• Mon - Fri 9.00 - 19.00

Yearly Archives: 2026

Albertans Vote Next Month on Whether to Start Leaving Canada

Albertans go to the polls on October 19 to answer a question few Canadian provinces have ever put to voters. Should Alberta begin the legal steps that could eventually lead to leaving Canada? The Alberta independence referendum vote is one of ten questions on that day’s ballot. It is the one drawing national attention.

The question is narrower than “should Alberta separate.” It asks whether the provincial government should start the legal process, required under the Canadian Constitution, to hold a further binding referendum on separation. A Yes vote opens a door. It does not walk Alberta through it.

Alberta prairie landscape ahead of the Alberta independence referendum vote

What the Alberta Independence Referendum Vote Actually Asks

Premier Danielle Smith announced the question in May 2026. Supporters of staying branded it “Alberta Forever Canada.” It joined nine other questions already scheduled for the October vote. The referendum’s own text is clear: even a Leave result would not force the government to pursue separation outright. It would only open the door to a subsequent, binding referendum.

That two-step structure matters. Voters casting a Yes ballot are not voting Alberta out of Canada. They are voting to let a legal process begin, one that could eventually lead there.

How the Vote Got Here

Alberta has flirted with separatist sentiment for decades. The grievances are familiar: federal energy policy, equalization payments, pipeline approvals. Those tensions sharpened again through 2025 and 2026 as disputes over resource royalties resurfaced. Smith’s government folded the independence question into the broader referendum package instead of holding a standalone vote. Critics say that choice was designed to normalize the idea without forcing a single up-or-down moment on secession.

Supporters counter that bundling lets voters weigh in on several provincial issues at once, cutting the cost of a standalone vote. Opponents say the bundling buries a constitutionally significant question inside routine ballot business.

What the Polling Says About Alberta’s Mood

Public opinion has not swung toward Leave. In mid-August 2026, close to two-thirds of Albertans told pollsters they would vote to remain part of Canada. Under a third favored starting the separation process. That gap has held steady through the campaign. It suggests the vote is more likely to produce a symbolic rebuke of Ottawa than a real mandate for secession.

A Yes Vote Would Not Mean Alberta Leaves Canada

Even backers of the Leave option admit the practical hurdles ahead. Actual separation would require a second, binding referendum. It would need negotiations with the federal government. It would raise constitutional questions never tested at this scale in Canada. Legal scholars compare the path to Quebec’s earlier sovereignty referendums, both of which failed to produce separation.

Why This Matters Beyond Alberta

Other resource-rich provinces are watching closely. Saskatchewan politicians have floated similar grievances over federal energy and equalization policy. A strong Yes showing in Alberta, even on a symbolic question, could embolden similar pushes elsewhere. National unity researchers read the vote less as a genuine secession threat and more as pressure tactics aimed at Ottawa.

Federal officials have mostly avoided commenting on the referendum directly. Some Alberta politicians cite that silence as proof Ottawa does not take the threat seriously.

The Road From Referendum to Anything Binding

If Yes wins on October 19, Alberta’s government would begin the constitutional process for a further referendum, not declare independence. Ottawa has given no sign it would treat a Yes result as a trigger for talks. No timeline exists for a second vote. Most constitutional lawyers expect any binding referendum, if it happens at all, to be years away.

That long runway is part of why some analysts read the vote as symbolic rather than procedural. A strong Leave showing would hand Smith a stronger hand with Ottawa. A strong Remain showing would let federal officials argue the separatist movement lacks real public support.

What Turnout Could Signal

Turnout is one number analysts are watching almost as closely as the result. A low turnout on the independence question, even with a Leave majority, would let Ottawa and Remain supporters dismiss the result as unrepresentative. A high turnout in either direction would carry more weight in the political arguments likely to follow October 19, whichever side wins.

Provincial election officials have not released turnout projections ahead of the vote. Past Alberta referendums and provincial elections have shown turnout can swing sharply, depending on how contentious the ballot questions are seen to be.

