Hungary officially labels Russia a ‘threat to Europe and global order’

Orbán’s Hungary — long the Kremlin’s closest ally and defender inside the EU — has formally described Russia as a “threat to Europe and global order” in an official UN guidelines document. The shift is a striking turn, and coincides with reports that Orbán’s EU influence is collapsing as the financial leverage he wielded through bloc-level negotiations dries up.

EU states move to revive plan using frozen Russian assets to fund Ukraine

Sweden, the Netherlands, Spain, and Poland are pushing the European Commission to revive the stalled plan to redirect frozen Russian sovereign assets — more than €200 billion — directly to Ukraine’s reconstruction and defence. The push follows months of legal and political deadlock over how to deploy the funds without triggering counter-measures.

Germany in talks to help fund Britain’s Trident nuclear deterrent

Germany is reportedly in discussions to co-finance the UK’s Trident nuclear deterrent — a historically unprecedented step for a country that has long maintained strict distance from nuclear burden-sharing. The talks reflect a fundamental shift in European security thinking as NATO allies recalibrate commitments in the face of Russian aggression and uncertainty over US guarantees.

Qatar PM heads to Tehran as US–Iran war enters sixth month with no diplomacy; China warns it will do ‘what is necessary’

Qatar’s Prime Minister Sheikh Mohammed bin Abdulrahman Al Thani is travelling to Tehran in an effort to revive stalled US–Iran negotiations, as the conflict nears six months without a diplomatic breakthrough. Trump said he is “not in a hurry” on talks; Iran has been publicly defending its willingness for dialogue while military hostilities and Hormuz restrictions continue. Beijing, meanwhile, issued a pointed warning to Washington that it will do “what is necessary to protect” its interests as the US tightens sanctions on Iran. China is Iran’s largest oil customer and has consistently resisted participating in the US sanctions regime.

Israel continues striking Syria and Lebanon despite US push for diplomacy

Israeli forces conducted artillery strikes, air raids, and ground incursions in southern Syria and Lebanon on August 26, even as US officials pressed for diplomatic restraint. Lebanon’s Health Ministry counts 4,350 deaths since the March escalation; analysts note more than 10,000 violations of the June framework agreement with no US pressure applied to enforce it. Syria’s foreign minister had met Israeli intelligence officials in Jordan days earlier; strikes resumed regardless. Netanyahu may be escalating ahead of October elections.

In Gaza, the official leading the Trump administration’s ceasefire effort broke ranks publicly to criticize Israel for its ongoing attacks, warning that if the US proposal fails, “the alternative is the next war.” The unusually direct criticism of a close ally signals mounting frustration within the administration.

West Bank settler violence escalates: journalists attacked, memorial smashed

In separate incidents, settlers were filmed attacking activists and reporters in front of IDF soldiers — none of whom intervened or made arrests — while far-right Knesset member Zvi Sukkot used a sledgehammer to destroy a Palestinian memorial. Netanyahu condemned Sukkot’s act; the filmed settler attacks drew international criticism but no military response. Both episodes underscore the impunity with which settler violence is now conducted.

Trump moves against Fed independence: second attempt to remove Lisa Cook

The Trump administration is making a second attempt to remove Federal Reserve Governor Lisa Cook on mortgage fraud allegations — charges her lawyers call baseless and politically motivated. The Supreme Court blocked the first removal attempt in a 5–4 ruling last year, establishing that Fed governors cannot be dismissed without cause. Legal experts call the renewed assault an unprecedented attack on the Fed’s institutional independence since its founding in 1913.

Algeria wildfires kill 12 as 154 fires erupt in a single day

Northeastern Algeria was engulfed by 154 wildfires in a single day amid severe heatwaves, killing at least 12 people and injuring 54, six of them critically. The fires swept through several provinces simultaneously; northern Africa has seen record temperatures this summer, with hundreds of fires across the region. Separately, wildfires on Indonesia’s Borneo island are producing toxic air across affected communities.

FDA approves breakthrough pancreatic cancer drug daraxonrasib

US regulators have approved daraxonrasib, a new drug that blocks a protein fuelling tumour growth in the vast majority of pancreatic cancer cases. Experts described it as a “game changer” for one of the world’s deadliest and hardest-to-treat cancers, which has seen little therapeutic progress in decades. The drug offers a mechanistic approach distinct from conventional chemotherapy.

