2026-10-30 16:00 UTC | BLOCK 973836 BITCOIN $77,605 | GOLD $3,910 | OIL $113.28 1. Malicious Claude Code Extension Plants SSH Backdoors on Developer Machines -- A malicious version of Anthropic's Claude Code extension was published to Cursor's marketplace for about 11 hours on 29 October, exposing up to 5,000 developers to malware that installed persistent SSH backdoors, BleepingComputer reported. -- Extension marketplaces leave developer credentials one install away from an attacker; SSH keys planted that way survive password resets and open access to source repositories and production hosts, so teams should pin versions and audit authorized_keys on affected machines. 2. Core Lightning Bug Crashes Nodes With a Single Channel Announcement -- Nishant Bansal disclosed a Core Lightning denial-of-service flaw in versions 25.02 through 26.04, where a channel announcement naming the same node at both ends passes validation and crashes gossipd, and the stored message crashes the node again on every restart until removed by hand; CLN 26.04.1 fixes it. -- An attacker needs only to fund a 2-of-2 output and sign the announcement, so the cost is limited to onchain fees; older releases relay the message to vulnerable peers, and upgrading alone leaves the stored announcement in place, requiring operators to clear it manually. 3. Swiss National Bank Posts $23 Billion Profit on Gold and Foreign Assets -- The Swiss National Bank reported a profit of about $23 billion, lifted by gold and foreign assets and its unusually large equity portfolio, CNBC reported. -- The result supports the annual distribution to cantons and the Confederation but also shows how much of the central bank's balance sheet is market-exposed: gold at $3,910 and an equity book can swing from profit to loss with prices, leaving a large payout to flatter one year's budget and strain the next.

EDITOR WIRE | 2026-10-30 | BLOCK 973833 BITCOIN $77,540 | GOLD $3,915 | OIL $113.31 | S&P 500 $7,611 | US 10Y 4.96% Linux remote-root demonstration prompts Go warning over CVE-2026-98432 The Go Security Team is urging Linux operators to install patched kernels after Anthropic reported an attack demonstration that runs commands as root on a server exposing a Multipath TCP listener, without credentials or user interaction. The flaw, CVE-2026-98432, is in the kernel's IPv4 TCP connection handling—not Go itself—and disabling MPTCP does not repair the underlying vulnerability. Published October 15, the vulnerability is a use-after-free: concurrent connection-handling paths can leave one processor reading memory that another has already freed. Anthropic says it turned that race into a leak of kernel addresses and then attacker-chosen command execution as root. Its proof of concept took 48 minutes to obtain a kernel pointer and another five minutes to reach command execution. Those are measurements from its research setup, not a guaranteed attack time against other servers. The reviewed sources do not establish exploitation in the wild. The exposure can arise before a service's login or other application-level authentication. On an affected host with a reachable MPTCP listener, malicious network traffic reaches the vulnerable kernel code during connection establishment. Successful exploitation could give an attacker control of the host, potentially exposing service secrets, allowing workloads to be modified or taking services offline. Those are possible consequences of root access, not reported losses from this disclosure. Go's October 29 warning matters because version 1.24 introduced MPTCP-enabled listeners by default on Linux. That does not mean every binary built with a recent compiler exposes the demonstrated path: defaults also depend on the Go version declared by the application module and explicit overrides, while actual operation depends on kernel support and configuration. Operators need to check the running service and kernel rather than infer exposure from a compiler version alone. The warning has reached Bitcoin infrastructure operators. In an October 30 X post, Peter Todd advised people running lnd on Linux with open ports to shut it down until they patch the kernel or otherwise mitigate the issue, stressing that it was not lnd's fault. His warning is not evidence that every lnd deployment exposes MPTCP or that funds have been stolen; the relevant vulnerability is in the host kernel. The Go team lists temporary ways to disable default MPTCP behavior: setting GODEBUG=multipathtcp=0 in the program's environment, or adding godebug multipathtcp=0 to the main module's go.mod at build time. Explicit per-socket SetMultipathTCP calls override that default. The team calls application-by-application disabling fragile: one overlooked MPTCP listener preserves the demonstrated exposure, and other attacks against the underlying bug may not require MPTCP at all. Patches are already available upstream and for some distributions; the gap is whether a fixed package has shipped for an operator's exact distribution and kernel flavor. Debian's tracker marks linux 6.1.190-1 in bookworm security and 6.12.113-1 in trixie security as fixed. It is therefore incorrect to describe this as a Linux-wide vulnerability with no patch available. The upstream CVE record lists fixes in Linux 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56 and 7.2.10, and mainline 7.3. These are branch-specific fixed releases, not a rule that every kernel below 7.3 remains vulnerable. Distribution packages may carry backported fixes under different version numbers. Operators should check their vendor's status for the exact installed kernel package, follow its update and activation procedure, and verify that the patched kernel is actually running—not merely installed. The practical distinction is between removing one demonstrated attack path and fixing the host vulnerability. Rebuilding a Go service or disabling MPTCP may reduce exposure, but neither removes the kernel memory error. The Go team's recommended durable response is a patched kernel. Sources: https://cveawg.mitre.org/api/cve/CVE-2026-98432

