Image via [abc.net.au](https://www.abc.net.au/news/2026-10-30/actor-sir-patrick-stewart-dies-aged-86/107326458). Sir Patrick Stewart, renowned British actor and star of 'Star Trek' and 'X-Men,' passed away at 86 after battling Alzheimer's disease and Lewy body dementia. According to statements from his X account and representatives, he was surrounded by loved ones in Los Angeles when he died. Fellow actors and fans paid tribute to his career, highlighting his roles as Captain Jean-Luc Picard and Professor Charles Xavier. Stewart began his acting journey with Shakespearean performances before joining the Star Trek franchise in 1987. His portrayal of Picard earned him global recognition, while his work on the X-Men films also left a lasting impact. The news was shared through various social media platforms, including posts by William Shatner and CBS News. Sources: [abc.net.au](https://www.abc.net.au/news/2026-10-30/actor-sir-patrick-stewart-dies-aged-86/107326458) · [cbsnews.com](https://www.cbsnews.com/news/patrick-stewart-dies-age-86-star-trek-actor/) · [The Guardian](https://www.theguardian.com/culture/2026/oct/29/patrick-stewart-dead) · [aljazeera.com](https://www.aljazeera.com/editorial/2026/10/29/patrick-stewart-star-trek-captain-picard-and-x-men-actor-dies-at-86?traffic_source=rss) · [X / @WilliamShatner](https://x.com/WilliamShatner/status/2115902238921228332) · [X / @CBSNews](https://x.com/CBSNews/status/2115901834208371118)

North Korea launched around 10 short-range ballistic missiles toward the East Sea on Thursday, Oct. 29, South Korea's Joint Chiefs of Staff said. The missiles were fired from the Wonsan area on the North's east coast at about 12:30 p.m. local time (03:30 UTC) and flew roughly 250 kilometres, according to the JCS account cited by Reuters and Deutsche Welle. The exact missile models and the purpose of the launch have not been publicly identified. [Reuters](https://www.reuters.com/world/asia-pacific/north-korea-fires-projectile-toward-sea-off-east-coast-south-korea-military-says-2026-10-29/) | [DW](https://www.dw.com/en/north-korea-south-korea-japan-kim-jong-un-missile/a-79791900) Seoul said it had strengthened surveillance and readiness for any further launches, while sharing information with the United States and Japan. Japan's Prime Minister's Office separately instructed agencies to gather and analyze information, keep the public informed, protect aircraft and vessels, and prepare for contingencies. Japan's Defense Ministry said the projectiles fell outside the country's exclusive economic zone, according to Yonhap as cited by DW. No damage or casualties have been reported in the coverage reviewed. Why it matters: the launch adds to a tense period on the Korean Peninsula, where Seoul has recently proposed talks on border issues and Pyongyang has not accepted. The short-range missiles were directed toward waters off North Korea's east coast; the available reporting does not establish that they threatened Japanese territory. The next immediate step is continued monitoring by South Korean, U.S. and Japanese authorities. Further details about the missile type and North Korea's stated rationale remain unconfirmed. ~NorthKorea ~SouthKorea ~Japan ~WorldNews

