Josse-posten

A tenth night of American strikes turns the Gulf’s drinking water into a weapon; Ukraine sends 400 drones over Moscow while Russian and Chinese warships probe from the English Channel to the Sea of Japan.

US–Iran War: Tenth Night of Strikes as Iran Turns Off the Taps

Vehicles pass a monument to the clenched fist of Ayatollah Ali Khamenei in Islamic Revolution Square, Tehran, July 19. Photo: AP

The US carried out its tenth consecutive night of strikes on Iran, hitting targets around Bandar Abbas, Qeshm Island, Chabahar and Konarak. Iran escalated sharply: it claimed attacks on tankers in the Strait of Hormuz — forcing at least one crew to abandon ship — and struck US interests across the region, including Kuwait. Most pointedly, Iran turned water into a weapon, hitting desalination plants in Kuwait, Bahrain and the Emirates — Gulf states that draw 90–99% of their drinking water from the sea. The US in turn struck an Iranian desalination plant at Jask serving 20–30 villages in Hormozgan.

The Pentagon acknowledged nearly 100 US service members have been injured over the past two weeks, on top of the three killed since Friday; Democrats accuse Trump of having “lost control” of the war. With Hormuz largely closed since February, the IEA now warns of a global energy crisis within weeks if the strait does not reopen — Asia, which receives 80–90% of its oil this way, is most exposed, though Chinese stockpiles of over a billion barrels have cushioned the price shock so far.

Ukraine Hits Moscow with 400 Drones as Russia’s Black Sea War Turns on Civilian Ships

Smoke rises between Lipetsk’s thermal power plant and the NLMK steel complex after Ukrainian strikes, July 21. Photo: Militarnyi

Ukraine launched roughly 400 drones at Moscow overnight — its largest-ever attack on the Russian capital — in retaliation for one of the war’s biggest strikes on Kyiv at the weekend. The deep-strike campaign widened well beyond Moscow: strikes hit the Indesit factory and the NLMK steel complex in Lipetsk (Russia’s largest steel producer), an industrial park near St. Petersburg, and an FSB coordination hub in occupied Kherson Oblast; satellite imagery confirmed a Tu-95 bomber destroyed at Engels-2.

At sea, Russia has crossed a line. Milbloggers confirm it is now using heavy anti-ship missiles — from Tu-22 bombers, coastal batteries and warships — against civilian vessels in the Black Sea, saying only these can penetrate large cargo ships. The Golden Leo attack killed ten sailors, four of them Indian; India summoned the Russian chargé d’affaires. Ukraine’s Operation MoLoCHKa struck back with 11 vessels in 24 hours and hit 19 power substations across occupied Crimea. Russia still killed three in Odesa, which has now lost 28 people in July alone.

Russian and Chinese Warships Test the West’s Waters

Two provocations, an ocean apart, bracketed the day. Japan confirmed that Chinese and Russian warships held joint live-fire drills inside Japan’s exclusive economic zone, as Taiwan reported a “significant” rise in Chinese maritime activity and a Philippine sailor was injured in a fresh clash near Second Thomas Shoal. At the same time, a Russian Neustrashimy-class frigate ran a 30-minute live-fire exercise in international waters just 46 miles off Plymouth — legal, but deliberately close, and clearly meant to test NATO’s reactions at a moment of maximum European tension.

World

Hamas Names Khalil al-Hayya as New Overall Leader

Hamas has elected Khalil al-Hayya — its Qatar-based chief negotiator and the face of ceasefire diplomacy — as its new overall leader, replacing Yahya Sinwar, killed by Israeli forces in October 2024. Reactions in Gaza are mixed: some see a possible opening for negotiations; others say they long ago lost faith in all Palestinian factions and simply want the war to end.

India’s ‘Cockroach’ Youth Movement Surges — 180 Injured in Delhi Clashes

Protesters and police clash. Photo illustration

Tens of thousands of young protesters defied a police ban and marched toward India’s parliament in one of the country’s largest anti-government demonstrations in years. The satirical “Cockroach Janta Party,” championed by activist Sonam Wangchuk, demands the education minister’s resignation over exam-paper leaks and endemic corruption in university admissions. Police clashed violently with marchers, leaving 180 injured. A movement that began as absurdist satire has become a serious vehicle for Gen Z anger at a broken education system and vanishing opportunity.

