Security patches for the PHP programming language, widely used to build websites and web apps, are expected to roll out today, with the goal of fixing two critical vulnerabilities that could wreak havoc on the internet if left unchecked. In an advisory published on Tuesday, PHP developers said the vulnerabilities have a severity rating of 9.2 out of a possible 10, with some cybersecurity agencies encouraging websites to temporarily take their systems offline if they're unable to apply the fix immediately.

The security patch is expected to drop today at 10AM ET - though the developers say they may release it earlier if the vulnerability deta …

Read the full story at The Verge.

PARIS — Suspicious drones flew over military facilities in southeastern France earlier this month, the French navy said on Wednesday.

During a large-scale armed forces exercise that lasted from Oct. 5 to Oct. 16, “unauthorized drones were detected in the no-fly zone, near and above military sites,” the navy said in a press statement.

“In each instance, the planned security measures were activated by the deployment of anti-drone devices, in coordination with domestic security forces,” it continued, adding that a judicial investigation was opened.

Suspicious drones are increasingly spotted in several European countries including Denmark, Germany and France, close to military sites and defense industry facilities. In July, a Moldovan man was arrested on suspicion of espionage after flying an unmanned aerial vehicle over a KNDS factory in Munich. Some of these drone incursions are attributed to Russia, as Moscow intensifies its hybrid attacks against European countries.

The French navy’s statement confirms local media reporting about drone sightings around Toulon. The southeastern town is home to one of France’s largest naval bases, which hosts the country’s aircraft carrier Charles de Gaulle as well as attack submarines.

According to local broadcaster Ici Provence, the drones flew at night above the naval base, the General Directorate of Armaments facility in Toulon, and the 54th Artillery Regiment in Hyères. The military exercise, dubbed Typhon, was precisely aimed at training against drone sightings.

The navy said that no sensitive infrastructure was threatened. “The Ministry of the Armed Forces and Veterans Affairs reminds the public that unauthorized drone flights near or over military facilities are strictly prohibited,” the statement concluded.

With Washington’s support for Kyiv increasingly uncertain, Brussels is looking to its allies to help keep Ukraine afloat. The price tag: €70 billion.

On today’s show, Zoya Sheftalovich and Kathryn Carlson discuss how the EU hopes to persuade Canada, Britain and Japan to help foot the bill — and whether closer trade and defense ties could be part of the bargain.

Then, Germany’s far-right AfD leader Alice Weidel is in Strasbourg to present her vision for a radically different European Union.

And who owns your face and voice in the age of AI? As deepfakes become increasingly convincing, MEPs are pushing for new protections.

If you have a question or comment, don’t hesitate! Message us on our WhatsApp here or at +32 491 05 06 29.

Articles mentioned in this episode:

• “AfD’s Alice Weidel to unveil plan to downsize the EU.”
• “Socialists push for EU law on deepfakes.”
• “EU to press Canada and UK for more Ukraine funding.”

Ein Datenleck trifft die AfD: Hunderttausende interne E-Mails und sensible Dokumente sind plötzlich öffentlich abrufbar. Während die Partei den Vorfall herunterspielt, hoffen andere auf Enthüllungen, die der Alternative massiv schaden könnten. Pauline von Pezold, Co-Host von „Inside AfD“, ordnet ein, wie gefährlich dieser Akt des „Hacktivismus“ für die Partei wirklich werden kann.

Brennende Barrikaden in Frankreich wecken im Bundesinnenministerium die Sorge vor einem Überschwappen der Gewalt nach Deutschland. Rasmus Buchsteiner hat den Überblick, wie sich die Sicherheitsbehörden auf die bundesweiten Gen-Z-Proteste Ende des Monats vorbereiten und wo die Unterschiede zur französischen Protestkultur liegen.

Im 200-Sekunden-Interview erklärt Juso-Chef Philipp Türmer, warum er die Anliegen der Schülerproteste unterstützt, aber vor einer Unterwanderung durch radikale Kräfte warnt.

Das Berlin Playbook als Podcast gibt es jeden Morgen ab 5 Uhr. Rixa Fürsen, Maximilian Stascheit und das POLITICO-Team liefern Politik zum Hören – kompakt, international, hintergründig.

Für alle Hauptstadt-Profis: Der Berlin Playbook-Newsletter bietet jeden Morgen die wichtigsten Themen und Einordnungen. Jetzt kostenlos abonnieren.

POLITICO Deutschland – ein Angebot der Axel Springer Deutschland GmbH
Axel-Springer-Straße 65, 10888 Berlin
Tel: +49 (30) 2591 0
information@axelspringer.de
Sitz: Amtsgericht Berlin-Charlottenburg, HRB 196159 B
USt-IdNr: DE 214 852 390
Geschäftsführer: Christoph Eck-Schmidt, Carolin Hulshoff Pol, Mathias Sanchez Luna

LONDON — Labour swept to power with a big, expensive promise: to create a government-owned energy company, hand it billions to invest in British renewables, and watch it grow, eventually, to rival other state-owned energy giants. 

