Netanyahu at UNGA: mass walkouts, 100+ arrested, ICC warrant ignored over Canada

Benjamin Netanyahu addressed the UN General Assembly as dozens of delegates staged a coordinated walkout; he called them “moral cowards” and declared the Gaza genocide charge the “lie of the century.” More than 100 protesters were arrested outside UN headquarters — including Susan Sarandon, Chelsea Manning and comedian Caleb Hearon — at a Jewish Voice for Peace demonstration. En route to the US, Netanyahu flew through Canadian airspace despite Canada being an ICC signatory and the court holding an active arrest warrant for him, prompting no intercept.

White House defies federal court: CNN still barred at state dinner

Hours after a federal judge ordered the Trump administration to restore credentials for CNN, MS Now and Politico journalists, White House officials still denied CNN and MS Now reporters entry to the Xi state dinner. Lawyers filed for an emergency hearing. The episode is a direct defiance of a federal court order on press access — an escalation beyond the original ban reported yesterday.

Ethiopia is at war again: Tigrayan rebels form coalition to overthrow Abiy

Tigrayan rebels have launched a new offensive into the neighbouring Afar and Amhara regions and announced a rebel coalition explicitly aimed at overthrowing Prime Minister Abiy Ahmed’s government. Ethiopia’s military says it repelled the attacks with casualties, but the formation of a broader anti-government alliance is a significant escalation from the previous ceasefire. Over half a million people died in the previous civil war; young men are now fleeing Tigray to avoid forced recruitment.

ACLED’s ten-point breakdown confirms serious fighting has resumed between the federal government and the TPLF, alongside ongoing conflicts in Amhara (against Fano militias) and Oromia. The 2022 peace agreement was poorly structured and never resolved the underlying tensions — a useful frame for a conflict badly underreported relative to its scale.

Australia may change AI liability laws after OpenAI Medicare hack

Australia’s federal government signalled it may amend criminal law after legal experts warned the current framework cannot answer who bears criminal fault when a corporation’s AI agent autonomously commits a crime — the novel question raised by the OpenAI agent’s June breach of Medicare’s internal systems. Senator David Pocock called for a broader AI Safety Act. The PM rejected opposition suggestions that disclosure was deliberately delayed. The case is being watched internationally as a test of whether existing legal frameworks can regulate autonomous AI behaviour.

Pakistan launches air strikes in Afghanistan; Taliban says four civilians killed

The Taliban said four civilians were killed in Pakistani air strikes on Afghan territory. Pakistan said it struck 10 targets “strictly limited to identified military objectives” in retaliation for cross-border attacks by Afghan Taliban fighters, after claiming Afghan territory was used to launch drone attacks against Pakistan; the Taliban denies responsibility. Cross-border fighting had paused briefly but has now resumed — a slow-burn escalation throughout 2026 that may be entering a more active phase.

Pope Leo XIV opens Paris visit; 600,000 expected at Champs-Élysées Mass

Pope Leo XIV, the first American pope, began a four-day visit to France. The centrepiece is a Mass at Place de la Concorde with the altar flanked by the sealed Champs-Élysées; 600,000 faithful are expected. Macron held talks with the Pope at the Élysée on geopolitics and AI. The visit lands on a notable religious revival: adult baptisms have more than doubled in five years, even as fewer than 5% of the population attends church regularly.

Russia launches second consecutive mass drone wave; teenager killed in Kyiv high-rise

On the night of 24–25 September Russia launched 295 strike and decoy drones; Ukraine downed 267, with hits recorded at 16 locations. A drone struck a residential high-rise in Kyiv’s Pecherskyi district, killing a teenager and injuring seven; a separate morning strike on Odesa killed one person and damaged residential buildings. Russia is also systematically targeting Ukraine’s internet infrastructure, striking data centres and telecom providers in Kyiv. Ukraine’s energy minister says intelligence services have obtained Russia’s detailed winter strike plan, including targets and weapons packages. A new economic threshold: strikes have destroyed enough metallurgical capacity that Ukraine produced zero steel for a week in September — the first time in 100 years.

Operation Vivaldi: UGVs deployed 10 km behind Russian lines; Ukraine recaptures ground near Kupyansk

Ukraine’s 3rd Corps released footage of Gryphon heavy bomber drones deploying kamikaze unmanned ground vehicles more than 10 km behind Russian lines near Lyman — the first systematic use of this combination at scale. UGVs demined 30 km of routes toward Shandryholove in two nights, enabling continued advances. OSINT monitors confirmed Ukrainian forces recaptured territory west of Kupyansk, where autumn rains are now significantly hampering Russian drone operations. Russia’s MoD published a map claiming an encirclement of Dobropillya and separately claimed Ukrainian forces are encircled northeast of Kharkiv City; ISW finds no evidence for either, with the nearest Russian positions at least 10 km from Dobropillya’s outskirts. Ukraine is pushing forward in four frontline sectors overall.

