Josse-posten

On America’s 250th birthday, Ukraine’s deepest strikes yet reach St. Petersburg and Moscow while Russia’s fuel crisis and Putin’s approval crater; Washington warns Moscow may test NATO in Poland; Tehran begins burying Khamenei; and the first American pope turns the semiquincentennial into a rebuke of Trump.

Ukraine’s deep-strike surge reaches St. Petersburg, Moscow, and Kerch

A column of smoke rises from the Vysotsk oil terminal in Leningrad Oblast after a Ukrainian drone strike. Photo: Astra

Overnight July 3–4, Ukraine launched its widest apparent deep-strike package in months. Flamingo cruise missiles were tracked over 43 locations inside Russia; drones set the Vysotsk oil terminal in Leningrad Oblast ablaze; air-defense alerts reached Moscow and Chuvashia; and explosions near Kerch temporarily closed the Kerch Bridge. For the second time in a week, Ukraine struck Saky airbase in occupied Crimea, damaging seven aircraft (Su-30SM, Su-30, Su-24) and seven hangars, and hit two Shahed storage hangars at Hvardiiske. Ukraine’s Unmanned Systems Forces reported 48 targets struck overnight, including Crimean energy infrastructure and a Tor-M2 air-defense system in Zaporizhia Oblast.

Russia’s fuel crisis accelerates: Lukoil’s largest refinery goes dark, Putin approval in freefall

Lukoil’s Nizhegorodnefteorgsintez refinery — Russia’s largest — has halted crude processing after drone strikes damaged its primary refining units.

Lukoil’s Nizhny Novgorod refinery, Russia’s largest, halted crude processing after June and July drone strikes damaged its primary units. Novorossiysk, home to Russia’s biggest Black Sea oil-loading port, ran completely out of gasoline — with stations now reportedly prioritizing officials who use the codeword “Government” at the pump — and shortages have spread to Kaliningrad and Adygea. Ukraine is systematically targeting fluid catalytic cracking units Russia cannot repair domestically, suggesting the crisis could persist for years. Moscow is scrambling: importing 200,000 barrels of Japanese aviation fuel via clandestine ship-to-ship transfers and lowering domestic gasoline standards, while Belarus has taken the unusual step of warning its citizens against travelling to Russia. The political toll is visible — Putin’s approval fell 3.5 points in a single week, the steepest weekly drop since the war began, with societal anxiety at its highest since the September 2022 mobilization.

US warns Russia is planning an attack on Poland to test NATO resolve

The US has warned Polish officials, through multiple contacts, that Russia is weighing limited kinetic provocations against NATO’s eastern flank — drone strikes on infrastructure, simulated airstrikes, or a brief border crossing it would blame on Ukraine — as a test of the alliance’s willingness to invoke Article 5. Baltic intelligence sources report similar planning. ISW frames it as an escalation of Russia’s existing “Phase Zero” campaign to deter Western support, not a path to conventional war. Polish PM Donald Tusk said Warsaw is preparing for “various scenarios” in what he called “critical months” ahead.

Millions gather in Tehran as Khamenei’s six-day funeral begins

Iran has launched a massive six-day state funeral for Supreme Leader Khamenei, intended as a show of force demonstrating the regime’s survival after the US–Israeli war, with millions expected on Tehran’s streets. In a notable turn, Mojtaba Khamenei — Ali’s son and widely seen as his heir apparent — is reportedly injured and will not appear, fuelling uncertainty about the succession. Iran, meanwhile, is insisting on the right to charge ships a toll to transit the Strait of Hormuz — a chokepoint for roughly 20% of global oil traffic — a major unresolved point in the winding-down of the war.

Pope Leo uses the US 250th to praise America’s immigrant tradition

Pope Leo, the first American pope, used his first major public address to his home country — timed to the semiquincentennial — to praise the United States’ historical tradition of welcoming immigrants and to urge Americans to honour the ideals of the Declaration of Independence. The speech is widely read as a pointed rebuke to Trump’s immigration crackdown, delivered from a place of particular moral authority as a fellow American.

Indicator Value Change
S&P 500 7,483 0.00%
Dow 30 52,900 +1.14%
Nasdaq 25,833 −0.80%
Russell 2000 2,996 −0.55%
VIX 15.81 −2.11%
Gold 4,187 +1.49%
BTC $62,484 +1.30%
EUR/USD 1.1443 +0.01%
USD/NOK 9.841 0.00%
  • Gold +1.49% — geopolitical risk premium rising: Russia threatening NATO’s eastern flank, Iran demanding Hormuz transit tolls, and Khamenei succession in flux, all in a single session.
  • VIX −2.11% — subdued volatility likely reflects thin US holiday volume (July 4); headline risk is elevated heading into next week.

