Josse-posten

The Iran war ends on paper as the G7 pivots to Ukraine — and Ukrainian drones turn the pressure on Moscow into a nationwide fuel crisis.

US and Iran Sign 14-Point Peace MOU, Ending the War

A man holds an Iranian flag after the US and Iran announced a deal to end their war. Photo: Reuters

The US and Iran have signed a Memorandum of Understanding ending their 107-day conflict, with a 60-day window to negotiate a final settlement. The 14-point framework — leaked via Bloomberg and Al Arabiya — reportedly includes a $300 billion reconstruction fund (more than half already committed), Iran’s restored right to sell oil, and the lifting of the US naval blockade, which Tehran’s deputy foreign minister confirmed has been “lifted.” JD Vance traveled to Switzerland for the signing.

The strategic reversal is stunning: Supreme Leader Khamenei and key officials were killed during the campaign, yet the regime survived intact enough to negotiate, and Western powers — once aligned with the offensive’s regime-change aims — have pivoted to backing Tehran’s rehabilitation in a matter of weeks. Most Iranians frame the deal as necessity rather than victory, doubting it will last or improve daily life. (Aftermath, Republican skepticism, and the Israel rift covered in World.)

G7 Unites Behind Ukraine at Évian; Trump Signals Russian Oil Sanctions Return

G7 leaders at their working session in Évian-les-Bains, June 17, 2026. Photo: Getty

In an unexpected outcome at the G7 summit in Évian-les-Bains, Trump signed a joint declaration pledging “unwavering support for Ukraine in defending its freedom, sovereignty, and territorial integrity.” Leaders agreed to expand air-defence deliveries, consider licensing Ukraine to produce interceptor missiles domestically, include Kyiv in a new $1 billion US humanitarian package, and tighten sanctions on Russia’s energy sector — with Trump signalling a swift return of sanctions on Russian oil. Zelensky, meeting Trump on June 16, is pushing for direct talks with Putin before winter; the Kremlin denied receiving any such proposal and again rejected a head-of-state meeting.

European allies framed the Iran deal as opening a window to refocus pressure on Moscow — but worry the freshly unburdened Trump may try to run the peace process himself and trade away too much Ukrainian sovereignty for an early settlement. Trump’s own posture stayed ambiguous, claiming the war has “no impact” on the US while vowing to help end it. (Frontline and battlefield momentum in Ukraine.)

Russia Strikes Kyiv Cathedral; Ukraine’s Drones Ignite a Russia-Wide Fuel Crisis

The historic Kyiv Pechersk Lavra compound after a Russian missile strike, June 15, 2026. Photo: Getty

Russian missiles killed 11 people in Kyiv and set the historic Kyiv Pechersk Lavra cathedral ablaze — one of the war’s most symbolically charged attacks on Ukrainian heritage. Ukraine’s “just response,” as Zelensky put it, was a drone strike that halted the Moscow Oil Refinery in Kapotnya, a facility supplying ~40% of Moscow’s fuel.

That strike is part of a campaign now reshaping Russia’s home front. Ukraine’s General Staff says hits on 16 refineries have cut total refining capacity by 30%, driving gasoline output to a 16-year low. Fuel rationing has spread across most of Russia — Rosneft, Tatneft and Bashneft are all imposing per-customer purchase limits, queues are forming on major highways, and Moscow has extended permission for substandard fuel to enter the domestic market.

Indicator Value Change
S&P 500 (f) 7,598 +0.14%
Dow 30 (f) 52,458 -0.02%
Nasdaq (f) 30,497 +0.60%
Russell 2000 (f) 2,969.8 +0.19%
VIX 16.35 -0.37%
Gold 4,346.3 -0.19%
BTC $64,975 -2.24%
EUR/USD 1.1606 -0.04%
USD/NOK 9.4846 +0.12%
  • Gold -0.19%, VIX near lows — US-Iran MOU signed; markets pricing de-escalation, though Israeli strikes in Lebanon and Hormuz uncertainty keep moves modest
  • BoJ raised rates to 1% (31-year high), citing Iran war energy inflation — Fed and BoE expected to hold

World

The Iran Deal’s Strains: Lebanon, Hormuz, and a Jerusalem Frozen Out

Despite the MOU, Israel has continued operations in southern Lebanon, killing at least four people and drawing an Iranian warning that the deal explicitly requires Israeli withdrawal. Trump publicly criticised Netanyahu — reportedly saying “if Israel can’t do the job without killing everyone, Syria should do it” — and the FT reports the two leaders have reached a genuine breaking point. Washington pointedly denied Israel’s request to see the deal text before signing; far-right minister Ben Gvir abruptly cancelled a US trip after the embassy demanded fingerprints for a visa.