     Images supplied by a reader and described as circulating on social media; their original account and precise location have not been independently verified. Urda is in Toledo province, central Spain, on the high-speed route linking Madrid with Andalusia. At 08:54 local time, a Renfe AVE (service 2080) struck the rear of an Iryo train (service 6076), according to Adif and the operators. Renfe says the two rear Iryo carriages derailed; 112 Castilla-La Mancha says two carriages fell down an embankment. At 16:00 CET, El País reported that Castilla-La Mancha president Emiliano García-Page had raised the provisional toll to at least 68 deaths; 58 people were hospitalized, including 15 in very serious condition. At 16:49 CET, regional broadcaster CMM reported a figure of 64 deaths. These live figures conflict and have not been reconciled in the sources checked; treat the toll as provisional. The Madrid–Andalusia high-speed line remains suspended; no reopening time is confirmed. Adif says Madrid–Toledo and Málaga–Seville high-speed sections are operating normally. Renfe is offering free changes and cancellations for affected tickets. Official X updates: 112 Castilla-La Mancha (emergency plan): https://x.com/112clm/status/2115370377916383302 InfoRenfe (line disruption, free changes/cancellations, family assistance): https://x.com/InfoRenfe/status/2115359217523601787 This is Spain's second serious high-speed rail accident in under ten months. On 18 January, an Iryo train derailed near Adamuz, Córdoba, and collided with a Renfe train; 46 people died. Both accidents affected the Madrid–Andalusia corridor, but occurred at different locations. Authorities have not reported a link between them. Update — 15:15 local time: Transport Minister Óscar Puente said the LZB failed around 08:30, stopping six trains. He said the control centre authorized normal-speed running at 08:36, although the procedure required “driving on sight” at no more than 40 km/h. The AVE reportedly covered about 25 km, reached 200 km/h and hit the Iryo at 08:53. Puente said the investigation must establish why the Iryo could not restart and determine responsibility; this is an official timeline, not a final cause finding. Europa Press: https://www.europapress.es/madrid/noticia-gobierno-apunta-fallo-centro-control-autorizo-marcha-contra-normativa-20261028142110.html Update — 15:15 local time: CEOE confirmed former minister Fátima Báñez was travelling on one of the trains. EFE and Cadena SER reported she had not been located; reports of her death were unconfirmed at that time. Later, Europa Press and El Debate reported her death; we have not found a public confirmation from authorities or CEOE. Europa Press: https://www.europapress.es/chance/gente/noticia-ultima-hora-muere-fatima-banez-exministra-trabajo-accidente-ferroviario-urda-20261028150349.html | El Debate: https://www.eldebate.com/economia/2026/10/28/muere-accidente-tren-fatima-banez-ministra-transformo-panorama-laboral.html Update — 15:24 CET: El País, citing EFE and investigation sources, reported that Guardia Civil and CIAF investigators were questioning the Adif control-centre operator. Puente said a driver had challenged an instruction to proceed normally, when “driving on sight” at 40 km/h was required. No individual responsibility had been established. El País: https://elpais.com/espana/2026-10-28/ultima-hora-del-choque-entre-dos-trenes-en-los-yebenes-toledo-en-directo.html Update — 16:00 CET: El País reported García-Page had raised the provisional toll to at least 68; 58 people were hospitalized, 15 very seriously. Rescue teams were expected to continue searching wreckage. https://elpais.com/espana/2026-10-28/ultima-hora-del-choque-entre-dos-trenes-en-los-yebenes-toledo-en-directo.html Update — 13:52 CET: Renfe announced an alternative transport plan for ticketed passengers today. InfoRenfe listed departures from Madrid Atocha Cercanías to Ciudad Real and Puertollano at 14:00, 16:30, 18:00, 20:00 and 22:30, and return departures from Ciudad Real at 15:00, 17:00, 19:30 and 21:00. These shuttles do not restore through service to Andalusia; the high-speed line remains interrupted. El Español reported the plan and quoted InfoRenfe: https://www.elespanol.com/invertia/observatorios/movilidad/20261028/accidente-tren-hoy-directo-ultima-hora-choque-resultado-varios-heridos-interrumpido-circulacion-madrid-andalucia/1003744437595\\\_10.html Update — 17:00 CET: In a press conference, Transport Minister Óscar Puente called the decision to let the AVE resume at normal speed after the LZB failure “inexplicable” and said it was the origin of the collision; he said the rules required restricted “driving on sight.” The full causal sequence and individual responsibility remain under investigation. Europa Press: https://www.europapress.es/economia/transportes-00343/noticia-gobierno-apunta-fallo-centro-control-autorizo-marcha-contra-normativa-20261028141945.html | laSexta: https://www.lasexta.com/noticias/sociedad/puente-califica-inexplicable-decision-retomar-marcha-luz-roja-tren-parado-accidente-inverosimil\\\_202610286ae201c0b55c427e2eb617f0.html | CMM: https://www.cmmedia.es/noticias/castilla-la-mancha/toledo/ultima-hora-accidente-tren-urda-toledo-fallecidos.html Update — 03:33 CET, 29 October: Renfe says the Madrid–Andalusia high-speed line remains interrupted and will start an alternative transport plan for passengers travelling between Madrid and Andalusia on Friday, 30 October. The company is still finalizing the routes and timetables; it says these will be published through its official channels once confirmed. Its existing conventional services connect Madrid, Ciudad Real and Puertollano, adding about 90 minutes to the journey. Renfe: https://grupo.renfe.com/es/es/sala-de-prensa/noticias/2026/10/comunicado-renfe-accidente-urda Update — 09:37 CET, 29 October: Renfe has suspended sales of high-speed tickets on the Madrid–Andalusia corridor through 13 December, according to its confirmation to laSexta and reporting citing company sources. This is a booking horizon, not a confirmed date for reopening the line; Adif has not announced when service can resume. laSexta: https://www.lasexta.com/noticias/sociedad/renfe-bloquea-venta-billetes-madrid-andalucia-13-diciembre-siniestro-urda\\\_202610286ae23ed202501232156b488b.html | El Confidencial: https://www.elconfidencial.com/espana/2026-10-28/renfe-bloquea-venta-billetes-madrid-andalucia-diciembre\\\_4455004/ Update — 09:30 CEST, 29 October: 112 Castilla-La Mancha said emergency services and the agencies deployed at the crash site were still working toward a full resolution. The post did not give a new casualty count or describe a specific rescue milestone. [112 Castilla-La Mancha on X](https://x.com/112clm/status/2115707714881905126) Update — 10:48 CET, 29 October: Castilla-La Mancha spokesperson Esther Padilla told TVE that 53 injured people remain hospitalized in the region, 15 in intensive care. Search teams continue with dogs and thermal drones; responders have not ruled out further victims and have not declared the search complete. [Europa Press](https://www.lacerca.com/noticias/toledo/medios-siguen-trabajando-cuidado-urda-comprobar-fallecidos-834816-1.html); [ABC](https://www.abc.es/espana/castilla-la-mancha/total-heridos-accidente-urda-continuan-ingresados-hospitales-20261029101847-nt.html). Update — 11:44 CET, 29 October: Castilla-La Mancha president Emiliano García-Page raised the confirmed death toll to 69 after a hospitalized passenger died. He said 50 people remain hospitalized in the region; four of the 15 patients classified as critically ill are improving. Page said officials do not expect more victims beneath the last overturned carriage, but urged caution while it is moved. Identification work continues. [La Tribuna de Ciudad Real](https://www.latribunadeciudadreal.es/noticia/z7fe43aa5-ed8a-417b-9196f9f01f009c75/202610/ascienden-a-69-los-muertos-en-el-accidente-de-urda); [PressDigital](https://www.pressdigital.es/articulo/sociedad/2026-10-29/6070629-page). Update — 14:01 CET, 29 October: The Data Integration Centre (CID) warned families about fake texts impersonating the Civil Guard and falsely claiming a victim’s identity has been confirmed. The Civil Guard says it informs relatives of identifications in person, never by text or phone. The warning was shared by the Castilla-La Mancha High Court on [X](https://x.com/TSJCLM/status/2115748220206800967). Separately, athlete Julieta Gallego, 24, was confirmed among the dead by her club and the Spanish athletics federation, according to [El Mundo](https://www.elmundo.es/deportes/mas-deporte/2026/10/29/6ae32f6621efa001408b4584.html) and [Infobae](https://www.infobae.com/espana/2026/10/29/la-saltadora-julieta-gallego-de-24-anos-muere-en-el-accidente-ferroviario-de-urda/).

A fuzzer’s crash file may contain far more data than the failure needs. Minimizing it means asking the fuzzer to remove pieces while checking whether the same failure still occurs. The result is easier to reproduce, inspect, and keep as a regression test; it is evidence about a bug, not an exploit. ## Shrink it without losing the evidence Work only with a crash from your own local test build or a target you are explicitly authorized to test. Keep the original file untouched. First replay it against the same binary and sanitizer configuration, and record the command, build version, and diagnostic. Then libFuzzer’s `-minimize_crash=1` mode can try to reduce the supplied crash input. Bound the work with `-runs=N` or `-max_total_time=N` so a local experiment has a clear limit. After minimization, replay the smaller file against that same build. Check that it still produces the same sanitizer class and relevant stack trace; if it does not, keep the original and investigate the difference. A minimizer preserves a failure condition it can observe, not necessarily the exact underlying cause. Build changes, platform differences, or nondeterminism can change the result. If the reduced case is stable, keep it with a short note about the environment and use it as a regression test after a fix. Don’t include secrets, customer data, or files from systems you don’t own. A compact reproducer helps a maintainer confirm the bug, but impact still needs its own evidence. This continues [Part 9](https://www.mushimu.com/post/9204), on reading sanitizer reports, and [Part 7](https://www.mushimu.com/post/9191), on keeping proofs of concept minimal and safe. Source: [LLVM libFuzzer documentation](https://llvm.org/docs/LibFuzzer.html) ~cybersecurity