Reader Questions on the Alberta Vote

When is the Alberta independence referendum vote?

October 19, 2026, alongside nine other referendum questions on the same ballot.

Does a Yes vote mean Alberta separates from Canada?

No. A Yes vote would only direct the provincial government to begin the legal process toward a future, binding referendum on separation.

Is the Alberta government bound to act on the result?

No. The government is not bound to abide by whichever option wins the most votes.

What do polls show?

In mid-August 2026, close to two-thirds of Albertans said they would vote to remain in Canada, against under a third who favored starting the separation process.

Who is Alberta’s premier?

Danielle Smith, who added the referendum question in May 2026 as part of a wider package of ten questions.

Sources

See also Tamara News coverage of the Global State of Democracy report and Trump’s Greenland deal with Denmark for more on this year’s territorial politics.

Ukraine Just Launched Its Biggest Drone Attack Ever — On Moscow

The Ukraine drone attack Moscow forces launched over the weekend was the largest single wave of drones Kyiv has sent at the Russian capital. It damaged one of the country’s biggest oil refineries. It killed at least three people.

Russia’s Ministry of Defense said its air defenses shot down more than 1,900 drones. They also downed eight guided aerial bombs, eight cruise missiles and four rockets overnight. The scale stood out, even in a war with near-nightly long-range strikes.

Fire and smoke rise from the Moscow oil refinery hit in the Ukraine drone attack Moscow

How Big the Ukraine Drone Attack Moscow Really Was

Ukraine’s General Staff named the main target as the Gazpromneft-Moscow Oil Refinery. It sits in the capital’s Kapotnya district. The facility ranks among Russia’s largest refineries by processing volume. Drones and debris also struck a residential building nearby, officials said.

Russian state media broadcast footage of fires burning through the night. Some Moscow-area airports faced temporary flight disruption as air defenses engaged the drones. That pattern has repeated through 2026 as both sides expand their long-range strike campaigns.

Casualties and Damage on the Ground

Regional officials confirmed at least three deaths linked to the strikes. Authorities have not released a full damage assessment for the refinery. Russian energy analysts say repeated strikes on refining capacity this year have already strained domestic fuel supply in several regions.

Ukraine has not detailed civilian casualties from the attack. Kyiv’s public statements instead focus on the strike’s military and economic significance.

The barrage’s scale also stands out against the war’s broader arc. Both militaries have steadily expanded their drone fleets over more than four years of full-scale fighting. Drones went from a niche weapon to the dominant feature of the war’s long-range campaigns. A single-night wave of 1,900 drones would have been unthinkable in the war’s early years, when strikes numbered in the dozens.

Why the Timing Looks Deliberate

The strike landed on the final day of Russia’s parliamentary elections. Voting included, for the first time, ballots cast in Ukrainian territory Moscow has illegally annexed. Moscow Mayor Sergei Sobyanin said the attack “was clearly planned with the aim of disrupting the elections.”

Ukrainian officials have not directly addressed that claim. They have long argued that refineries, not polling stations, are the real targets. Any overlap with the election calendar, they say, reflects operational timing rather than an attempt to interfere with the vote.

How Russia and Ukraine Are Each Framing It

Russian officials cast the strike as an attack on civilians and infrastructure, timed to embarrass the Kremlin during a national vote. Ukrainian officials frame it differently. They call it a legitimate strike on a facility that fuels Russian military logistics. Kyiv has hit dozens of refineries and depots since 2024.

Neither account has been independently verified by outside investigators as of publication.

The Broader Pattern of 2026’s Refinery War

This strike did not happen in isolation. Ukraine has spent much of 2026 targeting Russian refining capacity systematically. The goal: squeeze the fuel supply that keeps Russian military vehicles and aircraft running. Energy analysts say the cumulative effect has been real, even though any single strike rarely knocks a facility offline for long.