Two years on from the foundation of Great British Energy, that isn’t what has happened. 

Analysis from POLITICO shows billions of pounds from its budget have been redirected to schemes not included in GBE’s initial remit, stripping away some of the cash earmarked for costly, large-scale renewable energy projects like wind and solar. Those funds are being used instead for very different purposes, like planning new nuclear schemes and reviving Britain’s creaking electricity grid. 

Set up by then Energy Secretary Ed Miliband, the government backed GBE with £8.3 billion of fresh funding. Its purpose at the time seemed clear. “Great British Energy will own, manage and operate clean power projects,” Miliband pledged, “and generate energy in its own right.” 

Labour officials familiar with GBE plans told POLITICO in 2024 local projects would get around £3 billion of its total budget, while the rest would go on helping the company establish itself in the market, including by taking stakes in wind and solar projects. 

Yet now experts can’t agree on what, exactly, GBE is for. 

How to spend it

Miliband’s GBE pitch to the public was ambitious.  

The company would allow Britain to become a bigger player in its own clean energy market in Labour’s dash to hit green goals, he said. Referencing huge state-owned companies in Denmark and France, he told Channel 4 News weeks after the election that GBE was “not going to become Ørsted or the generation arm of EDF overnight. But that is the long-term vision.” 

Soon after GBE passed into law, though, former Chancellor Rachel Reeves reassigned £2.5 billion of its budget to help developers design small-scale nuclear power plants and prep sites where those mini-nukes will eventually go.

The government also scaled back its funding for those local, smaller-scale projects, which include getting solar panels onto school and hospital roofs. The mooted £3 billion for GBE’s Local Power Plan became just £1 billion when more details were announced this February. 

GBE has set aside another £1 billion to build up clean energy supply chains.  

And that’s all before Prime Minister Andy Burnham used Labour’s annual conference to pledge another whack of GBE’s budget to a totally new venture: Great British Grid. 

Enter GB Grid  

In a bid to put his own stamp on Miliband’s pet project, Burnham announced that the new unit would sit within GBE, using some of its budget to speed the build out of Britain’s creaking grid network.  

GB Grid will invest alongside existing grid operators in a bid to cut costs, Energy Secretary Miatta Fahnbulleh said last week, at a time when the grid regularly struggles to handle the levels of power being generated by developers. 

Energy experts are torn over whether GB Grid, in particular, is a smart pivot for the government — but acknowledge it is not the same thing Miliband promised to deliver.  

“I think the focus has shifted, but I don’t think that should be seen as a problem,” said Joshua Emden, a senior research fellow at the Institute for Public Policy Research think tank. 

GB Grid would have access to £4 billion of GBE funding, according to media reports published at the time of Burnham’s announcement, although officials from the Department of Energy Security and Net Zero insist they “don’t recognize” that figure. 

It is still enough for Kemi Badenoch’s Conservatives to pile the pressure on ministers to explain why their plans have changed. 

“Taking half the GB Energy budget and putting it into a venture that was only announced a few weeks ago leads to the obvious question of: What actually is GB Energy for? And does the GB Energy of today bear any resemblance to what the government envisaged in July 2024?” asked Shadow Energy Minister Harriet Cross. 

Doubters and defenders  

Some energy industry officials are doubtful that setting money aside for grid investment is the best use of public cash.  

“If it does that last mile [of grid] to a data center, if it helps where there isn’t actually any program or plan, [then] fine. We’re not going to say: ‘No, don’t spend it on making the grid better,’” Dhara Vyas, chief executive of the industry group Energy UK, told a panel at Conservative Party Conference earlier this month. 

But transmission operators — who run the network — are already spending tens of billions on the grid, she said. “The energy transition will be paid for by the private sector.”  

GBE “made a slow start and has focused on low-impact activities, important though they are,” said Bill Esterson, a Labour MP and chair of parliament’s Energy Security and Net Zero Committee. Creating GB Grid, he argued, “suggests a shift in emphasis to build what the country needs where the network companies are not delivering.” 

The pivot “makes sense as an efficient use of government money,” argued IPPR’s Emden, if there’s a choice between investing in power generation — where there’s competition between providers — and in the grid where private networks have a “total monopoly.” 

GB Energy has “the foundations now to create something genuinely useful,” argued one government figure. “Politicians of all stripes should give it the space to get on with the job.”  

A spokesperson for DESNZ said “securing new homegrown energy and building a grid fit for the 21st century work hand in hand. Great British Grid will bring public and private investment together, helping to build the infrastructure Britain needs.” 

Additional reporting by Nicholas Earl.

