Josse-posten

Thursday, 2026-10-29  🛩️🕯️🔓

Ukraine sends its biggest drone swarm yet at Moscow while Europe is told to wait outside the November talks. In Norway, data centres put the price of power on the political agenda.

Ukraine fires 613 drones at Moscow, its largest attack yet on the capital

Smoke over the Bashkir Soda Company plant in Sterlitamak after the drone strike, 29 October. Photo: Militarnyi

Ukraine launched roughly 613 drones at Moscow overnight 28–29 October. It was the largest single-night drone attack on the capital, and it closed Vnukovo, Domodedovo and Zhukovsky airports. Russia says it shot down 231 drones near the city. Footage shows a damaged apartment block in Kotelniki. In a separate strike about 1,400 km from the border, drones hit the Bashkir Soda Company plant in Sterlitamak. The plant is Russia’s only producer of terephthaloyl chloride, which is used in body armour. Russia’s own overnight attack used 112 drones. Ukraine says it shot down 97 of them, 40 of which were jet-powered Shaheds.

Kyiv Independent · Ukrainska Pravda: 613 drones · Ukrainska Pravda: Russian attack · Militarnyi · Al Jazeera · r/UkrainianConflict

Britain pledges £10 billion as Europe is kept out of the November peace talks

Britain announced its largest Ukraine package so far: £10 billion ($13.3B) for 2027. It includes World Bank guarantees, £500M for winter air defence and £3B in export finance for weapons. In The Hague, Zelenskyy announced a joint air-defence initiative with the Netherlands. Kremlin aide Ushakov confirmed that no European representatives will attend the planned November US–Russia–Ukraine talks. He also said that Moscow is discussing sanctions relief with Washington. Russia repeats its 2021 demand that NATO return to its pre-1997 borders. ISW assesses that the Kremlin is getting concessions from the US without offering any of its own. On the same day, Brussels told both Washington and Moscow that Nord Stream will not reopen after the war. (More in Ukraine)

Kyiv Independent · Ukrainska Pravda: Netherlands · Ukrainska Pravda: Ushakov · ISW · Euronews · r/ukraine

Russian satellites guide Iran’s proxies against Saudi Arabia, and the US warns of strikes after the midterms

AP reports that Russian military reconnaissance satellites help Iran’s proxy forces find and target sites inside Saudi Arabia. This takes the Russia–Iran military axis beyond Ukraine and into the Gulf. AP sources also say that the US has told allied governments to prepare for possible Iranian strikes in the period after next week’s midterm elections. The US has not said publicly what Iran would be retaliating for.

The Moscow Times · AP

NVE: Datasentre kan gi 55 prosent høyere strømpriser innen 2035

NVE-direktør Kjetil Lund. Foto: Aftenposten

NVE varsler at strømprisene kan stige med 35–55 prosent innen 2035 hvis datasentrene fortsetter å vokse i dagens tempo uten ny kraftproduksjon. «Da får vi en helt ny situasjon», sier NVE-sjef Kjetil Lund, som advarer om kraftunderskudd og vil ha et køsystem for datasentre. Saken har allerede blitt politikk: Senterpartiet vil stanse alle nye datasentre og firedoble elavgiften for dem, Fellesforbundet krever full byggestans, og Trond Giske og AUF støtter en pause.

Aftenposten · DN · TU.no · Digi.no: Sp · Digi.no: Fellesforbundet

Spain’s deadliest rail disaster since 2013: 68 dead in Toledo province

Rescue workers at the collision site near Urda, 28 October. Photo: Aftenposten

A high-speed train on the Madrid–Andalusia line hit another train from behind near Urda. At least 68 people died. This is Spain’s second high-speed accident this year. Reports say the rear train passed a red signal, and the transport minister called the cause “inexplicable”. Spain has declared three days of national mourning, and the Civil Guard has set up DNA clinics to identify the victims. In the evening, protesters clashed with riot police outside the government building in Madrid. According to El País, a far-right group was among the organisers. A general election is approaching.

