On Wednesday, Meta was ordered to pay New Mexico more money than it has ever been ordered to pay anyone. A few hours later, it told investors it had taken in $64.6 billion in three months, more than the top of its own forecast. According to the Associated Press, Meta’s shares were trading about 2 percent higher after the penalty was announced.

Neither number is what it looks like, and the gap between them is today’s story.

The judgment. A First Judicial District judge in Santa Fe ordered Meta to pay $25 billion in civil penalties. In September a jury had found that Facebook made 26 false or misleading statements about user privacy. Those included promises that users controlled how advertisers reached their data, and a pledge to stop outside apps from taking friends’ data. The case grew out of the Cambridge Analytica scandal, in which a personality quiz harvested data from roughly 87 million profiles. Jurors counted more than 43 million violations of the state’s Unfair Practices Act. At the statute’s $5,000 maximum per violation, that came to about $219 billion.

In a 20-page opinion, the judge wrote that the record supported the maximum penalty. He called Facebook’s misrepresentations “a systemic pattern of deception at the core of Facebook’s business model.” He then cut the penalty by almost 90 percent. Courthouse News reported that the opinion does not explain how he reached $25 billion. The state had asked for $35 billion to $40 billion. Meta had argued it should pay no more than $3.4 billion, and that a sum ten times that would violate due process.

Meta’s chief legal officer, C.J. Mahoney, said the ruling makes it “all but impossible to do business in the state of New Mexico.” He called the lawsuit “a tax on speech.” Meta will appeal. Under New Mexico’s constitution, consumer-protection penalties go to education. “We may have paid for the construction of schools for the next 100 years,” Attorney General Raúl Torrez said. He also acknowledged that the money will be tied up during the appeal. Interest accrues in the meantime. An appeals court could also reduce the violation count on which the whole sum rests.

So a $25 billion judgment is not a $25 billion payment. Today it is a claim and a timeline.

The quarter. Meta’s third-quarter release, published the same afternoon, gives investors something else to look at. Revenue was $64.60 billion, up 26 percent from a year earlier. Advertising supplied $63.06 billion of it. Meta booked a $9.89 billion charge for its August agreement with state attorneys general over harm to teenagers. That is a separate matter. New Mexico stayed out of the multistate deal to pursue its own case. The charge cut operating income 37 percent, to $12.99 billion, and halved the operating margin to 20 percent. Without it, Meta says, diluted earnings would have been $7.40 a share rather than $3.83.

Ignore the 264 percent jump in net income. A year ago Meta took a one-time $15.93 billion tax charge, and almost any normal quarter beats that.

The detail advertisers will notice is price. Meta delivered 10 percent more ad impressions and charged 14 percent more per ad. In the U.S. and Canada, prices rose 23 percent. Impression growth was the slowest in the five quarters Meta charted. The company is growing less by showing more ads than by charging more for its feeds. It guided fourth-quarter revenue to $73 billion to $76 billion.

The arithmetic. The New Mexico penalty equals about 39 percent of one quarter’s revenue. It is nearly twice this quarter’s reported operating income. Measured against operating income before the teen-settlement charge, it is slightly more than one quarter’s worth. That is a serious number. The positive net price move does not show which item investors emphasized or what they expect on appeal.

The August multistate agreement has been reported as requiring up to approximately $18.59 billion in cash and other consideration, plus new child-safety measures. Meta’s $9.89 billion charge for it is a different number, and the materials we reviewed do not explain the gap. Readers should not assume the difference is free. They also should not assume all of it is cash leaving this year.

What it establishes. A New Mexico jury found, and a judge affirmed, that Facebook systematically misled people about who could see their data. Meta disputes that and will keep disputing it. Nobody has paid. Nobody has shown that the penalty changes how Meta’s products work. The August settlement’s child-safety measures can at least be checked. So far, the New Mexico judgment can only be appealed.

A fine changes behavior only if it costs more than the behavior earned. On Wednesday’s numbers, Meta takes in $25 billion of revenue in about five weeks. Before the teen charge, it earns that much in operating profit in a little over three months.