Discovering and exploiting vulnerabilities in critical, real-world software with Claude

Over the past few months, we’ve used an unreleased, internal research model to find critical vulnerabilities in some of the world’s most widely...

oss-security - Fwd: Protecting against CVE-2026-98432 when using Go programs

Go, Backwards Compatibility, and GODEBUG - The Go Programming Language

X (formerly Twitter)

Peter Todd (@peterktodd) on X

Important notice for the Bitcoin community: if you are running lnd on Linux, and it has open ports, you should shut it down until you patch your Li...

CVE-2026-98432

2026-10-30 15:00 UTC | BLOCK 973830 BITCOIN $76,860 | GOLD $3,908 | OIL $113.42 1. Canada Takes Equity Stake of Up to $1.1 Billion in Toronto AI Startup -- Ottawa is buying an equity stake of up to $1.1 billion in a Toronto-based AI company, Semafor reported, part of a push by US allies to cut technological reliance on Washington; Britain's chancellor meanwhile promised a "distinctively British approach to AI" and money for a sovereign AI fund. -- State equity in domestic model builders is a subsidy with a balance-sheet claim attached, steering public capital into compute and salaries that private rounds outside the US have struggled to carry. It also risks pricing the same scarce engineers against allied governments rather than against the market. 2. Australian Senators Warn AI Scraping Exemption Could Trigger Compensation Claims -- Coalition senators and the recording industry said letting AI companies scrape music, books and journalism could amount to a constitutional acquisition of property, with constitutional lawyer Anne Twomey calling the risk real depending on drafting; the attorney general's department said it was "extremely alive" to the issue, the Guardian reported. -- If a court accepts the acquisition argument, rights holders worldwide get a compensation route and the Commonwealth carries contingent liability for the training data its AI sector consumes. Drafting an opt-out or licensing regime instead would shift cost onto developers before any litigation lands.

2026-10-30 14:00 UTC | BLOCK 973827 BITCOIN $77,248 | GOLD $3,946 | OIL $112.84 1. Gulf States Told to Rebuild Defences After 4,670-Drone Iranian Barrage -- Twelve regional states, overwhelmingly in the Gulf, faced 4,670 Iranian one-way attack drones and more than 1,400 ballistic missiles in the weeks before the 8 April ceasefire, nearly half aimed at the UAE, according to an International Institute for Strategic Studies report. -- The study puts one estimate of damage to energy infrastructure as high as $58bn and questions both continued reliance on US bases and "overdependence on expensive, high-end systems", pointing Gulf procurement toward cheaper counter-drone layers and local production instead of another round of high-end interceptors. 2. Qatari Mediators Return to Tehran in Last-Ditch Push Before Midterms -- Qatari officials arrived in Iran to try to revive a ceasefire with Washington, talks the Financial Times reports are aimed at preventing an intense new round of war ahead of next week's US midterm elections, amid speculation about a resumption of hostilities. -- A decision on renewed strikes now effectively falls after the 3 November vote, keeping a war premium in Brent at $112.84 and in gold at $3,946 until Washington and Tehran settle whether inspectors or bombers come next. 3. Senior RSF Commander Defects From Hemedti's Forces -- Siddiq Ander, a senior commander in Sudan's Rapid Support Forces, announced his defection in an exclusive video obtained by Al Jazeera. -- Defections at command level cost the RSF more than manpower: they strip local knowledge of Darfur supply routes and garrison arrangements at a point when siege tactics and aid obstruction have already put parts of the country at famine risk. 4. Trezor Warns Resold Safe 5 Wallets Carried a Seed-Stealing Implant -- A customer reported finding an extra circuit board inside a Trezor Safe 5 bought from reseller CryptoBilis that transmits the recovery phrase over a mobile network; Trezor has not examined the device and is telling anyone who bought from the reseller since March 2026 to move funds to a new wallet with a new recovery phrase. -- The implant sidesteps firmware attestation entirely, since the device still boots and signs normally while the seed leaves the room; with bitcoin at $77,248, buyers now have to treat a third-party seller as part of the trust boundary rather than a cheaper route to the same hardware.

