Sudan: RSF drones knock out eastern power grid; 30+ nations warn of famine

The Rapid Support Forces launched a coordinated drone assault on five power stations in eastern states still held by the army, causing mass blackouts. The US, EU and more than 30 countries warned of famine risk and called on all parties to lift impediments to humanitarian access. The UK sanctioned senior Sudanese military commanders on the first anniversary of the El Fasher atrocities, specifically for their role in a “campaign of rape”.

Brazil: Bolsonaro concedes, markets crater, his passport seized

Flávio Bolsonaro effectively conceded after Trump cast doubt on the result but declined to back him, and his party formally accepted the outcome. He was barred from leaving the country and ordered to surrender his passport amid a money-laundering case. Brazilian stocks, rates and the real fell sharply, some stocks by 50%; the Economist called the result “bad for markets, and for good reason”. In his victory speech, Lula vowed to regulate social media giants.

Comey charged a third time; his daughter’s firing ruled illegal

The Trump administration has charged former FBI Director James Comey for a third time, now alleging he leaked classified information to the New York Times in 2016. His lawyers call the prosecution time-barred. Separately, a federal judge ruled that the administration illegally fired his daughter Maurene Comey, a Manhattan federal prosecutor for a decade who worked on the Epstein cases.

Courts also twice blocked the DOJ’s pre-midterm ballot moves: an appeals court rejected its bid to stop California counting ballots from 20,000 alleged non-citizens, and a separate effort targeted over 400 ballots in Washington state.

Guardian exclusive: US accused of weaponising Somalia’s El Niño floods

A Guardian investigation alleges that US airstrikes on al-Shabaab-held territory are systematically pushing civilians toward flood-prone river areas as El Niño raises water levels to dangerous heights — raising the question of whether displacing civilians into rising waters is a deliberate tactic.

Serbia’s Student List begins government talks

After ousting Vučić, the leaderless Student List is preparing coalition talks to form a government. Thousands celebrated for a second night in Belgrade while volunteers cleaned up the encampment that pro-government thugs had used to intimidate opponents. NRK sums up the list as young people without political experience — Marxists, anarchists and nationalists — after two years of protests and university blockades.

Massacres of Christians: Jordan retaliates in Syria; 60+ killed in Ethiopia

Jordan’s air force struck armed groups in southern Syria in retaliation for last week’s attack on a Greek Orthodox church in Karak that killed nine. Syrian health officials said five people, including women and children, died in the strikes. In Ethiopia’s Oromia region, more than 60 Christians were killed and over 20 injured in what a witness described as a deliberate ambush; around 20 homes were burned.

Oleshky ceasefire takes effect

The local ceasefire in Russian-occupied Oleshky, brokered by Melania Trump, took effect Tuesday morning, allowing aid deliveries and civilian evacuations from a city where residents had been surviving on weeds. The pause covers a single city — a sign of how fragmented and piecemeal Ukraine diplomacy has become.

Storm Shadows hit Russia’s only glide-bomb battery plant

Storm Shadow missiles hit the Energia plant in Yelets — Russia’s only maker of power sources for FAB glide-bomb guidance kits, Iskander-M missiles and sea-launched cruise missiles — with at least seven impacts on separate buildings. A drone hit the Voronezhsintezkauchuk petrochemical plant in Voronezh, and an ammunition depot near Khrustalnyi in Luhansk Oblast burned with secondary detonations. Near Yekaterinburg, 20 freight cars derailed, setting seven fuel tankers on fire and halting traffic both ways.

Ukraine retakes three villages near Velyka Novosilka

Ukrainian forces have retaken Perebudova, Komar and Fedorivka near Oleksandrivka, forcing Russia to divert naval infantry and tank units from planned offensives toward Druzhkivka and Huliaipole. The push is slow but threatens a key Russian logistics road network.

Europe steps up as Romania breaks a Russian sabotage ring

The EU mobilised €4.9B under the European Peace Facility. France licensed Ukraine to produce Aster 30 missiles, SCALP cruise missiles and AASM Hammer bombs domestically, and the defence ministers of France, Germany, Italy, Poland and the UK met in Paris to coordinate further aid as US transfers stall.

Romanian intelligence dismantled a Russian-coordinated network that tried to burn the Carfil arms factory in Brașov; suspects were also arrested in Germany and Poland. The Baltic Sentinel counts 54 Russian hybrid incidents across Europe in six months — sabotage, arson, cyber operations and assassination plots — and finds them growing more dangerous. A UN panel, meanwhile, concluded that Russia is committing crimes against humanity in Ukraine.