Guardian · NPR · BBC · Reddit

Settlers Kill Two Palestinians in West Bank Raid; Israel Tracked Global NGOs

Armed settlers killed two Palestinians and wounded another in a night raid on Deir Jarir, with Israeli security forces present — a pattern residents describe as routine settler-army “partnership.” Separately, an internal government document obtained by Al Jazeera reveals a systematic program to surveil and label international NGOs as hostile based on suspected BDS activity, raising alarm over state targeting of civil society. Médecins Sans Frontières also demanded Israel release detained Palestinian healthcare workers.

Burnham Cuts VAT on Electricity Bills in First Policy Moves

Britain’s new prime minister Andy Burnham — the first Catholic to hold the office in England — used his first days replacing Keir Starmer to cut VAT on household electricity bills as a cost-of-living measure. June borrowing came in below expectations, giving modest fiscal room, but employers cut vacancies as unemployment held at 4.9%, underscoring the fragile backdrop — compounded by Middle East energy disruption — against which the more charismatic but untested Burnham now governs.

Ann Widdecombe Killed — Political Motive Investigated

A 28-year-old man has been charged with the murder of Ann Widdecombe, the long-serving Conservative MP and later prominent Reform UK figure known for her outspoken positions on immigration. Police say a possible political motive is under active investigation, making the case one of the most serious attacks on a British politician in recent years.

Nicaragua’s Ortega Declares Country Will Hold No More Elections

President Daniel Ortega, 80 and in his fourth term, announced that Nicaragua will no longer hold elections, saying the move is needed to “build a wall” against the opposition. The declaration formalizes what has long been reality in a country where Ortega has jailed opponents, expelled the Catholic Church, and dismantled democratic institutions since returning to power in 2007.

Trump Slaps 50% Tariffs on Canada; Ottawa Fights Back

The White House announced 50% tariffs on most Canadian goods — wine, hockey sticks, cement and more — citing alleged discrimination against US autos, alcohol and dairy. PM Mark Carney vowed to “intensify” trade talks while rejecting the framing. In a pointed counterpoint, Canada issued air-quality warnings over wildfire smoke drifting north from burning US states — days after Trump had threatened tariffs over Canadian fire management. It is the sharpest escalation yet in North American trade tensions.

Also today

Americas
Sinaloa Cartel co-founder ‘El Mayo’ sentenced to life with a $15bn forfeiture — one of the largest financial penalties in US criminal history — BBC · Guardian
Andrew and Tristan Tate appeared in a Miami court and vowed to fight UK extradition on rape and trafficking charges — BBC · Al Jazeera
Guyana detained ferry crew after drug tests revealed violations; 27 dead in the country’s worst marine disaster in decades — Al Jazeera · BBC
Europe
AliExpress fined a record €550m by the EU — the largest DSA penalty yet — for failing to remove illegal and counterfeit goods — BBC · Guardian
A viral video of Abderrahim Fakir’s death in Italian police custody sparked protests over the use of force during arrests — Al Jazeera
Middle East
France says Iran detained embassy staff and assaulted one; Tehran now threatens citizens with prison for sharing videos of US strikes — Iran International · Telegraph
Yemen’s Houthis declared a naval “embargo” on Saudi Arabia, threatening further Red Sea and Gulf shipping disruption — BBC · Reuters
Asia
Flash floods in Afghanistan’s remote Nuristan province killed 20+ and left over 100 missing — Guardian

Ukraine

Command Crisis Sharpens: Syrskyi Replacement Expected Within Days

A Kyiv protester holds a ‘Bring back Fedorov’ placard beside a portrait of General Syrskyi, July 16. Photo: Roman Pilipey/AFP via Getty

Zelensky is now choosing among 11 candidates to replace General Syrskyi as commander-in-chief, with General Drapatyi the frontrunner. Syrskyi broke his silence to publicly apologize to ousted defence minister Fedorov, claiming he was “unaware of the conflict between them” — but Fedorov has rejected the offer to return, and an acting defence minister (Khmara) has been appointed in the interim. Five consecutive days of street protests continue. In a possible signal of broader restructuring, Zelensky held an unprecedented joint meeting of weapons manufacturers and corps commanders.

