Josse-posten

Ukraine sets Moscow’s biggest fuel depot ablaze with its largest raid in two years, Turkey and Pakistan send troops to Saudi Arabia as the Yemen offensive takes Mocha, Quebec hands power to separatists promising a referendum — and at home the budget leaks have Norgespris going up.

650 drones over Moscow: airport fuel depot ablaze in Ukraine’s largest raid on the capital in two years

Column of smoke rising over Moscow Oblast during the Ukrainian drone raid, October 5–6. Photo: Ukrainska Pravda

Ukraine launched roughly 650 drones toward Moscow and Moscow Oblast overnight in what is described as the largest drone attack on the region in two years. The Volodarskaya LPDS — Russia’s largest oil depot, 40 km from the city centre and primary fuel supplier to Vnukovo, Domodedovo and Sheremetyevo airports — was struck and set ablaze. Two people were reported killed and seven injured; Mayor Sobyanin said 105 drones were destroyed on approach.

The raid follows satellite confirmation that the 4 October strike on Khanskaya airbase, 500 km inside Russia, destroyed at least one Su-35 and one Su-34. Russia’s oil and gas budget revenues fell 22.3% year-on-year in September, a measurable sign of the cumulative pressure. (Frontline and Russian strikes in Ukraine)

Mecca Alliance activates mutual defence as Saudi-led forces retake Mocha

Fighting around Bab al-Mandab as the Saudi-backed Yemeni offensive advances. Photo: AP via Al Jazeera

At emergency talks in Riyadh, the Mecca Alliance — Saudi Arabia, Turkey and Pakistan — invoked its collective deterrence provisions for the first time, with Turkey and Pakistan agreeing to rapidly deploy forces to Saudi Arabia. On the ground, a 100-jet Saudi air campaign has recaptured the port city of Mocha and claims air control over the Bab al-Mandab strait, the chokepoint between the Red Sea and the Gulf of Aden. Yemeni government forces expelled Houthis from several areas around the strait, and Yemen’s military declared the waterway “secured” — though ground control of Mocha remains contested in some reports.

Ankara is engaged on more than one front: Turkey has also supplied Ukraine with Korkut short-range air defence systems, according to Middle East Eye.

Quebec separatists win provincial election, referendum by 2028 promised

The Parti Québécois won Quebec’s provincial election, returning separatists to power for the first time in over a decade. PQ leader Paul St-Pierre Plamondon has pledged to hold an independence referendum by 2028, a fresh test for Canadian national unity that will play out against Trump’s ongoing trade pressure on Ottawa.

Statsbudsjettet 2027: Norgespris opp til 45 øre, 400 millioner til russisk overvåking, historisk IKT-løft i politiet

Statsminister Jonas Gahr Støre (Ap) før fremleggelsen av statsbudsjettet 2027. Foto: Ole Berg-Rusten / NTB

Statsminister Støre legger frem budsjettet onsdag, og lekkasjene tegner konturene: Norgespris øker fra 40 til 45 øre/kWh (16,4 mrd. totalt i strømstøtte); 400 mill. til etterretningstjenestene for overvåking av russisk aktivitet; 5,7 mrd. til et historisk IKT-løft i politiet, inkludert droner og KI; 135 mill. til mobildekning i togtunneler; 246,7 mill. til grønne hurtigbåter; 650 mill. til Andøya Spaceport; og over 85 mrd. til Ukraina-støtte. LO advarer mot at økt Norgespris er en «uheldig sterk økning».

Samtidig snur Rødt om drivstoffavgiftene: partiet vil stemme for forslaget fra Frp, Sp og KrF om å fjerne avgiftene på bensin og diesel ut 2026, som dermed kan få flertall i Stortinget mot regjeringens og Høyres vilje. (Mer i Norway)

Trump hits record-low approval as Iran war reshapes midterm calculus

Trump’s approval rating has fallen to a record low four weeks before the November 3 midterms, with Hispanic voters now twice as likely to favour Democrats. The Iran war — unpopular but not uniformly so — is the dominant factor reshaping the electoral landscape, with analysts uncertain whether its costs will outweigh any rally effects. The same day, Trump approved the execution of Fort Hood shooter Nidal Malik Hasan by Army firing squad, the first US military execution since World War Two, and his administration was reported to be pursuing 40 denaturalisation cases, the largest volume in US history.

