Trump formally waives the Russia sanctions Congress wrote into law while the Telegraph confirms Musk asked him to throttle Ukraine’s Starlink; Ukraine answers with its first strike on Siberia as Russia cuts power to a million people; and the NIST curve seeds turn out to be a Unix timestamp fed to drand48.

Trump waives Russia sanctions two days before they bite; Telegraph confirms Musk proposed the Starlink slowdown

Trump signed an executive order suspending several Graham Act sanctions and tariffs on Russia, citing “national security” and diesel price relief ahead of the November midterms — two days before the sanctions Congress passed into law would have taken effect, and a week after the diesel deal with Putin. It is the most concrete pro-Russia policy move of his second term. CNBC’s analysis argues the diesel arrangement offers Russia more than revenue: it signals reduced US pressure and undermines Ukraine’s leverage at a critical moment.

The Telegraph independently confirmed that Musk approached Trump proposing to restrict Ukraine’s Starlink service, contradicting Trump’s earlier denials. Congressional pushback is sharpening: a bipartisan bill from Rep. Meeks would block the Russia diesel deal and mandate new energy sanctions, and US senators have called for a formal investigation into the Starlink restrictions. The EU is negotiating Ukraine’s direct inclusion in its own satellite communications system as a fallback.

Ukrainska Pravda: sanctions suspension · BBC: sanctions waiver · NYT · AP · Al Jazeera · CNBC: diesel leverage · The Hill · The Telegraph: Musk approached Trump · Ukrainska Pravda: Musk · BBC: senators call for investigation · Ukrainska Pravda: diesel deal bill · r/UkrainianConflict: EU satellite backup · r/worldnews

EU rallies around Zelensky as Trump turns on him; Starlink access still not fully restored

At the EU summit in Brussels, Zelensky received warm embraces from European leaders. Von der Leyen declared EU support “matters more than ever”; Zelensky thanked the bloc’s “real leaders” — a pointed contrast with Trump, who called him “more difficult to work with than Putin.” Ukraine’s military Starlink access remained only partially restored. Germany, which co-funds Starlink for Ukraine, demanded the restrictions be lifted immediately; Italy’s defence minister called Trump “completely wrong.” The EU confirmed a new Russia sanctions package is on the way.

Kyiv Independent · The Guardian · Reuters · Kyiv Post: Germany · BBC · r/worldnews

Ukraine hits a Siberian Gazprom plant 2,340 km from the border; Ryazan struck again; Su-34 losses confirmed

Fire at Gazprom’s Chernomyrdin Condensate Stabilization Plant near Surgut, Khanty-Mansi Autonomous Okrug, after the Ukrainian drone strike on October 16. Photo: Militarnyi

Ukrainian drones struck Gazprom’s Chernomyrdin Condensate Stabilization Plant near Surgut in the Khanty-Mansi Autonomous Okrug — 2,340 km from Ukraine’s border and the first confirmed strike on the region. The plant produces motor and aviation fuel with a 12 million tonne annual capacity. The Ryazan Oil Refinery was struck the same night. Satellite imagery from October 15 confirmed that the earlier Neptune cruise missile strike on Borisoglebsk airfield destroyed four Su-34M fighter jets, described as the worst single-day Russian air force loss since Operation Spiderweb. RUSI argues the sustained deep-strike campaign has already imposed a kerosene shortage on Russia.

