Apple’s stuffed 2025 release calendar is missing one very important product
Macworld While it’ll likely still be a couple of months until the first new Apple device arrives in 2025, a fresh leak has given us a look at the calendar for the next 12 months—and it’s jam-packed. Starting in just a few weeks, Apple plans to release more than a dozen new products before the end of 2025, with nearly everything in its catalog getting a refresh. Here’s a look at Apple’s release calendar based on the rumors so far: February MacBook Air: A minor refresh to the 13-inch and 15-inch models with an M4 chip and FaceTime camera. March iPhone SE: A major overhaul with a design based on the iPhone 14, an OLED display, and an A18 chip with Apple Intelligence support. iPad 11: Apple’s entry-level tablet gets a new chip and 8GB of RAM to allow it to run Apple Intelligence. iPad Air: Likely a simple spec bump that jumps the mid-range tablet straight to the M4. June Mac Studio: An overdue update to Apple’s mid-range desktop with M4 Max and M4 Ultra processors and Thunderbolt 5. Mac Pro: We’d love to see the rumors of a smaller design come to fruition, but it will likely just get an upgrade to the M4 Ultra. Studio Display: The design will likely stay the same but bring mini-LED backlighting and camera enhancements. Pro Display XDR: Apple’s high-end monitor is due for an update to 120Hz ProMotion, possibly with Spatial Audio and a FaceTime camera as well. September iPhone 17: The iPhone will get a new design for the first time in years, which includes a new iPhone 17 Air model, which will be substantially thinner than the others. Apple Watch Series 11: The new Apple Watch isn’t expected to deviate much from the design but could gain high blood pressure detection. Apple Watch Ultra 3: The 3rd-gen Apple Watch Ultra will also have a similar design but will gain satellite connectivity and 5G RedCap network access. Apple Watch SE 3: Apple’s cheaper watch will get a new look geared toward kids AirPods Pro 3: Apple’s high-end earbuds are due to get an update with a new shorter-stem design, H3 chip, and additional health features. October Smart home hub: A brand-new device with an iPad-like display that can hang on a wall or rest on a counter. HomePod mini 2: An update to the 2020 model with a new chip and smart home functionality. Apple TV 4K 4: Apple’s set-top will get a new chip and a renewed smart home focus. November MacBook Pro: Don’t expect much more than a bump to the M5 chip. iPad Pro: Same as the MacBook Pro, expect an M5 processor and little else. AirTag 2: Updated UWB chip and additional privacy protections. That’s a huge list, but you’ll notice one major product conspicuously absent: Vision Pro. While Apple’s headset was announced in 2023 and released in 2024, it’s not expected to get an update until later in 2026.And the lower-cost model everyone is waiting for might not arrive until 2027. And the glasses, well let’s just say you shouldn’t hold your breath. Otherwise, the only products not expected to get an update are the AirPods 4 and AirPods Max, iPad mini, iMac, and Mac mini, all of which were just updated in the fall.  Apple is expected to hold its first event in March or April to announce the redesigned iPhone SE and 11th-gen iPad.

Read more »

Mac users who lost equipment in the LA fires may have a better chance of replacing their hardware through insurance policies than AppleCare plans
If your Apple hardware was affected by the LA wildfires, you’ll have better luck replacing it via a standard insurance policy than AppleCare. Per AppleInsider, AppleCare Repair Agreement policies for Mac dictate what is and what isn’t covered for repair. In the plans, the list, section 4 under “What is not Covered?,” lists specific scenarios. […] Source

Read more »

Goldman Sachs CEO confirms that Apple Card partnership may end soon
The financial relationship between Apple and Apple Card financial backer Goldman Sachs may be coming to an end soon. Goldman’s CEO confirmed the possibility of a premature conclusion to the Apple partnership during a recent earnings call. Apple Card-Goldman Sachs partnership possibly ‘won’t continue’ all the way through the current contract Per Reuters, Goldman Sachs […] Source

Read more »

