Trump promises a “big, beautiful” deal for all of Europe while Russia leaves Kyiv without water. The quieter stories are about infrastructure nobody guards: undersea cables, map labels, and a 257-character password.

Trump signals a “big, beautiful” deal with Russia; Kushner announces peace talks next week

Trump met Kirill Dmitriev at the White House and hinted at a coming agreement affecting “all of Europe”. He did not meet the Ukrainian delegation that attended the same event. Envoy Jared Kushner then announced US–Russia–Ukraine peace talks for next week. Washington’s proposals reportedly cover a ceasefire and long-term security arrangements. Trump also called the law banning Russian fuel imports “pretty bad”, which signals openness to easing economic pressure on Moscow. When asked about Russian killings of Ukrainian civilians, he said: “Russia is losing civilians also.” The Kremlin says Trump “will continue his foreign policy” whatever the midterm result. Meanwhile, Russian diesel tankers are turning away from US routes as the deal runs into sanctions complications. (Also covered in Ukraine)

Ukrainska Pravda: Kushner · Ukrainska Pravda: “all of Europe” · Ukrainska Pravda: fuel ban · DW · Washington Post · BBC: Kremlin · Kyiv Post: tankers · Reddit: Trump clip

Kyiv’s worst water outage of the full-scale war; every Ukrainian power plant now damaged

People walk along the unlit Landscape Alley in Kyiv during a partial power outage after Russian attacks, 1 November 2026. Photo: Getty Images

Zelensky said every Ukrainian power plant has now been hit. Overnight on 5–6 November, Russia launched 227 drones at energy infrastructure across several oblasts, up from 128 the night before. The power failures caused Kyiv’s worst water outage since the invasion began, with all city districts affected. DTEK says Russia has moved to more intensive, coordinated attacks on the grid: its facilities have been struck 78 times since about 2 November, against 11 times in all of 2022. The death toll from the 2 November glide-bomb strike on the Komyshuvakha aid station has risen to at least 43.

Kyiv Independent · Kyiv Independent: live · Ukrainska Pravda: power plants · Ukrainska Pravda: 227 drones · Ukrainska Pravda: tactics

Russia secretly supplied Iran with 90 missile launchers, as Iran’s security chief meets Putin

Vladimir Putin shakes hands with Mohsen Rezaei, Secretary of Iran’s Supreme National Security Council, in Moscow, 5 November 2026. Photo: Alexey Babushkin/Pool via AFP

The Financial Times obtained production schedules from a major Russian defence manufacturer. They show that Russia agreed to supply Iran with 90 launchers for the same advanced guided missiles used widely in Ukraine. The trade now runs both ways: Iran sends drones and artillery shells west, and Russia sends precision-strike capacity back. On Thursday, Iran’s security chief Mohsen Rezaei delivered a personal letter from Supreme Leader Khamenei to Putin in Moscow. Russia also told its citizens to avoid travel to Iran. New satellite images from November show major digging and new structures near Iranian ballistic missile sites. (Also covered in Investigations)

Financial Times · Al Jazeera · Caspian Post · CBN: travel warning · BBC: missile sites · Reddit

Second wave of bomb hoaxes hits European airlines; hybrid warfare suspected

At least 34 flights across Europe were disrupted this week in two waves of coordinated hoax bomb threats. Aircraft were diverted or made emergency landings. The UK government called the latest incidents a “malicious hoax threat”. Analysts are looking at possible links to Russian or Iranian proxy groups, but no hard evidence has been made public. The incidents add to concerns about grey-zone attacks on civilian infrastructure.

BBC: hoax threats · BBC: who could be behind it? · BBC: ATC messages · Guardian: hybrid war fears · Guardian: live

Paraguay’s president resigns over the bank collapse, and is impeached within minutes

President Santiago Peña resigned after the collapse of Ueno Bank. His government had authorised the bank to expand dramatically before it froze the savings of millions of Paraguayans. Minutes after he resigned, Congress voted to impeach him anyway, which is widely seen as a way to make sure he cannot return to office. The crisis has wiped out a large share of the country’s private savings.