2026-10-30 13:00 UTC | BLOCK 973822 BITCOIN $77,430 | GOLD $3,965 | OIL $112.98 1. Spain Points to Signalling Failure as Train Crash Toll Reaches 69 -- Prime Minister Pedro Sánchez said evidence currently points to a failure inside Adif's command and control centre, as officials confirmed 69 dead, with at least 70 reported missing and possible victims of 27 nationalities after Wednesday's collision near Toledo. -- Blaming the state infrastructure manager rather than either operator directs liability toward Adif and makes signalling on the Mora-Orgaz stretch the central question for investigators; the closed Madrid-Seville trunk line keeps diverting passenger and freight traffic while Renfe and Iryo review joint operating rules. 2. UK Competition Regulator Opens Case Against Meta's Content Terms -- The Competition and Markets Authority opened a Competition Act 1998 investigation into whether Meta's revised commercial terms, which would let it collect content from business and publisher websites to build AI products without consent, abuse a dominant position; Meta paused the rollout on 28 October. -- A finding of abuse would force Meta to offer UK businesses an opt-in or payment instead of a default, and hands publishers a statutory lever beyond the objection rights account holders hold under data law. 3. Researcher Proposes Silent Payments From Multiparty Wallets -- Oleksandr Kurbatov posted a two-round protocol to Delving Bitcoin that lets wallets built on FROST or MuSig2 produce silent payment transactions by computing the ECDH share as a weighted sum of signer contributions with an AggDLEQ proof, an input type BIP352 does not recommend for want of a security proof. -- Collaborative-custody and exchange wallets that cannot offer silent-payment privacy under the BIP as written would gain it without new PSBT fields, but the construction rests on an assumption whose hardness is still open, giving wallet teams reason to wait for the paper now under review. 4. Limpet Mines Mark Tactical Shift in Hormuz Attacks -- Attackers in a speedboat attached limpet mines to a tanker in the Strait of Hormuz on Thursday, damaging the ship in the first such incident since 2019, the Financial Times reported, describing an apparent shift in Iranian tactics. -- Mines fixed by hand rather than drifting are deniable and escape sweeps of the transit lanes, so they raise hull and war-risk premiums for cargoes carrying about a fifth of world oil while Brent trades near $113.

2026-10-30 12:00 UTC | BLOCK 973816 BITCOIN $77,778 | GOLD $3,976 | OIL $113.19 1. Church Says At Least 60 Christians Killed in Ethiopia Violence -- At least 60 Christians have been killed in Ethiopia in violence declared religious by the Orthodox Church, with around 20 houses burned and rebels and local government blaming each other, France 24 reported. -- The disputed attribution decides whether federal forces or regional rebels carry responsibility, while church pressure can harden demands for security in a country where religious identity increasingly overlaps with territorial conflict. 2. Exxon and Chevron Beat Forecasts as War Lifts Diesel Margins -- ExxonMobil and Chevron beat third-quarter profit forecasts as war-driven refining margins soared and both warned of tight diesel supply, with the Financial Times tying the gains to President Trump's war in Iran. -- Refining rather than crude production is where the war pays: bombed plants in Russia and the Middle East tighten diesel, lifting margins for operators able to process crude while hauliers and consumers absorb the pump cost. Brent at $113.19 keeps that spread wide. 3. US Presses Allies to Back Ukraine Truce as Lavrov Joins G20 Talks -- The United States is pressing allies to support a Russia-Ukraine truce as Russian Foreign Minister Sergei Lavrov arrives for a G20 foreign ministers' meeting, Semafor reported. -- Putting Lavrov in the same room as US officials turns the G20 into a working channel, but pressure on allies rather than Moscow suggests Washington is assembling terms first; any framework still has to bridge sanctions relief and territorial control. 4. Bitcoin Core Cuts Embargo for AI-Findable Bugs -- Bitcoin Core amended its security policy so easily discoverable bugs, including those found with a simple AI prompt, get immediate backports and point releases rather than waiting for the next major version; fixes for three such flaws shipped in 32.1, 31.2, 30.4 and 29.5, Bitcoin Optech reported. -- AI-assisted auditing compresses the time between discovery and exploitation, so node operators face more frequent urgent upgrades; the policy trades a longer embargo for faster disclosure and puts the burden on operators to track point releases.