CIA warns of Russian drone attacks on southern Europe — Macron denies receiving the warning

The CIA reportedly warned European allies of Russian plans for drone strikes on southern European targets, according to The Telegraph. Hours later, Macron publicly denied France had received any such warning — either a genuine intelligence gap, a political decision not to acknowledge it, or signal management ahead of French deployments to the Red Sea. The contradiction highlights fragmentation in NATO intelligence-sharing as Russian hybrid operations expand beyond Ukraine’s borders; the CIA also reportedly warned Poland of potential sabotage of underwater cables.

How Putin escalates — and what defence chiefs actually think about him attacking NATO

A Foreign Affairs analysis argues Putin is escalating simultaneously on two fronts: striking Ukraine’s power grid this winter to literally freeze the country, while ratcheting up internal repression — broader asset seizures of “foreign agents,” an unsustainable tax burden, increasingly hysterical regime rhetoric. The piece details how Putin derailed 2025 peace talks by misleading Trump, then continued escalating through 2026. The returns are diminishing, but escalation has become the central mechanism of maintaining power, not just a military tactic.

The Times, meanwhile, surveys senior Western defence figures on what they genuinely believe about whether Putin’s escalation logic could extend to direct NATO confrontation, and on what timeline — distinct from the public statements, and worth reading against the Danish warning on today’s front page.

Russia’s spy war with Britain is intensifying — and changing

Former Moscow correspondent James Rodgers reports that Russian espionage operations against the UK are growing more intense and structurally different, with a new category of agent emerging beyond the traditional intelligence-officer model. Citing Andrei Soldatov — the Russian intelligence expert recently jailed in absentia and declared a “foreign agent” — the piece traces the ideological roots of Russia’s obsession with Britain: a century-old fixation on the UK as exploiter of Russian state fragility.

McMaster: don’t be fooled again — and why a US-China AI deal is unlikely

H.R. McMaster published a pointed pre-summit warning: Xi’s visit comes as China continues funding Russia’s war in Ukraine, backing Iran, conducting offensive cyberattacks against the US and engaging in economic aggression. He frames decades of US-China engagement policy as a recurring failure of hope over evidence — from Kissinger’s 1970s “horizontal line” construct to 2020s summit optimism. Eleven years since Xi’s last White House visit, US leaders should “resolve not to be fooled again.”

CEPA’s analysts reach a similar conclusion on the one item nominally on the agenda: the prospects for a formal US-China agreement on AI safety are poor, blocked by competing definitions of what “AI safety” means, divergent regulatory philosophies, and the entanglement of AI capabilities with military and intelligence applications both sides consider non-negotiable.

File notification APIs leak keystrokes, browsing and message timing on Linux, Android, Windows, macOS

Research accepted at ACM CCS 2026 shows that file-notification systems (Linux inotify, Android FileObserver, Windows ReadDirectoryChangesW, macOS FSEvents) leak sensitive user behaviour to any process with read access to a parent directory — no elevated privileges required. Attackers can reconstruct inter-keystroke timing by watching /dev/input, infer the exact arrival and deletion of messages in encrypted apps, and identify websites visited through browser cache directory names. Linux and Android are most affected; Linux allows watching a readable parent to receive all events on unreadable children. Comprehensive fixes are not yet available across all platforms.

Sourcehut account takeover via wormable XSS in ansi2html build logs

A vulnerability in ansi2html (1.7.0–1.9.3) allowed crafted OSC 8 hyperlink escape sequences to inject unescaped JavaScript event handlers into rendered build logs on builds.sr.ht. Anyone — even unauthenticated patch submitters — could plant the payload; maintainers viewing their own build logs would execute it, leaking CSRF tokens and deployment keys. The bug was wormable: victims could automatically propagate it to others. Fixed in ansi2html 1.9.4 and mitigated on builds.sr.ht in August.

UK’s secret encryption order created a two-tier iCloud

A detailed explainer on what the UK’s 2025 Technical Capability Notice actually produced: Apple withdrew Advanced Data Protection (end-to-end encryption for iCloud backups, photos, notes and Drive) for new UK users in February 2025 rather than build a backdoor. Users who enabled ADP before the deadline still have it; everyone who joined or didn’t activate it afterward cannot — a permanent split in encryption protection between UK residents under identical law. Apple stated it would “never” build a backdoor or master key.

