← All writing

US clears 500 Patriot missiles for Ukraine, but deliveries may not begin until the 2030s

Morning Brief · Monday 2 November 2026

morning-brief ai-generated

The US State Department has approved a $2.1bn sale of 500 PAC-3 Patriot interceptors to Ukraine, paid for by Canada, Germany and Norway and by EU loan money. Reporting says the new-build missiles will not arrive until the early 2030s. Kyiv wants allies to release existing stock now and be backfilled later. That leaves a wide gap between the political signal and what Ukraine’s power grid can use this winter.

Elsewhere, Britain published its defence offset policy detail and hosted Ukrainian drone makers at Larkhill. Iran’s campaign against shipping in the Strait of Hormuz has moved back to limpet mines. An open-weight AI model has been shown turning public software patches into working browser exploits. The Ebola outbreak in the DRC has passed 5,000 deaths.

Washington approves 500 Patriots for Ukraine, with delivery years away

The State Department has cleared a proposed Foreign Military Sale of 500 Lockheed Martin PAC-3 interceptors and support for an estimated $2.1bn. (BBC News, The Guardian, Al Jazeera) No US funds are involved. The money comes from Canada, Germany and Norway through the JUMPSTART programme, alongside national funds financed by the EU Ukraine Support Loan. (BBC News, The Guardian, Al Jazeera) The missiles will be newly built rather than drawn from US stockpiles. (BBC News, The Guardian, Al Jazeera)

The timing is the problem. The State Department gave no delivery schedule, but reporting says the interceptors are not expected until a couple of years into the 2030s. (The Guardian, Al Jazeera) The US Department of Defence puts current Patriot output at about 600 missiles a year. (BBC News) Lockheed won an Army contract of up to $58.6bn in July to raise PAC-3 production towards 2,000 a year by the end of 2030. (Al Jazeera) Whether it meets that target is one of the main unknowns, and a ramp-up of that scale usually runs into supply-chain limits on seekers and solid rocket motors.

President Zelenskyy welcomed the approval but said Ukraine needs interceptors now to protect energy infrastructure from intensified Russian strikes. He asked allies to hand over current inventory and take this later production as their backfill. (The Guardian) US operations in Iran and commitments to other allies have already drawn down American interceptor stocks. (BBC News, The Guardian, Al Jazeera)

This suggests the proposal is hard to accept. Any state releasing operational Patriots takes the risk itself for years, and nothing so far indicates anyone has agreed. The funding pattern also stands out: Washington licenses and approves the sale while European partners and Canada carry the cost. The approval is a commitment to future production capacity more than a near-term defence of Ukraine’s grid.

Limpet mines return to Hormuz as the shipping war passes 100 attacks

On 29 October a small craft approached the Dubai-owned tanker Louise 1 in the Strait of Hormuz and attached two limpet mines above the waterline. The blast caused an engine-room fire, according to UKMTO and the Financial Times as relayed by The War Zone. (The War Zone) The report counts 28 attacks on shipping in October, the highest monthly total on record, and 113 since hostilities began in February. (The War Zone) The brief for this story describes this as the first use of limpet mines on commercial hulls here since 2019; that comparison rests on a single outlet’s analysis.

On 1 November Iran’s IRGC Navy said two more tankers had “exploded” after hitting mines. (Reuters) The claim is unverified. The tankers’ names, flags and condition are not yet known, and the source is a short wire item reporting an Iranian statement.

The attacks came despite US Central Command having cleared the main transit channels of mines and deployed uncrewed surface vessels such as the Saronic Corsair. (The War Zone) The pattern suggests where the weakness lies. Mine countermeasures and patrol drones address mines in the water, not a boat that closes with a moored or slow merchant ship and fixes a charge by hand. Escorting every vessel is impractical at this volume.

Diplomacy is running in parallel. Foreign Minister Abbas Araghchi said Iran and Qatar have drawn up a two-day plan to reopen the strait, conditional on US concessions that have not been specified. (Al Jazeera) The five-month pattern of strikes alongside talks makes the plan hard to read, and the IRGC claims on the same day complicate it.

