Josse-posten

The day after the blue wave, Washington starts counting the cost: Vance blames the Iran war, Trump says Israel’s support ends at New Year, and Congress eyes a veto-proof path for Ukraine. Hong Kong adds a decade to Joshua Wong’s sentence, and Ryazan burns.

Vance blames the Iran war as the midterm reckoning begins

JD Vance has called the war in Iran the “obvious” culprit for the Republicans’ midterm losses — one of the sharpest public breaks between a sitting vice-president and president in recent memory. Speaker Mike Johnson says he will not stay on as minority leader when the new Congress meets in January, and Democrats are preparing investigations into Elon Musk’s leadership of DOGE and his government contracts. Trump says he is willing to accept the result. Germany’s Merz expects him to keep bypassing Congress anyway.

For Ukraine, congressional leaders say bipartisan supermajorities can now override vetoes on defence funding; Ukrainian bonds jumped on the result (see Ukraine). Støre says he is more worried about tariffs than about NATO (see Norway).

Joshua Wong sentenced to 10 more years — two months from release

Hong Kong’s High Court sentenced pro-democracy activist Joshua Wong to a further 10 years for colluding with foreign forces — his second conviction under Beijing’s national security law. Wong, 30, has been jailed since 2020 and was just two months from potential release. The judge started at 13 years before reducing for his guilty plea. The US consulate condemned the ruling and called for his immediate release; human rights groups called it “endless political persecution.”

Ryazan refinery burns; Russia answers with 310 drones and debuts the Filin missile

Fire at the Ryazan oil refinery after the Ukrainian drone strike, 5 November. Photo: Militarnyi

Ukrainian drones struck Rosneft’s Ryazan refinery overnight — one of Russia’s largest (17–18 million tonnes a year), supplying aviation fuel and military diesel, and already hit on 15 October. A 173,000 m² Wildberries warehouse in the same industrial zone was hit at the same time, and a 92,000 m² Ozon warehouse in Adygeysk, ~400 km from the front, burned down the night before.

Russia launched 310 drones on the night of 3–4 November against energy infrastructure in Kyiv and eight oblasts, with notably heavier targeting of central and western Ukraine. Emergency power cuts rolled across Kyiv, and nuclear plants are reducing output because of substation damage. Ukraine’s GUR and a Russian milblogger confirmed the first combat use of the new Filin cruise missile — ground-launched, ~800 km/h, 1,200 km range — against an energy facility in Rivne Oblast.

Trump says US support for Israel ends at New Year, as Herzog opens coalition talks

President Trump told Fox News that US support for Israel will end by the end of the year, and that Netanyahu has agreed; Israel keeps the option to buy weapons commercially. In Jerusalem, the election commission definitively rejected Netanyahu’s fraud claims and confirmed that his bloc lost its majority. President Herzog has begun consultations with party leaders, warning that “not every commitment and promise can be fulfilled” and that another election must be avoided. Netanyahu’s rivals said the US midterm result showed Israel “cannot afford” to keep him in office.

The White House network is for rent as a residential proxy

Layer3 Intel logged 236 residential-proxy exits from the Executive Office of the President’s network between 5 October and 3 November. The software is Infatica, whose founder previously ran King Servers — host of six of the eight IPs used by Russian state security against US election systems in 2016. At least 28 proxy services could route traffic through White House addresses (see Tech).

Indicator Value Change
S&P 500 (f) 7,713 -0.10%
Dow 30 (f) 53,748 +0.46%
Nasdaq (f) 28,353 -0.75%
Russell 2000 (f) 2,874 +0.29%
VIX 17.15 +3.25%
Gold 4,136 +1.55%
BTC $80,331 +2.62%
EUR/USD 1.1248 +0.12%
USD/NOK 9.2875 -0.10%
  • Oil falls below $95, the lowest since early September; BP sells Aker BP shares worth NOK 11bn at a double-digit discount (see Norway)
  • Norges Bank announces its rate decision today — chief economists think the peak has been reached
  • Ukrainian bonds jump on the Democratic win; Shell’s profit doubles to $10.8bn on Iran-war margins (see World)

World

Hormuz: Seoul moves closer, Tehran picks who passes, Shell cashes in

South Korea is seeking parliamentary approval to extend its Cheonghae anti-piracy unit’s operating area to waters about 650 km from the Strait of Hormuz, after sustained US pressure to help keep the strait open; anti-war activists have protested. Iran, meanwhile, has exempted vessels from India, China, Iraq and Qatar from its Hormuz restrictions — showing how selective and diplomatically calibrated the blockade is. Shell reported quarterly profits doubling to $10.8bn as the war inflates oil prices and refining margins, while the EU’s tally of Hormuz-related costs passed €127bn.

