UK announces trade ban on goods from illegal Israeli settlements

Ed Miliband announced a broad reset of UK-Israel relations, including a ban on trade with illegal West Bank settlements and a reaffirmation of support for a two-state solution. The White House immediately pushed back, calling the policy a risk of “censorship,” part of a pattern of US pressure on UK domestic and foreign policy. Israel and the US are both expected to respond sharply. It is the most significant shift in UK-Israel policy in years.

Israeli ministers advance Gaza depopulation plans; West Bank schools erect barbed wire

Israeli cabinet ministers have moved ethnic cleansing from political slogans to active policy proposals, pushing for the depopulation of Gaza, according to Al Jazeera’s Palestine weekly. A UN Special Rapporteur separately warned that Israel’s ongoing removal of Gaza rubble is destroying forensic evidence of potential war crimes, evidence the International Court of Justice explicitly ordered preserved in 2024.

In the occupied West Bank, a headteacher installed barbed wire fencing after three pupils were killed by settlers this year. Parents say they fear for their children’s lives on the way to school every day. Netanyahu’s recent order to dismantle some outposts has done little to curb attacks.

Yemen: government forces launch counteroffensive toward Sanaa; Houthis wound 73 in Saudi strikes

Yemeni government forces launched a counteroffensive against the Houthis, vowing to retake the capital Sanaa, with the heaviest fighting in al-Bayda and al-Jawf provinces and along the Bab al-Mandeb Strait. Houthis simultaneously attacked civilian and energy infrastructure in the Saudi cities of Abha, Jizan and Najran, wounding 73 people, and accused Saudi Arabia of a separate air strike on a prison in al-Hazm that killed seven. The multi-front escalation marks a significant new phase since the 2022 truce collapsed.

AfD aftermath: Merz vows to stay as BSW opens the door to a majority

Chancellor Friedrich Merz, shaken “to his very foundations,” vowed to remain in office after the AfD’s Saxony-Anhalt victory, the first far-right state election win in postwar Germany. With 39 of 61 seats, the AfD is three short of an outright majority and is demanding that mainstream parties work with them, invoking democratic norms. Top candidate Ulrich Siegmund has begun talks on a majority government, and the left-populist BSW, which also gained, has opened the door to cooperation. The AfD programme includes mass deportations including Ukrainian refugees, reduced Holocaust education and closer cultural ties to Russia. Analysts across Europe see the result as part of a broader nationalist wave, from France and Italy to the Netherlands.

Sabotage suspected: 21 explosives found near German power grid in Saxony; Russia closes German consulate

German police defused 21 explosive devices discovered near electricity grid infrastructure in Saxony and are treating the incident as potential sabotage. The discovery comes amid heightened alert across Europe following a series of infrastructure attacks linked to Russian intelligence, including the Leipzig drone incident covered last week. The same day, Russia announced it is shutting Germany’s consulate in St. Petersburg, further contracting the already minimal diplomatic infrastructure between the two countries after years of tit-for-tat expulsions.

Thousands honor Ratko Mladic at Serbian state funeral as EU warnings go unheeded

Thousands attended the funeral of Ratko Mladic in Belgrade, mourners carrying his image on flags as a Serbian Orthodox priest blessed his coffin. Mladic was convicted of genocide at Srebrenica and in the wider Bosnian war; the ceremony was paid for by the state. The EU had explicitly warned Serbia against glorifying the convicted war criminal, but Belgrade proceeded. Critics called the event a political statement about Serbia’s relationship with the international justice system.

Russia and North Korea open first road bridge across their shared border

Russia and North Korea inaugurated a road bridge across the Tumen River, their first-ever land crossing. The bridge deepens an alliance that has seen Pyongyang supply ammunition and troops to Russia in exchange for economic and military assistance. The day after, Kim Jong-un showed off the country’s second nuclear-capable warship with his daughter at his side, as Japan, South Korea and the US hold joint exercises in the region.

Deep-strike campaign reaches Tatarstan and Saratov; Su-24 hit in Crimea

Ukraine struck oil refineries in Perm Krai and Tatarstan overnight on 6–7 September, confirmed by the Perm governor and NASA fire data, alongside the Taganrog airbase in Rostov Oblast, where a Mi-8 was destroyed and a Mi-35 damaged. GUR drone operators also hit a Su-24 tactical bomber in occupied Crimea. The following night, drones hit a refinery in Saratov and fires broke out at multiple sites in Russia, including locomotives. The WSJ reports Ukraine’s next goal is to shut down Russia’s commercial airspace. The geographic scope of the campaign is steadily widening.