Frontline Static; Ukraine Captures 64 Russian Soldiers in Hulyaipole Sweep

No confirmed advances on any axis. In the Hulyaipole direction, Ukraine’s 225th Assault Regiment cleared four settlements of Russian infiltration groups and took 64 prisoners — the largest single-operation POW haul in weeks. In Kostyantynivka, Russia released footage claiming seizure of the House of Culture; ISW assesses it as AI-altered, and Ukraine confirmed only that the two soldiers shown were taken prisoner, not that Russia holds the city. Russian forces may be infiltrating eastern Taratutyne in Sumy Oblast for the first time.

Diplomacy: Patel to Visit Russia; China Training Confirmed; IMF Disburses $690M

FBI Director Kash Patel is planning an October visit to Russia hosted by the FSB — the latest signal of US-Russia normalization under Trump, who is also pushing to add Iran to the Russia sanctions bill. A leaked EU document reportedly confirms China has provided military training to Russian forces. Meanwhile Putin met North Korean foreign minister Choe Son Hui in Moscow, with analysts speculating a Kim Jong Un state visit is being arranged. On Ukraine’s side, the IMF will imminently disburse $690M, and nine European nations launched an anti-ballistic missile coalition, with France licensing Ukraine to produce Aster 30 interceptors domestically.

Norway

Datasenterdebatten: Aker vil bruke 8 % av Norges strøm – statsråden sier nei til konsesjonskrav

Akers Nscale har søkt om å bygge datasentre i Nord-Norge med et kraftbehov tilsvarende rundt 8 prosent av hele Norges strømforbruk. Digitaliseringsminister Karianne Tung (Ap) sier nei til konsesjonskrav for datasentre, tross press fra Høyre, SV og Rødt. I USA har New York som første delstat innført et ettårig byggeforbud for de største datasentrene for å kartlegge konsekvensene for miljø og energiforbruk.

Lørenskog-hacket: 1,8 TB sensitiv data på det mørke nettet

Dronefoto av tunnelportaler til Nedre Romerike Vann og Avløps anlegg, som forsyner 180.000 innbyggere. Foto: Digi.no

Et dataangrep mot Lørenskog kommune for omtrent to måneder siden har endt med at hackerne har lagt ut 1,8 terabyte stjålet data på det mørke nettet – barnevernssaker, pasientjournaler, elevsaker og dokumenter om kritisk infrastruktur. Politikere ble hasteinnkalt til krisemøte midt i fellesferien. Blant materialet er 1,3 millioner filer fra Nedre Romerike Vann og Avløp (NRVA), herunder kart, risikovurderinger og beredskapsplaner for drikkevannsforsyningen til 180.000 innbyggere. NRVA understreker at angrepet ikke påvirker daglig drift eller vannkvalitet.

KI-gigantenes «skjulte gjeldsbomber» bekymrer Wall Street

Bak rekordstore KI-investeringer skjuler det seg ifølge DN stor gjeld utenfor selskapenes balanser, og analytikere advarer om et mulig «blodbad» i obligasjonsmarkedet dersom KI-gevinstene lar vente på seg. En Nikkei-analyse tallfester det: Microsoft, Google, Amazon, Meta og Apple bærer til sammen 1,65 billioner dollar i forpliktelser utenfor balansen, knyttet til KI-infrastruktur og strukturert for å unngå standard regnskapsføring – en opasitet kritikere sammenligner med finansteknikkene før 2008. Samtidig falt SpaceX-aksjen under introduksjonskursen, og Apple og Nvidia kjempet mandag om å være verdens mest verdifulle selskap.