2026-10-30 11:00 UTC | BLOCK 973806 BITCOIN $77,364 | GOLD $3,983 | OIL $113.50 1. Trump Backs Bukele's Troop Surge Into Haiti -- El Salvador's President Nayib Bukele is sending thousands of troops to Haiti to help its government fight gangs and recover four of his soldiers captured in an ambush, after President Trump told him "do what you have to do" in a Tuesday call, Axios reported; Haiti's government agreed to the deployment. -- Haiti has lacked a president since Jovenel Moïse's assassination five years ago and gang violence has killed more than 5,700 people this year, so the intervention is a live bet on El Salvador's security model: stabilisation would hand Bukele a second exportable product, failure would push the toll higher with no UN mandate to share the blame. 2. Ukraine Sanctions Russian Satellite Network and 39 Shadow-Fleet Tankers -- President Volodymyr Zelensky enacted a National Security and Defence Council decision imposing sanctions on the Russian companies and individuals developing the Rassvet satellite communications system and on 39 vessels in Russia's shadow fleet, Ukrinform reported. -- Rassvet is Moscow's answer to Starlink, holding a couple of dozen satellites against roughly 13,000, so designating its developers strikes at the command-and-control side of the war while the tanker list goes after export revenue; unilateral sanctions bite mainly through the paperwork trail they create for insurers, charterers and ports handling those hulls. 3. Binance Targets Reopening Within Days as Frozen Funds Cap Recovery -- Binance has vowed to get the exchange back up within a couple of days after a record $6.3 billion heist, MarketWatch reported, while CNBC said billions of dollars in assets have been frozen and whether the funds can be recovered remains open. -- Bitcoin at $77,364 is down from about $80,386 before the breach broke, so restoring access brings back a venue with 335 million users without settling confidence; the issuer-level freezes only reach balances still sitting in dollar tokens, and anything swapped into bitcoin or pushed across a bridge depends on on-chain tracing.

2026-10-30 10:00 UTC | BLOCK 973799 BITCOIN $77,722 | GOLD $3,993 | OIL $112.75 1. Novaya Gazeta Closes Under Kremlin Pressure -- Novaya Gazeta, one of Russia's last independent newspapers, announced its closure Friday, citing pressure from authorities after police searched the home of a senior editor and detained a journalist earlier this year. -- For civil liberties, the closure strips Russian readers of a newsroom willing to report on the war and Kremlin corruption from inside the country; as policy, it leaves Telegram channels and exile outlets that face blocking and prosecution as the remaining channels. 2. Binance Traces $6.3 Billion Theft to Compromised DevOps Laptop -- Binance linked the theft of about $6.3 billion to a DevOps engineer's compromised laptop and a service container, saying no wallet private key leaked and that it will cover all losses from its SAFU fund and company funds. TRM Labs and Chainalysis attributed the attack with high confidence to North Korea's TraderTraitor unit. -- About $2.4 billion sits in ETH and BTC beyond the reach of Tether, Circle and Arbitrum freezes, leaving recovery to on-chain tracing of a state-backed group. For markets, exchange-laptop compromise rather than a key leak shifts the security burden onto hosting, access control and proof-of-reserves audits. 3. China Sends Combat-Readiness Patrols Around Scarborough Shoal -- China said its forces conducted combat-readiness patrols around the disputed Scarborough Shoal in the South China Sea, calling them a necessary countermeasure to the Philippines' "rights-violation and provocative acts". -- The patrols assert Chinese control over a fishing ground both countries claim, raising the security risk of close encounters between coast guard and naval vessels; diplomatically, they test how far Washington will back Manila's defense commitments. 4. Houthi Siege Pushes Yemen's Taiz Toward Collapse, Governor Says -- The governor of Taiz said the Houthis' month-long siege has left oxygen, food and water running short, with rubbish piling up because landfill sites are full or unreachable, and accused the group of massacres as he urged outside help to lift it. -- Taiz is Yemen's third city and a front line, so keeping hospitals supplied and roads open is the practical test; a collapse would extend supply-chain failures and displacement into a war already driving famine conditions. 5. Amazon and Intel Slide Before Open as AI Spending Fears Hit Tech -- Amazon fell 7% and Intel 25% in premarket trading Friday after earnings stoked investor anxiety over the scale of AI capital spending and whether it will pay off. -- The move extends a rout that erased more than $500 billion from Alphabet on Thursday, and for markets it raises the cost of equity and debt for data-centre builders and suppliers already leaning on credit to fund expansion.

2026-10-30 09:00 UTC | BLOCK 973794 BITCOIN $77,970 | GOLD $3,988 | OIL $112.68 1. France Deploys 70,000 Police Ahead of Halloween Protests -- France will deploy about 70,000 police officers in Paris and other cities before nationwide protests on Saturday, with Interior Minister Laurent Nunez warning of a "very high risk of public disorder" after October 17 demonstrations turned into rioting and looting. -- The deployment tests whether pre-positioned units can prevent a repeat of storefront damage that hit retailers and insurers this month; a disorderly night would also raise the political cost for a government already under budget and energy pressure. 2. Ukrainian Drones Hit Russian Samara Refinery -- A group of drones struck the Novokuybyshevsk oil refinery in Russia's Samara region overnight, Ukrainian media reported, with a military canning plant also hit. -- Samara lies deep inside Russia's rear, so the strike demonstrates Ukrainian drone range beyond the border regions and puts refining capacity that supplies domestic fuel and export blends at risk; repeated hits would force repairs and could tighten product supply.

