World

Iran talks collapse on day 58 — Trump cancels envoy mission

US-Iran ceasefire negotiations collapsed on the 58th day of the war as Iran’s Foreign Minister Araghchi left Pakistan without meeting US envoys Witkoff and Kushner. Trump cancelled the mission entirely, saying Iran “did not make a satisfactory offer.” Tehran rejected negotiations under what it called a blockade “siege,” with hardline officials arguing Iran should refuse further talks under duress. Hundreds of Israelis rallied in Tel Aviv fearing the US-Israeli campaign will resume. Tehran separately resumed international flights — a partial normalization even as the diplomatic track stalls.

Sources: Al Jazeera (live) · Al Jazeera · Guardian · BBC · Axios · Brussels Times

NATO fractures over Iran — Macron and Tusk sharpen the divide

The Iran war has exposed deep NATO fissures. Trump is reportedly furious European allies refused to join the campaign; a NATO official confirmed he cannot expel members over their stance. Macron, speaking in Athens, cited the EU’s mutual-defence clause as stronger than NATO’s Article 5 and “not just words,” pointing to joint EU military aid to Cyprus as proof Europe can defend itself. Polish PM Tusk sharpened the alarm from the other direction, warning Russia could attack NATO territory within months.

Sources: Kyiv Independent · Guardian · Le Monde · Al Jazeera · IntelliNews

Armed man charges Correspondents’ Dinner — Trump evacuated, officer shot

A suspect armed with knives and guns rushed a security checkpoint outside the White House Correspondents’ Dinner at Washington’s Hilton Hotel on Saturday night, prompting the Secret Service to evacuate President and Melania Trump. One agent was shot but saved by a bulletproof vest; Trump later called him “a hero.” Surveillance footage showed the suspect running past metal detectors as agents drew weapons. He faces two felony firearms and assault charges. Leaders from Canada, Mexico, and Australia condemned the attack.

Sources: Al Jazeera · Guardian · NPR · BBC

Mali hit by largest coordinated jihadist assault in years

Al-Qaeda-linked JNIM and Tuareg separatist rebels launched simultaneous attacks on Bamako’s international airport and four other Malian cities — the largest coordinated assault in years. Explosions and gunfire erupted across the capital and through the centre and north as the Sahel’s security situation continues to deteriorate following the expulsion of French forces.

Sources: BBC · Guardian · NPR

Colombia highway bombing kills 14

A bomb-laden bus exploded on the Pan-American Highway in Cauca, killing at least 14. Authorities blame dissident FARC rebels; the state governor described it as part of a broader “wave of attacks” in the region.

Sources: Al Jazeera · CNN

Netanyahu orders “vigorous” Lebanon attacks despite extended ceasefire

Netanyahu directed the army to attack Hezbollah “vigorously” even as the ceasefire was extended by three weeks. Israeli strikes killed six people in southern Lebanon. The IDF separately opened an investigation into soldiers filmed destroying solar panels in a Lebanese village.

Sources: BBC · Reuters · Jerusalem Post

CIA agents killed in Mexico were unauthorized

Mexico confirmed the two Americans who died during a drug lab operation were CIA agents without authorization to participate. The incident deepens diplomatic friction over the extent and legality of US intelligence activities on Mexican territory.

Sources: BBC · Al Jazeera · AP

Pope Leo condemns capital punishment as US authorizes firing squads

Pope Leo declared the death penalty “inadmissible” in a video message released hours after the US Justice Department authorized firing squads for federal executions — the first such expansion in decades. The juxtaposition drew sharp attention to the divide between the new pope and the Trump administration.

Sources: Reuters · NPR

Orbán steps down after landslide defeat

Viktor Orbán has vacated his parliamentary seat after Fidesz’s landslide defeat brought the party into opposition for the first time in over a decade. He did not take up his seat in the new parliament.

Sources: BBC

Palestinians vote in West Bank and Gaza — first since 2006

Local elections were held in the occupied West Bank and Gaza’s Deir el-Balah — the first vote in that Gazan city since 2006. Hamas and other armed factions did not participate. Residents voted amid ongoing destruction and displacement, many expressing a strong desire for change.

Sources: BBC · Al Jazeera

Ukraine

Ukraine strikes the Urals for the first time

Ukrainian drones hit Yekaterinburg and Chelyabinsk on April 25 — roughly 1,600–1,700 km from the front — the farthest documented strikes of the war, with over 100 UAVs reportedly involved. Russian officials, including Shoigu, had acknowledged since March that the Urals were in the “immediate threat zone.” In a separate overnight operation on April 25–26, drones struck the Yaroslavl oil refinery (~700 km from the front), one of Russia’s largest at 15.7 million tons annual capacity, triggering a major fire with 15+ explosions.

Sources: Militarnyi · Ukrainska Pravda

Russia maintains bombardment tempo — Dnipro toll rises to 8

Russia launched 144 drones overnight April 25–26 (Ukraine downed 124), again targeting Odesa, Chernihiv, and Dnipro. The death toll from the previous day’s mass strike on Dnipro climbed to 8 killed and 56 injured, with the mayor reporting a deliberate double-tap against first responders. Russian strikes killed at least seven more across Odesa and Kharkiv. Drone debris fell in Romania for the second time in days, prompting Bucharest to summon the Russian ambassador.