Paraguay’s largest private bank collapses, taking half the country’s savings

Ueno Bank was abruptly shut down overnight after regulators declared it insolvent. It held roughly half of Paraguay’s private savings. Mass protests have erupted as depositors demand their money back, and the government faces a crisis of confidence in the financial system.

Syria and Saudi Arabia sign defence pact, agree $403m in loans

On his second visit to Riyadh in under a month, Syrian President Ahmed al-Sharaa signed a defence cooperation agreement and secured $403m in loans — a sign of Saudi Arabia’s accelerating effort to bring Syria into the regional order as the US role in the region contracts.

Bukele sends troops to Haiti: “we will finish” the gangs

El Salvador’s President Nayib Bukele has deployed military forces to Haiti and warned gang leaders that his troops will finish them as they did in El Salvador. Haitian police separately found a vehicle linked to four missing Salvadoran technicians.

Also today

Europe
Serbia detains nine serving police officers and one former officer over alleged torture of anti-corruption protesters held in a government garage — The Guardian · Reddit
Hungary opens communist-era secret police files after 37 years; critics call them incomplete and the timing political — BBC
Bavarian deputy minister-president Hubert Aiwanger, 55, found dead in a Berlin hotel; prosecutors investigating — The Guardian · Reddit
France braces for a general strike over education and cost of living, with hospitals, rail and air traffic control affected — The Guardian
UK MPs: Britain is “dangerously” reliant on China for critical minerals for defence, AI and renewables — The Guardian
Asia-Pacific
Kim Yo Jong rejects talks with a “hostile” United States — The Telegraph · Reddit
New Zealand votes in a knife-edge election; the Māori Party and Greens may hold the balance — Al Jazeera
Health & climate
British healthcare worker with Ebola evacuated from DRC to a UK high-consequence infectious disease unit; stable — The Guardian
Paris Agreement at ten: an uneven record on the 1.5°C pledge, ahead of COP30 in Brazil — Al Jazeera

Ukraine

Russia pivots to Kostyantynivka — 24 assaults in two days

Russian forces made 24 assaults in the Kostyantynivka direction on 3–4 November, the highest count on any single axis, and ISW assesses they have consolidated positions in the northwest of the town. It marks a shift away from Dobropillya, Russia’s main effort since August. Infiltration and dense Ukrainian airstrikes in northwestern Kostyantynivka point to continued attempts to push deeper. Elsewhere — Sumy, Kharkiv, Kupyansk, Lyman, Pokrovsk — there were no Russian advances.

Komyshuvakha death toll reaches at least 40

The toll from Russia’s double-tap bombing of the school shelter in Komyshuvakha, Zaporizhzhia, has risen to at least 40 killed, with dozens still missing under the rubble — 59 according to Ukrainian reports, around 30 according to the BBC. Ukraine has released bodycam footage showing the second strike timed to hit rescuers. The Kremlin said it hopes the midterm results will not affect Trump’s “peacemaking efforts.”

Zelensky honours Melania Trump, demands “ironclad” guarantees before talks

Zelensky speaking after the US midterm results. Photo: Ukrainska Pravda

Zelensky awarded Melania Trump the Order of Princess Olga, Ukraine’s highest honour, after the Oleshky ceasefire. Russian and Ukrainian delegations are due to meet the first lady at the White House on Thursday — the most direct face-to-face contact between the two sides since the war began. In a 90-minute call with envoys Kushner and Witkoff, Zelensky pressed for Patriot resupply and said post-war guarantees “must be truly ironclad.” Trilateral talks are set for 10 November in Abu Dhabi; Kushner praised Ukraine’s “constructive engagement.”