CODE WIRE | BLOCK 973795 BITCOIN $78,000 | GOLD $3,990 Tails OS 7.16 -- Tails is a portable operating system that routes Internet connections through Tor and leaves no trace on the computer unless explicitly configured. -- Tails 7.16 updates Tor Browser to 16.0, bringing Firefox 153’s redesigned settings, updates the Tor client to 0.4.9.15, and fixes OpenPGP support in Thunderbird. -- Source:

Tails - Tails 7.16

2026-10-30 08:00 UTC | BLOCK 973789 BITCOIN $78,462 | GOLD $3,989 | OIL $112.50 1. North Korea Vows 'Force' Response to U.S.-South Korea Air Drills -- North Korea's defense ministry denounced the two-week Freedom Flag exercise that began Oct. 26, citing allied army, navy and marine units plus refueling tankers and attack drones, and said its armed forces would "thoroughly deter threats with force," according to KCNA via Yonhap. -- The missile-then-denunciation sequence keeps cross-border security risk elevated while nuclear diplomacy with Washington stays frozen, giving Seoul and Tokyo a concrete reason to sustain trilateral missile-tracking and warning-data sharing. 2. French Economy Contracts as Energy Costs and Borrowing Bills Bite -- France's economy shrank 0.1% in the third quarter, with the eurozone's second-largest economy weighed down by high energy prices and a surge in borrowing costs, the Financial Times reported. -- A contraction thins Paris's fiscal buffer against war-driven fuel costs and raises refinancing costs on debt investors already price at a premium to German bunds; it also complicates the ECB's inflation fight hours after President Christine Lagarde signalled her February exit. 3. Mahmood Refuses to Share Homelessness Forecast for Asylum Overhaul -- UK Home Secretary Shabana Mahmood has repeatedly declined to tell ministerial colleagues how much homelessness she expects her asylum changes to cause, even after her department's impact assessment conceded a rise was possible, the Guardian reported. -- Councils and homelessness services need the numbers before asylum hotels close, and a visible rise in rough sleeping would undercut the government's Christmas pledge, turning the dispute into a policy fight over which department carries the cost.

2026-10-30 07:00 UTC | BLOCK 973784 BITCOIN $78,666 | GOLD $3,995 | OIL $111.59 1. Mines Set Four Tankers Ablaze in Strait of Hormuz, Iran Says -- Iran's Revolutionary Guards said four tankers caught fire after hitting mines on a route through the Strait of Hormuz they called unauthorized; the timing of the incidents and the vessels' flags were not immediately established. -- Four casualties at once are the sharpest test yet of the US-escorted transit model, raising hull and war-risk premiums for cargoes carrying about a fifth of global oil while Brent trades at $111.59. 2. FCC Sets Vote to Cut Chinese Carriers From US Phone Numbers -- The Federal Communications Commission plans to vote on Nov. 19 to bar China Mobile, China Telecom and China Unicom from direct access to US phone numbers on national security grounds. -- Direct number access lets the carriers hand off calls without a US intermediary; cutting it pushes traffic through American operators, adding interconnection cost for business lines and roaming while giving Washington a licensing lever over the three state-owned firms. 3. Machado Urges 2027 Vote and Breaks With US Oil Deal -- María Corina Machado returned to Venezuela from exile and called for elections in 2027, praising Donald Trump for "freedom" while criticising Washington's oil deal with Caracas. -- Naming a date turns opposition pressure onto interim president Delcy Rodríguez, and the split over the US oil arrangement gives Machado distance from a bargain that touches the revenue the government needs to fund any vote.

2026-10-30 06:00 UTC | BLOCK 973776 BITCOIN $78,648 | GOLD $4,008 | OIL $111.86 1. UK refuses entry to Andreas Malm ahead of Palestine Action hearing -- Immigration officials told Malm, a Lund University human-ecology academic and author of How to Blow Up a Pipeline, that his presence "may not be considered to be conducive to the public good" before a Tribune conference where he was to appear with Palestine Action co-founder Huda Ammori; Sally Rooney called the decision "cultural self-harm". -- The test is discretionary and unexplained, so it works as a censorship lever needing no charge or court finding; the refusal lands five days before the Supreme Court hears the group's proscription challenge and supplies a live example of what the ban now reaches. 2. Russian strikes cut power to more than 350,000 around Dnipro -- Overnight attacks left more than 350,000 consumers in Dnipro and surrounding settlements without electricity and damaged an industrial facility in the Kremenchuk district of Poltava region, Ukrinform reported. -- Repeated hits shift the constraint from generation capacity to restoration time, and with Kyiv's interceptor requests stalled in Washington, repairs can be undone faster than crews finish them; district heating draws on the same supply as temperatures fall. 3. Datacentre boom rests on exploited migrant labour, joint investigation finds -- A five-month Guardian and Investigate Europe probe across Sweden, Norway, Belgium and the Netherlands documented arc-flash burns, vermin-infested shared housing, an unreported tuberculosis case and hundreds of payslips showing unpaid overtime and missed holiday pay on sites built for Google and Microsoft. -- Europe already runs more than 2,300 data centres with hundreds under construction, so the labour model sits beneath capacity hyperscalers are contracting for; unreported outbreaks and accidents for which no contractor has been held liable are schedule risk that does not appear in buyers' own supply-chain audits.

