Fire on three continents, a war that keeps widening past its own borders, and the International Criminal Court removing the man who indicted Netanyahu.

US–Iran war reaches the Caspian; Houthis strike Saudi Arabia as oil hits $100

The US extended its strike campaign deep into Iran — as far as the Caspian Sea — while Iran retaliated against American military assets in Bahrain, Jordan and Kuwait. Trump warned of “major military punishment” while signalling openness to talks, saying the US remains “locked and loaded,” and cautioned China and Russia that involvement would be “very bad for them.” Analysts credit Iran’s improved accuracy to Chinese satellite imagery and Russian-derived tactics that are exposing stretched US defences across the Gulf.

Iran-backed Houthis claimed a missile attack on Saudi Arabia; the Saudi-led coalition struck Houthi-held Hodeidah in response and warned of escalation. Oil surged to $100 a barrel after Houthi attacks on two Saudi tankers in the Red Sea, with the US military saying it disabled a tanker trying to evade its blockade of Iranian ports.

Guardian: US expands attacks · Guardian: Chinese tech, Russian tactics · Al Jazeera: live · NPR · Reuters: Trump warns China, Russia · BBC: Houthis strike Saudi · Al Jazeera: Hodeidah

Russian ballistic missiles kill 10 at a drone expo near Kyiv

Russia fired Iskander-M ballistic missiles at Bucha Raion, Kyiv Oblast on July 24 — evading air defences after a simultaneous wave of 180 drones and decoys — hitting a drone and arms exhibition attended by figures from Ukraine’s defence industry. Ten people were killed and over 100 injured; fires destroyed 23 homes, two hotels and 34 vehicles. A Polish defence-company employee was among the dead. Kyiv Oblast declared July 25 a day of mourning, and Zelensky warned Russia is preparing another large-scale strike within 48 hours. Ukrainian prosecutors have opened an investigation into why the event was publicly announced despite the evident threat. (More in Ukraine.)

Emergency workers at the site of the strike in Bucha district, Kyiv Oblast. Photo: Ukraine State Emergency Service

UP: rescue completed · UP: day of mourning · UP: Polish employee killed · BBC · Washington Post · Reddit: prosecutors investigate

ICC votes out chief prosecutor Karim Khan

Member states of the International Criminal Court removed chief prosecutor Karim Khan after the court’s governing body found he committed serious misconduct related to sexual-abuse allegations from a junior staff member. Khan — who issued the arrest warrant for Israeli PM Netanyahu — denies the allegations and calls the process politically motivated. The removal ends nearly two years of institutional turmoil, and lands the same day Venezuela announced its own withdrawal from the court. (Fallout in World.)

The Guardian · BBC · NPR

Fire across three continents: 220,000 evacuated in France and Spain

More than 220,000 people were evacuated or told to shelter as wildfires swept southwestern France and southern Spain at once. Spain declared a national emergency, warning of the “worst fires in the history of the region,” while France ordered the full evacuation of the Cap Ferret peninsula near Bordeaux; Spanish police are investigating whether a tractor driver sparked one blaze, and the EU emergency mechanism has been activated. Across the Atlantic, over 900 wildfires are burning some 3 million hectares in Canada — one of its most intense seasons on record — and Trump again threatened tariffs over smoke drifting into the US.

BBC: 220,000 evacuated · Guardian: live · Guardian: Cap Ferret · Al Jazeera: tractor driver · Guardian: Canada BC fires · Toronto Star: smoke tariff

Indicator	Value	Change
S&P 500	7,412	+0.05%
Dow 30	51,947	+0.46%
Nasdaq	24,976	−0.64%
Russell 2000	2,930	−0.35%
VIX	18.58	−0.64%
Gold	4,070.80	+0.51%
BTC	$63,970	−2.27%
EUR/USD	1.1377	−0.02%
USD/NOK	9.577	−0.02%

Gold +0.51% — safe-haven bid as the Iran conflict widens and Houthis strike Saudi Arabia (see World)
Oil reported surging to $100/barrel on Houthi tanker attacks in the Red Sea — no futures feed in today’s data

World

Iran claims a cruise missile destroyed Amazon’s Bahrain data centre

Bahrain in the Persian Gulf, with Manama and the King Fahd Causeway. Photo: NASA

The IRGC claimed a July 21 cruise-missile strike — “Wave 24” — on AWS’s Bahrain region (me-south-1), calling it retaliation for US strikes on Iran’s Darkhovin nuclear plant. There is no confirmation from Amazon, Bahrain or CENTCOM, but HN commenters point to satellite imagery showing an adjacent substation damaged around July 22, and the region has been effectively unavailable for four months. Amazon’s last public statement (April) said restoration after March drone strikes would take “several months.” Iran declared 18 US tech companies legitimate military targets in March; this appears to be the first claimed cruise-missile use against commercial cloud infrastructure in the conflict.