In a throwaway comment this week, Donald Trump made clear that he does not regard the war in Ukraine as a conflict with fault on both sides. “Russia frankly has been fine on Ukraine,” the U.S. president said. “They have not been doing that much.”

To residents of Kyiv — who have endured weeks of intensifying bombardment — and Ukraine’s allies across Europe, the remark confirmed a growing impression that the U.S. is taking Russia leader Vladimir Putin’s side in the war.

“American negotiators have been trying to push Ukraine into surrender for already almost two years,” the EU’s top diplomat Kaja Kallas told the European Parliament on Tuesday. The reason Ukraine hasn’t “surrendered on Putin’s terms” so far is because Europe has been providing so much support, she added. 

As they scratch their heads for explanations for Trump’s latest turn against Ukraine, some European officials and diplomats think it comes down to the president’s personal preferences, as much as his country’s political aims.

“I do think it’s a personal thing,” said former British Cabinet minister David Lidington, now distinguished fellow at the Royal United Services Institute, a leading security think tank in London. “Trump is self-centered — his personal predilections for dictators and autocrats, his desire to give opportunities to U.S. businesses … are very important parts of his motivation.”

In private, EU officials agree. “Trump doesn’t like [Ukrainian President Volodymyr] Zelenskyy. He just doesn’t like him,” said one government official who has observed both men closely. “That makes it harder to get the U.S. to help on peace. Everything is a rational business deal with Trump, until it’s not.” 

A diplomat from an EU country — granted anonymity, like others in this report, to discuss sensitive matters — said the inconsistent Trump could change his mind again and reverse recent moves against Ukraine. The U.S. president has chopped and changed on many issues, “except one thing,” the diplomat said. “He seems to be supportive of the Russians.”

“He’s been critical of Ukraine, the EU, NATO, but hardly ever said anything critical about Putin. It is striking. We have to deal with an administration that seems to be more pro-Russian than anything else,” the diplomat said.

The White House didn’t immediately respond to a request for comment.

Mounting losses

For Ukraine and its European allies, the idea that nothing can or will change Trump’s feelings about Zelenskyy is a bleak one. After four-and-a-half years of war, Kyiv is running low on funding, air defenses and — amid swelling support for Europe’s populist right — facing a potential loss of political support in the months ahead. 

Trump’s envoy Steve Witkoff met the Ukrainian president and the leaders of Norway and Finland for talks in Oslo on Tuesday, and will head to St. Petersburg to discuss peace proposals with the Russian leadership on Wednesday as the White House pushes hard for a ceasefire. One option Putin will be offered is a three-way leaders’ summit with Trump and Zelenskyy.

Previous efforts to get the Russian president to attend such a meeting have failed, however, and EU diplomats do not believe Putin is showing any genuine desire for a ceasefire. That is partly what makes Trump’s hostility toward Zelenskyy so problematic.

“There is a clear consensus across Europe that Putin does not want peace,” a second EU diplomat said. “He will need to be forced into peace.”

But instead of making demands of Putin, Trump has ratcheted up his pressure on Zelenskyy, even amid escalating Russian attacks on Ukrainian cities this month. Ukraine’s leader is feeling the strain, as he told his EU counterparts in private meetings in Brussels last week, according to the first diplomat.

In a succession of highly critical comments in recent days, Trump has said Zelenskyy “doesn’t care” and “doesn’t want to end this war;” and should be replaced as leader or as Ukraine’s negotiator. “President Putin would like to see a settlement,” Trump said. “President Zelenskyy could have solved this war, or he could have made a deal, many times.” 

The Oval Office beating

Trump’s animosity may date back to an incident during his first term in 2019, when he urged the Ukrainian leader to help with an investigation into Joe Biden, who eventually defeated Trump in the following presidential election, Lidington said. A succession of hostile encounters in the years since — including in the Oval Office in February 2025 — have reinforced the impression, he said. 

“It was clear that in the infamous meeting in the White House that Trump and [Vice President JD] Vance had planned that public beating-up of Zelenskyy and it struck me then that there was a strong personal element to this,” said Lidington.

“I think there’s another element, which is that if you look at the people Trump tries to court, it tends to be autocratic strongman — and it is ‘man’ — leaders,” Lidington said.

He recalled attending a dinner with world leaders in 2018 to mark the centenary of the end of World War I in Paris. French President Emmanuel Macron and the German chancellor at the time, Angela Merkel, were playing joint hosts “at the top table,” but Trump was not interested in making small talk with either of them, Lidington said.

“It was pretty obvious from the body language that Trump was impatient with them and one of the people he really wanted to talk to was [Turkish leader Recep Tayyip] Erdoğan and other people who were a bit more in that strongman image that he likes to portray himself,” he observed.

‘Strange stories’

A senior official from a European country familiar with the Ukraine talks said Trump’s motives were partly political, partly about calculating what would be profitable and partly about personalities.

