World

Hormuz: ceasefire holds, but IRGC draws a red line around Iran’s tankers

The US-Iran ceasefire remained in effect Saturday as Washington awaited Tehran’s formal response to a proposed interim deal. Iran’s Revolutionary Guards issued a direct warning: if Iranian tankers come under fire, US installations in the Middle East will be targeted. Satellite imagery revealed a suspected oil slick near Iran’s Kharg Island — a critical export hub — raising concerns about environmental damage. A new analysis finds the conflict is depleting global strategic petroleum reserves at an unprecedented rate, with 20% of world oil supply still disrupted through Hormuz. Neither side can sustain the standoff indefinitely.

Sources: Al Jazeera · The Guardian · Financial Post · The Guardian · NPR

Israel reportedly built secret military base in Iraqi desert

Israel constructed a clandestine military base in the Iraqi desert to support its air campaign against Iran, according to Times of Israel and Ynet. Israeli forces also struck armed groups that came close to discovering the installation. The revelation draws Iraq into the conflict as an operational theater and raises questions about Iraqi sovereignty.

Sources: Times of Israel · Ynet

Israeli strikes kill 39 in Lebanon; Gaza bombardment continues

Lebanon’s health ministry reported 39 killed in Israeli strikes — despite a ceasefire announced the previous month — as Israel and Hezbollah continued trading fire. In Gaza, overnight airstrikes hit Al-Shati Refugee Camp. Turkey’s foreign minister held parallel talks with a Hamas official with no resolution in sight.

Sources: BBC · Al Jazeera

UK Labour MP threatens to trigger leadership challenge by Monday

Catherine West publicly threatened to collect the signatures herself to force a leadership contest against Keir Starmer by Monday if cabinet members fail to act. The ultimatum reflects Labour’s deepening fractures after the May local elections, where the party shed votes to Reform UK on the right and others on the left.

Sources: BBC · The Guardian

Denmark turns right after Frederiksen fails to form coalition

King Frederik X tasked centre-right politician Troels Lund Poulsen with forming a new government after Prime Minister Mette Frederiksen could not assemble a ruling coalition — another European centre-left government losing ground.

Sources: The Guardian

One Nation wins first Australian lower house seat; coalition fractures

Pauline Hanson’s One Nation claimed its first federal House of Representatives seat in the Farrer by-election. Nationals MP Colin Boyce publicly considered defecting, pressure is mounting on opposition leader Angus Taylor, and Hanson declared her party “here for the long haul” — a rightward fragmentation pattern mirroring Europe and the UK.

Sources: BBC · The Guardian · The Guardian

Ukraine urges US to investigate Starlink on Russia’s shadow fleet

Ukraine called on Washington to investigate whether Russia’s oil sanctions-evasion shadow fleet is using SpaceX Starlink terminals — which would implicate Starlink infrastructure in funding the war and raise questions about US sanctions enforcement.

Sources: Kyiv Independent

India and Pakistan: one year after their four-day war

A year after their brief but intense conflict, both sides claim strategic victories while tensions simmer. The war shifted military doctrines and tested diplomatic networks but produced no decisive outcome. Separately, a car bomb and ambush killed at least 12 police in Bannu, Khyber Pakhtunkhwa — underscoring the persistent insurgency in Pakistan’s northwest.

Sources: Al Jazeera · Al Jazeera

Ukraine

Ceasefire in name only

Ukraine’s General Staff recorded 147 combat engagements on May 9 and 27 Russian drones overnight into May 10. Zaporizhzhia Oblast absorbed 780 strikes during the “truce” day. A Russian strike on a nine-storey residential building in Kharkiv’s Industrialnyi district injured five, including two children. Kherson and Dnipropetrovsk oblasts were hit by drones overnight. ISW notes the ceasefire lacks every prerequisite for durability: no enforcement mechanism, no third-party monitoring, no dispute resolution process.

Sources: Ukrainska Pravda · Ukrainska Pravda · Ukrainska Pravda · Ukrainska Pravda

Russia uses ceasefire pause to regroup for Pokrovsk and Kramatorsk

Ukrainian commanders observed Russian forces exploiting the reduced tempo for rotations, logistics, and position fortification across the Kupyansk, Lyman, and Slovyansk directions. The 90th Tank Division has been redeployed to the Pokrovsk direction, with Russia establishing command posts in Myrnohrad. Ukrainian intelligence reports a May 30 Kremlin deadline to reach Kramatorsk’s outskirts, with two fresh battalions and heavy equipment accumulating in occupied Bakhmut — where Ukrainian airstrikes have already destroyed roughly half the equipment at one depot.