How to solve intermittent Wi-Fi connections with HomeKit and other smart devices
Macworld Recently, I found that one of our home security cameras that supports Apple’s HomeKit framework and HomeKit Secure Video for iCloud clip storage had started to flip on and off the local network. I would often see dozens of “[name] is offline” and “[name] is online” messages scroll across notifications every day. Sometimes it would remain offline for hours at a time, even though it is within line of sight to a router in the same room and had functioned for months at a time without a problem. Because the camera is inexpensive and a few years old, I purchased a replacement to test whether the original was dying–the new camera immediately exhibited the same connection issues in the same location. Was the hardware failing? Turns out it was a Wi-Fi connection issue.Foundry There was a solution. A few months ago, our HomeKit-enabled smart thermostat refused to reconnect to Wi-Fi after a local power outage. I figured out the solution there by configuring a different option on my router. I tested out this solution on both the old and replacement cameras, and it worked. I created a distinct Wi-Fi network to which I connect all smart devices that can be configured to join a specific Wi-Fi network. To explain why and how that works, let’s start with a refresher on Wi-Fi. Wi-Fi hits the wall Wi-Fi was launched in the late 1990s on the unlicensed 2.4 gigahertz (GHz) band, a range of frequencies divided into narrow, overlapping channels that anyone can use but which isn’t guaranteed to be free of other users (unlike cellular frequencies, which are licensed and exclusive to each carrier). This worked well enough for the initial low maximum speed of 11Mbps. As Wi-Fi improved, it expanded into a much larger area of unlicensed spectrum at 5GHz and, more recently, 6GHz. These higher-frequency bands have shorter wavelengths (a function of the number of cycles per second they vibrate at) and have wider channels, which together allow vastly higher data throughput. Modern Wi-Fi in the 5GHz and 6GHz bands can exceed 1Gbps. Those shorter wavelengths, however, have greater trouble passing through walls, ceilings, furniture, and other objects. The longer 2.4GHz wavelengths do a better job of getting through without as much absorption, meaning more signal–thus more data–reaches a greater distance across rooms and floors. The 2.4GHz band maxes out at about half of 5GHz and 6GHz’s top rates, and typically delivers only in the high tens and low hundreds of megabytes per second of data. However, that’s enough for smart devices, which often pass very little information. Even a 4K security camera has a datastream that fits comfortably inside 2.4GHz’s window. You likely never noticed the performance difference between frequency bands because all modern routers are dual-band 2.4GHz/5GHz or tri-band 2.4GHz/5GHz/6GHz and your devices always strive to pick the fastest data rate, regardless of band. Router makers kept 2.4GHz in their Wi-Fi base stations originally for backward compatibility because possibly hundreds of millions of computers, phones, and other devices had been sold with just 2.4GHz built in (some percentage of those remain in use). But it also helps with range when a router is placed in an area in which 5GHz or 6GHz signals are absorbed a room or more away. HomeKit and other smart devices often include only a low-power Wi-Fi radio, particularly if they’re battery-powered. Many are stuck in the past by only supporting 2.4GHz, too, as that reduces the cost and power consumption. How can you leverage your router and 2.4GHz to improve smart device connections? Set up a separate guest 2.4GHz on a router (or routers) near your smart equipment. Separate networks improve consistency When you set up a Wi-Fi network in your house, you may have a single router or several, or have opted for a mesh network (like that created by where you add “nodes” that self-configure with other nodes. In most cases, the default configuration has all bands and all routers using the same network name and Wi-Fi password. This allows seamless roaming across your home. However, each of your devices picks which router and band it connects to based on logic built into the device. If your iPhone or security camera selects a weak, distant router’s 5GHz broadcast, you can’t force it to switch. The way to pick a band and router is to name networks distinctly. Nearly all routers sold in the last decade provide a couple of options for this: You can set a separate name and password for your 2.4GHz and 5GHz (or 5GHz/6GHz) networks. You can enable a guest network in one or more bands with its own name and password, though with some extra configuration needed to work with HomeKit. The first is less useful, as it can affect roaming. Using a guest network makes more sense, as it leaves your main network untouched but gives you the advantage of selection. If you have routers around your house, you may even be able to set up each router’s guest network’s 2.4GHz radio with a unique name (the password can be identical). For instance, on the router closest to my smart home devices, a NetGear Nighthawk, I have enabled the guest network, set its SSID or network name to broadcast (making it selectable from a menu), and checked “Allow guests to see each other and access my local network.” That last item is very important: without “guests” seeing your local network, your smart home devices will be unable to reach your HomeKit hub. The language will vary by router manufacturer and sometimes even among models made by the same company, but there should always be a switch you can set to turn off “guest isolation” or turn on “see devices on the local network.” This configuration on a NetGear router locks connected devices to a strong, nearby signal while also letting them interact with the primary network.Foundry Once I had that network set up, I used the app for cameras, both Eufy models. While they are HomeKit compatible, Eufy also more details configuration and other options within its own app, including updating firmware. It’s there that I was able to select the guest 2.4GHz Wi-Fi network and the offline/online toggling immediately stopped. Months earlier, I had used the physical interface on my smart thermostat and a corresponding app to connect to that guest 2.4GHz network. That was more involved: I had to put the thermostat into a special connection mode from its panel, connect to its short-range private Wi-Fi configuration network, and use the thermostat’s app to select the new 2.4GHz network. Your mileage will vary Not all HomeKit devices can have their Wi-Fi networks changed: some are locked to the network on your iPhone, iPad, or Mac when you add them as an accessory. But those with apps or interfaces may let you pick a Wi-Fi network without disrupting their association with your HomeKit hub and defined home in the Home app. Ask Mac 911 We’ve compiled a list of the questions we get asked most frequently, along with answers and links to columns: read our super FAQ to see if your question is covered. If not, we’re always looking for new problems to solve! Email yours to mac911@macworld.com, including screen captures as appropriate and whether you want your full name used. Not every question will be answered; we don’t reply to emails, and we cannot provide direct troubleshooting advice.

Read more »

Macworld Podcast: Apple’s ‘loaded’ 2025
Macworld If you thought 2024 was a pretty good year for Apple products, 2025 looks to be even bigger. On this episode of the Macworld Podcast, we talk about Apple’s loaded release schedule for the year. If you’re pondering some major Apple purchases this year, you’ll want to listen in!  This is episode 917 with Jason Cross, Michael Simon, and Roman Loyola.  Listen to episode 917 on Apple Podcasts

Read more »

Losing your wallet isn’t a problem anymore
Macworld If you’ve misplaced your wallet, there’s no need to rush to cancel your credit cards as long as you have a MagTag Ultra Slim Tracker. These small trackers work just like Apple AirTags but are designed to fit easily into your wallet or even your passport. Right now, you can get one for just $26.99, marked down from $42. The MagTag syncs with the Apple Find My app, allowing you to track your wallet’s location on a map or play a sound when you’re nearby. Don’t worry about tossing your tracker on a charger every night. The battery lasts up to five months. Don’t have an iPhone? No problem. Apple Find My works on iPads and Mac computers, too. If you’ve dropped your work badge in the rain, there’s no need to worry as long as a MagTag is with it. With an IP68 waterproof rating, it’s built to withstand wet conditions and keep working. It might be in trouble if you drop it while scuba diving, though.  What could have been a stressful situation becomes an easy fix with the MagTag tracker, and they’re only $26.99.    MagTag Ultra Slim Tracker Card – Works with Apple Find My App – $26.99 See Deal StackSocial prices subject to change. 

Read more »

Samsung’s iPhone 17 Air rival could be just 6.4mm thin
Samsung's super-slim Galaxy to rival the upcoming iPhone 17 Air will seemingly measure 6.4mm and feature triple rear cameras. (via Cult of Mac - Apple news, rumors, reviews and how-tos)

Read more »

Apple published a new Press Release
Apple just published a new Press Release:Apple MixC Hefei opens for customers this Saturday, January 18, in Anhui, China

Read more »

How to turn off Apple Intelligence Report in macOS
Apple's generative AI, Apple Intelligence, also generates some usage reports. Here's how to turn off the Apple Intelligence Report in macOS.How to turn off Apple Intelligence Reports in macOS.Apple's much-anticipated AI features dubbed Apple Intelligence have been released for most Apple platforms on recent hardware. Public reception has been, shall we say, less than enthusiastic - with some reports claiming up to 73% of Apple users have no interest in the technology.Others, such as BBC have complained that Apple Intelligence isn't ready for prime time - with Apple devices reporting erroneous news headlines after creating summaries. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