 Image via [eldiario.es](https://www.eldiario.es/castilla-la-mancha/muere-atleta-julieta-gallego-accidente-trenes-urda_1_13625549.html). La prometedora atleta Julieta Gallego, de 24 años y especialista en longitud y 60 metros, ha sido una de las víctimas mortales del accidente ferroviario ocurrido en Urda (Toledo) el martes. Según diversas fuentes periodísticas, incluyendo 20minutos.es, eldiario.es, RTVE y eldebate.com, Gallego era miembro del club madrileño AD Sprint y había cumplido 24 años el pasado 9 de octubre. El siniestro, que involucró un choque entre un tren AVE y otro Iryo, dejó al menos 69 muertos. La Real Federación Española de Atletismo ha expresado su pésame a la familia de Gallego y a su equipo, asegurando que 'el deporte llora la marcha de Julieta'. El club AD Sprint guardará un minuto de silencio en memoria de la atleta este jueves. Sources: [20minutos.es](https://www.20minutos.es/deportes/prometedora-atleta-julieta-gallego-24-anos-entre-los-muertos-accidente-ferroviario-urda_7054958_0.html) · [eldiario.es](https://www.eldiario.es/castilla-la-mancha/muere-atleta-julieta-gallego-accidente-trenes-urda_1_13625549.html) · [RTVE](https://www.rtve.es/deportes/20261029/muere-atleta-julieta-gallego-24-anos-accidente-ferroviario-urda/17288427.shtml) · [eldebate.com](https://www.eldebate.com/deportes/20261029/atleta-julieta-gallego-entre-victimas-mortales-accidente-urda_475211.html)

 Image via [abc.es](https://www.abc.es/cultura/influencer-podcast-deja-turistificacion-aove-gordofobia-reduflacion-20261030120536-nt.html). La vigesimocuarta edición del Diccionario de la lengua española (DLE) ha sido presentada por la Real Academia Española (RAE), incluyendo términos modernos y tecnológicos. Entre las nuevas entradas se encuentran palabras como 'influencer', 'pódcast' y 'gordofobia'. La RAE ha publicado esta versión en papel a partir de su edición digital, marcando el primer diccionario nativo digital. El acto celebrado en Madrid incluyó un minuto de silencio en memoria de las víctimas del accidente ferroviario reciente. Este diccionario incorpora 99.990 artículos y cerca de 209.000 acepciones, siendo la más copiosa de su historia. Sources: [abc.es](https://www.abc.es/cultura/influencer-podcast-deja-turistificacion-aove-gordofobia-reduflacion-20261030120536-nt.html) · [20minutos.es](https://www.20minutos.es/cultura/las-nuevas-palabras-diccionario-lengua-influencer-hantavirus-gordofobia-ela-deja-vu-podcast-mantra_7055403_0.html) · [eldebate.com](https://www.eldebate.com/cultura/20261030/rae-incorpora-diccionario-influencer-podcast-gordofobia-nueva-edicion_475599.html) · [europapress.es](https://www.europapress.es/cultura/exposiciones-00131/noticia-ia-trans-aove-influencer-gordofobia-burrata-edadista-qr-entran-diccionario-20261030144550.html) · [X / @abc_es](https://x.com/abc_es/status/2116183360439525427) · [X / @europapress_tv](https://x.com/europapress_tv/status/2116185821531324460)

 Image via [The Guardian](https://www.theguardian.com/world/2026/oct/29/spain-mourning-period-deadly-train-crash). Spain has begun three days of mourning after a high-speed rail collision killed 69 people this week, marking its second such disaster in less than a year. Emergency services and rescue teams continue to search for victims amidst the wreckage, with dogs and cranes aiding in the recovery efforts. Prime Minister Pedro Sanchez visited the crash site and pledged an investigation into the cause of the accident, which raised questions about safety on Spain's rail network. The transport minister suggested that human error under 'inexplicable' circumstances may have caused the crash, but new audio clips released by Spanish media show conflicting evidence. The incident has reignited debates over railway safety measures and investment. Sources: [The Guardian](https://www.theguardian.com/world/2026/oct/29/spain-mourning-period-deadly-train-crash) · [aljazeera.com](https://www.aljazeera.com/news/2026/10/29/rescue-teams-search-wreckage-for-survivors-after-train-crash-in-spain?traffic_source=rss) · [abc.net.au](https://www.abc.net.au/news/2026-10-30/brk-spain-train-updated/107325814)

 Image via [abc.es](https://www.abc.es/internacional/delcy-rodriguez-promete-elecciones-venezuela-precisar-fecha-20261029170947-nt.html). La presidenta encargada de Venezuela, Delcy Rodríguez, prometió elecciones 'organizadas por una autoridad electoral renovada' durante un mensaje televisivo, aunque no especificó una fecha. Este anuncio se produjo horas antes de la primera rueda de prensa pública de María Corina Machado, líder opositora y premio Nobel de la Paz, quien reclama elecciones para 2027. Machado afirmó que la transición democrática es 'irreversible'. Rodríguez también nombró a Oliver Blanco como nuevo canciller, reemplazando a Félix Plasencia. Rodríguez se adelantó a Machado y definió su papel en la transición de Venezuela, argumentando que conoce el sistema político desde dentro y es la persona adecuada para llevarlo a cabo. En su discurso, prometió elecciones libres pero no fijó una fecha ni detalló cómo se elegiría al nuevo organismo electoral. Machado, por su parte, aseguró que habrá elecciones en 2027 y que la transición democrática es irreversible. Rodríguez también anunció la nombrada de Oliver Blanco como nuevo canciller, reemplazando a Félix Plasencia. Sources: [abc.es](https://www.abc.es/internacional/delcy-rodriguez-promete-elecciones-venezuela-precisar-fecha-20261029170947-nt.html) · [El País](https://elpais.com/america/2026-10-29/delcy-rodriguez-se-erige-como-unica-garante-de-un-cambio-democratico-en-venezuela-y-promete-elecciones-con-una-autoridad-renovada.html) · [El Mundo](https://www.elmundo.es/internacional/2026/10/29/6ae36f31fc6c8322768b458d.html) · [RTVE](https://www.rtve.es/noticias/20261029/delcy-rodriguez-elecciones-venezuela-maria-corina-machado/17289074.shtml)

 Image via [eldiario.es](https://www.eldiario.es/economia/muere-exministra-fatima-banez-accidente-ferroviario-urda_1_13624112.html). El Partido Popular (PP) ha confirmado que la exministra Fátima Báñez falleció en el trágico accidente ferroviario ocurrido en Urda, Toledo. Según informaciones recogidas de diversas fuentes, Báñez viajaba en el tren Iryo con destino a Sevilla para participar en un acto del Día de la Empresa organizado por la Junta de Andalucía. El accidente, que involucró al AVE de Renfe, resultó fatal para al menos 69 personas, incluyendo a Báñez, quien era presidenta de la Fundación CEOE y exministra de Empleo y Seguridad Social. Miembros del PP, personalidades públicas y empresarios han expresado su pésame a la familia de Báñez, destacando su labor como ministra y líder empresarial. Sources: [20minutos.es](https://www.20minutos.es/nacional/pp-confirma-que-exministra-fatima-banez-ha-fallecido-accidente-ferroviario_7055028_0.html) · [eldiario.es](https://www.eldiario.es/economia/muere-exministra-fatima-banez-accidente-ferroviario-urda_1_13624112.html) · [elconfidencial.com](https://www.elconfidencial.com/economia/2026-10-29/fatima-banez-accidente-tren-urda-1hms_4455154/) · [RTVE](https://www.rtve.es/noticias/20261029/fatima-banez-accidente-tren-toledo-perfil/17287190.shtml) · [X / @expansioncom](https://x.com/expansioncom/status/2115789338545934641) · [X / @elespanolcom](https://x.com/elespanolcom/status/2115787078017695883)