“They are currently in an election cycle and need someone to blame for rising prices,” the official said. “In general, Trump tends to like various types of people and leaders. He actually has a fondness for successful and cheerful people.”

In recent days, Zelenskyy has warned his country is suffering more civilian casualties because the U.S. has cut back on support, including Starlink and Starshield services that help Ukraine defend itself against Russian attacks and plan operations. “We still have no explanation for this, just different strange stories,” Zelenskyy told U.S. congressmen on Monday.  

This month, the advanced warnings of incoming Russian missile attacks from U.S. partners have failed to come through as normal. Ukraine is also running low on Patriot missile interceptors, he said. 

The Pentagon has not issued an official comment on the Ukrainian complaints. The U.N. Human Rights Monitoring Mission in Ukraine said 328 civilians were killed and more than 2,000 wounded across Ukraine last month, an 85% increase compared to September 2025. The U.N. said that the first two weeks of October were among the deadliest for civilians in Ukraine in years, driven by increased missile and drone strikes.

The first EU diplomat quoted above said many European governments were irritated that Trump had cut them out of his conversations with Putin so far. “There is probably much more dialogue between the Americans and the Russians than we might know,” the diplomat said. 

Tuesday’s meeting with Witkoff in Norway raised the possibility that direct engagement with Putin might be back on the cards, for Zelenskyy at least. 

“Today was a good day for peace,” Finland’s President Alexander Stubb said after attending the talks in Oslo. “On a substantive and technical level we have actually made a lot of progress under the radar in the past week or so,” Stubb said.

The process is now going in the right direction again, he added. “Hopefully, we don’t do any backtracking.”

U.S. special envoy Steve Witkoff will offer Vladimir Putin direct talks with President Donald Trump and Ukraine’s Volodymyr Zelenskyy in an effort to secure a ceasefire.

The proposal for three-way leaders’ negotiations on a peace proposal, the first such summit since Russia’s full-scale invasion of Ukraine began in 2022, was announced at a press conference Tuesday after talks in Norway between Zelenskyy and Witkoff.

Norwegian Prime Minister Jonas Gahr Støre, who hosted the talks, said Witkoff will travel to Russia Wednesday and set out proposals for peace terms, including the idea of a three-way summit between the leaders. The meeting in Oslo came after days of high tensions between Ukraine and the U.S. president.

“We have hosted today, I would say, good and constructive talks — necessary after events of the last week,” Støre told reporters after the meeting. “Steve Witkoff will fly tomorrow to St. Petersburg where he will be meeting with Russian leadership and exchange ideas from this meeting and the proposals that have been worked on by European and American colleagues, and possibly pave the way for a meeting at leaders’ level.”

Previous attempts to get Putin to meet Zelenskyy in person have fallen flat, with the Kremlin recently insisting a meeting could only take place in Moscow.

Zelenskyy told the press conference that the day had been positive. He said issues around the future of Ukrainian territory could only be discussed by leaders and that any peace settlement would require genuine security guarantees. A deal would only be acceptable if Ukraine is involved in designing it, he said.

Meta says it paused a Muse feature that lets you share conversations with the AI assistant after researchers found the URLs publicly available on the web, as reported by Ars Technica. In a report published this week, researchers at the security firm Claroc say they found more than 6,800 Muse links through public DNS records.

"People have the ability to share specific Muse artifacts, which creates a page that can be accessed by those with the link," Muse spokesperson Tracy Clayton says in an emailed statement to The Verge. "However, we've paused this functionality while we review this report and consider changes to how these links can be dis …

Read the full story at The Verge.

Google is launching a new browser safety feature for Chrome that aims to keep you better informed about how malicious a website might be before you open it. The new suspicious site warnings, available when Chrome's Enhanced Protection is on, build on a similar two-stage system introduced for Chrome file downloads in 2024, which provides visually different notifications for blocked files based on whether they're determined to be "suspicious" or "dangerous."

For the Chrome site warnings, the feature will flag a website as suspicious if it detects that it has similar qualities to other sites associated with phishing, malware, and scams. Google …

Read the full story at The Verge.

Romania ended five months of political paralysis Tuesday with its parliament voting in Luca Niculescu as prime minister after three failed attempts to form a government — but the deal comes with a six-month deadline for the parties to strike a more lasting agreement.

The threat of snap elections, which would likely see the populist right-wing Alliance for the Union of Romanians (AUR) party surge, helped push the center-right National Liberal Party (PNL) and the center-left Social Democrats (PSD) to agree on a government led by independent Niculescu, a former journalist and diplomat who was nominated as prime minister by moderate President Nicușor Dan earlier this month. The socialists will join the cabinet, but the liberals will stay out.