House of Saud · HN discussion

Romania downs a Shahed for the first time — and a cargo ship is struck in its waters

A Romanian F-16 shot down a suspected Russian Shahed drone over southeastern Romania on July 24 — the first time a NATO member has destroyed such a drone over its own territory. Separately, a Liberian-flagged vessel carrying US coal to Ukraine was struck by an apparent drone or mine within Romania’s exclusive economic zone, damaging a shipboard warehouse. Ukraine’s FM Sybiha called for comprehensive partner measures against Russia; the twin incidents follow a Russian drone strike on a Galați apartment block in May and reflect intensifying pressure on Black Sea shipping and NATO-adjacent airspace.

The Independent · Ukrainska Pravda · Reddit

ICC fallout: Venezuela quits, London’s mayor pledges to enforce the Netanyahu warrant

On the day Karim Khan was removed, Venezuela announced it would withdraw from the ICC, accusing it of “bias” — as it edges closer to a Trump administration that has pledged to “disable” the court, and while its own government faces potential accountability proceedings. In Britain, London’s mayor said he would act to enforce the ICC’s arrest warrant against Netanyahu should the Israeli PM enter the capital, putting him in direct confrontation with a Downing Street that has so far declined to act.

Al Jazeera: Venezuela exits · RFI · Ynet: London mayor

Israel prepares a major West Bank operation after a deadly shooting near Nablus

A shooting near Nablus killed four Palestinians and two Israelis, with competing accounts: Palestinians say settlers attacked villagers; the Israeli military says a Palestinian seized a weapon and fired on hikers. Settler attacks on Palestinian homes and vehicles followed, with property set ablaze. Israel is now reportedly preparing a major military operation in the West Bank — a significant escalation from previous incursion-level actions.

BBC · CNN · Al Jazeera: settler attacks

Trump threatens ‘substantial’ EU tariffs over a €890m Google fine

After the EU fined Google €890m under the Digital Markets Act for self-preferencing in search, Trump threatened “substantial” additional tariffs on the bloc, accusing Brussels of “robbing” American firms and demanding the fines against Google, Apple, Meta and Amazon be “entirely reversed.” The move ties the trade war directly to regulatory disputes over US tech giants. In parallel, court filings show the administration cancelled more than $7.5bn in federal clean-energy grants to states that did not vote for Trump — an explicit admission of political discrimination the administration calls a “misrepresentation.”

Guardian: EU tariffs · Al Jazeera · BBC · Guardian: clean energy grants

India orders GitHub to remove Jack Dorsey’s offline protest app

The Indian government ordered GitHub to take down Bitchat, an offline mesh-messaging app developed by Jack Dorsey, after protesters reportedly used it to coordinate during state-imposed internet shutdowns amid the “cockroach” protest movement. Dorsey publicly posted the removal notice. The order is a direct attempt to eliminate a technical workaround to internet blackouts — a significant pressure point in the ongoing crackdown.

India Today · Reddit

Ireland intercepts a ‘military-grade’ car bomb near the UK border

Irish police intercepted what they called an “extremely significant” military-grade bomb near the UK–Irish border in an intelligence-led operation against dissident republicans. A 25-year-old law student, Isobella Perrie Sullivan of County Kildare, was charged and remanded in custody. The operation signals that dissident republican groups retain the capacity to produce sophisticated ordnance.