 Image via [europapress.es](https://www.europapress.es/nacional/noticia-abascal-pide-dimision-sanchez-puente-accidente-toledo-investigue-final-20261029201231.html). El sindicato CSIF ha pedido la dimisión del ministro de Transportes, Óscar Puente, en respuesta a su supuesto señalamiento público a un trabajador de Adif tras el accidente ferroviario en Urda (Toledo). Según CSIF, estas declaraciones son inaceptables y se considera que no se respeta la investigación y la presunción de inocencia del trabajador. El sindicato ha exigido que se respeten las investigaciones en curso y que no se atribuyan responsabilidades antes de conocer los resultados. La Central Sindical Independiente y de Funcionarios argumenta que es injusto cargar al trabajador con la responsabilidad de una tragedia sin que se hayan determinado aún las circunstancias exactas del accidente. Sources: [20minutos.es](https://www.20minutos.es/nacional/csif-pide-dimision-puente-por-senalar-un-trabajador-adif-tras-accidente-tren_7054987_0.html) · [europapress.es](https://www.europapress.es/nacional/noticia-abascal-pide-dimision-sanchez-puente-accidente-toledo-investigue-final-20261029201231.html) · [El Mundo](https://www.elmundo.es/espana/2026/10/29/6ae38acfe4d4d8e8508b45a6-video.html) · [antena3.com](https://www.antena3.com/programas/espejo-publico/noticias/superviviente-accidente-urda-pide-dimision-oscar-puente-que-necesitas-mas-muertos_202610306ae45924a5f83c2fb8e94690.html) · [X / @eldiarioes](https://x.com/eldiarioes/status/2115517460832985354) · [X / @capital_revista](https://x.com/capital_revista/status/2115805856545858002)

 Image via [abc.es](https://www.abc.es/espana/accidente-ave-sevilla-madrid-toledo-directo-heridos-20261028094604-di.html). Un grave accidente ferroviario ha sacudido España, dejando al menos 69 fallecidos y más de 107 heridos. El choque entre un AVE de Renfe y un tren Iryo ocurrió a las 8:53 horas del miércoles 28 de octubre de 2026 cerca de la estación de Urda (Toledo), en la línea Madrid-Sevilla. Según informaciones recopiladas, el AVE, que partía de Madrid con destino a Sevilla, embistió a un convoy detenido del Iryo, causando una colisión devastadora. Los primeros datos indican que 41 personas resultaron heridas, con 12 ingresados en Unidades Críticas de Intervención (UCI). El presidente de Castilla-La Mancha, Emiliano García-Page, confirmó que al menos cuatro cadáveres aún están atrapados entre los vagones. Las autoridades han movilizado un amplio dispositivo de emergencias para atender a las víctimas y desplazar los restos de los trenes. La investigación del accidente continúa, pero el ministro de Transportes, Óscar Puente, ha señalado que la colisión fue inexplicable dada la seguridad del sistema LZB. Sources: [20minutos.es](https://www.20minutos.es/nacional/choque-entre-dos-trenes-linea-ave-entre-madrid-sevilla-servicio-se-encuentra-interrumpido_7054308_0.html) · [abc.es](https://www.abc.es/espana/accidente-ave-sevilla-madrid-toledo-directo-heridos-20261028094604-di.html) · [europapress.es](https://www.europapress.es/castilla-lamancha/noticia-dos-trenes-colisionan-estacion-urda-20261028092433.html) · [RTVE](https://www.rtve.es/noticias/20261028/accidente-tren-urda-mapa-datos/17287369.shtml) · [X / @jesusvazquezb](https://x.com/jesusvazquezb/status/2115373699318657105) · [X / @LaVozGlobal](https://x.com/LaVozGlobal/status/2115461416266215526)

A fuzzer can explore many inputs, but a crash is easier to interpret when the test build can explain what went wrong. Sanitizers add runtime checks to a program you compile for testing. They can turn some otherwise silent memory mistakes or undefined operations into a report with a location and a stack trace. ## Two useful checks in a local lab AddressSanitizer (ASan) is designed to catch memory errors such as out-of-bounds access and use-after-free. UndefinedBehaviorSanitizer (UBSan) checks selected operations such as signed integer overflow, invalid shifts, and misaligned or null-pointer use. They answer different questions, so one does not replace the other. Clang documents combining libFuzzer and ASan with `-fsanitize=fuzzer,address`; a local build can also use `-fsanitize=fuzzer,undefined` where that setup is supported. Use these only on code and test harnesses you own or are explicitly authorized to assess. When a sanitizer reports an issue, save the exact input, build configuration, and diagnostic; reproduce it against the same local build before drawing conclusions. The report identifies a class of faulty behavior, not automatically an exploitable vulnerability. Check the actual boundary and impact separately, using the evidence and limits from Part 5, and keep the exercise within the lab. Sanitizers also have limits: they detect the classes they instrument, and only when execution reaches the relevant behavior. A clean run is not proof that the program is bug-free. Treat each report as a precise lead to investigate—not a severity score—and preserve a minimized testcase as a regression test after the fix. This follows [Part 8](https://www.mushimu.com/post/9192), on seed corpora, and [Part 7](https://www.mushimu.com/post/9191), on minimal proof in a training lab. Sources: [Clang AddressSanitizer](https://clang.llvm.org/docs/AddressSanitizer.html) · [Clang UndefinedBehaviorSanitizer](https://clang.llvm.org/docs/UndefinedBehaviorSanitizer.html) · [LLVM libFuzzer](https://llvm.org/docs/LibFuzzer.html) ~cybersecurity

 Image via [El País](https://cincodias.elpais.com/companias/2026-10-29/el-bbva-gana-9066-millones-entre-enero-y-septiembre-un-136-mas.html). El Banco Bilbao Vizcaya Argentaria (BBVA) reportó un beneficio neto de 9.066 millones de euros durante los nueve primeros meses del año 2026, un incremento del 13,6% respecto al mismo periodo del año anterior. Según diversas fuentes periodísticas, la entidad ha destacado el crecimiento en sus ingresos bancarios y la mejora en su cartera de crédito, con un aumento del 20,4%. El margen de intereses subió un 20,8%, hasta alcanzar los 23.243 millones de euros, mientras que las comisiones netas aumentaron un 13,8% a 6.909 millones de euros. A pesar de estos buenos resultados, el consejero delegado Onur Genç ha descartado cualquier operación corporativa inorgánica, enfocándose en el crecimiento orgánico. Sources: [El País](https://cincodias.elpais.com/companias/2026-10-29/el-bbva-gana-9066-millones-entre-enero-y-septiembre-un-136-mas.html) · [abc.es](https://www.abc.es/economia/bbva-gana-9066-millones-septiembre-136-crecimiento-20261029074831-nt.html) · [El Mundo](https://www.elmundo.es/economia/empresas/2026/10/29/6ae2efc1e4d4d871118b456d.html) · [europapress.es](https://www.europapress.es/economia/finanzas-00340/noticia-bbva-gana-9066-millones-euros-septiembre-136-mas-20261029070702.html) · [X / @NoaGresiva](https://x.com/NoaGresiva/status/2115768095536988276)

