to set the tone for other emerging markets at the start of the week.
Ifo business climate — Monday, 10:00:
A monthly survey of German companies about business now and over the coming six months. Consensus is 90.1 after 89.9, which was the highest since May 2023. It shows whether Germany’s slow recovery is holding.
US durable goods and consumer confidence — Tuesday, 13:30 and 15:00:
Orders for goods built to last three years or more, consensus +1.4%, then the Conference Board’s consumer survey, expected at 80.3 after 81.9. Together they show whether households and companies keep spending as fuel gets dearer.
Fed decision — Wednesday, 19:00:
The target range for the Fed’s lending rate is 3.75–4.00% after a rise in September, and futures put a hold at about 91%. The press conference at 19:30 with chair Kevin Warsh matters more, because a December rise is priced near 80%.
Alphabet and Microsoft earnings — Wednesday, after the US close:
Analysts expect profit per share of $3.00 and $4.72, on revenue of $127.8 billion and $90.8 billion. After Thursday’s chip sell-off, their spending plans are the real test.
US growth and inflation — Thursday, 13:30:
The first estimate of third-quarter GDP, forecast at 3.2% annualised after 2.2%, arrives with September’s PCE price index, the Fed’s preferred inflation gauge. That’s expected at 3.7% over the year and 3.1% for the core measure, which leaves out food and energy.
ECB decision — Thursday, 14:15:
The deposit rate, what banks earn on money left at the central bank overnight, stands at 2.50%, and a hold is priced at 97%. Euro-area inflation was 3.8% in September. There are no new staff forecasts this time, so the press conference at 14:45 carries the news.
Amazon earnings — Thursday, after the US close:
Consensus profit per share is $1.96 on revenue of $202.2 billion, the last of the big AI spenders to report this week.
Bank of Japan decision — Friday, ≈04:00:
A hold at 1.25% is expected, along with a new quarterly outlook. More than 80% of Bank of Japan watchers expect the next rise in December, and a sliding yen would bring that forward.
☕ Last Sip
Two of last week’s biggest stories rested on things nobody could see yet: damage at a Saudi port, and how many forgotten servers are still running the old PHP. Markets put a price on both anyway, and both prices will move as the facts come in.
This week the Fed and the ECB get their say, and they’ll be asked about oil first.
Have a great start to the week. See you next Monday.
Sources
Market levels from CNBC, Yahoo Finance, Trading Economics, Investing.com and Investomine; ANSA for the Italian–German gap; Kabutan and Nikkei for Japanese yields; Seoul Economic Daily and Yahoo for the KOSPI. PHP2Shell from NPR, Fortune and CNBC. Economic releases from the ONS, the National Bureau of Statistics of China, ZEW, the Bank of Korea, S&P Global and the University of Michigan. Credit and euro curve data from ICE BofA indices via FRED and the ECB Data Portal, as of 22 October, own pipeline. Weekly changes are measured against edition #13 where it stated a level. Analysis and personal opinion, never investment advice.