Moscow takes the concessions and keeps the war; Ukraine answers underground and deep in Russia’s rear, while Brent climbs to $112 on Iranian threats against the Gulf.

Trump says Musk restored Ukraine’s Starlink — Kyiv flatly denies it

Trump publicly claimed that Elon Musk had restored Ukraine’s satellite access after a phone call between the two, but refused to say whether he personally ordered it. Kyiv issued an immediate denial: speeds and coverage remain restricted, and no formal agreement exists. AP reports conflicting accounts inside the US government as well. The throttling of military-grade Starshield had caused Ukrainian drone operations to collapse mid-mission. Kyiv is now hedging fast: the Finnish PM’s visit yielded more than €300M in agreements, including Nokia and ICEYE partnering with Ukraine’s Ministry of Defence on sovereign satellite communications.

Kyiv Independent: denial · Kyiv Independent: Finnish satellite plan · BBC · Al Jazeera · Ukrainska Pravda: Trump confirms · Ukrainska Pravda: AP on conflicting accounts · NYT · ICEYE · r/ukraine

Putin pockets the US reset — and the US now reportedly offers a Nord Stream restart

ISW’s reading of the 21 October Witkoff–Putin meeting: the Kremlin is using diplomacy to extract US economic concessions while buying time on the battlefield. The most visible concession is a reported US offer to restart Nord Stream as part of a peace deal. Peskov confirmed that Putin presented no peace proposal and has not formed a delegation for trilateral talks, and Duma members said openly that freezing the front would hurt Russia. Ukraine has already offered the frontline freeze that was demanded, yet pressure keeps landing on Kyiv, which is wired into US military and intelligence systems and is therefore the easier party to move. ISW notes that Russia has lost a net 241 km² since 1 September, and that Russian milbloggers accuse their own Ministry of Defence of inventing village captures in Zaporizhzhia to mislead US negotiators. The UK rejected Witkoff’s description of Putin as “humanitarian” on the same day Russia hit Kyiv’s historic centre with cluster munitions. In Oslo, before Witkoff flew on to St. Petersburg, Støre insisted on “nothing about Ukraine without Ukraine.”

ISW · Ukrainska Pravda: Nord Stream offer · Ukrainska Pravda: trilateral talks · Bloomberg · TVP World: reset stalls · TVP World: Oslo · r/geopolitics: reset · r/geopolitics: Oslo

Operation Veles: Ukraine’s underground counteroffensive cuts Russia’s pipeline route into Kupyansk

Ukraine’s Khartiya Corps says it has completed the world’s first underground counteroffensive. Troops cleared Russian forces from a Soviet-era gas pipeline that runs 15 km under the Oskil River into Kupyansk, and killed or captured more than 100 Russian soldiers. Since at least September 2025, Russian forces had used the pipe (1–1.2 m wide, 2–4 m underground) as their main supply and infiltration route, at times using civilians as human shields when they came out. Drones and explosive-laden ground robots failed, because the Russians simply dug new entry holes, so Ukrainian soldiers had to go in on foot. The operation reportedly cuts Russia’s covert access to Kupyansk from the north.

ISW · Gwara Media · WSJ · r/UkrainianConflict

Rosneft concedes Ukraine’s refinery strikes are becoming unsustainable

Oil storage tanks at Rosneft’s RN-Tuapsinsky refinery in Tuapse. Photo: Bloomberg/Getty

Russia’s state oil giant told Bloomberg that losses from Ukrainian drone strikes on its refineries are becoming unsustainable. This is a rare admission that the long-range campaign has strategic effect. CNBC reports that the strikes have badly damaged Russia’s diesel exports. Russia is the world’s second-largest diesel supplier, and the damage affects both export revenue and military logistics. The campaign now reaches beyond oil. Strikes on 8–11 October knocked out three Yandex data centres with top-500 supercomputers, including the world’s 19th-ranked, and also hit Sberbank and VK. The Nvidia A100s inside cannot be replaced under sanctions. Russia’s own data-localisation rules had concentrated the targets. (More deep strikes in Ukraine)

