Josse-posten

Oil runs through everything today: Kyiv promises more refinery fires while Washington and Moscow quietly haggle over Lukoil, Houthi missiles reach Aramco outside Riyadh, and Brazil, Bosnia and Serbia all pick leaders in the shadow of it.

Ukraine doubles down on refinery strikes as Moscow adopts ‘winter doctrine’; Merz in Kyiv, Moscow-range FP-9 ready this autumn

German Chancellor Friedrich Merz greeted by German Ambassador Boris Ruge at Kyiv’s main train station on Oct 4. Photo: Kay Nietfeld/picture alliance via Getty Images

Zelenskyy announced Ukraine will intensify attacks on Russian oil refineries in response to a new Moscow doctrine of airstrikes designed to force civilian evacuation of Kyiv and other major cities, with strikes timed to degrade Russia’s capacity to sustain the winter campaign. He said Ukraine will not target civilians. On the same day, he announced the domestically developed FP-9 ballistic missile (855 km range, Moscow within reach) will be combat-ready this autumn, following the shorter-range FP-7’s recent combat debut. Strikes on an Iskander battery in Bryansk and a drone launch site near Oryol were confirmed over Oct 2–3.

German Chancellor Friedrich Merz arrived in Kyiv on Oct 4, pledging thousands of interceptor drones and accelerated long-range weapons support — a significant contribution given Russia’s intensifying air campaign. (Also covered in Ukraine)

NYT: Ukraine peace talks now entangled with multibillion-dollar Lukoil deal tied to Trump allies

The New York Times reports that US-Russia negotiations on Ukraine have become intertwined with a multibillion-dollar deal involving Lukoil assets, connected to Trump allies Jared Kushner and Steve Witkoff — adding a commercial dimension to the diplomatic track and direct high-level economic engagement between Washington and Moscow despite the active war. Russia simultaneously announced plans to sharply increase war spending while cutting social programmes. Zelenskyy urged Washington not to forget it holds “100 times” more leverage than Russia; the EU dismissed Russia’s threats against Kyiv diplomats as a sign Moscow is “losing its nerve.”

Brazil votes: race tightens as Lula government accuses US of election interference

Brazil held its presidential first round today, with polls showing Lula da Silva’s lead over Bolsonaro narrowing to the point where neither was expected to win outright. Brazil’s Federal Police and intelligence service ABIN separately warned of what they characterised as a possible US-backed coup attempt, while the Lula government formally accused the United States of election interference — escalating an already tense diplomatic dispute with Washington.

Houthis strike Aramco facility near Riyadh as Yemen fighting surges

Houthi forces claimed successful missile and drone strikes on an Aramco facility south of Riyadh on October 3, with witnesses reporting fire and smoke at the site. Saudi coalition forces simultaneously claim 700 Houthis killed in 24 hours as the pro-government offensive advances. Trump issued fresh warnings to Iran, saying a decision on Tehran is coming. Somalia’s president publicly accused the Houthis of destabilising the region and blocking navigation through Bab el-Mandeb.

Indicator Value Change
S&P 500 7,723 +0.73%
Dow 30 51,177 +0.49%
Nasdaq 27,191 +1.19%
Russell 2000 2,833 +0.94%
VIX 15.3 -6.59%
Gold 4,162 -0.95%
BTC $84,986 +0.53%
EUR/USD 1.1259 +0.02%
USD/NOK 9.62 0.00%
  • Friday’s close: equities up across the board and the VIX down sharply, even as the Hormuz and Riyadh headlines pile up.

World

Israeli politics shift rightward: opposition attacks Netanyahu as too pro-Palestinian; Ben Gvir claims entire West Bank

In a striking sign of Israel’s political drift, opposition factions are now openly attacking Prime Minister Netanyahu for being too conciliatory toward Palestinians — a posture inconceivable a few years ago. Simultaneously, National Security Minister Itamar Ben Gvir declared the entire West Bank sovereign Israeli territory that should be annexed, escalating pressure from the government’s far-right flank ahead of elections.

