Microsoft has issued an out-of-band update for its recent Windows 11 patch, which has caused a number of bugs and issues. The September 2026 update was just released last Tuesday, and although it packs a number of new features and fixes nearly 1000 security flaws (commonplace in this day and age), there are also a few unfortunate regressions.
The 25H2 update finally reintroduces a movable taskbar, just like we've had since Windows 95, with an option to make the height smaller for compact displays. Likewise, the Start menu now has multiple configurable layouts, and you can toggle each main section on or off. Microsoft also revamped Windows Search — perhaps to finally be useful — and users can now choose to only have it display local results. Explorer got a handy tweak in the form of using KB, MB, GB size indicators, as well.
The update has also surfaced some serious bugs. First off, PCs with AMD Radeon GPUs are crashing, apparently due to the update provoking driver instability. Reinstalling the driver doesn't appear to help, and the reports unfortunately cover most contemporary AMD graphics cards. Microsoft did not mention AMD GPUs specifically in its latest update.
Microsoft noted that it has fixed an issue with Remote Desktop Services where RDS might become unstable, causing connection and sign-in failures.
Microsoft is also aware of an issue with audio output and microphone input going dead. Additionally, there are seemingly reports of audio devices starting up with a botched configuration, like tweaked 3D audio settings or speaker setups. The apparent workaround seems to be putting audio in a standard 2.0 configuration, but Microsoft has now addressed this issue in the emergency patch.
Explorer may display a black screen after logging in, leaving you with a perfectly functioning operating system but no visible UI. The File History backup feature is reportedly not detecting external drives, effectively making it useless. Of particular concern to enterprises, systems administrators, and homelabs, the Remote Desktop Service is also experiencing issues. Last but not least, Microsoft says it has addressed an issue where Claude Cowork is nonfunctional due to the update breaking HC-managed Linux VMs with Plan9 shared folders
Owners of HP and Lenovo systems are also advised to consider holding off on this update. Ever since the August 2026 patch (and now, cumulatively, with the September update), there are reportedly serious issues on both camps. On the HP side, there are instances of the update triggering BIOS corruption, leading to a failed install with no ability to recover the OS — though seemingly the OEM has published a new BIOS revision, so it's hard to say which side is to blame. Meanwhile, Lenovo users might have their machines black-screen or shut down out of the blue, seemingly due to power mismanagement.
While it's heartening to see that Microsoft has significantly increased its Windows development speed and is seemingly listening to customer feedback, a string of bugs after a major feature update are still common.
The colorful CEO of Automattic, which controls WordPress, was forced out last Thursday by his board of directors, which put him on a leave of absence. He used his system access to remove the accounts of the acting CEO and others — an action that could get most employees fired. Instead, he was fully reinstated to CEO a couple of days later.
It’s not hard to compare this to the saga at OpenAI almost three years ago when an eerily similar series of events happened. The board fired the CEO for having repeatedly lied to it. Within a few days, the board reversed itself.
A weaker historical comparison is with Steve Jobs, who was ousted from his Apple CEO role, only to later return. But Jobs at least had the decency to wait a few years while he created and ran NeXT.
To be fair, boards have often been criticized for being puppets of the CEO, who often have a lot to say about who serves on the board. But that criticism doesn’t hold for the first OpenAI board nor for the initial Automattic board.
Some years ago, I was involved with a VC-funded startup, and we were at the stage of forming a board of directors. I was talking with the person who was to be the board chair and he needed candidates for board secretary, which is typically an attorney. That role is supposed to be a lawyer who cares about the board, as opposed to the company’s general counsel, who reports into the CEO and only cares about the company.
The chair said that we need someone who is trustworthy. I had the perfect candidate in mind, until I probed deeper and found that there is a vast chasm between “trustworthy” and “someone we can trust.”
I envisioned someone who was honest and had integrity, someone who would take their duties seriously and would tell the board the truth regardless of the implications. That turned out to be precisely what the chair did not want.
He wanted someone who would vote with us regardless of their legal opinion. He didn’t actually want trustworthy. He wanted blind unconditional loyalty. (That business, thank goodness, never ended up launching.)
But that seems to be what CEOs now want, which undermines the entire point of having an independent board. Other than deciding whether to accept an acquisition offer, the most important decision of any tech board is the hiring — and firing — of the CEO.
What does it say when a board makes that decision for what it seems to be a legitimate business reason — and then reverses itself within a couple of days?
In the case of Automattic, it is not a good look. The board said absolutely nothing about why it forced the CEO out, which made its reversal over the weekend even more perplexing.
When Automattic emailed reporters on Thursday to announce that the CEO had been ousted, the messages were cryptic: “Matt Mullenweg is currently on leave from Automattic. Mark Davies, Automattic’s CFO, will lead the company as interim CEO. The Board has full confidence in Mark’s leadership and in the team’s ability to execute against the company’s priorities.”
The next we heard was an equally cryptic message sent Saturday afternoon: “Matt Mullenweg is the chairman and CEO of Automattic, with full support of the board, and if you search online you can see many top executives and Automatticians supporting him as well.”
Huh? We then asked for clarification of what happened and why. At 2:26 AM Eastern on Sunday, the media team emailed: “Matt and Automattic’s leadership team have great respect for everyone involved. While we can’t comment on specific individuals, we’re thankful for their contributions to Automattic and its mission, and we remain excited about what’s ahead with Matt at the helm. Matt was away for only 33 hours and 20 minutes — we’re now back to work.”
My proposal: A board’s decision to hire or terminate a CEO should be defended with public specifics. And so should a hiring decision. Or, in this case, a reversal of a mandatory leave of absence decision.
If the board is going to take the extreme step of relieving the CEO, it should be required to say why. In some situations, it may need to be vague (as in “personnel situation involving a substantiated sexual assault”), but the board needs to give some kind of reason. That should happen so at the very least, a reversal is also explained.
Further reading:
Yet another security vulnerability has been discovered in GitLab infrastructure, this one a perfect 10 in severity.
CVE-2026-85706, the second flaw GitLab has disclosed in just a month, is a maximum-severity vulnerability that allows attackers to read arbitrary files in a single HTTP request. The path traversal flaw results from improper confinement and lack of authentication enforcement in GitLab’s repository commits API, the company reported.
Threat actors could exploit it “under certain conditions” and read arbitrary files (credentials, secrets, and other sensitive data) on vulnerable GitLab servers.