Kyiv Independent · CNBC · Fortune · r/worldnews · r/geopolitics: diesel · r/geopolitics: AI race

Iran threatens seven Gulf states; Brent hits $112 as Hormuz shipping is attacked

Oil reached a five-month high of $112 a barrel after the IRGC claimed strikes on four vessels in the northern Gulf, and three more tankers hit mines near the Strait of Hormuz. Iran now explicitly threatens oil facilities and AI infrastructure in seven Gulf states if the US and Israel renew their attacks, and officials have named undersea cables and data centres as targets. Trump ruled out negotiations: “something will happen fairly soon.” Iran’s foreign minister describes a “truly wartime situation” and calls the latest US response “insufficient and incomplete.” European and Middle Eastern foreign ministers met in Istanbul to try to contain the crisis. US–Israeli plans for a “short but intensive” campaign after the 3 November midterms still wait for Trump’s approval. A War on the Rocks essay by a former CIA analyst argues that a leadership which has already lost Khamenei no longer follows pre-war deterrence logic.

Al Jazeera · Guardian: Gulf threat · Guardian: oil · CNBC: Brent · CNBC: strike plans · IranNewsWire · War on the Rocks · r/geopolitics: oil flows · r/geopolitics: Saudi

Anthropic uses LLMs to prove security properties across 123 production libraries

Share of 36 formal verification tasks proved by a single agent at a given token budget, Opus 5 vs Opus 5.5. Chart: Anthropic

New Anthropic research applies Claude to formal verification at production scale: 239 entry points across 123 OSS-Fuzz libraries, with about 180 million lines of assembly-level proof code. The proofs found real bugs: a counter underflow that needs about 20 MB of input, an out-of-bounds read in an image decoder, a logic bug in file-restriction code that nobody had found before, and a rediscovery of CVE-2026-56132 in libexpat. Opus 5.5 finished tasks with 40% fewer tokens than Opus 5. Agents that share verified components across the workspace cut costs a further 17%.

Anthropic · HN

Indicator	Value	Change
S&P 500 (f)	7,695	-0.12%
Dow 30 (f)	52,835	-0.44%
Nasdaq (f)	29,160	+0.06%
Russell 2000 (f)	2,785.2	-0.39%
VIX	19.25	+1.16%
Gold	4,029	-0.77%
BTC	$81,440	-0.85%
USD/NOK	9.34	+0.16%

Brent at $112, a five-month high, after Iranian attacks on Gulf shipping and mines near Hormuz; US index futures mostly slightly lower (see above)
Europe enters winter with record-low gas reserves, adding to energy-cost pressure (see World)

World

EU heads into winter with record-low gas reserves

IEA chief Fatih Birol warned in Berlin that Europe is entering winter with the lowest gas reserves ever recorded, on top of the supply shock from the Iran war. Britain faces some of Europe’s highest energy costs this winter because it depends heavily on imports, and UK consumer confidence has fallen at its fastest rate since the 2016 Brexit vote.

Al Jazeera · Guardian: energy costs · Guardian: consumer confidence

Europe’s protest wave: Serbia votes Sunday, Milan erupts, Poland marches on abortion

Sunday’s Serbian election is the first real test for the student movement that has challenged Vučić for two years since the deadly Novi Sad station collapse, and the “Student List” could be decisive. In Milan, riot police clash with marginalised youth, and the scenes have reopened the debate about Italy’s “lost generation.” Thousands marched across Poland on the sixth anniversary of the near-total abortion ban, while the governing coalition stays deadlocked on reform. In France, Paris has extended its curfew, Marseille and Lyon have banned non-union protests, and major museums will close on Saturday.

BBC: Serbia · Guardian: Serbia · Guardian: Milan · Al Jazeera: Poland · BBC: Paris curfew · CNN: Macron

Brazil goes to the polls Sunday with a Meta bias row clouding the runoff

Lula faces Flávio Bolsonaro in Sunday’s presidential runoff. Lula has demanded Bolsonaro’s disqualification and accuses Meta of algorithmically suppressing anti-Bolsonaro content, which the company denies. The Amazon is directly at stake: communities in Roraima warn of environmental rollbacks if the right wins.