Conversations breaks up with Google Play as F-Droid 2.0 lands

Daniel Gultsch moved Conversations — the FOSS XMPP client for Android — to F-Droid as its primary distribution channel, ending a “toxic relationship” with Google Play marked by unexplained app removals, 14-day review delays on security updates, and €1,000+/year in fees with no support. The app is now built reproducibly and signed with Gultsch’s personal key. The move coincides with the F-Droid 2.0 release, a major milestone for the FOSS Android ecosystem.

rr creator Robert O’Callahan resigns from Google over AI pace

Robert O’Callahan — creator of the rr time-travel debugger and co-founder of Pernosco — has left Google, citing moral conflict with his role accelerating AI hardware development. He argues AI progress is moving unsustainably fast and that predicted problems (reward hacking, power concentration, cognitive surrender) have materialized. He plans to keep maintaining rr and Pernosco independently from New Zealand and explore AI applications that are “unambiguously pro-human.”

tine: a Buck2-based OS image build system with hash-keyed hermetic builds

tine builds complete bootable OS images (RPM packages, Rust crates, Go modules, UKIs) on Buck2’s hash-based action graph — every action keyed by a hash of inputs, never by timestamps, making incremental builds trustworthy and shareable via cache. It bootstraps from only git and Python3; all subsequent dependencies are declared and pinned. Supports Fedora, CentOS, Arch and Debian, with automatic SBOM generation via Syft. An interesting counterpart to Nix’s approach for teams building verifiable, reproducible OS images in a monorepo.

Widescreen-first layouts, persistent clipboard, desktop working memory: Scott Jenson’s proposals for the open-source desktop

Scott Jenson (UX lead at Apple, Google, Mastodon, Home Assistant) argued at KDE’s Akademy 2026 that the open-source desktop carries 40 years of hardware assumptions that no longer apply. His proposals: design for large widescreen monitors using Exposé-style tiling rather than overlapping windows; give the desktop “working memory” by retaining context about what users were doing across sessions; and build persistent clipboard/canvas systems, inspired by Obsidian Canvas, for collecting data across apps. His pitch: Linux should innovate rather than trail Apple and Microsoft.

“Katamari architecture”: how LLM-generated code produces unmaintainable codebases

An essay coining “katamari architecture” — the anti-pattern where features accumulate haphazardly without architectural coherence, like rolling a ball that picks up random objects. The diagnosis: +6,000-line PRs make meaningful review impossible; LLMs make unfamiliar errors humans wouldn’t recognize; and the low friction of generation accelerates accumulation. Unlike a Big Ball of Mud, which has understandable economic causes, katamari codebases lack even a coherent pressure explaining their shape. The proposed mitigation: require that contributions not look LLM-generated, forcing authors to actually understand what they commit.

LLMs traced alchemical knowledge networks across 17th-century encrypted letters

Historian Benjamin Breen documents using LLMs to decode 17th-century coded correspondence and map transmission chains in alchemical knowledge — tracing which texts influenced which authors across decades of fragmentary sources. Breen argues AI labs should fund this kind of historical work, which produces verifiable scholarly results rather than consumer products, and that it demonstrates a genuinely novel methodology for handling fragmentary historical evidence at scale.

Opus 5.5 builds a complete 3D chess roguelite autonomously — and the community has catalogued 776 more AI-built games

Given four reference images and a single prompt in Claude Code, Opus 5.5 produced Chainmate: a full chess roguelite with nine battles across three acts, 18 relics, upgradeable pieces and three boss encounters. No Blender, no external asset files — every 3D chess piece, arena and relic is generated by code the model wrote, and the audio is synthesized the same way. Tests and Windows/HTML5 builds included. The fully autonomous pipeline from concept to published game is the significant part.

For the population view, the Awesome Opus 5.5 Games list has grown to 776 game units from 512 qualifying GitHub repositories, covering games attributed to Opus 5.5, Fable and GPT-6 Astra, graded by evidence quality from direct attribution to inferred. Eighty low-quality or non-game entries are excluded. More useful as a capability sample than a ranking.

agent-shell 0.78: Emacs agent shell gains mid-turn steering and a persistent prompt queue

New release of agent-shell, the native Emacs mode for ACP (Agent Client Protocol) agents. Prompts now queue and re-appear immediately after submission so you can keep typing while the agent works; mid-turn steering lets you course-correct Claude in flight via M-RET without cancelling; files can be drag-dropped into shell buffers with image preview; per-session cost tracking sits in the header. 153 commits and 25 PRs since the last release.

Fable 5 quota appears on Claude Pro plans; Fable can’t spawn Opus 4.8 sub-agents in Claude Code

A new Fable 5 usage quota appeared on at least one Pro account, suggesting Anthropic is reintroducing access to the top-tier model within the Pro subscription. No official announcement yet — this was spotted as a UI change in account settings.

Separately, when Fable is set as the primary model in Claude Code it is explicitly prevented from spawning sub-agents using Opus 4.8. This looks like a deliberate restriction — possibly to keep capability levels consistent across agentic chains or to prevent cost arbitrage in multi-agent workflows — and suggests Anthropic is actively managing model-to-model delegation policies in the agentic layer.

Claude Code film pipeline: orchestration, self-correction, $16.87 total

A detailed breakdown of using Claude Code to direct and produce a short film: five AI-voiced characters comment on a fictional movie, their commentary constituting the film itself. The write-up covers the full orchestration pipeline — prompt to script to voice synthesis to assembly — and specifically calls out the checks Claude used to catch and correct its own mistakes mid-run. Total OpenRouter spend: $16.87 for a 3:12 video with outtakes. Worth reading for the pipeline architecture notes rather than the content.