The company has fixed the vulnerability, which impacts GitLab Community Edition (CE) and Enterprise Edition (EE), and has advised customers with public-facing self-hosted GitLab instances to patch their servers immediately, or remove public access.
Experts say the flaw is alarming because GitLab’s DevSecOps platform is used by roughly 50% of the Fortune 100 and has more than 50 million estimated registered users.
“GitLab is not simply a source-code repository,” noted Safayat Moahamad, advisory director at Info-Tech Research Group. In many enterprises, it is connected to build pipelines, deployment processes, application security workflows, and other trusted systems.
As a result, unauthorized access to configuration files, secrets, or credentials on the GitLab server could “create consequences well beyond the affected instance,” he said.
GitLab has been a favorite hacker target of late: In January, it patched a high-severity flaw that allowed attackers possessing a target’s account ID to bypass two-factor authentication, and in August, it fixed a critical vulnerability that could give unauthenticated users the ability to make modifications inside code repositories or even completely delete them with a single HTTP request.
The current maximum severity bug, CVE-2026-85706, was reported through GitLab’s HackerOne bug bounty program. It affected CE and EE versions 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2.
The US Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-85706 to its Known Exploited Vulnerabilities catalog, noting that this type of vulnerability is a frequent attack vector for malicious cyber actors, and particularly poses significant risks to the federal enterprise; watchTowr Intel has reported that it is already observing “in-the-wild probes.” “Based on recent GitLab vulnerabilities, we know the time until indiscriminate exploitation is likely not far away,” it warned.
This is not a vulnerability that organizations should leave for the normal patch cycle, Moahamad emphasized. “It offers an unauthenticated path to arbitrary files on a platform that frequently sits at the center of source code, build, and deployment workflows,” he said.
Enterprises should patch immediately, hunt for suspicious repository-commits API activity, and investigate whether exposed files contained credentials or secrets that may now require rotation, he advised.
Beyond patching, the watchTowr Intel team said defenders should try to identify exploitation attempts by hunting through log files for HTTP POST requests to “/api/v4/projects/{id}/repository/commits/” URIs containing “file.path” parameters.
Organizations running affected self-managed GitLab CE or EE instances should be most concerned, Moahamad noted. Risk increases where GitLab is connected to sensitive repositories, CI/CD pipelines, cloud environments, or production-deployment processes.
The information and/or access that attackers could obtain depends on what the GitLab service can read and what organizations store on the server, he explained. It could include configuration files, secrets, credentials, and other sensitive server-side data. If those files happen to contain usable tokens, keys, or credentials, an attacker could attempt to access connected infrastructure
“The flaw directly creates an unauthorized file access risk,” he said. Credential theft, lateral movement, source code exposure, and supply chain compromise are possible follow-on scenarios.
Source code and CI/CD platforms must be governed as “critical trust infrastructure,” he said. While patching remains essential, resilience will depend on knowing where platforms can be exposed, limiting what they can access, detecting abnormal API behavior, and having a tested process for investigating and rotating credentials.
David Shipley of Beauceron Security described two factors colliding to generate “maximum pain” for GitLab users.
First is the vulnerability. “It’s a 10 for a reason: Unauthenticated read access to GitLab client source code,” he said.
Second, this especially hurts because developers still have bad habits: way too much code continues to ship or is in production with embedded SSH keys, cloud secrets, tokens, and other valuable data that attackers can use to get into infrastructure, Shipley said.
“So for attackers, you’ve got the classics,” he noted: Data exfiltration and extortion, ransomware, cloud infrastructure hijacking for crypto mining, and the stealing of AI tokens and infrastructure to enable other criminal activity.
“This level of vulnerability is the code and cloud equivalent of being able to get the credit card number, expiry and security number,” Shipley said. “It opens up a world of criminal data shopping.”
The bottom line: “Get those secrets out of production code and adopt modern coding authentication best practices,” he advised.
This article originally appeared on CSOonline.
While we wait to see if Apple really is experiencing huge demand for its newly introduced iPhones, today’s the day every iPhone user gets a completely new device experience, with iOS 27 rolling out internationally, along with the other members of Apple’s 27 series OS family. If you’re on the fence about installing the new release, here are 12 reasons you should upgrade today.
Apple seems to have worked hard to improve speed and performance in this release. Everything feels much zippier, but where it seems most noticeable is when launching apps. Apple says these now open up to 30% faster, while AirDrop transfers are almost twice as fast as before.
With the 20th anniversary glass iPhone waiting in the wings, Apple isn’t going to get rid of Liquid Glass. But the company is prepared to iterate the look, and iterate it has, with sharper icons, improved contrast, and a new slider control that lets you set the UI’s transparency.
iPhone Handoff lets you use one eSIM across two devices on supporting carriers. Once set up it’s remarkably easy to use — your SIM activates the moment you unlock one of your iPhones. Better still, if you use two lines on one device, you’ll find these both transfer across too.
We’ve been talking so much about Apple’s improved Siri that I demoted it to fourth place; that’s not a reflection on what it does, but on how often you’ll have seen how it has become so much better at understanding context. It now has a Chat GPT-like interface, a standalone app, and powerful on-screen awareness to help get things done. Sadly, many of these features aren’t available in the EU.
AI is everywhere, including in Reminders Smart Suggestions, which can read your Messages chats and prompt you to set reminders for agreed tasks. Notes also gains Markdown copying.
You can now create a shortcut just by describing what actions you want it to take. Apple Intelligence will string a shortcut together for you, which you can then use across all your systems.
Safari can watch a web page and automatically let you know when it changes. That’s not the only improvement; Apple Intelligence automatically groups your open tabs into topics so related pages are easier to find.
I feel like this feature hasn’t had the attention it deserved, but you can now get Apple Intelligence to build you extensions in Safari. Just tap the three-line menu on the left of the address bar, choose Describe Extension, and let the fun begin.
Spatial Reframing is amazing; it lets you extend backgrounds and reframe subjects using AI. The upgraded Clean Up tool removes distractions even more easily than before.
Apple’s Passwords app now does an even better job of keeping your online world safe, as it can now automatically visit a website to sign in and swap a weak or compromised password for a stronger one.
Apple has really thought about child protection. Parental controls have had a huge overhaul, including the introduction of new Ask to Browse, Ask to Buy, contact calling approval and settings to protect minors against nudity, gore, and violence. These arrive alongside new scheduling function which manages which apps kids can use during school hours, meals, or bedtime.