BBC · The Guardian · NPR · AP

Indicator	Value	Change
S&P 500 (f)	7,400	+0.23%
Dow 30 (f)	51,195	-0.81%
Nasdaq (f)	27,056	+1.14%
Russell 2000 (f)	2,734	-0.04%
VIX	27.13	-3.73%
Gold	4,082	-0.78%
BTC	$75,587	-6.01%
EUR/USD	1.1185	-0.38%
USD/NOK	9.3772	+0.80%

Tech rout after Democrats flipped the House: the Nasdaq fell more than 5% on fears of AI regulation, about $2 trillion off global tech (see World). Nasdaq futures are up 1.14% this morning, and the VIX is still high at 27.
BTC -6.0% and USD/NOK +0.8% (weaker krone) follow the broad risk-off mood.

World

$2 trillion tech rout as Democrats flip the House

Democrats took control of the House, helped by backlash over the Iran war and the cost of living. Several long-held Republican seats in North Carolina flipped, and dozens of races are still uncalled. Markets reacted sharply: the Nasdaq fell more than 5%, wiping about $2 trillion from global tech stocks, as investors feared a Democratic Congress would bring new AI and data-centre rules. South Korea suspended trading on the KOSPI. In Los Angeles, democratic socialist Nithya Raman defeated Mayor Karen Bass, so both New York and LA now have democratic socialist mayors.

Guardian: live · NPR: tech rout · NPR: uncalled races · NPR: North Carolina · BBC: LA mayor · Korea Times

Judge blocks Trump’s triumphal arch hours after approval; Oval Office declared a monument

A model of Trump’s proposed triumphal arch on display in Washington, DC. Photo: Kylie Cooper/Reuters

A federal judge issued a 14-day restraining order against construction of Trump’s triumphal arch in Washington, DC, only hours after the planning commission approved it late on Thursday. The same week, Trump signed a proclamation that makes the Oval Office and Cabinet Room national monuments. He said he wanted to stop future administrations from “ripping down” his gold-covered redesign. Elsewhere in the post-midterm White House, there are calls to replace Pentagon chief Pete Hegseth, who may also face an impeachment vote, and rumours that Marco Rubio is preparing a 2028 run. The White House denies both. Harmeet Dhillon, head of the Justice Department’s Civil Rights Division, resigned after 18 “tumultuous” months.

Guardian: arch · Al Jazeera · NPR: arch · BBC: Oval Office · Guardian: proclamation · BBC: Hegseth/Rubio · NPR: Dhillon

Israel: Eisenkot secures a majority; Herzog to name a PM candidate on Sunday

Yashar party leader Gadi Eisenkot at an election event. Photo: AFP

Gadi Eisenkot, leader of the Yashar party, now has endorsements from 67 lawmakers, a majority that includes the Arab Joint List. President Herzog will name a candidate to form a government on Sunday, and Eisenkot is the frontrunner. The courts rejected Netanyahu’s fraud claims, and he could be out of the premiership for the first time since the Iran war began.

The Guardian · Al Jazeera: Sunday · Al Jazeera: Joint List

Yemen’s government purges its leadership as the Houthis advance and demand $51 billion

Yemen’s UN-recognised government dismissed ministers and senior officers after Houthi territorial gains and a four-week siege of Taiz, the country’s third-largest city. The Houthis publicly demanded $51 billion from Saudi Arabia to end the war, a figure analysts call maximalist positioning. Turkey’s parliament ratified a “Mecca Defence Agreement” with Saudi Arabia, which prepares the ground for more Turkish military involvement. Around the region, Lebanese residents are stocking up and packing bags in fear of a third Israeli escalation, and Iraq’s foreign minister called Trump to say Baghdad wants to stay out of the US–Iran war. He also urged Iran-aligned groups in Iraq not to join any Iranian retaliation.

Guardian: Yemen · Invezz: $51bn · Al Jazeera: Mecca pact · Al Jazeera: Lebanon · Al Jazeera: Iraq

California commutes all 548 death sentences, the largest mass clemency in US history

Governor Gavin Newsom commuted the sentences of everyone on California’s death row, historically the largest in the country, citing state values and systemic flaws in the legal system. The same week, Alabama, Florida and Indiana carried out executions on the same day, tying a 2010 record.

BBC · Al Jazeera · Guardian: three executions

France: 600,000 march in a general strike; Serbia’s student movement wins power

Trade unions joined a general strike across France over the cost of living and cuts to public services. The interior ministry counted 600,000 demonstrators, and the unions say more. The government deployed 70,000 police. In Serbia, final results clear the way for the student-led movement that grew out of mass anti-corruption protests to try to form a government.

