Josse-posten

A strait shuts a second time and oil falls anyway; reckonings open in Oslo and Rome; and in Beijing the machines beat the humans at the half-marathon.

Hormuz Shut Again — Tankers Fired On, Oil Falls Anyway

Iran’s IRGC reimposed closure of the Strait of Hormuz after briefly reopening it, with gunboats firing on merchant vessels and ordering an Indian ship to abort transit. Tehran says the strait stays closed until the US lifts its naval blockade of Iranian ports. Trump convened a situation room meeting as the US military prepared to board Iran-linked vessels; Hegseth said Iran is “digging out missiles and launchers.” More than 3,400 Iranians have died in the war; over $50bn of crude production has already been lost. And yet oil crashed another 7.8%. (Full coverage in World.)

Moscow-Born Gunman Kills Six in Kyiv

A 58-year-old Ukrainian citizen born in Moscow opened fire in Kyiv’s Holosiivskyi district, killing six and wounding 15 before police shot him dead after a supermarket hostage standoff. Ukrainian investigators are now examining whether Moscow directed the attack — raising the specter of Russian state-sponsored terrorism inside the capital. The weapon was legally registered; no motive has been established. (Full coverage in Ukraine.)

Norway Opens a 30-Year Epstein Investigation

The head of Norway’s parliamentary oversight committee says the Epstein files have “shaken Norway’s faith in democracy,” as the committee launches a sweeping probe into Epstein’s connections with Norwegian politicians and civil servants going back three decades — among the most institutionally serious national-level responses yet. (Follows Stortinget’s unanimous vote for an Epstein commission, 2026-04-16.)

Claude Code Source Leak — Three CVEs, One 9.8

A source map file accidentally bundled in a March 31 Claude Code npm release exposed over 512,000 lines of TypeScript source, letting researchers catalogue three command injection flaws under CVE-2026-35022 (CVSS 9.8). The chain spans the TERMINAL env-var parser, $() substitution in file path handling, and an auth helper abusable to exfiltrate AWS, GCP, and Anthropic API keys. In non-interactive CI/CD environments the trust dialog is bypassed entirely — a clean path for “Poisoned Pipeline Execution” via malicious PRs or poisoned .env files.

Beyond Machines · Lobsters (See Tech.)

The Robots Ran Faster

More than 100 Chinese-made humanoid robots competed on dedicated parallel tracks at the Beijing half-marathon. The winning robot posted a faster time than the human world record holder. A deliberate showcase of advances improving faster than most forecasters projected. (Guardian)

Markets

S&P 500 +1.21%
Gold +1.33%
Oil −7.79%
EUR/USD 1.0843
USD/NOK 10.8172
VIX 17.48
BTC $75,039 −2.6%
ETH/BTC 0.0308

Oil −7.8% — Hormuz reimposed, tankers fired on, yet crude cratered; with $50bn of production already lost, markets appear to be pricing demand destruction over fresh supply shock.

Gold +1.3%, S&P +1.2%, VIX 17.5 — equities and safe havens both up, fear gauge muted. Oddly sanguine given a live shooting war blocking the world’s most critical oil chokepoint.

Malta-flagged tanker Agios Fanourios I arriving in Iraqi waters off Basra after a Hormuz crossing, April 17.

Also on the front page - Meloni’s hold on Italy weakens; breaks with Trump on Iran and the Pope - French UNIFIL peacekeeper killed in southern Lebanon; Macron blames Hezbollah - Trump signs executive order to fast-track psychedelic drug review

World

Meloni weakens at home, breaks with Trump abroad

A failed referendum on judicial overhaul has pierced Giorgia Meloni’s aura of invincibility and triggered a government crisis in Rome. Leftwing Genoa mayor Silvia Salis — a former Olympian — is emerging as a potential progressive unifier. Meloni has also publicly split with Trump over the Iran war and over the pope dispute, a notable fracture in the global right.

The Guardian · DW

Pope Leo pushes back on Trump, speaks against exploitation of Africa

Pope Leo pushed back on interpretations of his recent speech as an attack on Trump, saying his remarks had been misinterpreted — after a public spat with the US president. Separately, the pontiff used his platform to challenge Western and Chinese extraction practices on the African continent.

BBC · Bloomberg

Hormuz closed again; tankers fired on; US prepares to board Iran-linked ships

Iran’s IRGC reimposed closure of the Strait of Hormuz, with gunboats firing on merchant vessels and ordering an Indian ship to abort transit. Tehran says the strait stays closed until the US lifts its naval blockade of Iranian ports. Trump held a situation room meeting and warned Iran against “blackmail”; per the WSJ, the US military is preparing to board Iran-linked vessels. Defense Secretary Hegseth said Iran is “digging out missiles and launchers.” More than 3,400 Iranians have been killed; the world has lost over $50bn in crude production since hostilities began.