Sources: Ukrainska Pravda · Ukrainska Pravda · Ukrainska Pravda · Guardian · BBC

Ukraine’s cyber unit breached Russian satellite network for years

Ukraine’s cyber division infiltrated “Gonets,” Russia’s military satellite communications network, in an operation running from 2023 to 2025. The breach gave Ukrainian intelligence sustained access to Russian military communications — one of the most significant offensive cyber operations disclosed during the war.

Sources: United24 Media

Pokrovsk pressure continues; motorcycle assaults go theater-wide

Russian forces advanced northwest of Hryshyne and reportedly seized Bilytske north of Pokrovsk, continuing to press Ukraine’s most stressed sector. The motorcycle and ATV assault tactic — first documented in Pokrovsk — has now spread to Kharkiv Oblast and the Kostyantynivka direction, pointing to a deliberate theater-wide tactical shift as Russian commanders exploit poor weather to enlarge infiltration groups.

Sources: ISW

Kremlin conditions public for rolling reserve call-ups

Kremlin-coopted milblogger Rybar’s founder gave a nationally broadcast interview arguing Russia must simultaneously enroll a large cohort to build cohesive, interoperable formations — framing mobilization around unit quality, not manpower shortage. ISW assesses this as deliberate conditioning: Russia’s recruitment rate is falling while casualties rise. Up to 80% of 2025 personnel losses were reportedly first-time volunteers sent into combat without integration.

Sources: ISW · ISW

Tech

DeepSeek-V4: hybrid sparse attention, FP4 weights, 1M context

DeepSeek-V4 arrives in two sizes (1.6T Pro, 284B Flash) with a 1M-token context window and three architectural innovations: hybrid sparse attention combining sliding window with compression, mHC (Manifold-Constrained Hyper-Connections) for gradient flow, and FP4 expert weights for serving efficiency. A novel ShadowRadix prefix cache unifies three heterogeneous KV cache pools via a radix tree. Day-0 support via SGLang and the Miles RL training framework, including verified RL pipelines with Rollout Routing Replay for training stability.

Sources: LMSYS · HN

The supply chain you can’t verify

Two complementary pieces on software supply chain trust. Simon Ramstedt dissects npm’s structural problem: packages are developer-uploaded pre-compiled binaries with no cryptographic link to source commits — even SLSA attestations leave runner images and build tools unverified. Lock files hash built artifacts, not source code. He suggests git-based dependencies or Nix as meaningfully better alternatives where source pinning is first-class. Meanwhile, lcamtuf publishes a working LD_PRELOAD hack for #include <URL> in C — satirizing npm by importing the same risk model into C/C++. “Don’t use this! If you do, you will die, and it will hurt the whole time you’re dying.”

Sources: Ramstedt · lcamtuf · Lobsters · Lobsters

GnuPG ships post-quantum encryption; Gmail gets “E2E”

GnuPG 2.5.19 lands ML-KEM (Kyber/FIPS-203) as its post-quantum encryption algorithm — the primary feature of the 2.5 series, with 2.4 reaching end-of-life in two months. Separately, Google rolls out a simplified E2E encryption flow for Gmail Business, bypassing S/MIME certificate management via Client-Side Encryption keys. Worth watching: Google’s “E2E” in enterprise contexts historically means E2E to Google’s infrastructure, so the actual threat model warrants scrutiny.

Sources: GnuPG · Google Workspace · HN · Lobsters

EU age verification as trojan horse for digital ID

A technical teardown of the DSA’s age-verification fallback argues it functions as centralized digital ID infrastructure. The protocol requires hardware attestation via Google or Apple (excluding GrapheneOS and custom Linux phones), the zero-knowledge proof layer is “in the repo and not switched on,” and the design lacks proximity verification — enabling relay attacks where adults proxy verification for minors. The author argues the credential system could eventually link to Digital Euro, enabling remote account deactivation as enforcement.

Sources: Juraj Bednar · HN

Amateur solves 60-year-old Erdős problem with ChatGPT

A non-professional mathematician used ChatGPT to solve an Erdős combinatorics problem that had been open for roughly 60 years. Not full automation — AI as interactive collaborator to explore the problem space. Scientific American covers the case as an example of AI-assisted mathematical discovery where the human steers and the model helps search.

Sources: Scientific American · HN

Linux kernel weighs dropping old drivers as AI bug reports flood maintainers

Kernel maintainers are discussing removing legacy network drivers partly because AI-generated bug reports are flooding them with technically valid issues for hardware nobody uses. The reports require human triage for drivers with essentially zero active user base — a novel maintenance cost that tips the cost-benefit calculation toward removal.

Sources: Phoronix · Lobsters

Hyper-DERP: Tailscale relay at half the CPU cost

An open-source Tailscale DERP relay in C++/io_uring that matches throughput on half the vCPUs. At 8 vCPUs it clears what Tailscale’s derper needs 16 for; under extreme load (5 Gbps, 2 vCPUs) Tailscale loses 93% of packets while Hyper-DERP holds at 0.2%. Three choices drive the gap: kernel TLS offloads encryption, io_uring batches 50+ operations per syscall versus epoll’s polling, and a share-nothing per-core design eliminates lock contention.

Sources: hyper-derp.dev · Lobsters