A strait shuts a second time and oil falls anyway; reckonings open in Oslo and Rome; and in Beijing the machines beat the humans at the half-marathon.
Hormuz Shut Again — Tankers Fired On, Oil Falls Anyway
Iran’s IRGC reimposed closure of the Strait of Hormuz after briefly reopening it, with gunboats firing on merchant vessels and ordering an Indian ship to abort transit. Tehran says the strait stays closed until the US lifts its naval blockade of Iranian ports. Trump convened a situation room meeting as the US military prepared to board Iran-linked vessels; Hegseth said Iran is “digging out missiles and launchers.” More than 3,400 Iranians have died in the war; over $50bn of crude production has already been lost. And yet oil crashed another 7.8%. (Full coverage in World.)
Moscow-Born Gunman Kills Six in Kyiv
A 58-year-old Ukrainian citizen born in Moscow opened fire in Kyiv’s Holosiivskyi district, killing six and wounding 15 before police shot him dead after a supermarket hostage standoff. Ukrainian investigators are now examining whether Moscow directed the attack — raising the specter of Russian state-sponsored terrorism inside the capital. The weapon was legally registered; no motive has been established. (Full coverage in Ukraine.)
Norway Opens a 30-Year Epstein Investigation
The head of Norway’s parliamentary oversight committee says the Epstein files have “shaken Norway’s faith in democracy,” as the committee launches a sweeping probe into Epstein’s connections with Norwegian politicians and civil servants going back three decades — among the most institutionally serious national-level responses yet. (Follows Stortinget’s unanimous vote for an Epstein commission, 2026-04-16.)
Claude Code Source Leak — Three CVEs, One 9.8
A source map file accidentally bundled in a March 31 Claude Code npm
release exposed over 512,000 lines of TypeScript source, letting
researchers catalogue three command injection flaws under CVE-2026-35022
(CVSS 9.8). The chain spans the TERMINAL env-var parser,
$() substitution in file path handling, and an auth helper
abusable to exfiltrate AWS, GCP, and Anthropic API keys. In
non-interactive CI/CD environments the trust dialog is bypassed entirely
— a clean path for “Poisoned Pipeline Execution” via malicious PRs or
poisoned .env files.
Beyond Machines · Lobsters (See Tech.)
The Robots Ran Faster
More than 100 Chinese-made humanoid robots competed on dedicated parallel tracks at the Beijing half-marathon. The winning robot posted a faster time than the human world record holder. A deliberate showcase of advances improving faster than most forecasters projected. (Guardian)