2026-10-30 05:00 UTC | BLOCK 973770 BITCOIN $78,346 | GOLD $3,995 | OIL $112.00 1. Binance Puts Hack Impact at $6.3 Billion and Pledges to Cover All Losses -- Binance said a security incident affected an estimated $6.3 billion in assets, that about $3 billion has been frozen with partners, and that it will cover all losses; TRM Labs attributed the breach to North Korean unit TraderTraitor with "high confidence", and Binance said it may have started with a compromised engineer's laptop. -- Issuer blacklists are the only fast recovery lever and reach no further than balances still held in dollar tokens; anything swapped into bitcoin or bridged out is beyond recall. A state-actor attribution turns an operational failure into a sanctions problem for a venue with 335 million users. 2. BOJ Holds Rates and Declares Its Inflation Target Met for the First Time Since 2013 -- The Bank of Japan kept its policy rate unchanged and said its underlying 2% inflation target had been achieved, the first such declaration since it adopted the target in 2013, while setting a pace of ¥860 billion a year for selling its exchange-traded fund holdings. -- Declaring victory while leaving the rate alone keeps Japan's gap with the Federal Reserve at 3.75%-4% and the ECB at 2.5%, sustaining the yen-funded carry trade. Tokyo core prices overshooting 2% the same morning makes the next hike a data question, and the ETF runoff hands equity exposure back to the market. 3. Asian Tech Shares Slump as AI Spending Doubts Deepen After US Earnings -- Seoul's KOSPI fell more than 5% and Tokyo's Nikkei 225 dropped 3% as a global technology selloff deepened, with the Financial Times citing US earnings that stoked fears over artificial-intelligence capital spending; Wall Street was set to open lower. -- The selloff is pricing funding, not demand: Alphabet's worst session erased over $500 billion in market value and Amazon's free cash flow turned negative $42.4 billion while capital spending held. A sustained de-rating raises the cost of the debt and equity data-centre builders depend on. 4. Saudi Strike Kills 12 in Yemen as Houthi Fire Reaches Riyadh's Airspace -- A Saudi-led strike killed 12 people in Yemen, the Houthis said, and blasts were heard over Riyadh after the group reported missile and drone launches at the capital and eastern Saudi Arabia; the two sides have traded daily attacks since a years-long truce collapsed over the summer. -- Hitting population centres forces Saudi air defences to cover cities as well as refineries and export plant, and each exchange adds to the war-risk and freight bill on cargoes moving with Brent at $112.00. Gulf capitals are separately pushing a Hormuz-for-sanctions bargain with Tehran that the Houthis' tempo can undercut before it is tested. 5. Netanyahu's Likud Claims Election 'Stolen' With Coalition Math Short of 61 -- Final results left Prime Minister Benjamin Netanyahu's bloc ahead but without the 61 Knesset seats needed to govern, his party alleging the vote was stolen; Arab parties that won a record 18 seats emerged as potential kingmakers, while allegations of foreign interference complicated coalition talks. -- Likud's largest-party status gives Netanyahu the first attempt at a government, but the arithmetic turns on whether he can reach 61 while shunning the Arab parties he wants Shin Bet to investigate for foreign-funded vote buying. West Bank policy and backing for another US strike on Iran stay frozen through weeks of bargaining.

