Russia double-taps a shopping mall in Zelenskyy’s hometown, the Canada–US trade war goes from talks to tariffs overnight, and a security researcher discovers her €5 expired domain had been passively wiretapping calls to Diego Garcia.

Russia double-taps Kryvyi Rih shopping centre, killing 16; Kyiv infrastructure also hit

Rescue workers at the scene of the Kryvyi Rih shopping centre attack, August 21, 2026. Photo: Ukrainska Pravda

Russia struck the Solnechnaya Galereya shopping mall in Kryvyi Rih — Zelenskyy’s hometown — with multiple low-flying Shahed drones during daytime hours on Friday, then hit emergency responders with a second strike 30 minutes later. The deliberate double-tap killed at least 16 and wounded 130, including 23 children; nine remain missing. In a separate overnight attack, Russia struck Kyiv’s critical infrastructure, killing at least 17 and knocking out hot water supply across the capital. EU foreign policy chief Kaja Kallas called the mall strike “terror by design” and threatened Russia with the harshest sanctions yet; Ukraine’s foreign minister instructed all ambassadors to push for “anti-ballistic sanctions” in response to each such strike. The attack followed the same pattern as the Kyiv hospital strike earlier this week — systematic targeting of civilian rescue operations.

The Guardian · Reuters · BBC: mall strike · BBC: Kyiv · CNN · Al Jazeera · Pravda: strike · Pravda: nine missing · Pravda: sanctions push · r/worldnews

Canada–US trade talks collapse; Washington imposes 50% tariffs, Ottawa matches dollar for dollar

After nearly two weeks of talks and a three-day extension, Canada–US trade negotiations collapsed after Washington made what Carney called “unfair” last-minute changes. The US immediately imposed 50% tariffs — invoking Section 338 of the Tariff Act of 1930, never previously deployed — on $20B of Canadian imports including hockey sticks, building materials, and liquor. Carney pledged to match tariffs “dollar for dollar,” while the US Chamber of Commerce warned the tariffs risk the 13 million American jobs tied to North American trade. Adding a hostile political dimension: leaked audio from a private New York fundraiser reportedly captures Vice President JD Vance mocking Carney for trying to “out-tough” Trump. Note: previous coverage reported a deal having been reached — this is a full reversal.

The Guardian · Al Jazeera · NPR · NBC News · BBC · PM Carney statement · Guardian: Vance audio · HN · r/worldnews

Trump calls Strait of Hormuz “American territory”; Iran signals readiness to negotiate

At a South Carolina rally, Trump declared the Strait of Hormuz “American territory” as the US military blockade of Iran continues, while also joking about bombing Iran. Simultaneously, Iran’s president said it was “time to end the war” from a “position of strength,” and the Omani and Iranian foreign ministers held a call — pointing toward back-channel talks. Iranian officials dismissed Trump’s economic warfare framing as evidence of military failure, while Iranian families face deepening shortages.

The Guardian · Al Jazeera: Iran president · Al Jazeera: live · NPR · r/worldnews

Indicator	Value	Change
S&P 500	7,674	+0.43%
Dow 30	53,277	+0.98%
Nasdaq	26,180	+0.43%
Russell 2000	3,018	+0.85%
VIX	15.1	-5.50%
Gold	4,681	+2.39%
BTC	$77,436	+1.51%
EUR/USD	1.1688	+0.00%
USD/NOK	9.30	+0.00%

Gold +2.39% — safe-haven bid as Russia-Ukraine strikes escalate and Trump claims the Strait of Hormuz amid Iran tensions (see World)

World

North Korea fires 10 missiles after Trump curtails South Korea drills

North Korea launched roughly 10 short-range ballistic missiles a day after Trump ordered a scaling back of US–South Korea joint exercises — an apparent overture to Kim Jong-un that Pyongyang answered with a show of force rather than diplomacy. Experts warn Trump’s transactional approach is eroding alliance trust with Seoul, even as South Korea’s K9 artillery system won a new US Army contract. Ukraine’s military separately confirmed 8,500 North Korean troops are now deployed in Russia (also covered in Ukraine).

The Guardian · NPR · Kyiv Post · r/worldnews

Israel re-establishes closed West Bank settlement; settler violence doubles in PA-controlled areas

Thirty “pioneer families” have moved into a previously shuttered West Bank settlement in a wave of nationalist expansion driven by Israel’s government. A new report documents that Israeli settler attacks on Areas A and B — under direct Palestinian Authority rule and earmarked for a future Palestinian state — have nearly doubled since 2025, with settlers pursuing a self-proclaimed “great settlement” campaign. A 17-year-old Palestinian was shot and killed in a settler attack Friday. The Economist warns Israel is “flirting with the next intifada.”

