Iran war: Riyadh air raids, $43.6bn cost, Amazon data loss, death toll disputed

Several significant disclosures from the ongoing Iran conflict. Saudi Arabia issued its first air raid warnings for Riyadh since the Houthis escalated attacks, with explosions reported before the all-clear. US Central Command acknowledged the war has cost at least $43.6 billion so far. An Al Jazeera investigation found that more US troops have died than the Pentagon’s publicly stated 18. And Iranian strikes on Amazon data centers in the region caused permanent, unrecoverable loss of customer data — a civilian infrastructure casualty of the war that received little attention.

Yemen: anti-Houthi assault on Sana’a collapses; politicians allege billions were paid to abandon positions

What was billed as a decisive anti-Houthi offensive on Sana’a ended in sudden military collapse, triggering a bitter inquest among the coalition. Some Yemeni politicians are claiming billions of dollars were paid to persuade forces to abandon their positions, raising serious questions about coordination, morale, and whether the collapse was bought. The failure significantly sets back prospects of any military reversal of Houthi control. The Houthis, meanwhile, accuse Saudi Arabia of launching 26 strikes in 24 hours.

Hundreds of Iranian women run Tehran 10K without hijabs in open defiance

Hundreds of women ran a Tehran 10K race without hijabs, openly defying Iran’s mandatory veil law. The public act of mass civil disobedience is one of the largest since the government resumed enforcement crackdowns following years of protest.

Trump bans CNN, MS NOW and Politico from the White House; thousands protest at the Kennedy Center as a judge blocks demolition

Trump announced an immediate ban on CNN, MS NOW, and Politico from White House press access, calling it justified by “fake news” coverage and threatening further bans. Critics, including legal scholars, called it one of the most direct First Amendment violations in recent presidential history.

The same day, thousands gathered at Washington’s Kennedy Center after Trump was photographed holding a sign reading “Kennedy Center DEMOLIS…” and suggested the building could be torn down. A federal judge ruled Trump cannot demolish it without a 30-day notice. Financial records show the venue ran a surplus in 2024, contradicting Trump’s claim it was “losing hundreds of millions.” Kerry Kennedy called potential demolition “a tragedy.”

US deportees bound and beaten at Equatorial Guinea hotel; court blocks third-country deportation plan

Men expelled by the Trump administration to Equatorial Guinea were bound, fitted with bags over their heads, beaten, and pushed down stairs at the Hotel Bamy — all in plain view of other US deportees. Rights groups are raising alarms over the downstream human rights consequences of third-country deportation policies. Separately, a US court blocked the administration’s plan to deport migrants to unfamiliar third countries, ruling that migrants must have a meaningful opportunity to voice safety concerns before removal.

US-Denmark Greenland deal gives Washington security control — sovereignty disputed

Trump announced a security pact with Denmark and Greenland he says grants the US “permanent control over security” over the island, following months of threats to take it by force. Denmark and Greenland’s governments are presenting it differently: as a US military expansion that preserves their sovereignty and right to self-determination, pending ratification by both parliaments. The gap between how Trump and Copenhagen are describing the same agreement is notable and unresolved. Meanwhile Carney is seeking to bring the UK and Germany into a new multilateral defence finance institution — middle powers building financing capacity outside US-dominated structures.

Indonesia ferry capsizes: 126 people missing, three bodies recovered

Indonesian rescue teams retrieved three bodies and began operations to right a capsized ferry, with 126 people still missing. Bad weather has complicated the search-and-rescue effort.

Russia fires Zircon missiles and 174 drones overnight; Sumy apartment struck, commuter train hit

Russia launched its largest recent strike on the night of 18–19 September: two Zircon hypersonic missiles and 174 drones, with 141 aerial assets downed and hits recorded at 15 locations across six oblasts. A guided aerial bomb struck a residential building in Sumy city, killing two and injuring eight including children; a jet-powered Geran drone hit a commuter train in Kharkiv Oblast, killing one and injuring eight. The railway campaign is accelerating — Russia has damaged or destroyed over 500 locomotives since the war began, with 60% of that damage in just the past eight months, targeting trains to isolate front-line areas and paralyze Ukraine’s economy. Ukraine separately confirmed the neutralization of one of the two S-400 launchers Russia recently used in ground-attack mode against Kyiv.

Ukraine splits Eastern command in two; Russia masses for Dobropillya fall offensive

Ukraine disbanded its Eastern Group of Forces and replaced it with two new commands: Center GoF covering the Lyman-to-Kramatorsk axis, and Azov GoF covering the Dobropillya south. In Dobropillya, Russia has intensified drone and artillery strikes against Ukrainian logistics since 9 September and moved artillery guns forward — preparation for the fall mechanized assault ISW has been tracking. New details of Operation Vivaldi confirm Ukrainian forces captured Serednie by deploying armor on rain-saturated terrain Russian forces considered impassable, achieving complete surprise. Near Chasiv Yar, Russia raised flags in Virolyubivka but ISW does not assess they have consolidated positions there.

Russia extends its parliamentary vote to occupied Ukrainian territories

Russia is for the first time holding its parliamentary elections in the Ukrainian regions it illegally annexed, with armed troops stationed at polling stations. Analysis frames the elections less as democratic participation and more as a Kremlin mechanism for projecting legitimacy and gathering political feedback in occupied territory. “There are no decent parties left,” as one Politico headline puts it. (Mobilization fears and asset seizures in the Leader)

Assad regime planned journalist Austin Tice’s kidnapping for weeks

New reporting reveals the Syrian government systematically planned journalist Austin Tice’s abduction for weeks before it happened in 2012. Tice has been missing ever since, and the finding adds significant weight to long-standing suspicions about regime culpability — with implications for how the new Syrian leadership handles accountability.