Militarnyi · ISW · RUSI: kerosene shortage · EUobserver: Su-34 losses · r/ukraine: Surgut footage · r/ukraine: Ryazan · r/UkrainianConflict: Borisoglebsk

Back-to-back mass strikes kill eight and cut power to a million; Ukrainian drones shut all four Moscow airports

Residential buildings in Sloviansk, Donetsk Oblast, after a Russian FAB-250 aerial bomb strike in the early hours of October 17. Photo: Ukrainska Pravda

Russia launched 464 drones and Banderol/Dan-T loitering munitions overnight October 15–16, then followed with Iskander, Kalibr and Kh-22/32 missiles plus 332 attack drones the next night. At least eight people were killed in Kharkiv, Kramatorsk, Volyn and Rivne. Emergency outages hit at least eight oblasts — Kharkiv lost 280,000 customers, Volyn 270,000, and Vinnytsia lost power city-wide, roughly a million Ukrainians in total. Aerial bombs struck two high-rise apartment buildings in Sloviansk. The Guardian frames the pattern as Russia abandoning hope of a military breakthrough in favour of making major cities unlivable through systematic energy destruction.

Russian drones also violated Moldovan airspace five times in a single night, with one crashing and exploding in a field near Scaieni, 30 km inside the country — at least the ninth violation since August. In the other direction, Ukrainian drones forced the closure of all four Moscow airports overnight, cancelling dozens of flights.

Ukrainska Pravda: missiles and drones · Ukrainska Pravda: Sloviansk · Ukrainska Pravda: power outages · Al Jazeera · The Guardian: analysis · ISW: Moldova · Euronews: Moscow airports · r/worldnews

NIST elliptic curve seeds solved: drand48 and a Unix timestamp from 1997

Dice in evening light — the photo accompanying Filippo Valsorda’s write-up on the solved seeds. Photo: words.filippo.io

A 30-year-old cryptographic mystery is closed. Anthropic researchers, using Claude, determined that the NIST P-256/P-384/P-521 curve seeds were generated by passing Unix timestamps to srand48() and producing 20-byte sequences per the ANSI X9.62 spec — not by some forgotten English sentence as long assumed. Specific 1997–98 timestamps reproduce the published curves. The security implication: only about 30 bits of selection freedom existed, far too little to embed an exploitable backdoor, substantially rehabilitating confidence in these curves. The filippo.io bounty has been claimed.

filippo.io: Seeds Solved · Anthropic Research · HN · Lobsters

Indicator	Value	Change
S&P 500	7,659	-1.09%
Dow 30	52,002	-0.34%
Nasdaq	26,140	-2.14%
Russell 2000	2,721	-1.66%
VIX	20.0	+21.45%
Gold	4,181	+0.26%
BTC	$81,505	-0.83%
USD/NOK	9.43	0.00%

Risk-off Friday: Nasdaq down more than 2%, VIX up a fifth to 20. Gold holds above 4,100.

World

Oil supertanker catches fire in Strait of Hormuz after striking naval mine

An Islamic Revolutionary Guard Corps boat during an operation in the Strait of Hormuz, April 2026. Photo: AFP file

Iran’s IRGC reported that an oil supertanker is on fire in the Strait of Hormuz after hitting a naval mine. The incident caps what was already a record week for Hormuz ship attacks, amid a broader escalation in regional maritime tensions.

Al Jazeera

Who hacked France’s supermarket fridges?

Shortly before midnight last Sunday, digital thermostats controlling cold aisles in hundreds of French supermarkets began malfunctioning, causing food to spoil on a large scale. The attack left France — described as Europe’s most-hacked country — with a mountain of food waste. Investigators have not yet determined whether it was state-sponsored sabotage or independent hackers.

The Guardian

Amazon deforestation falls to lowest level on record — down 42% in a year

Brazil’s government reported a 42% drop in Amazon deforestation compared to a year earlier, the lowest level since records began in 1988. The milestone is a boost for President Lula ahead of the election run-off and a reversal of the dramatic clearances that accelerated under Bolsonaro. Lula has made the Amazon’s protection a centrepiece of his environmental diplomacy.

Al Jazeera · The Guardian · BBC

Meta employees say Lula’s accounts were algorithmically suppressed during Brazil’s election

Internal messages reported by Folha de S.Paulo show Meta employees acknowledged that Lula’s social media accounts were restricted and that Bolsonaro’s profile and WhatsApp channel were algorithmically promoted during the campaign. The revelation adds to a growing body of evidence about platform decisions shaping democratic outcomes, following Wednesday’s reporting on the censoring of pro-Lula accounts.