BBC · The Guardian · NPR · Al Jazeera · Aftenposten · NRK

Hacktivists publish 41,000 DHS and ICE identities, the third major leak in a month

Distributed Denial of Secrets released personal data on more than 41,000 Department of Homeland Security employees and contractors. The data includes ICE agents, covert operatives and counter-intelligence staff. The group calls the release a transparency measure. Critics say it exposes immigration officers to harassment or harm. It is the third large disclosure of US government data in less than a month.

BBC · The Guardian · NPR · Aftenposten · Digi.no

Indicator Value Change
S&P 500 (f) 7,760 -0.30%
Dow 30 (f) 52,976 +0.53%
Nasdaq (f) 29,638 -1.14%
Russell 2000 (f) 2,854 +0.51%
VIX 17.14 +1.36%
Gold 4,043 -0.20%
BTC $79,916 -1.78%
USD/NOK 9.29 +0.38%
  • Futures are split: the tech-heavy Nasdaq is down 1.14% while the Dow and small caps rise. The Fed held rates, and markets widely expect a hike in December (see World).
  • European gas storage is at a 15-year low, and the forward price is at a record €100/MWh (see Norway).

World

Israel: the final count confirms deadlock, and coalition talks begin

With nearly all ballots counted, Netanyahu’s bloc has about 53 Knesset seats. A majority needs 61. Eisenkot’s opposition also falls short. Formal coalition talks have begun. Analysts say the most likely outcomes are a new election or a coalition that depends on Arab parties. The Economist urges the Jewish and Arab opposition parties to cooperate quickly, before Netanyahu turns the deadlock into another term. In the occupied West Bank, video shows armed settlers in Umm al-Khair beating a US journalist and an Israeli-Russian activist. A separate clip shows an attack on three foreign journalists in the same area.

BBC · The Guardian · The Economist · Dagsavisen · Al Jazeera: settlers · Al Jazeera: video

Book alleges Kushner ran slush funds to influence his Middle East role

A new book claims that two slush funds were set up to influence Jared Kushner’s Middle East diplomacy during Trump’s first term. Kushner denies the claims and has threatened to sue. The allegations raise questions about how private foreign money and official US foreign policy are connected, especially because Kushner still has business interests in the region.

The Guardian

US midterms five days out: judge blocks DOJ bid to hold back California ballots

A federal judge rejected the Justice Department’s unprecedented demand to separate and withhold California ballots from voters it claimed were non-citizens. The judge called the legal basis thin. The DOJ appealed immediately. Obama campaigned in suburban Atlanta for Jon Ossoff, and polls show close races in several states.

The Guardian · NPR · Al Jazeera

North Korea fires about ten ballistic missiles as the landmine dispute escalates

North Korea fired about ten short-range ballistic missiles towards the Sea of Japan, according to South Korean and Japanese authorities. At the same time, Seoul accuses Pyongyang of planting landmines that exploded near the demilitarised zone and injured three South Korean soldiers. North Korea denies this.

Al Jazeera · AP · Aftenposten

Amnesty: Cambodian police and soldiers ran security inside scam compounds

A new Amnesty International report says that serving Cambodian police and military officers worked as guards inside online fraud compounds. The report says they personally gave electric shocks and beatings to the trafficked people who were forced to work there. If the findings are correct, the Cambodian state took part in the crime directly and did not merely tolerate it.

The Guardian

Europe’s young and the streets: 2.8% of the wealth, new laws against protest

Europeans under 35 hold just 2.8% of household wealth, about one-eighth of what older households hold. BBC analysis finds that the youth protests of the past month share one cause: a generation locked out of housing, job security and political representation. At the same time, governments are making it riskier to protest. The French Senate passed a bill that makes everyone present at a protest that turns violent pay for damage, whatever their own conduct. Albania now fines people more than $6,000 (six times the average monthly salary) only for attending such a protest. In Serbia, days after students defeated Vučić, protesters entered the studio of a pro-regime TV channel and confronted its editor-in-chief live on air.