Maps now uses aerial imagery and vision intelligence models when you use Flyover. It makes for much more detail, and a real sense of immersion.
While you’ll have to wait for search indexing to complete, Mail has become faster to load with better search results and more accurate unread counts. (Though that’s a little moot for this writer, who currently has 4,719 unread emails.) Spotlight has also been improved with smarter, more relevant suggestions.
The new operating systems are expected to be made available at around 10am PDT. One more thing? They are bound to include security updates, which you likely need.
Please subscribe to my daily, human-curated Apple-related news headline feed at The Core, or follow me on Bluesky, LinkedIn, or Mastodon.
Microsoft’s September 2026 Patch Tuesday is the year’s largest release, with 963 CVEs requiring customer action, 106 rated critical. Two are already exploited: CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in Advanced Local Procedure Call. Nothing in this release was publicly disclosed ahead of the patch. Readiness recommends a Patch Now scheduling for Windows, Office, SQL Server and the developer tooling, and standard patch release for Exchange. The Readiness team has published an infographic summarising deployment risk by product family.
Three client issues are carried in from August close with this update, covering:
And Microsoft has left open a Microsoft Defender Antivirus notification defect, confirmed on 28 August, in which devices report that Defender is turned off while it is running correctly.
The quietest revision window of recent months arrived alongside the largest release. Between the August and September Patch Tuesdays, from 12 August to 7 September, the MSRC Security Update Guide touched 324 CVEs. Of those, 307 were routine Microsoft Edge and Chromium republications requiring no customer action.
That leaves 17 entries affecting Microsoft’s own products, and only one of those is a genuine revision. CVE-2026-59133, an elevation of privilege in the High-Performance Computing Pack, moved to version 1.1, and its own revision note records the change as informational. For comparison, August’s window carried 76 revisions to Microsoft’s own products, 60 of them flagged as requiring customer action.
The Readiness team has reviewed all 963 published updates. Microsoft has published no mitigations and no workarounds anywhere in this release.
Microsoft has published no new service or enforcement deadlines for September. The lifecycle picture is different, with multiple end-of-support notices for this coming October:
A second wave follows on 10 November 2026, and it is the one most likely to catch development teams rather than infrastructure teams. .NET 8 reaches the end of its long-term support branch, PowerShell 7.4 does the same, and Windows 11 Enterprise and Education 23H2 ends servicing alongside Windows 11 IoT Enterprise 23H2.
Microsoft’s test guidance for this release runs to 466 Windows entries, 55 of them flagged as high risk, against 109 and four in August. Given the large number of updates this month (who would have thought that we would be here at 963 CVEs), the Readiness team recommends the following testing priorities:
Each month, we break down the update cycle into product families, as defined by Microsoft, with the following groupings.
Microsoft has not released any updates for their browser products for the second month in a row. September’s Security Update Guide carries no Edge-specific CVEs at all, and the 307 Chromium republications in the revision window required no customer action. The nine Edge CVEs that did appear arrived mid-cycle on 28 August and were serviced through the browser’s own update channel rather than this release.
Estates on a managed Edge channel have nothing to do here beyond confirming the channel is current. It is the one quiet corner of an otherwise heavy month.
Windows carries 726 CVEs, 77 of them critical, which is three-quarters of the entire release. Elevation of privilege dominates by volume at 406 entries, with remote code execution second at 156, information disclosure at 94 and denial of service at 47. The pattern is the reverse of the severity picture: the bulk is local elevation, while the critical-rated entries cluster in the network-facing roles.
Add this Windows update to your Patch Now schedule, with DHCP and DNS servers first and the biometric stack close behind.
Microsoft released 137 Office CVEs this month, 24 of them critical, with remote code execution the through-line at 69 entries and information disclosure close behind at 52. September breaks the recent pattern in a way that matters for deployment: this wave is not MSI-only.
Nothing in Office is exploited this month. With 24 critical-rated entries and the Click-to-Run channel carrying most of the exposure, the September Office updates belong on the Patch Now schedule regardless.
Exchange is quiet and SQL Server is not, which inverts the usual relationship between the two.
Exchange goes on the Schedule list, and SQL Server goes on the Patch Now list. That is an unusual split, and it is driven by the four critical remote code execution entries on the database estate.
Microsoft released 24 CVEs across its developer tooling this month, 23 rated important and one critical. Security feature bypasses are the main focus with eight CVE entries, with remote code execution and information disclosure at four each.
Add these to your standard release schedule, behind this month’s Windows, Office and SQL Server priorities. Keep the 10 November date for .NET 8 and PowerShell 7.4 in view while you are in the developer estate, because a patch this month does not extend either branch.
September is the largest release of the year, and this (crazy, super high) volume is the least interesting thing about it. The 963 CVEs matter less than the 55 entries Microsoft flags as high risk, and those sit in printing and fonts. Adobe shipped two Acrobat builds one digit apart and only the second is a security update (nothing to worry about here). Of the CVEs Microsoft republished, 25 are not Microsoft’s. A version number tells you very little about the work in front of you. So, given my (super-secret knowledge) of how Microsoft operates over the summer, here is my prediction for next month (October). It won’t be as big as this month – but just you wait – November is going to be big. Let’s up those numbers (or not).
Equations once used to predict whether populations of rabbits would boom, stabilize, or collapse are now being applied to something potentially even more complicated: romantic relationships.
According to mathematician Laurent Pujo-Menjouet of Claude Bernard University Lyon 1, the forces that determine whether a couple survives life’s inevitable stresses can be studied much like other complex systems. Attraction can strengthen or fade, outside pressures can push a relationship away from stability, and perhaps most importantly, there may be a critical mathematical threshold beyond which recovery becomes increasingly difficult.
In his new book, Love! Valour! Equations! The Mathematics of the Couple, published by CRC Press, Pujo-Menjouet draws on mathematical ecology, psychology, literature, and even film to explore why some couples weather years of conflict, stress, children, illness, and financial hardship while others gradually drift apart.
The goal isn’t to produce an equation that predicts who will fall in love with whom. Instead, Pujo-Menjouet treats relationships as dynamical systems—systems that change over time, respond to disturbances, and can move toward either stability or decline.