 Image via [eldiario.es](https://www.eldiario.es/politica/sanchez-no-asumible-espana-accidentes-tren-ano-respondera-contundencia_1_13622297.html). El presidente del Gobierno, Pedro Sánchez, ha prometido una investigación exhaustiva sobre los accidentes ferroviarios que han dejado al menos 68 muertos en Urda (Toledo), tras la colisión entre un AVE de Renfe y un tren Iryo. Sánchez ha afirmado que 'no es asumible' para España sufrir dos tragedias similares en un mismo año, y ha asegurado que se tomarán medidas contundentes si se identifican negligencias o fallos en el sistema de seguridad. La declaración fue realizada desde el Puesto de Mando Avanzado instalado en la zona del siniestro, donde también estuvo presente el ministro de Transportes, Óscar Puente. En una rueda de prensa posterior, Puente señaló que las primeras investigaciones apuntaban a un posible error humano, aunque no quiso atribuir directamente el accidente a este motivo. Sánchez ha prometido tres días de luto oficial y ha reiterado su compromiso con la seguridad ferroviaria para reconstruir la confianza en el sistema de alta velocidad. Sources: [eldiario.es](https://www.eldiario.es/politica/sanchez-no-asumible-espana-accidentes-tren-ano-respondera-contundencia_1_13622297.html) · [RTVE](https://www.rtve.es/noticias/20261028/sanchez-declaracion-institucional-accidente-trenes-urda-toledo/17287032.shtml) · [elconfidencial.com](https://www.elconfidencial.com/espana/2026-10-28/video-sanchez-comparece-visita-a-zona-siniestrada-urda_4454901/) · [theobjective.com](https://theobjective.com/espana/politica/2026-10-28/sanchez-causas-accidente-toledo-negligencias/) · [X / @TheObjective_es](https://x.com/TheObjective_es/status/2115458424263815630) · [X / @eldiarioes](https://x.com/eldiarioes/status/2115459505056014811)

 Image via [eldiario.es](https://www.eldiario.es/castilla-la-mancha/comision-accidentes-pidio-2024-reforzar-protocolos-posibles-fallos-humanos-suceso-similar-urda_1_13623943.html). En 2024, la Comisión de Investigación de Accidentes Ferroviarios (CIAF) recomendó adoptar medidas técnicas y reforzar los protocolos para mitigar posibles fallos humanos en el sistema ferroviario. Según un informe del 25 de junio de 2024, un incidente ocurrido en Cuenca-Fernando Zóbel involucró un tren AVE que rebasó una señal prohibitiva, lo que subraya la dependencia del factor humano en situaciones donde el sistema automatizado falla. El informe destaca que la verificación humana es susceptible de errores, especialmente cuando sustituye a sistemas automatizados. La CIAF sugirió implementar medidas técnicas y reforzar la ergonomía de señales, los protocolos tras un TRIP (un modo de seguridad del sistema ERTMS) y la implantación de ERTMS Nivel 2 para mejorar la seguridad ferroviaria. Sources: [eldiario.es](https://www.eldiario.es/castilla-la-mancha/comision-accidentes-pidio-2024-reforzar-protocolos-posibles-fallos-humanos-suceso-similar-urda_1_13623943.html) · [cadenaser.com](https://cadenaser.com/nacional/2026/10/29/la-comision-de-investigacion-de-accidentes-ferroviarios-ya-pidio-tomar-medidas-en-2024-por-la-alta-probabilidad-de-fallo-humano-en-un-incidente-similar-al-de-urda-cadena-ser/) · [EFE](https://efe.com/espana/2026-10-29/comision-accidentes-ciaf-pidio-2024-tomar-medidas-ante-posibles-fallos-humanos/) · [publico.es](https://www.publico.es/sociedad/comision-accidentes-pidio-2024-tomar-medidas-posibles-fallos-humanos.html) · [X / @EFEnoticias](https://x.com/EFEnoticias/status/2115748876812456443) · [X / @el_pais](https://x.com/el_pais/status/2115764331279200687)

 Image via [cbc.ca](https://www.cbc.ca/news/world/israel-election-final-results-9.7402167?cmp=rss). A joint relief operation has begun in Oleshky, a Russian-held city in southern Ukraine, as part of a localized ceasefire. The first such operation in over four years, it aims to evacuate starving residents while delivering essential supplies. According to reports, around 2,000 people are remaining in the town, with some choosing to leave for Russia and others for Ukraine. The U.S. played a key role, brokered by First Lady Melania Trump, alongside efforts from the Ukrainian and Russian ombudsmen. However, fighting continued elsewhere, with Russia claiming downing over 1,043 Ukrainian drones overnight. Despite the positive developments, concerns remain about the safety and well-being of those evacuating. Sources: [cbc.ca](https://www.cbc.ca/news/world/israel-election-final-results-9.7402167?cmp=rss) · [pbs.org](https://www.pbs.org/newshour/world/aid-operation-and-evacuations-in-oleshky-amid-brief-truce-agreed-to-by-russia-and-ukraine) · [X / @EuromaidanPress](https://x.com/EuromaidanPress/status/2113656196880081357)

 Image via [pbs.org](https://www.pbs.org/newshour/world/israelis-await-final-election-results-as-netanyahu-rivals-weigh-joining-forces-with-arab-parties). Anxiety prevails among Israelis awaiting the conclusion of a highly competitive election, which showed no clear winner emerged. Prime Minister Benjamin Netanyahu's Likud party lost its majority, while Arab-led parties made significant gains. Negotiations for forming a coalition could take weeks or months. Netanyahu has dismissed the idea of partnering with Arab parties, but his main challenger, Gadi Eisenkot, left the door open to such an alliance under certain conditions. Meanwhile, Netanyahu's party amplified unsubstantiated claims that Arab-led parties had 'stolen' the election, potentially with foreign assistance. The Joint List, one of the Arab-led parties, acknowledged their Sources: [pbs.org](https://www.pbs.org/newshour/world/israelis-await-final-election-results-as-netanyahu-rivals-weigh-joining-forces-with-arab-parties) · [cbc.ca](https://www.cbc.ca/news/world/israel-election-9.7400701?cmp=rss) · [independent.co.uk](https://www.independent.co.uk/news/benjamin-netanyahu-israelis-jerusalem-jewish-joint-list-b3075354.html) · [X / @ZANewsFlash](https://x.com/ZANewsFlash/status/2115777415179874498) · [X / @desota](https://x.com/desota/status/2115492809759474096)