At home, Republican senators are skeptical, demanding details Vance says remain in unwritten back-channel commitments; CNN reports US officials are actively downplaying the document as incomplete.

Strait of Hormuz: Ships Stay Wary, and Iran Can Now Close It at Will

Shipping has not returned to pre-conflict levels through Hormuz despite the framework deal — experts cite residual mines, security uncertainty, and Iranian toll demands. More consequentially, a US intelligence assessment now concludes Iran has permanently strengthened its ability to close the strait — through which ~20% of global oil passes — “at will,” leverage analysts say rivals nuclear deterrence and which likely pushed Washington toward a deal in the first place. Brent crude slid to its lowest since early March. Anger meanwhile mounts in India over Washington’s refusal to apologise for killing Indian sailors aboard commercial vessels during the campaign, pushing US–India relations to a multi-year low.

Ebola Outbreak Kills Over 170 in DRC

The Ebola outbreak centred on Bunia in the DRC has killed more than 170 people, devastating communities and the local economy as public-facing workers — teachers, motorcycle-taxi drivers, travel agents — bear disproportionate risk. Seven patients have recovered and been discharged. The outbreak has also sparked protests in Kenya’s Laikipia County, where a US-linked quarantine centre has stirred land-rights and sovereignty concerns rooted in the region’s colonial past.

Messi’s Hat-Trick Headlines a Wild World Cup Opening

Lionel Messi scored three goals — 20 years to the day after his World Cup debut — as Argentina opened their title defence with a 3-0 win over Algeria, becoming the first player to appear at six World Cups. Elsewhere in the North American tournament’s early rounds: Cape Verde held Spain to a 0-0 draw, Norway beat Iraq 4-1 with Haaland scoring twice, and France’s Mbappé broke Giroud’s national goal record against Senegal.

Also today

Europe
Hungary’s parliament voted to cap the premiership at eight years, effectively barring Orbán from ever returning — BBC
The Netherlands Senate banned gay conversion therapy — NL Times
The EU ruled airlines must allow carry-on bags free of charge, threatening Ryanair and Wizz Air’s fee model — YLE
France’s intelligence service is dropping Palantir for domestic provider ChapsVision over US “strategic dependency” fears — The Guardian
Hamas operatives reportedly planned a major European terror attack for the October 7 second anniversary, disrupted before execution — Jerusalem Post
Americas
Brazil’s Supreme Court sentenced Eduardo Bolsonaro to four years for seeking US sanctions on judges in his father’s coup trial — The Guardian · BBC
The DOJ moved to kill the NAACP’s air-pollution suit against Musk’s xAI, citing “national, economic, and energy security” — Al Jazeera
FBI filings reveal a foiled plot to attack a White House UFC event with snipers and drones, citing grievances over the Epstein files and data centres — BBC
UN chief Guterres condemned global indifference to Haiti as gang violence kills ~2,300 this year — NPR · Al Jazeera
World
Norway’s Marius Borg Høiby, son of Crown Princess Mette-Marit, was sentenced to four years for rape — BBC
The Bank of Japan raised rates to a 31-year high of 1%, citing Iran-war energy inflation — The Guardian
Somaliland opened an embassy in Jerusalem, six months after Israel became the first state to recognise its independence — BBC
A US Air Force B-52 crashed in California on a test mission, killing eight — BBC
A GCPEA study documents a 40% surge in attacks on schools — 8,556 incidents across 83 countries — The Guardian

Ukraine

McFaul: Ukraine Is Winning — and Time Has Shifted to Kyiv’s Side

Stanford’s Michael McFaul argues in a viral essay that Ukraine is winning across seven measurable dimensions. Putin’s core objectives have failed: unification support sits at 0.3%, Zelensky remains in power, and Russia’s spring 2026 offensive was a “complete disaster” — DeepState recorded a net Russian loss of 1 square mile in the four weeks to June 9, against 41 gained earlier. Ukraine targets 7 million drones annually and has effectively destroyed Russia’s Black Sea navy; CSIS estimates 1.2 million Russian casualties, with NATO’s Rutte citing 30,000 monthly losses — exceeding Soviet losses in the entire Afghan war.

