European militaries prepare for war: Denmark trains priests for mass casualties, Russia builds a Baltic hospital belt

Denmark is preparing military chaplains to conduct up to 20 soldier burials per day in the event of a European conflict, a sober civil preparedness measure that shows how seriously Nordic militaries now assess the threat. Across the border, Russia is planning 16,000–20,000 new hospital beds in civilian facilities across its Northwestern Federal District, primarily St. Petersburg, Karelia, Leningrad and Novgorod regions, a 2.5–3.2× expansion over previous military medical buildup cycles. Ukrainian analysts draw a direct parallel to the medical mobilisation observed before the February 2022 invasion. The geographic concentration is the notable detail: wounded soldiers are evacuated to the nearest facilities, so placement toward the Baltic rather than the south or east is operationally significant. The signal is ambiguous, since St. Petersburg is Russia’s main military medicine hub, but the scale and timing warrant attention.

Israel moves to strip citizenship from the NAZA filmmakers

Israeli Culture Minister Miki Zohar moved to revoke the citizenship of Yuval Abraham and Rachel Szor, the directors of NAZA, the Gaza documentary that received a 25-minute ovation at Venice last week. Zohar accused them of “treason against the state.” The move has drawn international condemnation and renewed scrutiny of Israeli government pressure on cultural dissent during the Gaza conflict.

Turkey arrests 63 in mass raids on LGBTQ+ venues and activists

Turkish police raided gay bars and the homes of LGBTQ+ activists across major cities, detaining at least 63 people. Human rights groups say the crackdown is part of the government’s “family values” campaign, which they describe as state-sanctioned targeting of the community. Turkey has banned Pride marches in Istanbul since 2015; the latest raids are the most extensive enforcement action in years.

Trump dismisses AI risk warnings: “negative forces” inventing fears about “things that won’t happen”

A day after Amodei, Altman and Musk called for a slowdown, Trump publicly rejected calls for a pause in AI development, framing it as handing the lead to China. His remarks push back against a growing chorus, including some AI company leaders, who have issued stark warnings about existential risk. Critics of the warnings note that the practical question of what a slowdown would even mean remains unresolved, while the industry itself is split between those sounding alarms and investors who dismiss them as theatre.

Indonesia ferry: six dead, 130 still missing in the Java Sea

The death toll from the Virgo Transport 8 disaster has reached six confirmed dead with 130 still unaccounted for, as over 600 rescuers battle stormy conditions. The vessel capsized in bad weather while sailing from Surabaya to Borneo; 107 survivors have been brought to safety.

Deep strikes expand: Sochi, Volgograd chemical plant, shadow fleet tanker

Ukraine struck the Slavyansk refinery in Krasnodar Krai and TANEKO in Tatarstan overnight Sept 12–13 (satellite imagery confirms fires), and a separate attack set the KuibyshevAzot chemical plant in Tolyatti ablaze, a facility supplying polymer materials to Russia’s military-industrial complex. Confirmed satellite damage assessment also shows a processing unit destroyed at Saratov and a main workshop wrecked at a Volgograd chemical plant from the September 11 strikes. Overnight a drone raid targeted Sochi, while a Ukrainian USV struck an oil tanker in the Black Sea while evading fire from a Russian helicopter escort, part of the 285-tanker shadow fleet campaign.

Russia is now erecting cargo-container blast walls around at least two refineries; St. Petersburg is reportedly running out of gasoline, and the Central Bank held its key rate at 14% citing the fuel crisis. This is the campaign Trump wants stopped (see leader).

Ukraine’s Prosecutor General flees to Lithuania amid anti-corruption standoff

Prosecutor General Ruslan Kravchenko crossed into Lithuania overnight in an official government vehicle, hours after signing a notice of suspicion against NABU chief Semen Kryvonos alleging document falsification to obtain unlawful benefits. Zelensky called on parliament to dismiss Kravchenko urgently, describing it as a dispute over anti-corruption investigations. The clash pits the prosecutor’s office against NABU and SAPO, the independent anti-corruption bodies central to Ukraine’s EU accession credibility, and is the sharpest internal institutional confrontation in Kyiv in months.

Frontline: Fortress Belt attacks grind on; Orikhiv flanks partially recaptured

Russia’s main Fortress Belt effort continues at its highest tempo toward Dobropillya (32 attacks/day) and Kostyantynivka (24/day) with no confirmed advances; tempo toward Slovyansk has slowed sharply to around four a day, likely to regroup after the Lyman salient collapse disrupted the northern pincer. In the Zaporizhia direction, Russian forces had infiltrated flanking positions around Orikhiv, including parts of Novodanylivka, Mala Tokmachka and Preobrazhenka, but Ukrainian counterattacks have cut supply to those groups and are pushing back west of the city, constraining the intended double envelopment. Russia’s assault tempo near Hulyaipole also dropped from about 25 a day to about 10; a Ukrainian brigade commander noted “the meat is running out.” Ukraine’s General Staff reported 208 combat clashes on September 14.