Guardian: Meta row · BBC · Guardian: Amazon podcast

Venezuelans demand elections in first national protest in nearly two years

An opposition supporter waves a flag over a highway in Caracas at a demonstration demanding 2027 elections. Photo: Fausto Torrealba/Reuters

Thousands marched across Venezuela in the first national opposition mobilisation in nearly two years. They demand an election date after Nicolás Maduro’s capture by US forces. No successor has been named and no transition framework exists. In Ecuador, police arrested opposition leader Luisa González in a campaign finance probe, and her Correa-aligned movement calls it political persecution.

Al Jazeera: Venezuela · Al Jazeera: Ecuador

A week before the midterms: Russian AI disinformation, and a judge blocks DHS “voter” operations

A congressional intelligence report obtained by Politico describes a Russian covert influence operation that uses AI to multiply disinformation output, erode trust in US election institutions and voting machines, and target candidates who support Ukraine. Separately, a federal judge barred Department of Homeland Security field operations that searched for noncitizen voters, with agents in tactical gear in immigrant-heavy precincts. The judge ruled that the operations likely violated the Voting Rights Act’s ban on voter intimidation.

Politico · NPR · Al Jazeera · r/worldnews

Ebola cases in Nigeria and Kenya traced to the same Uganda airport on the same day

Investigators have found that the Ebola patients in Nigeria and Kenya both transited Entebbe International Airport on 3 October, which points to a possible shared exposure. Contact tracing now runs in three countries at the same time.

BBC

Sudan: BBC finds the RSF deliberately targeting hospitals

A BBC investigation documents deliberate, repeated attacks on hospitals by the Rapid Support Forces. UN human rights chief Volker Türk says the attacks may amount to war crimes.

BBC

96% of shallow-water coral reefs now critically endangered

Fish above a finger coral colony on the Great Barrier Reef. Photo: Lucas Jackson/Reuters

A new IUCN assessment puts 96% of assessed shallow-water reef systems in the “critically endangered” category, the highest threat level. Reefs support about a quarter of all marine biodiversity. The assessment cites marine heatwaves and ocean acidification.

Al Jazeera

Magnitude-7 earthquake strikes Tibet, killing 16

The quake hit northern Tibet near Nagqu. It killed at least 16 people, injured 54 and destroyed hundreds of homes, and at least seven aftershocks followed.

Guardian · BBC · Al Jazeera

Also today

US & UK politics: DOJ opens criminal investigation into Trump adviser Corey Lewandowski over alleged profiteering from his DHS role — Guardian; Farage’s new billionaire donor Sasan Ghandehari was in business with a foundation under Iran’s supreme leader — Guardian; EU to press Burnham for more Ukraine defence money in 2027; youth mobility deal may slip six months — Guardian: Ukraine · Guardian: youth mobility
Rights & accountability: The US-sanctioned ICC wins the EU’s Sakharov Prize — Al Jazeera; Aung San Suu Kyi speaks to her son for the first time in more than five years — Guardian
Health: India caps prices on 137 cancer drugs after the Supreme Court calls mark-ups “extortion” — Guardian; First known human case of Shamonda virus, a cattle arbovirus, recorded in France; the patient died — BBC
Environment: “Pure arrogance”: Google illegally fells 250,000 trees in Finland for an AI datacentre — Guardian · r/worldnews

Ukraine

Energy war: DTEK plant knocked offline; Russia fields the new Filin cruise missile

Aftermath of the Russian drone strike on Sumy, 23 October. Photo: State Emergency Service of Ukraine

Russia launched 176 drones overnight on 22–23 October, and 140 were destroyed or jammed. A separate strike seriously damaged a DTEK thermal power plant and stopped generation ahead of winter, and Sumy came under a large-scale drone attack. Zelensky says more than 170 energy facilities have been hit since 11 October, when Trump announced an “energy ceasefire” that Russia has ignored. Ukrainian intelligence says Russia began deploying a new cruise missile, the Filin, in late summer. It has a carbon-fibre airframe, a Chinese inertial navigation system, a range of up to 1,200 km and a 50–100 kg warhead. It is designed to be cheaper than Kalibr or Iskander and harder to intercept in large numbers.