BBC · The Guardian · RFI · ABC News · AP: Serbia

Also today

Politics: Indonesia names a fourth suspect in the wiretapping scandal that is splitting Prabowo and Jokowi; the navy deploys almost 21,000 personnel to secure Jakarta, without explanation — Al Jazeera · IDN Financials; Somalia’s top court rejects President Hassan Sheikh Mohamud’s term extension, putting the first nationwide elections since 1969 in doubt — BBC; Lula’s re-election ends US hopes of quick access to Brazil’s rare earths — Reuters · Guardian: Lula’s win
Rights and repression: Macau sentences veteran campaigner Au Kam San to 12½ years for subversion, the territory’s first national security case — BBC; Israeli settlers seize eight Palestinian homes in Jericho and burn olive trees in Burqa; Israel tightens control of East Jerusalem schools — Al Jazeera: Jericho · Al Jazeera: Burqa · Al Jazeera: schools; The Taliban burn hundreds of seized musical instruments as “immoral” — The Telegraph; Russell Brand convicted of rape in the UK; the judge says he will go to prison — NPR

Ukraine

Afipsky refinery hit; 2026 accounts for half of all wartime refinery strikes

Smoke over the Afipsky oil refinery in Krasnodar Krai after a Ukrainian drone strike. Photo: Exilenova+

Ukrainian drones struck the Afipsky refinery in Krasnodar Krai, one of southern Russia’s largest. Ryazan and the Oryol industrial complex are still burning. A tracker of Russian refinery strikes counts 50% of all hits since 2022 in 2026 alone. Ukraine also hit a Pantsir air-defence system in the Sumy direction and destroyed a Grad launcher in Belgorod Oblast with FPV drones.

Ukrainska Pravda · Reddit: refinery hitlist · Reddit: Ryazan · Reddit: Pantsir

Russia arrests “Romanov Lite”, the milblogger who exposed the Oleshky propaganda

Russian authorities arrested military correspondent Vladimir Romanov after he revealed that most Oleshky evacuees went to Ukrainian-held territory, contrary to the Kremlin’s version. His post predicted that Russia would misreport the bus numbers. Newsmax, the only US outlet allowed inside, later confirmed that 11 of 15 buses went to Ukraine. Romanov was one of the last outspoken critics of Russian military exaggeration. Meanwhile, Melania Trump hosted Russian and Ukrainian delegations under the Oleshky ceasefire framework. Both sides credited her publicly, although her exact role is unclear, and only Kyiv called for more Oleshky-style missions.

ISW · Kyiv Independent · BBC · NPR · Reddit

Russian infiltrators use the drained Kakhovka Reservoir bed to flank Orikhiv

Russian infiltrators are using the exposed bed of the Kakhovka Reservoir to move toward Malokaterynivka north of Prymorske. The route bypasses Ukrainian defensive lines at Plavni. Ukrainian forces cleared most of Mala Tokmachka, but Russian elements have entered southern Prymorske and positions west of Orikhiv, keeping up a two-pronged encirclement attempt. Across the front, Russian assaults fell to 184 on 5 November, below the 206-per-day average, and the Kostyantynivka push lost intensity after this week’s surge.

ISW

Washington’s Belarus policy splits: Trump envoy pushes Lithuania to reopen ports

A Kyiv Independent exclusive reports that US envoy John Coale has pushed Lithuania to reopen its ports to Belarusian potash, without the State Department’s knowledge. Officials call US policy “schizophrenic”: career diplomats do not know about the Coale and Witkoff initiatives, while White House officials defend the December 2025 lifting of potash sanctions as “progress with Minsk”. Lithuania refuses. (Also covered in Investigations)

Kyiv Independent · Reddit

Also today

Zelensky says Ukraine must adapt to the new US political realities to solve its Patriot shortage — Reuters
Putin places Japan Tobacco International’s Russian assets under “temporary administration”; Russian regions cut payments to families of fallen soldiers as budgets shrink — Reuters · Kyodo · Bloomberg
NATO is reportedly preparing a new defence plan that foresees deep strikes inside Russia — Ukrainska Pravda