Stephen Hubbard, a 74-year-old retired teacher from Michigan, left Russia on Wednesday after more than four years in custody. He flew out of St. Petersburg’s Pulkovo airport with Steve Witkoff, President Trump’s special envoy. According to the Kremlin adviser Yuri Ushakov, Vladimir Putin pardoned him.

Russian prosecutors said Hubbard signed a contract with Ukraine’s military after the 2022 invasion and was captured two months later. A closed court sentenced him in 2024 to nearly seven years. His lawyers deny he took part in any fighting, and the Biden administration designated him wrongfully detained. Mr. Trump said on Truth Social that he had asked Putin to free Hubbard during a phone call last week. Unlike previous releases, he said, the United States gave up no one in return.

That was the clean part of the day. Thanking Putin on camera, Witkoff said: “You talk so much about my president, President Trump, being a humanitarian. You are a humanitarian also, sir, and I salute that, I commend you, and I thank you again.”

The objections came within hours, and mostly from Republicans. “WTF, Steve?” wrote Senator Thom Tillis of North Carolina. Senator John Cornyn of Texas wrote: “No. Putin is a stone cold killer.” Senator Susan Collins of Maine called Putin “a warmonger, a thug.” Senator Joni Ernst of Iowa wrote that “appeasement won’t end this war. Pressure will.” Asked whether he agreed with Witkoff, Mr. Trump said the word applied “for that particular purpose,” and added, “But I wouldn’t say anything one way or the other.”

The diplomacy was thinner than the language. The meeting at the Constantine Palace lasted roughly three hours, with Jared Kushner joining by video. Afterward Ushakov said Putin had agreed “in principle” to resume trilateral talks with Washington and Kyiv after Nov. 10. The talks, he said, would focus on “building a security system for Russia and Ukraine after the conflict ends.” The three governments held three rounds of such talks earlier this year, in Abu Dhabi in January and February and in Geneva in February. According to the Associated Press, they produced little beyond prisoner-of-war exchanges.

Nov. 10 is a week after the U.S. midterm elections. Witkoff had met Volodymyr Zelenskyy in Oslo the day before. In a Fox News interview broadcast Wednesday, Zelenskyy said a freeze of the fighting was the “minimum” needed to end the war. Witkoff also publicly thanked Putin for lifting Russia’s ban on diesel exports. Some U.S. lawmakers were angered by the thanks.

What Wednesday establishes: a wrongfully detained American is going home, and Moscow has named a date after which it says it will talk. It doesn’t establish a ceasefire, a leaders’ summit or any Russian concession on territory. And whether the release cost Washington nothing depends on what you count as payment.

On Sunday, near Croix-des-Bouquets on the edge of Port-au-Prince, gunmen attacked an armored vehicle carrying four Salvadoran aviation technicians. They hit it with gunfire and explosives, and it caught fire. The men belonged to the international Gang Suppression Force, which backs Haiti’s police against the armed groups that control much of the capital region. They have been held hostage since.

On Wednesday President Nayib Bukele said El Salvador had launched a military operation to rescue them. He set out his terms on X: “Today’s attack is nothing compared to what is coming if you do not return all four hostages alive.” He pointed to his record at home: “We have already finished with the gangs in El Salvador, and we can finish with you too.” He added that the gangs still had time to avoid escalation.

Bukele said the technicians worked on medical evacuations, not combat. He said they were seized while returning from buying food at a supermarket. Haiti’s government called their rescue an “absolute priority,” the Associated Press reported. Anadolu reported that continued fighting in the area has hampered efforts to find them.

By Wednesday night, nothing made public established the men’s condition. Nor had details of the rescue operation been released: where it ran, what it reached, or whether it found them. Bukele’s statement describes an operation. It doesn’t report a result.

Why it matters beyond the four men: governments lend troops to multinational forces, and those governments answer to voters at home. By seizing four Salvadorans, a Haitian gang has turned a UN-backed policing mission into a bilateral confrontation with a government whose domestic brand is the gang crackdown. The Gang Suppression Force was designed to be multilateral, yet its first hostage crisis is being run, at least publicly, from San Salvador.