Russia has leaned harder on strikes against Ukraine’s power grid and gas network as winter approaches. That tit-for-tat dynamic has defined the war’s energy front since 2024. Each side appears to be betting that degrading the other’s infrastructure matters more than front-line gains alone. That calculation has held through multiple failed ceasefire attempts this year.

Western officials monitoring the war call the mutual infrastructure campaign a war of attrition on the home front. It is distinct from the static trench lines further south and east. Neither side has forced a decisive shift through infrastructure strikes alone. Yet both continue expanding the campaigns rather than scaling them back.

What Happens Next in the Drone War

Russian and Ukrainian long-range strikes have both intensified through September. Analysts tracking the war expect that pattern to continue. Russia has previously answered major Ukrainian refinery strikes with retaliatory barrages within days. Residents on both sides are watching for a response this week.

The attack also lands just as world leaders gather in New York for the United Nations General Assembly’s high-level week. The war is expected to feature heavily in floor speeches and side meetings there.

Common Questions About the Moscow Refinery Strike

How large was the Ukraine drone attack Moscow strike?

Russia’s defense ministry said it shot down more than 1,900 drones, eight guided bombs, eight cruise missiles and four rockets overnight, the largest single wave of the war aimed at the capital region.

What was the main target?

The Gazpromneft-Moscow Oil Refinery in the Kapotnya district, one of Russia’s largest refineries by volume, according to Ukraine’s General Staff.

Were there casualties?

Russian officials reported at least three deaths in the Moscow region and damage to a residential building near the refinery.

Why did the timing matter?

The strike landed on the final day of Russia’s parliamentary elections, which Moscow’s mayor said was no coincidence.

Has Russia announced retaliation?

Not yet tied specifically to this strike as of publication, though both sides continue near-daily long-range attacks.

Sources

For related coverage, see Tamara News on Tusk’s warning that Russia could stage “accidental” strikes to test NATO, the Russian State Duma election the attack coincided with, and Europe’s short-term Russia sanctions renewal.

Trump Wants an ‘AI Force.’ He Hasn’t Said Who’s Flying It.

President Trump used a Saturday Truth Social post to announce two things at once: a new “AI Force,” modeled on the Space Force he created in his first term, and plans to name an AI czar to oversee it. The Trump AI czar announcement came on September 19, with Trump adding that “only High I.Q. individuals need apply” for the role.

No name, timeline or budget accompanied the post. The announcement came days after AI researchers renewed public warnings that advanced systems could become difficult to control, a debate Trump has previously dismissed as overblown.

The post was short. The implications were not. A single paragraph on social media now sits at the center of a debate over how the US government will treat the fastest-moving technology of the decade.

The short version: Trump posted the plan on September 19. It creates an “AI Force” modeled on Space Force. An AI czar will lead it. Trump has not named anyone yet. Trump still calls AI fears a hoax. He says enforcement will target “BAD” actors.

What Trump Actually Announced

The post described an “AI Force” without detailing its legal authority, funding source or relationship to existing agencies that already touch AI policy, including the Commerce Department’s semiconductor export controls and the President’s Council of Advisors on Science and Technology. Trump said an AI czar would come “in the near future” to take point on the effort.

Trump cited no bill. No agency memo followed. Reporters asked for detail. The White House had little more to add. That silence is itself part of the story.

The Contradiction at the Center of the Announcement

Trump has repeatedly called fears about AI risk a “hoax,” a position he has held publicly for months. Yet this announcement followed renewed warnings from AI researchers about the technology moving faster than oversight can keep up with. Trump appeared to partially acknowledge this tension, saying his administration would go after “BAD” actors using existing criminal and civil justice tools rather than new AI-specific regulation.

Who Held This Role Before

Venture capitalist David Sacks previously served as Trump’s AI and cryptocurrency czar before stepping down in March 2026 after reaching the time limit allowed for a special government employee. Sacks now chairs the President’s Council of Advisors on Science and Technology, meaning any new AI czar would be working alongside, not replacing, an official already positioned at the center of the administration’s tech policy.