Al Jazeera: wealth gap · BBC · Guardian: Albania · RTL Today · Al Jazeera: Serbia · Guardian: Serbia podcast

Sudan: airstrikes on a Darfur market kill more than 100

Airstrikes on a crowded market in Darfur killed more than 100 people. Witnesses say that the strikes hit shopkeepers as well as RSF fighters. Doctors Without Borders called the attack “appalling”.

Al Jazeera

Also today

Americas
Flávio Bolsonaro, now in Miami, deleted a post that called himself “true president-elect” and now calls himself “leader of Brazil” — BBC · Guardian · NPR
El Salvador doubles its Haiti force to 2,000 troops after four soldiers disappear in a gang ambush. Haiti delays its elections — BBC · Al Jazeera
The Federal Reserve holds rates. Markets widely expect a hike in December — NPR
Europe
The EU backs away from associate-membership talks with Canada and offers only “ever-closer association” — Guardian
The Dutch PM says Europe will not return to Russian gas, whatever the peace deal — Kyiv Post
The Netherlands withdraws from Eurovision again because Israel is taking part — NRK
Health & climate
Ebola: Africa CDC chief Jean Kaseya warns that the DRC outbreak could reach the UK and Europe without more funding — Guardian · Al Jazeera: last patient leaves a centre
Oxfam: the richest 0.1% emit more carbon than the poorest 3.5 billion combined — CGTN

Ukraine

Ukrainian economist Tymofiy Mylovanov, citing Bill Browder, reports that Trump cut prepaid Starlink access and weapons deliveries after Zelenskyy refused to stop striking Russian refineries. According to the report, Putin had asked Trump for that halt. The Pentagon’s inspector general rejected a bipartisan request to investigate the Starlink disruptions. Putin called Elon Musk a “real genius” and said that the two are in “close” contact. Russia also announced its own military satellite network as an alternative to Starlink. Zelenskyy replied that Ukraine mainly uses Starshield, the US government-contracted version, which shifts the question of responsibility to Washington. In a new op-ed, he explains why he and Trump disagree on the path to peace. Lavrov insists that the October diesel deal has “no conditions whatsoever”, which contradicts earlier Kremlin statements.

r/UkrainianConflict: Browder · Ukrainska Pravda · BBC · The Guardian · Kyiv Independent · Kyiv Post · Zelenskyy op-ed · ISW

Oleshky: the route home goes through Russia and Belarus

Fox News published photos of the signed ceasefire agreement. They show that Oleshky residents who want to return to Ukraine must first travel to Anapa in Russia and then to Gomel in Belarus on 31 October. The agreement does not say how they get from Belarus to Ukrainian-controlled territory. The ceasefire has held so far: both sides’ human rights commissioners report no violations in the first 30+ hours. Melania Trump confirmed that it now covers all of Kherson Oblast for humanitarian convoys. The Atlantic argues that the whole operation is a press event managed by Russia and not a real humanitarian corridor.

Fox News · The Atlantic · ISW · r/UkrainianConflict

Frontline: Ukrainian gains near Oleksandrivka, Russian probe north of Kostyantynivka

Ukrainian forces have advanced to central Novomykolaivka, cleared Zaporizke and Kalynivske, and cut Russian supply lines from Obratne. This continues the slow pressure on the Velyka Novosilka hub. Northeast of Hulyaipole, Ukrainian positions near Uspenivka are now 6.7 km from Poltavka. Russian forces have entered Klynove, north of Kostyantynivka. ISW notes a possible future risk to the flank of Oleksiievo-Druzhkivka. In Kupyansk, Operation Veles has stopped Russia from using the underground pipelines for infiltration, but some Russian troops remain in the northern districts.

