Trump steps back from the brink with Iran and markets exhale —
while Kyiv runs out of interceptors, Ukraine’s deep strikes reach
Engels-2, and Europe counts 67 dead at Ceuta.
Trump
halts Iran strikes after Saudi intervention — deal ‘perimeters’
claimed
Donald Trump announced Saturday he is cancelling planned military
strikes on Iran, asserting that “perimeters” of a deal have been agreed
and calling on Tehran to finalise terms “rapidly.” The Guardian revealed
that Saudi Crown Prince Mohammed bin Salman intervened directly with
Trump, raising concerns about the scale of the planned offensive. Iran
had threatened to strike neighboring countries’ energy fields if
attacked, and US embassies across the Middle East had urged Americans to
consider leaving the region. The walk-back comes after days of
escalating Hormuz tension, US–Israel coordination on energy
infrastructure targets, and Iranian strikes on tankers.
Kyiv’s
air defense collapses: Ukraine has no interceptors left as Trump walks
back missile pledge
Only one ballistic missile was intercepted during Russia’s latest
devastating strike on Kyiv, which killed nine people. Zelenskyy publicly
explained the failure: Ukraine has run out of interceptors. The crisis
is compounded by reports that Trump is now walking back a promised boost
to Ukraine’s missile defense — leaving the capital effectively exposed
to further ballistic barrages at the precise moment its shield has been
exhausted. Kyiv is pitching an unlikely workaround involving Starlink
and drone strikes on the launchers themselves. (More in Ukraine)
Ceuta
death toll reaches 67 — EU calls emergency meeting as political storm
engulfs Sánchez
The death toll from the Ceuta border crossing has climbed to 67,
including people who drowned and others killed in a stampede on a
breakwater barrier. The EU has convened an emergency meeting of interior
ministers for Tuesday amid sharp internal divisions; Sánchez — once seen
as a pro-immigration leader — now faces the biggest political crisis of
his tenure. Most of the 60,000 migrants have returned to Morocco, but
the European fallout continues. Al Jazeera is also investigating whether
external actors played a role in coordinating the crossing, with
questions pointing toward Israeli intelligence involvement in
orchestrating the pressure on Spain.
| Indicator |
Value |
Change |
| S&P 500 |
7,490 |
+0.70% |
| Dow 30 |
52,485 |
+0.53% |
| Nasdaq |
25,374 |
+1.00% |
| Russell 2000 |
2,931 |
-0.50% |
| VIX |
16.0 |
-6.44% |
| Gold |
4,107 |
-1.29% |
| BTC |
$63,426 |
+0.69% |
| EUR/USD |
1.1533 |
-0.03% |
| USD/NOK |
9.47 |
0.00% |
- VIX -6.4%, Gold -1.3% — safe-haven demand eased after Trump
halted planned Iran strikes and claimed deal “perimeters” (see
leader)
- Equities broadly higher (Nasdaq +1.0%, S&P +0.7%, Dow +0.5%)
as the same de-escalation lifted risk appetite
World
Moscow
restaurant bombing kills three — Russia’s aerospace commander may have
been present
A woman carrying a homemade device was stopped by security from
entering the Balzi Rossi Italian restaurant on Kudrinskaya Square in
central Moscow on Saturday evening; the bomb detonated just outside,
killing three people and injuring at least 21. The restaurant was
hosting a closed private event — eyewitnesses reported military vehicles
outside, and journalist Oleg Kashin and others suggest it may have been
the birthday party of Colonel General Aleksandr Chayko, commander of
Russia’s Aerospace Forces, though this remains unconfirmed. No group has
claimed responsibility. It is among the most lethal acts of domestic
violence in Moscow in recent years, and will intensify pressure on
Russian security services already stretched by wartime operations.
Gaza:
Palestinians hope Hamas disarms but fear Israeli forces will never
leave
Despite Hamas formally agreeing to disarm under a US-brokered plan,
Israel continued strikes on Gaza killing at least eight people.
Palestinians on the ground expressed cautious hope for an end to the war
but deep skepticism that Israeli forces will actually withdraw — the
core sticking point in every prior negotiation. Former Israeli PM
Naftali Bennett further complicated matters, publicly claiming Qatar is
now a more dangerous enemy to Israel than Iran, signaling ongoing
hardliner resistance to any diplomatic settlement.
Fighting
erupts in western Tigray — Ethiopia’s 2022 peace deal under serious
threat
Clashes have broken out near Sheraro in western Tigray between
Ethiopian government forces and the TPLF, with both sides trading blame.