The Guardian · Sky News

Also today

Middle East & South Asia: Pakistan suicide bombing kills 15, including 12 soldiers; no group claims responsibility — The Hindu; Amnesty says Pakistani air strikes on a Kabul drug-rehab centre may constitute a war crime — The Diplomat; Trump switched from the Qatari-gifted jet to the older Air Force One mid-trip after a credible Iranian-proxy threat — The Guardian
Institutions: UN rights chief Volker Türk wins a second term despite US and Israeli opposition — Al Jazeera; FIDE president Arkady Dvorkovich hit with an EU travel ban and asset freeze over Russia sanctions — BBC; Europol dismantles thousands of websites tied to a global “nihilist” network linked to arson and violence — Brussels Times
Environment & disasters: Guyana coastal ferry sinking: confirmed death toll rises to 72, of an estimated 179 aboard — The Guardian; Sweden to ban PFAS “forever chemicals” from consumer products from 2028, moving ahead of a stalled EU ban — EUobserver; Armed gangs seizing Amazon indigenous communities as bases, leaders tell Brasília; the state “absent” — The Guardian

Ukraine

Ukraine’s warehouse blitz reaches Yekaterinburg — $2.2B in damage, aimed at Putin’s inner circle

Fire at the Engels-2 airfield, home of Russia’s strategic bombers, overnight July 25. Photo: Kyiv Independent

Ukraine has struck at least 10 Wildberries e-commerce warehouses across Russia in a single week — St. Petersburg, Tver, Moscow and Tambov oblasts, Krasnodar, Stavropol, Voronezh, occupied Simferopol, and now Yekaterinburg on July 25 — causing an estimated $2.2B in damage and forcing the platform to suspend operations at major hubs. The campaign deliberately targets civilian logistics to erode the normalcy shielding urban Russians: Wildberries is reportedly co-owned by Kremlin Chief of Staff Anton Vaino, tying the damage to Putin’s inner circle. Russia is rushing additional Pantsir positions to Moscow. Overnight, a fire was reported at the Engels-2 bomber base near Saratov, and drones struck warehouses and energy sites across Belgorod — part of a sustained blitz alongside strikes on Crimea’s power grid (17 substations hit July 23–24).

Guardian: warehouse strikes · Reuters: Wildberries · Kyiv Post · Kyiv Independent: Engels fire · Kyiv Independent: Belgorod · Reddit: Yekaterinburg footage

A cyber-deception turns Russia’s air defence against its own Su-57

Crash site of the Su-57 downed by its own air defence near Lutsino, Moscow Oblast, July 23. Photo: Militarnyi

On July 23, a combined Ukrainian HUMINT and cyber operation identified vulnerabilities in a Russian BARS-Moscow air-defence formation and fed it falsified data, causing it to engage and destroy a Russian Su-57 stealth fighter over Lutsino — roughly 30 km from the Kremlin. The aircraft is valued at over $100M. Attributed to Ukraine’s InformNapalm group, the operation demonstrates a qualitatively new vector: manipulating Russian command-and-control to turn defensive assets against Russian forces without firing a shot from Ukrainian territory.

Militarnyi · Reddit

Russia’s summer offensive stalls as Zelensky signals readiness for a peace deal

Russia’s summer offensive has slowed to roughly 1 sq km per day — 16 times slower than last June — with no confirmed advances on July 23–24 despite 230 recorded attacks. Ukraine repelled a reinforced mechanised assault in the Dobropillya direction, destroying nine tanks, two AFVs and three Grad MLRS in a single engagement; Russian commanders reportedly abandon contact with assault units once they come under drone fire. Against this backdrop, Zelensky publicly offered to sign a peace agreement at the White House or Mar-a-Lago. The Russian Central Bank cut its key rate to 14% — its fifth cut this year — while slashing 2026 GDP growth to near-zero, as ISW assessed the Kremlin is laying legal groundwork for a new mass-mobilisation wave and bracing for the unrest it expects to follow.

UP: 230 attacks stopped · UP: ready to sign · Reddit: offensive slows · Reddit: ISW mobilization

Also today

Zelensky’s political standing is meaningfully weakened as protests over the dismissal of Defence Minister Mykhailo Fedorov continue — BBC

Tech

Claude Opus 5 debuts: frontier performance at half of Fable’s price

Anthropic’s hero image for the Claude Opus 5 announcement. Image: Anthropic

Anthropic released Opus 5 on July 24, priced identically to Opus 4.8 ($5/$25 per M tokens) while claiming near-Fable-5 intelligence. It scores 3× higher than competitors on ARC-AGI 3 and sets state-of-the-art on Frontier-Bench and CursorBench; a Fast mode delivers ~2.5× speed at 2× cost. Early testers report notably autonomous behaviour — the model independently wrote computer-vision pipelines and built debugging systems unprompted, with much lower run-to-run variance than its predecessors. It reached #1 on Artificial Analysis; per-task cost ($2.03) still sits above GPT-5.6-Sol or Kimi K3 at comparable quality. Anthropic notes it trails Mythos 5 on cybersecurity exploitation — a deliberate safety boundary.