GoChess Lite review: a surprisingly effective way to get better at chess
If you've been meaning to learn how to play chess, or if you want a fun way to practice, GoChess might just be your best bet.GoChess LiteChess is having something of a renaissance at the moment, with many new players joining the fray thanks to services like Chess.com and LiChess. However, for many, chess might seem a bit daunting to step into, especially if the only chess players you know have been playing for years.That's why Particula created GoChess. GoChess is a smart chess set packed with AI features to help you learn how to master this classic game. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Noel Fielding’s time starring in Dick Turpin Apple TV+ series abruptly ends
“The Completely Made-Up Adventures of Dick Turpin” got abruptly cancelled after star Noel Fielding stopped coming to the set. (via Cult of Mac - Apple news, rumors, reviews and how-tos)

Read more »

Who should and shouldn’t buy a new MacBook Air right now
Friends don’t let friends buy a new MacBook Air right before a newer MacBook Air comes out, right? That’s mostly true, but two exceptions. There are currently two very good MacBook Air models that you can purchase brand new that are both incredible values. more…

Read more »

Apple TV+ holds 7% share of U.S. streaming service market
Apple TV+'s share of the U.S. streaming service market declined slightly from 8% in the third quarter of 2024 to 7% in the final quarter… The post appeared first on MacDailyNews.

Read more »

Apple removed an original AirPods Pro setting, but here’s how to add it back
If you’ve noticed a missing toggle from your AirPods Pro settings, you’re not alone. Here’s how to bring back the “Off” option when managing AirPods Pro noise control settings. more…

Read more »

Apple TV+ maintained ‘modest’ market share in the US during Q4 2024
The market share of Apple TV+ in the US has been fairly consistent over the last few quarters, at least that’s what the latest research from JustWatch shows. Now 9to5Mac has seen exclusive data on the market share of streaming platforms during Q4 2024 – and the situation for Apple remains stable. more…

Read more »

Apple CEO Tim Cook attending Trump inauguration after $1 million donation
Apple CEO Tim Cook will join other big tech executives at the inauguration as they seek to avoid being targeted by incoming regulation and tariffs.The US Capitol building. Image source: Visit the Capitol government websiteDifferent United States presidents call for different tactics. With the incoming administration, gone are the days of sending a few hundred lobbyists to Washington.Instead, the companies and the CEOs themselves must curry favor from the one in charge. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

These are the top 10 Apple TV+ shows that are coming soon
Apple TV+ closed out last year on a high note, but the streamer has already prepped a big lineup of shows and movies for early 2025 too. Here are the top 10 TV shows coming to Apple TV+ soon. more…

Read more »

Parallels offers preview of x86 emulation on Apple Silicon Macs
Parallels Desktop 20.2 now includes an "early technology preview" of x86 emulation, as announced by product manager Mikhail Ushakov… The post appeared first on MacDailyNews.

Read more »

Worst & weirdest at CES 2025 — Robotic owls, phone toasters, & unnecessary AI
After a week of high-profile releases, CES 2025 is over and there was some awful stuff on display. Here's the worst and weirdest products at the show.I saw some weird stuff out at CES 2025There is a lot of amazing tech at CES. This year, I was particularly surprised to see that not only were there a lot of new products, but most of what I saw was imminently shipping.That's a huge departure from year's past where most products were purely vaporware. You can see my existing roundups of gear for Apple users and for the

Read more »

Galaxy S25 ‘Slim’ is probably thicker than ‘iPhone 17 Air’ as leak reveals 6.4mm design [Gallery]
Samsung and Apple are both preparing to launch new, thinner smartphones in 2025, but it sounds like Samsung’s Galaxy S25 “Slim” won’t match what’s rumored for the “iPhone 17 Air” per a new leak that reveals how thin the device is. more…

Read more »

Apple One might finally get a brand new service later this year
Apple One launched over five years ago, and while it did recently gain new features, there’s never yet been a brand new service added. But it sounds like that might change later this year. more…

Read more »

Apple CEO Tim Cook to attend Trump’s inauguration next week
Earlier this month, Apple CEO Tim Cook donated $1 million to President-elect Donald Trump’s inauguration. Now, Bloomberg reports that Cook is set to attend Trump’s inauguration next week. more…

Read more »

Apple Card's future in question as Goldman Sachs CEO eyes early exit
Goldman Sachs CEO David Solomon signaled the possible early end of the bank's Apple Card partnership due to financial losses and regulatory challenges.Goldman Sachs may part ways with AppleThe collaboration between Apple and Goldman Sachs on the Apple Card may end before its 2030 contract expiration, according to Reuters. The announcement follows years of financial losses and regulatory challenges for the investment bank, raising questions about the future of Apple's first credit card.Goldman Sachs partnered with Apple in 2019 to launch the Apple Card, which delivers seamless integration with iOS and user-friendly features like no fees and enhanced privacy. While the card gained popularity among Apple customers, it proved costly for Goldman. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Apple CEO Cook invites Red Cross donations to assist California fire relief
Following its own donation to support California fire recovery, Apple is now encouraging its U.S. customers to contribute to… The post appeared first on MacDailyNews.

Read more »

Escapee from Apple TV+’s Silo shows up at NBA game
Apple TV+ marketing is working overtime this week, and not just with "Severance" PR stunts. An escapee from Silo showed up at an NBA game. (via Cult of Mac - Apple news, rumors, reviews and how-tos)

Read more »

Apple hardware lost to LA fires needs to be replaced by homeowner's insurance, not AppleCare
People affected by the LA wildfires who lost their Mac to the flames shouldn't use AppleCare to replace it. They'd have better luck with homeowner's insurance.AppleCare - Image Credit: AppleThe wildfires ravaging California and Los Angeles has involved evacuations of residents out from affected areas, as well as the loss of property. Homes, businesses, and personal belongings have been destroyed by the blaze, with thousands of people affected by it.However, when it comes time to replace their possessions, Mac owners may start to think that they will be covered by AppleCare. In the vast majority of instances, it won't be of much assistance to fire victims. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Bookends 15.1
Adds support for Apple Intelligence to the reference management tool. ($74.99 new, free update, 118.8 MB, macOS 10.13+)

Read more »

Goldman Sachs CEO confirms Apple Card partnership could end sooner than planned
Apple and Goldman Sachs have had a fraught Apple Card relationship, which has widely been reported to be ending soon. Now, Goldman’s CEO has confirmed the possibility of a premature conclusion to the Apple partnership during a recent earnings call. more…

Read more »

Goldman Sachs CEO: Apple card partnership may end before 2030
Goldman CEO David Solomon said on Wednesday that Goldman Sachs' Apple Card partnership with Apple may end before its contract… The post appeared first on MacDailyNews.