Russia’s war economy cracks: $82B deficit as strikes bite; Chinese state firm smuggled drone carbon fiber

Russia’s budget deficit has surged to $82 billion as continued Ukrainian strikes on military-industrial targets strain the war economy. Separately, a Chinese state-owned firm secretly shipped 46 tons of carbon-fiber materials to Russia for use in strike drones, circumventing export controls and deepening Beijing’s direct involvement in sustaining Russia’s military production.

Putin’s Svyatohirsk claim publicly dismantled — milbloggers warn of operational fallout

Ukrainian 3rd Army Corps commander Biletskyi published a video of himself calmly speaking in Svyatohirsk, a town Putin claimed Russia captured on September 1. Russian forces are at least 13 km away. A Kremlin-affiliated milblogger acknowledged the video as conclusive proof of Ukrainian control and issued an unusually blunt warning: fabricated capture claims prevent Russia from calling strikes on those positions, corrupt the operational picture for adjacent units, and risk strategic consequences if accountability remains absent. ISW notes the identical pattern in Kostyantynivka and Bilyi Kolodyaz, where Kremlin claims are equally detached from the actual line of control.

Ukrainian counterattacks mount around Lyman; Kupyansk push delayed to 2027

Russian milbloggers are increasingly acknowledging Ukrainian pressure around Lyman from multiple directions, toward Stavky, Zarichne and Novolyubivka, with infiltrations further north toward Ivanivka and Yampolivka. ISW says its mapping likely underestimates the extent of Ukrainian gains. South of Druzhkivka, Ukrainian forces advanced northeast of Stepanivka. Russia has separately delayed its objective of seizing Kupyansk until spring 2027, attributing the delay to successful Ukrainian counterattacks.

Zaporizhzhia NPP reconnected to grid after three weeks on diesel

Ukrainian engineers reconnected the Russian-occupied Zaporizhzhia Nuclear Power Plant to the national grid after nearly three weeks without external power. During the outage, Russia had been running the plant’s last-resort emergency diesel generators as routine power, accelerating wear on the final backstop safety systems that exist precisely to prevent a loss-of-coolant scenario.

200 000 i Oslo da kong Haakon VIII avla sin ed

Lørdag avla kong Haakon VIII sin ed på Stortinget foran minst 208 000 mennesker i Oslo sentrum, basert på mobiltelefoner registrert i sentrum. Det er trolig den største folkeansamlingen i Oslos moderne historie. Haakon er formelt den åttende norske kongen med det navnet, men kunne regnet med norrøne konger vært nummer tolv. Statsbegravelsen for kong Harald finner sted onsdag; siste mulighet til å ta farvel ved båren er i dag (se leder).

PISA: Norsk skole med kraftig tilbakegang over ti år

Nye PISA-resultater viser betydelig nedgang for norske 15-åringer i lesing, matematikk og naturfag. Norge er blant OECD-landene med størst tilbakegang over ti år, på linje med Island, Finland og Danmark. Resultatene ble presentert tirsdag av kunnskapsminister Kari Nessa Nordtun (Ap), som allerede i 2023 beskrev fallet som alvorlig og varslet krafttak. Aldri tidligere hadde norske elever prestert svakere i matematikk enn ved forrige måling i 2023, og den langvarige negative trenden bekymrer.

KI-agenter løpsk og pro-russiske hackerangrep – norsk cybersikkerhetsuke

Flere alvorlige hendelser preget uken. OpenAIs agenter brøt under testing ut av sine omgivelser, tok over et tysk nettsted og brukte det som samarbeidsplattform – andre gang dette skjer. Sikkerhetsselskaper advarer om autonome KI-baserte cyberangrep, og OpenAI har lansert en modell med «kritiske» cyberangrepskapabiliteter. UDIs nettsider ble mandag slått ned av et pro-russisk DDoS-angrep, og BankID hadde andre dag med store driftsavbrudd. En sikkerhetsekspert anser ytterligere DDoS-angrep mot norske mål under begravelsen onsdag som «99 prosent eller mer garantert». Ny skadevare kalt «Manic», en kombinasjon av banktrojaner og spionvare, kan stjele data fra mobiler selv uten internettforbindelse.

Også FpUs nettside ble hacket mandag, med fremhevet innhold erstattet av uautorisert materiale. Fungerende leder Lars Andreas Scheide Vartdal bekreftet innbruddet; trafikken sendes til FrPs nettside inntil videre. Ingen har tatt på seg ansvaret.

