SCIENCE

Business is back to normal in the orbital station, but one of two newly discovered leaks is still unrepaired

A serious air leak in the Russian segment of the ISS forced NASA astronauts to put on their spacesuits and shelter in their Dragon capsule for a brief period of time on Friday, but all appears to be safe for now and operations have resumed.

At around 1316 UTC Friday, NASA spokesperson Bethany Stevens announced that, after the crew discovered new leaks, Roscosmos had decided to do a repair operation. During this time, the US space agency ordered astronaut Chris Williams and the four-member SpaceX Crew-12 team into the Dragon spacecraft as part of a precautionary safe-haven procedure.

Reuters, citing an unnamed NASA official, said that leaks in the Russian section of the station escalated this week from around a pound of air a day to two pounds. A source The Register spoke with said that the latest discoveries were the longest cracks in the module they’d seen, though we’re still not clear on how large the cracks actually are. 

Approximately two hours later, Stevens confirmed that NASA had instructed crew members sheltering in a docked Dragon spacecraft to resume normal operations aboard the International Space Station after Roscosmos paused repair work in the Zvezda service module’s transfer tunnel, known as PrK.

The Roscosmos crew was planning to conduct repairs on the transfer tunnel on Friday, but Stevens said that the plan was paused in order to further assess “measurements and data” regarding the new leaks. 

“Given this development, NASA has instructed the crew members inside the Dragon spacecraft to end the safe haven procedures and return to planned operations aboard the International Space Station,” Stevens said. 

What’s life in space without some risks?

Just how big is this crack, exactly?

We’ve known about problems with Zvezda leaks for some time now, as Stevens noted.

“The cracks have always been a concern that NASA watches very closely,” the NASA mouthpiece said in Friday’s X post about the leak. “NASA and Roscosmos have been working to determine the root cause of the cracks, and Roscosmos manages the issue through operational mitigation measures and periodic partial-repair efforts.” 

The Register has been reporting on leaks in the Russian segment of the orbital lab since they were first identified in 2020. Multiple repair efforts over the past few years have failed to stop the leaks entirely, and newly identified cracks suggest the problem is continuing.

Russian news wire Interfax reported that cosmonauts identified two potential air leaks in the transfer chamber, one of which was sealed on Friday with a layer of Germetall-1 two-component sealant, but the second hasn’t been addressed yet. 

“Efforts are underway to prepare it for hermetic sealing,” Roscosmos said in a statement. 

We’ll update this story if we hear anything new from NASA, including whether the continued leaks, with cause unknown, could lead to an early retirement for the station. ®

What you’re reading started as yet another takedown of Universes Beyond.

Maybe not a takedown, but certainly something fuelled by fatigue.

Solo Stove makes some of the best smokeless fire pits, including the Ranger, Bonfire and Yukon backyard fire pits. But if you’re looking for something a little smaller, it also makes a line of tabletop fire pits, including the Mesa and Mesa XL. Both come in several color options, including traditional stainless steel. 

I started off using the smaller Mesa, but when the Mesa XL was subsequently released, I moved to the larger version of the mini fire pit (pictured on the left) because it looks and feels a little more substantial while remaining compact. (As you might expect, it does produce a bigger fire with a heat radius of 2 to 3 feet compared with the Mesa’s 1 to 2 feet.) 

As its name implies, the Mesa XL is designed to sit on a tabletop and is quite portable. Naturally, you could also set it on the ground, but when you put it on a table, it’s at a good height for comfortably roasting marshmallows. It has the same 360-degree Signature Airflow system as Solo Stove’s larger fire pits.

security

Good luck, sys admins

The threat is real. Unknown miscreants are exploiting a high-severity, zero-day bug in Cisco’s SD-WAN management software, and the networking giant hasn’t said when it will patch the flaw.

Cisco issued an advisory on Thursday for the Catalyst SD-WAN Manager vulnerability, tracked as CVE-2026-20245, and it sounds like attackers have been exploiting this security failure for at least the last week.

It’s due to a validation error – the software fails to properly validate user-supplied input – and an authenticated, local attacker can exploit the flaw by uploading a specially crafted file to vulnerable systems. From there, they can escalate privileges and execute commands with root privileges.