Indicator Value Change
S&P 500 (f) 7,841.5 +0.19%
Dow 30 (f) 51,800 +0.47%
Nasdaq (f) 31,371 +0.17%
Russell 2000 (f) 2,873.9 +0.21%
VIX 15.48 -0.26%
Gold 4,166 +0.22%
BTC $85,613 -0.67%
EUR/USD 1.1238 +0.19%
USD/NOK 9.59 -0.06%
  • VIX at 15.5, little changed, and US futures slightly up despite the Yemen escalation, the Mecca Alliance activation and the G7 emergency diesel release (see World).

World

G7 releases 100 million barrels of emergency diesel; ASEAN convenes energy summit

The G7 agreed to release up to 100 million barrels of emergency diesel reserves as the Iran war drives a global energy crunch, threatening supply in Asia and Europe. ASEAN energy ministers are meeting simultaneously to coordinate regional energy security responses. (South Korean fuel reaching Russia via sanctioned tankers: see Investigations)

France: 15-year-old loses hand to police stun grenade; national day of protests planned

A 15-year-old student lost a hand after being struck by a police stun grenade during school protests in France, igniting fierce debate about police conduct. Nearly 200 students have been injured in clashes with riot police. France is now bracing for a national day of protests and school blockades, with youth anger intensifying over both education funding and the crackdown.

UK threatens tit-for-tat expulsions as Israel closes East Jerusalem consulate

Britain has threatened to expel one Israeli diplomat for every British diplomat Israel forces to leave, after Israel announced the closure of the UK consulate in East Jerusalem. The standoff follows UK sanctions on goods from illegal Israeli settlements, and expulsions are expected imminently.

Ethiopia: Tigray rebels forcibly recruiting boys as young as 15; Abiy renews Red Sea demands

Credible reports are emerging that a new armed alliance in Ethiopia’s Tigray region is forcibly rounding up boys as young as 15 for conscription as renewed fighting spreads. On the diplomatic front, PM Abiy Ahmed renewed his demand for Ethiopian access to the Red Sea, with Eritrea, Djibouti and Somalia pushing back sharply, insisting coastal states must govern their own waters.

UN Human Rights Council demands Sudan ceasefire, extends investigators’ mandate

The UN Human Rights Council passed a resolution condemning attacks on civilians in Sudan’s ongoing conflict and calling for an immediate ceasefire, while extending the mandate of the independent mission investigating abuses by all parties.

Also today

Middle East & Asia
Saudi Arabia urged to spare Sri Lankan Anojan Sivarasa, sentenced to death for blasphemy over a Facebook comment — BBC · r/worldnews
China shuts hundreds of smaller banks, consolidating them into larger state-controlled institutions to reduce systemic risk — CNBC via r/worldnews
Americas
New York state declares a public health disaster over a measles resurgence driven by declining vaccination rates — Al Jazeera
Brazil: Flávio Bolsonaro and Lula head to a runoff in three weeks after Bolsonaro beat the polls in round one — Dagsavisen

Ukraine

AI gun turrets enter combat; jet-Shahed intercept rate surges

Sky Sentinel AI-equipped air defence turret, now deployed against Russian jet-powered Shahed drones. Photo: Kyiv Independent

New AI-equipped automatic gun turrets have downed their first jet-powered Shaheds in combat, and the effect is already visible in the numbers: monitoring channels report only around 4 of more than 30 jet Shaheds targeting central Ukraine reached their targets overnight. The Night Hornets unit — manufacturer of the STING anti-Shahed interceptor — has been formally integrated into the Armed Forces. Ukraine also confirmed Rafale pilot training will begin shortly, and Turkey has supplied Korkut short-range air defence systems (see leader).