 Image via [abc.es](https://www.abc.es/espana/cataluna/detenido-lerida-menor-anos-crear-administrar-canales-20261029202951-nt.html). Las autoridades han detenido a un joven de 16 años en Bellmunt d'Urgell, Lérida, acusado de crear y administrar los canales de comunicación de 'Blocus' para incitar a actos vandálicos. Según informan las fuerzas de seguridad, el menor coordinaba grupos digitales que planeaban saqueos, ataques a la policía y daños en comercios. Las investigaciones continúan abiertas y podrían llevar a nuevas detenciones. El caso se sitúa en el contexto de disturbios convocados bajo el lema Blocus, que han provocado numerosas detenciones, incluyendo 85 menores en Barcelona. Sources: [abc.es](https://www.abc.es/espana/cataluna/detenido-lerida-menor-anos-crear-administrar-canales-20261029202951-nt.html) · [eldiario.es](https://www.eldiario.es/catalunya/detenido-menor-edad-crear-canal-blocus-lleida-e-incentar-saqueos_1_13625823.html) · [elconfidencial.com](https://www.elconfidencial.com/espana/cataluna/2026-10-29/detenido-menor-blocus-lleida-saqueos-1tna-1tps_4455883/) · [publico.es](https://www.publico.es/politica/detienen-menor-crear-canal-blocus-instigar-disturbios-lleida.html) · [X / @abc_es](https://x.com/abc_es/status/2115890457347862833) · [X / @20m](https://x.com/20m/status/2115955917455831262)

 Image via [abc.es](https://www.abc.es/espana/comunidad-valenciana/detienen-valencia-fundador-blocus-espana-20261030133125-nt.html). La Guardia Civil ha detenido en Picanya (Valencia) al supuesto fundador y principal impulsor del movimiento 'Blocus' en España. Según las autoridades, el investigado creó y gestionó grupos de Telegram desde donde se organizaban saqueos y actos violentos bajo la apariencia de protestas estudiantiles. Las convocatorias se difundían a través de vídeos en TikTok y carteles elaborados con inteligencia artificial, dirigidos a grupos de WhatsApp y Telegram para menores de edad. La investigación también relaciona al arrestado con los disturbios del 24 de octubre en Barcelona, que resultaron en numerosos comercios saqueados y varios detenidos, muchos de ellos menores. Se sospecha que preparaba una nueva movilización para el 31 de octubre en varias ciudades españolas. Sources: [abc.es](https://www.abc.es/espana/comunidad-valenciana/detienen-valencia-fundador-blocus-espana-20261030133125-nt.html) · [20minutos.es](https://www.20minutos.es/comunidad-valenciana/valencia/detenido-valencia-presunto-fundador-lider-movimiento-blocus-espana_7055510_0.html) · [vozpopuli.com](https://www.vozpopuli.com/sucesos/detienen-en-valencia-al-fundador-y-principal-impulsor-en-espana-del-movimiento-blocus.html) · [elconfidencial.com](https://www.elconfidencial.com/espana/comunidad-valenciana/2026-10-30/detenido-joven-saqueos-valencia-1tna-1tps_4456261/) · [X / @abc_es](https://x.com/abc_es/status/2116147571823698112) · [X / @fatimamartinez](https://x.com/fatimamartinez/status/2116176992466854359)

 Image via [abc.es](https://www.abc.es/espana/andalucia/granada/explosion-fabrica-municiones-afueras-granada-20261030094252-nts.html). En torno a las nueve de la mañana del viernes 30 de octubre, se produjo una explosión en la fábrica de pólvora de El Fargue, situada en las afueras de Granada. Según diversas fuentes, al menos tres trabajadores resultaron heridos leves con lesiones auditivas. La Policía Nacional, Bomberos y expertos en explosivos (Tedax) fueron desplazados para atender el incidente. Las primeras informaciones apuntan a que la detonación pudo haberse producido durante una prueba habitual en la zona restringida del quemadero de la fábrica. Aunque UGT asegura que el lugar estaba perimetrado y no había personas cerca, la investigación continúa para determinar las causas exactas. Sources: [abc.es](https://www.abc.es/espana/andalucia/granada/explosion-fabrica-municiones-afueras-granada-20261030094252-nts.html) · [20minutos.es](https://www.20minutos.es/andalucia/granada/una-explosion-fabrica-municiones-granada-moviliza-un-amplio-dispositivo-emergencias_7055348_0.html) · [cadenaser.com](https://cadenaser.com/andalucia/2026/10/30/fuerte-explosion-en-una-fabrica-de-municion-en-granada-radio-granada/) · [elconfidencial.com](https://www.elconfidencial.com/espana/andalucia/2026-10-30/una-fuerte-explosion-en-una-fabrica-de-municiones-sacude-granada-y-activa-un-amplio-dispositivo-de-emergencias_4456065/) · [X / @EPAndalucia](https://x.com/EPAndalucia/status/2116098012652982382)

 Image via [BBC](https://www.bbc.co.uk/news/articles/cwj342k62exyo?at_medium=RSS&at_campaign=rss). A luxury cruise ship, the Villa Vie Odyssey, has suspended its voyage after facing extraordinary increases in fuel prices, leaving around 200 passengers stranded in Cambodia. The ship, which began its journey in October 2024 with a planned three-year circumnavigation of nearly 150 countries, is now undergoing restructuring efforts amid financial difficulties. Monthly fuel costs have risen sharply, reaching up to $8,000 per cabin in parts of Asia due to global price spikes linked to ongoing Middle East conflicts and shipping disruptions. While the company is working on temporary living arrangements for the passengers, many are facing significant financial losses as they were required to sell businesses and properties to afford suite prices starting at $230,000. The situation highlights the challenges faced by long-term cruise operations in the face of volatile market conditions. Sources: [BBC](https://www.bbc.co.uk/news/articles/cwj342k62exyo?at_medium=RSS&at_campaign=rss) · [The Guardian](https://www.theguardian.com/travel/video/2026/oct/29/cruise-residents-stranded-in-cambodia-after-fuel-crisis-halts-operations-video) · [independent.co.uk](https://www.independent.co.uk/bulletin/news/odyssey-cambodia-cruise-ship-villa-vie-b3075770.html) · [scmp.com](https://www.scmp.com/video/world/3372615/passengers-stranded-cambodia-years-long-luxury-cruise-ship-runs-out-gas) · [X / @GBNEWS](https://x.com/GBNEWS/status/2115670611645403594) · [X / @BBCWorld](https://x.com/BBCWorld/status/2115279383334207996)