Al Jazeera describes the fighting as one of the most serious threats yet
to the fragile 2022 Pretoria Agreement that ended a devastating civil
war which killed hundreds of thousands. A renewed breakdown would risk
catastrophic humanitarian consequences in an already fragile region.
Europe
burns: Greek wildfires rage, France eases, Italy on maximum heat
alert
Wildfires continue to ravage Greece while French blazes are showing
signs of containment in Var and Gironde. Italy is placing nearly all its
major cities on the highest heat alert — 19 cities including Rome,
Milan, and Naples are on red alert, with virtually the entire country to
follow by Monday. The compounding crisis reflects Europe’s worst
wildfire and heat season in decades.
Hungary
to shut its only nuclear plant — record-low Danube levels disrupt
cooling
Hungary will fully shut down the Paks nuclear power station for the
first time since it opened in 1982, after an unprecedented drought
brought the Danube to record-low levels that are disrupting reactor
cooling — an escalation from the partial disruption reported Friday.
Hungary depends heavily on Paks for its electricity, and the forced
shutdown represents a major energy crisis driven directly by
climate-related drought.
Nirmal
Purja confirmed dead in Broad Peak avalanche
Nirmal Purja — who famously summited all 14 eight-thousanders in just
over six months in 2019, a feat celebrated in the Netflix documentary
14 Peaks — has been confirmed killed in the avalanche on
Pakistan’s Broad Peak. He was leading a team of 11 climbers when the
slide struck; multiple other members of the expedition also died.
Previously only four bodies had been recovered and Purja was listed as
missing.
13
killed as tourist plane crashes over Peru’s Nazca Lines
A small sightseeing aircraft crashed into a field after departing
from Pisco on a flight over the Nazca Lines UNESCO site, killing all 13
aboard — 11 tourists including European nationals and two pilots. The
Nazca Lines, vast ancient geoglyphs in the Peruvian desert, can only be
fully appreciated from the air, making low-altitude tourist flights
routine. Authorities are investigating the cause.
Foxtrot
Network: teenage hitmen recruited for murder-as-a-service across
Europe
A BBC investigation exposes the Foxtrot Network, a criminal
organization believed responsible for approximately 35 murders across
Europe that systematically recruits teenagers as contract killers. Using
“violence-as-a-service” tactics, the network exploits young people —
often with no prior criminal record, making them harder to flag at
borders — to carry out targeted assassinations for hire across multiple
countries.
Capital One revealed in court filings that it closed the Trump
Organization’s accounts following an internal anti-money-laundering
review — marking the first time any bank has formally tied a
money-laundering compliance concern to Donald Trump by name. The
disclosure came in response to a lawsuit filed by Trump’s business
against the bank, effectively surfacing damaging material that might
otherwise have remained internal.
Russian
ship defies sanctions, delivers armored vehicles to Mali through English
Channel
Satellite imagery analyzed by BBC journalists shows a Russian vessel
carrying armored personnel carriers and trucks sailing through the
English Channel en route to Mali, in open defiance of Western sanctions.
The delivery continues Russia’s pattern of sustained military support to
West African military juntas — Mali, Niger, and Burkina Faso have all
deepened security ties with Russia in recent years as French and Western
forces were expelled.
Also today
- United States
-
Trump DOJ subpoenas the New York Times, seeking to expose North Korea
sources — press freedom advocates warn of a chilling effect on national
security reporting — Al
Jazeera
-
25,000+ unaccompanied migrant children lose legal representation as a
federal contract lapses without renewal — NPR
-
FDA set to rule on Moderna’s mRNA flu vaccine — the first of its kind,
and a political flashpoint given RFK Jr.’s mRNA skepticism — NPR
-
Michigan joins Minnesota in reporting cyberattacks; FBI probes a
possible Iranian connection — Al
Jazeera
- Americas
-
Trump says Greenland will be under US control before he leaves office —
no mechanism offered; Greenland has firmly rejected annexation — r/worldnews
-
Pew: Canadians and Mexicans now view China more favorably than the
United States — Pew
Research · r/worldnews
- Africa
-
West Africa’s anti-LGBTQ+ crackdown spreads — campaigners say
politicians have made LGBTQ+ people “the easiest scapegoats to maintain
their power” — The
Guardian
- Health & culture
-
WHO documents ultra-processed food companies systematically suing
governments to block health regulations — The
Guardian · r/worldnews
-
Rare books destroyed for AI training data — Australian booksellers sound
alarm over “horrific” losses in the AI supply chain — The
Guardian · r/worldnews
Ukraine
Deep
strikes hit Engels-2 bomber base, Saratov refinery, and three refineries
1,600 km behind the lines
Ukraine struck Engels-2 — the strategic bomber airbase — and the
Rosneft Saratov refinery (4.8 Mt/year capacity) in overnight raids, with
fires confirmed at both sites. Zelensky said three oil refineries were
hit up to 1,600 km behind Russian lines in total, along with a military
airbase; a Wildberries distribution centre in Samara Oblast was also
struck by drones, with no injuries. The campaign, which has driven
Russian refinery capacity losses to roughly 45%, now includes repeated
hits on the base that houses Russia’s long-range bomber fleet — a
demonstration of Ukraine’s sustained reach into Russian territory even
as its own air defenses hollow out.