Kharkiv hit hard; Russian drone sinks Turkish grain ship; Oleshky facing starvation

Damaged building in Kharkiv’s Slobidskyi district after Russian strikes killed 6 and injured 59, October 5. Photo: Ukrainska Pravda

A major Russian strike on Kharkiv’s Slobidskyi district killed 6 and injured 59, damaging residential buildings and industrial facilities. In the Black Sea, Russian drones struck and sank a Turkish-flagged cargo ship carrying corn, killing the captain and injuring 11 crew — Zelensky condemned it as a “horrific” and deliberate attack on civilian grain transport. A Russian strike on a bridge over the Dnipro in Zaporizhzhia injured five, while Russia claims Ukraine struck two facilities at the Zaporizhzhia nuclear plant.

Two slower-moving crises: sustained Russian strikes have nearly depleted Ukraine’s locomotive reserves, threatening logistics nationwide, and the New York Times reports that Oleshky, an occupied city near Kherson trapped between front lines, is beginning to face starvation after all supply routes were severed.

Hungary conditionally lifts EU accession veto; Germany warns of violent conflict with Russia

Hungary has dropped its veto blocking Ukraine’s EU accession process, per FT reporting, with full political support conditional on Kyiv passing minority educational rights legislation by October 12. EU foreign policy chief Kallas warned that Russia’s hybrid war — sabotage, airspace violations, disinformation — is actively spreading across Europe, and member states are discussing tighter restrictions and additional security checks on Russian diplomatic personnel.

Germany’s foreign intelligence chief went further, warning that Germany faces real risk of being drawn into violent conflict as Moscow escalates an “increasingly aggressive” shadow war. Estonia announced it will move troops directly to the Russian border under a new “Active Defense” strategy — a shift from deterrence-through-depth to forward presence. Meanwhile Trump’s latest peace initiative is described as “unraveling again”, and India is stepping up its role as mediator. (Russia’s warning to foreigners in Kyiv, and Eide’s reaction: see Norway)

Frontline tempo rises; Pokrovsk and Kostiantynivka bear the brunt

Combat intensity ticked up to 184 clashes over 24 hours (from 177), with the heaviest Russian pressure on Pokrovsk (23 attacks) and Kostiantynivka (18). Russia sustained 1,540 reported personnel losses in a single day. The Lyman and Borova axes remain active.

Also today

  • Mexican and Colombian cartel fighters filmed serving in Ukraine’s International Legion, reportedly using the war as a training ground for drone warfare — Al Jazeera

Investigations

South Korea shipping fuel to Russia via sanctioned tankers, Guardian investigation finds

A Guardian analysis found more than 150,000 tonnes of fuel was shipped from South Korea to Russian ports in July and August 2026, some via sanctioned tankers, as Moscow scrambles for energy supplies. The findings raise serious sanctions-compliance questions for Seoul at a time when Trump is already threatening South Korea with tariffs — and a day after Seoul and Kyiv fell into an open row over secretly transferred POWs.

FlyDubai co-pilot planned to crash plane into Ben Gurion Airport

Investigators have determined that the co-pilot who attempted to hijack a FlyDubai flight from Dubai to Tel Aviv last week intended to crash the aircraft into Ben Gurion International Airport. He originally planned the attack for July but postponed it, indicating a premeditated, months-long plot — this after yesterday’s revelation that he had been flagged for extremist materials in 2024 and hired anyway.

Cities demand millions in FOIA fees to bury Flock surveillance records; federal judge calls it unconstitutional

A Fort Worth suburb demanded $2.3 million for public records on its Flock license-plate camera usage — 14 years of labor at $15/hr — in what anti-surveillance advocates call deliberate FOIA obstruction. Separately, a federal judge in Oklahoma ruled a Flock database search was “indiscriminate mass surveillance” requiring a warrant, one of the first rulings to question the cameras’ constitutionality.

Documented abuse includes a former Texas officer who pled guilty to 100 felony counts after stalking people with Flock; there are over 100,000 warrantless Flock searches monthly. Texas Governor Abbott halted Flock funding after the stalker-cop case. Of hundreds of Texas agencies using the cameras, only 16 share any data with the public.

