COTS is back on the menu If Congress actually cancels the SLS rocket, what happens next? Here's what NASA's exploration plans would actually look like if the White House got its way. Eric Berger – May 13, 2025 3:49 pm | 9 A technician works on the Orion spacecraft, atop the SLS rocket, in January 2022. Credit: NASA A technician works on the Orion spacecraft, atop the SLS rocket, in January 2022. Credit: NASA Story text Size Small Standard Large Width * Standard Wide Links Standard Orange * Subscribers only   Learn more The White House Office of Management and Budget dropped its "skinny" budget proposal for the federal government earlier this month, and the headline news for the US space program was the cancellation of three major programs: the Space Launch System rocket, Orion spacecraft, and Lunar Gateway. Opinions across the space community vary widely about the utility of these programs—one friend in the industry predicted a future without them to be so dire that Artemis III would be the last US human spaceflight of our lifetimes. But there can be no question that if such changes are made they would mark the most radical remaking of NASA in two decades. This report, based on interviews with multiple sources inside and out of the Trump administration, seeks to explain what the White House is trying to do with Moon and Mars exploration, what this means for NASA and US spaceflight, and whether it could succeed. Will it actually happen? The first question is whether these changes proposed by the White House will be accepted by the US Congress. Republican and Democratic lawmakers have backed Orion for two decades, the SLS rocket for 15 years, and the Gateway for 10 years. Will they finally give up programs that have been such a reliable source of good-paying jobs for so long? In general, the answer appears to be yes. We saw the outlines of a deal during the confirmation hearing for private astronaut Jared Isaacman to become the next NASA administrator in April. He was asked repeatedly whether he intended to use the SLS rocket and Orion for Artemis II (a lunar fly around) and Artemis III (lunar landing). Isaacman said he did. However nothing was said about using this (very costly) space hardware for Artemis IV and beyond. Congress did not ask, presumably because it knows the answer. And that answer, as we saw in the president's skinny budget, is that the rocket and spacecraft will be killed after Artemis III. This is a pragmatic time to do it, as canceling the programs after Artemis III saves NASA billions of dollars in upgrading the rocket for a singular purpose: assembling a Lunar Gateway of questionable use. But this will not be a normal budget process. The full budget request from the White House is unlikely to come out before June, and it will probably be bogged down in Congress. One of the few levers that Democrats in Congress presently have is the requirement of 60 Senators to pass appropriations bills. So compromise is necessary, and a final budget may very well not pass by the October 1 start of the next fiscal year. Then, should Congress not acquiesce to the budget request, there is the added threat of the White House Office of Management and Budget to use "impoundment" to withhold funding and implement its budget priorities. This process would very quickly get bogged down in the courts, and no one really knows how the Supreme Court would rule. Leadership alignment To date, the budget process for NASA has not been led by space policy officials. Rather, the White House Office of Management and Budget, and its leader, Russell Vought, have set priorities and funding. This has led to "budget driven" policy that has resulted in steep cuts to science that often don't make much sense (i.e. ending funding for the completed Nancy Grace Roman Space Telescope). However there soon will be some important voices to implement a more sound space policy and speak for NASA's priorities, rather than those of budget cutters. One of these is President Trump's nominee to lead NASA, Jared Isaacman. He is awaiting floor time in the US Senate for a final vote. That could happen during the next week or two, allowing Isaacman to become the space agency's administrator and begin to play an important role in decision-making. But Isaacman will need allies in the White House itself to carry out sweeping space policy changes. To that end, the report in Politico last week—which Ars has confirmed—that there will be a National Space Council established in the coming months is important. Led by Vice President JD Vance, the space council will provide a counterweight to Vought's budget-driven process. Thus, by this summer, there should be key leadership in place to set space policy that advances the country's exploration goals. But what are those goals? What happens to Artemis After the Artemis III mission the natural question is, what would come next if the SLS rocket and Orion spacecraft are canceled? The most likely answer is that NASA turns to an old but successful playbook: COTS. This stands for Commercial Orbital Transportation System and was created by NASA two decades ago to develop cargo transport systems (eventually this became SpaceX's Dragon and Northrop's Cygnus spacecraft) for the International Space Station. Since then NASA has adopted this same model for crew services as well as other commercial programs. Under the COTS model, NASA provides funding and guidance to private companies to develop their own spacecraft, rockets, and services, and then buys those at a "market" rate. The idea of a Lunar COTS program is not new. NASA employees explored the concept in a research paper a decade ago, finding that "a future (Lunar) COTS program has the great potential of enabling development of cost-effective, commercial capabilities and establishing a thriving cislunar economy which will lead the way to an economical and sustainable approach for future human missions to Mars." Sources indicate NASA would go to industry and seek an "end-to-end" solution for lunar missions. That is, an integrated plan to launch astronauts from Earth, land them on the Moon, and return them to Earth. One of the bidders would certainly be SpaceX, with its Starship vehicle already having been validated during the Artemis III mission. Crews could launch from Earth either in Dragon or Starship. Blue Origin is the other obvious bidder. The company might partner with Lockheed Martin to commercialize the Orion spacecraft or use the crew vehicle it is developing internally. Other companies could also participate. The point is that NASA would seek to buy astronaut transportation to the Moon, just as it already is doing with cargo and science experiments through the Commercial Lunar Payload Services program. The extent of an Artemis lunar surface presence would be determined by several factors, including the cost and safety of this transportation program and whether there are meaningful things for astronauts to do on the Moon. What about Mars? The skinny budget contained some intriguing language about Mars exploration: "By allocating over $7 billion for lunar exploration and