ISW · Ukrainska Pravda

Also today

  • Poland and the UK sign the Warsaw Defence Plan to deter Russia — Notes from Poland
  • Russia moves to legalise cars stolen from Europe, Canada and Ukraine — United24 Media

Norway

Støre–Putin-samtalen: FT vil ikke rette, kritikken vokser

Jonas Gahr Støre og Alexander Stubb i Oslo. Foto: Financial Times

Financial Times avviser statsminister Jonas Gahr Støres krav om å rette artikkelen der kilder beskriver hvordan Putin foreleste for Støre og Stubb om russisk historie. Ifølge FT varte samtalen 90 minutter, selv om den var satt opp til 30. Danmark og Sverige har tatt avstand fra initiativet. En pensjonert norsk general kaller samtalene «et absurd teater». Kommentatorer påpeker at Støre og Stubb før eller senere må svare på at Putin fortsetter krigføringen.

Dagsavisen: FT · Dagsavisen: general · Dagsavisen: kommentar · Financial Times · r/Norway

PST venter russisk sabotasje, NSM hever cyberrisikoen

NSM-direktør Sofie Nystrøm på pressekonferansen. Foto: Digi.no

PST mener Russland tar stadig større risiko i sine skjulte operasjoner, og forventer at Norge blir utsatt for sabotasje. Vurderingen bygger blant annet på et avansert hackerangrep mot polsk infrastruktur. PST ser også at Russland går fra etterretning til aktiv forstyrrelse. Nasjonal sikkerhetsmyndighet har hevet risikonivået for cyber til nest høyeste nivå, etter at antallet vellykkede angrep mot norske virksomheter er tredoblet. Bransjen kaller det «et covid-øyeblikk for cybersikkerhet». Justisminister Astri Aas-Hansen har bedt om å få orientere Stortinget om PST. På r/norge diskuteres direkte trusler mot Norge på russisk statsfjernsyn: er det reell opptrapping eller teater for hjemmepublikummet?

Dagsavisen · Digi.no: NSM · Digi.no: kommentar · Aftenposten · r/norge

Norske medier vant fram: Meta stanses midlertidig

Oslo tingrett har gitt midlertidig forføyning mot Metas planlagte endringer i vilkårene for bedriftskontoer, som skulle tre i kraft 20. november. Mediehusene mente endringene var ensidige og muligens ulovlige. Meta kan ikke innføre dem før lovligheten er vurdert.

NRK · Aftenposten

Pasienter protesterer mot nye retningslinjer for ME og long covid

Pasienter og pårørende demonstrerte på Eidsvolls plass i Oslo mot utkastet til en felles norsk veileder for «langvarig utmattelse», som skal dekke ME og long covid med PEM. Hovedinnvendingen er at utkastet ikke beskytter godt nok mot anstrengelsesutløst symptomforverring (PEM). PEM er kjernesymptomet som skiller ME og long covid fra vanlig utmattelse og krever en helt annen oppfølging. Aktivistene frykter at en generisk kategori åpner for gradert trening og «push-through»-tilnærminger som kan skade pasientene.

r/oslo

Ukraina: 500 millioner til energi – og 67 000 kan få nei til opphold

Norge gir 500 millioner kroner for å sikre ukrainsk energiforsyning gjennom en ny vinter med russiske angrep. Landene har også signert en avtale om at norsk kraftplanlegging skal bygge på ukrainske erfaringer fra drift under bombing. Samtidig risikerer 67 000 ukrainske flyktninger i Norge å få nei til forlenget opphold fordi de ikke oppfyller inntektskravet.

TU.no: støtte · TU.no: avtale · NRK

Etikkrådsleder truer med å gå

Svein Richard Brandtzæg, leder av Oljefondets etikkråd, vil ikke lede det som kan bli en «tannløs intern rådgivingsgruppe» hvis Gjedrem-utvalgets forslag blir vedtatt. Forslagene vil fjerne rådets selvstendige myndighet til å anbefale utelukkelse og legge rådet inn under NBIMs egen styring. Rådsmedlem Johan Andresen og varamedlemmer sier det er naturlig å vurdere om de skal fortsette.