Krokstadelva-brannen: Slukking i ti dager til – politiet tror ulykkesbrann

Slukkeinnsatsen i Krokstadelva i Drammen ventes å pågå i ytterligere ti dager. 113 boliger er totalt ødelagt og fem gjort ubeboelige – over 400 personer ble evakuert i det som beskrives som Norges verste brann siden andre verdenskrig. Krimteknikere ankom mandag, men området er fortsatt for varmt for detaljert granskning; politiet mener foreløpig at brannen skyldes uhell eller selvantennelse, ikke påsatt ild. Forsikringsestimatene peker mot rundt én milliard kroner. Dugnadsånden er enorm – en familie som la ut en nødbønn på sosiale medier, fikk over 40 tilbud om husly i løpet av natten, og Fotballforbundet vil auksjonere bort VM-effekter til inntekt for de rammede.

15 år siden 22. juli – Breivik-uniform stilles ut

Norge markerer 15-årsminnet for terrorangrepene som drepte 77 mennesker. For første gang stilles politiuniformen Anders Behring Breivik brukte under angrepene ut offentlig; mora til det yngste offeret reagerer på at hun ikke fikk vite det på forhånd. Debatten handler om hukommelse og uro: forskere advarer om at høyreekstremt tankegods i 2026 siver inn i norsk offentlighet på måter som minner om Breiviks manifest, og at «det som var ekstremt i 2011 er blitt den nye normalen».

Utpressingsvirus bruker nå KI til å automatisere angrep – Telenor varsler ny bølge

Forskere varsler en ny og farlig trend: løsepengevirus som bruker kunstig intelligens til å gjennomføre angrep automatisk, uten menneskelig styring underveis. Telenor Norges konsernsjef advarer om at stadig kraftigere KI-modeller gjør det enklere å finne og utnytte sårbarheter, og at både bedrifter og privatpersoner må skjerpe den digitale beredskapen. DORA-rapporten for 2025 viser at bare 19 prosent av utviklingsteam er modne nok til å håndtere KI-agenter sikkert.

Vår Energi kjøper Bluenord – blir Europas største uavhengige oljeselskap

Vår Energi annonserte tirsdag kjøpet av det danskbaserte Nordsjø-selskapet Bluenord for 248,4 millioner nye aksjer pluss 1,96 milliarder kroner kontant – en premie på 23,5 kroner per aksje. Etter fusjonen blir Vår Energi Europas største uavhengige olje- og gassprodusent. Aksjen steg 5,5 % på Oslo Børs, og selskapet la fram sterke Q2-tall: 2,42 milliarder dollar i driftsresultat og et utbytte på 350 millioner dollar.

E24 · TU.no · DN

Også i dag

Økonomi
Statkraft tapte halvannen milliard etter en effektiv skattesats på 171 %, tross nær 50 % økning i driftsresultat; Telenor-aksjen falt 10 % etter Q2 — Aftenposten: Statkraft · Digi.no: Telenor
Etter Morrows konkurs ligger et amerikansk selskap best an til å overta batterifabrikken i Arendal; det norske konsortiet er ute — TU.no
EU-kommisjonen la fram et reformert kvotesystem som stenger CO₂-krana saktere og gir industrien mer tid — kritikere mener det undergraver 2040-målet — NRK Urix · TU.no
Google-åpenhet, digital euro og norsk skysuverenitet: EU strammer inn på Google og nærmer seg digital euro, mens en Digi-debatt spør hva Norge gjør neste gang USA stenger KI-døren — Digi.no
Innenriks
Ekstrem skogbrannfare i Sør-Norge etter langvarig tørke; Frankrike rammet av sin verste brann siden krigen, 13 døde og 800 evakuert i Spania — NRK: skogbrannfare · NRK: evakuert i Europa
Statens naturoppsyn har trolig felt den omtalte finsk-russiske ulven i Sør-Fron; Noah kaller fellingen «skandale» — NRK
Strømproblemer på Drammenbanen ga tirsdag nye forsinkelser og innstillinger — togtrøbbelet i Oslo-regionen er blitt en gjenganger — Aftenposten
Kronprins Haakon om kronprinsesse Mette-Marits helse etter besøk hos brannrammede: «Det går heldigvis bedre … men det er begynnelsen på en ganske lang vei» — NRK
Sport & verden
Spania slo Argentina 1-0 i VM-finalen; slåsskamp etter sluttsignalet, og Trump og Infantino ble møtt med kraftig piping — NRK: slåsskamp · NRK: piping mot Trump
Norge klatret 12 plasser til 19. på FIFA-rankingen – best siden 2011 – etter VM-bragden; Haaland fikk 30 millioner nye Instagram-følgere — NRK · Dagsavisen
Fotballegenden Kevin Keegan er død, 75 år gammel, etter kamp mot kreft — NRK · Dagsavisen
Tolv års fengsel for tidligere leder etter Morandi-brukollapsen i Genova i 2018, som tok 43 liv — TU.no