Investigations

Russia rehearsed cutting Svalbard’s cables, and the West has almost no repair capacity

USNS Zeus, the US Navy’s last cable repair ship, was decommissioned in 2025. Photo: geograph.org.uk

In spring 2026, NATO allies tracked Russian deep-sea submersibles in a covert Arctic exercise off Norway. The exercise simulated using a weapon designed to disable the two undersea cables that link Svalbard to the mainland. War on the Rocks puts this next to a structural problem: only about 22 specialised cable repair ships exist worldwide, the US Navy retired its last one in 2025, and replacement cable takes months to make. A 2025 earthquake near Taiwan damaged six cables at once, and repairs ran into May 2026, which shows what coordinated sabotage in several theatres could look like. The argument: cable repair must be treated as a national security mission, not a commercial service.

War on the Rocks

Bellingcat: Google and Bing Maps were Iran’s targeting guide for US bases

Google Maps label for the Camp Buehring main HQ next to a satellite image of the same building destroyed, as published by Iran’s Tasnim news agency. Image: Bellingcat

At Camp Buehring in Kuwait, Maps labels for the main HQ, gym and self-help centre matched the structures destroyed in Iranian strikes. At Muwaffaq Salti Air Base in Jordan, an “Airman’s Attic” volunteer shop was pinpointed within 40 metres of the impact that killed three US service members. User reviews revealed activity patterns, meal times and busy hours. Bing Maps showed unblurred satellite imagery where Google had obscured it, so the base layouts stayed fully visible.

Bellingcat

ICIJ: ICBC lent $590M to place Chinese state firms in European wind energy

Wind turbine assembly line at a Goldwind branch in Xinjiang. Photo: Getty Images

ICBC’s London branch channelled more than $590M in loans to place Chinese state companies in at least 16 UK wind farms and wider European energy infrastructure. The main vehicle was Goldwind, “the Huawei of green energy”, which got $110M from ICBC London in a $300M loan package in 2018. Internal bank records show officers framed the deals as advancing “the Chinese government’s economic policy objectives” under Belt and Road and Made in China 2025. The European Commission has opened formal investigations into whether the state-subsidised financing gave Chinese firms an illegal advantage.

ICIJ · Reddit

Why modern wars have become harder to end, and what the new Congress can do

A War on the Rocks roundtable of five experts finds two main mechanisms. The US arms allies without agreeing with them on political goals or what victory means, so interests diverge and there are no exit conditions. And global economic interdependence gives more outside actors the means to keep losing belligerents going. Wars therefore end more often as frozen conflicts than as settlements. A Carnegie analysis lists three levers for the Democratic Congress on Trump’s foreign policy: riders on must-pass bills such as the NDAA, war-powers and arms-sale disapprovals with fast-track Senate treatment, and investigations that build the case for binding legislation. Without veto-proof majorities, most of this depends on sustained political pressure.

War on the Rocks · Carnegie Endowment · Reddit: wars · Reddit: Congress

Also today

Golden Dome would trigger the arms race it claims to prevent: re-MIRVed arsenals, interceptors as ASAT targets, decision times of “tens of seconds”, and first-strike temptation — War on the Rocks
The US–China AI stability deal from Xi’s September visit builds confidence but has no enforcement — War on the Rocks
Hormuz: two tankers and a tug burn after hitting mines; South Korea sends a destroyer but limits it to waters south of Oman; Iran’s exemptions for India, China, Iraq and Qatar map its alliances — SBS · Hindustan Times

Tech

sshhole: three old musl and OpenSSH decisions let any 257-character password into locked accounts on Alpine

Three independent design choices combine into a real authentication bypass on musl systems. musl’s crypt() returns "*" on failure instead of NULL (2012). musl’s SHA-512 caps input at 256 bytes, so longer passwords make crypt() fail (2012). And OpenSSH borrows another account’s salt when it hides timing for non-existent users (2016). The result: any account stored with * as its password hash (key-only users, LDAP accounts, root) accepts any password longer than 256 characters. On Alpine’s official AWS and Azure images, the default alpine user is vulnerable and has passwordless doas, so it is root. glibc systems such as Debian and Ubuntu are not affected. Fix: apk upgrade openssh (10.6p2). The site has a live demo in the browser.

sshhole.com · Lobsters

BUI: Blender’s UI runtime as a cross-language library

Blender’s node editor rendered by BUI outside Blender. Image: BUI

BUI extracts Blender’s interface layer as a standalone C library with bindings for Python, Rust, JavaScript/React, C/C++ and Dear ImGui: the same 45 Blender-compatible widgets, node editor, colour picker and pie menus. The project claims about 38 ms to first frame for Rust HTML+CSS against about 231 ms for GPUI. Damage-only rendering means idle windows use almost no CPU. Whether or not the benchmarks hold, the architecture is interesting: Blender’s UI has decades of real-world polish.