“There is no mysterious enchantment or magic potion. By now, that would be known,” Pujo-Menjouet writes in the book, which draws on mathematics, psychology, literature, and film. “Is all hope lost then? Certainly not. That is precisely where everything becomes interesting.”
The mathematical models Pujo-Menjouet uses originated in ecology. His work uses Malthusian growth models and the Lotka-Volterra equations, originally developed to describe population dynamics in animals such as rabbits. He also studies the Allee effect, a phenomenon that explains how populations struggle to recover if they drop below a particular size.
Pujo-Menjouet adapts these concepts to relationships, using the idea of a critical threshold to examine when a couple may become increasingly vulnerable to separation. He also draws on the research of psychologist John Gottman, who showed that relationship behaviors can be quantified as data.
“Just as we can predict population growth or endangered species, we can model the evolution of feelings within a couple,” Pujo-Menjouet explains. “We’re not trying to predict who you’ll fall in love with, we’re trying to understand why some couples remain stable despite life’s inevitable shocks while others slowly drift apart.”
The basic idea is simple: a relationship may have a critical threshold, or minimum level of stability needed to keep the bond intact. Pujo-Menjouet’s model considers three main forces: mutual attraction, the gradual weakening of feelings over time, and each partner’s emotional response to the other.
“If your feelings fall below this threshold and stay there, the mathematics predicts an inevitable decline toward separation,” Pujo-Menjouet says. “However, understanding this threshold gives couples a powerful tool: they can recognize danger zones and take corrective action.”
These models emphasize how couples recover from drifting apart. The key question is not whether couples experience conflict, but whether they have the resilience to restore balance afterward.
“Life will always send its wolves: stress, illness, work, children, financial difficulties,” Pujo-Menjouet says, “mathematics helps us understand how to build the brick house rather than the straw one.”
Researchers such as Pujo-Menjouet are considering whether they could combine these mathematical models with artificial intelligence to create an early-warning system for relationships. Such a system could detect the signs of instability before they become apparent to the people involved.
Pujo-Menjouet compares this method to a GPS for relationships, showing where a couple currently is, where its dynamics may be heading, and the various ways they could arrive at a healthier place. Although the models don’t decide who somebody will love, they can help explain how relationships evolve and what actions might help couples maintain their connection. Early detection of problems would allow partners to make changes before reaching a stage where recovery becomes unlikely.
Pujo-Menjouet admits that present-day mathematical models have limitations. Most of these models are based on data from Western relationships. In contrast, the factors that impact whether a relationship succeeds or fails can differ from one culture, religion, or generation to another. He points out that the model must account for additional factors to be applicable everywhere.
Human behavior also introduces unpredictability that mathematical models cannot fully account for. People can change their habits, strengthen their commitment, seek therapy, or otherwise alter the dynamics of a relationship in ways the equations cannot anticipate. The equations identify tendencies rather than determine an unavoidable outcome.
“Mathematics can illuminate patterns and provide guidance,” Pujo-Menjouet says, “but ultimately, the success of a relationship depends on two people choosing, every day, to nurture their connection. The equations can show you the path, but you still have to walk it together.”
Austin Burgess is a writer and researcher with a background in sales, marketing, and data analytics. He holds an MBA, a Bachelor of Science in Business Administration, and a data analytics certification. His work focuses on breaking scientific developments, with an emphasis on emerging biology, cognitive neuroscience, and archaeological discoveries.
Long before Taco Tuesday became part of the pop-culture vernacular, Tuesdays were synonymous with security — and for anyone in the tech world, they still are. Patch Tuesday, as you most likely know, refers to the day each month when Microsoft releases security updates and patches for its software products — everything from Windows to Office to SQL Server, developer tools to browsers.
The practice, which happens on the second Tuesday of the month, was initiated to streamline the patch distribution process and make it easier for users and IT system administrators to manage updates. Like tacos, Patch Tuesday is here to stay.
Patch Tuesday coverage has long been a staple of Computerworld’s commitment to provide critical information to the IT industry. That’s why we’ve gathered together this collection of recent patches, a rolling list we’ll keep updated each month.
In case you missed a recent Patch Tuesday announcement, here are the latest six months of updates.
September’s Patch Tuesday is Microsoft’s biggest of 2026, with 963 CVEs, two exploited flaws and a clear message: prioritize Windows, Office and SQL Server.
Two vulnerabilities are already exploited: CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in Advanced Local Procedure Call. Nothing in this release was publicly disclosed ahead of the patch. Readiness recommends a Patch Now scheduling for Windows, Office, SQL Server and the developer tooling, and standard patch release for Exchange.
Get more info on the September 2026 Microsoft security updates.
Microsoft’s August 2026 Patch Tuesday closes at 751 CVE entries (across all product families), with 108 rated as critical. One flaw is already exploited, CVE-2026-68820, an elevation of privilege in the Windows WinSock driver (afd.sys). Two more were disclosed but not exploited.
This security-only release earns Patch Now for Windows, Office and Exchange; no SQL Server updates this month. Unfortunately, several critical issues affect server roles: Windows DNS Server carries a cluster of critical RCEs; Windows DHCP Server is the most-populated Microsoft product family at 14 entries. Testing should lead with printing and fonts and the Remote Desktop client, then a WinSock smoke test given the exploited afd.sys flaw.
Get more info on the August 2026 Microsoft security updates.
Microsoft addressed 722 CVEs this month once the 427 Chromium upstream relays are set aside — roughly three times a normal cycle and one of the largest single months in recent memory. Two vulnerabilities arrive under active exploitation: an elevation of privilege in Active Directory Federation Services (CVE-2026-56155), and an elevation of privilege in SharePoint Server (CVE-2026-56164). A third, a BitLocker security feature bypass (CVE-2026-50661) is publicly disclosed but not yet exploited.
The July 2026 Patch Tuesday earns Patch Now recommendations for Windows, Office, Exchange, and SQL Server. SharePoint has two critical RCEs on top of its exploited zero-day, and Exchange Server returns with a critical on-premises spoofing flaw. Adding to our (dear) administrator’s efforts, SharePoint Server 2016/2019 and SQL Server 2016 all reach end of support today.
More info is available here on Microsoft Security updates for July 2026.
Microsoft this month released 206 updates affecting Windows, Office, Exchange Server, and its developer tools — including three Windows vulnerabilities already publicly disclosed. That trio includes an elevation of privilege in the Collaborative Translation Framework (CVE-2026-45586), a denial of service in HTTP.sys (CVE-2026-49160), and a BitLocker security feature bypass (CVE-2026-50507). At the moment, none appear to be under active exploitation, but all three are rated “Exploitation More Likely.”