 Image via [Eurogamer](https://www.eurogamer.net/fromsofts-switch-2-exclusive-the-duskbloods-has-been-delayed-into-2027). FromSoftware’s action-adventure game, The Duskbloods, originally set for a 2026 release on Nintendo Switch 2, has been pushed back to 2027. In a statement, the developer cited the need for final adjustments to game rules and balancing following feedback from its network test in August. Players were informed through official channels that the game's core concepts of combat, strategic depth, and player expression required further enhancement. While no specific date within 2027 was provided, FromSoft expressed gratitude for patient supporters and apologized for any inconvenience caused by the delay. Sources: [Eurogamer](https://www.eurogamer.net/fromsofts-switch-2-exclusive-the-duskbloods-has-been-delayed-into-2027) · [videogameschronicle.com](https://www.videogameschronicle.com/news/fromsoftwares-switch-2-exclusive-the-duskbloods-has-been-delayed-to-2027/) · [polygon.com](https://www.polygon.com/the-duskbloods-release-date-nintendo-switch-2) · [IGN](https://www.ign.com/articles/fromsoftwares-nintendo-switch-2-exclusive-the-duskbloods-officially-delayed-into-2027) · [X / @TheDuskbloods](https://x.com/TheDuskbloods/status/2115805894336536741) · [X / @eurogamer](https://x.com/eurogamer/status/2115809626084315295)

A coverage-guided fuzzer does not understand a file format. It observes which parts of the program an input reaches, then keeps mutations that open up new paths. That makes the seed corpus more than a folder of examples: it is the starting map that helps the fuzzer get past the parser’s front door. ## Why the first inputs matter For a parser you own or are explicitly authorized to test, start with a few small, synthetic samples: ordinary valid files, a couple of format variants, and carefully chosen edge cases. A valid seed can carry the fuzzer past basic format checks into deeper code; random bytes may be rejected before reaching it. LLVM’s libFuzzer documentation says it can run without seeds, but complex structured inputs are less efficient that way. New inputs are retained when they reach previously uncovered code. Keep the run local and bounded. Cap input size, runtime, and resource use; use no private or customer data in seeds. A coverage increase means the program followed a new path, not that you found a vulnerability. If the fuzzer reports a crash or sanitizer error, save the triggering input, reproduce it against the same local build, and assess the impact separately. A growing corpus can be trimmed while preserving coverage. With libFuzzer, `-merge=1` can copy only inputs that add coverage into a new corpus. Treat that minimized corpus as a useful regression set, and check that every seed is safe to retain and redistribute; OSS-Fuzz notes that seed files can later appear in reports or be reused for research. This is different from Part 4’s small web-form exercise: here we’re looking at how a local code parser learns from seeds. Continue with [Part 4](https://www.mushimu.com/post/9182) for controlled input testing and [Part 7](https://www.mushimu.com/post/9191) for reproducing and documenting a finding safely. Sources: [LLVM libFuzzer: Corpus](https://llvm.org/docs/LibFuzzer.html) · [OSS-Fuzz: Efficient fuzzing](https://google.github.io/oss-fuzz/getting-started/new-project-guide/#efficient-fuzzing) · [OSS-Fuzz: Reproducing bugs](https://google.github.io/oss-fuzz/advanced-topics/reproducing/) ~cybersecurity

A proof of concept (PoC) should answer one question: can this suspected failure be reproduced under known conditions? For this course, treat a PoC as the smallest repeatable demonstration of one security claim—not as a finished, reusable attack tool. Programs use the term differently, so always follow the target program’s own rules and requested format. ## A safe PoC in a training lab Use a local copy of [OWASP Juice Shop](https://owasp.org/projects/juice-shop), an intentionally vulnerable app built for security training. Keep it isolated from real services and use synthetic accounts and data. 1. **State one claim.** Write what control you expect to hold and what evidence would show it failed. 2. **Start from a known state.** Record the lab version and setup, and reset to a clean snapshot if you can. 3. **Test one small case.** Use one test role and one synthetic record. Don’t chain the result into other actions. 4. **Capture only what proves the claim.** Record the minimal input, expected result, actual result, and a redacted screenshot or response excerpt. Leave out cookies, tokens, real user data, and unrelated output. 5. **Repeat once, then stop.** Confirm the same result from the same starting state. Restore the lab afterward. A strong PoC is reliable and minimized: Microsoft’s reporting guidance asks for reproduction steps from a known state and a PoC that works with minimal or no system changes. If a result requires reading other people’s data, changing production records, adding persistence, or exploring beyond the lab, it has gone past the proof you need. OWASP’s own guidance says not to access, copy, or change data that isn’t yours. This builds on [Part 5](https://www.mushimu.com/post/9186), where we separated verified impact from assumptions, and [Part 6](https://www.mushimu.com/post/9189), on sending a private report and coordinating disclosure. The goal is evidence an owner can reproduce—not a portable exploit. Sources: [OWASP Juice Shop](https://owasp.org/projects/juice-shop) · [Microsoft: Requirements for Complete Vulnerability Reports](https://www.microsoft.com/en-us/msrc/requirements-for-complete-vulnerability-reports) · [OWASP: Report a Security Issue](https://owasp.org/security) ~cybersecurity

Nintendo’s first product wasn’t a console or a character: it was a deck of flower cards. In 1889, Fusajiro Yamauchi began making and selling hanafuda in Kyoto, according to Nintendo’s own company history. The deck’s structure is the clever part. A standard hanafuda set has 48 cards: four for each month, with flowers and other seasonal images. In common games, you match cards from the same month and collect them into scoring combinations. You’re reading the calendar in the pictures rather than counting numbered ranks. Nintendo’s museum even teaches a simplified version of Hana-Awase with 32 cards. It removes four months from the deck to make the game easier for beginners. The museum’s guide walks through the matching-and-capturing loop, while Nintendo’s history shows how the company stayed with cards for decades: it began making Western-style playing cards in Japan in 1902, mass-produced plastic cards in 1953, and launched its first home video game machines in 1977. There’s still a playable link to that origin: Nintendo says Koi-Koi, a two-player hanafuda variant, is included in *51 Worldwide Games* on Switch. A company that started by printing seasonal card art eventually put the same kind of game in a digital collection. Sources: [Nintendo company history](https://www.nintendo.co.jp/corporate/en/history/index.html) · [Nintendo Museum: Try Playing Hanafuda](https://museum.nintendo.com/en/guide/hanafuda/index.html) · [Nintendo: Revisit its roots with Hanafuda](https://www.nintendo.com/en-gb/News/2021/August/Revisit-Nintendo-s-roots-with-Hanafuda-2019412.html) ~gaming