Frontline Stalls as Russia Escalates Infiltration in Donetsk

No confirmed territorial changes on June 16. Russian forces are pressing via small-unit infiltration across multiple axes — Kozacha Lopan north of Kharkiv, Podoly near Kupyansk, and most pressingly Kostyantynivka in Donetsk, where ISW flagged AI-generated flag-raising footage as part of an expanding cognitive-warfare campaign. Analysts warn the slow “Pokrovsk scenario” could repeat there, setting up a push toward Sloviansk and Kramatorsk. Ukraine intercepted a company-sized mechanized assault near Zakitne (1 tank, 3 IFVs, 28 motorcycles, ~50 infantry — all destroyed), and downed 114 of 132 overnight drones alongside two Iskander-M missiles.

Lukashenko Breaks with the Kremlin Line

In an Al Arabiya interview, Lukashenko acknowledged Russian battlefield limitations, warned that a Belarusian front would be indefensible and risk direct NATO conflict, and offered to mediate peace talks — a notable departure from prior pro-Kremlin rhetoric. He reportedly also apologised to Zelensky for earlier threats. ISW still assesses Belarus as a Russian co-belligerent, but the shift reads as Minsk reading the war’s trajectory and distancing itself from a potentially losing side.

Russia’s Oreshnik Stockpile Nearly Exhausted, Guidance Flaws Exposed

Ukrainian intelligence firm Dallas Analytics reports Russia has just one operational Oreshnik IRBM left after firing three in 2026 — the most recent of which crashed in occupied Donetsk in May due to a flawed Soviet-era GU-503 gyroscope, deviating tens of kilometres off target. Putin ordered four more on an accelerated schedule, but quality controls were bypassed to meet deadlines, reportedly worsening the guidance problem and limiting Russia’s ability to mount high-profile ballistic strikes near-term.

Investigations & Security

Russian Warship Fires on a British Yacht as London–Moscow Tensions Spike

A Russian frigate fired warning shots at a retired British couple’s yacht in the English Channel — they had already altered course when the shots came. Starmer called it “deeply concerning and reckless,” warning from the G7 that Russia conducts proxy attacks on the UK “every day.” The incident lands amid a fast escalation spiral: Britain seized a Russian shadow-fleet tanker (its Indian-national captain now charged with sanctions violations), Moscow issued explicit escalation warnings, and British troops are deploying to NATO’s eastern flank within miles of Russian territory. An iNews investigation adds a sharp irony — UK-registered vessels embedded in Russia’s shadow oil fleet generate Putin some £700M a month.

Bellingcat’s AIS Heading Trick Unmasks a Russian Grain-Smuggling Route to Libya

Satellite image of the bulk carrier Grumant docked at Feodosia, occupied Crimea, Feb 15, 2026. Photo: Bellingcat

Bellingcat developed a technique to track ships in GPS-spoofed environments: because compass-based AIS heading data isn’t affected by GNSS jamming, investigators matched the Grumant’s consistent 267–268° heading to Feodosia Port’s exact bearing (267.5°), confirming its presence at the occupied Crimean port despite unreliable position data. The ship was then tracked to Benghazi — only the second confirmed instance of Russian vessels delivering stolen Ukrainian grain to Libya. Five ships from earlier investigations now face EU sanctions; one has US Treasury sanctions.