That overlap raises a practical question the announcement did not address: whether an AI czar reporting through a new AI Force structure would have authority over, alongside, or beneath the existing science and technology advisory council Sacks now leads.

How the Trump AI Czar Announcement Landed With Researchers

The timing struck many observers as notable. Researchers across multiple AI labs had spent the preceding week publicly renewing warnings about the pace of frontier AI development outstripping safety testing, a debate that has grown louder throughout 2026. Trump’s announcement arrived days later, framed not as a response to those warnings but as a parallel initiative focused on enforcement against bad actors rather than restrictions on model development itself.

That framing puts the administration’s position somewhere between the AI industry’s largest labs, several of which have called for more structured oversight, and skeptics in Congress who have resisted new AI-specific regulatory bodies. Where the proposed AI Force ultimately lands on that spectrum will depend heavily on who is named to lead it.

What We Still Don’t Know

The announcement left the most consequential questions open: what authority the AI Force would actually have, how it would be funded, whether it requires congressional action, and who Trump will name to lead it. Until those details arrive, the announcement functions more as a signal of intent than a concrete policy shift.

Congressional committees with jurisdiction over technology policy have not yet indicated whether they were consulted before the announcement or whether hearings on the proposal are planned.

The numbers at a glance: Announcement date: September 19. Platform used: Truth Social. Model cited: Space Force. Named leader: none yet. Previous AI czar: David Sacks. Sacks stepped down: March 2026.

What People Are Asking About the AI Force

What is Trump’s proposed “AI Force”?
A new body Trump says will be modeled on the Space Force to oversee artificial intelligence, announced without further structural detail.

When was the Trump AI czar announcement made?
September 19, 2026, via a post on Truth Social.

Who is expected to be named AI czar?
Trump has not named a candidate. He said an announcement would come “in the near future.”

Who held a similar role before?
David Sacks served as AI and cryptocurrency czar until March 2026, when he reached his time limit as a special government employee.

Does this mean new AI regulation is coming?
Not necessarily. Trump indicated the administration would pursue “BAD” AI actors through existing criminal and civil law rather than new AI-specific rules.

Recommended Reading

Sources

  • NBC News — Trump Says He’s Creating an AI Force and Appointing a Czar Amid Concerns Over the Rapidly Developing Tech. nbcnews.com
  • CNN — Trump Vows to Create ‘AI Force’ and Appoint Czar Amid Calls for Oversight. cnn.com
  • Al Jazeera — Trump Says He Will Create ‘AI Force’ With New ‘AI Czar’. aljazeera.com

Your Green Card Priority Date Could Freeze in the Next 10 Days

The State Department’s September 2026 Visa Bulletin held cutoff dates steady from August, but it came with a warning attached. Employment-based visa retrogression could hit several categories before the fiscal year closes on September 30. High demand is pushing some annual limits toward their ceiling.

The categories most exposed are EB-1 and EB-2 for applicants born in India, along with EB-5 Unreserved. India’s EB-2 category has already become unavailable at points this fiscal year after its prorated limit was reached, a preview of what could happen more broadly in the final days of September.

This is bureaucratic language for a simple fact. The line moved backward, or stopped. Applicants near the front felt it first. Those further back barely noticed. That gap is the whole story here.

The short version: The fiscal year ends September 30. EB-1 India, EB-2 and EB-5 Unreserved are at risk. September cutoff dates held steady from August. India’s EB-2 has already gone unavailable once. New numbers open October 1. Check your priority date now.

What Retrogression Actually Means

A visa category “retrogresses” when the government pulls its cutoff date backward because more people applied than there is annual visa capacity to cover. A category can also become “unavailable,” which pauses new visa issuance in that category entirely until the next fiscal year opens on October 1. Both outcomes leave applicants who were close to their priority date waiting longer than expected.

Why India’s Categories Are Under the Most Pressure

Demand for employment-based green cards from India has outpaced the per-country limits built into US immigration law for years, creating long-standing backlogs. Each fiscal year’s final weeks tend to be when the State Department has the least room to maneuver, since annual number limits are fixed and cannot be exceeded regardless of demand.