A Democratic Congress opens a veto-override path; USAF orders 1,000 ERAM missiles

With Democrats taking both chambers in January, congressional leaders say bipartisan supermajorities can override Trump’s vetoes on Ukraine funding. The first priority is blocking Trump’s plan to let Russian diesel back into US markets. Separately, the US Air Force has issued a solicitation for 1,000+ ERAM cruise missiles for Ukraine (460 km range, 10 m accuracy), with first deliveries within three months of award; responses are due 19 November. Zelensky said more US aid “will influence Putin.” Ukrainian bonds rose sharply on the result.

Also today

  • Russian diesel tankers sharply change course away from the US — UNN · Reddit
  • Hungary to phase out Russian gas by autumn 2027 — Armenpress · Reddit
  • Zelensky doubts Musk acted alone in the Starlink slowdown (see also Starlink in Norway) — The Hill · Reddit

Norway

Oslo-prosessens hemmelige arkiv åpnet

5 000 dokumenter fra Terje Rød-Larsens og Mona Juuls private arkiv fra Oslo-prosessen er overlevert til Nasjonalarkivet, digitalisert og gjort tilgjengelig for alle torsdag. Arkivet gir innsyn i diplomatiet bak kulissene som ledet til Oslo-avtalen mellom Israel og PLO i 1993.

Økokrim beslagla arkivet i en ransaking av parets leilighet på Frogner i februar, etter at deres forbindelser til Jeffrey Epstein ble kjent gjennom dokumentslippene i 2026. I kjelleren lå dokumenter merket gradert; PST fant ingen brudd på sikkerhetsloven. Paret hadde i over 20 år hevdet at de ikke hadde dokumenter hjemme. Historiker Hilde Henriksen Waage, som allerede i 2004 påviste et ni måneders hull i UDs arkiver fra Oslo-prosessen, kaller frigivelsen «en stor overraskelse» og venter at den vil bekrefte funnene hennes om Norge som «Israels løpegutt». Advokat John Christian Elden understreker at materialet er Rød-Larsens private papirer, ikke UDs eiendom, og ikke del av noen straffesak.

Prorussiske hackere tar på seg kjøleanlegg-angrepene — to norske anlegg rammet

Ullensvang Fruktlager, ett av to norske anlegg som ble hacket. Foto: Digi.no

Hackergruppene Noname057(16) og Z-Pentest tar på seg skylden for angrepene mot kjøle- og fryseanlegg i flere europeiske land, blant annet i Frankrike der blodbanker ble rammet. I Norge ble Havaristen og Ullensvang Fruktlager hacket: angriperne skrudde temperaturen så kraftig opp at sprinkleranlegget ble utløst. NSR sier de har avverget flere angrep mot norske anlegg — titalls norske virksomheter hadde slike systemer eksponert på internett uten å vite om det. Eksperter kaller det «et oversett sikkerhetsproblem».

Samtidig har Norad satt krisestab etter et dataangrep der navn og e-postadresser til over 20 000 søkere kan ha kommet på avveie.

Datasentre: Støre varsler kraftgrep, Frp snur igjen, og Microsoft har ikke mer plass

Statsminister Jonas Gahr Støre sier regjeringen «jobber intenst» med tiltak som skal stramme inn datasentrenes kraftforbruk på kort sikt. Rødt fremmet på tirsdag et hasteforslag om stans i all ny datasenterbygging — 32 sentre i køen kan samlet bruke over halvparten av kraftoverskuddet innen et år. Frp, som en uke tidligere hadde signalisert støtte, stemte imot. Rødt-leder Marie Sneve Martinussen kaller det «nok en snuoperasjon». På r/norge ble det påpekt at alle 41 jurisdiksjoner i USA som stemte over datasenter-moratorium i mellomvalget, sa ja.

Bransjen advarer: Bulk Infrastructure sier en frys vil ramme inngåtte kontrakter, og NHO har lagt fram sju forslag til regulering. Nscale mister nok en stor Microsoft-kontrakt. Og Microsoft selv sier at Norway East-regionen «ikke lenger er skalerbar» — Digdir har fått beskjed om å flytte tjenester til Sverige, noe som reiser spørsmål om digital suverenitet.

Forsvarsmateriell har tildelt en satellittavtale verdt inntil 450 millioner kroner til Forsvaret og politiet, der tilgang til Elon Musks Starlink er et krav. SV kaller forsvarsministeren inn på teppet og kaller det «skremmende» å gjøre norsk beredskap avhengig av et selskap kontrollert av en politisk aktiv milliardær. Samme dag sier Zelensky at han ikke tror Musk handlet alene da Starlink ble strupet i deler av Ukraina.