introducing $1 billion in new investments for Mars-focused programs, the Budget ensures that America’s human space exploration efforts remain unparalleled, innovative, and efficient." This was, in fact, the only budget increase proposed by the Trump White House. So what does it mean? No one is saying for sure, but this funding would probably offer a starting point for a robust Mars COTS program. This would begin with cargo missions to Mars. But eventually it would expand to include crewed missions, thus fulfilling Trump's promise to land humans on the red planet. Is this a gift to Elon Musk? Critics will certainly cast it as such, and that is understandable. But the plan would be open to any interested companies, and there are several. Rocket Lab, for example, has already expressed its interest in sending cargo missions to Mars. Impulse Space, too, has said it is building a spacecraft to ferry cargo to Mars and land there. The Trump budget proposal also kills a key element of NASA's Mars exploration plans, the robotic Mars Sample Return mission to bring rocks and soil from the red planet to Earth in the 2030s. However, this program was already frozen by the Biden administration because of delays and cost overruns. Sources said the goal of this budget cut, rather than having a single $8 billion Mars Sample Return mission, is to create an ecosystem in which such missions are frequent. The benefit of opening a pathway to Mars with commercial companies is that it would allow for not just a single Mars Sample Return mission, but multiple efforts at a lower cost. "The fact is we want to land large things, including crew cabins, on the Moon and Mars and bring them back to Earth," one Republican space policy consultant said. "Instead of building a series of expensive bespoke robotic landers to do science, let's develop cost-effective reusable landers that can, with minimal changes, support both cargo and crew missions to the Moon and Mars." Eric Berger Senior Space Editor Eric Berger Senior Space Editor Eric Berger is the senior space editor at Ars Technica, covering everything from astronomy to private space to NASA policy, and author of two books: Liftoff, about the rise of SpaceX; and Reentry, on the development of the Falcon 9 rocket and Dragon. A certified meteorologist, Eric lives in Houston. 9 Comments

May 14, 2025Ravie LakshmananVulnerability / Endpoint Security Ivanti has released security updates to address two security flaws in Endpoint Manager Mobile (EPMM) software that have been chained in attacks to gain remote code execution. The vulnerabilities in question are listed below - CVE-2025-4427 (CVSS score: 5.3) - An authentication bypass in Ivanti Endpoint Manager Mobile allowing attackers to access protected resources without proper credentials CVE-2025-4428 (CVSS score: 7.2) - A remote code execution vulnerability in Ivanti Endpoint Manager Mobile allowing attackers to execute arbitrary code on the target system The flaws impact the following versions of the product - 11.12.0.4 and prior (Fixed in 11.12.0.5) 12.3.0.1 and prior (Fixed in 12.3.0.2) 12.4.0.1 and prior (Fixed in 12.4.0.2) 12.5.0.0 and prior (Fixed in 12.5.0.1) Ivanti, which credited CERT-EU for reporting the issues, said it's "aware of a very limited number of customers who have been exploited at the time of disclosure" and that the vulnerabilities are "associated with two open-source libraries integrated into EPMM." The company, however, did not disclose the names of the impacted libraries. It's also not known what other software applications relying on the two libraries could be affected. Furthermore, the company said it's still investigating the cases, and that it does not have reliable indicators of compromise associated with the malicious activity. "The risk to customers is significantly reduced if they already filter access to the API using either the built-in Portal ACLs functionality or an external web application firewall," Ivanti noted. "The issue only affects the on-prem EPMM product. It is not present in Ivanti Neurons for MDM, Ivanti's cloud-based unified endpoint management solution, Ivanti Sentry, or any other Ivanti products." Separately, Ivanti has also shipped patches to contain an authentication bypass flaw in on-premise versions of Neurons for ITSM (CVE-2025-22462, CVSS score: 9.8) that could allow a remote unauthenticated attacker to gain administrative access to the system. There is no evidence that the security defect has been exploited in the wild. With zero-days in Ivanti appliances becoming a lightning rod for threat actors in recent years, it's imperative that users move quickly to update their instances to the latest versions for optimal protection. Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post. SHARE    

May 14, 2025Ravie LakshmananEndpoint Security / Vulnerability Microsoft on Tuesday shipped fixes to address a total of 78 security flaws across its software lineup, including a set of five zero-days that have come under active exploitation in the wild. Of the 78 flaws resolved by the tech giant, 11 are rated Critical, 66 are rated Important, and one is rated Low in severity. Twenty-eight of these vulnerabilities lead to remote code execution, 21 of them are privilege escalation bugs, and 16 others are classified as information disclosure flaws. The updates are in addition to eight more security defects patched by the company in its Chromium-based Edge browser since the release of last month's Patch Tuesday update. The five vulnerabilities that have come under active exploitation in the wild are listed below - CVE-2025-30397 (CVSS score: 7.5) - Scripting Engine Memory Corruption Vulnerability CVE-2025-30400 (CVSS score: 7.8) - Microsoft Desktop Window Manager (DWM) Core Library Elevation of Privilege Vulnerability CVE-2025-32701 (CVSS score: 7.8) - Windows Common Log File System (CLFS) Driver Elevation of Privilege Vulnerability CVE-2025-32706 (CVSS score: 7.8) - Windows Common Log File System Driver Elevation of Privilege Vulnerability CVE-2025-32709 (CVSS score: 7.8) - Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability While the first three flaws have been credited to Microsoft's own threat intelligence team, Benoit Sevens of Google Threat Intelligence Group and the CrowdStrike Advanced Research Team have been acknowledged for the discovery of CVE-2025-32706. An anonymous researcher has been credited with reporting CVE-2025-32709. "Another zero-day vulnerability has been identified in the Microsoft Scripting Engine, a key component used by Internet Explorer and Internet Explorer mode in Microsoft Edge," Alex Vovk, CEO and co-founder of Action1, said about CVE-2025-30397. "Attackers can exploit the flaw via a malicious web page or script that causes the scripting engine to misinterpret object types, resulting in memory corruption and arbitrary code execution in the context of the current user. If the user has administrative privileges, attackers could gain full system control – enabling data theft, malware installation, and lateral movement across networks." CVE-2025-30400 is the third privilege escalation flaw