Reuters · Al Jazeera · r/worldnews

India: ‘Cockroach’ party founder arrested as Delhi anti-government protests escalate

Abhijeet Dipke, founder of the youth-led Cockroach Janta Party movement, was detained and then formally arrested by Delhi police as authorities cracked down on fresh anti-government demonstrations. The movement had called the protest after mass detentions last week and the jailing of two party leaders. The protests centre on allegations that a voter roll review is politically motivated and designed to disenfranchise voters.

The Guardian · BBC · NPR

Albania protests turn violent for fourth day; PM claims ‘foreign hands’ are behind unrest

Albania’s student-led ‘Flamingo’ anti-corruption movement escalated sharply this week, with riot police clashing with protesters in central Tirana for a fourth consecutive day. The demonstrations — centred on corruption and poor university conditions — have grown significantly in scale. Prime Minister Edi Rama dismissed the movement by blaming foreign interference, a characterisation protesters reject.

Al Jazeera · BBC

Israeli settlers attack West Bank olive harvest; Washington Post journalist beaten

Masked Israeli settlers conducted coordinated attacks across the occupied West Bank to disrupt the annual olive harvest, burning cars and olive trees and hurling rocks at Palestinian farmers. Washington Post photographer Heidi Levine was beaten by settlers during the attacks. The BBC, which witnessed the attacks directly, reported a surge in similar incidents this season.

The Guardian · BBC · NPR · NBC News · r/worldnews

Also today

Americas: Oregon shooting: the teacher killed in Bend fought the 16-year-old gunman before an armed parent shot the suspect; the attacker, a former special needs student, targeted a special educational needs classroom — BBC · Al Jazeera; White House press secretary Katie Zacharia out after five days on the job, following criticism of her credentials and debut performance — NPR · BBC; Norte Fire forces evacuations in Orange County as Santa Ana winds and unseasonable heat make for dangerous fire weather through the weekend — Al Jazeera · The Guardian; Lula reverses decades-held position, now backs lowering the age of criminal responsibility to 16 for ‘heinous’ crimes ahead of the run-off — The Guardian; Three men sentenced to 158 years each for the 2024 murders of Australian brothers Jake and Callum Robinson and American Carter Rhoad on a Baja California surfing trip — BBC · The Guardian · Al Jazeera
Europe: UK army chief says politicians must start a frank public conversation about preparing the country for war — Sky News · r/worldnews; Downing Street weighs joining the EU’s Chinese EV tariff scheme after France drops its opposition; Beijing warns against a ‘discriminatory’ step — The Guardian; Italy opens investigation into Israeli FM Katz and 12 officials over alleged abuse and sexual assault of detained flotilla activists — Al Jazeera; Sally Rooney’s books will no longer be sold in the UK after she pledged royalties to the proscribed Palestinian Action — NPR; Pope pictured for the first time since lung cancer surgery at Rome’s Gemelli Hospital — BBC
Africa & Asia: South Africa: around 200 patients rescued from a suspected illegal rehab centre, some found chained with sores in severely overcrowded rooms — BBC; China says it could ‘easily win’ a confrontation with the Philippines, an unusually direct escalation in the South China Sea dispute — Channel NewsAsia · r/worldnews
Science: Astronomers announce the first known green star, a colour not typically sustained by standard stellar physics — CNN · r/worldnews

Ukraine

Putin stages victory theater at the command post; ISW data shows Russia losing ground

Putin visited the Joint Grouping of Forces command post with the General Staff and announced sweeping advances: 6,500 sq km seized in 2026, Ukrainian forces encircled in Kharkiv Oblast, Russian troops at the outskirts of Kramatorsk and Druzhkivka. ISW’s assessment contradicts every major claim. Net gain is roughly 100 sq km since January, and a net loss of 122 sq km since September 1, with Russia averaging minus 7 sq km per day in October. Ukrainian forces held or advanced near Slovyansk, western Zaporizhia and Kostyantynivka. Putin also explicitly ruled out any Russian territorial concessions in peace talks, framing the “security zone” in northern Ukraine as non-negotiable — the Kremlin continues to demand Ukraine cede territory while refusing to yield any of its own.