BBC · The Guardian · Al Jazeera · The Economist

Regulators land two of the largest platform penalties yet: TikTok pays $400M, Uber fined $966M

TikTok and ByteDance agreed to a $400 million settlement with the US Department of Justice over allegations the platform collected data on millions of users under 13 — among the largest child privacy settlements in US history. The same week, the Netherlands’ data protection authority fined Uber €825 million ($966 million) for deactivating driver accounts through automated systems without adequately informing drivers — one of the largest GDPR-linked fines in the EU’s algorithmic accountability push, holding Uber accountable specifically for the opacity of its automated decision-making, not just data collection.

Guardian: TikTok · BBC · Al Jazeera · Guardian: Uber

Hong Kong Tiananmen vigil organisers convicted of “inciting subversion”

Lee Cheuk-yan and Chow Hang-tung — organisers of Hong Kong’s annual Tiananmen Square candlelight vigils — have been found guilty of “incitement to subversion” under Beijing’s National Security Law, in one of the most high-profile NSL cases to date. A third activist was also convicted. The UK Foreign Office condemned the use of the security law to prosecute civil society organisers.

The Guardian · BBC

Also today

Israel–Palestine: Turkey issues genocide arrest warrant for Netanyahu over the Gaza aid flotilla interception; France, Italy, and Australia have separately launched judicial proceedings — The New Arab · r/worldnews; UK, Canada and Australia call it “shameful” that Israel will not pursue criminal investigations into the WCK aid worker killings — The Guardian · BBC; Ben-Gvir posts video boasting of gallows built to hang Palestinians under a new death penalty law — which notably does not apply to Jewish extremists — The Guardian
United States: Federal judge strikes down Trump’s immigrant visa ban covering 75 countries — Al Jazeera; First group of 20 deportees arrives in Liberia under a third-country deal covering up to 1,200 people — The Guardian; Stars & Stripes editor-in-chief fired — second top departure in the press freedom dispute with the Pentagon — Al Jazeera; Trump administration plans a $725 million partial payment toward its large outstanding UN debt — Reuters · r/worldnews
Asia: Extreme floods kill dozens across India, Japan and South Korea — Assam survivors describe “a tsunami”; 115mm fell in one hour near Tokyo — Al Jazeera: India · The Guardian · Al Jazeera: Philippines; Myanmar junta bombs a Buddhist monastery during a religious retreat, killing at least 14 — Al Jazeera
Africa & health: Ebola vaccine trial begins in DR Congo as WHO warns half of all 2,500 recorded deaths came in the last 20 days — BBC; Somalia child hunger crisis worsens as aid cuts drive a 32% surge in severe acute malnutrition — Al Jazeera
UN: Guyana’s Rodrigues Birkett leads the informal Security Council straw poll to succeed Guterres as Secretary-General — Al Jazeera

Ukraine

Ukraine strikes Ozon warehouse and Samara refinery; fuel crisis reaches Moscow

Fire at the Ozon logistics complex in Chapayevsk, Samara Oblast, after the Ukrainian drone strike, August 22, 2026. Photo: Militarnyi

Ukrainian drones hit the Ozon logistics hub in Chapayevsk, Samara Oblast overnight — the first-ever strike on Russia’s largest e-commerce warehouse network (a 135,000 m² facility) — and simultaneously struck the Novokuibyshevsk oil refinery nearby, setting off multiple fires. A separate strike also hit the LUKOIL-Permnefteorgsintez refinery in Perm, more than 1,500 km from the border. The cascading effect on Russian fuel supply is now acute: queues have returned to Moscow, Yakutsk is described as “critical” with only five functioning fuel stations, and Gelendzhik is entirely out of fuel. In a significant admission, leaked communications from Moscow’s deputy mayor’s office acknowledge Russia cannot protect its oil refineries and describe internal plans to decentralize refining into mini-refineries.

Pravda: Ozon and Samara refinery · Pravda: Novokuibyshevsk · Militarnyi · r/worldnews · r/ukraine: refinery hitlist · r/ukraine: Moscow queues

Ukraine fields jet interceptor drone; Trump blocks Starlink for deep strikes

Ukraine’s Alexa Spatium jet-powered interceptor on its mobile catapult launcher — the country’s first domestically-developed jet interceptor, designed to catch Russia’s Geran-4/5 drones. Photo: Militarnyi

Two new Ukrainian countermeasures to Russia’s evolving air campaign emerged this week. The domestically-developed Alexa Spatium jet-powered interceptor drone has entered service — a reusable, truck-deployable system specifically designed to catch Russia’s faster Geran-4 and Geran-5 jet drones, which piston-engine interceptors cannot keep up with. Ukraine is also seeking US authorization for Starlink connectivity over geographically defined segments of Russia, which would enable precise drone strikes against Russia’s mobile ballistic missile launchers up to 200 km inside Russia — bypassing the need for additional Patriot interceptors amid the SAM shortage. But Trump has reportedly rejected the push to provide Starlink-enabled targeting for long-range strikes on Russian territory, limiting a key capability. Both Ukrainian moves are designed to reset the air-defense cost calculus without depending on Western weapons shipments.