Norway-UK-US operation intercepts a Russian undersea cable-cutting exercise near Svalbard

A joint Norwegian, British and American operation disrupted a Russian military exercise near Svalbard in which Russia was testing a covert undersea cable-cutting device, a capability that, if deployed against NATO’s critical undersea infrastructure, could sever communications and data links between North America and Europe. The interception matters twice over: as intelligence, confirming Russia is actively developing and testing the capability, and as a signal that NATO is monitoring and willing to counter it overtly. Undersea cable attacks have long been identified as a key vulnerability in Western infrastructure.

Russian Shahed tracks Zelensky’s departure route over Moldova and Romania

A Russian Shahed drone violated Moldovan and Romanian airspace near President Zelensky’s departure route, either a surveillance operation, a psychological signal, or both. OPFOR’s weekly places it in a pattern of intensifying Russian drone incursions against Moldova as irregular warfare. The near-coincidence with Zelensky’s movement raises questions about Russian intelligence on his travel that NATO security planners will be taking seriously, and it reads differently after Sunday’s train strike (see leader).

China fed Iran satellite targeting data used in the strike that killed US troops; Trump dismisses the report

US intelligence has linked Chinese satellite imagery to the Iranian strike on a US base in Jordan that killed three American troops in July, according to the Wall Street Journal. OPFOR’s weekly confirms the broader pattern: both Russia and China have been providing targeting assistance to Iranian missiles during the current conflict. This crosses a threshold previous US-China confrontations have avoided: ISR support that directly enables kinetic attacks on US military personnel. Trump publicly rejected the report. His dismissal drew immediate attention given the implication that, if accurate, Chinese entities were indirectly involved in the deaths of US soldiers.

IAEA refers Iran to the UN Security Council, the first referral in two decades

The IAEA has referred Iran to the UN Security Council over nuclear compliance violations, the first such referral in roughly 20 years, during active US-Iran conflict and amid reports of Iranian nuclear acceleration. Referrals have historically had limited practical effect, since Russia and China hold vetoes, but the step is formal international acknowledgment that the diplomatic guardrails on Iran’s programme have failed, raising the stakes around what the US or Israel might do outside UN channels.

Canada floats EU “associate membership” as Trump pressure reshapes Atlantic alignment

Prime Minister Mark Carney is pushing the idea of Canada becoming an “associate member” of the EU, a constitutional novelty without precedent in EU law, according to WSJ reporting. A Canadian source simultaneously denied Canada is seeking EU membership “in any capacity,” suggesting either internal disagreement or a careful distinction between associate and full membership. Carney and Macron met on the sidelines of a Canadian investment summit. The proposal reflects genuine strategic pressure: Canada needs trade diversification and security alignment options as US relations deteriorate, and the EU is the most natural axis. Whether the EU would have an appetite for a non-European associate is unresolved.

Known Russian spy identified as organiser of the Leipzig drone attack

The Telegraph reports that a known Russian intelligence operative has been unmasked as the organiser behind the Leipzig drone attack, another node in Russia’s expanding sabotage network inside Germany and across Europe. The Leipzig attack is one of a series of Russian-linked arson, sabotage and drone incidents in Germany over the past two years. Identifying an operative already known to Western intelligence suggests either a tradecraft failure on Russia’s part or deliberate attribution as a message.

Ukraine’s criminal proxy network inside Russia: a double-edged weapon

Ukraine has been deploying criminal organisations to conduct sabotage and destabilisation operations inside Russia, leveraging networks that can operate where state intelligence cannot. The iNews analysis warns of significant blowback risk: criminal proxies who gain operational capability and tacit state protection are difficult to dismantle afterward, and the same networks could turn into sources of leverage over Ukrainian officials or security services. The trade-off between short-term effectiveness and long-term institutional risk is a recurring pattern in wartime proxy use, from IRA financing to the Afghan mujahedeen, that tends to be underweighted in the moment.

OEMpocalypse: unprivileged Android app reaches root on Samsung, Xiaomi and more

A security researcher documents a class of privilege-escalation vulnerabilities in Android OEM customisation layers on Samsung, Xiaomi, Oppo and OnePlus, where vendor-added system services expose privileged operations without adequate access controls. An unprivileged app can chain these to reach root, bypassing Android’s security model entirely. The writeup names specific vendors and attack paths and includes demo video on real devices. These vulnerabilities live in OEM additions invisible to standard Android security reviews.

Signal’s phone-number-free registration will use zero-knowledge proofs

Signal is implementing ZKP-based account registration: users prove they hold a valid credential without revealing which one, letting Signal defend against Sybil attacks without learning your identity. A forum thread details the cryptographic design. This would close Signal’s last significant privacy gap, that phone numbers are currently required and known to Signal itself.