The Guardian · Al Jazeera · BBC · Reuters · Axios · NBC · WSJ via UNN

US-Iran peace talks collapse amid premature announcements

Progress toward a peace settlement has collapsed amid mismanaged and premature media statements from both Trump and Tehran. Trump’s eagerness to end the war led him to try to accelerate a process he does not fully control; Iran’s top negotiator says “fundamental” issues remain unresolved, and no date for further talks has been set.

The Guardian · live

Diplomatic cables: the Iran war is damaging US standing on multiple fronts

Internal embassy cables obtained by Politico show the Iran war is causing significant diplomatic damage worldwide, with allies questioning US judgment and adversaries exploiting the conflict — reinforcing a pattern of European unease with US escalation.

Politico

French UNIFIL peacekeeper killed in Lebanon; Macron blames Hezbollah

A French soldier serving with UNIFIL was killed in southern Lebanon, days after the Israel–Lebanon ceasefire took hold. Macron attributed the attack to Hezbollah, which denies any connection — a sharp early test of the truce and the safety of international peacekeepers.

BBC · Al Jazeera · Reuters · Times of Israel

Israel declares ‘yellow line’ in Lebanon; Hezbollah threatens president

Israel announced a “yellow line” in Lebanon — a buffer threshold modelled on Gaza — as the ceasefire entered its second day and displaced residents began returning to towns like Khiam. Hezbollah separately warned Lebanon’s president he will “lose his status” if he meets Netanyahu, piling pressure on a delicate political situation.

Al Jazeera · BBC · Ynet

Magyar moves fast, seeks EU renewal via Warsaw

After Tisza’s landslide over Fidesz, Péter Magyar is wasting no time preparing for the transfer of power. He has reached out to Poland’s PM Donald Tusk, hoping to draw on Warsaw’s experience of restoring EU relations after its own authoritarian drift.

BBC · The Guardian

Norway’s parliament opens 30-year Epstein investigation

The head of the Storting’s oversight committee says the Epstein files have “shaken Norway’s faith in democracy,” as the committee launches a sweeping investigation into three decades of connections between Epstein and Norwegian politicians and civil servants. Among the most institutionally serious national-level responses yet.

The Guardian

Venezuela: Machado sidelined as Trump backs Rodríguez

Venezuelan opposition leader María Corina Machado finds herself politically frozen out after the US captured Maduro, with Trump backing Delcy Rodríguez rather than a clean democratic transition. Machado — who gave Trump her Nobel Peace Prize medal in gratitude and says she has “no regrets” — is rallying diaspora support at a Madrid event to keep pressure on for genuine change.

The Guardian · Al Jazeera

UK: Starmer would have blocked Mandelson’s Washington posting

Foreign Secretary David Lammy said PM Keir Starmer would have blocked Peter Mandelson’s ambassadorship to Washington had he known Mandelson had failed security vetting. Lammy called it “inexplicable” that a senior civil servant kept Downing Street in the dark, reopening questions about Starmer’s political grip.

The Guardian · Al Jazeera

Spain, Brazil, Mexico unite to defend Cuba’s sovereignty

Spain’s, Brazil’s, and Mexico’s leaders pledged increased aid to Cuba and declared Cubans must determine their own future, in a direct rebuke to a US pressure campaign. Lula separately condemned the UN Security Council’s five permanent members as “Lords of War” in unusually pointed language.

Al Jazeera · DW

Bulgaria: eighth election in five years

Bulgarians voted Sunday to elect a new parliament for the eighth time in five years, following mass protests that brought down the previous government in December. Chronic instability reflects deep divisions no coalition has yet managed to resolve.

Al Jazeera

North Korea: seventh ballistic missile test of 2026

North Korea launched multiple ballistic missiles from its eastern Sinpo area toward the sea on Sunday, South Korea’s Joint Chiefs confirmed — the accelerated 2026 pace continues.

Al Jazeera · NPR · Reuters

North Korean tactical ballistic missile launch. Kim Jong Un maintains the country’s nuclear status is irreversible.