Eksperter sier til Reuters at en russisk militærsatellitt som nærmet seg en finsk kommersiell satellitt i oktober, kan ha øvd på et angrep.

Sivilombudet: Alle undersøkte sykehus holder psykiatriske pasienter ulovlig fastspent

Sivilombudet slår alarm etter en gjennomgang av psykiatriske sykehus: samtlige undersøkte institusjoner har holdt pasienter fastspent i belte i strid med loven. Én pasient lå fastspent i over 18 døgn sammenhengende. Funnet beskrives som en systemsvikt, ikke enkelttilfeller.

Støre etter USA-valget: Mer urolig for toll enn for NATO

Demokratene tok begge kamre, og JD Vance innrømmer på X at nederlaget skyldes «Iran-krigen». Statsminister Støre sier han er mer urolig for toll enn for NATO-støtten, og understreker at Kongressens budsjettmakt nå kan begrense Trumps utenrikspolitiske handlingsrom. Eksperter tror Europa kan gå mot roligere Trump-tider — men tollpolitikken ligger fast.

Boligprisene falt 1 prosent, BP dumper Aker BP-aksjer — og renten avgjøres i dag

Boligprisene falt 1 prosent nominelt i oktober ifølge Eiendom Norge; sesongjustert var veksten 0,1 prosent. I Oslo uteblir budrundene, og lageret av usolgte boliger er historisk høyt. Norges Bank kunngjør rentebeslutning torsdag — sjeføkonomer tror toppen er nådd. På Børsen selger BP opptil 5 prosent av Aker BP, aksjer verdt rundt 11 milliarder kroner, med tosifret rabatt, mens oljeprisen faller under 95 dollar fatet. Mowi leverte rekordinntekter på 19 milliarder i tredje kvartal, og Oljefondet gjør sin første direkte investering i batterilagring med 10 prosent av amerikanske AYPA Power.

Erna Solberg i ny bok: «Null tro» på Listhaug

I en ny bok skriver Erna Solberg at hun «hadde null tro på at Sylvi Listhaug kunne bli statsminister», og at Listhaug har «skapt større avstand på borgerlig side». Hun skriver også at ektemannens aksjehandler var «den største krisen i ekteskapet vårt» — men at skilsmisse aldri var aktuelt.

Også i dag

Krim og rett
16-åring fra Vestfold siktet for å ha planlagt terrorangrep mot en navngitt barnehage i Oslo — NRK
Lagmannsretten: Marius Borg Høiby forblir varetektsfengslet — NRK · Aftenposten
Stortingsflertallet sier nei til å utrede aktiv dødshjelp — Aftenposten
Forsvar
Forsvaret utplasserer luftovervåking i Kirkenes for å oppdage droner på avveie — NRK · TU.no
Nasams-batteriet på Ørland oppgradert til Nasams 4 — TU.no
Samferdsel og Oslo
Bergensbanen stengt mellom Voss og Dale etter ras; full stans på Østfoldbanen etter signalfeil ved Ski — Aftenposten: Bergensbanen · Aftenposten: Østfoldbanen · TU.no: punktlighet
Fjernvarmebrudd på Grønland: over én million liter vann tapt, 1 500 husstander uten varme; nå tilbake — NRK · Aftenposten
Barn omkom i trafikkulykke på E18 ved Larvik — Aftenposten
Oslo kutter antall elsparkesykler med minst 25 prosent og hever aldersgrensen — Aftenposten · NRK · Reddit
KI
Mistral slipper Large 4 som åpen modell — Digi.no
Google skrur av KI for skoleelever som standard — men skoler som vil fjerne KI helt, mister også Google Søk — Digi.no · Aftenposten
Sport
FIS-styret sier nei til Bolsjunov; Norge boikotter for første gang siden 1980 — NRK · NRK: boikottnasjonen
Viking skriver klubbhistorie med 4–1 over Sabah FC i Mesterligaen; Bodø/Glimt bare ett poeng mot Lille — NRK: Viking · NRK: Glimt
Haaland avgjorde mot Leipzig — med Nusa på motsatt lag — NRK