GitHub · HN

Can 23,000 qubits break RSA-2048? A close read of the Alice & Bob paper says no

The claim depends on bit-flip errors happening once per 100 years per qubit. Alice & Bob’s own experiments show errors “once every few minutes” under some conditions, a gap of more than 100 million times. Their largest demonstrated system has 18 qubits. The scheme needs 22,593, or 45,000 in an alternative design that relies on unproven error correction. A useful primer on the gap between what a hypothetical machine could do and what we can build.

bfswa.blog · Lobsters

11 nanoseconds per word: six optimisation layers on anagram lookup

David Andersen gets a 15.8× speedup on dictionary anagram grouping by stacking low-level techniques. He uses a custom linked-list structure that removes singleton Vec allocations, u128 letter counts instead of string sorts, and FxHashMap. Then comes Gödel numbering: each letter gets a prime, and their product is a collision-free 64-bit key. Finally, 5-bit character packing with dual accumulators and branchless fixed-length loops enable auto-vectorisation. The result is about 10.9 ns per word on real data. A good example of how techniques multiply rather than add.

wiredream.com · Lobsters

Also today

SourceHut’s disabled-registration gate was bypassable for five years: the 2021 Flask→Go migration only checked the GET path of /register/step2 (CVE-2026-121728) — blog.arusekk.pl · Lobsters
Meta’s internal documents projected about $16B a year from scam and prohibited-product ads, and estimated that Meta plays a part in a third of successful US scams; Mark Cuban says Facebook “knowingly” runs deepfake ads using his face — Yahoo Finance / Reuters · HN
“The poison and the cure”: Lola Seaton reviews two books on French Theory and argues for a “productively ambivalent” reading: “think outside an author’s terms” — The Ideas Letter · HN

AI & Automation

Claude Code was sending users’ email addresses to third-party servers

Claude Code put the user’s email address from ~/.claude.json into the User-Agent header of outbound requests. Any website or API it contacted during tool use could see it. At least one user reports dozens of scam emails as a result. Anthropic shipped a cc-plugin-privacy mod in v2.1.317 to block this, but follow-up tests on v2.1.318 (Windows 11) found the leak still happened through both shell and curl calls. The GitHub issue has more than 329 reactions.

GitHub issue #107757 · HN

Anthropic replaced Git with a custom VCS after Claude drove merges to 30,000 a day

Changes merged to Anthropic’s monorepo per day, January to September 2026. Chart: Anthropic

Merges to Anthropic’s monorepo grew 12× between May and September 2026, from 2,500 to more than 30,000 a day. Scaling git checkouts naively would have needed 600 PB of CI traffic per day. Anthropic built Scion, a server-centric source control system with sparse on-demand checkouts and bounded caches. CI checkouts went from minutes to seconds, the infrastructure footprint shrank 200×, and CI saw a 25% CPU win.

Anthropic · Reddit

Portal 2 recompiled to native ARM64: 125,000 functions, no Wine, 60 fps on iPhone

With Claude Code and Codex writing most of the code under his direction, Raphaël Kanapitsas translated all ~125,000 functions in Portal 2’s Linux x86 build to C, then compiled them to native ARM64. It runs at 235–280 fps on an M3 Pro Mac and a locked 60 fps with touch controls on an iPhone 15 Pro Max. A small runtime provides the Linux environment the binaries expect (libc, threads, SDL2, OpenGL, Steam). Bring your own game files. The work took a few days.

rkan.org · GitHub · Reddit

AirPods 3 head tracking on Linux: the first public RemoteHID documentation

With Claude Code as a pair engineer, starman-tech reverse-engineered Apple’s undocumented RemoteHID protocol. The key finding: the motion sensors do not appear at Linux’s default L2CAP MTU of 672 bytes, only at 2582, the value iOS uses. At that setting, motion data flows at up to ~210 Hz. The resulting tool, mousepods, turns gyroscope and accelerometer data into a virtual input device on Wayland and X11.