ISW · Ukrainska Pravda: General Staff report

Russia rebuilding armored stockpiles at five bases, including a site 185 km from Finland

Satellite imagery analysis shows Russia restocking T-90M tanks, BMP-3M and BMD-4M infantry fighting vehicles, and 2S19/2S43/2S44 self-propelled howitzers at five storage bases — including one near Petrozavodsk in the Republic of Karelia, roughly 185 km from Finland. ISW assesses this as long-term NATO posturing rather than an imminent threat, since Russia’s active-duty combat personnel remain heavily committed in Ukraine with high attrition. But reconstitution alongside an ongoing war signals Russia hasn’t abandoned mechanized warfare and is building a long-term conventional posture against NATO regardless of the war’s outcome.

ISW · RFE/RL (Krutov)

Tech

How Claude Code scales to 30,000 daily changes and cut reverts 40%

The Claude Code team’s engineering blog describes a full rethink of code review under AI-assisted scale — the review-side companion to Wednesday’s story on Anthropic replacing git. The architecture: pre-PR Claude verification runs (tests, lint, a second agent reviewing the diff with fresh context), multi-agent voting on review findings before humans see them, risk-tiered human sign-off (zero approvals for docs and internal features, two for high-risk), merge queue re-testing against latest main, and CLAUDE.md/REVIEW.md files encoding project conventions and priority finding classes. The result was a 40% drop in reverts. The philosophy: preserve human attention for architectural and strategic decisions, not line-by-line reading.

Claude Code Blog · HN

Claude discovers genuinely novel quantum circuit designs

Claude-designed circuits against prior published benchmarks across eight quantum circuit design tasks, on qubit and gate counts. Image: Anthropic

In a closed-loop setup — Claude proposes circuits in Python, an evaluator checks correctness and scores qubits × gates, Claude iterates — Anthropic found that Claude independently discovered circuits beating all previously published benchmarks across eight tasks. The Reed-Solomon decoder task saw a 12× gate reduction. In a 53-hour autonomous run on elliptic-curve operations, Claude derived a novel formula for reversible computation that avoided storing branch history — a previously unexplored mathematical approach. This is actual algorithmic discovery, not prompt assistance.

Anthropic Research · HN

On Terry Tao’s blog: what is mathematical research actually for?

A sharply written guest post by physicist Rikab Gambhir uses heavy irony to attack AI companies treating mathematical output as a productivity metric — generating vast quantities of unverified, unreadable results and offloading verification to the community. The essay invokes Borges’s Library of Babel: a library containing all possible statements is not the same as knowledge. The target is explicit: systems optimizing for “factoids in repositories nobody reads.” Short, and a useful counterweight to the quantum circuit story above.

Terry Tao’s Blog · Lobsters

Big Fish: exploiting a 37-year-old signed integer overflow in OpenBSD

A signed 16-bit counter (shm_nattch) in OpenBSD’s SysV shared memory implementation can wrap from positive to negative after 259 fork cycles, enabling a use-after-free plus out-of-bounds write. The exploit achieves local privilege escalation by winning a race between IPC_RMID and new attachment, grooming kernel heap layout via sysctl(KERN_MALLOCSTATS) metrics, then overwriting kernel function pointers through atomic decrements in the PTE self-referential map. SMAP/SMEP are bypassed via crafted IP socket allocations. The bug is 37 years old.