Even without an exploited zero-day, the June 2026 Patch Tuesday release requires Patch Now recommendations for Windows, Office, and Exchange. The latter is back in the patch picture with a consolidated security update that Microsoft recommends installing “as soon as possible.”
More info is available here on Microsoft Security updates for June 2026.
Microsoft this month released 139 updates affecting Windows, Office, .NET, and SQL Server (though there were no updates for Microsoft Exchange Server). Despite the absence of zero-days, the May Patch Tuesday update still requires Patch Now recommendations for Windows and Office.
The combination of three unauthenticated network RCEs (Netlogon, DNS Client, and SSO Plugin for Jira and Confluence), four Word Preview Pane RCEs, the large TCP/IP vulnerability cluster, and the carry-over BitLocker recovery condition (still active on Windows 10 and Windows Server) warrants an accelerated deployment release schedule.
More info is available here on Microsoft Security updates for May 2026.
Windows admins are going to be busy this month, dealing with the largest Patch Tuesday cycle in memory. The April release involves 165 updates and roughly 340 unique CVEs from Microsoft — including two zero-days, one of which is already being actively exploited in the wild.
The Readiness team recommends “Patch Now” schedules for nearly every major product family: Windows, Office (with a zero-day), Microsoft Edge (Chromium), SQL Server, and Microsoft Developer Tools (.NET). April also brings Phase 2 of Microsoft’s Kerberos RC4 hardening with full enforcement set for July. There is a lot to cover, so here’s a useful infographic mapping the deployment risk for each platform.
More info is available here on Microsoft Security updates for April 2026.
Microsoft has finally solved one of the biggest pain points of Windows with the rollout of Cloud Rebuild. The new recovery feature can reinstall Windows 11 even when an existing Windows installation is corrupt or refuses to boot. Available as a beta through the newly released Windows 11 Insider Beta Preview Build 26220.9343, the feature is essentially a hassle-free alternative to creating a Windows installation USB drive when a PC needs to be recovered.
According to Microsoft, Cloud Rebuild is designed to restore a Windows 11 PC to a “clean, known-good state” by downloading a fresh image of Windows along with the required drivers directly through Windows Update. Unlike the existing Reset this PC functionality, it does not depend on the health of your existing Windows installation, nor does it require users to have a USB drive or custom recovery image available.
Available via the Windows Recovery Environment (WinRE), users can access it by selecting Troubleshoot > Recovery and uninstall > Cloud rebuild from WinRE. Speaking of which, Microsoft has also improved networking support in WinRE. The recovery environment can now reuse eligible Wi-Fi profiles saved within an existing Windows installation, allowing a PC to connect during recovery without requiring administrators to separately configure Wi-Fi credentials in WinRE. Once the PC is connected, Cloud Rebuild checks Windows Update for the target Windows build and downloads the required files. Users can then confirm the Windows edition, language, and build before starting the reinstall.
The only catch here is that Cloud Rebuild completely wipes the system drive, meaning that the process removes all data stored in your main installation or C: drive, including locally stored files, accounts, applications, and settings, before reinstalling Windows. Thus, it is recommended to back up all your important files either locally or using a cloud-based service before starting the process. Once the installation is complete, the PC boots into the Windows out-of-box experience, similar to a fresh installation of Windows. For admin-managed PCs using Windows Autopilot and Microsoft Intune, the system can automatically reconnect to the organization's management infrastructure and restore assigned applications, policies, and backed-up settings.
Cloud Rebuild could particularly be useful when Windows becomes too corrupted to boot normally. Instead of finding another PC, creating installation media, and manually reinstalling Windows, users can potentially perform the entire recovery process directly from WinRE. The feature is still in preview; however, we can expect a wider release later this year.
Qualcomm is taking an unusual approach to the launch of its next-generation premium Snapdragon mobile platform this year. Instead of holding everything for its annual Snapdragon Summit in Maui happening later this month, the company has been methodically disclosing the architecture that will power the next wave of flagship Android phones over the past couple of weeks.
First, the company disclosed its new Oryon CPU architecture, followed by a major overhaul of its Adreno GPU. Today, Qualcomm is detailing the next-generation Hexagon NPU that will serve as the platform’s primary AI engine.
Taken together, the disclosures give us a pretty good picture of where Qualcomm is going before we even know the chip’s official name.
There is obviously a strong performance story here, anchored by a 5GHz CPU, but the more interesting theme running through the architecture is memory locality and specialized AI acceleration. Qualcomm is trying to keep more data close to the compute resources that need it, while distributing AI workloads across the CPU, GPU and NPU.
These architectural changes are important as the company continues to drive on-device AI beyond relatively simple generative features toward more persistent, agentic workloads.
Qualcomm disclosed in August that its next Oryon CPU will be the first mobile CPU to reach 5GHz. The eight-core design includes two 5GHz Prime cores and six Performance cores, with Qualcomm attributing the frequency gains to its fully custom Oryon microarchitecture, an in-house Arm-based CPU design that gives the company full control over the cores, cache and memory hierarchy, branch prediction and CPU subsystem.
The 5GHz headline is certainly going to get attention. However, Qualcomm’s new FlexCache architecture may ultimately have a larger impact on sustained performance. FlexCache allows Oryon’s Prime and Performance cores to tap into the same shared cache pool, with capacity dynamically allocated based on the workload. So rather than a demanding core being limited to a fixed slice of cache, it can draw on more of the available pool when needed. This keeps larger working data sets close to the CPU cores and reduces high-latency trips out to system memory.
This approach should benefit everything from gaming and multitasking to content creation, but it also aligns well with agentic AI workloads, where tasks may move through several stages of processing and across different CPU cores. The basic goal is straightforward: keep the CPU fed and avoid expensive trips to external memory.
Qualcomm’s next disclosure focused on graphics, where the company is making one of the more significant changes to its Adreno GPU engine in recent years. The new GPU adds dedicated Adreno Matrix Cores for running AI models directly inside the graphics pipeline. They’re paired with 18MB of Adreno High-Performance Memory, or HPM, which provides low-latency local storage for tile-based rendering, frame buffers and GPU compute.
Qualcomm claims HPM provides a 12% power improvement compared to its previous-gen Snapdragon 8 Elite Gen 5.
