Ukraine — Novorossiysk Raid Damages Four Warships, Ends the Black Sea Fleet’s Last Sanctuary#

Ukraine carried out what Krasnodar regional governor Veniamin Kondratyev described as a “massive” overnight operation against Russia’s Novorossiysk naval base on August 12 — by several accounts the largest single-night drone operation of the war, with Russia’s Defense Ministry claiming to have downed more than 500 Ukrainian drones across Novorossiysk, Anapa, Gelendzhik, and the Temryuk district. President Zelenskyy called it a “unique” strike, and it lived up to the description: Ukraine combined jet-powered Palianytsia drones, Neptune anti-ship missiles, and uncrewed naval systems to hit Russia’s last major Black Sea stronghold, some 300km from the front line. Zelenskyy said the strike damaged two Kalibr-carrying frigates, a large landing ship, a corvette, and other vessels — four warships in total, according to Euromaidan Press’s accounting.

The human cost fell on civilians rather than the fleet: Kondratyev said at least three people were killed, including an eight-year-old child, with twelve more wounded across the region. Two grain terminals at the port halted operations and water service was cut to parts of the city; four enterprises, more than two dozen residential buildings, and some educational facilities sustained damage. Novorossiysk had functioned as the Black Sea Fleet’s fallback anchorage after Ukrainian strikes forced Russia to largely abandon Sevastopol earlier in the war — this raid signals that no Russian Black Sea port is now reliably safe from Ukrainian reach.

Sources: Washington Times — Ukraine launches drone and missile strike on Russian naval base nearly 200 miles from the front line · Euromaidan Press — Two Kalibr-carrying frigates, a missile ship, a patrol vessel: Ukraine hit four Russian warships in one night at Novorossiysk · Al Jazeera — Ukraine hits grain terminals at Russia’s Novorossiysk port, killing three · The Moscow Times — 3 Killed, 2 Grain Terminals Halt Work in Novorossiysk After Ukrainian Attack · Tech Times — Novorossiysk Struck by Ukraine’s Veto-Proof Missiles, Ending Fleet’s Black Sea Sanctuary

Disaster — Colombia’s Earthquake Search Enters “Final Phase” as Toll Hits 265#

Colombian rescue teams entered what officials called the “final phase” of the search for survivors on Wednesday, racing to beat the close of the critical 72-hour window since Monday’s magnitude-7.4 earthquake — the strongest to hit the country this century. President Abelardo de la Espriella put the confirmed death toll at 265, with more than 3,500 injured and almost 500 still listed as missing. In Pereira, crews concentrated on a collapsed bakery where a trapped street vendor was believed to still be alive, and rescuers using vibration-detection equipment picked up possible signs of life from another man, Pablo Loaiza, drawing anxious relatives to the wreckage. Late Tuesday, crews freed Daniela Largo alive after a 12-hour extraction that required carving an opening around her pinned arm while a doctor administered IV fluids on site.

Ecuador’s President Daniel Noboa has offered a 47-member search-and-rescue team capable of operating independently in Colombia for a week, adding to the international response mobilized since Monday. The earthquake, centered in the Chocó region, struck hardest in Pereira and Cali. Background on the initial disaster is in our August 11 roundup.

Sources: France 24 — Colombia earthquake rescue efforts enter ‘final phase’ as death toll rises · The Japan Times — Colombia enters ‘final phase’ of quake search as toll rises · NPR — Colombia’s new government and rescuers race against the clock to find survivors · Al Jazeera — Colombia quake: Frantic search for survivors as over 2,700 reported missing

Geopolitics — Trump Claims “Total Control” of Hormuz as Global Oil Stockpiles Hit Four-Decade Lows#

President Trump reasserted on August 12 that the United States maintains “total control” of the Strait of Hormuz, even as transit through the waterway fell to a one-week low — just eight vessels crossed on Tuesday, down from 130–140 daily before the war. Iran pushed back hard: a top adviser to the IRGC commander said Tehran could “prolong” its war with the US until Trump leaves office, and Iranian officials reiterated that Hormuz will not reopen until Washington meets Iran’s conditions, rejecting Trump’s claim of control outright.

The standoff is no longer just a regional dispute — the IEA’s August 12 Oil Market Report cut its 2026 global oil demand forecast by 1.6 million barrels per day and warned that inventory buffers are “rapidly depleting” with no reopening deal in sight. Global observed oil inventories fell below 7.9 billion barrels in July, the lowest since April 2025 and down 410 million barrels since the war began; US crude stockpiles are below 300 million barrels, the lowest in more than four decades. With Bab el-Mandeb transit also still constrained by Houthi activity, the IEA says it is lowering supply estimates for the rest of the year. This is the clearest sign yet that the Hormuz closure has moved from a Middle East story to a global-economy one.

Sources: CNN — Trump insists US controls Hormuz, Iran says it could ‘prolong’ war with US · Al Jazeera — As Strait of Hormuz transit drops, Trump again says US has ‘control’ · The Times of Israel — Aug. 12: Responding to Trump’s claims of control, Iran says Hormuz won’t open until its conditions met · CNBC — IEA cuts 2026 oil demand forecast on Hormuz disruption · UPI — IEA says oil stocks falling fast · gCaptain — IEA Warns Oil Market Risks Mount as Hormuz Disruptions Drain Inventories

AI & Security — A Shared Encryption Key Let Weaker Models Decode OpenAI, Anthropic, and Google’s Hidden Reasoning#

Researchers disclosed a cross-provider flaw in how OpenAI, Anthropic, and Google handle encrypted “reasoning” tokens passed between API calls — the hidden chain-of-thought that reasoning models generate but don’t show users directly. All three providers were found to use a single global encryption key per model family for these reasoning blocks, which meant a block created in one session could be replayed into another, and in testing, even handed to a weaker model from the same provider to decode the stronger model’s hidden reasoning without ever breaking the stronger model’s own encryption. The team demonstrated four abuse paths: stealing proprietary reasoning for model distillation, extracting private data from other users’ published agent traces, recovering harmful content hidden behind a “safe” visible answer, and concealing prompt injections inside opaque reasoning blocks. Across 6,708 public agent trajectories the researchers pulled from the web, they successfully decoded 315,320 individual thinking blocks — including, in some cases, API keys and passwords left in reasoning traces.