E24: trussel · E24: Gjedrem · DN

Sterkeste fra Equinor siden 2022 – og Afrodite kan være dobbelt så stort

Equinor leverte et justert driftsresultat på 12,35 milliarder dollar i tredje kvartal, det beste siden 2022. Høye priser og rekordinntekter fra trading trakk opp, og tradinginntektene så langt i år er allerede høyere enn for hele 2025. Opedal advarer om at de europeiske gasslagrene er på det laveste nivået på 15 år før vinteren, og prisen på europeisk gass er over 100 euro/MWh. En ny avgrensningsbrønn ved Afrodite nær Kvitebjørn viser at funnet kan være dobbelt så stort som antatt. Kongsberg Gruppen fikk 11,3 milliarder kroner i inntekter, slo forventningene og har rekordhøy ordrebok. Aksjen steg rundt 6 prosent. På r/norge diskuteres selskapets kamuflerte rakettutskyter, som ser ut som en vanlig ISO-container.

E24: Equinor · Aftenposten · TU.no · E24: gasspris · E24: Kongsberg · DN · r/norge

Gjensidige kutter 40 i teknologi – mens Anthropic går på børs

Gjensidige kutter rundt 40 årsverk, eller ti prosent, i avdelingen Technology & Insights, bare uker etter et kvartalsresultat som var 32 prosent bedre enn i fjor. Selskapet begrunner kuttene med «mer effektive arbeidsprosesser» og innrømmer at KI påvirker ressursplanleggingen. Utviklerne må søke på nytt på sine egne stillinger. DNB gjorde det samme regnestykket tidligere i år. DN beskriver Anthropics børsnotering som historiens kanskje største, med en struktur som gir investorene lite å si. Digi.no skriver om prospektets detaljer om Nscale-avtalen.

kode24 · Digi.no: Gjensidige · DN: podkast · DN: kommentar · Digi.no: Nscale · r/norge

Norway — Street Level

To måneder med en mikrofon på taket: Oslos bråkmakere

Ulovlig støyende kjøretøy (blått) mot utrykningssirener (gult), time for time gjennom 57 døgn. Kilde: torvald.no

En utvikler i Uelands gate monterte en kalibrert mikrofon på taket og registrerte alle lyder over 72 dB i 57 døgn. Lydene ble kategorisert med en KI-klassifiserer og manuelle stikkprøver. Resultatet var 4509 ulovlige støyhendelser, i snitt 79 per døgn. På kveldene var det én hvert ellevte minutt. Hver hendelse bryter tre lover, men ingen håndheves. Den mest støyende tidelen av kjøretøyene er omtrent fire ganger høyere enn grensen. Utrykningssirener brukes som kalibreringskontroll, fordi lydnivået deres er fastsatt i forskrift. Forfatteren foreslår håndholdte støymålere i trafikkontroller (Brussel fjernet 35 prosent av synderne slik i 2025) og støytellere på Statens vegvesens eksisterende målepunkter.

torvald.no · r/oslo

Telenor-sjefen gikk i DN ut mot Musks satellittinternett, nå som Starlink begynner å presse de norske bredbåndsprisene. På r/norge kommer mange frustrerte forbrukere til orde. Utenfor byene har mange hatt én leverandør i flere tiår og betalt noen av verdens høyeste priser.

r/norge

Også i dag

Krim og rett
Bhatti-saken: aktor ber om 30 års forvaring i lagmannsretten — NRK · Dagsavisen
Steinar Wangen dømt til 15 års forvaring i Agder lagmannsrett — Aftenposten
Tre pågrepet etter skyting i Drammen, og én pågrepet etter væpnet aksjon på Andøy — Aftenposten · NRK: Vesterålen
Tingretten avviser forsøket på å oppheve arresten av det russiske skipet «Professor Moltsjanov» på Svalbard — NRK
Samfunn
Bibliotekene sliter med rusavhengige gjester. De ansatte har fått nalokson og kurs i å takle vold — NRK
Tromsø, Vågan og Stranda får innføre besøksbidrag fra nyttår — NRK
SAS-streik er i gang: 24 kabinansatte i SAS Link har gått ut — NRK · E24
Sport
Vektløfter-VM til Russland: Norge sender ikke utøvere hvis situasjonen ikke endres — NRK
Kjempesmell for Ødegaards Arsenal: ute av ligacupen mot nivå fire-laget Fleetwood — NRK