The Trump administration asked the Supreme Court on Wednesday to let it resume building border barriers in the Big Bend region of Texas. The project mixes walls, vehicle barriers and surveillance technology along a remote stretch of the Rio Grande, some of the least-crossed ground on the southern border.

On Oct. 2, U.S. District Judge Kathleen Cardone halted about 340 miles of planned barrier and road construction within the larger Big Bend sector while the case proceeds. The Washington Post put the project’s cost at $1.7 billion. The case turns on waivers signed by the Homeland Security secretary under a 1996 law. They let Customs and Border Protection skip environmental and other reviews. The government says the law gives the secretary that power. Opponents say Congress granted it for areas of “high illegal entry,” and that Big Bend isn’t one. The opponents are ranchers, residents, business owners and conservation groups, a coalition the Associated Press described as bipartisan.

Cardone agreed with them, and the tool she used is the interesting part. She wrote that the plaintiffs “are likely to succeed on the merits of their major questions doctrine claim that the Big Bend Waivers were issued in excess of the Secretary’s authority.”

The Supreme Court’s conservative majority built the major questions doctrine. It holds that agencies can’t claim vast powers from vague statutes. Its best-known uses have reined in environmental and public-health regulators. In Big Bend, a federal judge has turned it against a Republican administration’s signature construction project, and the plaintiffs are West Texas ranchers.

The administration now wants the justices to accept, at least for now, that one Cabinet officer’s signature can waive the laws that apply across hundreds of miles of border. Its argument is that the doctrine doesn’t fit. On its account, Congress spoke clearly in 1996, and the Big Bend sector does see high illegal entry.

It was a busy day on the emergency docket. In an unsigned order, the Court also refused to let the administration enforce new restrictions on medical care for transgender people in federal prisons. Justices Thomas and Alito noted dissents.

A stay application isn’t a ruling on the merits. If the justices grant one, construction resumes while the case continues. If they deny it, the pause holds. Either way, the order is worth reading for one thing. Does the majority treat the major questions doctrine as a rule about power, or as a rule about kinds of power it dislikes? Big Bend will show which.

Tesla reported its third quarter after the market closed Wednesday. Revenue was $28.05 billion, flat from a year earlier and in line with the consensus Electrek cited. Non-GAAP earnings came to 48 cents a share. That beat the 45-cent consensus but was down from 50 cents a year ago. Total gross margin recovered to 19.6 percent, from 16.8 percent in the second quarter.

Below the gross margin, the numbers went the other way. Operating income fell 56 percent, to $718 million, for an operating margin of 2.6 percent. Operating expenses rose 39 percent, to $4.78 billion. Research and development jumped 69 percent, to $2.76 billion. Tesla is spending that money on what it now calls “Super Intelligence,” on Optimus robots and on the Cybercab. Stock-based compensation, which includes the 2025 CEO pay package, was $1.17 billion, up from $663 million. GAAP net income fell 43 percent, to $787 million. That figure includes a $288 million unrealized gain on bitcoin, partly offset by a $142 million unrealized loss on the SpaceX stake. Strip out both marks and net income would have been lower still.

Readers should slow down at free cash flow. Tesla generated $1.53 billion, after negative $1.09 billion in the second quarter, and the swing will be quoted as a recovery. Capital spending was $4.73 billion. That is more than double a year ago, but down from $5.79 billion in the second quarter. Spending less on factories and compute raises free cash flow mechanically, without selling a single extra car.

Then there is the plan. Tesla has spent $13.01 billion on capex through nine months of a year for which management guided “more than $25 billion.” Meeting the guide would take roughly $12 billion in the fourth quarter alone, more than double its biggest quarter so far. Electrek reports that the shareholder letter does not update the guidance. One of two things follows. Either Tesla is about to set a spending record, or part of 2026’s plan is sliding into 2027 without anyone saying so.

Deliveries were 486,532, down 2.1 percent. Production was 464,391. Energy storage deployments were 13.7 GWh, short of the roughly 15.9 GWh analysts expected. Tesla ended the quarter with $45.4 billion in cash and investments, so solvency is not the question.