in DWM Core Library to be weaponized in the wild since 2023. In May 2024, Microsoft issued patches for CVE-2024-30051, which Kaspersky said was used in attacks distributing QakBot (aka Qwaking Mantis) malware. "Since 2022, Patch Tuesday has addressed 26 elevation of privilege vulnerabilities in DWM," Satnam Narang, senior staff research engineer at Tenable, said in a statement shared with The Hacker News. "In fact, the April 2025 release included fixes for five DWM Core Library elevation of privilege vulnerabilities. Prior to CVE-2025-30400, only two DWM elevation of privilege bugs were exploited as zero days – CVE-2024-30051 in 2024 and CVE-2023-36033 in 2023." CVE-2025-32701 and CVE-2025-32706 are the seventh and eighth privilege escalation flaws to be discovered in the CLFS component and have been exploited in real-world attacks since 2022. Last month, Microsoft revealed that CVE-2025-29824 was exploited in limited attacks to target companies in the U.S., Venezuela, Spain, and Saudi Arabia. CVE-2025-29824 is also said to have been exploited as a zero-day by threat actors linked to the Play ransomware family as part of an attack targeting an unnamed organization in the U.S., Broadcom-owned Symantec revealed earlier this month. CVE-2025-32709, likewise, is the third privilege escalation flaw in the Ancillary Function Driver for WinSock component to have come under abuse within a span of a year, after CVE-2024-38193 and CVE-2025-21418. It's worth noting that the exploitation of CVE-2024-38193 has been attributed to the North Korea-linked Lazarus Group. The development has prompted the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to add all five vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, requiring federal agencies to apply the fixes by June 3, 2025. Microsoft's Patch Tuesday update also addresses a privilege escalation bug in Microsoft Defender for Endpoint for Linux (CVE-2025-26684, CVSS score: 6.7) that could permit an authorized attacker to elevate privileges locally. Stratascale researcher Rich Mirch, who is one of the two researchers, acknowledged for reporting the vulnerability, said the issue is rooted in a Python helper script that includes a function ("grab_java_version()") to determine the Java Runtime Environment (JRE) version. "The function determines the location of the Java binary on disk by checking the /proc/<PID>/exe symbolic link and then executes the java -version command," Mirch explained. "The problem is the Java binary could be running from an untrusted location. A malicious local unprivileged user can create a process with the name java or javaw, which will eventually be executed with root privileges to determine the version of the JRE." Another notable flaw is a spoofing vulnerability affecting Microsoft Defender for Identity (CVE-2025-26685, CVSS score: 6.5) that allows an attacker with LAN access to perform spoofing over an adjacent network. "The lateral movement path detection feature can itself potentially be exploited by an adversary to obtain an NTLM hash," Adam Barnett, lead software engineer at Rapid7, said in a statement. "The compromised credentials in this case would be those of the Directory Services account, and exploitation relies on achieving fallback from Kerberos to NTLM." The vulnerability with the maximum-severity is CVE-2025-29813 (CVSS score: 10.0), a privilege escalation flaw in Azure DevOps Server that allows an unauthorized attacker to elevate privileges over a network. Microsoft said the shortcoming has been already deployed in the cloud and there is no action required on the part of customers. Software Patches from Other Vendors In addition to Microsoft, security updates have also been released by other vendors over the past few weeks to rectify several vulnerabilities, including — Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post. SHARE    

Brace yourself, my fellow Android-appreciating amigos: By this time next week, we’re gonna be positively drowning in all things AI. All right — to be fair, we already are fairly suffocated by the scent of generative AI (genAI) these days. But with Google’s annual I/O developers’ conference kickin’ off this coming Tuesday, a whole new wave of over-the-top promises is about to hit hard. At this point, in fact, signs suggest the conference — which traditionally has featured Android and other associated areas as key parts of its keynote — will revolve mostly around Gemini and (a) breathless hype around feats the generative AI technology can theoretically achieve along with (b) demos of things the system can actually do but with ample factual errors and counterproductive inconsistencies (that conveniently won’t be mentioned as part of the conversation). For those of us still living in a land where accuracy matters — and if you’re using any of this stuff for professional purposes in particular, my goodness, I hope you’re among us — all this genAI gobbledygook should be interesting mostly just from a limited, carefully controlled perspective that doesn’t exactly jibe with how tech companies are fighting to framing it. The real meaningful progress here in the Android arena comes down to two key areas that have nothing to do with Gemini or any of the high-profile generative-AI ballyhoo we’ll be hearing about incessantly in the days ahead. If you’re relying on Android for your professional and/or personal life, these are the areas worth watching. [Get fresh Android insight in your inbox with my free Android Intelligence newsletter. Three new things to know and try each Friday!] 1. Stronger Android security It may not always be the sexiest subject around, but it’s hard to argue with the fact that Android security is one of the most important parts of the platform in front of us. And this year, amidst all the Gemini and genAI jibber-jabber, El Googeroo’s cookin’ up some significant improvements around Android security that’ll bring a big boost to our devices’ defenses. Now, for my standard caveat: Android security is far less scary than most headlines make it out to be. The operating system has long sported numerous layers of built-in protection, and the odds of encountering anything truly troubling in the real world are shockingly slim. (Consider: When’s the last time you or anyone you knew had a run-in with any of that nasty “Android malware” we’re always hearing about?) Generally speaking, you’ve really gotta go out of your way — and/or exhibit a complete lack of common sense — to see a serious problem. Even so, extra security can obviously only be a good thing, for business and casual use alike. And as we speak, Google’s sautéing up a slew o’ new security measures that’ll soon be sliding into our lives — including: A new Advanced Protection Mode that enables the most secure possible settings across the operating system itself as well as system-level apps and even third-party apps with a single simple switch An Android Intrusion Detection system that creates an encrypted, locally stored log of system actions and network activity and allows you to search it for potential weak points if you spot any signs of suspicious