Norway — Street Level

«Drapsannonser»: Sverige truer tech-giganter med millionbøter – Norge vurderer det samme

En ny svensk lov, i kraft denne uken, krever at plattformer fjerner kriminelle rekrutteringsannonser innen én time etter politivarsel, ellers bøter på 5.000–5 millioner kroner. Både norsk og svensk politi melder om kraftig økning i slike annonser – prislister på Telegram, «jobb»-oppslag på Discord, Instagram-poster – brukt til å rekruttere barn helt ned i 13-årsalderen til bomber og skyting. Kripos avdekket rundt 400 slike oppdrag i fjor og forhindret 30 voldsoppdrag. Justisdepartementet vurderer nå tilsvarende lovgivning; en egen lov fra 1. juli gjør rekruttering av mindreårige til kriminalitet straffbart med opptil seks års fengsel.

Voldsoffererstatning: praksis endres etter at Sivilombudet fant den ulovlig

Justisdepartementet endrer hvordan Norge vurderer erstatningskrav i henlagte straffesaker. Tidligere overtok saksbehandlerne automatisk politiets egen kodifisering – en sak kodet som «ran» (ikke dekket av 2023-loven) ble avvist uten selvstendig vurdering. Sivilombudet fant dette ulovlig. Nå må sakene vurderes ut fra hva som faktisk skjedde, og tidligere avviste kan klage. Endringen ble delvis utløst av en tenåring som ble slått, kvalt og ydmyket på skolen, men fikk saken kodet som ran i stedet for vold – noe som stengte hans vei til erstatning.

Grassroots

  • Vrakrester fra en russisk rakett skylte i land ved Kiberg i Vardø; Kystvakten kom for sent da en kuling skapte 7–8 meters bølger som førte biten til havs igjen. FOH sier slike funn «ikke er helt uvanlige» langs Finnmarkskysten — NRK
  • Schibsteds personvern-paradoks: for å slippe annonsesporing må du logge inn og betale med bankopplysninger – som fullstendig av-anonymiserer deg. «Drikker jeg av feil ende av slangen, eller …?» — r/norge
  • En Oslo-beboer merker at folk det siste halvåret har sluttet helt å hilse i oppgangen og heisen – telefonen fram, blikket ned. Tråden vekker gjenkjennelse fra hele landet — r/norge
  • Nyhetstretthet som ufrivillig avkobling: en poster gikk fra å lese VG og NRK hver morgen til å scrolle forbi alt politisk – «hjernen nekter rett og slett å ta inn mer.» Mange kjenner seg igjen — r/norge

Tech

Cursor: Use Frontier Models Only for Planning, Cheaper Models for Execution

Cursor published research on agent-swarm economics: routing planning to frontier models (Opus 4.8) and execution to cheaper models (Composer 2.5) cut worker costs from $9,373 to $411 on a SQLite benchmark — a 95% reduction — while improving quality (80% test pass rate versus near-failure for homogeneous fleets). The key insight: frontier intelligence is only needed at decomposition time; once ambiguity is resolved into explicit instructions, smaller models execute reliably. Better coordination — cutting merge conflicts from 70k+ to under 1k — drove the quality gains, not model tier.

Seven Sandbox Escapes Found Across Four Coding-Agent Vendors

Pillar Security disclosed seven sandbox-escape vulnerabilities affecting Cursor, Codex CLI, Gemini CLI and Antigravity. The vectors range from Docker sockets and virtualenv modification to git-config indirection and .claude hook configuration — each letting a sandboxed agent’s writes become unsandboxed execution. The core finding: “an agent’s blast radius is not the agent process; it includes everything the agent can write that the host later trusts.” Process containment misses the whole attack surface when the host implicitly executes agent-created files.

