Google's Project Zero exists to hunt down zero-day vulnerabilities such as the yet to be fixed Windows 10 security bomb I wrote about recently. But it's not just Microsoft that comes under scrutiny from the Google security researchers: a vulnerability in Apple's iMessage has been found that "bricks" an iPhone and survives hard resets, leaving users having to wipe the device and start factory fresh again.

The iMessage text bombing zero-day was disclosed by Google Project Zero researcher Natalie Silvanovich, who describes how the malformed message vulnerability can cause a Mac to "crash and respawn." However, as Silvanovich notes in her disclosure, "on an iPhone, this code is in Springboard. Receiving this message will cause Springboard to crash and respawn repeatedly, causing the UI not to be displayed and the phone to stop responding to input." In other words, receiving this text bomb through iMessage creates a condition that survives a hard reset and causes the iPhone to be unusable from the moment it is unlocked. "The only way I could find to fix the phone is to reboot into recovery mode and do a restore," Silvanovich said, continuing "this causes the data on the device to be lost though."

As long as you keep your iPhone up to date, however, there is no need to panic. The Google Project Zero disclosure policy is to allow the vendor, Apple, in this case, 90 days from the point of informing it of the vulnerability to issue a fix. After that 90 days has elapsed, or a fix has been made available, the vulnerability report will be disclosed to the public. That's what has happened this week, with Silvanovich hitting the publish button on her April 19 bug report. Apple actually fixed the problem really quickly as part of the iOS 12.3 release on May 13. Even so, Silvanovich left plenty of extra time to ensure the fix has been made as broadly available as possible before disclosing the existence of the problem this week.

If you haven't turned on the automatic software update feature in iOS 12, then I recommend that you do. That way you can be sure that issues like the iMessage text bomb iPhone bricker will not impact you. Simply open the Settings app, navigate to the General section, and then select the software update option. Toggle the automatic updates button to on and you are sorted. It goes without saying, but I will say it anyway: if you are not yet running iOS 12.3, then you really should update as a matter of urgency now that the iMessage bricking technique has been made public. Sure, there are always going to be some concerns about updating to a new version of any operating system, and the forthcoming iOS 13 is not immune to these, but updating makes more sense than not if you want to reduce the risk of falling victim to known security issues that could make your iPhone unusable.

Windows 10 continues to be a danger zone. Not only have problems been piling up in recent weeks, Microsoft has also been worryingly deceptive about the operation of key services. And now the company has warned millions about another problem. 

Spotted by the always excellent Windows Latest, Microsoft has told tens of millions of Windows 10 users that the latest KB4501375 update may break the platform’s Remote Access Connection Manager (RASMAN). And this can have serious repercussions. 

The big one is VPNs. RASMAN handles how Windows 10 connects to the internet and it is a core background task for VPN services to function normally. Given the astonishing growth in VPN usage for everything from online privacy and important work tasks to unlocking Netflix and YouTube libraries, this has the potential to impact heavily on how you use your computer. 

I've written about two fantastic tools that help people discover the ideal Linux distribution tailored to their needs and expectations, but a new tool just materialized on my radar and frankly, it's blowing my mind. I just took Debian 9.9.0 Cinnamon, MX Linux 18.3 and Peppermint OS for a quick test drive. But I did so without downloading any ISOs, without flashing any images to a USB, and without even firing up VirtualBox. That's thanks to DistroTest.net, a website that streams the experience right to your browser.

UPDATE 2: DistroTest founder Andy Klemann tells me they're receiving so much traffic that they need to rewrite their scripts. He also says the site itself should be back online today, but the servers for starting systems are still down and they're working on a solution. 

DistroTest is the brainchild of Forster Tobias and Andy Klemann. It operates on the philosophy of every potential Linux user asking the "3 W's" questions:

DistroTest serves up a whopping 689 versions across 223 unique operating systems. This feels like a gargantuan undertaking for the site's operators, but the end-user experience is seamless and dead simple.