Amnesty documents Morocco’s use of state surveillance to silence journalists

Amnesty International has published a whistleblower account detailing how Morocco allegedly deploys state surveillance infrastructure to monitor and intimidate journalists. Moroccan journalists have corroborated the claims, recounting years of targeted harassment and electronic surveillance.

Norway

Far og sønn skutt og drept under jaktsamling i Halden

Stor politistyrke ved gårdsbruk ved Ørsjøen i Halden der to menn ble skutt og drept søndag morgen. Foto: Aftenposten

Per-Ove Engebretsen og sønnen Bjørn Rune Engebretsen ble drept søndag morgen da en mann i slutten av 20-årene åpnet ild mot jaktlaget sitt ved Ørsjøen. En tredje mann ble alvorlig skadd. Siktede var tidligere medlem av jaktlaget og erkjenner straffskyld, men nekter å forklare seg. Politiets hovedhypotese er en forutgående konflikt. Han varetektsfengsles i fire uker.

Vestlandet rammet av kraftig regnvær – våteste døgn i Bergen siden 2019

Bergen opplevde mandag sitt våteste døgn siden 2019. Tre farevarsel var aktive i Vestland, med oversvømmelser og stengte veier flere steder. Ferjer ble innstilt og bruer stengt mellom Ålesund og Sandnessjøen på grunn av kraftige vindkast. Brann-treneren reagerte etter at Toppserie-kampen ble spilt til tross for regnkaoset.

Tre skip kolliderte ved Ålesund – tre kapteiner mistenkt

Skadede skip ved kai etter trippelkollisjonen i Valderhaugfjorden. Foto: Aftenposten

En tankbåt og to lasteskip kolliderte i Valderhaugfjorden utenfor Ålesund natt til søndag. Et mayday ble sendt klokken 01:37 og et av skipene tok inn vann, men ingen ble skadd. Tre kapteiner er mistenkt for uaktsom navigering. Statens havarikommisjon vurderer om de vil undersøke kollisjonen.

Regjeringen vil midlertidig forby KI-briller på offentlige steder

Digitaliseringsminister Torgeir Micaelsen vil innføre et midlertidig forbud mot KI-briller – som Metas Ray-Ban-baserte modeller – på skoler, sykehus, kjøpesentre og i parker, med henvisning til faren for skjult filming. Parallelt settes det ned en ekspertgruppe for varig nasjonal regulering. Forbrukerrådet ber optikerkjedene stanse salget nå, mens DN er skeptisk til at forbudet hviler på tilstrekkelig grunnlag. The Guardian plasserer forslaget i en bredere europeisk bekymring; lignende restriksjoner gjelder allerede i Storbritannia og USA.

Norsk KI-strategi skal skrives på nytt – SV vil ut av Palantir-kontrakter

Digitaliseringsminister Micaelsen varsler at Norges KI-strategi fra 2020 skal erstattes av et nytt «spisset, strategisk styringsdokument», klart før sommeren 2027. SV fremmer samtidig forslag om å fase ut statlige kontrakter med det omstridte amerikanske analysefirmaet Palantir.

Norske datasentre: eid fra skatteparadiser, gir få arbeidsplasser

En ny analyse viser at Norges største datasentre kontrolleres fra skatteparadiser, og at milliardgjeld til egne konsern reiser spørsmål om skatteflukt. Selv om datasenterindustrien er landets raskest voksende teknologisektor, sysselsatte selskapene bare 425 årsverk i 2025. Teknologirådet slår fast at etableringene gir svært få spesialiserte IT-jobber. Bare i Vestland er 20 datasentre planlagt.

DNB kutter 400 stillinger og peker på KI

Norges største bank eliminerer rundt 400 årsverk i teknologi- og serviceområder innen utgangen av fjerde kvartal 2026. Konsernsjef Kjerstin Braathen sier KI-agenter allerede leverer «betydelige gevinster» på kundeverifisering, KYC-oppgaver og koding, og at banken nå tilpasser organisasjonen til «en ny virkelighet». Nedbemanningen gjennomføres i dialog med tillitsvalgte.