Balkan ballots: Bosnia votes under Dayton strain as Vucic seeks return as Serbia’s prime minister

Bosnians voted today in a general election under the country’s complex post-Dayton ethnic power-sharing structure. The vote carries implications for EU accession talks and regional stability, with nationalist parties continuing to challenge the constitutional framework that underpins Bosnia’s fragile peace.

Next door, former Serbian president Aleksandar Vucic, who has dominated Serbian politics for over a decade, launched a campaign to become prime minister through the upcoming parliamentary vote. The move seeks to extend his grip on power through an institutional shift rather than a direct presidential run, raising concerns from the EU and democratic observers about further democratic backsliding.

Baltic security: unidentified object near Helsinki closes sea lanes; drone enters Lithuanian airspace from Belarus

Finnish authorities closed maritime traffic near Helsinki and deployed the navy after an unidentified metal object was discovered in the sea. Separately, Lithuania reported an unidentified object entering its airspace from Belarus, with a search launched. Both incidents come against the backdrop of repeated suspected sabotage of Baltic undersea infrastructure and heightened regional security concerns — and on the same day as Russia’s largest single airspace breach of Moldova yet (see Ukraine).

Ethiopian government troops seize Tigray capital Mekelle

Ethiopian government forces announced the capture of Mekelle, capital of the Tigray region, after a week of intense battles with Tigray fighters. The fall of Mekelle risks reigniting one of Africa’s deadliest recent conflicts, which previously caused an estimated 300,000–500,000 deaths and a catastrophic humanitarian crisis before a fragile ceasefire. It comes days after Ethiopia and Eritrea severed diplomatic ties.

Libya: US-backed unity talks collapse after Haftar’s son linked to drone terror campaign

Plans for a US-backed merger between Libya’s rival Tripoli-based government and the eastern forces of Khalifa Haftar have broken down after Western Libya’s Government of National Unity declared it ‘impossible’ to work with Haftar’s son Saddam. He allegedly oversaw a ‘terror cell’ conducting drone attacks on fuel storage facilities and power stations in western Libya, destroying any remaining basis for negotiations.

Tens of thousands march across Spain over housing crisis

Following parliament’s defeat of the Sánchez government’s emergency housing legislation, tens of thousands took to the streets in Madrid and more than 50 other Spanish cities under the banner ‘this can’t go on.’ The protests are the largest yet in an escalating housing affordability crisis, and snap election speculation is intensifying as Sánchez’s minority government fails to pass core agenda items.

Tennessee prison chief resigns after Christa Pike survives two lethal injections

Tennessee corrections commissioner Frank Strada resigned after the state’s botched execution of death row inmate Christa Pike, who survived two rounds of lethal injection and remains in critical condition. Governor Bill Lee has ordered an independent investigation. Pike’s lawyers said the failure ‘goes far beyond any one person,’ pointing to systemic problems in the state’s execution protocol.

Also today

Security
Russia rehearses invasion and occupation of an unnamed Central Asian country, according to Ukrainian intelligence — Ukrainska Pravda · Reddit
Carney confirms the Canadian military is running contingency scenarios for a US invasion — BBC
Two Iranians appear in UK court over Manchester Jewish community terror plot, remanded in custody — DW · CBS News · Reddit
Australia opens security investigation into the Flydubai co-pilot’s time in the country; he was reportedly barred from flying by Oman over extremist views — The Guardian · BBC
Europe
Greece returns Tsar Samuel’s 1,000-year-old remains to Bulgaria, and Mitsotakis uses the occasion to press the UK over the Parthenon marbles — The Guardian · Al Jazeera
Warsaw activists launch the ‘AbortOmat’, a parcel locker dispensing abortion pills anonymously to bypass Poland’s near-total ban — The Guardian
Americas & Asia
Six missing after a Bermuda-to-Boston air ambulance plunged 9,000 feet in under two minutes; debris found off Nantucket — The Guardian · Al Jazeera · NPR · BBC
US Supreme Court term opens Monday with landmark cases on religion, guns and climate liability — NPR
US Marine arrested on suspicion of murder in Okinawa, reviving long-running tensions over the base presence — CNN · Reddit

Ukraine

Operation Vivaldi: 140 sq km reclaimed; Russian monthly losses climb to 42,000

Footage from Operation Vivaldi counteroffensive operations in northern Donetsk Oblast. Photo: Ukrainska Pravda