activity An elevated in-call scam detection option that seeks out signs of someone trying to trick you into sharing sensitive info (including banking access) and stops you before it’s too late A beefier on-device scam protection setup for sensing and warning you about all sorts of scams within messages, with privately and entirely local on-device processing Stronger protections around the factory reset and remote lock processes as well as one-time password access More extensive ongoing scans of already-installed apps to safeguard against any deceptive behavior A security-minded auto-restart system that automatically restarts a device — thus re-encrypting all of its data and requiring a password to unlock and get into anything — anytime it’s been inactive for three consecutive days And expanded access to an Identity Check option that requires biometric authentication to change any sensitive system security settings Some of these elements may be included in the upcoming Android 16 update, while others could show up separately via smaller subsequent rollouts. (Google sometimes even sends these sorts of improvements out through under-the-hood updates to Play-Store-housed Android system elements, which means they reach every device worldwide at the same time — without any reliance on notoriously unreliable device-makers to do the lifting. That happened just recently, in fact, with a new improvement that automatically revokes permissions for any apps that are deemed to be dangerous.) However and whenever they reach us, though, they’re all actively in the works and headed our way. And they’re all excellent illustrations of why, even outside of any more apparent surface-level considerations, Android system upgrades absolutely do matter and should always be a key consideration in any device-buying decision. 2. Smarter Android efficiency Aside from the important but not exactly visible under-the-hood enhancements, Google’s got a trio of truly tantalizing twists under development for Android — and they’re all things you’ll absolutely notice and almost certainly appreciate. First and most exciting for me, personally, is the advent of a platform-wide dock-style taskbar that could completely reimagine how we multitask and get around our devices. It’s seemingly the same concept introduced with the first Pixel Fold and Pixel Tablet and available in a limited capacity, in certain large-screen environments, already. If you’ve ever used a computer of any kind, it’ll immediately feel familiar. See for yourself: The Android taskbar, as seen on Google’s Pixel 9 Pro Fold phone.JR Raphael, IDG That’s it — the bar at the bottom of the screen. But mundane as it may seem, man alive, lemme tell ya: It makes a world of difference in your day-to-day Android experience. That bar, which in its current form can either be summoned on demand with a special swipe gesture or set to remain visible at all times, makes it as easy as can be to pull up any app, anytime — without having to first galumph back to your home screen and wade around to find it. You can hop instantly to any app you’ve got set as a favorite, swiftly switch to any app you’ve used recently, or access your entire app drawer on demand right then and there, even, with just one more tap. Maybe even more interesting yet is the way the taskbar puts Android’s long-out-of-sight and oft-forgotten screen-splitting system front and center for the first time in — well, ever. Just press and hold any icon in the taskbar and drag it up into the main screen area, and…poof: You’ve got both apps visible together. srcset="https://b2b-contenthub.com/wp-content/uploads/2024/09/google-pixel-9-pro-fold-taskbar.webp?quality=50&strip=all 600w, https://b2b-contenthub.com/wp-content/uploads/2024/09/google-pixel-9-pro-fold-taskbar.webp?resize=289%2C300&quality=50&strip=all 289w, https://b2b-contenthub.com/wp-content/uploads/2024/09/google-pixel-9-pro-fold-taskbar.webp?resize=162%2C168&quality=50&strip=all 162w, https://b2b-contenthub.com/wp-content/uploads/2024/09/google-pixel-9-pro-fold-taskbar.webp?resize=81%2C84&quality=50&strip=all 81w, https://b2b-contenthub.com/wp-content/uploads/2024/09/google-pixel-9-pro-fold-taskbar.webp?resize=463%2C480&quality=50&strip=all 463w, https://b2b-contenthub.com/wp-content/uploads/2024/09/google-pixel-9-pro-fold-taskbar.webp?resize=347%2C360&quality=50&strip=all 347w, https://b2b-contenthub.com/wp-content/uploads/2024/09/google-pixel-9-pro-fold-taskbar.webp?resize=241%2C250&quality=50&strip=all 241w" width="600" height="622" sizes="(max-width: 600px) 100vw, 600px">The Android taskbar lets you start a split screen simply by dragging an icon up.JR Raphael, IDG I’ve been begging Google to bring this same smart setup to all Android environments, regardless of their screen size, since we first saw the thing in action a couple years back. (You can technically force it to happen on any Android device, incidentally, but it requires some crafty configuring and awkward compromises.) Now, it looks like the company’s listening and we’ll likely see this one in front of us everywhere before long, even if the development hasn’t officially been announced just yet. If that isn’t enough, signs suggest Google’s also cookin’ up a new native Android Desktop Mode that’d let you plug a phone into an external monitor — with a keyboard and mouse connected — and use it like an actual computer. You’d see a fully functional desktop-style interface on the monitor while your phone remains in its standard usable state. It’s similar to systems certain Android device-makers are already offering, but as a native feature built into Android itself, it’d be more broadly available, standardized, and also actively (and consistently) developed and supported. Again, this one isn’t yet official, but it’s plainly being developed out in the open and where anyone can see it. Last but not least, a rather bold new design change is now officially comin’ our way — one that brings bulky elements, bright colors, and all sorts of wacky fonts into Android’s exterior. Like any interface evolution, it’s bound to be divisive. (To wit: I asked readers of my Android Intelligence newsletter what they thought about the look last Friday, following an early leak of the info. As of this writing, 17% say they hate it, 14% say they love it, and everyone else falls somewhere in the middle.) Google, for its part, is convinced the updated visuals will result in an easier-to-use, more efficient Android interface — with “time to tap on key actions decrease[d] by seconds” compared to the current approach. Only time will tell if that holds true for all of us, but combined with all the other incoming elements we just went over, it doesn’t seem like a stretch to say that the Android experience we know and love is on the brink of a near-total reinvention. And despite the all-consuming AI focus we’re certain to see at Google I/O next week, none of this has anything to do with Gemini. Want even more Googley knowledge? Join my Android Intelligence newsletter to get practical tips, personal recommendations, and plain-English perspective on the news that matters.

