Canada and EU launch “Alliance for the Future”, open to other democracies

Canada and the EU formally launched the “Alliance for the Future” at the Montreal summit — a grouping open to like-minded nations, framed as both mutual protection and a hedge against American unpredictability. Carney said “unequivocally” that Canada seeks to become the EU’s first associate member; von der Leyen spoke of a world “shaken by new storms.” Xi Jinping responded at once, urging the EU to deepen cooperation with Beijing instead.

G20 in Atlanta: family photo scrapped, and a joint demand on North Korea

The traditional opening photo at the G20 foreign ministers’ meeting was cancelled after about a third of countries — including the US, UK and Australia — refused to stand beside Russia’s foreign minister. Rubio pulled the plug. UK Foreign Secretary Miliband confronted Lavrov directly, accusing his government of killing civilians in Ukraine.

On the sidelines, the US, South Korea and Japan demanded the “complete denuclearisation” of North Korea and pledged to enforce UN sanctions — even as Trump signals interest in a new summit with Kim, possibly at APEC, and Pyongyang has written its nuclear status into law as permanent.

US midterms, three days out: ICE surge, a pope’s ballot, and “send him back”

More than 43 million Americans have voted early, with Democrats leading in polls. Pope Leo XIV mailed a ballot to his native Chicago — the first pope to vote in a US general election. At a rally, Trump told crowds to send Michigan candidate Abdul El-Sayed “back to where he came from.”

ICE enforcement is surging: video shows masked agents pointing a gun at a dog walker during an arrest in North Hollywood. Democrats are demanding ICE data on miscarriages among detained women, after a Guardian investigation found the agency did not track them between October 2025 and June 2026. Fake polls are also circulating.

Bolsonaro’s flight to the US becomes a three-country incident

Brazil summoned Argentina’s diplomat over reports that Buenos Aires helped Flávio Bolsonaro fly to the US after his election loss. Brazilian media mocked his short-lived “president-elect” claim — made in a letter bearing the wrong national coat of arms.

Youth protests sweep Germany and France

About 150,000 people registered to protest across 30 German cities, led by the “GenZ regelt!” movement. France deployed 70,000 police and banned face coverings amid warnings of a “very high risk” of disorder. The grievances: unaffordable living, failing public services, and a generation locked out of economic stability. Berlin shops boarded up after looting in earlier weeks.

Global port strike: dockworkers at 113 ports halt arms shipments

More than 25 unions across 113 ports in 22 countries struck on Friday against the use of ports for weapons exports. Organisers say it disrupted over 40% of Mediterranean cargo and $2 billion in freight. Italian, French, Greek, Spanish, Turkish and Moroccan dockworkers led, backed by ver.di, SIPTU, 3F, CGT and India’s WTWFI, which noted about 15 Indian seafarers died in the US-Israel-Iran conflict. The action builds on May’s Istanbul Declaration.

DR Congo: Ebola deaths pass 5,000 — and Kabila returns as a rebel leader

The outbreak declared in May has killed more than 5,000 of over 10,000 infected, now the second-largest on record after West Africa 2014–16. It is the rare Bundibugyo strain, with no approved vaccine or treatment. It has reached eight of 26 provinces and spread to Kenya, Uganda and Nigeria; Saudi Arabia has suspended travel to Kenya.

In the same troubled east, former president Joseph Kabila (2001–2019) has launched an armed rebel movement, adding a new actor to a conflict already involving M23, Rwandan-backed forces and the army.

Sudan: senior RSF commander defects — “a purely family-based project”

In footage obtained by Al Jazeera, Siddiq Ander says the RSF is “controlled by Hemedti’s relatives in every aspect” — weapons, finances, promotions, troop movements — and that dissenters face “expulsion, imprisonment or a hidden death.” He joins a wave of senior defections this year, some taking hundreds of fighters with them.

Yemen: Houthis sending Taiz “back to the stone age”

As the siege enters its third month, Taiz’s governor says oxygen, food and water are critically low and “massacres” are underway. Analysts are examining whether the Houthis use Russian satellite communications to coordinate strikes on Saudi Arabia — echoing this week’s reporting on Russian satellites guiding Iran’s proxies.

Ufa refinery burns; Fire Point claims a way around Starlink

Ukraine’s strike on the L-35 reformer at Bashneft-Novoil in Ufa came alongside hits on Novokuibyshevsk, two further refineries and a gas chemical complex. Manufacturer Fire Point says it has solved Starlink dependency for long-range navigation. ISW notes Peskov and Ushakov are publicly using the strikes to argue Kyiv is defying Trump’s requests — a wedge between Kyiv and Washington.

Oleshky: first civilian evacuation in four years — on a stage set by Russia

Hundreds of civilians left occupied Oleshky under the Melania Trump-brokered ceasefire, the first joint humanitarian operation of its kind in over four years. A Ukrainian delegation arrived on 30 October via Gomel and Anapa, with both sides’ human rights commissioners overseeing. Demining of the routes finished the same day and convoys set off that afternoon; the ceasefire had held for over 80 hours. A convoy also brought food and medicine. Some residents chose to stay.

Ukrainian accounts and residents report that Russian forces cleaned streets and removed bodies from visible areas before the cameras arrived.