Also today - Russia urges HIV testing for a third of the population as cases surge — Moscow Times - Humanoid robots outrun human world record at Beijing half-marathon — Guardian - Trump signs executive order fast-tracking FDA review of psychedelics — Guardian · Al Jazeera · NPR - Trinidad and Tobago: 56 bodies, mostly children, found at a cemetery in Cumuto — Al Jazeera - Australia charges Victoria Cross recipient Ben Roberts-Smith with five counts of war crime murder — BBC · Guardian - Japan’s weather agency adopts 酷暑日 — “cruelly hot day” — as official term for ≥40°C — Mainichi

Ukraine

Mass shooting in Kyiv: six dead, Russian direction under investigation

A 58-year-old man born in Moscow opened fire in Kyiv’s Holosiivskyi district on April 18, killing six and injuring 15 before police shot him dead after a supermarket hostage standoff. The attacker was a Ukrainian citizen using a legally registered weapon. Investigators are pursuing multiple lines of inquiry — including whether Moscow directed the attack — but have not established a definitive motive.

The Guardian · BBC · Al Jazeera · NPR · Ukrainska Pravda

Crimea warships hit; Taganrog drone plant struck; Russian SAM shortages in the open

Ukraine’s SBU struck three Black Sea Fleet vessels in occupied Crimea overnight April 17–18 — including Ropucha-class landing ships Yamal and Azov — plus a radar station, communication antenna, and the Sevastopol fuel depot. The next night, Ukrainian missiles reportedly struck a UAV production plant in Taganrog, starting a large fire. Russian milbloggers are openly criticizing SAM shortages; one cited a servicemember who said air defenses lacked missiles to intercept many strike vehicles, leaving coverage gaps Moscow has not addressed.

Ukrainska Pravda — vessels · Kyiv Independent — Taganrog · Kyiv Post · Kyiv Independent — Crimea

236 drones overnight; Shaheds exploit European roaming via T2 SIMs

Russia launched 236 drones overnight April 18–19 (up from 219); 203 were downed. Strikes killed a 16-year-old in Chernihiv and cut power to 380,000 subscribers in Chernihiv Oblast. Ukrainian EW expert Serhiy Beskrestnov revealed every Russian Shahed carries a T2/Rostelecom SIM card for real-time telemetry and remote control. Ukraine has blocked T2 roaming on its own networks, but the drones can still connect via Belarusian, Polish, and Romanian telecom operators near the borders — a loophole Russia is actively exploiting.

Ukrainska Pravda — 236 drones · Ukrainska Pravda — Chernihiv · ISW, April 18

Zelensky warns of artillery pre-positioning on Belarusian border

Zelensky said on April 17 that Russia is positioning artillery along roads to the Belarusian–Ukrainian border — active preparation for a potential second front rather than a mere troop buildup. ISW frames it as part of ongoing efforts to integrate Belarus into Russia’s military framework.

Kyiv Post

Russian frontline advances broadly stalled

Ukrainian counterattacks have halted Russian advances on multiple axes: at Vovchansk, Ukraine is pushing Russian forces back and clearing positions; in the Kupyansk direction, Russian offensive operations have paused for roughly two weeks; in the Slovyansk direction, the pace has slowed significantly. The exception: a platoon-sized mechanized assault by the 70th Motorized Rifle Division seized Pryvillya and Minkivka near Chasiv Yar.

ISW, April 18 · Ukrainska Pravda — Russian losses

The Ropucha-class landing ship Yamal, one of two struck by Ukraine’s SBU in Crimea.

A Special Forces Police Unit evacuates a hostage at the site of the Kyiv supermarket shooting, April 18.

Aftermath of the overnight Russian drone attack on Chernihiv.

Tech

Anthropic’s Mythos launch claims face substantive pushback

A detailed critique argues Anthropic’s Mythos launch systematically overstates capabilities: the “thousands of severe zero-days” claim extrapolates from only 198 manually reviewed reports; the Linux kernel bug cited was actually found using publicly available Opus 4.6, not Mythos; and Firefox exploits were run without browser sandboxes. An independent study reportedly found 8 different models — including a $0.11/M-token one — could detect the same FreeBSD vulnerability. Business-side concerns too: 5 of 11 launch partners are investors, and JPMorgan is simultaneously a launch partner and IPO underwriter.

AI Made Simple · Lobsters

MAD Bugs: cat readme.txt can RCE through iTerm2

“Month of AI-Discovered Bugs” is a research initiative using AI to surface vulnerabilities in widely-used software. The first finding is striking: running cat readme.txt on a remote server over iTerm2’s SSH integration can trigger arbitrary code execution. iTerm2 processes escape sequences in file output, and a malicious file can impersonate the trusted conductor protocol to hijack the terminal. The root flaw: iTerm2 doesn’t authenticate whether escape sequences come from its trusted helper or untrusted file content. Researchers also note working exploits can be reconstructed from the patch diff alone.