Read more »

Coupon savings hit Apple's M4 Pro Mac mini with 24GB RAM, 2TB SSD
Every Mac mini (Late 2024) is on sale, with exclusive coupon savings in effect on the high-end M4 Pro model equipped with 24GB of memory and 2TB of storage. Plus, get three years of AppleCare for $79.Save on Apple's newest Mac mini release with coupon.Discounted M4 Mac mini prices start at $569 this Wednesday, but we're especially pleased to see inventory begin to appear on M4 Pro models.This particular M4 Pro configuration equipped with 24GB of memory and 2TB of storage is $100 off with promo code APINSIDER at Adorama — and at press time, it's expected to ship soon directly from Apple's distribution channel. The same APINSIDER discount code also takes $20 off optional AppleCare, dropping the 3-year extended protection plan to $79. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Microsoft: Happy 2025. Here’s 161 Security Updates
Microsoft today unleashed updates to plug a whopping 161 security vulnerabilities in Windows and related software, including three "zero-day" weaknesses that are already under active attack. Redmond's inaugural Patch Tuesday of 2025 bundles more fixes than the company has shipped in one go since 2017.

Read more »

A Day in the Life of a Prolific Voice Phishing Crew
Besieged by scammers seeking to phish user accounts over the telephone, Apple and Google frequently caution that they will never reach out unbidden to users this way. However, new details about the internal operations of a prolific voice phishing gang show the group routinely abuses legitimate services at Apple and Google to force a variety of outbound communications to their users, including emails, automated phone calls and system-level messages sent to all signed-in devices.

Read more »

U.S. Army Soldier Arrested in AT&T, Verizon Extortions
Federal authorities have arrested and indicted a 20-year-old U.S. Army soldier on suspicion of being Kiberphant0m, a cybercriminal who has been selling and leaking sensitive customer call records stolen earlier this year from AT&T and Verizon. As first reported by KrebsOnSecurity last month, the accused is a communications specialist who was recently stationed in South Korea.

Read more »

Happy 15th Anniversary, KrebsOnSecurity!
KrebsOnSecurity.com turns 15 years old today! Maybe it's indelicate to celebrate the birthday of a cybercrime blog that mostly publishes bad news, but happily many of 2024's most engrossing security stories were about bad things happening to bad guys. It's also an occasion to note that despite my publishing fewer stories than ever this past year, we somehow managed to attract near record levels of readership (thank you!).

Read more »

Web Hacking Service ‘Araneida’ Tied to Turkish IT Firm
Cybercriminals are selling hundreds of thousands of credential sets stolen with the help of a cracked version of Acunetix, a powerful commercial web app vulnerability scanner, new research finds. The cracked software is being resold as a cloud-based attack tool by at least two different services, one of which KrebsOnSecurity traced to an information technology firm based in Turkey.

Read more »

How to Lose a Fortune with Just One Bad Click
Adam Griffin is still in disbelief over how quickly he was robbed of nearly $500,000 in cryptocurrencies. A scammer called using a real Google phone number to warn his Gmail account was being hacked, sent email security alerts directly from google.com, and ultimately seized control over the account by convincing him to click "yes" to a Google prompt on his mobile device.

Read more »

How Cryptocurrency Turns to Cash in Russian Banks
A financial firm registered in Canada has emerged as the payment processor for dozens of Russian cryptocurrency exchanges and websites hawking cybercrime services aimed at Russian-speaking customers, new research finds. Meanwhile, an investigation into the Vancouver street address used by this company shows it is home to dozens of foreign currency dealers, money transfer businesses, and cryptocurrency exchanges -- none of which are physically located there.

Read more »

Patch Tuesday, December 2024 Edition
Microsoft today released updates to plug at least 70 security holes in Windows and Windows software, including one vulnerability that is already being exploited in active attacks. The zero-day seeing exploitation involves CVE-2024-49138, a security weakness in the Windows Common… Read More »

Read more »

U.S. Offered $10M for Hacker Just Arrested by Russia
In January 2022, KrebsOnSecurity identified a Russian man named Mikhail Matveev as "Wazawaka," a cybercriminal who was deeply involved in the formation and operation of multiple ransomware groups. The U.S. government indicted Matveev as a top ransomware purveyor a year later, offering $10 million for information leading to his arrest. Last week, the Russian government reportedly arrested Matveev and charged him with creating malware used to extort companies.

Read more »

Why Phishers Love New TLDs Like .shop, .top and .xyz
Phishing attacks increased nearly 40 percent in the year ending August 2024, with much of that growth concentrated at a small number of new generic top-level domains (gTLDs) -- such as .shop, .top, .xyz -- that attract scammers with rock-bottom prices and no meaningful registration requirements, new research finds. Meanwhile, the nonprofit entity that oversees the domain name industry is moving forward with plans to introduce a slew of new gTLDs.