2026-10-30 04:00 UTC | BLOCK 973769 BITCOIN $78,200 | GOLD $3,996 | OIL $112.08 1. China Expels a Record 33 From the Party as Plenum Seats Empty Out -- The Communist Party expelled 33 members as it closed its fifth plenum, 16 of them from the military, and attendance fell to 279 Central Committee members from 364 in July 2024; expulsions in Xi Jinping's third term now total 51 against five in his second, the BBC reported. -- The military cull has reduced the seven-member Central Military Commission to Xi and Zhang Shengmin. Analysts cited by the BBC warn that the removals raise questions about military leadership and combat readiness, even as China unveils new hardware ahead of its 2027 leadership reshuffle. 2. Seoul Weighs Sending Its Anti-Piracy Unit to Hormuz -- National Security Adviser Wi Sung-lac said South Korea is considering extending the Cheonghae Unit beyond Somali waters to cover the Strait of Hormuz, with no final decision made; protecting Korean merchant ships, oil routes and nationals would be the mission's focus, Yonhap reported. -- Escorting tankers would put South Korean naval resources behind an energy supply route rather than just the existing anti-piracy mission. Wi ruled out participation in the war, leaving a security-policy boundary for planners seeking to protect shipping without joining the conflict. 3. UN Inquiry Finds Genocidal Acts Continue in Gaza After Ceasefire -- A UN commission of inquiry reported that Israeli authorities and forces continue to commit genocidal acts in Gaza after the ceasefire and have committed war crimes and crimes against humanity in occupied Palestinian territory; it counted 254 Palestinians killed by West Bank airstrikes from October 2023 through September 2026. -- The commission called for an end to the occupation and reversal of land confiscations, putting property rights and displaced residents at the centre of its recommendations. It also urged the Palestinian Authority to stop targeting rights defenders and investigate alleged abuses by its security forces.

2026-10-29 12:00 UTC | BLOCK 973686 BITCOIN $80,126 | GOLD $4,034 | OIL $110.14 1. Russian Strike on Dnipro Rail Station Kills at Least 13 -- Russian forces hit the railway station in Dnipro, killing at least 13 people, Ukrinform reported, with the number of injured not yet established. -- The station handles both passenger evacuation and military logistics, so a hit there disrupts movement across the wider Dnipro axis rather than one building; Ukraine's interceptor stocks, still gated by a stalled US approval, leave more Russian missiles reaching targets. 2. US and Gulf States Open a Channel to End the Iran War -- The US vice president reportedly wrote to the head of Iran's security body to restart truce talks, while Gulf states pushed to reopen the Strait of Hormuz, Semafor reported. -- A functioning channel would drain the war premium holding Brent near $110, and the Gulf plan trades tanker passage for sanctions relief; President Trump said this week that talks were not under way, leaving escorts and bypass pipelines to carry the exports. 3. China's Plenum Adopts Tighter Party Discipline Before Leadership Congress -- The fifth plenum of the Central Committee, led by Xi Jinping, adopted a decision on "advancing full and rigorous governance of the party", Xinhua reported, as cadres prepare a congress next year expected to hand Xi a fourth five-year term, according to the Financial Times. -- Locking down discipline ahead of the congress narrows room for elite challenge but keeps the purge running through the state firms and regulators foreign investors must price; the readout carried no economic measures.

2026-10-24 07:00 UTC | BLOCK 972892 BITCOIN $80,774 | GOLD $3,998 | OIL $111.75 1. Trump Floats 200% Tariffs on Russia and Ukraine -- President Donald Trump said the United States could impose 200% tariffs on Russia and Ukraine to force an end to the war, Ukrinform reported. -- U.S. importers sourcing from either country would face sharply higher duties if the proposal became policy; the remarks alone do not change customs obligations. 2. Russia Uses 61 Jet-Powered Shaheds in Overnight Drone Attack -- Ukraine's military said Russia launched 126 drones overnight, including 61 jet-powered Shaheds, and reported hits at 14 locations despite shooting down or suppressing 101 drones. -- Jet-powered attack drones can shorten interception windows, making early detection and rapid engagement more important for protecting civilian infrastructure.