Militarnyi · Financial Times · Kyiv Post · War Zone · r/UkrainianConflict · r/worldnews: Starlink

North Korea deploys 400-strong drone unit to Kursk; Putin may request 50,000 more troops

Ukraine’s GUR deputy head Skibitskyi confirmed that a 400-person North Korean drone operator unit is embedded among the 8,500 NK troops currently in Kursk Oblast, where they are gaining live combat experience with FPV and reconnaissance drones alongside Russian forces. Roughly 25,000 North Korean soldiers have rotated through Russia in total; Putin is expected to ask Kim Jong Un for up to 50,000 additional troops in September. North Korea has also supplied at least 150 KN-23/24 ballistic missiles with 120 more promised. ISW notes the drone unit may be training alongside Russia’s elite Rubikon drone center, accelerating NK’s acquisition of battlefield drone tactics. (Also covered in World)

Militarnyi · CNN · r/UkrainianConflict

Frontline: Russia broadly stalled, shifting tactics under Ukrainian pressure

Russia made no confirmed advances across the major axes on August 20–21. At Pokrovsk, a Ukrainian battalion commander reports Russian forces have scaled back armored assault attempts after being repelled 10–20 km behind the line; infiltration probes are now the primary mode. At Orikhiv in Zaporizhzhia, Russia’s months-long effort to flank the town has failed and Russian command reportedly abandoned the pincer approach, now apparently massing for a frontal assault. Marginal Russian infiltrations continued in western Kostyantynivka and around Mykolaivka east of Slovyansk, but ISW assesses no significant tactical gains. Overnight on August 21–22, Russia launched 217 drones plus ballistic missiles and Kh-31P/Kh-59 cruise missiles hitting 50+ locations across Ukraine, killing at least six and striking Kyiv’s Darnytsia railway district.

Pravda: overnight attack · Pravda: Kyiv railway strike · ISW

Also today

No longer a national project: US, UK and French troops will join Poland’s “East Shield” fortification line along the borders with Russia and Belarus, alongside a parallel “Eastern Sword” long-range strike initiative — TVP World · r/worldnews
Russia’s Pacific Fleet fires missiles near the disputed Kuril Islands shortly after Putin’s visit; Japan formally protests — The Guardian

Investigations

€5 expired domain gave passive wiretap on Diego Garcia military calls

Log output showing hundreds of thousands of ENUM DNS queries encoding real phone numbers (randomised in the screenshot) — the passive wiretap from a €5 domain. Image: lina.sh

Security researcher Lina bought the expired domain ns.enum.org.uk for ~€5 and discovered it controlled three ENUM (e164.arpa) DNS zones covering Diego Garcia — the US/UK Indian Ocean military base — plus Ascension Island and Saint Helena. ENUM converts E.164 phone numbers into DNS lookups for VoIP routing; the zones had been delegated to nameservers including this lapsed commercial domain. Over six months of passive logging, ~400,000 ENUM queries arrived, each encoding a real phone number, timestamp, and source resolver IP, including resolvers from military networks. A malicious actor could have conducted full MITM on routed calls. She reported to the UK NCSC; transfer of control was reportedly expedited after a 2026 Iranian missile strike on Diego Garcia raised urgency. Root cause: critical defence infrastructure delegated to an unmonitored commercial domain — exposure cost was €5.

lina.sh · Lobsters

German weapons cache linked to Russian intelligence assassination plots

German authorities are investigating an underground stash of weapons found in a forest near Berlin that they believe was placed by Russian intelligence for use in targeted assassinations on German soil. Germany is seeking to extradite a suspect from Romania. The case adds to a growing list of Russian sabotage and assassination-preparation operations uncovered across Europe.