Read more »

Vulnerability Summary for the Week of November 25, 2024
High Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info 1000 Projects--Portfolio Management System MCA  A vulnerability has been found in 1000 Projects Portfolio Management System MCA 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /register.php. The manipulation of the argument name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. 2024-11-26 7.3 CVE-2024-11744 1000 Projects--Portfolio Management System MCA  A vulnerability classified as critical was found in 1000 Projects Portfolio Management System MCA 1.0. This vulnerability affects unknown code of the file /forgot_password_process.php. The manipulation of the argument username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. 2024-11-27 7.3 CVE-2024-11819 1000projects -- beauty_parlour_management_system  A vulnerability classified as critical was found in 1000 Projects Beauty Parlour Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/edit-services.php. The manipulation of the argument sername leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. 2024-11-25 7.3 CVE-2024-11646 1000projects -- beauty_parlour_management_system  A vulnerability, which was classified as critical, has been found in 1000 Projects Beauty Parlour Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/view-appointment.php. The manipulation of the argument viewid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. 2024-11-25 7.3 CVE-2024-11647 1000projects -- beauty_parlour_management_system  A vulnerability, which was classified as critical, was found in 1000 Projects Beauty Parlour Management System 1.0. This affects an unknown part of the file /admin/add-customer.php. The manipulation of the argument name leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. 2024-11-25 7.3 CVE-2024-11648 1000projects -- beauty_parlour_management_system  A vulnerability has been found in 1000 Projects Beauty Parlour Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/search-appointment.php. The manipulation of the argument searchdata leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. 2024-11-25 7.3 CVE-2024-11649 AbsolutePlugins--Absolute Addons For Elementor  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AbsolutePlugins Absolute Addons For Elementor allows Local Code Inclusion.This issue affects Absolute Addons For Elementor: from n/a through 1.0.14. 2024-11-28 7.5 CVE-2024-52496 Advantech--EKI-6333AC-2G  A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (securityEngineID to local_record.engineid without proper bounds checking. 2024-11-27 3 CVE-2024-36468 Zabbix--Zabbix  When the webdriver for the Browser object downloads data from a HTTP server, the data pointer is set to NULL and is allocated only in curl_write_cb when receiving data. If the server's response is an empty document, then wd- >data in the code below will remain NULL and an attempt to read from it will result in a crash. 2024-11-27 3.3 CVE-2024-42328 Zabbix--Zabbix  The webdriver for the Browser object expects an error object to be initialized when the webdriver_session_query function fails. But this function can fail for various reasons without an error description and then the wd- >error will be NULL and trying to read from it will result in a crash. 2024-11-27 3.3 CVE-2024-42329 Zabbix--Zabbix  In the src/libs/zbxembed/browser.c file, the es_browser_ctor method retrieves a heap pointer from the Duktape JavaScript engine. This heap pointer is subsequently utilized by the browser_push_error method in the src/libs/zbxembed/browser_error.c file. A use-after-free bug can occur at this stage if the wd- >browser heap pointer is freed by garbage collection. 2024-11-27 3.3 CVE-2024-42331 Zabbix--Zabbix  The researcher is showing that due to the way the SNMP trap log is parsed, an attacker can craft an SNMP trap with additional lines of information and have forged data show in the Zabbix UI. This attack requires SNMP auth to be off and/or the attacker to know the community/auth details. The attack requires an SNMP item to be configured as text on the target host. 2024-11-27 3.7 CVE-2024-42332 Zabbix--Zabbix  When a URL is added to the map element, it is recorded in the database with sequential IDs. Upon adding a new URL, the system retrieves the last sysmapelementurlid value and increments it by one. However, an issue arises when a user manually changes the sysmapelementurlid value by adding sysmapelementurlid + 1. This action prevents others from adding URLs to the map element. 2024-11-26 2.2 CVE-2024-22117 Zabbix--Zabbix  When exporting media types, the password is exported in the YAML in plain text. This appears to be a best practices type issue and may have no actual impact. The user would need to have permissions to access the media types and therefore would be expected to have access to these passwords. 2024-11-27 2.7 CVE-2024-36464 Zabbix--Zabbix  The researcher is showing that it is possible to leak a small amount of Zabbix Server memory using an out of bounds read in src/libs/zbxmedia/email.c 2024-11-27 2.7 CVE-2024-42333 Back to top Severity Not Yet Assigned PrimaryVendor -- Product Description Published CVSS Score Source Info autolab--Autolab  Autolab is a course management service that enables auto-graded programming assignments. From Autolab versions v.3.0.0 onward students can download all assignments from another student, as long as they are logged in, using the download_all_submissions feature. This can allow for leakage of submissions to unauthorized users, such as downloading submissions from other students in the class, or even instructor test submissions, given they know their user IDs. This issue has been patched in commit `1aa4c769` which is not yet in a release version, but is expected to be included in version 3.0.3. Users are advised to either manually patch or to wait for version 3.0.3. As a workaround administrators can disable the feature. 2024-11-25 not yet calculated CVE-2024-53258 BoidCMS--BoidCMS  BoidCMS is a free and open-source flat file CMS for building simple websites and blogs, developed using PHP and uses JSON as a database. In affected versions a reflected Cross-site Scripting (XSS) vulnerability exists in the /admin?page=media endpoint in the file parameter, allowing an attacker to inject arbitrary JavaScript code. This code could be used to steal the user's session cookie, perform phishing attacks, or deface the website. This issue has been addressed in version 2.1.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability. 2024-11-25 not yet calculated CVE-2024-53255 bunkerity--bunkerweb  bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). A open redirect vulnerability exists in the loading endpoint, allowing attackers to redirect authenticated users to arbitrary external URLs via the "next" parameter. The loading endpoint accepts and uses an unvalidated "next" parameter for redirects. Ex. visiting: `/loading?next=https://google.com` while authenticated will cause the page will redirect to google.com. This vulnerability could be used in phishing attacks by redirecting users from a legitimate application URL to malicious sites. This issue has been addressed in version 1.5.11. Users are advised to upgrade. There are no known workarounds for this vulnerability. 