Display industry vet Ross Young shared information suggesting iPhone 18 Pro models are indeed going to get under-display Face ID, but selfie cameras will still be visible for now.The Dynamic Island could lose one of its cutouts with iPhone 18 ProUnder-display Face ID is one of those rumors that started the minute the technology arrived and has been repeated frequently, even recently. The dreaded notch followed by the compromise that was the Dynamic Island both exist as a result of Face ID needing screen space.According to former Display Supply Chain CEO, current VP of Counterpoint Research, Ross Young, Apple is set to put Face ID components under the display with iPhone 18 Pro in 2026. The information was shared via a social media post about a business conference. Rumor Score: 🤔 Possible Continue Reading on AppleInsider | Discuss on our Forums

Microsoft has issued fixes for a total of five new zero-day vulnerabilities out of a grand total of just over 70 addressable common vulnerabilities and exposures (CVEs) on the fifth Patch Tuesday of 2025 – over 80 when third-party issues are accounted for. In numerical order, this month’s zero days are as follows: CVE-2025-30400, an elevation of privilege (EoP) vulnerability in Microsoft DWM Core Library; CVE-2025-30397, a memory corruption leading to remote code execution (RCE) vulnerability in Scripting Engine; CVE-2025-32701, an EoP vulnerability in Windows Common Log File System Driver (CLFS); CVE-2025-32706, a second EoP flaw in CLFS; CVE-2025-32709, an EoP issue in Windows Ancillary Function Driver for WinSock (AFD.sys). All five of these CVEs are listed by Microsoft as being exploited in the wild, but have not yet been made public. They are all rated as being of Important severity, and all save the Scripting Engine flaw carry CVSS ratings of 7.8. Mike Walters, president and co-founder of patch management specialist Action1, said that the two CLFS issues stood out as particularly dangerous given its importance in computing – the CLFS is a critical component that providers logging services to user- and kernel-mode applications, and is widely used by various system services and third-party applications. “Attackers exploiting these vulnerabilities can escalate privileges to system level, granting them full control to run arbitrary code, install malware, modify data, or disable security protections,” said Walters. “With low complexity and minimal privileges needed, these flaws pose a serious risk, especially given the confirmed in-the-wild exploitation [and] while no public exploit code is currently available, the presence of active attacks suggests that targeted campaigns, potentially involving advanced persistent threats (APTs), are already underway. “Organisations should prioritise immediate assessment and remediation of these vulnerabilities to prevent potential compromise. Any organisation running Windows systems – across enterprise, government, education, or consumer sectors – could be exposed. Given Windows’ global footprint, millions of devices are likely at risk,” said Walters. CVE-2025-30400 in DWM Core Library should also be high on security admins’ patching lists, observed Kev Breen, senior director of threat research at Immersive. He explained: “If exploited, it would allow attackers to gain system-level permission on the affected host. With this level of privilege, attackers would be able to gain full control over the host, including any security tools and user accounts, potentially allowing for domain-level access to be compromised. “This CVE is marked as ‘Exploitation Detected’ by the Microsoft team, meaning patches should be applied immediately as threat groups, including ransomware affiliates, will be quick to leverage this once more details become public.” Breen added that once this happens, cyber teams and threat hunters should work quickly to review their systems for indicators of compromise (IoCs) to ensure that they haven’t been hit in the window between the point at which threat actors began at-scale exploitation, and the patch was released. Breen’s colleague, cyber threat intelligence researcher Ben Hopkins, ran the rule over the remaining exploited zero-days, CVE-20205-30397 in Scripting Engine and CVE-2025-32709 in AFD.sys “A scripting engine memory corruption vulnerability occurs when the Microsoft scripting engine mishandles objects in memory, in this case leading to an elevation of privilege being performed by an attacker,” he explained. “This specific vulnerability exists … involves access to a resource using (‘type confusion’) which allows attackers to execute code over a network. Type confusion in this context occurs when a program mistakenly treats a piece of data as a different type than it actually is, which leads to undefined and unpredictable behaviour, allowing the attacker to execute arbitrary code and elevate their privileges,” said Hopkins For the layperson, this means that having attained system-level privileges, a threat actor could easily access sensitive data and look for opportunities to pivot to other, more valuable parts of the victim’s network. Turning to the issue affecting AFD.sys, a core Windows kernel-mode driver that supports network socket operations by bridging from WinSock (Windows Sockets API) in user space, and lower-level network drivers in the kernel, Hopkins explained that an unauthorized attacker could exploit a condition in which memory that has been deallocated can still be accessed to inject controlled data into memory and influence how the program behaves, ultimately granting them the ability to elevate their privileges. In both cases, what this means is that having attained system-level privileges, a threat actor could easily access sensitive data and look for opportunities to pivot to other, more valuable parts of the victim’s network. Two additional zero-days have been publicly-disclosed today (13 May) but have not yet been reported as coming under attack at the time of writing. These are CVE-2025-26685, a spoofing vulnerability in Microsoft Defender for Identity, and CVE-2025-32702, an RCE vulnerability in Visual Studio. Both of these are rated of Important severity, carrying CVSS scores of 6.5 and 7.8 respectively. Finally, the May update brings a total of 11 critical flaws affecting Azure Automation, Azure DevOps, Azure Storage Resource, Microsoft Dataverse, Microsoft msagsfeedback.zurewebsites.net, Microsoft Office, Microsoft Power Apps, Microsoft Virtual Machine Bus and Remote Desktop Client (RDP). In their impact, these issues run the gamut from EoP to spoofing to information disclosure, and six of them lead to RCE, said Microsoft. Of the critical issues, Walters’ co-CEO and co-founder at Action1, Alex Vovk, told Computer Weekly that the two RDP flaws stood out in particular. These are tracked as CVE-2025-29966 and CVE-2025-29967. “Both vulnerabilities pose critical risks, including remote code execution, full system compromise, and data breaches,” remarked Vovk. “Given the broad adoption of remote desktop services, many organizations are potentially exposed. CVE-2025-29966 and CVE-2025-29967 underscore the urgent need to secure both client and server components in remote access environments.” Read more about Patch Tuesday April 2025: Microsoft is correcting 124 vulnerabilities in its March Patch Tuesday, one of which is being actively exploited in the wild, and 11 of which are ‘critical’. March 2025: The third Patch Tuesday of 2025 brought fixes for 57 flaws and a hefty number of zero-days. February 2025: Microsoft corrected 57 vulnerabilities, two of which are being actively exploited in the wild, and three of which are ‘critical’. January 2025: The largest Patch Tuesday of the 2020s so far brings fixes for more than 150 CVEs ranging widely in their scope and severity – including eight zero-day flaws. December 2024: Microsoft has fixed over 70 CVEs in its final Patch Tuesday update of the year, and defenders should prioritise a zero-day in the Common Log File System Driver, and another impactful flaw in the Lightweight Directory Access Protocol. November 2024: High-profile vulns in NTLM, Windows Task Scheduler, Active Directory Certificate Services and Microsoft Exchange Server should be prioritised from November’s Patch Tuesday update. October 2024: Stand-out vulnerabilities in Microsoft’s latest Patch Tuesday drop include problems in Microsoft Management Console and the Windows MSHTML Platform. September 2024: Four critical remote code execution bugs in Windows and three critical elevated privileges vulnerabilities will keep admins busy. August 2024: Microsoft patches six actively exploited zero-days among over 100 issues during its regular monthly update. July 2024: Microsoft has fixed almost 140 vulnerabilities in its latest monthly update, with a Hyper-V zero-day singled out for urgent attention. June 2024: An RCE vulnerability in a Microsoft messaging feature and a third-party flaw in a DNS authentication protocol are the most pressing issues to address in Microsoft’s latest Patch Tuesday update. May 2024: A critical SharePoint vulnerability warrants attention this month, but it is another flaw that seems to be linked to the infamous Qakbot malware that is drawing attention.