Flock surveillance cameras: hard-coded API keys, eight years unpatched

Micah Lee’s investigation of a Flock license plate reader found: a hard-coded provisioning API key enabling credential retrieval for any camera via MAC address; Android 8.1 running a June 2018 security patch (leaving it exposed to CVE-2021-1905, CVE-2018-9568, and years of others); Auth0 credentials in plaintext on an unencrypted partition; and GPS coordinates in logs precise enough to identify the device via Street View. Flock cameras are widely deployed in US law enforcement networks. This follows Thursday’s report of hackers getting root on a Flock camera and finding its encryption keys unprotected.

Android 17 breaks the AOSP compact — first time since version 3.x

GrapheneOS flags that Android 17 is adding new platform APIs without releasing them to the Android Open Source Project — the first time this has happened since Android 3.x (Honeycomb, 2011), when the tablet-first release was briefly withheld. Google’s post-3.x practice of publishing APIs to AOSP simultaneously with device releases has been a foundational assumption for GrapheneOS, custom ROMs, and the broader open-Android ecosystem. If this holds, it narrows what AOSP-based projects can build against.

Laser punches through RP2350’s permanent debug lock

Ledger Donjon combined photon-emission microscopy (locating DEBUGEN register bit positions by detecting IR photons from switching transistors) with 980 nm pulsed laser fault injection to flip those bits past write-protection locks on a decapped RP2350. The attack yields full Secure-world memory access and recovered a 128-bit OTP secret. Equipment cost is ~$250k and requires physical decapsulation, so the threat model is narrow — but it demonstrates the physical security ceiling of the chip’s debug-disable guarantees.

Bonsai 2 27B: ternary quantization hits 98.2% of Qwen full-precision performance

PrismML’s Bonsai 2 27B applies ternary quantization ({−1, 0, +1} weights with FP16 group-wise scaling) to Qwen3.8 27B, landing at 1.76 effective bits per weight and a 5.9GB footprint — 9× smaller than the baseline. Benchmark retention is 98.2%, up from 95% in Bonsai 1. Supports 262K context, multimodal input, and tool use, under Apache 2.0. The retention number is now high enough that the compression overhead is practically invisible for most workloads.

In the same vein of doing more with less representation: Cache-to-Cache (C2C), published at ICLR’26, skips text serialization between cooperating LLMs entirely. A neural projector maps one model’s KV-cache into another’s internal representation space, with a learnable gate selecting which target layers benefit. Results: 6–14% accuracy gains and 2.5× latency improvement over individual models, and 3–5% additional accuracy over text-based multi-agent communication. Models don’t need shared architecture, only the projector bridge.

Cloudflare saves 100TB of RAM with consistent hashing math

Two optimizations to Pingora’s backend router: replacing 32-bit server indices with 16-bit (25% memory reduction, since the ring will never need more than 65k servers), then using statistical diminishing-returns analysis to cut hash-point count by 90% — the last 90,000 hashes provided only 0.7% error reduction. The combined effect reclaimed over 100TB globally. Deployment used dual-ring versions running simultaneously for per-request selection, avoiding cache invalidation that would have overwhelmed origins.

Wild vs Mold: linker benchmarks are methodology-sensitive

Wild linker author David Lattimore shows that Wild and Mold reach near-parity under identical test conditions (tmpfs output, forking enabled, pre-existing output file). The apparent gap in Mold’s own benchmarks reflects configuration differences rather than fundamental capability. Mold also improved significantly in releases 2.42.0–2.42.1, which postdate Wild’s earlier comparative numbers. Wild’s next release will add OS-specific optimizations (file pre-allocation, hugepage mapping) it currently lacks; high-core-count scaling on systems like 64-core Threadrippers remains an open question.

Typst 0.15: variable fonts, MathML in HTML, bundle mode

Version 0.15 brings variable font support (continuous typographic axes without multiple files), experimental HTML output with MathML for TeX-quality equations without JavaScript, a bundle mode that generates interconnected HTML+PDF output from a single source, and independent per-chapter bibliographies. LWN’s coverage notes the pace of development remains impressive but scholarly publishers’ LaTeX lock-in continues to limit adoption where it would matter most.

The human brain is two evolutionarily separate organs

Stanford-led research on mouse embryo gastrulation identifies two completely distinct progenitor populations with different chromatin configurations: Otx2-expressing cells locked into generating the forebrain and midbrain, and Gbx2-expressing cells locked into the hindbrain — lineages that never overlap. The practical payoff: previous attempts to grow human hindbrain neurons in vitro failed because researchers were starting from the wrong progenitor. The discovery now enables lab-grown hindbrain neurons for the first time, opening direct paths to modeling ALS and spinal muscular atrophy.

Three essays on thinking: Tao on what proof leaves out, Kreinin on what tests are really for, Luu on when to stop thinking (never)

Terry Tao argues the mathematical community undervalues and underdocuments everything outside formal proof: intuition, failed approaches, heuristics, the “feel” for why a statement should be true before anyone can prove it. He calls for better infrastructure to capture and celebrate this part of mathematical culture — not just final polished proofs.

Yossi Kreinin’s contrarian argument: in practice, tests function primarily as territorial signals — marking ownership, raising friction for outsiders changing code, enforcing architectural boundaries — not as defect prevention. The mechanism he describes explains test culture patterns that the “tests prevent bugs” model struggles to account for.

Dan Luu systematically examines contexts where “turning your brain off” is expected or normalized — from airline crews to software engineers — and why each assumption of safe delegation fails in practice. Concrete failure cases, structural rather than anecdotal, conclusions that make the framing obvious in retrospect.