Romania has the sixth-largest population in the EU and plays a critical role in NATO’s defense of southeastern Europe as home to a major military base and a U.S. missile shield site. The country has been plagued by political instability and a mushrooming budget deficit in recent years, fueling a surge in support for hard-right nationalist politics. 

The new deal keeping the government afloat expires in six months, and parties will need to renegotiate the pact with no agreement yet on what comes next.

During this period, the Social Democrats will try to pass an investment-focused 2027 budget by the end of November, steering Bucharest away from austerity, party leader Sorin Grindeanu told POLITICO Playbook Capitals in an interview.

“Romania needs an economic recovery plan, not austerity,” he said. “Our priorities are protecting purchasing power and supporting business, restarting public investment, and improving essential public services.” Grindeanu added that he aims to revise the 2026 budget by the end of October and to fast-track implementation of EU projects to unblock funds.

The Social Democrats in May teamed up with AUR to topple the coalition government led by centrists and centre-right liberals, as unpopular debt-cutting reforms drove Social Democrat voters toward the populist right. PNL and USR have refused to govern with the Social Democrats again.

The formation of the new government makes snap elections harder to trigger once the six-month deal expires, as Romania’s constitution requires two failed attempts to install a government before Parliament can be dissolved.

Grindeanu hopes to persuade his former coalition partners to reunite in six months, but with a different economic program. Fearing an uptick in support for the far right, he wants to avoid further cuts.

But the pivot away from austerity puts him at odds with the PNL, which has defended fiscal restraint. The PNL refused to sign a detailed coalition program, Grindeanu said, forcing the administration to cobble together support vote by vote over the next six months.

Grindeanu distinguished between parliamentary votes and lasting alliances, and said he won’t seek a pact with AUR, citing deep disagreements over Europe and national security. He said he rejected an offer from AUR to back a €300 million social spending package during negotiations over the 2026 budget, after the far-right party demanded PSD’s support on another, unspecified issue in return. Instead, he waited to find a compromise with PNL.

“Until I will stay in this position, PSD will not have any agreement with AUR,” he vowed.

A hacker broke into more than 100 websites using an army of AI agents that mostly operated on their own, according to findings from the AI security firm Norforge. Though Norforge doesn't name the targets, Reuters reports that the victims included companies like John Deere, SharkNinja, and Cummins.

Concerns over AI-powered cybersecurity breaches have grown as the technology grows more advanced, with hackers using the tools to carry out large-scale attacks. At the same time, rogue AI agents are carrying out attacks of their own after escaping from testing environments.

Researchers at Norforge uncovered the attacks through exposed work on Cai …

Read the full story at The Verge.

LONDON — The British and Polish governments have criticized U.S. Defense Secretary Pete Hegseth, after he appeared to downplay the role fellow NATO members played in the Afghanistan war.

No.10 Downing Street joined Polish Foreign Minister Radosław Sikorski in pushing back at Hegseth, who told an audience at the University of Tennessee over the weekend that few NATO allies were “actually involved in kinetic operations.”

“I was a captain in Afghanistan and we would go to the headquarters in Kabul and there would be 50 flags at the headquarters,” Hegseth recalled. “It was a beautiful thing to see, 50 different countries contributing to the NATO alliance and the ISAF [International Security Assistance Force] mission there.”

But he added: “Except there were maybe five that contributed. It was actually closer to one or two that by the end were actually involved in kinetic operations. In fact the patch ISAF, we joked it meant ‘I Saw Americans Fighting’.”

All of NATO’s then-28 members participated in the U.S.-led war in Afghanistan, after the alliance invoked Article 5 of the North Atlantic Treaty – NATO’s collective defense clause – on September 12, 2001, a day after the terrorist attacks that took place on 9/11.

It remains the only time the article has been invoked in alliance history.

Asked about his comments Monday, U.K. Prime Minister Andy Burnham’s official spokesperson pointed out that “thousands of British and allied families made huge sacrifices to play their significant part in that war and uphold our values,” while “more than 450 British personnel never returned.”

“Their sacrifice and that of other NATO forces was made in the service of collective security and in response to an attack on our ally,” he continued.

“We are incredibly proud of our armed forces, and their service and sacrifice will never be forgotten. And it is wrong to diminish their role.”

Sikorski said in a social media post Sunday that Hegseth should repeat his comments “to the families of 44 Polish soldiers who died who died securing the tough Ghazni province.”

It’s not the first time fellow NATO members’ contribution to the Afghanistan war has been question by the U.S. government.

U.S. President Donald Trump triggered anger in London in January after he said non-American forces “stayed a little back, a little off the front lines” during the war.

Donald Trump’s latest moves on Russia and Ukraine have alarmed Kyiv and European capitals alike. But rather than scrambling to contain the fallout, EU leaders are keeping their cool. Zoya Sheftalovich and Nick Vinocur explore Europe’s strategy for weathering Trump’s midterm storm — and what it means for Ukraine.