2024-11-27 not yet calculated CVE-2024-53264 Century Systems Co., Ltd.--FutureNet NXR-G110 series  FutureNet NXR series routers provided by Century Systems Co., Ltd. have REST-APIs, which are configured as disabled in the initial (factory default) configuration. But, REST-APIs are unexpectedly enabled when the affected product is powered up, provided either http-server (GUI) or Web authentication is enabled. The factory default configuration makes http-server (GUI) enabled, which means REST-APIs are also enabled. The username and the password for REST-APIs are configured in the factory default configuration. As a result, an attacker may obtain and/or alter the affected product's settings via REST-APIs. 2024-11-29 not yet calculated CVE-2024-50357 Checkmk GmbH--Checkmk  Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions type] may result in an out-of-bounds access. To spot such missed invocations early in the future, checking the validity of link- >type in bpf_link_show_fdinfo() and emitting a warning when such invocations are missed. 2024-11-25 not yet calculated CVE-2024-53099 Linux--Linux  In the Linux kernel, the following vulnerability has been resolved: nvme: tcp: avoid race between queue_lock lock and destroy Commit 76d54bf20cdc ("nvme-tcp: don't access released socket during error recovery") added a mutex_lock() call for the queue- >queue_lock in nvme_tcp_get_address(). However, the mutex_lock() races with mutex_destroy() in nvme_tcp_free_queue(), and causes the WARN below. DEBUG_LOCKS_WARN_ON(lock- >magic != lock) WARNING: CPU: 3 PID: 34077 at kernel/locking/mutex.c:587 __mutex_lock+0xcf0/0x1220 Modules linked in: nvmet_tcp nvmet nvme_tcp nvme_fabrics iw_cm ib_cm ib_core pktcdvd nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables qrtr sunrpc ppdev 9pnet_virtio 9pnet pcspkr netfs parport_pc parport e1000 i2c_piix4 i2c_smbus loop fuse nfnetlink zram bochs drm_vram_helper drm_ttm_helper ttm drm_kms_helper xfs drm sym53c8xx floppy nvme scsi_transport_spi nvme_core nvme_auth serio_raw ata_generic pata_acpi dm_multipath qemu_fw_cfg [last unloaded: ib_uverbs] CPU: 3 UID: 0 PID: 34077 Comm: udisksd Not tainted 6.11.0-rc7 #319 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014 RIP: 0010:__mutex_lock+0xcf0/0x1220 Code: 08 84 d2 0f 85 c8 04 00 00 8b 15 ef b6 c8 01 85 d2 0f 85 78 f4 ff ff 48 c7 c6 20 93 ee af 48 c7 c7 60 91 ee af e8 f0 a7 6d fd 0b e9 5e f4 ff ff 48 b8 00 00 00 00 00 fc ff df 4c 89 f2 48 c1 RSP: 0018:ffff88811305f760 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffff88812c652058 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000001 RBP: ffff88811305f8b0 R08: 0000000000000001 R09: ffffed1075c36341 R10: ffff8883ae1b1a0b R11: 0000000000010498 R12: 0000000000000000 R13: 0000000000000000 R14: dffffc0000000000 R15: ffff88812c652058 FS: 00007f9713ae4980(0000) GS:ffff8883ae180000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fcd78483c7c CR3: 0000000122c38000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ? __warn.cold+0x5b/0x1af ? __mutex_lock+0xcf0/0x1220 ? report_bug+0x1ec/0x390 ? handle_bug+0x3c/0x80 ? exc_invalid_op+0x13/0x40 ? asm_exc_invalid_op+0x16/0x20 ? __mutex_lock+0xcf0/0x1220 ? nvme_tcp_get_address+0xc2/0x1e0 [nvme_tcp] ? __pfx___mutex_lock+0x10/0x10 ? __lock_acquire+0xd6a/0x59e0 ? nvme_tcp_get_address+0xc2/0x1e0 [nvme_tcp] nvme_tcp_get_address+0xc2/0x1e0 [nvme_tcp] ? __pfx_nvme_tcp_get_address+0x10/0x10 [nvme_tcp] nvme_sysfs_show_address+0x81/0xc0 [nvme_core] dev_attr_show+0x42/0x80 ? __asan_memset+0x1f/0x40 sysfs_kf_seq_show+0x1f0/0x370 seq_read_iter+0x2cb/0x1130 ? rw_verify_area+0x3b1/0x590 ? __mutex_lock+0x433/0x1220 vfs_read+0x6a6/0xa20 ? lockdep_hardirqs_on+0x78/0x100 ? __pfx_vfs_read+0x10/0x10 ksys_read+0xf7/0x1d0 ? __pfx_ksys_read+0x10/0x10 ? __x64_sys_openat+0x105/0x1d0 do_syscall_64+0x93/0x180 ? lockdep_hardirqs_on_prepare+0x16d/0x400 ? do_syscall_64+0x9f/0x180 ? lockdep_hardirqs_on+0x78/0x100 ? do_syscall_64+0x9f/0x180 ? __pfx_ksys_read+0x10/0x10 ? lockdep_hardirqs_on_prepare+0x16d/0x400 ? do_syscall_64+0x9f/0x180 ? lockdep_hardirqs_on+0x78/0x100 ? do_syscall_64+0x9f/0x180 ? lockdep_hardirqs_on_prepare+0x16d/0x400 ? do_syscall_64+0x9f/0x180 ? lockdep_hardirqs_on+0x78/0x100 ? do_syscall_64+0x9f/0x180 ? lockdep_hardirqs_on_prepare+0x16d/0x400 ? do_syscall_64+0x9f/0x180 ? lockdep_hardirqs_on+0x78/0x100 ? do_syscall_64+0x9f/0x180 ? lockdep_hardirqs_on_prepare+0x16d/0x400 ? do_syscall_64+0x9f/0x180 ? lockdep_hardirqs_on+0x78/0x100 ? do_syscall_64+0x9f/0x180 ? do_syscall_64+0x9f/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f9713f55cfa Code: 55 48 89 e5 48 83 ec 20 48 89 55 e8 48 89 75 f0 89 7d f8 e8 e8 74 f8 ff 48 8b 55 e8 48 8b 75 f0 4 ---truncated--- 2024-11-25 not yet calculated CVE-2024-53100 Linux--Linux  In the Linux kernel, the following vulnerability has been resolved: fs: Fix uninitialized value issue in from_kuid and from_kgid ocfs2_setattr() uses attr- >ia_mode, attr- >ia_uid and attr- >ia_gid in a trace point even though ATTR_MODE, ATTR_UID and ATTR_GID aren't set. Initialize all fields of newattrs to avoid uninitialized variables, by checking if ATTR_MODE, ATTR_UID, ATTR_GID are initialized, otherwise 0. 2024-11-25 not yet calculated CVE-2024-53101 Linux--Linux  In the Linux kernel, the following vulnerability has been resolved: nvme: make keep-alive synchronous operation The nvme keep-alive operation, which executes at a periodic interval, could potentially sneak in while shutting down a fabric controller. This may lead to a race between the fabric controller admin queue destroy code path (invoked while shutting down controller) and hw/hctx queue dispatcher called from the nvme keep-alive async request queuing operation. This race could lead to the kernel crash shown below: Call Trace: autoremove_wake_function+0x0/0xbc (unreliable) __blk_mq_sched_dispatch_requests+0x114/0x24c blk_mq_sched_dispatch_requests+0x44/0x84 blk_mq_run_hw_queue+0x140/0x220 nvme_keep_alive_work+0xc8/0x19c [nvme_core] process_one_work+0x200/0x4e0 worker_thread+0x340/0x504 kthread+0x138/0x140 start_kernel_thread+0x14/0x18 While shutting down fabric controller, if nvme keep-alive request sneaks in then it would be flushed off. The nvme_keep_alive_end_io function is then invoked to handle the end of the keep-alive operation which decrements the admin- >q_usage_counter and assuming this is the last/only request in the admin queue then the admin- >q_usage_counter becomes zero. If that happens then blk-mq destroy queue operation (blk_mq_destroy_ queue()) which could be potentially running simultaneously on another cpu (as this is the controller shutdown code path) would forward progress and deletes the admin queue. So, now from this point onward we are not supposed to access the admin queue resources. However the issue here's that the nvme keep-alive thread running hw/hctx queue dispatch operation hasn't yet finished its work and so it could still potentially access the admin queue resource while the admin queue had been already deleted and that causes the above crash. This fix helps avoid the observed crash by implementing keep-alive as a synchronous operation so that we decrement admin- >q_usage_counter only after keep-alive command finished its execution and returns the command status back up to its caller (blk_execute_rq()). This would ensure that fabric shutdown code path doesn't destroy the fabric admin queue until keep-alive request finished execution and also keep-alive thread is not running hw/hctx queue dispatch operation. 