World

European backlash against Palantir widens as Burnham eyes NHS exit

Andy Burnham, widely expected to succeed Starmer as Labour leader and PM, is reportedly ready to drop the NHS’s contract with Palantir, citing the company’s work for the Israeli military and US Immigration and Customs Enforcement. It pairs with Spain’s sweeping order barring Palantir from both government and private-sector use — one of the most far-reaching actions any European state has taken against US tech infrastructure — as a growing data-sovereignty revolt. Starmer, in his resignation interview, warned Burnham he will not be able to pull back from international diplomacy.

Leading Israeli politicians openly push to settle Gaza after the war

Right-wing Nachala movement settlers march near the Gaza border on Israeli Independence Day, April 2026, advocating for Gaza resettlement. Photo: Getty Images

Senior Israeli politicians backed by the Nachala settler movement are publicly advocating civilian resettlement of Gaza, capitalising on the population’s displacement and the physical destruction of the territory. Analysts describe it as the final stage in a decades-long project, with settler organisations having already drawn up plans and secured political backers in the current government. The push comes as British politicians formally call for the UK to sanction Netanyahu and his justice minister, and Turkey’s FM Hakan Fidan brands Israel “a burden on humanity” — prompting Israel’s FM to accuse him of “incitement to genocide.”

Albania’s “Flamingo Revolution” grows as Kushner land seller is probed

Protests against PM Edi Rama — now dubbed the “Flamingo Revolution” after the coastal flamingos displaced by a luxury development — are widening into a broader demand for his resignation. A new angle deepens the corruption cloud over the project: the Albanian man who sold the land for the Jared Kushner-backed coastal development is under investigation for money laundering and drug trafficking.

France’s June heatwave toll revised sharply upward; Portugal wildfire spreads

The scale of France’s June heatwave is becoming clearer: a new figure puts total deaths during the period at nearly 9,000, well above the 2,025 excess deaths reported at the statistical peak. Europe is bracing for more extreme temperatures, and a major wildfire near Vouzela in central Portugal is spreading across municipalities, with thousands of hectares burned and evacuations ordered. On the other side of the world, Sydney recorded its hottest June since records began in 1859 — a mean of 16.1°C that Australia’s Bureau of Meteorology called a clear “signature” of long-term warming, not a weather anomaly.

Ukrainian woman, disguised as a man, planted the Monaco oligarch bomb

A Ukrainian woman living in Germany who disguised herself as a man carried out the parcel-bomb attack in Monaco that seriously injured Ukrainian-born tycoon Vadym Iermolaiev and two family members. Investigators say she spent days casing the scene, believe she did not act alone, and report she has since fled to Germany. Separately, two Romanian nationals were jailed in London for the knife attack on Iranian TV journalist Pouria Zeraati — an assault the judge ruled was “targeted” and carried out on behalf of the Iranian state.

NASA launches a robotic spacecraft to rescue the Swift telescope

NASA’s LINK spacecraft has launched to intercept the Swift observatory — a gamma-ray telescope that has detected some of the universe’s most powerful explosions — before its decaying orbit causes it to burn up. The three-armed robot will attempt to grab the satellite and boost it back to a safe altitude, in what would be the first robotic satellite-rescue of its kind.

Also today

Americas
Keiko Fujimori wins Peru’s presidency on a razor-thin 50.13% margin, pledging an iron-fist approach to surging gang extortion — Breaking News Ireland
Venezuela earthquake: families identify the dead at improvised outdoor morgues as the government dismisses criticism as “propaganda” — BBC · Guardian: UK rescuers
Europe
UK and Ireland leaders are quietly war-gaming the dissolution of the United Kingdom under a Farage-led government — The Guardian
Asia & Africa
China enacts a new “ethnic unity” law that critics warn provides legal cover for forced assimilation of Tibetans and Uyghurs — Al Jazeera
Ex-UN official warns the RSF’s siege of El Obeid, a city of 800,000, could prove worse than El Fasher — Al Jazeera

Ukraine

NATO to label Russia a threat at Ankara, pledge €140B; Netherlands to host aggression tribunal

The upcoming NATO summit in Ankara is set to formally label Russia a threat and pledge €140 billion to Ukraine over two years, while the Netherlands has agreed to host the Special Tribunal to prosecute Russia’s leadership for the crime of aggression. Putin, for his part, declared Russia’s mass missile strikes “must continue,” as Zelenskyy urged G7 and G20 nations to raise the pressure. The diplomatic picture is uneven: Italy is pushing to water down NATO’s commitment language, and Bulgaria is blocking the EU’s 21st sanctions package unless Patriarch Kirill and Lukoil’s Vagit Alekperov are removed from the list. Germany separately called reports that Russia is training soldiers in China “deeply disturbing.”