Then, France reels from a weekend of violent protests, with more than 1,800 arrests and widespread destruction. As political leaders trade accusations, we look at how the unrest is shaping the battle ahead of the 2027 presidential election from Paris.

Plus, hackers turn supermarket fridges into heaters, exposing some surprisingly basic cybersecurity vulnerabilities.

If you have a question or comment, don’t hesitate! Message us on our WhatsApp here or at +32 491 05 06 29.

BRUSSELS — NATO is beginning talks this month on the forces and weapons allies would need to defend against a Russian attack — and how they would pay for them.

The talks will set capability targets for 2029, requiring each of NATO’s 32 member countries to provide specific forces and equipment.

The deadline raises the stakes: European officials have warned that Russia could be ready to attack a NATO country by then.

At the same time, the Trump administration is weighing a sharp reduction in U.S. forces in Europe, which could leave the alliance short of troops and critical capabilities with fewer like refueling aircraft, long-range missiles and intelligence, surveillance and reconnaissance assets.

The negotiations will test how much each country is willing to spend, how much Europe can do without the U.S. and whether NATO’s military plans should make greater use of technologies such as robotics and artificial intelligence.

“It’s going to be tough,” said one senior NATO diplomat, who, like others, was granted anonymity to speak freely on the sensitive issue. “Burden sharing, the U.S., how to combine the level of ambition with political priorities … it’s huge.”

NATO allies will begin discussing the broad mandate for the new targets — known as Political Guidance — in the coming days. It’s the first step in a five-part effort called the NATO Defence Planning Process.

“The ambition … is for this to be a transformation cycle and not one that’s just off the shelf,” said French Adm. Pierre Vandier, NATO’s Supreme Allied Commander Transformation and the alliance’s chief for future warfare.

POLITICO spoke to 15 current and former NATO officials and diplomats to get a sense of the five key debates likely to define the negotiations.

1. Deciding on ambition

The most significant issue will be deciding exactly how many troops and military capabilities allies want to provide — known as the level of ambition.

Historically, NATO allies have agreed that beyond the forces needed for major operations, they should have 18 spare brigades — each a unit of about 5,000 soldiers — to carry out smaller crisis-management missions outside alliance territory, like Afghanistan or Kosovo.

But U.S. pressure to hand off more security responsibility to European allies — dubbed NATO 3.0 — could put pressure on allies to reduce or even eliminate requirements for any smaller operations.

Discussions will also cover whether to speed up the process itself in future in response to the furious pace of battlefield innovation, from AI to ground robots. 

Allies are also likely to tackle how to provide conventional military support — like ground troops or aircraft — to nuclear-armed countries like the U.K. and U.S.

“Conventional support … capabilities are absolutely part of the NDPP process,” said Nassima Barrows, NATO’s nuclear policy director, “so that is one of the big messages that we underline as a part of the next [negotiations].”

2. Filling the American gap

Looming over the talks is the Pentagon’s upcoming review of American forces in Europe. Washington earlier this year already pulled assets like strategic bombers, fighter jets, drones, submarines and warships from the pool of forces NATO can draw on.

The review lands in December, midway through the NATO talks, prompting concerns it may delay negotiations. There are worries that the U.S. could pull out assets Europe needs, like heavy transport aircraft.

Washington’s drive to curb its military presence in Europe will set off a scramble among allies to replace its capabilities. That will open discussions on how to share the burden fairly, likely to be very difficult as national budgets are increasingly squeezed.

“Not so long ago, the whole NATO process was … you do the math on what NATO needs, and then when you realize you don’t have everything, the U.S. fills in the gaps,” said Camille Grand, head of the ASD defense lobby and a former senior NATO official. “This is no longer the case.”

One way to tackle that is to shift away from specific weapons requirements to assigning objectives to countries, such as having their forces eliminate Russian command outposts. That could create more flexibility for European allies to who can’t access U.S. weapons like Tomahawk cruise missiles.

“We don’t have to have thousands of Tomahawks … but we can have thousands cheaper, low-cost alternatives,” said Fabrice Pothier, a former NATO policy planning director who is now CEO of the Rasmussen Global consultancy.

3. Regional divides

The focus on Russia is likely to cause friction with allies worried about other threats.

On paper, NATO espouses a “360-degree” approach to security. In practice, the alliance’s focus has shifted eastward since Russia’s full-scale invasion of Ukraine in 2022, and northward in the past year as it set up an Arctic mission (largely in response to pressure from Donald Trump over Greenland).

Some allies would like to see more attention given to the alliance’s southern and southeastern flanks. Issues include Russian mercenary presence in Libya, the potential for weaponized migration and increased submarine activity, alongside drone attacks on vessels in the Black Sea.

“There is too much north,” said a second NATO diplomat. “We should reset.”