Norway — Street Level

«Alle elsker Rasmus»: Den danske skjulte-kamera-skandalen

Danske TV 2s skjulte-kamera-serie «Alle elsker Rasmus» har blitt et skandinavisk medieetisk brennpunkt. Komiker Rasmus Wallbridge ble lurt i fire måneder av 149 kolleger — inkludert sin beste venn — til å tro at han lagde drømmefilmen sin med Nordisk Film. Kanalen avfeide først kritikerne som humørløse, men trakk så serien og ba om unnskyldning uten forbehold. VG-kommentator Hans Petter Sjøli sammenligner det med et virkelig Truman Show og kaller det «en medieskandale av det sjeldne slaget». Lydeksperter mener dessuten at latteren til Wallbridge i avsløringsscenen er klippet inn fra et annet opptak, noe som kan gi juridisk ansvar etter dansk lov.

Tech

Want to rent an internet address at the White House?

Synthient’s daily observations of residential proxy exit traffic from the White House network (AS2650). Source: Krebs on Security

Layer3 Intel’s new Residential Proxy Observatory logged 236 proxy exits from AS2650 — the Executive Office of the President — between 5 October and 3 November. Synthient identified the software as Infatica, commonly bundled into “free” apps. Its founder, Vladimir Fomenko, previously ran King Servers, which hosted six of the eight IPs used by Russian state security to compromise election systems in Arizona and Illinois in 2016. At least 28 residential proxy services could route traffic through White House addresses, so anyone paying a few dollars could use them as an exit node. A 2026 survey found similar proxies inside nearly 300 government networks, 318 utilities, 166 healthcare facilities and 141 financial institutions.

A thousand fewer paths to root: OpenAI’s pipeline produced 948 working Linux LPE exploits for $1.2M

OpenAI ran an autonomous vulnerability pipeline against a stock desktop Linux install in mid-October: static scan → dynamic reproduction → PoC exploit → patch, with human review at the end. It found 2,308 candidates, reproduced 1,724, and produced 948 working local privilege escalation exploits plus 291 info-leak PoCs, for $1.21M in total — $1,279 per LPE. Historical Pwn2Own and TyphoonPWN bounties for Linux LPE run $20k–$70k. Against a hardened kernelCTF kernel it produced 21 LPEs at ~$1,569 each, comparable to the 26 confirmed 0-days kernelCTF accepted all year. Patches were coordinated with kernel maintainers via Patch the Planet.

OpenAI · HN

Critical MitM RCE in Debian’s apt: a redirect bug swaps packages after verification

CVE-2026-109518: apt’s HTTP download-resumption logic can merge two package downloads when a redirect gives them the same URI. A man-in-the-middle can substitute a malicious package after integrity checks pass and get code execution as root. Fixed in apt 3.0.4 for Debian stable. Found by Max Justicz; the advisory also covers out-of-bounds access issues.

FlashProve: zkSNARK proofs that an LLM response came from the claimed model

Anthropic published FlashProve, which uses zkSNARKs to prove that a response came from a specific model — verifiable without access to the weights. On a single H100 it runs ~110 tokens/s for a 400B-parameter model, with ~19 MB of proof per 1,024 tokens, verifiable in seconds on a CPU. Overhead is 70–95× standard inference, far better than prior approaches. Use cases: detecting compromised inference servers, enforcing “only this approved model” rules, and catching swapped-in quantized or fine-tuned variants.

Shlemiel the Painter is back: Zig’s libc made SQLite 12,000× slower

SQLite’s JSON tokenizer ran ~12,000× slower on Linux builds using Zig’s bundled libc than on macOS. Zig’s pure-Zig strspn measured the full string length on every call; SQLite calls strspn in a loop to skip whitespace, turning a linear scan quadratic. It only showed on Linux, where Zig’s cc was used; macOS used the system libc. The author pre-stripped whitespace as a stopgap, then moved Linux builds to containers.

How to speed up the Rust compiler in November 2026

Nicholas Nethercote’s update describes an unusually clean year. The biggest win is a new span compression scheme that cuts span interning from 20–40% of incremental build time to ~1%. The next-generation trait solver’s overhead on Diesel fell from 1.49× to 1.16× versus the legacy solver; skipping MIR-building for trivial constants saves up to 6% on stress tests. September–November: 236 improvements across 45 benchmarks against 4 regressions. Year to date: 2.85% lower mean wall time and 4.46% lower peak memory.