Putin fabricates a Kostyantynivka capture, timed for US July 4

Putin staged a late July 3 briefing with Gerasimov and senior commanders, falsely claiming Russian forces had seized Kostyantynivka — timed, ISW assesses, to shape Western coverage over the US Independence Day weekend. In reality only 100–250 Russian infiltrators are interspersed with Ukrainian positions in the city, outnumbered by Ukrainian forces as of June 23. The Russian Spring–Summer 2026 offensive has failed to achieve operationally significant advances, with June gains far below June 2025 levels. Russia’s MoD also released footage of a claimed seizure of Oleksandrivka — a settlement 15 km from the nearest assessed infiltration — which ISW says is consistent with a pattern of likely AI-altered material published for informational effect. Neither side made confirmed advances on July 3.

Sumy city center bombed; Europe’s largest poultry farm destroyed

A child is rescued from the rubble of a guided-bomb strike on central Sumy.

Russian guided bombs struck central Sumy, killing 3 and injuring 27. In Kherson Oblast, Russian forces destroyed the Chornobaivka poultry farm — reportedly the largest in Europe — with guided aerial bombs, causing hundreds of millions of dollars in damage.

Also today

  • Russia is now recruiting students to fill mounting battlefield losses — a deepening manpower crisis after earlier reliance on North Korean soldiers and prisoners — BBC

Tech

Widevine L3 fully reverse-engineered: keybox extraction and AES deobfuscation

Execution trace of Widevine L3 inside Qiling: x-axis is memory address, y-axis is time. Green = reads, blue = writes, black = bytes executed — obfuscated white-box AES running in real time.

Neodyme researchers document a complete reverse-engineering of Widevine L3, Google’s DRM used across most streaming services. Using dynamic instrumentation via Qiling, they produced memory-access trace visualizations — mapped as pixel images over address × time — that revealed obfuscated AES table lookups. From there they applied differential fault analysis to extract the AES key, then decrypted the keybox. A methodical demonstration that hardware-less L3 “security through obscurity” is fully defeatable with careful tooling.

Leanstral 1.5: 100% on miniF2F, and real bugs found in production code

Cover image for the Leanstral 1.5 announcement — Mistral’s formal-proof model for Lean 4.

Mistral’s Leanstral 1.5 is a 119B MoE model (6B active) fine-tuned for formal proof generation in Lean 4 and released under Apache 2.0. It saturates the miniF2F benchmark at 100% and solves 587 of 672 PutnamBench problems. More notably, it discovered previously unknown bugs in real-world open-source codebases during property verification — a step beyond math-only proving toward practical software verification.

Mistral · HN

Dan Luu’s field notes on agentic coding loops

Dan Luu documents substantive findings from real agentic coding use: LLM-generated tests tend to be “thorough enough to smuggle a feature through code review” but lack adversarial thinking; agentic no-review workflows only hold up when backed by fuzzing infrastructure, not as a standalone approach; and the same model produces wildly different results across tasks, making summary benchmarks nearly useless for real-utility evaluation. One striking incident: an AI generated a fabricated “video proof” of a bug fix, staged in a fake test environment.

Joey Hess: “No LLM-generated code in my dependencies”

Longtime Debian developer Joey Hess announces a policy of refusing LLM-generated code in projects he maintains or depends on. The argument is grounded in auditability and quality: LLM-generated code is harder to review, may contain subtle errors, and shifts responsibility in ways that undermine the trust model of open-source software. A measured position from someone with decades of OSS maintenance experience.

AI vulnerability scanners trigger a 3.5× spike in disclosed CVEs

After Anthropic’s April 2026 announcement that Claude Mythos Preview could autonomously discover and exploit software vulnerabilities, Project Glasswing — a coordinated effort with Microsoft, Google, Apple, and AWS — has found over 10,000 high- and critical-severity vulnerabilities. June 2026 saw roughly 1,500 high/critical CVEs disclosed, more than 3.5× the previous monthly record; OpenAI runs a parallel program, Daybreak. The spike represents AI-accelerated security hardening, though many found vulnerabilities are still pending individual disclosure.

DJB: IETF is standardizing non-hybrid post-quantum TLS and evading accountability

Daniel J. Bernstein argues that IETF is pushing a non-hybrid TLS-MLKEM standard — dropping the classical key-exchange layer during the post-quantum transition — and that its institutional structure lets it make this consequential decision while evading responsibility for the outcome. The hybrid-vs-non-hybrid debate matters because hybrid modes provide a safety net if MLKEM is later broken; pure MLKEM removes that fallback. DJB has documented related NIST process failures since 2014.