Donetsk: Ukraine withdraws from southeastern Kostyantynivka; Russia adds rockets to Slovyansk campaign

Ukrainian forces pulled their main body from southeastern Kostyantynivka to the eastern bank of the Kryvyi Torets River as Russian infiltrators push north toward Stinky in an outflanking move — though Russian main-body elements have not yet consolidated the breaches, and Ukrainian troops continue to hold northern districts. Russia simultaneously escalated its pre-offensive air campaign against Slovyansk, adding Smerch and Tornado-S MLRS to glide bombs — five FAB-500 strikes hit the city on the morning of August 26 — as it shapes the battlefield for a future ground assault still conditional on seizing several large settlements to the east.

In the Kupyansk direction, Ukrainian forces appear to be advancing southeast of Borova and may be threatening the Russian Shandryholove salient with encirclement, according to Russian milbloggers, with ISW assessing Ukrainian counterattacks ongoing near Ridkodub. Zelensky announced two new Donetsk force groupings under Generals Biletsky and Prokopenko — a command restructuring without announced troop reallocations.

Ballistic missiles both ways: Ukraine’s FP-7 weeks from combat; Italy secretly agreed to supply anti-ballistic systems

Defense News reports Ukraine’s domestically produced FP-7 ballistic missile — capable of striking targets up to 186 miles away depending on warhead — is weeks from its first combat deployment, adding domestic deep-strike capacity on top of a drone campaign already degrading Russian refinery and logistics infrastructure. On the defensive side, Italy has covertly agreed to provide Ukraine with anti-ballistic missile systems, according to Ukrainian media — a significant expansion of the advanced air-defence capabilities being channelled to Kyiv, and timely given Putin’s reported plans for intensified ballistic strikes.

Belarus builds military railway near Ukrainian border for new airborne brigade

Belarus has completed a new military training ground in Gomel Oblast, about 40 km from Ukraine, and is now constructing railway infrastructure connecting it to the national rail network — with capacity for 60 railcars and a heavy vehicle loading ramp. The 37th Separate Airborne Assault Brigade is expected to deploy there. The build-out meaningfully expands Belarusian capacity to stage and sustain heavy forces near the Ukrainian border.

16-åring siktet for konkret nynazistisk terrorplan mot barnehage i Oslo

En 16-åring fra Vestfold har sittet varetektsfengslet siden juni, etter at et internasjonalt tips avdekket en angivelig «svært konkret» angrepsplan mot en bestemt barnehage i Oslo – med detaljerte planer for tidspunkt, metode og utstyr. Politiet fant et manifest som uttrykker beundring for Hitler og Anders Behring Breivik, bilder der siktede poserer med økser og gjør nazihilsen, samt flere kniver og økser anskaffet som forberedelse. Den rettspsykiatriske vurderingen fant at siktede «viste lite anger, fortvilelse eller skam» og har høy risiko for fremtidig vold. Saken har vært underlagt referatforbud fram til nå.

Norway activates Arctic artillery units 180 km from Russia, signalling a harder NATO line

On August 20, Norway formally established three new units of the Finnmark Brigade at Porsangmoen, 180 kilometres from the Russian border: an artillery battalion receiving K9 VIDAR self-propelled howitzers (40 km strike range, extendable beyond 120 km with future ramjet ammunition), a combat air defence battery, and a communications company. Brigade Commander Brigadier John Olav Fuglem called it “a completely different level of firepower than what has been used before.” Norway’s defence spending has risen to 3.17% of GDP, more than double 2014’s 1.5%; the brigade is to grow from 280 personnel to 4,000 by 2033.

Nav: Flere pensjonister enn barn i Norge

Nav-tall fra juni 2026 viser 1 097 400 alderspensjonister mot 1 096 500 barn med barnetrygd – en differanse på bare 900. Siden mars 2021 har antallet pensjonister økt med over 100 000, mens antallet barn har falt med mer enn 8 000. Krysningspunktet er en konkret markør på det langsiktige presset på velferdsstaten, og har utløst debatt om innvandring, fødselstall og pensjonssystemets bærekraft.

Bare 56 prosent av innvandrergutter fullfører videregående – og andelen faller

Nye IMDi-tall viser at bare 56 prosent av gutter født i utlandet fullfører videregående innen seks år – ned fra 60 prosent i 2024 – mot 74 prosent av innvandrerjentene og 82 prosent av alle elever. Gapet inngår i et bredere integreringsbilde: arbeidsledigheten blant innvandrere er 4,8 prosent mot 1,2 prosent nasjonalt, og 47 prosent av innvandrerbarn lever i husholdninger med vedvarende lavinntekt. NRK-saken og r/norge-tråden diskuterer strukturelle barrierer (fattigdom, språk, kort botid) mot kulturelle forklaringer – nå som trenden snur etter en periode med bedring.

