Ukrainian drones kill 2 in Russia as Moscow hits main port hub in Black Sea

KYIV, Ukraine (AP) — Civilians were killed and injured overnight as Russia and Ukraine continued to attack each other with waves of drones.

Two people were killed in Russia’s Tatarstan, according to local officials, while Ukrainian authorities reported Russian drone attacks on the Black Sea port of Odesa and a fire near a border crossing with Poland.

Russia has ramped up its air campaign in recent weeks, using ballistic missiles and jet-powered drones to pierce Ukraine's defenses and capitalize on Kyiv’s dwindling stock of missile interceptors. Moscow’s attacks have targeted Ukraine’s power grid ahead of winter in what officials say is meant to demoralize civilians.

Two people were killed and 12 more injured on Sunday as Ukrainian drones struck Nizhnekamsk, a city in Tatarstan, according to the office of regional head Rustam Minnikhanov. The two civilians died after a drone slammed into a tree near their parked car, the statement staid.

Nizhnekamsk houses a key cluster of oil refineries and petrochemical, rubber and polymer plants, including some of Russia's largest facilities of their kind. Mayor Radmir Belyaev said that a fire had broken out “at one of the city’s enterprises,” without giving detail.

Ukraine’s recent long-range strikes have targeted Russia’s oil and gas industry, which Kyiv says both funds and directly fuels its war on Ukraine. The Ukrainian drone campaign has caused fuel rationing across Russia, despite the country being a key oil and gas exporter. Other Ukrainian strikes targeted major Russian online retailers, bringing the war ever closer to the public.

Ukraine also claimed on Sunday to have hit a major oil refinery in Slavyansk-on-Kuban, in Russia’s Krasnodar region, across from Crimea. The Defense Intelligence of Ukraine (DIU) agency said its drones struck a key oil processing unit and the refinery’s tank farm overnight, sparking a massive blaze visible from dozens of kilometers (miles) away.

Krasnodar authorities said the strike on “an enterprise” in Slavyansk-on-Kuban injured three people, damaged an oil pipeline and started a blaze. They did not directly respond to the Ukrainian claims.

Russian forces shot down 389 Ukrainian drones during the night, Russia’s defense ministry said Sunday, including over Tatarstan, other Russian regions, and Russian-occupied Crimea.

At least nine people were injured in a “massive” Russian nighttime attack on Odesa, according to Serhii Lysak, who heads the city's military administration. The city is home to Ukraine's main port hub on the Black Sea and has for months faced sustained drone and missile strikes, with Kyiv accusing Moscow of trying to choke off its exports.

A Russian drone attack on Saturday struck a residential high-rise in Odesa, killing two people and injuring 26 others, Ukrainian officials said. The building's upper floors were completely destroyed, according to regional head Oleh Kiper.

Russian strikes also pounded western Ukraine throughout the night, though there were no immediate reports of casualties. One drone struck near the Yahodyn-Dorohusk border crossing with Poland, setting fire to a petrol station, according to Ukraine's top diplomat and a spokesperson for the local customs force.

In this photo provided by the Ukrainian Emergency Service, a residential building is seen in fire following a Russian air attack in Odesa, Ukraine, Saturday, Sept. 12, 2026. (Ukrainian Emergency Service via AP)

A woman walks by the burning warehouse at the city entrance following Russian air attack in Odesa, Ukraine, Sunday, Sept. 13, 2026. (AP Photo/Michael Shtekel)

Firefighters put out a fire at warehouse stores after a Russian air attack in Odesa, Ukraine, Sunday, Sept. 13, 2026. (AP Photo/Michael Shtekel)

Firefighters put out a fire at warehouse stores after a Russian air attack in Odesa, Ukraine, Sunday, Sept. 13, 2026. (AP Photo/Michael Shtekel)

ATLANTA (AP) — Security researchers say rapid advances in artificial intelligence are making it more critical to address a flaw in Georgia's voting equipment that can allow voters to be matched to their ballots after they have been cast.

The system's vulnerability has been drawing increased attention, with election security advocates criticizing state election officials for failing to fix it before the November elections. Georgia election officials say they have taken steps to address the potential harm, but some advocates say the state is not going far enough.

The vulnerability does not allow votes to be changed or cast doubt on election results, but it could let someone see how others voted. That is important because ballot secrecy is a fundamental right under the state constitution and violations could create an opening for legal challenges.

While the flaw has been known for a few years, the widespread adoption of AI tools and the blistering pace of its sophistication have election security experts raising alarms.

This is "a bit of a wake-up call because it illustrates how much more easily vulnerabilities can be exploited now that AI can do all of the technical work for you,” said J. Alex Halderman, a voting technology specialist at the University of Michigan who was part of the team that exposed the flaw.