Anthropic · System card · HN discussion · Artificial Analysis

Kimi K3: safety institute finds autonomous attack capability; researchers build a 64-agent exploit swarm

Two Kimi K3 security findings landed the same week. The UK AI Safety Institute’s assessment found K3’s safeguards failed to prevent exploit-development attempts, and the model reached step 17 of 32 in enterprise network-attack simulations — outperforming all open-weight peers, though below frontier models at 28.5 steps. Separately, researchers demonstrated K3 discovering and exploiting a Redis 8.6.x buffer-overflow zero-day using a 64-subagent swarm for collaborative vulnerability research, development and testing. The Redis exploit needs authenticated access, limiting immediate threat — but the multi-agent-as-offensive-research-team pattern is the real signal.

UK AISI assessment · HN: AISI report · HN: Redis exploit

Hanwha cameras shipped a live GitHub admin token in firmware — 62% of versions affected

A researcher found Hanwha Vision security cameras embedding a live GitHub admin token in the login page, granting write access to hundreds of Hanwha repositories. Root cause: a Vite build that wrote the full CI process.env — including GITHUB_TOKEN — into compiled frontend assets. The token appeared in 62% of ~500 extractable firmware images examined; Hanwha revoked it within 12 hours of disclosure. A textbook case for explicit env-variable allowlists in frontend build pipelines: anything in the CI environment at build time can ship to every device.

Research writeup · HN discussion

Chrome silently installs a system-wide hotkey that launches Gemini

Chrome registers Ctrl+G (Mac) / Alt+G (Windows) as a global shortcut that opens a Gemini popup — with no notification, no permission prompt, and no obvious indicator that Chrome caused it. The author discovered it when it hijacked their editor’s “go to line” binding; disabling it means digging out “AI innovations” buried in Chrome settings. The framing is blunt: silently installing a global hotkey is malware behaviour regardless of vendor, and can never be anything other than opt-in.

Ares Luna · Lobsters discussion

Postgres LISTEN/NOTIFY actually scales — 60K writes/s with batching

DBOS engineers show that Postgres LISTEN/NOTIFY — long dismissed as unscalable — reaches 60K writes/second (20× the naive 2.9K/s baseline) once notifications are batched in memory rather than fired per-write. The bottleneck: every NOTIFY acquires a global exclusive lock, so high-frequency use creates severe contention, which batching collapses into a single flush. With a polling fallback for crash recovery, the result is a viable low-latency streaming backbone — LLM token streaming, chat — without reaching for Redis or a dedicated broker.

DBOS blog · HN discussion

Buz: a Bun fork in modern Zig with sub-1s incremental builds

Buz is an early-stage Bun fork rewritten in modern Zig — stripping 11,000+ lines of dead code and consolidating the build graph into a single build.zig. The headline result: sub-1-second incremental rebuilds, with ~60% of remaining overhead in the linker (improvable as Zig’s native linker matures). It’s not production-ready and many Bun tests still fail — but the architecture demonstrates meaningful headroom Bun’s current implementation leaves on the table.

Ziggit · HN discussion

Also today

AI policy: Nvidia, Microsoft and Meta lobby the US to reject export controls on open-weight AI models, arguing restrictions damage US leadership without limiting adversarial access — CNBC · Lobsters
Essays: Hillel Wayne interviews engineers who crossed over from other disciplines and finds most of software’s claimed uniqueness doesn’t survive contact — the real differences are narrower (no material tolerances, faster change, soft constraints) — Hillel Wayne · Lobsters; Martin Janíček’s inventory model shows longer feedback delays can stabilize complex systems — minimal delay amplifies demand into destructive oscillation; moderate delay dampens it — martin.janiczek.cz · Lobsters; Mitchell Hashimoto’s case that everyone should know SIMD, with a 5× Ghostty example and no assembly (continued from Thursday) — mitchellh.com · Lobsters

cd ~/repos/josse-posten && claude --resume c98f7592-1ce5-4d00-80ed-f31dc6094ef4