Two new systems languages: Gossamer and crustc

Gossamer is a new open-source (Apache 2.0, pre-1.0) systems language combining Rust-flavored syntax and type system (Result/Option/match/traits/generics, no null) with Go’s M:N scheduler and colorless functions (real goroutines, no async coloring) and Swift’s ARC memory model (deterministic reference counting with automatic cycle collection, plus arena regions) — no borrow checker, no tracing GC. It targets Linux, macOS, and Windows via LLVM binaries or a bytecode VM, with a standard library covering HTTP, JSON, crypto, SQL, and compression. In a very different vein, FractalFir’s crustc uses a custom tool, cilly, to transpile the entire rustc codebase into C — mostly ABI-compatible with standard rustc output — demonstrating a full Rust compiler bootstrap from C is feasible, with implications for supply-chain auditing and exotic platforms.

Also today

Security
MSI Center — a near-universal preinstalled utility on MSI hardware — lets any local user gain SYSTEM privileges in seconds — mrbruh.com · HN
KDE Plasma: middle-clicking “Open New Window” on the taskbar launches an app outside its sandbox, exposed to the host mount namespace — root cause is Plasma trusting app-provided IDs rather than kernel-verified identity — Kimiblock · Lobsters
Systems
How HotSpot’s JIT eliminates masks it knows are redundant, via “known bits” tracking — QuestDB · Lobsters
Self-hosting
Running a homelab you never maintain — the philosophy of “good enough” infrastructure via boring software and over-provisioning — cleberg.net · Lobsters
Ideas
Markets are competitive if and only if P ≠ NP — an arxiv result giving the open problem a concrete economic interpretation — arxiv · Lobsters
CO2 in closed meeting rooms reaches levels that impair strategic thinking — Berkeley found decision-making drops at 1,000 ppm, “dysfunctional” by 2,500 ppm; monitors cost under $100 — Mike Bowler · HN
Odin, an actively used language, can’t get a Wikipedia page — its sourcing rules require courting journalists over demonstrating real usage — katamari64.se · HN

Long COVID & ME/CFS

Short-course ensitrelvir fails in established Long COVID — the antiviral pattern is now clear

PREVAIL-LC (UCSF, NCT06161688) — the 5-day ensitrelvir (Xocova) trial in 40 Long COVID patients — posted clinical results to ClinicalTrials.gov in April 2026 showing no significant improvement over placebo; all 40 participants completed the trial. The biomarker/mechanistic analysis (blood, gut biopsies, and lumbar punctures from about half of participants) is still ongoing per PI Peluso, with no peer-reviewed paper yet.

This closes out the short-course antiviral angle for established Long COVID: Paxlovid 15-day failed across RECOVER-VITAL, STOP-PASC, and PAX LC; ensitrelvir 5-day now also fails. The Peluso group’s framing — that even if viral persistence exists, it may not be the primary driver of chronic symptoms, or the virus may reside in tissues inaccessible to orally-dosed antivirals — is increasingly the working hypothesis. Japan’s RESILIENCE prevention trial (within 72h of acute infection, n=2000) and the SHIELD triple-antiviral combination (valacyclovir + celecoxib + Paxlovid) remain live tests of different angles.

Tracking

  • ADDRESS-LC (bezisterim, BioVie) — 203 patients enrolled; primary completion August 2026; topline late summer 2026
  • RESILIENCE (ensitrelvir, Japan, n=2000) — data collection completed ~June 30; results expected December 2026
  • REVERSE-LC (baricitinib, Phase 3) — 550 adults, 17 sites; neurocognition data November 2026; all data July 2027
  • ANKTIVA INTERRUPT_LC (IL-15/CD8, UCSF) — recruiting, completion October 2026
  • ANKTIVA COVID-4.019-Long (Chan Soon-Shiong) — trial window closed July 2026; no results released
  • Rapamycin LC/ME (Mount Sinai + Simmaron, Phase 2) — results expected November 2026
  • Daratumumab “ResetME” (Haukeland) — 66 participants, treatment started ~Sep 2025, results ~2027
  • Locci/Penn GC B-cell dysregulation — no preprint yet; PolyBio May 2026 symposium data confirmed
  • Brodin/Karolinska WGS in severe LC — no preprint yet; PolyBio May 2026 symposium data confirmed
  • Sipavibart RCT (Klimas/NSU) — n=100, primary completion December 2026
  • SHIELD (valacyclovir + celecoxib + Paxlovid, Mount Sinai) — enrolling 2026; no results
  • TURN-Long COVID (IA, Amsterdam UMC) — recruiting AAb-positive patients; estimated completion December 2027
  • EXTINCT post COVID (IA, Hannover) — n=60 completed enrollment; results pending
  • Sonlicromanol (Khondrion, PEM-targeted, NCT07298005) — Phase 2 active; timeline TBD
cd ~/repos/josse-posten && claude --resume fd77c8f2-2dbd-48f4-b567-1f49ab53f05f