China’s Open-Weight AI Strategy Is Outcompeting Closed US Models

An analysis in werd.io argues that China’s release of capable open-weight models (DeepSeek, Qwen and others) is winning the global adoption race against the US strategy of locked-down proprietary APIs. Open models can be deployed anywhere, fine-tuned, and run without US infrastructure dependencies — far more attractive to governments and organizations worried about sovereignty or cost. The geopolitical implication: proprietary moats may be losing to open distribution as the dominant AI influence lever.

werd.io · HN

AI Is Now Routinely Outcounterexampling Human Mathematicians

Kevin Buzzard’s Xena blog documents two major AI counterexamples beyond the recently covered Jacobian Conjecture: ChatGPT disproved Erdős’ Unit Distance Conjecture in May using the Golod-Shafarevich theorem (formalized in Lean at 1.2M lines), and AI models found a counterexample to Grothendieck’s 60-year-old finite flat group scheme question in July. The pattern is clear — AI is particularly effective at disproving conjectures, with Lean formalization making results rigorous. HN commenters note this reflects strength at exhaustive search over large algebraic structures rather than conceptual creativity.

Flock Safety Lied to City Councils, Police, and the Public — Repeatedly

The ACLU has documented a systematic pattern of deception by Flock Safety, the ALPR (automatic license-plate reader) company now present in thousands of US communities: misrepresenting data-sharing practices to city councils, falsely claiming ACLU of New Mexico partnerships, and lying about product capabilities. The investigation spans multiple jurisdictions where Flock’s behavior contradicted statements to governing bodies — even as its cameras become pervasive surveillance infrastructure with little public scrutiny.

ACLU · HN

Three Roads to Memory-Safe Systems Code

A cluster of memory-safety research surfaced together. Fil-C’s InvisiCaps delivers full memory safety for C/C++ while keeping standard 64-bit pointers — capability metadata lives in invisible auxiliary allocations, using “flight pointers” in registers, at roughly 4× overhead and no source changes. Rust on Morello (ECOOP 2023) compiles Rust for ARM’s CHERI hardware, so capability-tagged pointers trap on out-of-bounds access even inside unsafe blocks. And Soteria’s Meta Garbage Collection lets OCaml’s GC drive collection of Rust-allocated objects — GC-managed lifetimes where ownership is impractical, useful for mixed-language systems sharing data structures.

Also today

Languages & databases
Postgres 19 switches TOAST compression default from pglz to LZ4 — dramatically faster with comparable ratios for text, JSONB and bytea — Crunchy Data · Lobsters
“l” is a new runtime for the k/q array languages with SIMD-by-default, operation fusion, auto thread/GPU dispatch, and computation over compressed data — memory bandwidth framed as “the enemy” — lv1.sh · Lobsters
Security & identity
Filippo Valsorda proposes an opaque, interoperable passkey record format to break the per-authenticator silo that blocks cross-platform portability — words.filippo.io · HN
The Linux kernel CVE list published 432 identifiers in 24 hours — confirmed vulnerabilities with fixes, not administrative backfill — linux-cve-announce · Lobsters
AI & media
An EU study during Hungary’s election found AI chatbots gave inaccurate, inconsistent voting advice — recommending parties not on the ballot — Guardian
unslop.run details how AI-writing detection on arXiv breaks down — flagging unusual human styles, and failing entirely when AI edits rather than generates — unslop.run · HN
Jellyfin founding contributor and longtime lead Andrew has stepped down — a significant moment for the main open-source Plex alternative — Jellyfin Forum · HN

Linux & Infrastructure

SecretSpec Audit: 42 NixOS Modules Leak Secrets to /nix/store

An audit of 445 NixOS modules found 42 that inline secret values into world-readable /nix/store paths (nixpkgs #24288), while 110 more must assemble restricted config files at runtime via envsubst, replace-secret, jq or custom shell glue — because the underlying applications accept no dedicated secrets channel. The SecretSpec project proposes fixing this at the interface level: a secretspec.toml declaring what secrets are needed, resolved at runtime by environment-specific providers (keyring, env vars, 1Password, Vault). A NixOS integration is tracked in SecretSpec #65, and the Cachix client (PR #737) is being updated to resolve tokens this way.