Your cryptography conspiracy theory is wrong

Soatok works systematically through the NSA/NIST backdoor theories. NSA did strengthen the DES S-boxes against differential cryptanalysis — which it knew before academia — while also shortening the key for SIGINT purposes; both are true. The NIST P-curve seed mystery was resolved in 2023 with no malice found. Post-quantum backdoor theories about ML-KEM are implausible given international design teams and the scale of weakness that would be needed. The realistic threat is endpoint compromise and metadata collection, not backdoored standards.

Also today

  • Burnt TOAST: for queries that skip the large column, Postgres TOAST makes things faster — COUNT(*) 3.5× and updates 2× quicker in a benchmark — pgEdge · Lobsters
  • So my ISP was hijacking my DNS: detect it by comparing plain DNS with DoH, fix it with AdGuard Home and dnscrypt-proxy — Karthi Hegde · Lobsters

Linux & Infrastructure

Patch now: Plausible CE RCE was dropping Monero miners, and Hydra fixes path traversal

Plausible Community Edition 3.0–3.2.0 has an unauthenticated RCE via the /storybook endpoint (CVE-2026-8467). A self-hoster found an XMRig binary named linuxsys that had mined for weeks before an 800% CPU spike gave it away; it was recovered from /proc/[pid]/exe after deletion. Upgrade to 3.2.1, and treat any unpatched instance as compromised: rotate credentials.

Hydra also disclosed two flaws on 3 November: a path traversal in /log allowing arbitrary file reads under $HYDRA_DATA, and stored XSS via project homepage links. Both are fixed upstream (0-unstable-2026-11-03 in nixpkgs); hydra.nixos.org mitigates with proxy rules blocking .. in log paths. Self-hosters should update and copy the proxy hardening.

Home Assistant 2026.11: HACS becomes the built-in Marketplace

The new Marketplace entry in Settings. Source: Home Assistant

HACS, the community store, is now a first-party Marketplace in Settings — no manual install. Also: an entity-naming overhaul that adds context without breaking entity IDs or automations; target exclusions (“all lights except the kitchen”); Matter 1.5 cameras with WebRTC and two-way audio; LoRaWAN via ChirpStack and The Things Network; Zigbee Green Power for batteryless switches; and 38 new integrations.

Out of the cloud: rooted Kuna cameras and de-paywalled Brilliant panels

The Ambarella A5S SoC on a Kuna camera board, with serial test points marked. Source: kuna-local

With Kuna’s cloud gone, kuna-local documents a full de-cloud of KNP01 and Toucan cameras: a UART console on three test pads at 115200 baud, interrupt the Ambarella bootloader at amboot>, redirect init to a shell, block the Amazon IoT endpoints, and open RTSP locally. A small HTTP bridge exposes light, speaker, mic and LED to Home Assistant.

Brilliant adds a $9.99/month paywall for SmartThings control on 2 December. brilliant-ha-kiosk replaces the stock UI with a Qt Quick app talking to Home Assistant over a local WebSocket (~0.1 s dimmer latency), using Brilliant’s built-in SSH — no jailbreak, and wired lights still work when HA is down.

Yen: Nix fleets you can formally verify

Yen is a minimal pure-Nix library — no nixpkgs, no dependencies — for multi-host fleets with invariant checks before deployment. Datalog expresses fleet-wide constraints, µKanren solves assignments like port allocation, and a Lean-based checker verifies the result before anything is built. The aim is to catch cross-host mistakes per-host eval misses: duplicate addresses, misplaced databases, desktops on servers. It ships an MCP server for agent-driven changes with verification guarantees.

Hyprland 0.57 in practice: Lua as a scripting surface

Beyond the broken configs (EGL errors, nil-field crashes), users are finding uses for 0.57’s Lua configs: event callbacks that switch monitor profiles when a capture card connects, and a thread arguing Lua makes Hyprland a better scrolling WM than Niri, since layout behaviour can be scripted. Wobbly windows need the new Lua config to be active. Also new: hyprwidgets, a Rust/GTK4 tool that puts an iOS-style widget grid — iCal calendar, Open-Meteo weather, MPRIS, clock — on empty workspaces, fading out when a window opens.

