The United States has withdrawn all long-range bombers from RAF Fairford, flying roughly a dozen B-1s back to US home bases after counter‑terror investigators probed a serious security incident at the Gloucestershire airfield on 27 September. Police were alerted to three suspicious vehicles approaching the base and arrested six men over subsequent days; all have since been released on bail. US officials acted after fresh intelligence, reportedly warning of an Iran‑backed plot targeting the base, prompted commanders to move the bombers rapidly while aerial refuellers were being scrambled. The removal was handled as an operational military decision communicated between US and UK forces; the UK Ministry of Defence has not publicly commented. Senior US figures suggested possible foreign involvement, and Iran has denied any role.
Removing the B-1s strips the US of a forward strike foothold in the UK and lengthens mission time and logistical complexity for any strikes against Iran, though Pentagon statements stress US bombers can still operate globally from continental bases. The B-1 fleet is a limited strategic asset often armed with precision "bunker‑busting" munitions and air‑to‑surface missiles, making their protection a priority. RAF Fairford, owned by the UK but regularly operated by the US Air Force, has long hosted B-52s, U-2s and other long‑range deployments tied to recent Middle East tensions. Counter‑terror police continue to investigate the incident.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
GrapheneOS has a partial port to the Pixel 11 but cannot complete it due to lack of support for ARM hardware memory tagging (MTE), a key security feature. Google reportedly cut MTE support to save costs, despite newer Pixel models and iPhones implementing similar security measures. (discuss.grapheneos.org)
The @subql/common version 5.8.3 was compromised with a postinstall credential stealer, affecting the popular SubQuery repository with 18,000 stars. The malicious release was reported on GitHub, raising security concerns among users. (github.com)
Uceprotect is blacklisting entire hosting provider networks like DigitalOcean based on ASN reputation, affecting innocent websites. The blacklist demands monthly fees for whitelisting, which can cut off access for users on networks that rely on these filters. (news.ycombinator.com)
AI vulnerability scanning has become essential for maintaining software security and quality in 2026, as human developers struggle with unsafe languages. Improved AI tools now effectively identify security and non-security bugs, significantly enhancing software reliability. (blogs.gnome.org)
A zero-day vulnerability in KVM allows virtual machines to escape their sandbox and execute code on the host system. The flaw affects KVM, a popular open-source virtualization technology used in many cloud and server environments. (cybernews.com)
A vulnerability in macOS (CVE-2026-65400) enabled remote code execution via the screen sharing feature, prompting Apple to release a patch. The author's Mac Mini, running only AI agents like Claude and Codex, was protected from the exploit due to its limited access. (stratechery.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.