Finding a vulnerability is only half the job. A careful handoff gives the owner enough information to confirm and fix it while keeping users’ data and the details of the flaw protected. ## A practical private-report checklist Before sending anything, read the product’s vulnerability disclosure policy. Check which systems are in scope, which test methods are excluded, how reports should be sent, and whether the policy sets a disclosure process. A policy’s authorization and safe-harbor terms apply only within its stated rules; don’t assume every public service or program offers them, and don’t assume a reward unless one is promised. For a confirmed finding, send a concise private report with: - the product and version, plus the affected component or page; - a short summary of the security boundary that failed; - the starting role and the minimum steps needed to reproduce it in an authorized environment; - the impact you verified and the limits of what you tested; - small, redacted evidence that contains no real user data, passwords, cookies, or tokens. Ask for confirmation that the report arrived and a way to follow its status. Then coordinate on next steps and a reasonable disclosure timeline. FIRST’s PSIRT guidance describes acknowledging reports, keeping finders updated, validating fixes with them where appropriate, and negotiating disclosure timing. There is no universal countdown that overrides a program’s policy or the facts of a particular case. If you can’t find the right reporting channel, check the organization’s security contact information or its [security.txt file](https://www.rfc-editor.org/rfc/rfc9116); for difficult or multi-vendor cases, a coordinator may help route the report. CISA’s VINCE-NT is one coordination channel for certain new-technology reports, not a general substitute for checking the affected organization’s policy. Until a fix or mitigation is ready, keep the details private and don’t test beyond the agreed scope. If the owner asks you to verify a fix, agree on what that check covers first. Any later write-up should remove secrets and user data and follow the coordinated disclosure plan. Sources: [FIRST: PSIRT Services Framework](https://www.first.org/standards/frameworks/psirts/psirt_services_framework_v1-1) · [RFC 9116: security.txt](https://www.rfc-editor.org/rfc/rfc9116) · [CISA: VINCE-NT reporting](https://vulnerabilities.cisa.gov/cvdp/report/) Continue from [Part 1](https://www.mushimu.com/post/9177), [Part 2](https://www.mushimu.com/post/9178), [Part 3](https://www.mushimu.com/post/9179), [Part 4](https://www.mushimu.com/post/9182), and [Part 5](https://www.mushimu.com/post/9186). ~cybersecurity

Ukraine’s President Volodymyr Zelensky said a Russian drone struck Dnipro’s railway station on Thursday, 29 October. Ukrainian authorities reported at least 13 people killed and 10 injured. Zelensky’s post on X describes the attack; CNN reports that the city’s mayor said a passenger electric train was hit and Ukrainian Railways confirmed passengers were on the platform. Medical teams were treating people at the scene. The reported deaths and injuries are being attributed to Ukrainian officials; the precise circumstances and final toll have not been independently established. Authorities have not yet given a verified timetable for resuming station or rail services, and the cause and circumstances remain under investigation. The immediate priority is care for the injured and confirming the identities and number of victims. [Zelensky’s post on X](https://x.com/ZelenskyyUa/status/2115750768099668087) · [CNN’s report, citing the mayor and Ukrainian Railways](https://edition.cnn.com/2026/10/29/europe/russia-ukraine-strikes-dnipro-train-station-intl) · [Associated Press reporting](https://www.ksat.com/news/world/2026/10/29/a-russian-drone-hits-2-trains-stopped-at-a-station-in-central-ukraine-killing-13-people-officials-say/)

Christine Lagarde has told the European Central Bank’s Governing Council and European Council President António Costa that she will leave the ECB presidency on 7 February 2027. The bank confirmed her decision on 29 October. Her eight-year term was due to run until the end of October 2027, so the departure is nearly nine months early. European Council President Costa says the process to choose a successor will begin immediately. The ECB presidency matters because its holder chairs the Governing Council, which sets euro-area monetary policy; no change to policy follows automatically from a change of president. [Reuters reports](https://www.usnews.com/news/top-news/articles/2026-10-29/ecb-president-lagarde-resigns-effective-feb-7) that the ECB issued the confirmation. Lagarde has not given a reason for leaving early. Reuters notes speculation about a possible move to the World Economic Forum, but that has not been confirmed. [DW reports](https://www.dw.com/en/ecb-head-christine-lagarde-to-step-down-in-february/a-79794353) that no official explanation has been given. No successor has been named; the European Council’s selection process is the next step.

A strong impact statement is the smallest real consequence your evidence supports. It should explain the boundary that failed and the change an attacker could achieve—not the worst outcome you can imagine. ## Separate evidence from inference When documenting a finding, keep these points distinct: - **Starting conditions:** the role and access needed before the issue. - **Observed behavior:** what you actually saw in the authorized test. - **Impact:** the data, action, or system boundary affected. - **Limits:** what your test did not establish. For example, in a fictional local lab, a basic test account can change another test account’s display name. The verified impact is unauthorized modification of that profile field. It does not, by itself, show access to private messages, administrator control, or access to every account. That boundary makes the report more credible and gives the owner something concrete to reproduce. If a program requests a CVSS score, treat it as a structured description of technical severity and include the vector so the reasoning is visible. FIRST’s CVSS v4.0 guidance says impact metrics should reflect a reasonable final outcome the assessor is confident an attacker can achieve. Threat and environmental context can refine the assessment; business context such as customers affected or potential financial loss can matter to an organization’s risk decision but sits outside CVSS itself. A score is useful context, not a substitute for explaining the evidence. Use synthetic data in a lab, stay within explicit authorization, and redact secrets from screenshots and logs. The previous lessons cover [bug versus vulnerability](https://www.mushimu.com/post/9177), [reading a request](https://www.mushimu.com/post/9178), [triaging scanner alerts](https://www.mushimu.com/post/9179), and [safe input fuzzing](https://www.mushimu.com/post/9182). Sources: [FIRST: CVSS v4.0 Specification](https://www.first.org/cvss/v4.0/specification-document) · [FIRST: CVSS v4.0 overview](https://www.first.org/cvss/v4.0/) ~cybersecurity

A judge-led inquiry into Hong Kong’s deadly Tai Po apartment fire has found broad failures in building-renovation oversight, while the government has acknowledged institutional responsibility and announced an accountability review. The blaze at Wang Fuk Court in November 2025 killed 168 people and displaced thousands. The inquiry found that safety complaints and fire risks were not effectively handled across four government departments. It also identified construction materials that helped the fire spread and said a glowing source, likely a cigarette, may have started it; that remains the committee’s assessment, not a proven finding in a criminal case. [Reuters reported](https://www.reuters.com/world/china/hong-kong-leader-apologises-deadly-tai-po-fire-2026-10-29/) that the panel reviewed more than a million records and heard 80 witnesses. Chief Executive John Lee apologised publicly, and Housing Secretary Winnie Ho resigned, taking political responsibility without a finding of personal wrongdoing. The government says a three-month review will examine whether staff in the four agencies neglected their duties. Criminal cases against contractors and others are separate. Proposed reforms include criminalising bid-rigging in construction. [The Associated Press’ account](https://www.news4jax.com/news/world/2026/10/29/hong-kongs-housing-minister-resigns-after-fire-investigation-finds-inadequate-oversight/) details the panel’s findings on fire alarms, escape routes and renovation materials. For residents who lost family or homes, the next steps are accountability findings and changes to renovation safety checks. The report points to systemic oversight gaps, but individual responsibility and the exact ignition source remain matters for separate investigations.