CUDA is dead, long live CUDA: the NixOS CUDA team splits

The CUDA maintainer group split at NixCon Krakow on 25 September. Founder SergeK was removed by members who had taken roles at MODUS and Flox and favoured majority-vote governance and commercial partnerships over his consensus model. The existing team keeps the infrastructure, domains and NVIDIA relationship. SergeK is starting “cuda-ng”, aimed at broader GPU acceleration — graphics, chemistry, older hardware — rather than mainly LLM workloads.

Also today

  • PSA: Immich ML sends Microsoft ONNX Runtime telemetry by default — set ORT_TELEMETRY_OPT_OUT=1 — Reddit · ONNX Runtime privacy docs
  • Climate Advisor v0.8.60: a HACS integration that learns your home’s thermal model, now multi-zone — GitHub · Reddit
  • Wiki.js 3.0: full rewrite with Monaco editor, live collaboration, Excalidraw pages and multi-site — Wiki.js · Reddit
  • FOSDEM 2027 Nix/NixOS devroom CFP open; submissions close 1 December — NixOS Discourse

Long COVID & ME/CFS

RECOVER-VITAL: Paxlovid fails at any duration, including the PEM phenotype

The full RECOVER-VITAL paper in Lancet Infectious Diseases closes the antiviral chapter more firmly than the preliminary 15-day results. Across 959 participants in three phenotypes — cognitive, autonomic, and exercise intolerance/PEM (n=332) — neither 15-day nor 25-day Paxlovid helped on any primary or secondary endpoint; all groups improved at the same rate. Participants were selected by symptoms only, with no test for viral persistence, so benefit in patients with persistent antigen is not ruled out. Blood for that analysis was collected; results are pending.

LDN fails its first double-blind RCT in post-COVID ME/CFS

A Canadian decentralised RCT (Nacul et al., preprint 22 October) gave 160 adults meeting IOM ME/CFS criteria LDN up to 4.5 mg/day or placebo for 16 weeks. No difference on fatigue, pain, symptom score, step count or quality of life; adverse events were similar. It lands just as RECOVER-TLC’s Brave-LC (LDN, ages 6–25, n=1,300) activates its first site in mid-November; the workshop noted Brave-LC is powered to find subgroup effects. The Canadian result is not yet peer-reviewed and covers only adults with post-COVID onset — but it is the first proper controlled evidence.

IVIG results for LC-POTS due next week

The RECOVER-AUTONOMIC IVIG trial (Gamunex-C, 2 g/kg monthly for nine months, n=200) has completed. Results will be presented at AHA Scientific Sessions (9 November) and the American Autonomic Society symposium (12 November), with a public announcement on recovercovid.org afterwards. Unlike the negative ivabradine arm, IVIG targets immunomodulation and autoantibody reduction — directly relevant to the GPCR-autoantibody hypothesis. Participants were not selected by autoantibody status, so watch for a biomarker sub-analysis.

Tracking

Immunology
REVERSE-LC (baricitinib, Phase 3) — 328/550 through CPET; registry completion Nov 2026, no results yet
ANKTIVA (IL-15) — COVID-4.019-Long overdue since July; INTERRUPT_LC completed October; both silent
TURN-LC (immunoadsorption, Amsterdam UMC) — recruiting, AAb-stratified; completion Dec 2027
Daratumumab “ResetME” (Haukeland) — recruiting, results ~2027; TAME (tafasitamab) pilot — no update
Sipavibart (Klimas/NSU) — Phase 2 RCT; primary completion December 2026
Pipeline
RECOVER-TLC — only REVERSE-LC enrolling; Brave-LC, Tame-LC and Block-LC target first enrolment December 2026
Rapamycin RCTs — correction: no November results; Simmaron RAPA STEP 4 mid-2027, Mount Sinai Phase 3 (NCT06960928) 2027+
Larazotide (Harvard/MGH) — completed June 2026 (n=107); no results posted
Bezisterim — no Phase 3 protocol or registration; LC programme in limbo
PROBE-PASC (Pemgarda + HCQ, UCSF) — ongoing; no updates
cd ~/repos/josse-posten && claude --resume 7a6dfa53-b77a-457b-8813-46bf3cc8613a