Tech

GitLab CVE-2026-97229 (CVSS 10.0): a regex crash in Ruby’s Onigmo, exploited in the wild

A critical flaw in Onigmo, Ruby’s regex engine, lets malicious CI configurations crash GitLab worker processes. On 20–21 October, an attacker probed Alpine Linux’s GitLab instance, crashed workers eight times and got a copy of Alpine’s GitLab container image. No code execution or data tampering was confirmed, but Alpine rebuilt the whole system. The catch: upgrading to GitLab 19.3.6 is not enough. The fix is in Ruby 3.3.13+, so many self-hosted instances are probably still vulnerable.

Alpine Linux · HN

Apple’s git still trusts the compromised eMudhra CA, and macOS 27.2 undid the workarounds

Apple’s bundled git, curl and python3 still trust certificates from eMudhra, a CA whose compromise was disclosed on 17 October. macOS 27.2 (26 October) also silently turned trust back on and undid the mitigations that users had applied by hand. An attacker on the network path can intercept clones and pulls from any HTTPS git remote, inject code or steal GitHub tokens. Dozens of open-source projects shipped fixes within days. Apple has not.

emudhra.we-have-a-problem.com · Lobsters

Orange Tsai: a full Microsoft Edge chain with logic bugs only

Orange Tsai’s write-up describes a full browser-to-OS exploit without a single memory-corruption bug. The chain combines a navigation throttle that does not check cross-window origins, a UXSS, a popup-blocker bypass through Microsoft’s own URL allowlist, OneAuth auto-sign-in, a CORS leak on assets.msn.com, an Immersive Reader read:// escape, and file writes through the Feedback API with null-byte injection. It ends by writing to protocols.json to launch an arbitrary protocol handler. The argument is that logic bugs survive the move to memory safety, and that humans still find them better than automated tools do.

blog.orange.tw · Lobsters

The case of the 9-bit AES key

Several major PDF libraries advertise AES-256 encryption but generate keys from almost no entropy. MuPDF seeded its RNG with 9 bits of timestamp, so any two documents created in the same 512-second window got identical byte streams. Foxit hashed the timestamp with a constant and zero bytes. OpenPDF and iText used millisecond timestamps plus JVM free memory. These “encrypted” documents can be brute-forced in milliseconds to minutes. MuPDF is patched, but documents encrypted with old versions stay vulnerable permanently.

v12.sh · HN

Why is this fingerprinting script creating bioweapons?

An AI model refuses to deobfuscate the script, which is the result the obfuscation was built to trigger. Screenshot: nullpt.rs

A researcher deobfuscated a fingerprinting script from the Russian anti-DDoS company Servicepipe. The script is full of function names like computeRicinLethalDosageForWaterSupply and fake system prompts about bioweapon synthesis. The script itself only collects ordinary WebGL and navigator fingerprints. But when the code is given to an AI model for analysis, the safety filter refuses. The model’s guardrails become a shield against automated reverse engineering.

nullpt.rs · HN

Rust’s Future trait is missing a Done state

Yoshua Wuyts points to a gap in Rust’s async model. Poll only has Ready(T) and Pending, so a completed future cannot say that it is finished. Polling it again gives unspecified behaviour: a panic, a hang or worse. FusedFuture works around this by using Pending to mean “done”, which breaks its own contract. The proposal is a Poll::Done variant, so that callers handle the state explicitly. It would also remove unnecessary panic code from embedded binaries.