13 May, 2025 We asked a range of designers to share their most deeply-held design belief, and their responses ranged from designing feelings to embracing mistakes. Every designer has deeply held beliefs that shape the way they think, and the way they work. We asked a range of designers what is their absolute non-negotiable when it comes to their profession, and they provided an enjoyably eclectic set of answers. Pete Hawkins – “Print it out, mock it up” Design hills can be lonely places. And truthfully, I’ve made sacrifices, this is a service industry after all. But my “hill” is more of a range. At the summit is, ‘Unique, relevant ideas, executed with artistry.” It’s the guiding principle, the DNA of every project, shaped by everything I’ve learned from colleagues to role models who’ve inspired me. But let’s face it, that sentiment isn’t rare. So I’ll stake my flag a little lower. In the foundational foothills of composition, colour and typography lies the forgotten Mount Piomiu which stands for, “Print it out, mock it up.” A modest peak, often overlooked, but vital. And I’ll defend this one with conviction! Pete Hawkins is creative director of Chase Design Group. Leon-Anthony Smith – “Make it work, then make it shine” Most users just want to get something done. If someone can move from A to B without swearing, squinting, or solving a puzzle, that’s good design. The impact isn’t in big reveals or clever flourishes – it’s in the boring stuff actually working. Set the bar at clarity first. Respect people’s time, reduce noise, and make the path obvious. Then, if there’s room, add the charm. Stop designing for awards. Design for real people doing real things, that’s what actually impresses. Leon-Anthony Smith is head of design at Atomic. Brigid McMullen – “Walk away if the trust isn’t there” Powerful brand strategy is profound. Brand definition captured in a matter of words, not pages. No fluff. No filler. Distilled to its very core. Meaningful. Creatively loaded. When it lands, everything else flows. When it doesn’t, it’s literally just blah. And essential to any significant brand programme is client and designer’s genuine openness to ideas, challenges, & uncomfortable conversations. Brave organisations are open-minded with their agency. Their trust deserves care, so our job is to guide, not bulldoze. Transformation demands collective curiosity, cut-and-thrust debate, plus a willingness to be wrong in pursuit of what’s right. Great brand design isn’t born from ego or tunnel vision but intellectual rigour, honesty and the courage to walk away if trust isn’t there. Sacred cows? Off the table. Preconceptions? Questioned. Every. Time.Brigid McMullen is founder and managing director of The Workroom. Tassia Swulinska – ”Make mistakes and embrace the chaos” I like making mistakes on purpose. I’ve always believed that creativity needs space to be messy. Something designed within an inch of its life risks becoming sterile – overworked and lifeless. The approach may seem chaotic from a distance, but that chaos weaves together spontaneous connections and unexpected moments. You have to short-circuit the rational brain to tap into instinct. Design it, kill it, remix it, then place it in a random space to give it new meaning. Let it break and glitch, then refine it. I think there’s something vital in the mess. Creativity isn’t a clean process because we are not robots – it’s intuitive, looping, non-linear. Embrace the mistakes and trust that your gut and taste will get you to the sweet spot. That’s a beautiful, chaotic design hill I’d happily lay to rest on, and watch the flowers grow across my perfectly typeset gravestone. Tassia Swulinska is design director at DixonBaxi. Bobby Burrage – “Always strive for simplicity” “Get rid of everything that doesn’t need to be there.” I find myself saying this a lot as a creative director. This isn’t an indulgent pursuit of pretentious minimalism – it’s about revealing what truly matters: the idea. What’s the design hill I would die on? Fighting against decoration, embellishment and the all-too-common over-designing that weakens brand impact. As creatives, we’re tempted to include multiple thoughts, references and elements in our work. The real skill is knowing how much to leave in versus remove. Deciding on what’s important and what’s just noise is a battle. This requires confidence and conviction – there’s a fine line between a clever twist and a forced concept. In branding, clarity cuts through noise. The most powerful message is often the simplest one. Simple is complicated!Bobby Burrage is creative director of The Click. Sarah Fairhurst – “Design should make life better” As designers, we could and should pub-rant every design detail. Vertical type? Only runs from top to bottom. Drop shadows? Should be illegal. Faux neon? Incomparable to the real thing. For none of these would I “die on a design hill.” Deep down I’m motivated by the belief that design should make life better, on purpose. Be transformational and uplifting! We don’t need more vanilla-coloured so-so, or so-what. We all need design for a better, lighter life – be that easier, more colourful, engaging, simpler or smilier. Design is a powerful weapon, and I’m fighting for more smiles. Sarah Fairhurst is creative director at Dalziel & Pow. Richard Taylor – “Don’t get caught up in the craft” My first love affair with design was born from something that fell off the back of a car. I was 16, and the Porsche 911 Carrera badge had fallen off and landed on the road. It was the most beautiful curvaceous type I’d ever seen. That badge was Blu Tacked to my bedroom wall for years. Skip forward to today, and I use design as a tool to achieve a commercial objective; to bring brands closer to the people they serve and drive transformational growth. As an industry, we often get caught up in the craft and can lose sight of the idea. But ideas and design are like yin and yang. Form and function. They need to be good bedfellows to truly move people, to break us humans out of our ritualistic buying habits. Whilst my passion for beautifully crafted typography will never wane, design thinking is what motivates me. And it should you. Richard Taylor is founder and CEO of Brandon Consultants. Lucy McKenzie – “Aesthetics are felt, not seen” The design hill I’d die on is that aesthetics are felt, not seen. Design isn’t just visual – it’s sensorial. Form, shape, and colour don’t just communicate; they provoke, they influence how we interact with the world and feel. These elements can spark something deeper and more innate – they evoke the senses and emotional responses that live in our subconscious, bypassing what’s rational. Like David Lynch builds feeling before story, design should evoke something intrinsic to the human condition before igniting a meaning that is something deep and relatable within us that we can all connect to. Working on a haircare brand, we weren’t just designing for function — we were designing for feeling. A sensorial experience demonstrating how the product smelled, flowed from the bottle, and felt on the scalp and hand. This mattered just as much as how it performed. Ultimately, design is not just about what a product does or enables us to do or how it fits within the cultural zeitgeist, but how it makes you feel. The design I believe in goes beyond what is in vogue, to something visceral and human, to something that is memorable and lasting. Lucy McKenzie is associate director of forpeople. Lee Roberts – “Fight the good fight for the guest experience” Although it is imperative that design is efficient and functional, the absolute priority has to be the user experience. At Zebra, we work extensively in the hospitality sector and there is often pressure to compromise on customer space for the operational aspect of a facility. Sometimes this is unavoidable, however I will always fight for the guest to ensure their overall experience is not diminished. The customer journey, from order to seating should always be exemplary – we strive to never have a bad seat in the house! Lee Roberts is creative director at Zebra Projects. Industries in this article What to read next