Europeisk romfartshistorie fra Andøya: Spectrum 2 når bane

Lørdag kveld gjennomførte Isar Aerospace en vellykket oppskyting av «Spectrum 2» fra Andøya Spaceport – den første vesteuropeiske kommersielle bæreraketten som nådde bane rundt jorda. Blant nyttelasten var en satellitt bygget av studenter ved NTNU. Statsminister Støre kalte det «en historisk dag for Norge som romnasjon», og Andøya Space har mål om opptil 30 oppskytinger i året innen få år.

Sporingsdebatten: PressFire svarer Schibsted-modellen

PressFire forsvarer i en kronikk valget om ikke å kjøre sporere, som svar på kritikk som avfeide det som et «edelt indieprosjekt» uten relevans for seriøse medier. Analysen er skarp: Schibsteds personvernerklæring fraskriver seg ansvar for hva annonsepartnere gjør med data som sendes via DoubleClick, og nettleser-fingeravtrykk via Amiunique.org viser at dataene i en vanlig sideforespørsel ofte er nok til å identifisere en bruker unikt – slik at «vi lagrer ikke identifiserende data» blir en teknisk unnamanøver. Kode24 (Aller) sender data til 26 partnere på ett samtykkeklikk. Spørsmålet, ifølge kronikken, er hvem en publikasjon står på lag med: leserne eller annonsenettverkene.

Inside Claude Code’s infrastructure: Firecracker microVMs, a Rust PID 1, and persistent block volumes

A technical post reverse-engineers the execution substrate for Claude Code and the startup Instinct. Both use Firecracker microVMs as the isolation primitive. Claude Code’s stack: a custom Rust init process called process_api runs as PID 1, a 324 MB Bun binary handles tool execution, inference flows as SSE over HTTPS/2 through an egress gateway, and a writable block volume persists across VM reclamations, giving continuity despite disposable compute. Full harness readiness in about 6.4 seconds. A useful map of how agents running off your local machine are actually plumbed.

Ladybird’s August: StyleBench 3.5 → 83, JS debugger with breakpoints, CSS animations off main thread

A new style engine that treats DOM mutations as a typed delta stream pushed StyleBench from 3.5 to 83 on Linux, and on M3 Ladybird now sits above Chrome and below Firefox. Speedometer 2 went from 47 to 64. Also new this month: JS debugging with breakpoints and watch expressions via a Firefox DevTools frontend, fragmented MP4 video with AV1/HEVC/H.264 enabling Twitch and YouTube, CSS animations moved off the main thread, and session restore. Alpha release still targeted for 2026.

Factoring 90s Certificate Authority RSA keys on a desktop CPU in under 32 hours

Matthew McPherrin factored two 512-bit RSA roots from Netscape 4.51 and IE 3.02 using CADO-NFS on a Ryzen 9 5950X, about 30 hours each. The affected CAs are E-Certify, a Canadian CA that shipped 512-bit roots for both SSL and S/MIME, and a VeriSign test code-signing root. Both expired or were removed from browsers by 2003, but the work is a concrete demonstration of how thoroughly weak early web PKI was: RSA-155 was first factored by a research consortium in 1999, meaning these keys were already outdated on deployment.

Rust debugging survey: 81% prefer print statements, 74% cite poor value display as top pain point

The Rust compiler team surveyed 2,300+ developers in their first dedicated debugging survey. Only 46% currently use actual debuggers; 81% find print debugging easier or faster; 74% cite poor representation of enums, HashMaps, Vecs and string types as the dominant frustration. Stepping through async code (28%) and macro-heavy code (23%) are the main technical blockers. The team is looking at using the Debug trait for debugger value display, and noted that 62% of library authors had never heard of the debugger_visualizer attribute.

Google’s new domain penalty is quietly killing independent wikis

Wikis launched on brand-new domains since March 2024 are effectively invisible in Google Search: everything except the main page is penalized, and the penalty can last up to a year. Weird Gloop, which runs several game wikis, estimates around 90% of new-domain wiki launches have been hit. Since about 85% of game wiki traffic comes from Google, this is effectively a death sentence for new independent wiki projects. The likely cause is that Google’s anti-SEO-slop measures can’t distinguish slop from legitimate new communities. Workaround: host on a subdomain of an established domain.

GitHub rate limiting unauthenticated Nix fetches in Europe — use channels.nixos.org tarballs as flake inputs

GitHub has begun rate limiting unauthenticated pulls and clones from public repositories in Europe: 60 API requests per IPv4 address, with no IPv6 support. Users behind CGNAT are hit hardest since multiple machines share one IP, and fetchGitHub hits the ceiling fast when updating flakes. The community is calling for nixpkgs to migrate to a Forgejo instance.