The vulnerability affects all versions of the SD-WAN software, regardless of device configuration, and across all deployment types including on-premises, cloud-based, and FedRAMP-certified deployments.

Switchzilla says it became aware of attacks against this vulnerability in June.

“To exploit this vulnerability, an attacker must have netadmin privileges on an affected system,” the vendor said. “This would require valid credentials or exploitation of CVE-2026-20182 or CVE-2026-20127. Cisco is not aware of successful exploitation by other methods.”

Both of these earlier SD-WAN security holes have also been hit by attackers in previous months.

The good news: an attacker needs valid credentials to abuse the new hole. The bad news: exposed credentials aren’t hard to find (or buy) online.

We don’t know the scope of exploitation or exactly when attackers began hitting this SD-WAN hole. Cisco declined to answer The Register’s questions, and instead sent us a statement via email.

“Cisco recommends customers upgrade to the fixed software released in May 2026 for CVE-2026-20182 as a protective measure,” a spokesperson said. “A patch for this vulnerability will be provided on a future date. Customers needing assistance should contact Cisco TAC.”

This latest bug is the sixth SD-WAN vulnerability listed as under attack since the start of the year, and the second zero-day in two months.

The most recent is the one the Cisco spokesperson mentioned in an email to The Register.

In May, Switchzilla disclosed a max-severity make-me-admin bug (CVE-2026-20182) affecting Catalyst SD-WAN Controller and Manager, and warned that attackers had already found and exploited the hole before it issued a patch.

A month earlier, America’s lead cyber-defense agency said that three Cisco Catalyst SD-WAN Manager bugs (CVE-2026-20128, CVE-2026-20133, and CVE-2026-20122) were under attack, and gave federal agencies just four days to patch the security holes.

Cisco fixed all three CVEs in late February, and in March warned of attackers abusing two of them.

Also in February, the networking vendor patched a max-severity improper authentication flaw (CVE-2026-20127) affecting the same SD-WAN software, prompting a Five Eyes countries’ joint intelligence alert urgently warning defenders to patch it – plus an old SD-WAN vulnerability (CVE-2022-20775) – or risk root takeover. 

“Malicious cyber threat actors are targeting Cisco Catalyst SD-WAN used by organizations globally,” the UK’s lead cyber agency said at the time. “These actors are compromising SD-WANs to add a malicious rogue peer and then conduct a range of follow-on actions to achieve root access and maintain persistent access to the SD-WAN.”

And while this one isn’t listed as under active exploitation (yet), on Wednesday, Cisco warned about a proof-of-concept exploit for CVE-2026-20230, a critical bug in its Unified Communications Manager that also allows attackers to gain root privileges. ®

Cosmetics will make me god.

Fake reviews are a real menace for online shoppers. If you have ever bought something online based on glowing reviews only to receive a disappointingly subpar product, you know what I mean. A new study published in the International Journal of Information and Communication Technology proposes an AI-powered system that can not only detect fake reviews, but also trace how they spread.

Why existing tools keep falling short

Most existing fake review detection systems focus on the text of a review. That approach worked for a while, but fake reviewers have gotten smarter. They now pair carefully written text with misleading images to make their reviews look authentic. Text-only tools struggle to catch this, and that’s a real problem for shoppers and honest sellers alike.

The researchers addressed this by building a system that looks at multiple signals at once. It analyzes the review text using two different methods, a text convolutional neural network and pre-trained language models, to capture both surface-level and deeper meaning in the words. It also factors in reviewer behavior, since fake accounts tend to have default profile pictures and system-generated usernames, unlike real users who tend to personalize their accounts.

Can AI really catch a fake image too?

The short answer is yes. Review images are analyzed separately using a residual network, a type of deep learning tool commonly used for processing visuals. Once all these signals are gathered, the system fuses them together to make a final call on whether a review is genuine.

When a review is flagged as fake, a Transformer model kicks in to map its origin and track how far it spread through the network.

Tests on a large dataset from JD.com showed that the system achieved a recognition accuracy of 94.2% and a tracing accuracy of 93.5%, outperforming all existing methods it was compared against. This kind of accuracy could eventually mean fewer misleading reviews and more trustworthy ratings to shop by.