Frontline: Russian encirclement push at Orikhiv deepens; Hulyaipole railway crossed

Russian forces effectively seized Charivne east of Orikhiv on 30 October, with infiltration groups pushing toward Omelnyk, nearly 19 km behind the line, as 76th VDV Division and Varyag drone brigade elements try to encircle Orikhiv from the northeast. Russian units also crossed the railway northwest of Hulyaipole and reached the Verkhnya Tersa River from Zaliznychne. Orikhiv–Hulyaipole is now the most active axis.

Elsewhere Ukraine pushed back: clearing infiltrators from Nove Zaporizhzhia and Ternuvate south of Oleksandrivka, intensifying counterattacks west of Kostyantynivka toward Mykolaipillya and Rozkishne, and stalling the Russian offensive at Dobropillya.

Supply chain attack backdoors Claude Code extension on Cursor marketplace

A malicious actor published tampered versions 2.1.312 and 2.1.313 of the Claude Code VS Code extension exclusively to Cursor’s marketplace on 30 October. The backdoor installs a reverse SSH tunnel, appends an attacker key to ~/.ssh/authorized_keys, and exfiltrates hostname, username, OS, git config, and the names (not values) of environment variables matching credential patterns. About 5,000 Cursor users were exposed. The VS Code marketplace, OpenVSX and Anthropic’s own channels were not affected, and Anthropic confirmed no compromise of its systems.

Cursor has pulled the versions, but remediation means removing the persistence artifacts by hand and rotating credentials. The incident also exposes that VS Code-compatible marketplaces have no code signing at all — a problem Linux package management solved decades ago.

Azure’s weakest link: five full cross-tenant compromises from one root cause

Oslo-based Binary Security published five chained privilege-escalation bugs in Azure Logic Apps API Connections. All stem from one flaw: when ARM calls into an API Management instance, it has rights to all connections, not only the one in use. The exploits: path traversal via ../, three undocumented DynamicList endpoints with the same flaw, implicit access to all V1 connections from Consumption Logic Apps, and RuntimeUrl manipulation that bypassed ownership checks — then the same traversal again after URL normalisation. A chain gives full cross-tenant access to Key Vaults, SQL databases, Jira, Salesforce and whatever else is connected.

The bounty totalled $200,000. All five are patched, but Microsoft’s fixes repeatedly created new bypasses.

CVE-2026-98432: Linux MPTCP use-after-free, exposed by Go’s defaults

A use-after-free in the kernel’s Multipath TCP code allows remote code execution on listening sockets. Go 1.24+ enables MPTCP by default for all listen sockets on Linux, so Go servers on unpatched kernels are exposed without any configuration. The Go team calls kernel patching the only proper fix; SetMultipathTCP(false) or the GODEBUG switch are fragile workarounds. Update your kernel.

The $6.3 billion Binance hack took 20 minutes

New detail on Thursday’s record heist: hackers drained hot wallets across at least ten chains in about 20 minutes, after 36+ hours of preparation — test withdrawals, a rehearsal four hours before, then the same code against live wallets. TRM Labs, Chainalysis and Elliptic attribute it to TraderTraitor, the North Korean group behind the $1.5B Bybit heist. Binance says the entry point was a compromised engineer’s laptop. About $2.8B, mostly stablecoins, is frozen; the remaining $3.3B in BTC, ETH and XRP largely cannot be.

Nesformer: a NES CPU compiled — not trained — into Qwen3.5 weights

Nesformer computes Qwen3.5 weight values that implement a complete 6502 NES CPU, with no training involved. It uses Gated DeltaNet attention: each head’s 128×128 state matrix acts as addressable memory through one-hot key-value lookups. All 151 opcodes, 2KB of RAM and 32KB of ROM live in the weights; a Python host handles PPU, audio and input. Super Mario Bros. runs pixel-perfect against a reference emulator. The compiler is adapted from Qwenputer, the RISC-V-in-weights project covered on Thursday.

Shrinking NixOS idle RAM from 288MB to 96MB on a 512MB host

The biggest wins: mem_profiling=never and disabling transparent hugepages free about 52MB; trimming the kernel module tree from 162MB to 45MB on disk; dropping systemd-resolved (8.3MB) and systemd-timesyncd (4.6MB); socket-activating sshd. vm.swappiness=180 plus zstd zram capped at 512MB keeps channel updates feasible at a 371MB rebuild peak.

Tangled: a self-hostable, federated code forge on AT Protocol

Tangled keeps issues, PRs and comments as collaborative objects inside the git repos themselves, so projects stay portable. On AT Protocol you can self-host just the git layer, just CI runners, or the whole stack and still collaborate across instances. Recent work: a Svelte redesign, “bobbins” indexers in 11+ regions, and org accounts; private repos, a CLI and SDKs are next.

Sanstun: a sans-IO WireGuard state machine in Rust

Firezone’s sanstun separates IO, time and randomness from protocol logic. begin_encapsulate() returns a Send-able PendingEncapsulate, so crypto work moves to worker threads while the core state machine stays single-threaded and lock-free. Born from frustration maintaining a boringtun fork, it uses the type system to enforce protocol invariants at compile time.

No, npm, “estee” is not a typo of “testem”

npm’s typosquat filter (Levenshtein distance ≤ 2) blocked the package name estee as too close to testem. For short names the rule eliminates about 99.88% of the namespace — and npm support confirmed there is no human override.