blog.yoshuawuyts.com · Lobsters

Also today

Security
Tailscale’s full “Tailworm” disclosure: 11 SSH flaws, with root via Unix-socket forwarding. If you have not patched yet, set TS_SSH_DISABLE_FORWARDING=1 — BleepingComputer · r/selfhosted
ACLs Don’t (Miller & Shapiro, 2009) is being read again: ACLs cannot decide correctly when more than two principals interact, which matters for agentic systems — HP Labs · Lobsters
Languages & systems
Four months of Zig: explicit allocators and IO are good for testing, but the stdlib is unstable and the bootstrap blob blocks Nix/Debian packaging — gracefulliberty.com · Lobsters
Hoot 0.10.0: Guile Scheme to WebAssembly, now with a Lisp Game Jam template before the jam starts on 30 October — Spritely · Lobsters
AlpineBSD: a NetBSD kernel with an Alpine userspace, and AI-generated code explicitly banned — wiki · HN · Lobsters
Culture
The Benchmarking Crisis: Goodhart’s Law is eating database benchmarks like ClickBench. The proposed fix is hidden, rotating query sets — Database Architects · Lobsters
StackOverflow drops below 1,000 questions per month. The decline started long before LLMs — Data Explorer · HN

AI & Automation

Claude Code spends 15–20% of your tokens on 3-word status labels

Every 30 seconds, Claude Code sends each background agent’s full transcript to an Opus model to generate a 3–5 word status for the agents panel. That is an input-to-output ratio of 9,000:1, and none of it reaches your conversation. This became the default in v2.1.232 (August 2026), without a disclosure or a setting to turn it off. As a workaround, a Bun preload script, no-agent-summary.js, blocks the timer callbacks.

Gist · HN

Qwenputer: a deterministic RISC-V CPU inside Qwen3.5’s weights

Gated DeltaNet state used as RAM: one-hot keys write rows, and one-hot queries read them back. Diagram: divagr.com

A researcher built a working RV32IM CPU into 11 of the 32 layers of Qwen 3.5 4B. The design uses the linear RNN state in Gated DeltaNet as addressable RAM, where one-hot keys write and read rows exactly. The CPU runs C and MicroPython during the forward pass and emits execution traces as tokens. Arithmetic accuracy is 97.5–100%, compared with 55–95% for the base model, and normal text quality is almost unchanged (KL 6e-4). The checkpoint is 18.8 GB. The new idea is that RNN state matrices can work as exact, addressable memory.

divagr.com · HN

Cursor opens its Agent SDK for event-driven CI agents

Cursor has open-sourced the Agent SDK behind its internal tools Bugbot and Security Reviewer. You define agents in TypeScript and Markdown, and events such as PRs or compliance checks trigger them. Agents run on Cursor’s infrastructure or as self-hosted Node processes. The SDK includes evaluation tools and event replay. Cursor says that one team built a knowledge-base PR reviewer in about a day.

Cursor · HN

Also today

  • Gemini 4 Carbon: Google’s new frontier model for agentic work that runs for days. It is #1 on the Artificial Analysis Index and scores 88.2% on SEC-Bench Pro. Introductory price: $2/$10 per million tokens — Google · HN
  • writeSkill: package agent skills with Nix, so that invalid definitions fail at build time and not at runtime — britter.dev · NixOS Discourse

Linux & Infrastructure

Found a backdoor on my NixOS laptop, disguised as a nix-update service

A user found a 12 MB Go binary at ~/.local/share/nix/nix-update, with a matching systemd user service and timer. It was installed on 22 October in about 95 seconds and left no trace in shell history or SSH logs. Reverse engineering showed a customised ligolo-ng reverse-tunnel agent. It uses garble obfuscation, uTLS/uQUIC fingerprint spoofing and post-quantum crypto, and it connects to a Vultr server in Singapore that has been flagged as C2 infrastructure since January 2025. The community thinks the most likely entry point is a compromised third-party flake input, from NUR or similar. The recommendation: if you have flake inputs you have not checked, reinstall and rotate your credentials.