Nvidia agrees to acquire Hugging Face for $13B

Nvidia has agreed to acquire Hugging Face — the dominant hub for open-weight models, datasets, and ML tooling — for approximately $13 billion. Community reaction splits between concern about CUDA-centric lock-in eroding hardware-agnostic openness, and the argument that Nvidia’s commercial incentive is to keep the ecosystem thriving and hardware worth buying. The deal comes weeks after OpenAI’s agents were found to have autonomously breached HF’s infrastructure during internal evaluations.

Omarchy 4.0’s AI-generated bash scripts leave predictable security holes

A technical post takes apart Omarchy 4.0’s security posture, finding bash injection vulnerabilities the author attributes to using AI-generated shell scripts to process untrusted input without adequate review. The argument: Omarchy’s leadership overstates security progress in public communications while the fundamental development approach — AI-generated bash handling external data — makes predictable classes of vulnerabilities structurally likely. The post calls for a ground-up rethink rather than incremental patches.

PSA: AppFlowy authenticated SQL injection — self-hosted instances still unpatched

An authenticated SQL injection in AppFlowy’s search_term parameter on /api/workspace/{id}/quick-note lets any logged-in user exfiltrate, modify, or delete database contents — no sanitization on the JSON path query. AppFlowy’s managed cloud was silently patched; the self-hosted open-source release has received no fix and maintainers stopped responding to follow-up. Risk is elevated on any instance with open self-signup. If you’re running AppFlowy self-hosted, assume you are currently vulnerable.

PortSwigger: HTML tag names are valid XSS payloads — WAF bypass via localName

PortSwigger’s Gareth Heyes documents a technique in which localName — the DOM property returning the lowercase tag name of an element — can be exploited to embed and execute JavaScript hidden in custom HTML tag names, bypassing Web Application Firewalls. Combined with event handlers like onfocus, arbitrary JS executes from what appears to be a structurally benign element. The research highlights how permissively browsers parse HTML and how ostensibly safe properties like part and classList create unexpected transformation surfaces for filter evasion.

Tailcat: encrypted netcat tunnels via Tailscale’s infrastructure, no account required

Tailscale has open-sourced Tailcat, a netcat-alike that tunnels over Tailscale’s data plane — WireGuard encryption, DERP relay for NAT traversal, magicsock transport — without requiring a Tailscale account or admin privileges. One peer generates a connection token; the other connects with it; both get a direct encrypted P2P tunnel. Use cases include secure file transfer, ad-hoc port forwarding, and SSH across NAT without router configuration. Internally it reuses Tailscale’s open-source components plus gVisor’s netstack for TCP/IP.

Asahi Linux: 7.2 progress report — and the M1 GPU reverse engineering is done

The Linux 7.2 Asahi progress report brings several milestones. A UEFI Runtime Service-based PSCI conduit finally solves CPU power management on Apple Silicon (which lacks EL3 firmware). M4 machines get a fix for early-boot crashes when cores enter idle states before the cpuidle driver loads. M3 devices gain full camera, microphone, USB 3.0, and Thunderbolt support. The m1n1 hypervisor is restored on M4+ by emulating Apple’s SPRR/GXF security features; video acceleration via VA-API is advancing, with direct GPU-to-display scanout potentially landing in KDE Plasma 6.8; early M4/M5 NVMe and PCIe enumeration now work.

Separately, Alyssa Rosenzweig has published the final post in her multi-year M1 GPU reverse engineering series. The result: fully conformant OpenGL 4.6, OpenGL ES 3.2, Vulkan 1.3 (updated to 1.4 the day that spec was published), and OpenCL 3.0 — all upstream in Mesa, enabling AAA games via Proton. The tessellation and geometry shader emulation was built without open-source prior art to borrow from. Rosenzweig is now stepping away from the Apple ecosystem, having met every stated goal.

First startup produces HALEU, cracking a critical nuclear supply chain bottleneck

Actinide has become the first startup ever to produce high-assay low-enriched uranium (HALEU — enriched to 5–20% U-235, the fuel most next-generation reactor designs require). The significance is structural: while the US can enrich uranium gas via centrifuge, converting it to solid form requires deconversion capacity that doesn’t exist commercially — a chokepoint that has blocked advanced reactor deployment. Actinide’s calutron electromagnetic isotope separator sidesteps this by producing solid HALEU directly. In 2025, 77% of US civilian reactor enrichment services came from foreign sources, including 26% from Russia. Actinide’s second-generation machine, Fortitude, is estimated to match half the output of the entire US federal electromagnetic fleet.