2024-11-25 not yet calculated CVE-2024-53102 Mozilla--Firefox  The application failed to account for exceptions thrown by the `loadManifestFromFile` method during add-on signature verification. This flaw, triggered by an invalid or unsupported extension manifest, could have caused runtime errors that disrupted the signature validation process. As a result, the enforcement of signature validation for unrelated add-ons may have been bypassed. Signature validation in this context is used to ensure that third-party applications on the user's computer have not tampered with the user's extensions, limiting the impact of this issue. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5. 2024-11-26 not yet calculated CVE-2024-11696 Mozilla--Firefox  On Android, Firefox may have inadvertently allowed viewing saved passwords without the required device PIN authentication. This vulnerability affects Firefox < 133. 2024-11-26 not yet calculated CVE-2024-11703 msg Suisse AG--EasyTax  A XML External Entity (XXE) vulnerability has been identified in Easy Tax Client Software 2023 1.2 and earlier across multiple platforms, including Windows, Linux, and macOS. 2024-11-29 not yet calculated CVE-2024-9044 n/a--n/a  FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse_options function of sbgdec.c within the libavformat module. When parsing certain options, the software does not adequately validate the input. This allows for negative duration values to be accepted without proper bounds checking. 2024-11-29 not yet calculated CVE-2024-35366 n/a--n/a  FFmpeg n6.1.1 has an Out-of-bounds Read via libavcodec/ppc/vp8dsp_altivec.c, static const vec_s8 h_subpel_filters_outer 2024-11-29 not yet calculated CVE-2024-35367 n/a--n/a  FFmpeg n7.0 is affected by a Double Free via the rkmpp_retrieve_frame function within libavcodec/rkmppdec.c. 2024-11-29 not yet calculated CVE-2024-35368 n/a--n/a  Ant-Media-Serverv2.8.2 is affected by Improper Output Neutralization for Logs. The vulnerability stems from insufficient input sanitization in the logging mechanism. Without proper filtering or validation, user-controllable data, such as identifiers or other sensitive information, can be included in log entries without restrictions. 2024-11-29 not yet calculated CVE-2024-35371 n/a--n/a  LinkStack 2.7.9 through 4.7.7 allows resourcesviewscomponentsfavicon.blade.php link SSRF. 2024-11-29 not yet calculated CVE-2024-35451 n/a--n/a  A deserialization vulnerability exists in the Stub class of the VarDumper module in Symfony v7.0.3. The vulnerability stems from deficiencies in the original implementation when handling properties with null or uninitialized values. An attacker could construct specific serialized data and use this vulnerability to execute unauthorized code. 2024-11-29 not yet calculated CVE-2024-36610 n/a--n/a  In Symfony v7.07, a security vulnerability was identified in the FormLoginAuthenticator component, where it failed to adequately handle cases where the username or password field of a login request is empty. This flaw could lead to various security risks, including improper authentication logic handling or denial of service. 2024-11-29 not yet calculated CVE-2024-36611 n/a--n/a  Zulip from 8.0 to 8.3 contains a memory leak vulnerability in the handling of popovers. 2024-11-29 not yet calculated CVE-2024-36612 n/a--n/a  FFmpeg n7.0 has a race condition vulnerability in the VP9 decoder. This could lead to a data race if video encoding parameters were being exported, as the side data would be attached in the decoder thread while being read in the output thread. 2024-11-29 not yet calculated CVE-2024-36615 n/a--n/a  An integer overflow in the component /libavformat/westwood_vqa.c of FFmpeg n6.1.1 allows attackers to cause a denial of service in the application via a crafted VQA file. 2024-11-29 not yet calculated CVE-2024-36616 n/a--n/a  FFmpeg n6.1.1 has an integer overflow vulnerability in the FFmpeg CAF decoder. 2024-11-29 not yet calculated CVE-2024-36617 n/a--n/a  FFmpeg n6.1.1 has a vulnerability in the AVI demuxer of the libavformat library which allows for an integer overflow, potentially resulting in a denial-of-service (DoS) condition. 2024-11-29 not yet calculated CVE-2024-36618 n/a--n/a  moby v25.0.0 - v26.0.2 is vulnerable to NULL Pointer Dereference via daemon/images/image_history.go. 2024-11-29 not yet calculated CVE-2024-36620 n/a--n/a  moby v25.0.5 is affected by a Race Condition in builder/builder-next/adapters/snapshot/layer.go. The vulnerability could be used to trigger concurrent builds that call the EnsureLayer function resulting in resource leaks/exhaustion. 2024-11-29 not yet calculated CVE-2024-36621 n/a--n/a  In RaspAP raspap-webgui 3.0.9 and earlier, a command injection vulnerability exists in the clearlog.php script. The vulnerability is due to improper sanitization of user input passed via the logfile parameter. 2024-11-29 not yet calculated CVE-2024-36622 n/a--n/a  moby v25.0.3 has a Race Condition vulnerability in the streamformatter package which can be used to trigger multiple concurrent write operations resulting in data corruption or application crashes. 2024-11-29 not yet calculated CVE-2024-36623 n/a--n/a  nodemcu before v3.0.0-release_20240225 was discovered to contain an integer overflow via the getnum function at /modules/struct.c. 2024-11-29 not yet calculated CVE-2024-36671 n/a--n/a  MSA FieldServer Gateway 5.0.0 through 6.5.2 allows cross-origin WebSocket hijacking. 2024-11-29 not yet calculated CVE-2024-45495 n/a--n/a  WithSecure Atlant (formerly F-Secure Atlant) 1.0.35-1 allows a remote Denial of Service because of memory corruption during scanning of a PE32 file. 2024-12-01 not yet calculated CVE-2024-45520 n/a--n/a  OpenVidReview 1.0 is vulnerable to Incorrect Access Control. The /upload route is accessible without authentication, allowing any user to upload files. 2024-11-27 not yet calculated CVE-2024-46054 n/a--n/a  Buffer Overflow vulnerability in SunBK201 umicat through v.0.3.2 and fixed in v.0.3.3 allows an attacker to execute arbitrary code via the power(uct_int_t x, uct_int_t n) in src/uct_upstream.c. 2024-11-29 not yet calculated CVE-2024-48406 n/a--n/a  Incorrect access control in Adapt Learning Adapt Authoring Tool