Blog · Lobsters

A €5 tracker in a postcard exposed a €500M warship for 24 hours

A cheap Bluetooth tracker concealed in a postcard and mailed to a Dutch naval frigate exposed the ship’s location for 24 hours before being discovered. The incident has triggered a review of postal screening procedures across allied navies and illustrates how consumer-grade surveillance now poses serious risks to military assets.

Tom’s Hardware

NearlyFreeSpeech rewrites production C++ frontend in Rust

NearlyFreeSpeech.NET published an account of migrating their C++ HTTP frontend to Rust in production — a live replacement of a system handling real traffic, not a greenfield rewrite. Motivations (memory safety, maintainability), what went well, where Rust’s guarantees paid off. A grounded systems migration story, not a language-war piece.

NearlyFreeSpeech Blog · Lobsters

When compilers surprise you: cunning Clang optimizations

A collection of cases where Clang produces genuinely unexpected output — transformations technically correct per the standard but surprising to most developers. Useful for understanding what “undefined behavior” actually means at the code generation level.

xania.org · Lobsters

GitHub uses eBPF to detect circular deployment dependencies

GitHub describes using eBPF hooks via cgroups to intercept outbound network calls during deployment scripts — surfacing cases where a deploy for one service reaches back out to GitHub itself (e.g., to download a binary), creating self-referential dependencies that cascade into outages. Making hidden dependencies visible so they can be eliminated before they fail. A practical, well-explained application of eBPF to production reliability.

GitHub Blog · Lobsters

Some secret management belongs in your HTTP proxy

A well-reasoned argument that certain secrets — particularly service-to-service auth tokens — are better managed at the HTTP proxy layer than injected into application environments. Moves rotation and injection out of application code into infrastructure, reducing secret sprawl and blast radius.

blog.exe.dev · Lobsters

Towards a trust model for Emacs

A proposal for structured trust levels in Emacs — distinguishing code from ELPA, local config, .dir-locals.el, and untrusted sources. Addresses a real gap: Emacs’s extensibility currently makes it hard to safely open someone else’s project without risking arbitrary Lisp execution.

eshelyaron.com · Lobsters

ROCm on AMD Strix Halo: unified memory works, once you’ve done the dance

Strix Halo is AMD’s APU with unified memory — CPU and GPU share the same physical RAM pool, so the full system RAM is available for GPU inference without discrete VRAM limits. Getting ROCm working on Linux required a BIOS update before PyTorch detected the GPU at all, plus careful tuning of the “reserved video memory” BIOS setting (set low, ~512MB) and the amdgpu.gttsize kernel parameter. Working stack: torch==2.11.0+rocm7.2 with triton-rocm via uv. Once past setup, the architecture delivers for local LLMs.

Blog · Hacker News

Why Japan has such good railways: a structural analysis

A Works in Progress longform examining why Japan’s rail network outperforms the West — not just “culture” or state investment, but the specific combination of private ownership, dense urban geography, fare flexibility, and cross-subsidy between rail and real estate development (the “railway city” model). Substantive policy analysis that explains a system rather than admiring it.

Works in Progress

NIST builds “any wavelength” lasers on a chip

NIST researchers have demonstrated integrated photonic circuits that generate laser light at essentially any visible or near-infrared wavelength on demand, using nonlinear optical processes to frequency-convert a single source laser across a wide spectrum. The chips are smaller than a dime and could replace racks of discrete laser sources in spectroscopy, quantum computing, and sensing.

NIST

Inside the Kollsman MD-1 Astro Compass — rotating cams, gear trains, and synchros that solved the B-52’s navigational triangle in analog.

NIST’s dime-sized photonic chip, shifting laser light to any target wavelength.

Also noteworthy - Ken Shirriff’s deep dive into the B-52’s electromechanical angle computer — righto.com · HN - NASA powers down Voyager 1’s Plasma Wave Science instrument to stretch the mission — NASA · HN - Running a Minecraft server on a 1960s UNIVAC (not emulated) — farlow.dev · Lobsters - PgQue: a zero-bloat job queue built natively in Postgres — GitHub · Lobsters - Optimizing a Haskell xref tool with elemIndexBlog · Lobsters - Why SQLite’s temp files start with etilqs_ — it’s “SQLite” reversed, on purpose — avi.im · Lobsters - Migrating from DigitalOcean to Hetzner: a practical walkthrough — Blog · HN

“Working exploits can be reconstructed from the patch diff alone.”

— MAD Bugs researchers, on the iTerm2 RCE window between patch and update

cd ~/repos/ratatosk && claude --resume ee6a1172-9831-4415-b0d0-95a451634405