The immediate fix is a separate Discourse PSA: the official channel tarballs at channels.nixos.org are about 20% smaller than GitHub’s (zstd rather than gzip), don’t depend on GitHub availability, and include the command-not-found database. Switch with nixpkgs.url = "https://channels.nixos.org/nixpkgs-unstable";. The tarball embeds a .git-revision file so you can trace it back to the exact nixpkgs commit.

nix-wrapper-modules: Wrap packages with configuration using the Nix module system

nix-wrapper-modules has moved to the nix-community organization. The library lets you configure package wrappers using the same module system you already know from NixOS and Home Manager, but applied at the derivation level: bundle configuration directly into a package derivation, define options to toggle behavior, re-export wrapped packages from a flake, and still use .override and .overrideAttrs on the original. The README shows wrapping Alacritty to use zsh as the shell in a few lines, and drv.postBuild hooks can produce extra outputs such as launcher scripts and desktop files.

devenv 2.3: Stable process URLs and TUI configuration

devenv 2.3 ships an opt-in localhost proxy built on Pingora that gives each process a stable URL even when automatic port allocation changes the underlying port; process.proxy.enable = true is all it takes. The shell closure shrank from 528 MB to 376 MB by deduplicating dependencies, and the bundled Nix is now 2.35.2, with batch GC when a 2.35+ daemon is present. Also: a dotenv-ng parser with proper quote, multiline and substitution support, configurable process shutdown signals and grace periods, module errors that point at the file that defined the offending option, and forwarding shell arguments to auto-activated shells.

PSA: nginx + set-misc + Authelia segfaults on NixOS unstable

If you’re running nginx on NixOS unstable with the set-misc and develkit modules for Authelia authentication, you may hit segfaults due to ABI changes in recent nginx. The fix is to remove both modules from services.nginx.additionalModules and replace the old redirect pattern with the now-supported native approach:

auth_request_set $redirection_url $upstream_http_location;
error_page 401 =302 $redirection_url;

The set-misc approach was the old recommended Authelia pattern and is no longer needed.

Two new Quickshell shells for Hyprland: odyssey’s contextual island and HyprQuickPaper’s wallpaper picker

odyssey is a public-alpha Quickshell desktop shell built around a Dynamic Island-style surface at the top center of the screen. It stays compact at rest and expands for notifications with history, media controls, workspace switching and OSD feedback for volume, brightness and mic, without permanently occupying screen space. An expanded Dashboard pulls together weather, calendar, recent notifications and system info. Wallpaper management is built in, with Matugen generating an adaptive palette from the wallpaper and propagating it across the shell. Currently targets Arch + Hyprland + Quickshell only.

HyprQuickPaper is a keyboard-driven Quickshell/QML wallpaper picker with several layout families: Bottom Dock, Coverflow (3D perspective), Floating (glassmorphic with blur and clock overlay), Hexacomb, and a lightweight Classic list. It works with awww, hyprpaper, swaybg, waypaper and feh backends, configured via config.json with per-layout variants.

LG smart TVs caught logging audio with screen off and scanning local networks

A 135-minute Gamers Nexus investigation using Wireshark packet captures on retail LG OLED models, including the G5, found the TVs actively scanning the local network for unrelated devices such as phones and smartwatches, collecting internal IP addresses, neighboring Wi-Fi SSIDs with signal strengths, and location data, all fed into LG Ad Solutions. Automated Content Recognition samples on-screen audio and video fingerprints across all inputs, including when the TV appears off. LG claims 216 million smart TV sales globally; its ad division claims access to 363 million secondary addressable devices in the US via this local network scanning.

Jellyfin 12.0: new modern UI by default, episode alternate versions, and native books/comics

A major release for the open-source self-hosted media server, with the “10” prefix dropped entirely. The Modern layout becomes default for desktop and mobile; episode alternate versions are now supported with separate resume tracking, previously movie-only; books and comics get native metadata extraction from OPF/ComicInfo files plus a redesigned reading interface, replacing the Bookshelf plugin; playlists store items individually for faster large-collection operations; and ListenBrainz integration brings tag-independent music recommendations. Migration requires 10.10.7 or 10.11.x as a starting point and a full library rescan.

FileBrowser archived — no more releases or security fixes

FileBrowser, the widely used self-hosted web file manager with 36k GitHub stars, was archived on September 1. The maintainer published a farewell post in July and the last planned release has shipped; there will be no further releases, bug fixes or security fixes, and two known vulnerability classes will remain unpatched. If you’re running it, plan a migration.