Calif Research · HN

Eufy HomeBase 2: UART lockdown, damaged flash, and an admin shell via firmware patch

A Raspberry Pi reading the desoldered flash chip off-board. Photo: Adepts of 0x

A detailed teardown of the Eufy HomeBase 2 security camera hub. The WiFi management password uses HMAC-SHA256 over a serial number extracted via I2C — documented as weak. UART shell access was blocked by an init script infinite loop; the researchers patched the recovery image to change the debug check from if [ "$DEBUG_LOG" = "1" ] to if [ 1 = 1 ]. Reading the soldered flash with spring clips failed, so they desoldered it — damaging 64 KB — and compensated with an intact recovery image. End result: GDB running on-device and full admin shell access.

Adepts of 0x · HN

Twenty self-hosted services on Incus OS with zero config drift

Solene’s write-up on running a full homelab stack on Incus OS — a locked-down immutable appliance (secure boot, A/B partitions, TPM disk encryption, no shell or SSH) that runs only Incus. About 20 Ubuntu system containers sit on top, each rebuilt from scratch via cloud-init whenever the configuration changes, eliminating config drift. Everything is declared via OpenTofu. Default-deny networking through Incus ACLs; haproxy and CrowdSec at the perimeter, Caddy for TLS, VPN-only admin access. Services include Nextcloud, Immich, Forgejo, Vaultwarden, PeerTube and a full Prometheus/Grafana/Loki stack.

dataswamp.org · Lobsters

Iroh 1.0: stable P2P connections dialed by public key

Four years in, iroh reaches 1.0. The promise: authenticated encrypted connections between any two devices using only their public key as the address — no infrastructure, with hole punching handled transparently, in the spirit of Tailscale. The 1.0 scope is deliberately narrowed, with extra functionality moved to separate crates. Notable architectural moves: dropped IPFS compatibility, forked the quinn QUIC library into “noq” to support multipath, and switched to raw public keys in TLS instead of self-signed certificates. Deployed across hundreds of thousands of devices.

Iroh Blog · Lobsters

Apple MLX: distributed inference across Mac Studios via RDMA over Thunderbolt

Apple’s MLX framework now supports pipeline and tensor parallelism across multiple machines using RDMA over Thunderbolt 5, introduced in macOS 26.2. The M5 Ultra GPU adds dedicated matrix-multiply hardware for a 4.6× speedup in time-to-first-token versus M3 Ultra. This is the infrastructure behind running Muse Spark Open (816B MoE) across two Mac Studios — covered yesterday as a model release, this explains the actual distribution mechanism.

Apple ML Research · HN

Interactive refactoring lands in gopls: the LSP can now ask questions

gopls v0.24.0 introduces multi-step interactive dialogs into LSP refactoring — the server can request user input before computing edits. Immediate uses: add or remove struct tags with naming convention choices (camelCase, snake_case, PascalCase), implement an interface with a workspace-wide type search prompt, and move declarations across files with a file picker, updating all references and imports automatically. The LSP primitive itself is the interesting part; expect other language servers to adopt it.

Go Blog · Lobsters

Also today

Character.AI files for bankruptcy after Google absorbed it by hiring its founders and licensing the technology, leaving the legal shell to fail — NPR / Planet Money
Mull: plain-text notes backed by a language server — cross-document links, autocomplete, hover previews, broken-reference diagnostics and rename refactoring — GitHub · Lobsters
GNOME OS Preview: first stable snapshot built from GNOME 51.1, used daily by dozens of GNOME developers for over a year; disk encryption, installer and ARM support still in progress — GNOME Blog · Lobsters
Rust 1.99.1 fixes an FFI bool miscompilation on x86_64, a missing wcslen symbol on UEFI targets, and rust-lld failing to load libLLVM.dylib on macOS — Rust Blog · Lobsters

cd ~/repos/josse-posten && claude --resume d5fd446f-3385-4021-a39f-87f124d57bf7