What the quarter establishes: margins on cars stopped falling. It doesn’t establish that the AI spending earns anything. The free-cash-flow rebound coincided with lower quarterly capex. A company that guided to more than $25 billion and has spent $13.01 billion has not yet delivered that spending plan; the remaining timing is uncertain.

On Wednesday, PHP’s maintainers released fixes for two critical flaws in the language’s runtime engine. PHP runs underneath a large share of the world’s websites. The same day, the U.S. Cybersecurity and Infrastructure Security Agency told organizations to patch immediately. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, and each carries a severity score of 9.2 out of 10. According to an advisory from the EU’s computer emergency response team, CERT-EU, either one lets an attacker run code on a vulnerable server without logging in.

The fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP’s advisory now describes the two flaw classes and says only an update is a complete solution. Because the flaws sit in the engine rather than in a plugin, commercial and open-source products that bundle PHP may also be exposed. MeriTalk noted that federal agencies will have to chase suppliers, hosting providers and contractors to confirm their systems are fixed.

Credit for the discovery is shared, and OpenAI’s own account shows how. OpenAI said a researcher identified one critical flaw using its GPT-5.6 Sol model. The security company Wiz independently discovered and reported both. PHP’s maintainers led development of the fixes. OpenAI, Wiz and Cloudflare provided research, testing and coordination over about two months, under an effort OpenAI calls Patch the Planet. OpenAI said the partners engaged CISA, the Office of the National Cyber Director and the White House’s Super Intelligence Force, along with international partners.

OpenAI used the disclosure to propose a broader framework. Model developers, maintainers, security vendors and governments would jointly validate AI-found bugs, build fixes and stage warnings before publication. The company acknowledged the symmetry: a model good enough to find a long-dormant hole for defenders is good enough to find one for attackers.

What this establishes: two serious vulnerabilities are patched, and coordinated disclosure gave providers time to prepare. Public technical details now narrow the defender’s window, but the reviewed sources do not establish active exploitation or a public working exploit. It doesn’t establish that AI found something humans couldn’t, since Wiz found both flaws. Nor does it settle who should run disclosure when the next bug comes out of a model. On the opinion page, our editor argues it shouldn’t be the model’s maker.

Before the first pitch on Friday night in Milwaukee, Major League Baseball already knows something it rarely gets to say. Its champion will be a franchise that has never won. Five current clubs have never won a World Series: the Mariners, Padres, Rockies, Brewers and Rays. By early November there will be four.

The World Series usually wants a different matchup. It wants a coastal blueblood, a payroll you can see from orbit, and a superstar whose face sells sneakers in places that don’t follow baseball. What it has instead is the best team in each league. The Brewers won a franchise-record 103 games and the Rays won 98. Nobody would call either one an empire.

Both franchises have come close before. Milwaukee’s only previous Series, in 1982, ended in a seven-game loss to the St. Louis Cardinals. Tampa Bay lost in 2008 to the Phillies, and in 2020, in the pandemic bubble, to the Dodgers. The Rays clinched this pennant late Monday at Tropicana Field. Hurricane Milton shredded that roof in October 2024 and sent the team to a spring-training park for the 2025 season. A champagne-soaked clubhouse under the repaired roof is a small story of civic repair. The national broadcast will probably mention it once and move on.

Game 1 has a plot, too. Drew Rasmussen, Tampa Bay’s likely starter, was drafted by Milwaukee and traded to the Rays five years ago. MLB.com notes he is 11-0 with a 1.73 ERA in 15 starts since the All-Star break. He is the kind of quiet, devastating pitcher front offices covet and casual fans couldn’t pick out of a lineup. On Friday he pitches in front of the crowd whose team once owned his rights.

Here is the argument about taste. October has drifted toward inevitability: the same few rich clubs, the same ratings logic, the same chorus that small markets “can’t compete.” This Series tests that claim. Both teams built winners through player development, pitching and defense, not by buying them. If the ratings disappoint, expect commentators to blame the teams. They would do better to blame a broadcast model that knows how to sell stars and has forgotten how to sell baseball.