Britain’s offset rules: matching contract value, applied selectively

Chancellor John Healey and Defence Secretary Wes Streeting announced the policy in Glasgow on 30 October. From April 2027, foreign suppliers winning UK defence contracts of £50m or more can be required to deliver UK economic benefit equal to the contract’s full value. (BBC News, Breaking Defense, UK Defence Journal) Qualifying benefits include factories, UK supplier investment, jobs and apprenticeships, and technology transfer. (Breaking Defense) A new Offset Authority will negotiate, value and monitor obligations. (Breaking Defense, UK Defence Journal) The policy will be applied case by case to selected procurements, not universally. (BBC News, UK Defence Journal)

UK Defence Journal reports that the Norwegian frigate deal shaped the policy. (UK Defence Journal) It mirrors schemes in Norway, Poland and the Netherlands. (BBC News) The government is also negotiating a Multilateral Defence Mechanism with Finland, Poland and the Netherlands to finance joint procurement. (BBC News, Breaking Defense)

The practical questions are about valuation. Technology transfer and intangible workforce investment are hard to price, and the incentive is to over-claim them. Offsets also tend to raise bid prices, as suppliers build the cost in, and to lengthen negotiations. Breaking Defense speculates that the £1.5bn Skynet 6 Wideband Satellite System contest between Airbus and Lockheed Martin could be an early test, but whether the policy would apply to a tender already under way is not settled. (Breaking Defense) The case-by-case approach gives ministers discretion, which suits flexibility but weakens predictability for suppliers.

Ukrainian drone makers come to Larkhill; NATO’s accelerator signs its first partner deal

On 30 October, 12 Ukrainian drone manufacturers showed operational uncrewed systems to British industry, investors and military officials at Larkhill Garrison. The MOD organised the event under the UK–Ukraine 100 Year Partnership, aiming at co-development, investment and technology transfer. (Ministry of Defence (GOV.UK), Defensehere) The companies have not been named, and no joint ventures or investment sums were announced.

On the same day Ukraine’s Deputy Defence Minister Sergiy Boyev signed a memorandum with NATO’s DIANA accelerator. Ukraine’s ministry describes it as DIANA’s first agreement with a non-member partner. (Міністерство оборони України) It covers joint development, testing and funding, and a harmonised technology catalogue spanning uncrewed air and ground systems, electronic warfare and radar. (Міністерство оборони України) The funding amounts are not stated.

Both sources are official releases, so the framing is promotional. The substance is that Western procurement is trying to absorb Ukraine’s fast iteration cycle, which peacetime acquisition processes have not matched. The test will be whether export controls, certification and money turn demonstrations into contracts.

An open-weight model turns security patches into exploits

Epoch AI reports that GLM 5.3, an open-weight model released by Z.ai in August, built working exploits for all six Firefox versions tested, released between 17 September and 26 October, by reverse-engineering published patches. (Epoch AI) Once the test infrastructure existed, each version took 12 to 48 hours and about $1,000 of compute. (Epoch AI) Attacks on recent versions chained patch-derived memory bugs with an unpublished flaw, which Epoch reported and Mozilla fixed in Firefox 159.0 on 27 October. (Epoch AI) Epoch says no provider’s safeguards were triggered. (Epoch AI)

The same approach failed against Chrome despite about $100,000 of compute. (Epoch AI) Epoch does not know why. This is a single, self-reported study, and the conditions were set up by the researchers. Even so, the finding bears on a long-standing assumption: that publishing a fix before users receive it is low-risk because weaponising it needs scarce expertise. If that cost falls to roughly $1,000, shortening the gap between a public commit and a shipped update matters more. Open-weight release also means the model’s capability cannot be withdrawn or monitored.

Ebola outbreak in DR Congo passes 5,000 deaths

DRC government data show deaths above 5,000 and more than 10,000 infections since the outbreak was declared in May. (Al Jazeera) It is the country’s deadliest outbreak and the second largest ever after West Africa in 2014–16. (Al Jazeera) The cause is the Bundibugyo strain, for which no approved vaccine or treatment exists. (Al Jazeera) That matters scientifically: Ervebo and the licensed monoclonal antibodies target the Zaire ebolavirus glycoprotein, so they are not expected to protect against this species. Eight of 26 provinces are affected, and cases have been reported in Uganda, Kenya and Nigeria. (Al Jazeera) Saudi Arabia has suspended travel to and from Kenya, extending earlier restrictions on the DRC, Uganda and South Sudan. (Al Jazeera) Such bans can discourage countries from reporting cases promptly. The brief draws on one Al Jazeera report.

What to watch

  • Patriot backfill: whether any ally agrees to release existing PAC-3 stock to Ukraine, and any delivery schedule from Lockheed Martin.
  • Hormuz: identification and condition of the two tankers the IRGC claims were mined, and any detail on the Iran–Qatar two-day reopening plan.
  • Offset Authority: selection criteria and valuation method before April 2027, and whether Skynet 6 is covered.
  • Ukraine–DIANA and Larkhill: funding figures, named companies and first joint ventures.
  • Firefox/Chrome exploits: independent replication of Epoch’s results, and vendor changes to patch publication.

Read further

Morning Brief is generated automatically each morning by an AI pipeline that reads, selects and summarises news reporting. It is published unedited; every factual claim links to its source.