What the September Bulletin Actually Says

Cutoff dates across employment-based and family-based categories generally held steady from August to September 2026, with no forward movement but also no retrogression announced in the bulletin itself. The warning is about what could still happen in the final days of the fiscal year if demand continues at its current pace, not something that has already occurred bulletin-wide.

Read the fine print carefully. A steady bulletin is not a guarantee. It is a snapshot. Snapshots change fast in September. Ask your attorney before you assume anything.

The State Department publishes two sets of dates each month: a “final action” chart that governs when a visa can actually be issued, and a “dates for filing” chart that governs when an application can be submitted. Applicants sometimes confuse the two, and immigration attorneys note that a category remaining open on the filing chart does not guarantee the final action chart will not still tighten before September 30.

Why Employment-Based Visa Retrogression Keeps Recurring in September

This is not the first time the government has flagged year-end pressure on employment categories, and it is unlikely to be the last. Annual visa number limits are fixed by statute, while application volume fluctuates based on economic conditions, processing backlogs and employer sponsorship trends that shift from year to year. When those two lines cross late in a fiscal year, the State Department has only one lever available: slow down or pause issuance until the count resets on October 1.

What Applicants Can Do Now

Applicants with pending cases in the affected categories should confirm their priority dates are current before taking any action that depends on visa availability, such as scheduling a final interview or filing to adjust status. Immigration attorneys generally advise against assuming a category will remain available through September 30 in a year when the government has already flagged possible retrogression.

Employers sponsoring foreign workers in the affected categories should also build extra lead time into any planning tied to a specific priority date, since a category that retrogresses can take months to recover once the new fiscal year’s allocation opens.

The numbers at a glance: Fiscal year ends: September 30. Categories flagged: EB-1 India, EB-2, EB-5 Unreserved. September movement: none from August. New numbers open: October 1. Bulletin issued by: US State Department.

Visa Bulletin Questions, Answered

What does “unavailable” mean on the visa bulletin?
It means no more visas can be issued in that category until the new fiscal year begins on October 1.

Which categories are most at risk this year?
EB-1 India, EB-2, and EB-5 Unreserved, according to the State Department’s own guidance.

Did the September bulletin already show retrogression?
No. Cutoff dates held steady from August, but the department warned further movement could come before September 30.

Why does India face more pressure than other countries?
Per-country limits combined with high application volume from India have created backlogs that are worse than in most other countries.

When does the pressure typically ease?
At the start of the new fiscal year on October 1, when annual visa number limits reset.

More Context

Sources

  • Gibney — September 2026 Visa Bulletin Released. gibney.com
  • Murthy Law Firm — September 2026 Visa Bulletin. murthy.com
  • RJ Immigration Law — September 2026 Visa Bulletin: Key Updates, Trends & What to Expect. rjimmigrationlaw.com

A Bug Called Plugin4Shell Could Hand Your AI Coding Agent’s Keys to a Stranger

Security researchers disclosed a flaw this week that lets an attacker hijack a popular AI coding assistant without the user clicking anything at all. The Plugin4Shell vulnerability disclosed by researchers at the security startup Air affects four of the most widely used AI coding agents: Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI.

The bug breaks SHA pinning, the mechanism developers rely on to lock an installed plugin to a specific, reviewed version of its code. A malicious plugin update can swap in attacker-controlled code that runs automatically, without requiring the user to approve or reinstall anything.

The short version: Plugin4Shell needs zero clicks to work. It breaks SHA-pinning protections. The flaw affects four major coding agents. Anthropic and OpenAI patched Claude Code and Codex. Google will not fix Gemini CLI. Microsoft had no fix at disclosure.

How the Plugin4Shell Vulnerability Works

AI coding agents commonly support plugins that extend their functionality, similar to browser extensions. Developers typically pin a plugin to a specific version using its SHA hash, expecting that hash to guarantee the code cannot silently change. Plugin4Shell defeats that guarantee, letting an update slip through even when the pinned hash appears to match.