The more visible feature for users, however, may be Adreno Neural Fusion, which combines AI super resolution, neural processing and frame generation in a unified graphics pipeline. There are obvious parallels here to what NVIDIA, AMD and others are doing with neural rendering on the PC, though Qualcomm’s next-gen Snapdragon SoC has to operate within a much tighter mobile power envelope.
Qualcomm claims enabling Neural Fusion reduces power consumption by up to 40% in its internal testing using the company’s Dragon Alley graphics demo. That’s an impressive number, though as always, we’ll want to see how the technology behaves across actual shipping games and devices before drawing any definitive conclusions.
Qualcomm has also helped integrate Neural Fusion technology into Unity and Unreal Engine, which may ultimately be just as important as the underlying hardware. Developer adoption determines whether features like this become meaningful platform advantages or just another tick box on a spec sheet.
Qualcomm
The most recent disclosure centers on Qualcomm’s Hexagon NPU, where the broader architecture starts to come together. The company’s next-generation Hexagon introduces a new Element Accelerator designed for transformer workloads, alongside its existing vector and scalar processing resources. Qualcomm says the new block is optimized for fast action loops, key-value (KV) cache acceleration and context lengths of up to 32K.
Hexagon is also getting 50% more shared memory, and again, that memory complement is important. Model state, context and KV-cache data can generate substantial memory traffic, particularly with larger language models. Keeping more of that data close to the NPU can reduce latency and power consumption. Qualcomm says the architecture is designed for long-context reasoning, multimodal models, concurrent agents and low-latency action loops.
For INT4 quantized models, the company claims up to a 50% improvement in pre-fill performance versus its previous-generation Snapdragon 8 Elite Gen 5. Qualcomm is also targeting Mixture-of-Experts, or MoE, models as large as 30 billion parameters. In its example, the company points to a 30B model that activates only about 3 billion parameters during a given token-generation step. That selective approach is a natural fit for the tight power and memory constraints of a handset.
Qualcomm isn’t suggesting that a smartphone will simply run a 30B dense model entirely from DRAM, however. By activating only the experts needed for a particular task, MoE architectures can dramatically reduce active compute and memory bandwidth requirements, potentially making much larger classes of AI models practical on mobile hardware.
There is a larger competitive story here as well. For years, flagship smartphone competition largely came down to CPU, GPU, modem performance and power efficiency. AI is now another major area of differentiation, and Qualcomm is clearly designing its next-gen Snapdragon mobile platform around this need.
Apple has the advantage of controlling its silicon, operating system and software stack end-to-end. MediaTek continues to push aggressively into premium Android devices as well. Qualcomm’s response is to make its custom Oryon CPU, Adreno GPU and Hexagon NPU work more like a fully integrated compute platform, tuned for modern AI and agentic workloads.
This is a solid advantage for Android handset OEMs because many don’t have the resources to engineer this level of silicon integration themselves. Qualcomm can effectively provide its Android OEM partners, including Samsung, Xiaomi, Honor and others, with a common hardware foundation for on-device AI, advanced graphics and agentic computing. It also gives Qualcomm another way to defend its premium Snapdragon position.
The company’s custom Oryon architecture now spans smartphones and Windows PCs, and soon servers, while AI acceleration is distributed across its CPU, GPU and NPU. For business users, that could mean more AI processing happens locally, reducing cloud and network dependence, improving response times and keeping more potentially sensitive data on-device. And for IT organizations, Qualcomm now has an opportunity to provide a more consistent AI compute foundation across Windows PCs with Snapdragon X and premium Android handsets.
There is still plenty we don’t know, however. Qualcomm hasn’t disclosed the complete SoC specifications, final performance or power characteristics, or which devices will ship with it initially. Many of these AI experiences will also depend heavily on Android, app developers and the models themselves.
The new 5GHz mobile CPU may generate the biggest headline at Snapdragon Summit, but the more important developments may be what sit around it: more local memory, specialized AI acceleration and tighter integration between the CPU, GPU and NPU.
If Qualcomm can translate this architecture into better sustained performance, enhanced power efficiency and useful on-device AI experiences, it could strengthen its position in premium Android phones while putting more competitive pressure on Apple. For business users, the payoff could be more capable local AI without sacrificing the performance and battery life expected of a flagship device.
That is the part I’ll be watching most closely when the complete silicon picture is unveiled at Snapdragon Summit later this month. And I may even get some hands-on time with it in some benchmarks, as we have in years past, so we shall see.
Every spring, Europe’s forests are showered with far more than rain. Wind-pollinated trees release staggering quantities of pollen into the atmosphere, and much of it eventually settles on leaves, branches and the forest floor. New research now shows that this pollen is not merely biological debris — it is a measurable, taxon-specific driver of nutrient fluxes in the water that drips through forest canopies, a flow scientists call throughfall. The findings, published in Environmental Monitoring and Assessment, provide the first continental-scale evidence directly linking pollen deposition to forest water chemistry, and they suggest that decades of forest monitoring may have been quietly misattributing a slice of nutrient input to other sources.
The study was carried out by a large international team led by Elena Gottardini of the Fondazione Edmund Mach in Italy, working within the ICP Forests programme, a pan-European network that monitors air pollution effects on forests. The researchers analysed throughfall samples collected in 2018 from 60 intensive monitoring plots — known as Level II plots — across eight countries: Belgium, Finland, France, Germany, Italy, Norway, Switzerland and the United Kingdom. The plots ranged in altitude from 14 to 1,900 metres above sea level and were dominated by six tree genera: Abies, Fagus, Larix, Picea, Pinus and Quercus. In total, 196 throughfall samples were collected between February and July, covering the early vegetative season when most European trees flower.
The innovation of the study lies in its methodology. Rather than inferring pollen inputs from nearby aerobiological samplers, the team examined the very same water samples that were being chemically analysed. A known quantity of water from each sample was filtered through a 5-micrometre cellulose nitrate mesh, and a calibrated number of 10-micrometre polystyrene-divinylbenzene microspheres — roughly 155,000 per sample — were added as a counting standard. The filters were then dissolved in acetone, centrifuged, and the resulting pellet embedded in fuchsin jelly on microscope slides. Trained analysts identified and counted pollen grains under 400-times magnification, stopping when about 1 percent of the added microspheres had been counted. From these counts, the team calculated pollen deposition rates in grains per square metre per day, correcting for filtered volume, throughfall quantity and sampling duration.