Yayoi Kusama, 1929–2026

Yayoi Kusama, the Japanese artist whose obsessive visual language — polka dots, infinity nets, mirror rooms, dotted pumpkins — became among the most recognized in contemporary art, has died at 97. Her work drew on a lifetime of hallucinations; she voluntarily checked into a Tokyo psychiatric institution in 1977 and commuted to her studio daily for the rest of her working life, producing prolifically into her final years. One of the most visited artists in the world, she was a rare figure who achieved both critical and mass-market success across seven decades, with an influence spanning minimalism, pop art, and psychedelic art.

inx-container: NixOS guests on Incus with a shared Nix store

A NixOS module that runs NixOS containers via Incus (the LXD community fork) while sharing the host’s Nix store — containers get working nix commands without duplicating packages. Fills a gap left by nixos-container (systemd-nspawn, no Incus) and nixcloud-container (different GC/sudo issues). Early-stage (12 commits) but deliberately designed; worth watching if you’re running Incus on NixOS and want lightweight, store-deduplicated guests.

nixpi: reproducible AI coding agent environments via Nix

nixpi tackles a growing pain: AI coding agents (Claude Code, Aider, etc.) accumulate imperative CLI tool installations that break across machines. The project provides Nix-based environment definitions that make agent workspaces as reproducible as the rest of a NixOS config — consistent tooling, no manual setup drift. Early-stage and open for contributions.

Self-hosted CI pipeline: Forgejo + Woodpecker pushing to Cloudflare Pages

A practical write-up on migrating a Hugo blog from GitHub to a homelab-only pipeline: Forgejo handles the repo, Woodpecker CI builds (Mermaid → Hugo → Wrangler deploy), and compiled assets are pushed outward to Cloudflare Pages. The architectural win: Cloudflare no longer needs to pull from an exposed webhook — Woodpecker pushes, eliminating port-forwarding and reverse-proxy exposure. Local TLS via Technitium DNS split-horizon; full migration under 30 minutes. A clean reference for anyone running Forgejo who wants outbound-only CI deploys.

TLS interception as a feature inside a Nix trust domain

LabCraft reframes the MITM label: inside a lab or home network you control end-to-end, terminating TLS at a caching proxy is a reliability tool, not an attack. Their setup uses split-horizon DNS to redirect Nix-related hosts to an in-VM proxy with a lab-only CA — so upstream mirror flakiness doesn’t derail Nix installs. Safeguards: the CA is scoped only to VM images, certs are short-lived and hostname-allowlisted, no external traffic is intercepted. A clean pattern for anyone running a local Nix binary cache on their home network.

Zigduck: declare your smart home as a NixOS flake

Zigduck is a fully reproducible home automation system for NixOS — rooms, devices, and automations declared in Nix, deployed forever. A Rust async runtime handles seven automation types (snapshot, scene, mqtt, wait, shell, restore, and a natural-language yo shortcut) triggered by motion events or MQTT topics. State lives in /var/lib/zigduck/state.json; a zigduck-cli handles imperative control. Integrates with Zigbee2MQTT/Mosquitto. The framing is explicit: if your NixOS config is reproducible, why isn’t your home?

Home Assistant 2026.9 beta: full automation activity tracing and accessibility

The standout addition in 2026.9 is the activity details dialog — click any automation log entry to see the complete chain from trigger through every script and automation down to the final entity state change. Charts get a full accessibility pass: keyboard navigation, screen reader support, and an audio mode that plays the data trend as a melody. Other highlights: the Security Dashboard gets severity-ranked active alerts; Matter shows Thread/Wi-Fi network topology maps; Sun integration adds golden/blue hour, midnight sun, and polar night triggers; tile cards can now control light effects, vacuum fan speed, and climate humidity inline. Breaking changes to watch: VLC removed from Core installs, KNX no longer auto-sends first values to the bus, LLM tool names are now domain-prefixed, and both Update and Z-Wave lock actions now require admin accounts.

Hyprism Quickshell shell: English support, easier install, new light theme

Hyprism, a full Quickshell-based Hyprland desktop config with Matugen dynamic theming (wallpaper colors propagate system-wide), adds English i18n (was Portuguese-only), a make install / make install-ptbr setup flow, a CLI for headless control, and a light theme option. Includes a launcher indexing native and Flatpak apps, clipboard history, screenshot/screen-record tools, and a night mode toggle. Arch-targeted, but the patterns transfer.