Ukraine
sinks Rosatom container ship, hits shadow-fleet tanker in Black Sea
Ukrainian naval drones sank the Yanina, a sanctioned
container ship owned by FESCO (a Rosatom subsidiary), 130 nautical miles
from Novorossiysk using two maritime drones — Rosatom confirmed the loss
and said all crew survived. Separately, USVs struck the shadow-fleet
crude tanker BOURDA (Liberian flag, involved in Urals crude
exports) heading to Taman. The dual strike is part of Ukraine’s
expanding campaign to strangle Russia’s Black Sea maritime
logistics.
The Donetsk city of Dobropillia is now unreachable by any vehicle;
roads into the city are under Russian drone fire control, forcing
soldiers and journalists to walk some 30 km on foot to enter. The front
is 6–7 km away, roughly 800 civilians remain without water, gas, or
electricity — cut since last year — and Ukrainian soldiers on the ground
estimate urban combat is likely within six months. Russian capture would
open a corridor toward Pavlohrad and Kharkiv. Separately, DeepState
recorded Russian advances near Kostiantynivka (Donetsk) and Zaliznychne
(Zaporizhzhia). Russia also launched 133 drones overnight — 24 hits
across 19 locations — and struck central Kherson with guided aerial
bombs, killing one and injuring 18.
Ukraine
wants Starlink to hunt ballistic launchers — Musk declined to meet
Zelensky
After Trump blocked both Patriot deliveries and the manufacturing
licence, Ukraine proposed an alternative: using Starlink satellite comms
to guide drone strikes on Russia’s mobile ballistic missile launchers.
Musk declined a meeting with Zelensky; his team told Kyiv he would allow
the access “if Trump says so.” Trump said he would “consider” the
request but gave no commitment, while Zelensky publicly called on all
partners to deliver anti-ballistic missiles and close sanctions
loopholes before winter.
Inside
Ukraine’s elite long-range drone brigade — turning Russia’s size against
it
A Guardian exclusive goes inside the “Magyar’s Birds” brigade,
Ukraine’s elite long-range drone strike force operating from concealed
countryside launch sites. The unit has developed tactics that exploit
Russia’s vast geography as a strategic vulnerability — striking deep
inside Russian territory with increasing precision and range. The piece
offers rare on-the-ground reporting of Ukraine’s most consequential
asymmetric offensive capability, the same campaign behind this weekend’s
refinery and airbase strikes.
Tech
Soundness
bug in Lean’s proof kernel, triggered by an AI-assisted Collatz
“disproof”
A soundness flaw in the Lean theorem prover kernel was discovered
when an AI-assisted script produced a purported disproof of the Collatz
conjecture. The bug: nested inductive types with phantom parameters
could escape type checking, allowing maliciously crafted metaprograms to
prove False. Leo de Moura (Lean’s creator) and team patched
it within hours of the formal report on July 28. An independent external
checker (nanoda) had found the same exploit through a different
vulnerability — prompting the team to subsequently find and patch
several further kernel bugs with AI assistance. Crucially this was an
implementation bug, not a hole in Lean’s meta-theory; the frontend
parser independently caught ill-typed terms.
Coldcard
wallet silently used weak PRNG after developer disabled hardware
RNG
A post-mortem on a Coldcard Bitcoin hardware wallet firmware bug: a
developer set MICROPY_HW_ENABLE_RNG 0 to suppress a
duplicate-symbol compiler error while attempting to override RNG
functions — not realising this disabled the STM32 hardware entropy
source globally. Wallet seed generation then fell back to Yasmarang, a
weak PRNG. The kicker: the overridden functions weren’t even called
during wallet creation, so the replacement never triggered. The root
cause was a 1,534-line commit with the message “runs” that the developer
didn’t fully understand.
LLMs won’t break
symmetric cryptography
Rounding out a day of crypto-and-correctness postmortems: a technical
argument that despite LLM capabilities, symmetric crypto (AES, ChaCha20,
etc.) is not threatened. These systems don’t have the algebraic
structure that makes public-key crypto potentially vulnerable to novel
algorithmic attacks, and brute-force on 256-bit keys remains physically
impossible regardless of hardware. The post engages seriously with the
question rather than dismissing it.