The results were striking. Fifty-three pollen taxa were identified across the samples, with woody species accounting for 98 percent of all grains. Four genera — Pinus, Picea, Fagus and Quercus — together made up 91.4 percent of the total. Pine pollen alone represented more than half of everything collected, a dominance the researchers attribute to the buoyant air sacs on pine grains, which allow them to travel enormous distances from both local and distant sources. In beech, spruce and pine stands, the pollen of the dominant genus itself prevailed, making up 49.7, 59.1 and 84.3 percent of the local pollen spectrum respectively. In oak stands, oak pollen ranked second at 26.9 percent, behind pine. Data from fir and larch stands were excluded because sampling there did not align with those genera’s flowering periods.
By combining the measured pollen curves with published flowering phenology, the team defined main pollen seasons for each genus. Beech and oak flowering spanned April and May, with beech peaking in the last week of April and oak showing a double peak at weeks 19 and 23, likely reflecting multiple oak species flowering at slightly different times across the wide latitudinal and altitudinal spread of plots. Spruce pollen peaked around weeks 19 to 20, while pine peaked at week 19 with a secondary pulse at week 22. Overall, 57 percent of the throughfall samples fell within their stand’s flowering period for at least half of their collection window, providing a robust temporal overlap between pollen deposition and water chemistry measurements.
The chemical analysis, conducted at the Research Institute for Nature and Forest laboratory in Belgium, quantified major ions including potassium, calcium, magnesium, sodium, chloride, phosphate, sulphate, nitrate, nitrite and ammonium using ion chromatography, alongside total dissolved nitrogen and non-purgeable organic carbon measured on a TOC/TN analyser. Linear mixed-effects models then tested whether pollen deposition rates could predict the flux of these compounds, with plot identity included as a random effect and autocorrelation between repeated samples explicitly modelled.
The answer was a clear yes. Every statistically significant association between pollen and throughfall chemistry was positive, meaning more pollen corresponded to more nutrients reaching the forest floor. Potassium emerged as the star player: its flux was significantly explained by pollen from all four main genera, with pollen accounting for an average of 33 percent of the variance. This makes biochemical sense, because potassium is one of the predominant ions in pollen grains, and pollen washed from flowers and crowns by rain or deposited dry is a direct source of the ion during the flowering season — an idea first proposed decades ago but never confirmed at this scale. The strongest single relationships involved oak pollen, which explained 77.8 percent of the variance in ammonium fluxes and 55 percent in total dissolved nitrogen.
Broadleaved and coniferous pollen left different chemical fingerprints. Beech and oak pollen together significantly explained fluxes of non-purgeable organic carbon, dissolved organic nitrogen, total dissolved nitrogen, ammonium and magnesium, while the combined pollen of pine and spruce was linked with every measured compound except phosphate. Intriguingly, broadleaved pollen showed a weak negative association with nitrate fluxes. The authors urge caution in interpreting this pattern, since several non-exclusive mechanisms could be at play. Laboratory experiments have shown that pollen and its associated microbiota can transform extracellular nitrate into nitrite and nitrous oxide, an effect pronounced in beech and oak but weak or absent in pine and spruce. Canopy uptake of nitrogen and coincidentally lower atmospheric deposition during broadleaf flowering are also possible explanations that this single-year study cannot disentangle.
The dissolved organic carbon carried in throughfall also differed by forest type. Specific ultraviolet absorbance at 254 nanometres, a proxy for aromatic and recalcitrant carbon, was highest in spruce stands, whose needles release lignin derivatives and tannins. The humification index was significantly higher in oak throughfall, reflecting more decomposed, humic organic matter. Most revealing was the fluorescence index, which distinguishes microbial from plant-derived organic matter: beech and oak samples had significantly higher values, with medians near 1.9, than pine and spruce samples, which sat near 1.7. Values above 1.9 typically indicate microbially processed carbon, and the elevated readings under broadleaves suggest microbes play a larger role in transforming pollen-derived carbon in those forests — hinting that pollen inputs feed not just trees but entire soil microbial food webs.
For the authors, the implications reach well beyond academic curiosity. Routine throughfall monitoring has historically ignored pollen as a variable, meaning that chemical enrichment previously attributed solely to canopy leaching or atmospheric deposition may in fact be partly pollenic. As climate change pushes flowering earlier and increases airborne pollen amounts across arboreal taxa, these hidden inputs could grow. Masting behaviour in beech and oak — the episodic, synchronized production of enormous seed and pollen crops — introduces strong year-to-year variability that any nutrient budget must now reckon with.
The researchers acknowledge the limitations of a one-year, correlative dataset and call for multi-year studies incorporating canopy architecture, stand age, phenology and insect infestations, as well as stable isotope tracing or controlled exclusion experiments to nail down mechanisms. Still, the message is clear: pollen is not just about reproduction, or even allergies. It is a seasonal fertiliser delivered from the sky, and forests have been banking on it all along. Incorporating pollen surveys into long-term forest observation networks, the team argues, will be essential for accurate nutrient budgets in a changing climate.
Article Title: Deposited pollen from dominant tree genera drives nutrient composition of throughfall in European forests
Article References: Gottardini, E., Cristofolini, F., Cristofori, A., Vanguelova, E., Thimonier, A., Clarke, N., Wachtveitl, L., Ukonmaanaho, L., Lindroos, A.-J., Nicolas, M., Limić, I., Boeckx, P., Bodé, S., Bauters, M., & Verstraeten, A. (2026). Deposited pollen from dominant tree genera drives nutrient composition of throughfall in European forests. Environmental Monitoring and Assessment, 198(10), Article 1053. https://doi.org/10.1007/s10661-026-15883-0
Image Credits: AI Generated
DOI: 10.1007/s10661-026-15883-0
Keywords: Tree pollen deposition, Throughfall chemistry, Atmospheric deposition, Forest nutrient cycle, Potassium fluxes, Dissolved organic carbon, ICP Forests, Flowering phenology, Nitrogen cycling, European forests
Drilling for electricity or geothermal energy is a common human-caused source of earthquakes. Drillers or engineers inject water into the earth to fracture underground rock through a process known as fracking. This allows scientists to produce clean energy almost anywhere on Earth by heating up water in the cracks using facilities called enhanced geothermal systems or EGS plants. However, fracking causes earthquakes, which are a major concern for people’s safety globally. Therefore, scientists are looking for new fracking methods that cause fewer earthquakes.