Stormen «Boelo»: Bryggen flommet, E6 stengt, danskebåten snudde

Høststormen «Boelo» slo inn over Vestlandet og Østlandet mandag. Bryggen i Bergen ble stengt da vannet gikk over bryggekanten, og brannvesenet rullet ut oppblåsbare flomsperrer langs trebebyggelsen. Nordic Crown snudde i Skagerrak og nådde ikke Oslo. E6 mellom Vingrom og Biri ble stengt etter tre separate oversvømmelser, men er nå åpen igjen. Stavanger og Haugesund fikk også flom.

Forsvaret bruker 400 kinesiske droner – og vil ha mer Starlink

Forsvaret bruker rundt 400 droner med kinesiske komponenter, bekrefter regjeringen. MDG kaller det naivt og krever samtidig stans i Forsvarets Starlink-utbygging på grunn av avhengighetsrisiko. Stortinget stemte i fjor ned et forslag om å forby kinesisk droneteknologi i staten. Regjeringen skal utrede dronebehovet for 2027.

Peter Frølich smuglet termiske droner til Ukraina – så endret han loven

Høyres Peter Frølich forsøkte i 2023, gjennom organisasjonen Fritt Ukraina, å sende sivile termiske droner til Ukraina via Kielferja. Da tollvesenet stoppet sendingen med henvisning til en forskrift fra 1950-tallet, sendte han dronene likevel. Dagen etter hastebehandlet regjeringen en forskriftsendring, og reglene tillater nå eksplisitt eksport av sivile droner til Ukraina. «Noen ganger må du følge magefølelsen og gjøre det som åpenbart er riktig», sier Frølich.

Borr Drillings rigg sank utenfor Gabon – fem savnet

Riggen «Prospector 5» sank lørdag kveld utenfor Gabon etter å ha mistet stabilitet under forberedelser til et boreoppdrag. Fem personer er fortsatt savnet. Aksjen falt markant på Oslo Børs, og analytikere peker på likviditetsrisiko for selskapet.

Sør-Varanger uten vann: Kirkenes sykehus på rød beredskap

Et brudd på hovedvannledningen søndag kveld etterlot 6 000 innbyggere uten vann. Kirkenes sykehus gikk på rød beredskap, og rørdeler måtte flys inn. Vannet ventes tilbake tidligst tirsdag kveld. Kommunen ser ingen indikasjon på sabotasje.

Harbardsbreen er delt i flere deler

Harbardsbreen i Vestland, en av Norges lengste isbreer, har smeltet så kraftig at den nå er delt i flere separate deler. Endringene har akselerert de siste elleve årene; NVE fryktet allerede i 2015 ukontrollert flom fra breen. På Svalbard viser nye flybilder av Forkastningsfjellet at store arealer synker og andre hever seg når permafrosten tiner.

NTNU: Studenter som brukte KI mye fikk to karakterer dårligere

En NTNU-studie av 160 førsteårsstudenter våren 2026 fant at storbrukere av KI fikk 3,2 i snitt på eksamen, mot 5,1 for dem som ikke brukte KI. Forskjellen holdt seg etter kontroll for kjønn, tidligere karakterer, foreldres utdanning og programmeringserfaring. Forsker Thomas Østerlie understreker at dette er korrelasjon, ikke kausalitet: svake studenter kan selv velge å lene seg tungt på KI. Rektor Tor Grande: «Det finnes ingen teknologisk snarvei.»

NRK, TV 2 og Schibsted saksøker Meta

De norske mediegigantene tar Meta til norsk rett med begrunnelse i frykt for journalistikkens økonomi.

Kinesisk bussleverandør saksøker Unibuss for en halv milliard

YES-EU, som representerer kinesiske CRRC, krever rundt 500 millioner kroner etter at Unibuss avbestilte 250 busser i januar 2022. YES-EU mener avtalen var inngått; Unibuss sier ingen bindende kontrakt ble signert og at pris og leveringstid fortsatt var åpne. YES-EU hevder også at Ruter presset Unibuss til å trekke seg fordi bussene var kinesiske.

eMudhra fallout: Apple blocks, Go ships its first-ever emergency release

Mozilla found that eight eMudhra intermediate CAs (six TLS, two code-signing) had trivially recoverable private keys — one was literally 4 — letting anyone impersonate arbitrary TLS servers. Apple blocked them in Safari and iOS from Oct 19 and the emSign ECC Root CA from Oct 23; macOS CLI tools (curl, git, openssl) follow in an upcoming update. Go’s security team issued its first URGENT-track release, Go 1.27.3 and 1.26.10, 7.5 hours after notification. Gram 3.4.0 shipped an emergency patch for rustls-webpki and webpki-roots.

Headless servers, containers and reverse proxies don’t auto-update their trust stores: check that cacerts is current and audit software that bundles its own CA store. Determinate already patched cacerts and found dozens of bundlers in the Nix closure needing separate fixes.