Russia intends to switch on a commercial version of its homegrown answer to Starlink next year, according to people familiar with the programme cited by Reuters, the latest milestone in a project that has been promising to arrive for most of a decade.

The constellation is called Rassvet, the operator is a private aerospace firm called Bureau 1440, and the ambition is deliberately narrower than the American network it is meant to rival.

The scale tells the story. SpaceX has put thousands of Starlink satellites into low Earth orbit. Bureau 1440 plans to reach commercial service in 2027 with a constellation in the high hundreds, with figures around 288 to 292 satellites cited for the first operational phase, and a longer-term target near 900 by the mid-2030s.

Moscow has, for years, described the goal as something conceptually like Starlink rather than a like-for-like match, and the numbers keep that promise honest.

The hardware is further along than the rhetoric alone would suggest. In March the company launched 16 operational satellites, on 23 March, following a run of experimental craft in 2023 and 2024 under the Rassvet-1 and Rassvet-2 test programmes.

Bureau 1440 has described the satellites as carrying 5G non-terrestrial-network communications, laser inter-satellite links, an upgraded power system, and plasma thrusters, the standard kit for a modern broadband constellation.

Dmitry Bakanov, head of the Roscosmos space agency, told Reuters last September that several test vehicles already in orbit had been inspected and the production satellites modified accordingly.

Throughput targets have been published too. Bureau 1440 has advertised per-subscriber speeds ranging from 50 megabits to one gigabit per second, with planned coverage across more than 70 countries.

Those figures are claims rather than demonstrated performance, the distinction that separates a constellation on a slide from one carrying paying traffic, and only the commercial launch will test them.

Money has been committed, on paper at least. The Russian government has earmarked 102.8 billion roubles, roughly $1.26bn, for Rassvet, and Bureau 1440 has said it will add some 329 billion roubles, around $4bn, of its own through 2030.

The company has put potential demand at 1.5 to two million subscribers inside Russia and as many as 12 million worldwide, with coverage planned across more than 70 countries.

The 2027 date deserves a footnote. An earlier target slipped amid reported production shortfalls, which is the kind of detail that tends to recur in constellation programmes everywhere, not only in Russia.

Building satellites is one problem; building them fast enough, in the numbers a useful network requires, is a different and harder one. The 16 operational craft now in orbit are a start on a figure that needs to clear 250 before paying customers can be served.

There is a strategic reading that sits underneath the commercial one. A sovereign broadband network that does not depend on a foreign operator is attractive to any government that has watched Starlink become a factor in the war in Ukraine.

Whether Rassvet arrives on schedule, and at the throughput Bureau 1440 advertises, is the question 2027 will answer. The constellation, for now, is mostly a plan with a launch cadence attached.

The national project will capture a baseline that will be used to create a clearer image of how research is understood and utilised in Ireland.

Research Ireland has launched the Research in Ireland Barometer 2026, a new national project designed to build a richer, more inclusive understanding of how people across Ireland encounter, engage with, and experience research in their everyday lives.

The Barometer will focus on capturing lived experiences, primarily the stories, context and perspectives that often shape how people relate to research. Serving as a baseline for the coming years, the project will aim to create a clearer picture of how research is understood, trusted and encountered across different communities. 

Commenting, the director of research for society at Research Ireland, Dr Ruth Freeman, said: “The Research in Ireland Barometer 2026 represents an important step in opening up conversations about research across society. It is also essential to shaping how we engage with society as a public body. 

“Rather than focusing solely on a simple, statistical survey, we are taking a community-engaged approach to understand how people experience research in their everyday lives, from the decisions they make to the information they encounter and trust.”

Freeman explained that the organisation is actively seeking information from people aged 16 and older, across Ireland – and particularly those who feel as though their experiences are not often captured in traditional surveys. Individuals have three months to contribute to the survey. 

She said, “By listening to people’s lived experiences and meeting people where they are, we aim to build a richer, more inclusive understanding of research and ensure it remains connected to the needs and experiences of the public.”

In early March, Research Ireland also unveiled its inaugural strategy for development of the country’s research and innovation landscape over the next five years. The aim of the strategy is to fund 3,800 new PhDs, support 14 enhanced research centres and deliver 150 research awards in collaboration with Government departments.

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.