Vendor responses have diverged since disclosure. OpenAI still instructs developers to replay encrypted reasoning items when manually managing stateless history. Google says its backend now manages compatibility automatically when a session switches models. Anthropic’s updated guidance says thinking blocks are tied to the specific model that produced them and should be stripped out when switching models, since other models will simply ignore them rather than decode them.

Sources: The Hacker News — OpenAI, Anthropic, Google API Flaw Let Weaker AI Models Decode Stronger Models’ Reasoning · Cyber Security News — OpenAI, Anthropic, and Google LLM APIs vulnerability Exposes Hidden Reasoning Traces · AI Weekly — Encrypted reasoning cracked across Anthropic, OpenAI, Google · MetaTalks — Researchers pulled hidden reasoning — and passwords — out of OpenAI, Anthropic and Google models

AI & Security — LiteLLM Compromise Named the Largest AI Supply-Chain Breach of 2026#

Security researchers at CloudSEK say a breach traced to the widely-used LiteLLM proxy project is the largest AI supply-chain attack uncovered so far in 2026, with a reconstructed exposure dataset touching more than 2,500 companies and roughly 434,000 CI/CD pipelines. The threat group tracked as “Team PCP” compromised LiteLLM’s PyPI packages (versions 1.82.7 and 1.82.8) back in March 2026 by first breaching the Trivy security scanner embedded in LiteLLM’s own build pipeline — that entry point stayed compromised for roughly 20 days, though the poisoned packages themselves were only live and downloadable for about 40 minutes. CloudSEK’s high-confidence matches for exposed organizations include Nvidia, AWS, Samsung, Salesforce, Cisco, ServiceNow, Siemens, S&P Global, Deloitte, Vodafone, BT, Zscaler, and X — though the firm cautions a high-confidence match doesn’t itself prove an organization was successfully compromised or that stolen credentials were actually used.

The FBI issued a FLASH advisory back in July warning that credentials harvested in the breach could still be weaponized in future attacks, and this week’s disclosure is effectively the fuller public accounting of just how far a 40-minute package-poisoning window reached through the AI tooling supply chain.

Sources: CloudSEK — 2,500+ Companies and 434,000 CI/CD Pipelines Exposed in the Largest AI Supply Chain Breach of 2026 · CX Today — Supply Chain Attack Exposes 2,500+ Companies in Largest AI Infrastructure Breach of 2026 So Far · The IT Nerd — 2,500+ Organisations and 434,000 CI/CD Pipelines Potentially Exposed

AI & Tech — Anthropic Starts Watermarking Claude’s Output Ahead of the EU AI Act Deadline#

Anthropic announced it will begin embedding machine-readable watermarks into content generated by Claude, including invisible marks baked directly into AI-generated text, and metadata following the C2PA provenance standard for generated files. The move brings Anthropic in line with OpenAI and Google, both of which have outlined similar plans to comply with the EU AI Act’s Transparency Code, which took effect August 2 and requires AI companies to mark generated or edited content in machine-identifiable ways. Every model Anthropic releases after August 2 will carry the watermarking tech by default, applied across the Claude consumer app, the Claude Developer Platform API, Claude Code, Claude Cowork, and Claude in Slack (Claude Tag).

Because the text watermark lives inside the generated text itself, Anthropic says it should survive copy-paste and some light editing, though heavy rewriting, mixing with other text, or very short outputs can push a passage below reliable detection thresholds. Reaction has been mixed — some commentators framed it as a meaningful transparency step, others raised concerns about downstream implications for anonymity and detection false positives.

Sources: TechCrunch — Anthropic says it will watermark text generated by its AI models · Axios — Anthropic’s text watermarks signal new front in AI detection · SiliconANGLE — Anthropic to start watermarking Claude-generated text, images · Forbes — Claude Will Put Invisible Watermarks On AI Text And Images

Science — A Total Solar Eclipse Sweeps Spain and Iceland, the Biggest Since 1999#

A total solar eclipse crossed eastern Greenland, western Iceland, and swept across the northern half of Spain and the northeastern corner of Portugal on August 12, with the path of totality drawing crowds across northern Spain for what observers are calling the biggest eclipse of its kind visible from the region since 1999. Skywatchers in Zaragoza, La Coruña, and Segovia captured totality against local landmarks — including the Cathedral-Basilica of Our Lady of the Pillar in Zaragoza, with a second reflection of the eclipsed sun visible in the Ebro River. Outside the path of totality, much of the rest of Europe, including the UK, experienced a deep partial eclipse.

Sources: France 24 — In pictures: Partial to total eclipse sweeps across much of Europe · EarthSky — Total solar eclipse August 12, 2026: Best images · NBC News — Photos: Europe basks in total solar eclipse · NASA Science — APOD: 2026 August 13 - Total Solar Eclipse Over Spain · Weather.com — Total solar eclipse 2026, in pictures: Images from Europe