Fracking for EGS plants can trigger earthquakes by changing the pressure underground and adding stress to the surrounding rock. However, these earthquakes happen at pre-existing, naturally occurring cracks called faults, which are different from the newly formed, man-made cracks. Faults are naturally under pressure from the overlying rock and the surrounding earth since they reach deep underground. As pressure builds up over time, it eventually causes the rocks to shift along these faults and release energy in the form of earthquakes.
During fracking, engineers use 4 different shut-in strategies to finish off water pumping. The standard industry strategy is called instant shut-in, where the injection pump is turned off immediately, but the water stays underground, causing the pressure to lower naturally. In a similar strategy, known as the tapered shut-in, engineers gradually reduce the water injection rate to zero instead of immediately turning it off. For the high-rate and low-rate extraction strategies, they pump the water back out after injection is complete, at different pump rates.
Recently, scientists aimed to mitigate the risk of earthquakes by testing these 4 shut-in strategies to determine which is most effective. They compared the shut-in strategies using crystalline basement rock with low porosity and permeability, meaning water couldn’t easily flow through it. Engineers use this same type of rock for EGS plants so they can control where the water flows. The scientists pumped water into the rock, then measured the pressure and stress levels where rocks began to move along faults, determining the point at which earthquakes would occur.
The scientists applied high-rate and low-rate extraction methods to the rock and found that pressure and fault movements decreased. However, when they applied instant and tapered shut-in methods to the same rock, they increased the pressure and caused continuous fault slipping. They measured stress in the rock during these methods and found that high-rate extraction stabilized the fastest, while low-rate extraction stabilized more slowly. In contrast, instant shut-in continuously increased the pressure and slip, and tapered shut-in caused the highest stress of all.
The scientists also used a computer model to simulate what happened at an EGS site in South Korea, where earthquakes occurred after injections using the instant shut-in method. They set up the model using a rock with the same characteristics, injection wells, and faults as that site. Then, they simulated periods of injection based on the previous real-world events and modeled the effects of pressure and stress to determine if the earthquakes could have been prevented.
The team used the model to compare how a site like this would respond to the instant shut-in method versus the other shut-in methods. They found that the tapered shut-in method increased pressure and stress in the rock, while the high-rate and low-rate methods both decreased pressure and stress. The high-rate method decreased pressure and stress more than the low-rate method.
The scientists concluded that high-rate extraction is the most effective method for reducing the risks of post-injection earthquakes during EGS fracking in crystalline basement rock. Additionally, the scientists determined that the earthquakes in South Korea could have been prevented if engineers had used either the high-rate or low-rate extraction methods. They recommend using high-rate extraction to reduce earthquakes during EGS fracking, which would allow EGS plants to generate clean energy more safely.
The post Reducing earthquakes caused by fracking appeared first on Sciworthy.
If you are yearning for a quick-shot retro Windows experience on your modern Windows 11 or macOS system, then there’s a new vibe-coded clone of the Windows 3.1 Program Manager that may interest you. Developer Mayuki has released a neat little nostalgia project dubbed ReProgman – named after the ancient Windows 3.1 ‘progman.exe ’, which was the primary shell of the era – until Windows 95 swept it away three decades ago.
ReProgman looks pretty authentic to my eyes, and it brought back memories of why I wasn’t sad to see it shrivel away from Windows machines. In a social media post about the release of ReProgman, Mayuki seems to agree with my sentiments. “I asked Claude to create a clone of the Windows 3.1 Program Manager,” wrote the developer (machine translation). “I think you'll enjoy reminiscing with it for about 30 seconds.”
Claude Code worked pretty swiftly to churn out this clone of the Windows 3.1 shell. The first version that was precipitated in about an hour was “pretty decent” but needed some effort to iron out the wrinkles. Then Mayuki complains again that actually using ReProgman induced boredom after about half a minute of usage.
The end-user-ready releases of ReProgman weigh in at between 12 and 16MB, so they are quite a trivial download and don’t need installing. Thus, it isn’t very taxing to give them a try for a spot of nostalgia-tinted navigation around your present system’s programs and files. Mayuki says that building and running this application needs the .NET SDK 10.0+. The code has been released on GitHub under the MIT license.
In conclusion, Miyuki’s ReProgman provides an easy trip down personal computing's memory lane, specifically to the Windows 3.X era of the early to mid-1990s. However, some will prefer to get their retro computing kicks by running the actual MS-DOS/Windows 3.1 combo on real hardware. As we discovered recently, that doesn’t limit users to dusting off an old i486 or similar. Back in April, an enthusiast demoed Windows 3.1X on ultra-modern bare metal with a system using a Ryzen 9 9900X and RTX 5060 Ti.
Nearly every country represented in the United Nations General Assembly recently voted in favor of promoting world maps that more accurately show the size of various continents. But the UN resolution is unlikely to change how millions of people regularly see versions of 16th-century Mercator maps depicting skewed continent sizes in navigation apps.
On September 4, the African-led resolution attracted 164 votes in favor, with six countries abstaining from voting. Only the United States voted to oppose the resolution after describing it as a “radical ideological project,” according to UN News.
The non-binding UN resolution does not impose map changes on anyone. Instead, it “encourages governments, schools, international organizations, and technology companies to use the Equal Earth projection and other so-called equal-area maps when relative size matters,” UN News reported. The resolution also encourages teaching about the trade-offs that arise from depicting a spherical planet on a flat map.
© UN Photo/Loey Felipe
Nearly every country represented in the United Nations General Assembly recently voted in favor of promoting world maps that more accurately show the size of various continents. But the UN resolution is unlikely to change how millions of people regularly see versions of 16th-century Mercator maps depicting skewed continent sizes in navigation apps.
On September 4, the African-led resolution attracted 164 votes in favor, with six countries abstaining from voting. Only the United States voted to oppose the resolution after describing it as a “radical ideological project,” according to UN News.
The non-binding UN resolution does not impose map changes on anyone. Instead, it “encourages governments, schools, international organizations, and technology companies to use the Equal Earth projection and other so-called equal-area maps when relative size matters,” UN News reported. The resolution also encourages teaching about the trade-offs that arise from depicting a spherical planet on a flat map.
© UN Photo/Loey Felipe
Login