Ukrainska Pravda: DTEK · Ukrainska Pravda: 176 drones · Ukrainska Pravda: Sumy · ISW

Ukraine hits Russia’s tax service data centre and a Tula defence supplier

On the night of 22–23 October, Ukraine struck the Federal Tax Service data centre in Gorodets, Nizhny Novgorod Oblast, about 500 km from the front. It is one of the two facilities that run Russia’s tax processing. In Tula, the Kosogorsk Metallurgical Plant, Russia’s second-largest pig iron producer and a defence-industry supplier, had a major explosion. It is the second there in recent weeks.

r/ukraine: tax data centre · r/ukraine: Kosogorsk · r/ukraine: second explosion

Deception at machine speed: how mass drone warfare revives old arts

A Ukrainian fibre-optic FPV drone. Photo: ArmyInform via Wikimedia Commons

An officer who served at the Pokrovsk command post argues that persistent sensor coverage has made deception essential, not obsolete. Under constant sensor coverage, concealment alone fails, so the adversary must reach the wrong conclusion by their own reasoning (reflexive control). Decoys that cost $400–2,500 make the enemy spend interceptors worth hundreds of thousands. The essay describes Operation Vivaldi, which combined electronic warfare, drone suppression and consistent battlefield fakes to restore manoeuvre.

War on the Rocks

The West is thinking too small about Ukraine’s victory

A second War on the Rocks essay argues that allies treat each Russian winter energy campaign as a new emergency. Meanwhile, Russia steadily degrades Ukrainian institutions: schools, hospitals, the grid and data centres. Instead of one-off aid packages, the author proposes deep institutional partnerships that pair governments directly with Ukrainian regions, universities and civil society, on the model of how defence-tech relationships already work.

War on the Rocks

Also today

Ukraine’s population has fallen to about 28.5 million, from roughly 41 million before the full-scale invasion — Ukrainska Pravda · r/worldnews
Denmark buys its first long-range precision strike missiles to hit “behind enemy lines” — Reuters · r/worldnews

Investigations

ICIJ: Kremlin firm A7 pushed $14 billion in untraceable cash into the global banking system

A fountain in Moscow’s Sadovod wholesale market, where A7 turned hundreds of tonnes of roubles into international wire transfers. Photo: ICIJ

The US Treasury has just sanctioned A7, a Kremlin-connected payment firm, as a “significant transnational criminal organization.” An ICIJ investigation shows how the scheme worked. Between November 2024 and July 2025, A7 moved at least 283 tonnes of roubles, more than $14 billion, through Moscow wholesale markets such as Sadovod, where cash has no traceable origin. The money then went abroad through shell companies in Kyrgyzstan, Turkey and Hong Kong. About 2,300 documented transfers reached Chinese exporters and banks, including ICBC, with no visibility into the Russian source. Cash becomes a legitimate-looking wire transfer the moment it enters the formal banking system.

ICIJ · r/geopolitics

Russia’s covert campaign: a $30,000 arson plot in Poland, a spy arrest in Germany

Polish prosecutors are investigating a suspected Russia-linked plot to burn down a factory in Gliwice that makes military drones for Ukraine. A recruiter reportedly offered $30,000 for the attack. In Germany, police arrested a Ukrainian national on suspicion of gathering military intelligence for Russia, one of several such cases this year. Chancellor Merz said publicly that Germany is the target of “intensive” espionage.

TVP World · BBC · r/worldnews: Poland · r/worldnews: Germany

Carnegie: the domestic foundation of American primacy is crumbling

A Carnegie Endowment paper describes a structural gap. National security elites see grave threats and recommend defence spending of 5–17% of GDP, while fewer than 6% of Americans name any foreign-policy issue as important. During the Cold War, both threat perception and willingness to pay were high. After 1989, both were low, which gave cheap primacy. The current mismatch has no precedent and no obvious resolution short of a catastrophic event that mobilises the public.