E24 · DN

Russland advarer utlendinger fra Kyiv – Eide: «skjult trussel»

Russland advarte i helgen utenlandske statsborgere, inkludert diplomater, mot å oppholde seg i Kyiv – et varsel som kom rett før Tysklands kansler Friedrich Merz besøkte Ukraina. Utenriksminister Espen Barth Eide (Ap) karakteriserer utspillet som «en skjult trussel mot diplomatiske stasjoner, ansatte og sivile», og understreker at ansvaret for eventuelle angrep utelukkende ligger hos de som utfører dem. Samme dag hasteinnkalte Sveriges statsminister Ulf Kristersson utenriks-, forsvars- og justisministeren til en uannonsert pressekonferanse om sikkerhetssituasjonen, uten å si hva som lå bak. (Se også Ukraine)

Nobelprisen i medisin til pionerene bak optogenetikk

Årets Nobelpris i fysiologi eller medisin går til amerikaneren Karl Deisseroth og tyskerne Peter Hegemann og Georg Nagel for utviklingen av optogenetikk – en teknikk som bruker lys til å slå enkeltnerveceller av og på med stor presisjon. Forskningen har betydning for forståelsen av nevrologisk sykdom og kan på sikt påvirke behandling av alt fra epilepsi til psykiatriske lidelser. Prisen er på tolv millioner svenske kroner og er den første av årets Nobelpriser.

NRK · NPR

Togstreiken trappes kraftig opp – 725 avganger innstilt

Etter 18 dager ble lokførerstreiken mandag eskalert til å omfatte 72 arbeidere, med over 725 innstilte avganger på Østlandet frem til torsdag. Vy tilbyr ikke alternativ transport. Det er streikens hardeste runde hittil.

Boligprisene falt 0,7 prosent i september

Sesongjustert steg prisene svakt (0,3 %), men nominelt falt de 0,7 % i september. Oslo hadde det svakeste resultatet med en nedgang på 1 %. DNB Eiendom melder om rekordmange usolgte boliger og salgstider de ikke har sett siden finanskrisen. Eiendom Norge venter en «god del svakere» utvikling resten av 2026.

NRK · DN · E24

Også i dag

Politikk
SV-leder Kirsti Bergstø tar gjenvalg; nestleder Marian Hussein gir seg og oppgir hets som medvirkende årsak — Aftenposten · NRK · Dagsavisen
Nordic Mining truer Natur og Ungdom med millionsøksmål; nye aksjonister blokkerte Førdefjorden-anlegget timer etter at politiet bar bort de forrige — NRK · TU
Spania går til nyvalg 29. november etter at boligreformen falt — NRK · DN: kommentar
Helse
RSV-vaksine inn i barnevaksinasjonsprogrammet – alle nyfødte skal beskyttes mot RS-virus — Aftenposten
Sykepleier saksøker staten og mener han fikk ME av covid-vaksinen; over 2500 har søkt pasientskadeerstatning, og saken kan få presedens — NRK · Dagsavisen: ME-pasienter
Russisk pestforsker død – nærmere 200 i isolasjon og frykt for laboratorielekkasje — Aftenposten · NRK Urix
Rett og sikkerhet
Danmark: 8,8 millioner personnumre lekket etter at uvedkommende misbrukte en bedrifts tilgang til CPR-registeret — Digi.no
Märtha Louise og Durek Verrett saksøker fire privatpersoner i Los Angeles for over 80 millioner dollar, fem dager etter kong Haralds begravelse — Aftenposten
Marius Borg Høiby varetektsfengsles i fire nye uker — Aftenposten
Steinar Wangen nekter straffskyld for drap da ankesaken startet i Agder lagmannsrett — Aftenposten
Cornell-skandalen: store protester etter at en henlagt gjengvoldtektssak ble gjenåpnet; New Yorks guvernør griper inn — Aftenposten: protest · Aftenposten: straff
Teknologi
OpenAIs sikkerhetssjef David Robinson slutter og kaller kulturen «ødelagt»; tre ingeniører nylig sparket for å ha delt intern informasjon — Digi.no: Robinson · Digi.no: ingeniører
OpenAI lanserer «Dots», autonome KI-agenter som jobber døgnet rundt for Pro-brukere – EØS og Norge foreløpig ikke inkludert — Digi.no
Sport
Norge – Portugal 1-2: tolvte strake kamp med baklengsmål, men Solbakken er «veldig fornøyd» — NRK · Dagsavisen
Oliver Solberg kjørte ut i siste sving av siste etappe med VM-tittelen innen rekkevidde – «det skal ikke være mulig» — NRK
Skøytelegenden Amund Sjøbrend er død, 4. oktober, etter kort tids sykeleie — Dagsavisen