Macron Quietly Buries French Nuclear Orthodoxy, Pitches a European Deterrent

At a Breton submarine base in March, Macron announced three historic breaks with French doctrine: expanding the arsenal, ending public disclosure of warhead numbers, and launching “advanced deterrence” — offering allies strategic consultations, joint nuclear exercises, and potential deployment of French nuclear-capable aircraft, as a European fallback if American guarantees erode. The risks are steep: France’s fewer than 300 warheads are designed for counter-value strikes, not NATO’s graduated responses, and control stays exclusively French. The deeper risk is political — the National Rally, leading 2027 polls, opposes subordinating French sovereignty to allies, so Macron may be building architecture that collapses the moment he leaves office.

The Fall of Singapore: Three Hard Lessons for Indo-Pacific Strategists

Iskander Rehman’s “applied history” essay uses the 1942 fall of Fortress Singapore to illuminate modern strategy. Three lessons: allied coordination must be built before conflict, not improvised during it; theatre prioritisation is inescapable (Churchill chose Soviet survival over Singapore — and the Iran war has already drained Indo-Pacific weapons inventories “for years”); and planners must think in branching scenarios, since unexpected shifts made Singapore indefensible before a shot was fired. A quiet warning about US–China contingency planning under resource strain.

Also today

  • A Russian artist and Putin critic, Robert Kuzovkov, was shot dead in Poland, while BBC reporting exposed a Russia-orchestrated arson campaign against the UK PM using fake far-right and Muslim front groups — BBC: artist killed · BBC: arson campaign

Tech & AI

US Export Control Suspends Anthropic’s Fable 5 and Mythos 5 Globally

On June 12 the US government issued an export-control directive forcing Anthropic to suspend worldwide access to its newest models, Fable 5 and Mythos 5, citing national-security concerns over a claimed jailbreak: asking the model to “fix code” could surface security vulnerabilities. Anthropic publicly disagreed, noting the capability exists in competing products and arguing such jailbreak discoveries “would essentially halt all new model deployments for all frontier model providers.” Resolution depends on Anthropic meeting unspecified security requirements; no timeline announced, refunds offered. All other models (Opus 4.8, Sonnet 4.6, etc.) remain available.

Local Models Are Genuinely Competitive Now

Vicki Boykis makes the empirical case that local LLMs hit a practical inflection point in early 2026. Her setup — an M2 Mac with 64GB RAM, LM Studio, and a quantized Gemma-4-12b-qat — reaches ~75% of frontier quality for real agentic coding tasks that were impossible locally six months ago. The turning point was GPT-OSS’s release, after which she stopped routinely double-checking results against API models. Notable for being grounded in real workflow rather than benchmarks.

Claude Opus Caught Malware Mid-Merge — Then Reverse-Engineered It

A developer running Claude Code (Opus) for automated branch consolidation reported that Opus stopped during a merge, identified malware in the incoming commit’s next.config.js, refused to proceed, then reverse-engineered the payload without executing it. The likely mechanism: the file diff was in Opus’s active context during the merge, so it actually read the file rather than trusting git metadata. The sharp caveat from the thread: anyone running Claude Code in auto-accept mode would have bypassed the block entirely. Relatedly, a r/ClaudeAI thread on avoiding AI “slop” surfaced a strong pattern — run a second agent as a “hostile auditor” given only the frozen spec and the diff, separating an authorization gate (did it stay in scope?) from a quality gate (is it good?).

zlib-rs Ships in Firefox 151: 3–32× Faster, Memory-Safe Decompression

Firefox 151 replaces C zlib with zlib-rs for gzip decompression, achieving 3.3×–32.5× speedup on one-shot benchmarks and 2.7×–10.86× on streaming, with the biggest gains on Linux x86_64. Beyond speed, Rust prevents the silent data corruption C would produce on bounds-check failures. Integration required updating Firefox’s test suite, since zlib-rs produces different (but valid) compressed bytes than stock zlib.

Chrome 150 Removes the Final Manifest V2 Bypass — uBlock Origin Dies in Chrome

Chrome 150, shipping June 30, removes the ExtensionManifestV2Disabled flag that power users relied on to keep MV2 ad blockers alive; Chrome 151 in July strips the remaining flags. uBlock Origin and most popular ad blockers cease to function in Chrome, with Edge and Opera expected to follow. The MV3 replacement sharply limits what extensions can intercept, in ways that benefit Google’s ad business. Firefox remains unaffected.