4. More drones or more tanks

The drone warfare dominating the frontlines in Ukraine is likely to force a debate on the balance between adding unmanned capabilities and continuing to build up conventional military equipment like tanks and artillery.

Most allies are making plans to increase their use of unmanned systems.

The U.K. this year announced a “hybrid fleet” that leans on autonomous vessels like Type 93 uncrewed underwater vehicles. France has earmarked roughly €8.4 billion for drones and loitering munitions while Germany is establishing its first dedicated drone regiment next year.

Europe’s difficulties in recruiting soldiers also feed into the debate, said Grand. “One thing that is driving everybody in the direction of more unmanned [systems] is we have aging societies — we have a manpower issue.”

Countries also have to figure out how to match Russia’s technological developments without breaking national defense budgets.

Vandier said Russia produces 9 million drones a year, a figure that requires a “pretty radical effort” from the alliance. He suggested one fix could be a subscription-style model for hardware updates to keep weapons systems from becoming obsolete.

5. Learning from Ukraine

Most NATO allies agree that Ukraine contributes to their security thanks to its large and battle-hardened military and its rapid technological developments in air, sea and ground drones, air defenses, missiles, and its advanced Delta battlefield management system.

That has some countries calling for closer military and industrial cooperation, even as others urge caution because the war in Ukraine is different from NATO’s doctrine, which calls for rapid-maneuver warfare, air superiority and standoff precision strikes.

“There are tremendous lessons from the conflict that we need to capture,” NATO’s top commander, U.S. Gen. Alexus Grynkewich, told the European Parliament earlier this month. But “we do not want to fight that kind of war.”

The cyberattack last week that hit hundreds of French supermarket refrigerators had Europeans wondering if the nonstop warnings about AI risks had finally landed in the real world.

They hadn’t — at least, not yet.

Experts say the attack, which forced hundreds of retailers to throw away defrosted food and spoiled milk, was mostly a reminder of the importance of old-school cybersecurity in safeguarding essential goods and services.

The attack is a “typical example” of how “low-key cyber-enabled sabotage can affect very crucial supply for society,” said Ferdinand Gehringer, hybrid threats lead at FTI Consulting. 

It’s arguably the most consequential hack in the European Union this year, with tangible, disruptive real-world repercussions. France’s Prime Minister Sébastien Lecornu personally managed the fallout, which prompted coordination and information-sharing at the EU level. 

The perpetrators, whose identity and motives are currently unknown, hacked into digital systems to remotely raise the temperature of refrigerators in supermarkets including Intermarché and Carrefour.

One cybersecurity expert working with Lecornu’s office said the French government held meetings after the attack to try to map all the potentially affected sectors, beyond supermarkets. “We’re in the middle of the flu vaccination campaign,” he said, referring to vaccine storage, which also relies on temperature control solutions, though no such attacks have been registered.

To add to the fear and confusion, supermarkets in the Netherlands and Belgium experienced unrelated cyber incidents that same week. Though there was limited impact in those cases, they were a good example of “how big our reliance is in the food supply chain on IT and network systems,” Dutch food security minister Silvio Erkens told POLITICO. 

The attacks come after citizens and policymakers have spent months being bombarded with warnings about scenarios in which unpredictable advanced artificial intelligence models escape human control.

While most good and bad actors on the internet are increasingly using AI models to increase speed and capacity, cyber experts say the hackers in question in the French case most likely used traditional methods to take advantage of devices needlessly exposed to the internet.

Connecting devices to the internet in this way is “an old-fashioned bad practice,” said Amir Preminger, chief technology officer at Claroty, a cybersecurity company that identified a software flaw in a product made by Danfoss, one of the refrigeration companies targeted by the French hacks. Danfoss fixed that flaw in 2025. 

Food systems

The attacks come at a time when Europe’s food security is already under considerable pressure due to geopolitical insecurity and climate change. The continuing disruptions in the Strait of Hormuz are pushing up fuel and fertilizer prices at a time where farmers struggle with the fallout of extreme drought that caused lower yields in many parts of Europe. These problems are compounded by the blockade of the Black Sea which is fueling the rise of global food prices.

“It is very serious that cyber criminals attack our food systems,” said Else Groen, director general of trade body Independent Retail Europe. She nonetheless stressed that food supply chains are resilient, which reduces the chances that consumer food supply would be endangered — even if such attacks are already a “major blow” for retailers operating on razor-thin margins.

The incidents bring to the fore a long-running problem with so-called operational technology, meaning industrial devices with physical outputs, like refrigeration systems. Critical sectors are packed with these kinds of devices, many of which are old, poorly protected, unnecessarily connected to the Internet, or some combination of the three. They’re also obscure and sometimes forgotten, despite the ramifications if they’re tampered with.  

And last week’s problems are far from solved. French and German cyber authorities warned that attacks were probably still ongoing, and the Greek cyber agency and an industry tracker said after the attack that there were hundreds of devices still connected to the internet.