If you want to play Android or iOS games with physical controls, the easiest and most portable way to do so is with a clamp-on phone controller. You could also buy a regular Bluetooth gamepad, though it won't stay attached to your handset unless you add a clunky clip. Or you could get both with the Backbone Pro, a $169.99 snap-on phone controller that's almost as compact as the Backbone One and has Bluetooth. The Backbone Pro performs well in both roles and feels better in the hand than its predecessor. However, it isn't quite as comfortable as the full-size Razer Kishi Ultra ($149.99), and it locks several useful companion app features behind a $39.99 yearly subscription. Still, it's a good compromise if you want a single gamepad you can easily use with your phone or PC.Design and Controls: Not Quite a Full-Size GamepadThe Backbone Pro is slightly chunkier than the Backbone One at 4.1 by 7 by 1.4 inches (HWD). It's still easy to slip it into a pocket, despite the plumper, rounded grips that are much more comfortable to hold. Weighing 7.02 ounces without its rubber inserts installed (more on those in a bit), the Backbone Pro feels a little hollow since it doesn't have haptic motors. Still, it doesn't feel remotely flimsy. The Backbone Pro is a well-built, comfortable gamepad. (Credit: Will Greenwald)The controls consist of a standard Xbox-style gamepad layout with offset dual analog sticks on either grip. There is also a plus-shaped direction pad below the left stick, A/B/X/Y face buttons above the right stick, and a pair of bumpers and analog trigger sets on the top. Small system buttons for Start/Select, Capture, and Backbone/Guide sit below the direction pad and right analog stick. The Backbone button lights up and doubles as a status indicator.The Backbone Pro's analog sticks are larger than the ones on the Backbone One and the same size as the sticks on an Xbox controller. They don't use Hall effect sensors like the magnetic triggers. Due to the controller's compact design, the triggers' pull distances are much shorter than the triggers on full-size gamepads. Likewise, the face buttons are noticeably smaller than full-size gamepad buttons, though slightly larger than Nintendo Switch Joy-Con face buttons. They're satisfyingly clicky, though.Like the Backbone One, the Backbone Pro has a USB-C port in the right grip and a headphone jack in the left grip. They serve the same power and audio pass-through functions. A new pairing button puts the controller into Bluetooth pairing mode. Since the Backbone Pro functions as a standalone wireless controller, the USB-C port also charges its internal battery, not just the phone it's attached to.(Credit: Will Greenwald)The Backbone Pro works with almost any phone with a USB-C port. That covers most Android phones and iPhone 15 (and later models). The older Backbone One has an iPhone-friendly Lightning version if you have an iPhone 14 or earlier handset. The Backbone Pro holds phones between approximately 3.4 and 7 inches long, so it can snap onto phablets like the Samsung Galaxy S25 Ultra. If you own an iPad mini or a small Android tablet, consider the larger Razer Kishi Ultra. Two pairs of included rubber adapters (one narrow, one wide) let you get a snug fit. They aren't designed for specific phone models, but they should accommodate your handset. To use the Backbone Pro with your phone, just pull it open and slip the phone between the jaws with the USB-C plug lined up with the phone's port. Your phone should automatically detect that it's connected to a Backbone controller and prompt you to download the Backbone app for configuration. At that point, the Backbone Pro functions as a controller for any game that supports it.Recommended by Our EditorsWirelessly connecting the Backbone Pro to a compatible device is easy. You press the pairing button and sync using a phone's standard process. It works with anything that supports a generic XInput Bluetooth gamepad, including PCs, phones, tablets, and many media streamers and TVs with games or game streaming apps. (Credit: Will Greenwald)If you wirelessly use the Backbone Pro with your phone, you can't access the Backbone app's features. As mentioned, the Backbone Pro lacks haptic motors, so the only rumble you'll experience will potentially come from your handset. According to Backbone, the Pro can function as a Bluetooth controller for up to 40 hours between charges.Software: Major Features Need a SubscriptionEven though the Pro's basic controls work without issue, you'll want to launch the Backbone app to update the firmware and add features. For example, the app lets you remap the controller inputs and take screenshots with the Capture button. Once it's all set up, the Backbone app opens whenever you insert your phone. You can also launch it by pressing the orange Backbone button.(Credit: Backbone/PCMag)Out of the box, those functions are where the Backbone app starts and ends, but you can expand the feature set with a Backbone+ membership ($39.99 per year). Backbone+ lets the app launch installed and streaming games, capture video at up to 1080p60 with cloud storage and Twitch streaming support, and use voice chat with other Backbone+ subscribers. iPhone users also get beta access to an in-app emulator for retro games.Most of Backbone+'s features should be available by default with the Backbone Pro and are unnecessarily gated behind a subscription. The emulator and voice chat are fun bonuses, but they are already well-supported on mobile devices with RetroArch and Discord, respectively. It just doesn't feel necessary. (Credit: Backbone/PCMag)Playing Games With the Backbone ProI had no problem controlling PC games with the Backbone Pro thanks to Steam's gamepad support. It also worked well with the Xbox app, albeit not quite as consistently. I had several hiccups with Claire Obscur: Expedition 33; it occasionally wouldn't respond to controller inputs, though restarting it fixed the problem. It seemed like an issue with the game rather than the Backbone Pro, because the controller worked reliably under all other circumstances.The full-size analog sticks were comfortable to use in testing, and they tracked movement consistently. Likewise, the buttons, bumpers, and triggers had just the right amount of resistance. Although the gamepad's face buttons are a bit small, I didn't accidentally press the wrong ones while playing. Moving and aiming with the analog sticks were similarly accurate, which resulted in exciting Monster Hunter Wilds and Palworld sessions. That said, the analog triggers' shallow pull required a bit more finesse than usual to accelerate and brake precisely in Forza Horizon 5.