Banned Book Library Embedded in a Smart Lightbulb

The captive-portal book library running on an ESP32C3 hidden inside a standard LED bulb.

Richard Osgood built a dead drop for banned books using an ESP32C3 inside a standard smart LED bulb. It broadcasts an open Wi-Fi access point with a captive portal serving EPUB files — disguised in plain sight as an ordinary lightbulb. With ~2MB usable SPIFFS, each bulb holds ~5–6 books. He custom-wrote firmware with ESP-IDF rather than modifying Tasmota, and published teardown notes for several bulb variants.

Also today

Security
A LinkedIn “job offer” delivered malware via an npm prepare script — a recruiter using a stolen identity asked devs to “fix deprecated npm modules” in a repo that fetched and ran a C2 payload on npm installroman.pt
A researcher could have hijacked every FIFA World Cup 2026 broadcast via a client-side auth bypass exposing live RTMP ingest URLs and stream keys; patched in hours, never formally acknowledged — bobdahacker.com
Honda Civic “EvilValet”: headunit firmware ships the public AOSP test key, letting anyone sign and USB-flash malicious updates with brief physical access — juniperspring.org
A 27-year-old OpenBSD PPP auth bypass — bcmp(buf, ref, 0) always returns match — let a rogue PPPoE server authenticate with zero-length credentials; fixed June 2026 — Argus Systems
A deep IIS exploitation reference: tilde 8.3 enum, web.config/ViewState RCE, cookieless session tricks — mll.sh
Languages & tooling
cuTile-rs — NVIDIA open-sources safe, data-race-free GPU kernels in Rust — GitHub · HN
Async task locals in Rust without tokio, built from scratch on how poll() actually works — wolfgirl.dev
bygge-zig — 374 lines of Zig replicate ~20% of Cargo, building real projects like Mozilla’s Glean SDK — fnordig.de
Why memory-safety CVE counts can’t be compared between Rust and C/C++ — Rust files a CVE whenever a safe API can cause a memory bug, inflating counts by design — kobzol.github.io
Microsoft’s x86 emulator detected a compiler’s 64KB stack-init unrolled into 65,536 writes and replaced it with a tight loop mid-translation — The Old New Thing
AI/ML research
FeynRL argues open ML research needs open training frameworks, not just weights — an SFT/DPO/PPO/GRPO post-training stack built on “locality of change” — GitHub
HuggingFace Transformers quietly contains a full Mixture-of-Experts modeling_gpt_oss.py — rotary embeddings, top-k routing, load-balancing loss — GitHub
LLMs have model-specific name fingerprints (Claude → Elena Vasquez/Marcus Chen); the method surfaced 1,655 ghost-authored Zenodo records with real DOIs — arXiv:2606.02184
Microsoft Research’s Next-Latent Prediction trains transformers to predict their own future internal states, not just the next token — r/MachineLearning
quicktok — a C++ BPE tokenizer with tiktoken-identical output, 3.5–11× faster via SIMD and a 2-byte trie — GitHub
gzip as a language model: compression-prediction equivalence demonstrated with beam search over compressed length — nathan.rs
The Netherlands’ TNO is building GPT-NL, a sovereign Dutch-language model for public-sector use — TNO
Also
A class action (Kahn v. Anthropic) alleges Max plan usage multipliers are overstated — Max 5x delivering ~3.5×, Max 20x only 6–8× — Decrypt
Claude Code’s Auto Memory persists corrections and preferences across sessions in ~/.claude/projects/<project>/memory/guide
GrapheneOS has been ported to Android 17, with official Pixel releases imminent — forum
KDE Plasma 6.7 released — Vietnamese lunar calendar widget, print-queue badges, redesigned Discover — KDE
RFC 10008 standardises the HTTP QUERY method — GET semantics with a request body — RFC 10008
A paper argues semiclassical (classical) gravity would let a massive qubit solve NP-complete problems in polynomial time — framed as a reductio that gravity must be quantized — arXiv:2606.14806
cd ~/repos/ratatosk && claude --resume 24136e5a-1998-48a9-9d86-f383801eb177