Researchers describe it as a first-of-its-kind AI supply-chain attack. Because these plugins often inherit the same permissions as the developer running the agent, a successful exploit can reach local source code, cloud credentials, SSH keys, internal repositories, production systems and other secrets.

No phishing email is needed here. No fake login page either. The plugin update itself is the attack. That is what makes it dangerous. Most security training does not cover this scenario at all.

Who’s Patched, Who Isn’t

Anthropic fixed the issue in Claude Code version 2.1.179. OpenAI patched Codex in version 0.146.0. Google is deprecating Gemini CLI and will not release a fix, instead advising users to migrate to its replacement, Antigravity. Microsoft had not issued a fix for GitHub Copilot at the time of disclosure, though GitHub noted that its platform separately blocks SHA-like branch and tag names, which limits one avenue of the attack.

Why This Matters Beyond Individual Developers

AI coding agents are increasingly embedded in company workflows, often running with broad access to internal systems to be useful. A vulnerability that requires zero clicks to exploit removes the human judgment that normally catches a suspicious download or unfamiliar prompt. Security teams are treating this less as a single bug and more as a warning about how much trust has been extended to AI coding tools without commensurate scrutiny of their plugin ecosystems.

Researchers at Air called it a first-of-its-kind AI supply-chain attack because it targets the trust relationship between a developer and their tools rather than a specific application. That distinction matters: traditional supply-chain attacks compromise a package or library, while this one compromises the update mechanism developers assumed was locking their plugins in place.

Why the Plugin4Shell Vulnerability Disclosed This Week Caught Vendors Off Guard

Four unrelated companies, each with its own security review process, shipped agents carrying the same underlying flaw. That suggests the SHA-pinning assumption Plugin4Shell defeats was treated as settled, trusted infrastructure across the industry rather than something any individual vendor had reason to re-examine. Researchers say this kind of shared blind spot is common in fast-moving software categories, where competitors converge on similar architectural patterns without cross-checking each other’s security assumptions.

What Developers Should Do Now

Anyone running Claude Code or Codex should confirm they are on the patched versions immediately. Gemini CLI users should plan a migration to Antigravity rather than waiting for a fix that Google has said will not come. Copilot users should watch for an official Microsoft patch and, in the meantime, review which plugins their agents have installed and what permissions those plugins carry.

Security teams managing multiple developers should also audit which AI coding tools are in use across their organization, since shadow adoption of these agents outside official IT channels makes a coordinated patch rollout harder to enforce.

The numbers at a glance: Tools affected: four. Clicks required to exploit: zero. Claude Code fix: version 2.1.179. Codex fix: version 0.146.0. Gemini CLI fix: none planned. Copilot fix: pending as of disclosure.

Plugin4Shell: Common Questions

What is Plugin4Shell?
A zero-click vulnerability that lets a malicious plugin update run attacker-controlled code inside AI coding agents by defeating SHA-pinning protections.

Which tools are affected?
Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI.

Has it been fixed?
Claude Code and Codex are patched. Gemini CLI will not receive a fix and is being deprecated. Copilot had no fix issued as of disclosure.

Does exploiting it require any user action?
No. That is what makes it a zero-click vulnerability — no click, approval or reinstall is needed.

What data is at risk?
Local source code, cloud credentials, SSH keys, internal repositories, production systems and other secrets the plugin’s host process can access.

Elsewhere on Tamara News

Sources

  • The Register — AI Coding Agents’ 0-Click RCE Flaw Could Hand Attackers Keys to the Kingdom. theregister.com
  • Help Net Security — Zero-Click RCE Vulnerability Hit Four Major AI Coding Agents, Two Remain Unpatched. helpnetsecurity.com
  • Air Security — Plugin4Shell: Zero-Click RCE Vulnerability Found in Top 4 Coding Agents. air.security