WEEKLY WIRE | 2026-10-23 | BLOCK 972830 BITCOIN $81,494 | GOLD $4,000 | OIL $111.42 | S&P 500 $7,634 | US 10Y 5.03% NEWS 1. Middle East tensions push energy costs higher -- Crude reached $117 on Friday for the first time since April amid fears of renewed Iran hostilities, the Financial Times reported; CNBC also reported Brent at a six-month high. -- Higher energy prices are lifting U.S. inflation expectations and increasing fuel-cost exposure for transport companies and energy importers. 2. Ukraine seeks satellite alternatives as Starlink restrictions persist -- Ukraine reported continued Starlink and Starshield restrictions Friday despite Trump's assurances, while CNBC reported that Kyiv was partnering with Nokia and ICEYE in its search for alternatives. -- Diversifying providers could reduce dependence on SpaceX for military connectivity, but the partnership announcement does not establish that replacement capacity is ready for battlefield use. 3. Russia and Ukraine agree humanitarian truce around Oleshky -- Russia and Ukraine confirmed a temporary ceasefire around Russian-occupied Oleshky to permit humanitarian aid and civilian evacuations, the BBC and Financial Times reported Friday. -- For civilian security, safe evacuation could reduce residents' exposure to fighting; the local agreement does not establish a wider ceasefire. 4. Justice Department seeks conditional block on Alaska Senate certification -- Trump said Friday he ordered the lawsuit seeking to pause certification if incumbent Dan Sullivan loses, pending an investigation into alleged voter confusion with another Republican named Dan Sullivan, the Guardian reported. -- A court-ordered delay could postpone certification of the winner in a race that may determine Senate control; filing the complaint does not itself block certification. 5. AI share selloff sends investors toward Treasuries -- CNBC reported Meta shares down 9% for the week Friday and the 10-year Treasury yield trading just below 5% during the session as AI-related technology selling drove investors toward government bonds. -- Capital-intensive AI businesses face a harder equity-funding environment even when demand for government bonds lowers benchmark interest rates. 6. U.S. revises Canadian tariffs as exemptions are announced -- Trump signed a proclamation Friday modifying Canadian product tariffs under Section 338 of the Tariff Act of 1930; Senator Susan Collins said several import categories would receive exemptions, CNBC reported. -- Exemptions would lower costs for covered imports without ending the broader tariff regime, making product eligibility decisive for businesses sourcing from Canada. 7. AI-assisted research exposes critical PHP flaws -- Researchers used AI to identify critical flaws this week in PHP, a programming language used across millions of websites, the Guardian reported. -- Shared runtime flaws can expose otherwise unrelated websites, requiring operators to assess their underlying PHP deployments rather than rely only on application-level defenses. 8. BlackX bootkit targets Central Asian diplomatic organizations -- Kaspersky documented a UEFI bootkit used against diplomatic entities in Tajikistan, Uzbekistan and Turkmenistan earlier in 2026 and suspects China-linked APT41 involvement, The Hacker News reported Friday. -- Secure Boot can be bypassed on patched Windows systems missing the relevant revocations, so operating-system update status alone does not establish protection. SOFTWARE 9. Eclair 0.14.5 -- Bitcoin Optech's October 23 newsletter details fixes for trampoline-routing and Taproot-splicing vulnerabilities, plus an integer-overflow bypass in onion-payload validation, in this Lightning node security release. -- For Lightning payment security, the routing fix closes a flaw that could let a malicious payer steal funds from a forwarding node; the project strongly recommends upgrading.

CODE WIRE | BLOCK 972656 BITCOIN $81,368 | GOLD $4,027 LocalAI v4.12.0 -- LocalAI is an open-source engine for running AI models on hardware that does not require a GPU. -- Version 4.12.0 redesigns the web UI and adds streaming voice responses, native decision routing, image upscaling, Qdrant stores and authenticated chat history. -- GitHub:

GitHub

Release v4.12.0 · mudler/LocalAI

🎉 LocalAI 4.12.0 Release! 🚀 LocalAI 4.12.0 is out! This release redesigns the web UI and adds streaming voice responses, native...

EDITOR WIRE | 2026-10-21 | BLOCK 972527 BITCOIN $84,696 | GOLD $4,138 | OIL $105.53 | S&P 500 $7,759 | US 10Y 5.13% GitLab patches critical unauthenticated code-execution flaw across older releases GitLab has issued an urgent patch for CVE-2026-110264, a CVSS 10.0 flaw in the regular-expression compiler shipped with its Community and Enterprise editions. GitLab says that, under certain conditions, compiling a specially crafted expression could let an unauthenticated attacker run code on a self-managed server. Affected releases extend back to GitLab 7.0. GitLab has not disclosed the conditions needed to reach the vulnerable path, so the rating should not be read as proof that every exposed instance can be compromised with a single request. The practical risk is control of the server running GitLab. If an attacker can get a crafted expression compiled through the vulnerable path and achieve code execution, they could attempt to access repositories, credentials or other data available to that server. Those are potential consequences of server-side code execution, not reported outcomes of an observed attack. GitLab has published detections for Onigmo native-worker crashes and bursts of Org-mode rendering errors to help self-managed operators investigate possible attempts. GitLab also fixed separate authentication issues in this release. One could let a logged-in user take over an LDAP-backed account only where both OmniAuth SAML and LDAP auto-linking are enabled. Another could let an unauthenticated attacker poison a shared OAuth/OIDC discovery cache and redirect certain sign-in flows to an attacker-controlled server under affected conditions. Neither has the same prerequisites as the regex-compiler flaw. Self-managed operators should upgrade promptly to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13, according to their release line. GitLab says GitLab.com is patched and specified GitLab Dedicated internal releases already contain the fixes. The 19.4.3 and 19.3.6 upgrades include database migrations; single-node administrators should plan for downtime while they complete. Sources:

GitLab Docs

GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13 | GitLab Docs

The Hacker News

Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases

GitLab fixes CVE-2026-110264, a critical flaw that could allow unauthenticated code execution on self-managed versions dating back to 7.0.