Preminger too said there are still devices exposed, though he added that the number is declining, and not all are necessarily vulnerable to attack. Another research group found that the number of exposed Danfoss devices had significantly decreased.

Finding a fix

What’s changed with the widespread diffusion of advanced AI models is that cyber attacks are now faster and easier to replicate. Claroty reproduced the original flaws in Danfoss products in 28 minutes at a cost of $6, it said. 

In broad terms, AI makes it easier to carry out many types of cyberattacks and enables attackers to pounce on software flaws more quickly. Financially motivated cybercriminals — who have already spent years extorting businesses and disrupting essential services like hospitals — can use AI to simultaneously launch attacks on multiple targets.

Though the motive for the attacks on French supermarkets remains unknown, it is notable that there was no reported attempt at extortion. The strike did come as Russia ramps up its campaign of hybrid warfare against Europe, and senior EU and European leaders have consistently warned that Moscow could use cyberattacks to disrupt real-world services. Beyond food supplies, AI-enhanced targeting could be aimed at banking, hospitals and the functioning of the internet itself.

Still, these fears of bad human actors using AI should be distinguished from the science-fiction scenarios pushed by so-called AI doomers, in which bots themselves are motivated and able on their own to wipe out humanity.

Digital security experts, including the EU’s own in-house cyber team, are also turning to AI for defense. But it’s not a silver bullet, said Rémi Enjolras, a chief technology officer at Splunk, part of Cisco. Critical industries need to stop “seeing AI as a magical tool that will solve everything and go back to the fundamentals,” he said.

The EU has passed laws intended to force critical industries and product manufacturers to get those fundamentals right. But France, for example, is lagging in implementing such national regulations, and there are few other incentives to get companies to do that difficult and costly work.

Still, the images of empty supermarket shelves could provide a new incentive. “It should serve as a kind of a wake-up call,” Enjolras said.

Émile Marzolf contributed to this report.

90 Prozent des weltweiten Warenhandels laufen über die Meere und genau dort attackiert Russland die westliche Sicherheitsarchitektur. Was oft als harmlose Nadelstiche abgetan wird, entpuppt sich im Schwarzen Meer und in der Ostsee als gezielte hybride Kriegsführung. Wenn Handelsschiffe ins Visier geraten und globale Lieferketten reißen, schlägt das direkt auf die deutsche Wirtschaft und die Preise an der Zapfsäule durch. Darüber spricht Rixa Fürsen mit dem Experten für maritime Sicherheit, Dr. Moritz Brake, in dieser Ausgabe.

Deutschland ist als Exportnation extrem abhängig von sicheren Seewegen, leistet sich aber die kleinste Marine aller Zeiten. Bracke analysiert, warum die deutschen Streitkräfte bei der Abwehr von russischen Schattenschiffen und Sanktionsbrechern rechtlich oft machtlos sind. Wie lässt sich diese eklatante Lücke schließen, bevor die nächste Eskalationsstufe erreicht ist?

Die Illusion der absoluten Sicherheit ist vorbei. Diese Episode zeigt auf, warum der Ruf nach gesellschaftlicher Resilienz mehr ist als nur ein politisches Schlagwort. Ein Blick nach Schweden offenbart, wie sich eine Bevölkerung mental und praktisch auf Krisen vorbereitet und warum die Zeiten der Rundum-sorglos-Mentalität endgültig der Vergangenheit angehören.

Das Berlin Playbook als Podcast gibt es jeden Morgen ab 5 Uhr. Rixa Fürsen, Maximilian Stascheit und das POLITICO-Team liefern Politik zum Hören – kompakt, international, hintergründig.

Für alle Hauptstadt-Profis: Der Berlin Playbook-Newsletter bietet jeden Morgen die wichtigsten Themen und Einordnungen. Jetzt kostenlos abonnieren.

POLITICO Deutschland – ein Angebot der Axel Springer Deutschland GmbH
Axel-Springer-Straße 65, 10888 Berlin
Tel: +49 (30) 2591 0
information@axelspringer.de
Sitz: Amtsgericht Berlin-Charlottenburg, HRB 196159 B
USt-IdNr: DE 214 852 390
Geschäftsführer: Christoph Eck-Schmidt, Carolin Hulshoff Pol, Mathias Sanchez Luna

**(Anzeige) Eine Nachricht von YouTube: Die Auffindbarkeit von Qualitätsjournalismus ist entscheidend für eine lebendige Medienlandschaft. 79 % der Medienunternehmen, die YouTube nutzen, an, dass digitale Videoplattformen ein wichtiger Vertriebskanal sind, so Oxford Economics. Und 81 % der Medienunternehmen mit YouTube-Kanal erreichen darüber weltweit neue Zielgruppen. Hier klicken und mehr erfahren.**