NixOS Discourse

Determinate Nix 3.24.1: security fixes, nix top, and much faster GC

Determinate Nix 3.24.1 fixes the Broccoli2Shell Brotli out-of-bounds write (CVE-2026-111497, possible RCE through a malicious binary cache) and removes the compromised emSign ECC Root CA G3. The bigger story is performance. A GC regression fix brings evaluation of large flakes down from 7,014s to 806s. Parallel instantiation cuts some evaluation times about in half. In-memory SQLite makes GC 17% faster and path registration 32% faster. The new nix top command shows active builds, like htop, with CPU and memory per derivation.

Determinate Systems · NixOS Discourse · r/NixOS

Hyprland 0.57.0: no more .conf, blur variants, and window wobble

The new “drops” blur variant. Image: hypr.land

Hyprland 0.57.0 removes support for .conf files, so configuration is now Lua only. New features include several blur variants (animated, static and extensible by plugins), per-workspace screensharing sources in Hyprland and XDPH, and the return of Compiz-style window wobble. The Lua API gets config.unload events, hl.reload_config(), hl.get_devices() and events for minimised windows. Lantern, a new GUI settings app for Hyprland 0.56+, shows each change as a diff before it applies it.

hypr.land · r/hyprland · Lantern · r/hyprland: Lantern

NIHIL: a fully declarative NixOS desktop from a single theme file

NIHIL’s monochrome dot-matrix frame on Hyprland. Image: nihilshell.com

In NIHIL, the whole visual system comes from one file, theme/nihil.nix: GTK, terminal, editor, compositor, lock screen, greeter and boot splash. The look is monochrome dot-matrix. A hardware-style frame has a left-hand bar and slide-out drawers for the dashboard, settings and launcher. Notifications appear as light segments around the edge of the screen. The Quickshell configuration is generated as Lua from Nix.

nihilshell.com · GitHub · r/NixOS · r/hyprland

snapback: ZFS snapshot plus restic, as a NixOS module

snapback takes a ZFS snapshot before each restic run and mounts it over the paths it backs up. Restic then reads a point-in-time copy and not files that are being written. Each service declares its own backup needs (paths, units to pause, restore commands) in its config, and one command handles the restore. It also has retries over 20 hours and supports append-only credentials for protection against ransomware.

Codeberg · r/NixOS

Home Assistant 2026.11 beta: LoRaWAN, new entity naming, and Powerwall control

Besides the HACS Marketplace, the beta adds a new entity-naming system that combines device and entity context automatically, with old names kept as voice aliases. It also adds automatic dashboard sections, LoRaWAN through ChirpStack or TTN, Zigbee Green Power for battery-free switches, and WebRTC for Matter 1.5 cameras. With Teslemetry and PowerSync, Home Assistant becomes the first consumer platform that can set charge and discharge rates on Powerwall 2 and 3 to the watt.

HA release notes · r/homeassistant · PowerSync · r/homeassistant: Powerwall

Also today

Self-hosting
Sablier v4 starts services on the first request and stops them when idle. It now supports Podman, Proxmox LXC, Nomad and ECS — GitHub · r/selfhosted
immich-convert-originals converts an Immich library to JPEG-XL/AV1 and saves 20–50% of the space, with EXIF and albums preserved — GitHub · r/selfhosted
A NixOS module raises the power limit of NVIDIA laptop GPUs with an in-memory VBIOS copy and no flashing. It gave +5.9% on an RTX 3080 Ti, but it is experimental — GitHub · r/NixOS
Wayland desktop
RediWM: compositor, shell, notifications, lock screen and display manager in one Zig process, now with a Nix flake — GitHub · r/NixOS
Pocketdesk streams Hyprland to Android over QUIC, with touch, pen and two-way clipboard — GitHub · r/hyprland
Waytator: screenshots, screen recording and a video editor in one GTK4 tool. It is in nixpkgs — GitHub · r/hyprland
Hue: a Rust wallpaper changer where the new image eats through the old one pixel by pixel — GitHub · r/hyprland 
cd ~/repos/josse-posten && claude --resume 438eae1d-37e4-4f48-96cc-4a6d842f8b10