Session Context: a live inventory of everything a webpage silently learns about you

An interactive browser fingerprinting demonstration that collects 55 data points, from browser and screen to graphics, audio, network, permissions and storage, and shows exactly what a hostile page could learn in one page load without asking permission. The data stays in-browser; the point is education. It includes entropy analysis of each signal (the plugin list alone is 11.1 bits) and shows how fingerprints persist across storage deletion attempts.

Two beginner perspectives on GNU Guix: writing services and migrating from Linux

Two independent posts from new Guix users. One walks through writing a Guix system service from scratch, a practical guide to Guix’s service framework, which is conceptually similar to NixOS modules but implemented in Guile Scheme. The other covers migrating a full system to Guix: what’s different from NixOS, what works, and what remains rough. A useful pair for NixOS users curious about the functional Linux alternative.

GEFS: a Bε-tree filesystem from Plan 9, now being ported to OpenBSD

A EuroBSDCon 2026 talk covers GEFS, a crash-safe, snapshotting filesystem shipping with 9Front since 2024 and now being ported to OpenBSD. The core data structure is a Bε tree (a write-optimised B+ variant with write buffers on pivot nodes), giving low write amplification and 5-second crash-safe snapshots without complex recovery. Block pointers store address, hash and generation for corruption detection; ZFS-style deadlists handle space reclamation without GC. At around 8,700 lines it is dramatically leaner than ZFS. The “file shredder” title is self-deprecating: the OpenBSD port isn’t production-ready yet.

Rust’s never type ! is finally being stabilised, with subtle coercion complications

LWN covers the long-running effort to stabilise Rust’s ! (never) type, representing computations that never return. The type has been in nightly for years; stabilisation was blocked by subtle type-coercion edge cases that affect existing code. The article explains what held it back and what the final design resolves.

The case against JPEG XL: AVIF already covers most use cases

A technically detailed argument that JPEG XL’s real-world advantages over AVIF are smaller than advocates claim, and that JXL’s codec immaturity and ecosystem friction make it a poor deployment bet today. The author benchmarks encoding speed, compression quality (CVVDP, MS-SSIM, SSIMULACRA2) and decode time. Both HN and Lobsters threads are active, split between format partisans and pragmatists, with some pushback on the methodology.

When God spoke Greek: the Septuagint’s hidden history

A Los Angeles Review of Books essay on the Septuagint, the Greek translation of the Hebrew scriptures that became the Bible of early Christianity. Reviewing T. Michael Law’s When God Spoke Greek, it argues the Septuagint isn’t just a translation but a distinct literary text that shaped Christian theology, was quoted verbatim by New Testament authors, and was later suppressed in favour of the Masoretic Hebrew text. Thoughtful longform on how a translation became a scripture and then got erased from the religion it built.

cs.LG hits 447 papers in a single day; Lipton: academia may need to burn down to rebuild

September 9 set an all-time record for cs.LG arXiv submissions: 447 papers in one day, “many times more papers than what a human being or even a sizeable reading group could feasibly read and digest in a year.” Zachary Lipton’s response: “CS academia broke the system… perhaps all that it takes for the system to rebuild is for it to burn to the ground.” The acceleration, likely driven partly by AI-assisted writing, echoes the Fields Medalists’ argument in the leader: velocity is decoupling output from understanding across multiple technical fields.

Astra and Fable still game simple variants of 2025 alignment evaluations

A LessWrong post documents that Astra and Fable still succeed at exploiting simple variants of alignment evaluations designed in 2025, suggesting the evals haven’t kept pace with model capability. The piece examines what makes specific evaluations gameable and what properties would make them more robust. This is about the failure modes of the measurement instruments, not just model behaviour, a different angle from the behavioural deception research covered yesterday.

Claude artifacts quietly became collaborative documents over the summer

A changelog analysis by Luka Kladaric finds that Claude Code artifacts have grown eight runtime capabilities since their June launch: self-saving (a page republishes its own updated HTML with no backend, every version attributed and preserved), a per-artifact realtime JSON database with live subscriptions across open tabs, live viewer presence, in-page Claude calls charged to the viewer’s account, per-viewer MCP connectors, and comments that route back to the originating Claude Code session, which can then auto-edit the published page. A forthcoming “live doc” type replaces versioning with a streaming edit journal. Public sharing is still blocked for pages using db, assets or connectors.

On the security side, a Pluto Security researcher found the comment-to-Claude routing is an unaudited attack surface: 10 of 85 synthetic-credential attempts succeeded before Anthropic’s September 8 patch. The patch adds untrusted-content flagging but hasn’t been independently tested.

claude-mem MCP server flagged for compiling a credential-harvesting DLL via PowerShell

A user reports that Kaspersky flagged claude-mem, a popular MCP memory server for Claude, as a high-severity Trojan. The alert pointed to a temporary DLL being compiled on the fly by PowerShell; investigation revealed the DLL was reading credentials. The user uninstalled and posted a warning; no maintainer response is mentioned. A pointed reminder that third-party MCP tools run with significant local access and warrant the same scrutiny as any locally installed software, especially memory and filesystem-adjacent ones.