Sources: ISW · Army Inform

Ukrainian drone paralyzes airports across southern Russia

A Ukrainian drone struck an air traffic control center in southern Russia, grounding or rerouting flights across a strategically sensitive region — one of the more impactful infrastructure strikes of the conflict.

Sources: Moscow Times

352,000 confirmed dead

Meduza and Mediazona’s updated estimate — drawing on death registries, Rosstat data, court records, and inheritance filings — puts confirmed Russian military deaths at a minimum of 352,000 through end of 2025. This is the first count to include ~90,000 servicemembers declared missing and presumed dead by Russian courts. Total Russian casualties (killed and seriously wounded) reportedly exceed 1.3 million as of February 2026.

Sources: Mediazona · NYT

Tech

Bun rewrites 960k lines of C/C++ to Rust in six days with AI

Jarred Sumner converted the entire Bun runtime — 960,000 lines of C/C++ — to Rust in six days using AI assistance, achieving 99.8% test compatibility on Linux x64 glibc. The motivation was eliminating memory safety issues rather than chasing performance. The rewrite preserves the same architecture while gaining Rust’s compiler-enforced safety guarantees.

Sources: Thread · HN

LLMs corrupt ~25% of document content in long workflows

A study across 19 LLM systems and 52 professional domains finds frontier models corrupt an average of 25% of document content by the end of long agentic workflows. Errors are sparse but severe, accumulate silently, and worsen with document size. Even tool use fails to mitigate the problem — a fundamental reliability issue, not a capability gap.

Sources: arXiv · HN

Security: cPanel ransomware, React Server Components RCE, FreeBSD privesc

cPanel zero-days. A ransomware campaign exploited three new vulnerabilities to compromise ~44,000 servers before patches existed — a significant supply-chain-adjacent incident for shared hosting. — Copahost · HN

React Server Components. CVE-2025-55182 — critical RCE in Next.js 15+’s Flight protocol. Weak type validation allowed arbitrary server-side JavaScript execution. After initial mitigations, researchers found 23 distinct WAF bypasses; Vercel paid bounties on all of them. ~2% of 4 million scanned Next.js domains affected. — Writeup · Lobsters

FreeBSD execve(). Local privilege escalation via execve() — FreeBSD-SA-26:13.exec. Patch available. — Advisory

AI is undermining vulnerability disclosure cultures

Jeff Kaufman argues AI coding assistants disrupt both responsible and full disclosure: they compress the safe window after patches by enabling rapid exploit development, and scale vulnerability reproduction unpredictably. The shift in vulnerability economics has concrete implications for how researchers, vendors, and defenders operate.

Sources: jefftk.com · Lobsters

Dillo browser argues for a forked, simpler web

The Dillo project publishes a manifesto for a “forked web” — a subset that’s simpler, more accessible, and free from the complexity trap of modern standards. Both a philosophical argument and a practical proposal for content that works in lightweight browsers without the full stack.

Sources: Dillo lab · Lobsters

WebRTC is the problem: the case for Media over QUIC

The moq.dev blog argues WebRTC’s complexity, browser lock-in, and poor scalability make it a poor foundation for real-time media. Media over QUIC is presented as a cleaner alternative — more composable, server-friendly, and aligned with modern transport infrastructure.

Sources: moq.dev · Lobsters

Chrome silently installs 4GB Gemini Nano model

Google Chrome is downloading a ~4GB Gemini Nano model to users’ machines for AI features, often without clear awareness or consent. The storage is difficult to reclaim and not presented as optional — a meaningful precedent for browsers treating disk space as a deployment target for local inference.

Sources: The Verge · Lobsters

let-go: Clojure in Go, boots in 7ms

A Clojure-like language (~90% JVM Clojure compatible) in pure Go — ~10MB static binary, ~7ms cold boot (50x faster than JVM Clojure, 3x faster than Babashka). Algorithmic throughput within range of GraalVM alternatives, practical where JVM startup is prohibitive.

Sources: GitHub · HN