GitHub: mousepods · Reddit

HarnessFlow: tree search over whole agent harnesses beats hand-tuned scaffolding

Microsoft Research Asia applies Monte Carlo Tree Search to complete agent harnesses (scaffolding, tool bindings and control flow) instead of weights or prompts. A coding agent refines candidates from a component library using archived traces and execution feedback. With 15 refinement attempts per benchmark, HarnessFlow averages 69.48% across six benchmarks: +10.89 points over the initial harnesses and +3.95 over Meta-Harness, at lower cost. Related: DialFork, from Idiap and Logitech, benchmarks “procedural hallucination”, where an agent stops mid-task even though every turn is fluent and every tool call is correct. Per-turn metrics miss this failure.

arXiv · Reddit: HarnessFlow · DialFork leaderboard · Reddit: DialFork

Also today

Looped transformers don’t save HBM traffic: profiling Huginn on a B200 shows that 3.3 GB of shared weights get evicted from a 126.5 MiB L2 between kernels, so weight sharing saves storage, not bandwidth — dinara-dl.github.io · Reddit
DHH has stopped writing code by hand; 37signals is rebuilding HEY from Ruby to Rust with AI agents — Reddit
Claude Personal Finance (beta): read-only analysis of up to two years of bank transactions through Plaid; US only, Pro/Max/Ultra — Anthropic · TechCrunch

Long COVID & ME/CFS

NINDS starts a PD-1 checkpoint trial for exhausted T cells in PASC

PD1-PASC I (NCT07388550) starts on 10 November at the NIH Clinical Center. Fifteen neuro-PASC patients, selected for high PD-1 expression on CD3 T cells (≥75th percentile), get a single IV dose of pembrolizumab 200 mg. Secondary endpoints include normalised immune-exhaustion markers, clinical improvement and changes in viral antigen. The logic: persistent viral antigen → sustained PD-1 upregulation → CD8+ exhaustion → pembrolizumab releases the brake. This is the first attempt to apply checkpoint reinvigoration from cancer immunology to PASC, and it targets the same exhaustion phenotype seen in the reader’s own labs. US only; results expected January 2028.

ClinicalTrials.gov

Maraviroc + atorvastatin: first blinded RCT is recruiting, with primary completion in December

IMPACT-LC (NCT06974084, n=252, double-blind, placebo-controlled, 16 weeks) is enrolling at the University of Arizona. It is the first blinded test of Patterson’s maraviroc protocol, which topped a 3,925-patient treatment survey. Endpoints cover fatigue, dysautonomia (COMPASS-31) and cognition. Caveat: the trial excludes patients with pre-existing autoimmune disorders or ME/CFS, so it is unclear how the results will apply to patients with high GPCR autoantibodies.

ClinicalTrials.gov

Tracking

Coming soon: RECOVER-AUTONOMIC IVIG: results at AHA (9 Nov, Chicago) and AAS (12 Nov, San Diego); public announcement on recovercovid.org expected after 12 Nov; RESILIENCE (ensitrelvir, Japan, n=2000): data collection complete; results December 2026; Sipavibart (Klimas/NSU, NCT07021794): primary completion December 2026
Overdue: ANKTIVA INTERRUPT_LC + COVID-4.019-Long: past primary completion (Oct and Jul 2026); no results posted; Larazotide (Harvard, Moschovis): completed June 2026 (n=107); not yet published; Bezisterim ADDRESS-LC: PEM subgroup confirmed at ANA on 19 Oct; biomarker sub-analysis still pending
Longer term: Rapamycin: Simmaron RAPA STEP 4 mid-2027; Mount Sinai still recruiting; TURN-LC immunoadsorption: AAb-stratified, recruiting; completion December 2027; Daratumumab ResetME (Haukeland): recruiting; results ~2027; PROBE-PASC (Pemgarda + HCQ, UCSF): enrolling; results TBD

cd ~/repos/josse-posten && claude --resume ef5edf06-1768-4854-b143-3ec769b7ca13