Cloudflare Workers AI leaked other customers’ data through a KV cache bug

Between Aug 27 and Sep 9, GLM-5.3 on Workers AI returned 155 responses containing data from other customers’ earlier requests. The cause: a 1M-token context window paired with a 681K-token GPU KV cache pool, plus an SGLang bug. Oversized requests were rejected but still processed — prefill cached a placeholder token while decode read stale pages from prior requests. Cloudflare found no evidence of exploitation; it doubled the pool and patched SGLang to reject oversized requests at admission.

The passkey is worse: phishers register their own and survive a password reset

A phishing postmortem describes a persistence trick: after stealing credentials and a 2FA code through a fake Google login, the attacker registered their own passkey on the account. Since a passkey replaces both password and second factor, access survives a password reset. Only a notification about the new passkey gave it away. The author argues that passkey recovery and notification UX is not yet built for this threat model.

C++26 fails its DIS ballot — a first for a C++ standard

Nine national bodies voted no on Oct 23 — Denmark, Finland, Iran, Italy, Japan, Luxembourg, Romania, Spain and Sweden — over contracts, whose design lets implementations ignore the checks entirely. The committee must now seek another ballot, with or without contracts, or move contracts to a Technical Specification so reflection and library hardening can advance.

Microsoft offers buyouts to a quarter of its workforce

Microsoft is offering voluntary separation packages to about 60,000 employees in the US, Canada, India and the UK — roughly 25% of staff — according to Bloomberg and an internal memo from HR chief Amy Coleman. Ex-employees on HN describe years of bloat: repeated reorgs, misaligned headcount and drift from technical execution.

Microsoft’s Type Server Protocol: LSP for Python types

The Pylance team published TSP, a JSON-RPC protocol for querying a type server for declared, inferred and expected Python types. It shares LSP data shapes but separates type analysis from general editor services, with multiple read-only channels for concurrent queries beside a single state-mutation channel. Python-only for now, but the pattern suits type-aware agents and refactoring tools in any typed language.

Stalwart 1.0: a full Rust mail stack — pin your Docker tag first

Stalwart 1.0 ships IMAP, POP3, SMTP, JMAP, CalDAV, CardDAV and WebDAV. Against Postfix 3.11 and Dovecot 2.4 it claims wins on 35 of 38 metrics — inbound SMTP 3.6–12× faster, IMAP login 5× faster — through SIMD/SWAR parsers and a redesigned full-text search engine. New: search inside PDF/Office/EPUB attachments, OAuth/OIDC with per-client scopes, and post-quantum DKIM2 signatures (ML-DSA-44 + Ed25519).

The catch: 1.0 cannot open a 0.16 store, and latest already points to 1.0. Anyone on watchtower gets a broken mail server on the next pull. Pin v0.16 now and migrate deliberately on a copy of the data — done that way, the migration reportedly goes fine.

Linux 7.3’s eBPF binfmt_misc hooks: a path to relocatable Nix binaries

A Discourse thread explores using Linux 7.3’s eBPF-powered binfmt_misc hooks to give Nix binaries and scripts $ORIGIN-relative interpreter paths alongside their absolute /nix/store paths, so the store could move without breaking executables. The proposal adds a PT_INTERP_NIX ELF section, with the absolute path as fallback on older kernels. fzakaria, co-author of the kernel patches, plans a NixOS module for the eBPF handler and wants to propose the pattern to Debian and Fedora.

Determinate sells emergency security coverage for NixOS 25.05

NixOS 25.05 has been unpatched since December 2025, leaving hundreds of CVEs open across curl, OpenSSL, Node, PHP and Brotli (CVE-2026-111497, RCE). Prompted by this week’s disclosures, Determinate launched a paid Emergency Legacy Extension with its usual CVE-remediation SLA, guaranteed through Q4 2027. It starts at roughly 1,000 packages and includes FlakeHub cache access and CycloneDX SBOMs.

HACS becomes the Home Assistant Marketplace in 2026.11

From HA 2026.11, due in about ten days, HACS is built in under Settings → Marketplace. Everything migrates automatically and stays free; installing an integration drops you straight into its setup flow without a restart. Standalone HACS can no longer be installed on 2026.11+. If you were about to install HACS: wait.

Ukishima: a dynamic-island Quickshell for Hyprland and Niri

A morphing pill at the top of each monitor expands in place into a launcher, system monitor, media controls, mixer, clipboard history, wallpaper and emoji pickers, or power menu. A dock with hover magnification and window previews sits at the bottom, plus a lock screen, per-output OSD, screen recorder and timer. It never touches your compositor config beyond the launch line. MIT licensed.