Tech

Anthropic reported a user’s diary-style messages to police; she now faces a felony

Florida resident Carli Michelle Heller, who says she used Claude “like a diary,” wrote that she would attack the Lee County Sheriff’s office. Claude’s safety systems flagged the message, and after human review Anthropic judged it credible and reported it to law enforcement. She now faces a second-degree felony under Florida’s electronic-threat statute.

The case makes explicit what Anthropic’s privacy policy already stated — human contractors can read submissions and the company will disclose to authorities in perceived emergencies — but most users treat AI chat as a private journal. A concrete reminder that AI platforms are not private spaces. In a related register, former Anthropic researcher Jacob Coxon has gone public with the warning that AI companies, Anthropic included, do not fully control the behaviour of their models.

ChatGPT is generating fake New Yorker cartoons and attaching real cartoonists’ signatures

Nieman Lab reports that ChatGPT produces fake New Yorker-style cartoons complete with forged signatures of real, named cartoonists — without disclosure. The cartoonists have no recourse through the magazine’s usual cease-and-desist channels since OpenAI isn’t a publisher. Not just style imitation, but direct attribution forgery at scale.

Beam: Reflection releases a 501B open-weight MoE model with 77% SWE-Bench Pro v2

Inference efficiency comparison — Beam vs. comparable frontier models. Image: Reflection.ai

Reflection.ai released Beam, a sparse MoE model with 501B total parameters (23B active), trained on 23.8 trillion tokens with over 100 million RL rollouts across 10.5K GPUs. Benchmarks: 77.2% on SWE-Bench Pro v2-Hard, 97.8% AIME 2026, 90.5% GPQA Diamond. The architecture is designed for 3–4× better inference compute efficiency than comparable models, putting its cost-to-capability ratio in range of frontier proprietary models. It targets coding, reasoning, and agentic workloads.

Dust: first zeroth-order method competitive with backprop for transformer pretraining

How Dust perturbs activations across token positions in a single forward pass. Image: QLabs

QLabs published Dust, a training algorithm that perturbs activations rather than computing gradients through backpropagation. Each token position is treated as a separate population member in a single forward pass; credit is assigned by how much each perturbation reduces loss. The result is the first zeroth-order approach competitive with backprop at transformer pretraining scale — 10³–10⁴× more efficient than prior evolution strategies, with gradient estimates that converge toward backprop gradients as population size grows. Notably, larger models (243M parameters) outperform smaller ones across most population sizes, contrary to the usual assumption that zeroth-order methods scale poorly.

Opus 5.5 agentic pipeline identifies two room-temperature magnetic semiconductor candidates

Vals.ai ran a multi-agent Opus 5.5 pipeline over materials science literature and predicted two Luttinger-compensated semiconductor candidates: YBaMnFeO₅ (a newly designed compound) and KV[Cr(CN)₆] (a 1999 Prussian blue family material). Both are predicted to sort electrons by spin at room temperature despite zero net magnetism — useful for spintronics storage. The computed spin-sorting windows exceed thermal noise at room temperature. Full inputs, outputs, and analysis code are on GitHub; the next step is laboratory synthesis and direct measurement of KV[Cr(CN)₆]. Genuine research, not a benchmark demo.