Carnegie Endowment · r/geopolitics

Why Kazakhstan joined both the American and Chinese AI blocs

RUSI explains why Kazakhstan signed up to both the US-led Pax Silica and China’s WAICO. It needs chips, models and infrastructure from both powers, and it has leverage that neither can ignore: it is the world’s largest uranium producer and a major supplier of gallium and tungsten. Membership gives smaller states a voice in how AI governance rules are written, not only in what technology they receive. Uzbekistan and Indonesia are following the same pattern.

RUSI · r/geopolitics

Also today

Canadian military officers increasingly refuse postings alongside US forces — The Atlantic · r/worldnews
Bellingcat tests 17 LLMs on geolocation: Claude leads, but humans remain key (see AI & Automation)

Tech

Eight bits of trust: eMudhra’s CA keys were single-byte integers

New details on the compromised eMudhra CA: all eight private keys were single-byte values (4, 56, 115, 155, 156, 230, 66, 237) on P-384, so a loop of 255 scalar multiplications recovers them in milliseconds. The root cause was a bug in a key-ceremony script, which created a second, weak key pair on the HSM. Human error then used those keys for the CSR. Scott Helme says he recovered the keys with Claude and a single prompt.

Scott Helme · Lobsters

Header Accordions: QPACK amplification attacks against HTTP/3 servers, up to 4,000:1

An attacker inserts a ~4 KB entry into the QPACK dynamic table and then references it thousands of times with single-byte pointers, which gives a 4,064:1 ratio of memory used to bytes sent. A second vector packs more than 160,000 unique header names into one compact HEADERS frame. Seven of ten tested implementations were vulnerable, and Bun also has an integer overflow that causes an infinite CPU loop. Fixes are out in quic-go 0.57.0, quiche 0.29.3 and lsquic 4.9.0. Bun, hyperium’s h3 and aioquic/mitmproxy remain unpatched.

foxio.io · Lobsters

Jailbreaking the Switch 2: three bugs chained to native code execution

Mario Kart World with injected characters: Walter White, Hatsune Miku and Minecraft’s Steve. Image: pepsipu.com

ns2jb chains three bugs. The first is a SmileBASIC integer overflow that gives out-of-bounds memory access through array removal. The second is a filesystem-service buffer overflow on paths with backslash parent-directory components. The third is a loader trust exploit that swaps in arbitrary code by controlling when the loader receives IPC responses from fs. The writeup is thorough, and the demos include character mods, save backup access and memory-mapped peripheral control.

pepsipu.com · Lobsters

Script dependencies with Nix: reproducible, language-agnostic, no containers

Nix writer helpers such as writePython3Bin, plus equivalents for R, Bash, Ada and other languages, bundle a script with its Python packages and system binaries. A flake.nix that pins nixpkgs declares the dependencies. The script itself stays unmodified, and a wrapper provides the environment. The result is identical across machines and over time, with no virtualenvs, no containers and no drift.

entropicthoughts.com · Lobsters

Jank: Clojure semantics on LLVM, with direct C++ interop

Jank runs Clojure’s persistent data structures and functional model on an LLVM JIT. Its interop reaches C++ templates, virtual functions, RAII and exceptions without intermediate bindings. It ships Cargo-style dependency management and nREPL integration, and it aims at game development and systems work that Clojure on the JVM cannot reach.

jank-lang.org · HN

UUIDv7 doesn’t have the properties you think

Under high load, UUIDv7 timestamps can run ahead of real time by any amount, and the RFC permits this. Without sub-millisecond counters, tight loops easily produce out-of-order IDs that are still RFC-compliant. The embedded timestamp also leaks creation time to anyone who receives the ID. Only uniqueness and collision resistance are guaranteed across implementations, so check your implementation before you rely on ordering for database sorts.

alexsci.com · Lobsters

Also today

Privacy & infrastructure: Au revoir France: Quad9 withdraws after court orders to block domains — Quad9 · HN; GNU Taler nears live operation in Germany: buyers unlinkable, merchant income auditable — GNU Taler · HN; Garmin reopens the Connect API with a free Personal tier: an API key in about 8 seconds for your own .FIT and health data — DC Rainmaker · Lobsters
Reading: Dijkstra, EWD667 (1978): “On the foolishness of natural language programming” circulates again — EWD667 · HN; Per-request AI CO₂: a Kimi K3 request emits 0.38 g in Sweden vs 3.2 g in Texas, almost entirely because of grid intensity — Berget AI · HN

AI & Automation

How does Fable 5.1 hide messages in images?