The Guardian · BBC · r/worldnews

Tech

Rust Glancer: a Rust LSP under 100 MB RAM

Memory usage benchmark showing Rust Glancer staying below 100 MB, against rust-analyzer’s much higher footprint. Image: rust-glancer.github.io

rust-glancer is a new Rust LSP implementation targeting radically lower memory use than rust-analyzer — staying under 100 MB even on large codebases by trading some deep analysis for a drastically lighter footprint. A companion post by matklad discusses the design. Worth watching for constrained environments, or for anyone finding rust-analyzer’s memory use a bottleneck.

rust-glancer.github.io · matklad · HN

Rust 1.98.0 lands algebraic floats; next-generation trait solver enabled on nightly

A big week for Rust. 1.98.0 brings three practically useful additions: f32/f64 algebraic methods (algebraic_add, algebraic_mul, etc.) opt into compiler float reordering for better vectorization — a scoped -ffast-math within safe Rust; format_into(&mut NumBuffer) provides zero-allocation decimal formatting matching itoa crate performance, now in the standard library; and UTF-16 helpers plus several atomic APIs stabilize. Meanwhile the new trait solver — a multi-year project replacing Rust’s existing coherence and trait resolution engine — is now on by default on nightly. It fixes a class of long-standing unsoundness bugs, improves coherence checking, and is the prerequisite for several long-blocked language features; the stabilization path is now open.

Rust Blog: 1.98.0 · Rust Blog: trait solver · Lobsters: 1.98.0 · Lobsters: trait solver

There’s no reason for software to be slow

danluu’s characteristic approach — benchmarks, careful accounting — applied to modern software performance. The core argument: a large fraction of observable slowness isn’t fundamental, it’s accumulated carelessness, and real optimization work repeatedly shows how far below the baseline current software runs. A useful counterweight to fatalism about software performance.

danluu.com · HN

OpenTelemetry isn’t delivering on its promise

A critical post — with a spreadsheet — documenting OpenTelemetry’s production pain: SDK overhead varies wildly across language implementations, the gap between the spec and what SDKs actually do is large and poorly documented, and the operational complexity is significant. The argument is that OTel has consolidated mindshare without delivering consistent value.

matduggan.com · HN

Halvar Flake on three hard-won lessons about thinking

Thomas Dullien (Halvar Flake), the binary analysis and security researcher, writes a reflective essay around three realizations: your self-narrative is almost always self-serving — the practice is to actively generate unflattering alternative explanations for your own behaviour; determinism is an engineering illusion — real systems are probabilistic and multicausal, and the scientific method is intentionally biased against accepting true-but-weak-evidence claims; and reason and emotion are not opponents — emotional processing is integral to decision-making, not noise to suppress, and treating the body as a distributed information system is more accurate than the “higher brain vs. basal instinct” framing.

thomasdullien.github.io · HN

ZK proof of wasta: Lebanese nepotism as a cryptographic protocol

A satirical-but-technically-rigorous paper from Nadim Kobeissi at AUB formalizes Lebanon’s wasta system — using political connections to get preferential treatment — as a designated-verifier ring signature. The observation: wasta already has ZK properties by necessity. You must prove you know someone powerful without revealing who (the connection is rivalrous and can be depleted if others learn it), and you must have plausible deniability afterward. The formalization — honest-verifier ZK, computational soundness under discrete log, unconditional deniability — is real cryptography. The vehicle is delightful.

eprint.gacr.info · Lobsters

Btrfs snapshot browsing lands in KDE

The KDE filesnapshots KIO worker showing the version history of a file — native Btrfs snapshot browsing in the file manager. Image: bharadwajraju.com

KDE now ships native Btrfs snapshot integration: a KIO worker exposing per-file version history (so you can browse old versions of any file from the file manager) and a subvolume snapshot browser. This is the difference between a feature existing at the CLI level and being actually usable day-to-day.

bharadwajraju.com · Lobsters

Also today

Languages & compilers: Zig’s io.threaded: cooperative I/O without function colouring — matklad on how Zig sidesteps the async colouring problem that plagues Rust — matklad.github.io · HN; Everyone says assembly is untyped — everyone is wrong: gingerbill designs Odin’s inline asm around the type structure that’s already there — gingerbill.org · Lobsters; Gleam: one clear way to do everything — case as the single control-flow tool, no exceptions, no null — a.baez.link · Lobsters; PL semantics and memory safety: what formal proofs actually buy you — burakemir.ch · Lobsters; LLVM 23 ships ~6.75% faster -O3 compile times (up to 10.5% on sqlite3), plus precompiled headers cutting its own build by ~45% — aengelke.net · Lobsters
Systems & data: ACID transactions are coming to Cassandra 6, via Paxos-based consensus atop leaderless replication — theconsensus.dev · Lobsters; Roomy, an open-source Discord alternative on AT Protocol, is now generally available — blog.roomy.space · Lobsters
Miscellany: Kagi can now filter paywalled results from search entirely — Kagi Changelog · HN; Japan’s TRON OS: the system that could have run the world, killed by US trade pressure — a lesser-known episode in the geopolitics of computing standards — XDA · Lobsters

cd ~/repos/josse-posten && claude --resume 143ccf7f-3edb-4aa3-8559-7a5b06d564c1