Linux Kernel Gaining eBPF-Driven Interpreter Selection — Good News for Nix Relocatability

A Nix developer submitted VFS patches to enable $ORIGIN-relative interpreter paths in ELF binaries — a long-standing blocker for truly relocatable Nix packages. Rather than a direct VFS change, maintainer Christian Brauner proposed something more powerful: eBPF programs registered with binfmt_misc that select interpreters dynamically based on any binary property. A patch series headed to linux-next lets a small eBPF program provide $ORIGIN support, with a new L (loader-substitution) flag running the binary natively while only swapping the PT_INTERP loader. The author plans a NixOS module gated on a PT_INTERP_NIX segment, so only opt-in binaries are affected.

Hyprland 0.56 Released — Expanded Lua API, But a Rocky Landing for Some

Hyprland 0.56 ships after ~2.5 months with notable layout additions (fit_into_view, fit expand, inhibit_scroll, focus_master_on_close) and a major Lua API expansion: custom live gestures, key-state querying, event registering, monitor physical dimensions, and raw workspace management. Other highlights include a Lua REPL in hyprctl, XDG interactive drag for CSD titlebars, gradient glow, and a stableid: windowrule field. Vaxry stresses no breaking changes — notable after the recent Lua migration. Not everyone landed smoothly, though: some users report significantly slower animations tied to the Lua changes, and blur breaking entirely as a separate regression. The new Lua API also enables neat tricks — one shared snippet auto-disables the laptop’s eDP-1 when an external monitor connects, via hl.on("monitor.added", ...).

Self-Hosting Roundup: SSH Bastions, LLM Gateways, Forgejo, and a Million Attacks

Four practical self-hosting reads landed together. A neat SSH trick routes through a bastion only when your home server’s hostname won’t resolve — via ProxyCommand and a DNS conditional, no VPN or manual switching. Ollmo is a Rust, OpenAI-compatible LLM gateway for NixOS that unifies every tool’s provider config behind one v1/chat/completions endpoint, with a flake.nix for native install. A detailed Forgejo walkthrough covers infrastructure, federation and operations for moving off GitHub. And a 30-day reverse-proxy analysis found 1.16M of ~1.28M requests were attacks — mostly WordPress probes and .env/.git fishing — with the takeaway to move everything non-public behind WireGuard and an identity-aware proxy so unauthenticated requests never reach services.

Also today

Nix ecosystem
Agenix appears unmaintained (no commits since early 2026); the community is migrating to sops-nix for a security-sensitive secrets manager — agenix repo · r/NixOS
Pedantix is a new formatter that layers uniform attribute-set ordering on top of nixfmt — tested cleanly against all of nixpkgs — Discourse · GitHub
nix-android brings nix-darwin-style declarative app and settings management to GrapheneOS over adb — no root, F-Droid apps verified by hash — GitHub · r/Nix
createSymlink declaratively manages tracked symlinks anywhere on the filesystem, removing them on rebuild when the declaration is dropped — Codeberg · r/NixOS
Fontconfig 2.18.1 in nixpkgs-unstable has two regressions (generic-family matching and stale-cache crashes, e.g. Ghostty); fixes target 2.18.2 — Discourse · nixpkgs #541553
A community member wired a Casio watch into their NixOS + Niri + Noctalia setup as a declaratively managed StreamDeck alternative, triggering nixos-rebuild from the wrist — YouTube · r/NixOS
Home automation
Shelly firmware 2.0.0 adds HTTPS (ECDSA P-256 confirmed); Home Assistant support is merged in dev — encrypted local device comms without the cloud — Shelly KB · r/homeassistant
Samsung is ending free SmartThings API access in October — $4.99/month for individual developers — affecting Home Assistant integrations — SmartThings blog · r/homeassistant
cd ~/repos/josse-posten && claude --resume e472737d-bd84-44ca-be16-45be90cc6fe9