Researchers found that Fable 5.1, which draws images as SVG code, hides secret messages without any steganography training. It encodes them in object heights (star height = the letter’s position in the alphabet), rotation angles, colour values and Morse-like gap patterns. A separate model instance recovered 78% of the hidden messages from screenshots alone. When the model cannot encode special characters directly, it adds visual hints, such as rooftop lines for accents or flags for capitals. When prompted in Russian, it switches to Cyrillic height encoding.

LessWrong · HN

Claude Code: every “Allow edit” may count as training feedback, regardless of settings

A Max-plan user points to the header comment in every Claude Code binary from 2.1.283 to 2.1.309. It states that all acceptance or rejection of code counts as “feedback” under Anthropic’s Commercial Terms, even when “help improve Claude” is off. The distinction appears to be between the UI toggle and the beta-product terms that users accept on first launch. Anthropic has not responded. Paid users who assumed that the toggle covers all data use should read the terms themselves.

r/ClaudeAI

Can LLMs supercharge geolocation? Bellingcat says big improvements, but humans remain key

A test photo from the study, annotated to show the only man-made object in the scene. Photo: Bellingcat

Bellingcat ran 17 models against 52 unpublished photos with no metadata, including night and fog scenes. The best models narrow down a location faster than humans, but they place only about half the images within 25 km. Claude Opus and Fable ranked highest overall, and Gemini 4 Argon led on precision. Even Bellingcat’s custom setups with satellite imagery and OpenStreetMap remained imperfect. Bellingcat concludes that the models are useful to narrow the search, but they do not replace human verification.

Bellingcat

LiveNerf day 29: no measurable change in Opus 5.5 after a month

A pre-registered 29-day benchmark finds no statistically significant change since launch. Window 1 (days 11–20) shows a delta of +0.007 ± 0.018 against the launch-week baseline. Median output tokens are slightly up (606 vs 588), and token count is the signal most likely to move first if thinking effort were quietly reduced. The benchmark uses UK AISI’s Inspect framework and 78 calibrated questions from GPQA Diamond, MMLU-Pro and competition maths. The verdict for window 2 comes after day 30.

GitHub · r/ClaudeAI

NVIDIA OpenShell: kernel-isolated sandboxes for agent fleets, with formally verified policy changes

OpenShell (Apache 2.0) gives each agent a sandbox with kernel-level limits on file access, network and credentials. Before a new permission is approved, the policy change is formally verified for risk instead of only reviewed by a person. It is for teams that run autonomous agents with real shell capabilities.

GitHub · HN

Carbon-X: an open 14.8B model trained jointly on DNA and text

Average DNA benchmark score vs cost per problem, Carbon-X and frontier models. Chart: Hugging Face

Hugging Face Bio mid-trained Qwen3-14B on 302B tokens: 55% raw DNA as 6-mer tokens in the same stream as text, plus English, biology documents and instructions. Training then used SFT and two rounds of async GRPO with verifiable rewards. Carbon-X averages 66.7% across five DNA benchmarks, 27 points above its starting checkpoint. Analysing 2.4 million ClinVar variants would cost about $300, against $32K–$4M with frontier models, and the model fits on consumer hardware.

Hugging Face · r/MachineLearning

Also today

Next-Concept Modeling generates text as a coarse-to-fine hierarchy of VQ codes: 21–31× faster than diffusion LMs at equal or better quality — arXiv · r/MachineLearning
Opus 5.5 as planner and reviewer over three parallel local workers: a full coding task for about $2 — AtomicAgent · r/ClaudeAI
Insurance approval queues cut from 8 hours to 30 seconds by moving specialist judgment into an agent loop — r/automation

cd ~/repos/josse-posten && claude --resume effe69fc-0ad2-4d6b-9952-142ff1e2326d