Vals.ai · HN

Mold 3.0: production linker fully rewritten in Rust

Mold 3.0 is a complete rewrite from C++ to Rust, the first release of the new implementation. It is a drop-in replacement for 2.42.1 with identical CLI flags, target architecture support, and comparable link performance. The Rust version adds bounds-checked memory access (malformed inputs panic cleanly rather than potentially reading out-of-bounds) and drops CMake for Cargo. Includes 30+ bug fixes across AArch64, RISC-V, LoongArch, PPC64, and linker script handling. Requires Rust 1.95+.

Gleam no longer compiles to Erlang source — now generates Erlang abstract forms directly

Gleam’s compiler backend (rewritten by Giacomo Cavalieri) now targets Erlang abstract forms — the metadata-annotated IR consumed by the Erlang compiler — instead of emitting Erlang source. This skips Erlang’s front-end parsing entirely and fixes a long-standing annoyance: BEAM crash reports and stacktraces now show accurate Gleam line numbers rather than offsets into generated Erlang. Build times improved substantially. The approach avoids the maintenance burden of a custom BEAM bytecode generator while still leveraging decades of BEAM optimization work.

Async Rust’s complexity is concurrency complexity — and where the scheduler lives explains why

A thorough analysis of why Rust’s async runtime lives in library crates (Tokio et al.) rather than the language or kernel: zero-cost abstractions require no hidden runtime, and embedded/no_std environments can’t tolerate a mandatory green-thread scheduler. The author argues “concurrency always requires a runtime” — the question is only where it lives. Zig’s approach of passing the allocator/scheduler as an explicit parameter would make the dependency visible and composable, whereas Rust’s ambient-executor model (.await on a future without knowing which executor will drive it) creates the ergonomic friction people complain about.

Cloudflare Containers cross-tenant data exposure: storage blocks weren’t zeroed between tenants

Researcher Oren Yomtov (Accomplish) disclosed a cross-tenant data exposure in Cloudflare Containers rooted in Linux device mapper thin provisioning with skip_block_zeroing enabled. When a 64 KiB storage block was reallocated between customers, a partial 4 KiB write left the remaining 60 KiB containing the previous tenant’s filesystem metadata, directory structures, and database content readable via raw disk reads. Cloudflare removed the setting, retired all existing container disks, and cleared cached image snapshots across the fleet by September 19. No evidence of exploitation.

Reverse engineering Comanche’s terrain maps: PCX images in disguise

The four color maps from the original 1992 Comanche, extracted from the obfuscated PCX files. Image: Pikuma

The 1992 voxel helicopter shooter Comanche stored its 1,024×1,024 height and color maps as standard PCX images with “Kyle DTA” overwriting the first 8 bytes of the header — a minimal obfuscation hiding plain run-length-encoded image data. Each map is exactly 1 MB; 8-bit indexed color, 256-color palette. The reverse engineering reveals that the team pragmatically reused ZSoft PC Paintbrush’s format rather than inventing a custom one. The post includes a working ANSI C decoder and the full four terrain color maps.

Also today

  • Ephemeral testing: Daniel Lemire on asking an agent to build a throwaway app against your library and watching where it fails — hidden state and poor docs surface as agent failures — lemire.me · HN
  • Deno exodus: broken ZSH integration, JSR rate-limiting and HTTP concurrency bugs drove one developer back to Node v26, where builds are now 15% faster — dbushell.com · HN
  • Qualcomm pays Huawei for 5G patents — the former licensee is now the licensor, reflecting Huawei’s position as the largest single contributor to 5G standards — Bloomberg · HN

Linux & Infrastructure

gonixgo: build Go projects in Nix using go.sum hashes — no vendorHash needed

gonixgo runs as a builtins.exec call during Nix evaluation to generate per-package derivations from the existing go.sum file. Unlike buildGoModule’s single vendorHash, it compiles each Go package as a separate derivation and links them — so changing one file only rebuilds affected packages, not all dependencies. The tradeoff is requiring --option allow-unsafe-native-code-during-evaluation true. An interesting direction for Go-in-Nix packaging.