Zelenskyy put Operation Vivaldi’s total liberated territory at up to 140 sq km in northern Donetsk Oblast, with Russian monthly casualties now running at roughly 42,000 — up from 30–32k earlier in 2026. The Forpost Border Guard Brigade separately reported retaking over 10 sq km on the South Slobozhanshchyna axis since June. Elsewhere the frontline is attritional: ISW confirmed no Russian advances at Dobropilla, Kostyantynivka, or Kupyansk; Russia’s MoD claim of seizing Nova Kozacha (Kharkiv Oblast) remains unconfirmed. UN figures add grim context: over 15,000 Ukrainian civilians were killed or injured in the first eight months of 2026, up 55% year-on-year.

Russia deploys mesh repeaters for precise bridge strikes; MFA tells diplomats to leave Kyiv

Technicians repair a trolleybus power line damaged by a drone strike on the Northern Bridge in Kyiv, Oct 3. Photo: Sergei Supinsky/AFP via Getty Images

The Northern Bridge was struck again on Oct 3 — the sixth hit on Kyiv’s two Dnipro crossings since Oct 1. A significant new technical detail: Russia is deploying portable mesh network repeaters near Kyiv that translate internet commands into local RF signals, giving drone operators live control of Shaheds in flight without relay aircraft. The same technique was used in the Sept 4 assassination attempt against SBU chief Poklad. Russia’s Foreign Ministry then issued an explicit public warning for all foreign citizens and diplomats to leave Kyiv, stating strikes will continue — a deliberate signaling step. Pontoon crossings are being planned (3-month build) to relieve the 600,000 daily vehicle crossings now severed. Overnight Oct 3–4, Russia launched another 135 drones; Ukraine’s air defences downed 123.

Five Russian drones and Banderol munitions crash in Moldova — largest single airspace breach yet

Five Russian aerial vehicles — three Banderol loitering munitions and two drones — violated Moldovan airspace and crashed across four districts on Oct 3, the largest single-incident violation since 2022. Chișinău summoned Russian Ambassador Ozerov for the second time in days. The pace is accelerating sharply: seven violations since August 2026 alone, against roughly 13 in the prior four years. ISW assesses Russia is deliberately normalizing these incursions to desensitize NATO and neutral neighbours, incrementally raising the threshold for what constitutes a provocative act.

Also today

  • Lukashenko publicly calls himself and Putin ‘co-aggressors’ in Ukraine, a rare explicit acknowledgment of Belarus’s direct role — Kyiv Post · Reddit
  • Russian billionaires’ ‘voluntary’ war levy covers just 1% of the state budget; the war machine runs on ordinary taxation and oil revenues, not elite sacrifice — Kyiv Post · Reddit

Tech

C2PA’s file exclusion feature enables post-hoc timestamp forgery

Proof of concept: a lottery ticket whose numbers were altered after the draw, with valid C2PA metadata asserting an earlier capture time. Photo: David Buchanan

C2PA allows signers to exclude byte ranges from signature coverage, designed for legitimate technical reasons like correcting PNG CRC checksums. David Buchanan found you can exclude an entire file, creating a cryptographically valid signature over an empty string. An attacker obtains a legitimate timestamp from a TSA, then modifies the file afterwards — the C2PA metadata will falsely assert the content existed at the earlier time, and current verification tools won’t flag it because there’s no check on how much of the file is excluded. Buchanan’s PoC: lottery numbers altered after the draw, with valid C2PA provenance claiming they were captured before it.

OpenAI safety: ‘move fast and break things’ at the frontier

An Atlantic piece from a departing OpenAI safety team member describes structural problems rather than speculative existential risk: leadership prioritizes speed over deliberate safety planning, safety team concerns lack escalation paths with real teeth, the organization has no layered redundancy expected for critical infrastructure, and users are effectively treated as beta testers without informed consent. The Guardian also covered the resignation. HN discussion surfaced a broader debate about whether the departing team focused on near-term deployment harms or long-horizon doomer scenarios — the substance of the critique appears to be the former.