Labubus have captivated the world under a spell of mischievous fantasy that is making the plush purse baubles a must-have collector’s toy. And if you’re a Jim Henson creature fan (think Labyrinth and Dark Crystal) or grew up on Where the Wild Things Are with a dash of Donnie Darko’s Frank the Bunny, you’ll find them hard to resist. Much like the lucky spirits of forest folklore that inspired them, Labubus are everywhere all at once and yet hard to find if you’re trying to buy one. Pop Mart, which distributes artist Kasing Lung’s beloved characters in vinyl and plush collectible form, releases drops that immediately sell out. Cutesy toy collectors are often having to turn to re-sellers at a steeper mark-up than the $20-30 the keychains usually go for, with prices often reaching hundreds of dollars for elusive variants. And while Pop Mart encourages fans to shop through official outlets, many fall for the trap of the Lafufus—faux Labubus, many of which are so cursed-looking, with eyes that fall out or bald peeled heads, they’ve garnered their own cult following as well.  “The Monsters,” as the series that spawned Labubu is called, continue to gain global recognition through popularity in the fantasy cottagecore realms of the internet. Labubu is the breakout species of the Monsters crew; the main character is also named Labubu and became the standout of the group thanks to the extreme ugly-cute quality that made her a viral sensation. Other characters in the Smurf-like tribe of Labubu include the rare pink Mokoko and the Labubu leader Zimomo (who has a tail), who also have a cult following of their own. Toy collectors love them, including celebrities like Blackpink’s Lisa (The White Lotus), What We Do in the Shadows‘ Harvey Guillén, and Madame Web’s Emma Roberts. io9’s conversation with Labubu figure creator Kasing Lung, conducted over email, delves into how Nordic supernatural folklore inspired the fuzzy elven creatures. Also—as fans ourselves, often awake at all hours of the night trying to nab an official Labubu on the Pop Mart app—we were excited to explore with Lung why he thinks the Monsters’ enchanting whimsy has taken over the world. Sabina Graves, io9: I’ve read that the creation of the Monsters was inspired by your time in the Netherlands when you were young. What about that experience inspired the Monsters story book idea, and how did that shift to making them into a physical art form? Kasing Lung: That’s right—Labubu was born from my fascination with Nordic mythology and European folklore, which I was surrounded by while growing up in the Netherlands. I’ve always been drawn to creatures that live in the space between fantasy and reality—figures that are both familiar and mysterious. I wanted to create a character that embodied that duality: mischievous yet endearing, strange yet deeply human. Labubu, like all the characters in the Monsters universe, has an emotional depth that makes her feel alive. When I partnered with Pop Mart, I was able to bring that imagination into the physical world—transforming Labubu from a storybook figure into something people could collect, connect with, and make their own. io9: What makes Pop Mart the ideal collaborator to share the Monsters with the world? Were you a part of collector culture growing up, and if so, what toys did you collect? Lung: Pop Mart’s design-forward philosophy makes them an ideal collaborator for any artist. They prioritize artistic integrity and allow creators like me the freedom to develop characters without compromise. That kind of trust is rare. It means every figure stays true to its roots—from concept to final collectible—and collectors can feel that authenticity in every piece. As for collecting, yes—I have always been interested in that world. I was drawn to toys that sparked imagination, whether it was action figures, miniature creatures, or things with unexpected personality. I think that fascination with small, expressive objects has stayed with me. The Monsters are really just a grown-up extension of that childlike wonder. [TK unboxing IG reel link] io9: I’d love to get your perspective on seeing your creations begin to appear in so many places on a global scale, even on fashion and music icons like Lisa. What do you think about the current fashion craze that the Monsters are a part of? Lung: Seeing Labubu embraced by fans worldwide, from dedicated collectors to global icons, is surreal and incredibly humbling. When I first started sketching Labubu, I wasn’t thinking about fame or fashion trends. I was just following a feeling, creating something that felt true to me. So to now see people lining up for drops, customizing their collections, and making Labubu part of their daily lives—it’s overwhelming in the best way. What’s happening in fashion feels like a natural evolution. Today, people want to wear their personalities, to show the world who they are through what they carry, collect, and wear. Labubu speaks to that desire for something playful, expressive, and a little bit rebellious. The fact that the Monsters are becoming part of that cultural language means the world to me. It pushes me to keep expanding the universe, to keep creating characters that surprise people and give them something they can connect with—emotionally and personally. io9: What are your plans to continue to expand the stories for the Monsters characters alongside the figures release? Are there any collaborations and projects related to them coming up that you can share that will open up their story to more fans around the world? Lung: Right now, I’m letting the Monsters story evolve naturally. These characters are always growing in my mind, and every new figure is a chance to explore a different side of their world. I never want to force their direction—it’s more about following the emotion behind them and letting that guide the creative process. In terms of collaborations, there are definitely exciting projects in the works. Most recently, we collaborated with One Piece for the Monsters × One Piece Series Figures. While I can’t reveal too much just yet, I’m always looking for opportunities to expand the Monsters into new mediums and formats, so fans can experience them in deeper and more immersive ways. © Pop Mart © Pop Mart © Pop Mart © Pop Mart © Pop Mart © Pop Mart © © Pop Mart © Pop Mart © Pop Mart © Pop Mart © Pop Mart © Pop Mart © Pop Mart © Pop Mart © Pop Mart © Pop Mart © Pop Mart © Pop Mart © Pop Mart © Pop Mart To see Pop Mart’s selection of the Monsters’ blind box offerings and collaborations, visit the retailer’s official site. Want more io9 news? Check out when to expect the latest Marvel, Star Wars, and Star Trek releases, what’s next for the DC Universe on film and TV, and everything you need to know about the future of Doctor Who.