Other jurisdictions across the country use the same voting equipment made by Dominion Voting Systems, a company that has since been sold and renamed Liberty Vote. But many have applied a software update to fix the flaw, and some other states do not allow the public release of records that are needed to exploit it, said Mark Lindeman, policy and strategy director at Verified Voting, a nonpartisan group focused on election technology.

Georgia, a presidential battleground with one of the nation's most closely watched U.S. Senate races this year, is the only place where the system is used statewide. Lindeman said that, combined with an open records law that has allowed access to key documents, creates a “perfect storm."

"It’s really embarrassing that this is still a possibility,” Lindeman said.

Georgia voters make their selections on touchscreen voting machines that print paper ballots voters insert into scanners to tally the votes.

Such cast-vote records detail the votes from each ballot. Those records and electronic ballot images created by the scanners are randomized. But the software flaw allows them to be put back in the order they were cast, according to a report by researchers who discovered it in 2022.

Along with other publicly available data, that information could be used to match voters to their ballots, the researchers wrote.

Max Springer, a Princeton University researcher who was not involved in the original research and studies AI, said he gave a publicly available AI assistant that research. He said it was able to reverse the shuffling of electronic ballot records from Georgia's May primary and then tell him what other records it would need to match names to ballots.

He then gave the AI assistant the early voting list for the counties he examined and the cast-vote record file, which could be obtained through a public records request. It was able to create “buckets of ballots and potential voters,” he wrote in a blog post. In many instances, that made it possible to match voters to their ballots.

In cases where ambiguity remained, he wrote, he got the public audit log for the ballot scanners and precinct check-in records and was able to match most ballots to specific voters.

“AI coding tools are essentially supercharging laymen people to exploit vulnerabilities,” Springer said in an interview.

Georgia's Constitution says elections “shall be by secret ballot” and state law requires voting machines to “permit voting in absolute secrecy so that no person can see or know any other elector’s votes.”

A lack of ballot secrecy can make it easier to buy or sell votes and increase the danger of coercion to vote a certain way by family members, political organizations, employers or government officials. It also is information that could be invaluable to political campaigns.

Gabriel Sterling, special projects manager in the secretary of state’s office, pushed back on the concerns. He said it would be easier to use mail ballots if vote-buying or coercion was the goal and that it likely would be cheaper for campaigns to just increase outreach to voters who fit a certain profile than try to identify voters this way.

State Election Board member Salleigh Grubbs proposed a rule during the board’s August meeting that would have required the secretary of state’s office to apply the software update recommended by the manufacturer by Tuesday.

“Each (voter) has one vote, and no one is entitled to know how it was cast,” Grubbs said. “That privacy protects more than the individual voter. It protects the integrity of the entire election.”

In a letter to the election board, an agency lawyer argued that the update has not been certified by the secretary of state, the implementation would take months and the legislature has not provided necessary funding. The board rejected Grubbs' proposal. Some members said they did not believe they had the authority to order the secretary of state to act and they raised concerns about the short timeline before the November midterms.

Board member Sara Tindall Ghazal, who voted against the proposal, said it is “intensely frustrating” that the software update has not been applied. But she pointed out that it is a felony to reveal how someone voted, which should serve as a deterrent.

“I hate the fact that it’s even physically possible, but there are very, very severe penalties if somebody were to actually do this,” she said.

The secretary of state's office sent guidance to county election officials instructing them to refer open records requests for certain records to the secretary of state's office. It will release them with the problematic information blacked out and decline to release other information and documents.

Sterling said the office is working with a vendor to scramble the original order of ballot images and cast-vote records before they are made public. Halderman said that precaution would be necessary to keep someone from reconstructing the order.

While some other jurisdictions have applied the software update that reportedly fixes the problem, some have done what Georgia is now trying to do by restricting public access to the records needed to exploit the flaw.

Marilyn Marks is executive director of the Coalition for Good Governance, which advocates for election transparency and security and raised the alarm about the vulnerability. She argued that withholding documents is not the solution and that steps need to be taken to ensure ballots cannot be traced to voters in the first place.

“When Georgia’s election records contain identifiers that can be used to trace ballots to voters, the only legal and acceptable answer is to stop recording that information — not restrict public access to sensitive unlawful information to insiders and commercial vendors,” she said.

With time growing short before the elections, Marks said a workable interim solution would be to collect ballots in locked boxes at precincts and then shuffle and scan them at a central tabulating center.

FILE - An election worker walks near voting machines at the Fulton County Election Hub and Operation Center, Nov. 5, 2024, in Atlanta. (AP Photo/John Bazemore, File)

FILE - Voting machines fill the floor for early voting at State Farm Arena, Oct. 12, 2020, in Atlanta. (AP Photo/Brynn Anderson, File)