NixOS Modular Services: package-level configuration modules are taking shape

Meeting notes from Modular Services working group meeting #9 (2026-10-02) show the group discussing “package modules” — a way to write wrappers for packages using a module-system-like API. The example snippet shows pkgs.nginx.module.configure { virtualHosts.test.locations."/" = ... }, suggesting packages will be composable and configurable at the derivation level without going through NixOS module options. Attendees included lassulus, roberth, and tomberek. Foundational work for a more composable Nix package ecosystem.

“Big Tech ruined the cloud, so we’re renaming ours.” Image: Home Assistant

Nabu Casa founder Paulus Schoutsen announced Home Assistant Cloud is being renamed Home Assistant Link — partly because “big tech ruined the cloud” and partly to clarify that HA runs locally. The $6.50/mo remote access service otherwise stays the same. More substantively, Schoutsen outlined a push to lower HA’s entry barrier: simpler dashboards, more intuitive setup, a new purpose-built hub launching next year, and AI integration to reduce configuration complexity. “We’re growing up.”

Part of that is HACS: the Home Assistant Community Store code has merged into HA’s dev branches, targeting Core 2026.11 as a native “Marketplace” component — no separate installation, no GitHub account required. Community integrations, cards and themes install from Settings, and updates appear alongside regular HA updates. Existing HACS installs auto-migrate with custom repositories preserved. Caveat: community projects remain independently maintained and unaudited by the HA team.

Three new Hyprland plugins: scrolling rows, sliding wallpapers, and a 3D desktop with physics

hyprmosaic: per-workspace wallpapers sliding mid-swipe in a 3×3 workspace grid. Image: La5u/hyprmosaic

z-scroll (repo: hyprland-scroll-overview) is a custom layout plugin implementing a vertically scrolling sequence of rows with two windows per row — inspired by niri’s scroll model. Supports per-monitor layout, blur, shadows, cross-monitor window drag, and hyprpm installation. Still rough but an interesting alternative tiling model.

hyprmosaic renders each workspace’s wallpaper as part of the workspace itself, so mid-swipe you see both wallpapers transitioning rather than snapping after the switch. Configurable grid (default 3×3), three-finger gesture navigation, PNG/JPEG/WebP/AVIF/JXL/SVG, live wallpaper updates. Install via hyprpm add https://github.com/La5u/hyprmosaic.

Hypr3D, the plugin that turns your desktop into a walkable 3D space, added the Jolt physics engine plus zoom and camera shake. Windows can be dragged, resized, and rotated in 3D; a keypress returns you to 2D. A novelty, but an increasingly polished one — MIT licensed, Lua-configured.

zfs-tenant: isolated ZFS access for encrypted friend-to-friend backups over SSH

Bas Nijholt wrote a tool and guide for secure mutual ZFS backups between two friends — each receives the other’s encrypted snapshots (zfs send -w) without ever getting a shell or root on the peer’s machine. The key piece is zfs-tenant, a ~930-line Python gate program invoked via SSH authorized_keys command= that validates and restricts ZFS commands to only what backup needs. Combined with zfs allow delegation, quotas, and syncoid/sanoid for scheduling, it creates a locked-down backup tenant. Ships as a single .pyz with no dependencies; works on NixOS and TrueNAS.

Also today

Nix
Spoonful: a static site generator written entirely in Nix — content as Nix code, cached reproducible builds, auto-generated RSS and sitemaps — Tangled · Lobsters
nix-metafun compiles Nix attribute sets into bash CLIs with option parsing, validation and tab completion, nested subcommands included — GitHub · r/NixOS
Nix and Home Manager on the Steam Frame VR headset via the Steam Deck installer path, with steamos-etc to survive updates — johns.codes · Lobsters
NixCon 2026 wrapped in Kraków with 555 attendees; the post-event survey is open — NixOS Discourse
Self-hosting & CLI
OpenWorkers: MIT-licensed, self-hostable Cloudflare Workers runtime in Rust with V8 isolates, KV/SQL/object storage bindings and 2.3ms cold starts, now in public beta — openworkers.com · r/selfhosted
fm: a 1500-line single-file bash file manager built on fzf and eza with Kitty inline image previews — GitHub · r/commandline
cd ~/repos/josse-posten && claude --resume 228ed711-86c6-47e4-8be3-63bd486c1d48