Simon Willison: AI agents make default hard budget caps urgent

Willison argues that warning emails are insufficient — cloud services need hard spending limits that pause workloads at a threshold, on by default, with explicit opt-out. The risk profile has changed: AI coding agents make it trivially easy to launch services that generate five-figure bills overnight. Recent progress: AWS now “pauses projects” at spending limits; Google Cloud launched Spend Caps in July 2026. His proposed ideal: agents themselves should recommend capped providers and refuse to configure uncapped services without prominent warnings.

Rust phased into CPython: zlib first, build required by 2029

The Python Language Summit 2026 heard a concrete multi-year proposal to integrate Rust into CPython. The motivation is quantitative: type-crash bugs jumped from 82 reports in 2021 to a projected 353 in 2026. Phase 1 (Python 3.16, Oct 2027): optional Rust zlib backend using zlib-rs, which already ships in Firefox and Cargo and outperforms both zlib and zlib-ng. Phase 2 (3.17, 2028): expand to io, json, xml, memoryview, and the new parser. Phase 3 (3.18+, 2029): Rust build required. The vendoring approach keeps external dependencies out of the CPython tree. Core concern raised: not developer fluency in Rust but platform coverage and dependency management.

Memory-safe WebP decoding with Halide

New library wpd rewrites WebP decoding using Halide, a DSL for image processing pipelines that generates high-performance, bounds-safe code from declarative schedules. The project is a direct response to CVE-2023-4863 and the ongoing history of buffer overreads in WebP — Halide’s formal pipeline model structurally eliminates the class of manual bounds errors that have plagued the C implementation.

Kolibri: European sovereign open-weight MoE model, 78B total / 3B active

Kolibri, Aleph Alpha’s Apache 2.0 open-weight model trained entirely in Germany. Image: Aleph Alpha

Aleph Alpha releases Kolibri under Apache 2.0, trained entirely in Germany. Architecture highlights: 384 small experts (rather than a handful of large ones); a hybrid attention design where only 10 of 50 layers process the full context while the other 40 use tight 512-token windows, enabling efficient 1M-token handling regardless of context length; and a custom bilingual tokenizer (UniBPE) that compresses German significantly better than competitors. Benchmarks: matches models up to 4× its active parameter count on math, coding, and long-context tasks. The sovereignty pitch is supply-chain transparency and on-premises deployment compliant with EU AI Act and GDPR — every training decision documented.

FTL: A library-OS that inverts the kernel/userspace relationship

FTL is a new OS for cloud containers that flips the traditional architecture: instead of a monolithic kernel managing processes, filesystems, and networking, each container runs a userspace OS implemented as a shared library, while FTL’s thin kernel provides only a minimal hardware-isolation interface. The result is microkernel-level security with monolithic performance, VM-grade container isolation without bare metal, and OS updates as library version bumps rather than kernel upgrades. Runs existing Linux binaries. Early-stage but technically interesting.

FTL OS · GitHub · HN

Also today

AI & agents
Agents don’t need memory, they need documentation: plain Markdown docs read before work and updated after, instead of RAG snippets with no accuracy or staleness check — liao.gg · HN
Why developers don’t ‘use the platform’: the IKEA effect and learning by struggle, per Nolan Lawson — Nolan Lawson · HN
Languages
The programming language exploration era is beginning, not ending: WASM, AI-augmented development and diverse hardware reopen design space — kirancodes.me · Lobsters
Rust’s derive macros silently emit #[inline]; uv shaved ~160KB off its binary with a single #[inline(never)] on a derived Debug impl — yossarian.net · Lobsters
SELF’s 1989 ‘Customization’ paper: inferring static types from dynamic code, the ancestor of every modern JavaScript JIT’s inline caches — ACM · Lobsters
Two-stack sliding window aggregation: O(1) amortized for non-invertible operations, and immune to NaN poisoning — orlp.net · Lobsters
Linux
Valve’s Timur Kristóf at XDC 2026: improving old AMD GPUs on Linux, for the long tail of GCN and RDNA1 cards — Phoronix · HN
Kagi ends Orion for Linux and Windows and will open-source both ports within 30 days, seeking a community maintainer — Kagi · Lobsters
cd ~/repos/josse-posten && claude --resume e8f09448-050d-40f1-8576-32e03468cb1e