Apple
Screen Sharing pre-auth RCE: root shell with no credentials
A critical zero-interaction vulnerability in macOS Screen Sharing
(screensharingd) allowed unauthenticated remote attackers
to gain root. The flaw is a logic error in SRP frame-length validation:
any length value with bit ≥ 15 set causes a stale success return,
skipping authentication entirely. From there, Apple’s file-copy protocol
enables root read/write, and attackers inject a reverse shell via
crontab. Affects macOS ≤ 26.5 with Screen Sharing enabled; fixed in
macOS 26.6 (July 27). Lobsters commenters noted the advisory was
LLM-generated with the disclaimer “no human reviewed the output for
correctness prior to publication” — an uncomfortable irony for a
security report.
NetBSD
11.0 released — RISC-V in, and a “vulnpocalypse” acknowledgment
NetBSD 11.0 (August 1) adds RISC-V as a supported architecture with
20,000+ pkgsrc packages already available, implements Linux epoll via
kqueue, and continues maintaining 32-bit and geriatric hardware ports.
Notably, the release ships with three known open security issues — the
team was transparent rather than delay further: “the number of security
issues found or suspected everywhere has massively increased with the
advent of AI tools… new ones are being reported all the time.” Lobsters
commenters are calling this the “vulnpocalypse.”
Decade-long
Arch Linux contributor resigns in wake of AUR incident
Morten Linderud — who spent ten years as an Arch Linux developer
spanning AUR maintenance, the security team, package maintenance, and
implementing debug package support — announced his resignation. The post
is brief: “Things are changing and it’s a good time to let go.” The
timing follows the coordinated RAT campaign that led Arch to disable AUR
package adoption, covered here yesterday. He plans to continue TPM,
secure boot, and platform security work independently.
Linux
desktop crosses 10% market share in North America
Statcounter data shows Linux desktop market share passing 10% in
North America — a notable threshold for a platform that has historically
sat in low single digits. Discussion debates methodology and what’s
driving the shift: Steam Deck, developer adoption, and Windows 11
friction.
Rodney
Brooks: AI hype conflates four time scales that each take decades
MIT robotics legend Rodney Brooks argues that AI discourse
systematically conflates four distinct development timescales: research
maturation (10–20+ years from idea to lab demonstration), hype
generation (months to years of media frenzy), at-scale deployment (20+
years to widespread adoption), and economic reshaping (50+ years for a
technology to actually restructure an economy). His central warning:
every technology that has reshaped economies took over 50
continuous years of deployment to do so. Current predictions of AI
replacing massive workforces within years are category errors, confusing
the hype timescale with the deployment and reshaping timescales.
Elevator
scheduling: why the simpler algorithm usually wins
A detailed interactive exploration of elevator dispatch algorithms —
SCAN, LOOK, and Otis’ RSR (which adds anti-bunching penalties and
idle-nearby bonuses). The counterintuitive finding: simpler algorithms
like LOOK frequently outperform RSR because they re-optimize every 5
seconds, while rigid-assignment systems can’t adapt as conditions
change. Modern destination-dispatch kiosk systems — which collect more
information — sometimes perform worse because the loss in
flexibility isn’t worth the extra data. The piece includes working
simulators and percentile wait-time analysis.
Wez Furlong (creator of WezTerm) released wiff, a terminal-centric
diff and code review utility. Reviews are stored locally
(offline-capable), with optional GitHub PR sync. The notable angle for
agentic workflows: AI agents and humans can contribute to the same
review session concurrently via CLI — annotations from both sources land
in the same local store.
Also today
- Go 1.27 interactive tour — runnable examples of the release’s new
features, from VictoriaMetrics — VictoriaMetrics
· HN · Lobsters
sizeof is surprisingly hard to parse in C — how a
historical design decision calcified into parser complexity — sebsite.pw · Lobsters- Twenty years of Bigtable: an ACM retrospective on the design
decisions, what held up, and what changed — ACM · Lobsters
Scene outside Balzi Rossi
restaurant on Kudrinskaya Square after the explosion. Photo: Baza
Ethiopia’s Tigray region, where
fresh fighting near Sheraro threatens to collapse the 2022 Pretoria
peace agreement. Photo: Al Jazeera
Fire at the Rosneft Saratov oil
refinery following the Ukrainian drone strike. Photo: Ukrainska
Pravda
A fresh grave in a courtyard in
Dobropillia. Photo: Frontliner
Time Scale 4: Economic reshaping —
the 50+ year horizon for a technology to fundamentally transform
economies. Diagram: Rodney Brooks