What it establishes: two well-run organizations reached the final. It doesn’t establish that money stopped mattering. Five never-won franchises out of thirty, after more than a century of play, says it still does. This week, though, someone with less money finishes first. Watch it, then write in and tell us which city you’re adopting.

Start with the part nobody should argue about. Stephen Hubbard is 74. He spent more than four years in Russian custody after a closed trial on charges his lawyers deny, and on Wednesday he boarded a plane home. Anyone who can’t be glad about that has confused politics with personality.

Now the part worth arguing about. The White House says the release cost nothing, with no swap needed. Every prisoner deal has a price, though, and the only question is the currency. In earlier releases it was people: convicted Russians handed back on an airport tarmac. On Wednesday it was a word. Standing beside Vladimir Putin, Steve Witkoff called him “a humanitarian,” and said he saluted him.

The senators who recoiled, most of them Republicans, are right that the word is false. Most of them have missed why it matters. Witkoff didn’t misspeak. He paid. The Kremlin’s spokesman had already said Putin freed Hubbard out of “humanitarian considerations.” Witkoff handed that framing back, on camera, to a man who will broadcast it at home and in every capital deciding whether he can be dealt with. A pardon costs Putin one prisoner, and he holds many. A respectable adjective from Washington is worth more to him, because nobody else can supply it.

The President’s defense was that the word fit “for that particular purpose.” That concedes the point: it was a transaction. Transactions set prices, and prices get remembered. Every government now holding an American has learned that a release can buy praise from the U.S. envoy on camera. That costs less than a spy swap, and for the hostage-taker it may be more useful.

The objection is that words are free and prisoners aren’t, so take the deal every time. I would take the deal too. I would also refuse this particular bill. “Thank you for releasing him” would have cost the same and conceded nothing. Diplomats thank people they despise every day. It is one of the profession’s few honest skills.

Witkoff also thanked Putin publicly for lifting a diesel export ban. In return the Kremlin agreed only “in principle” to talks after Nov. 10. The only thing Washington put on the record Wednesday was a compliment, and a compliment is thin bargaining. When the trilateral talks resume, the American side should arrive knowing that its vocabulary has a market value, and that it has been underpricing it.

Credit first, because it’s earned. Two flaws in PHP, rated 9.2 out of 10, could let anyone run code on a server without logging in. They were found, fixed and disclosed in coordination over about two months. PHP’s maintainers wrote the patches. Wiz found both bugs. Cloudflare helped stage protections. OpenAI did the convening, and its model helped one researcher find one of the flaws. On Wednesday CISA told everyone to patch. This is how disclosure is supposed to work.

Then OpenAI proposed making itself part of how it works every time. Its Patch the Planet framework would have model developers, maintainers, security firms and governments jointly validate AI-discovered vulnerabilities, build fixes and stage warnings. Each piece sounds reasonable. Taken together, the arrangement gives the companies that sell bug-finding engines a permanent seat at the table where bugs are triaged.

That seat is worth a great deal. Whoever runs disclosure decides which bugs count as “critical,” whose software gets fixed first and who learns early. They also decide whose model gets credited in the press release. OpenAI says the same capability that helps defenders could help attackers. That is true, and it is the strongest argument for keeping the switchboard away from anyone who profits from that capability. Selling both the lock-picking robot and membership in the lock-repair consortium is a business model. It isn’t a public good.

A better landlord already exists. Computer emergency response teams, CISA among them, and open-source foundations do exactly this work, and they are underfunded. The people who actually fixed the PHP engine are mostly volunteers and small teams, not companies with trillion-dollar ambitions. If AI labs want the defender’s window kept open, they can pay rent. They should fund maintainers and public CERTs in proportion to the bugs their models surface, and ask for no seat, no branding and no early look in return.

The PHP fix is a fine precedent for cooperation and a bad one for governance. PHP’s advisory now publishes technical details, but the reviewed sources do not establish a public working exploit or active exploitation. The window is short, and it will shrink as models improve. Whoever holds it should answer to the public, not to a product roadmap.