Read more »

Snag a 13-inch 16GB M2 MacBook Air for only $799 today
Amazon has Apple 13" MacBook Airs with M2 CPUs and 16GB of RAM on sale for $200 off MSRP, only $799. Their prices are the lowest currently available for these recently upgraded 13" M2 MacBook Airs. Shipping is free: - 13" M2 MacBook Air (16GB RAM/256GB SSD): $799 $200 off MSRP Best Buy has Apple 13" MacBook Airs with M2 CPUs and 16GB of RAM on sale for $200 off MSRP as well, only $799. Sale price for online orders only, in-store price may vary. Order online, and choose free shipping or free local store pickup (if available): - 13" M2 MacBook Air (16GB RAM/256GB SSD): $799 $200 off MSRP For the latest sales & prices, see our 13" MacBook Air Price Tracker, updated daily.

Read more »

Snag a 13-inch 16GB M2 MacBook Air for only $799 today
Amazon has Apple 13" MacBook Airs with M2 CPUs and 16GB of RAM on sale for $200 off MSRP, only $799. Their prices are the lowest currently available for these recently upgraded 13" M2 MacBook Airs. Shipping is free: - 13" M2 MacBook Air (16GB RAM/256GB SSD): $799 $200 off MSRP Best Buy has Apple 13" MacBook Airs with M2 CPUs and 16GB of RAM on sale for $200 off MSRP as well, only $799. Sale price for online orders only, in-store price may vary. Order online, and choose free shipping or free local store pickup (if available): - 13" M2 MacBook Air (16GB RAM/256GB SSD): $799 $200 off MSRP For the latest sales & prices, see our 13" MacBook Air Price Tracker, updated daily.

Read more »

Apple has 8th generation iPads in stock today for only $229
Apple has Certified Refurbished 8th-generation 10.2" WiFi iPads available on their online store for only $229 in Space Gray or Silver colors. An Apple one-year warranty is included with each iPad, outer cases are new, batteries are new, and shipping is free: - 8th-gen 10.2" 32GB WiFi iPad: $229 These iPads may not last very long, so check Apple's site for the very latest stock status. They are the cheapest iPads for sale today at Apple. Keep an eye on our iPad Price Tracker for the latest prices & sales from Apple and its resellers, updated daily.

Read more »

Here’s how to use your Education discount to take up to $300 off new MacBooks at Apple
Need a new Apple MacBook Air or MacBook Pro? If you're a student, teacher, or staff member at any educational institution, you can use your .edu email address when ordering at Apple Education to take up to $300 off the price of a new MacBook. Even parents of students can qualify. Education discounts are also available on most build-to-order options, such as extra RAM and more storage. Here are the Apple Education discounts on standard-configuration MacBooks: - 16" M4 Pro MacBook Pros: from $2299, $200 off - 16" M4 Max MacBook Pros: from $3199, $300 off - 14" M4 MacBook Pros: from $1499, $100 off - 14" M4 Pro MacBook Pros: from $1849, $150-$200 off - 14" M4 Max MacBook Pros: from $2899, $300 off - 15" M3 MacBook Air/16GB/256GB: $1199, $100 off - 15" M3 MacBook Air/16GB/512GB: $1399, $100 off - 15" M3 MacBook Air/24GB/512GB: $1599, $100 off - 13" M3 MacBook Pro/16GB/256GB: $999, $100 off - 13" M3 MacBook Pro/16GB/512GB: $1199, $100 off - 13" M3 MacBook Pro/24GB/512GB: $1399, $100 off - 13" M2 MacBook Air/256GB: $899, $100 off Details at Apple Education. Not in the US? Click for the Canada store.

Read more »

Here’s how to use your Education discount to take up to $300 off new MacBooks at Apple
Need a new Apple MacBook Air or MacBook Pro? If you're a student, teacher, or staff member at any educational institution, you can use your .edu email address when ordering at Apple Education to take up to $300 off the price of a new MacBook. Even parents of students can qualify. Education discounts are also available on most build-to-order options, such as extra RAM and more storage. Here are the Apple Education discounts on standard-configuration MacBooks: - 16" M4 Pro MacBook Pros: from $2299, $200 off - 16" M4 Max MacBook Pros: from $3199, $300 off - 14" M4 MacBook Pros: from $1499, $100 off - 14" M4 Pro MacBook Pros: from $1849, $150-$200 off - 14" M4 Max MacBook Pros: from $2899, $300 off - 15" M3 MacBook Air/16GB/256GB: $1199, $100 off - 15" M3 MacBook Air/16GB/512GB: $1399, $100 off - 15" M3 MacBook Air/24GB/512GB: $1599, $100 off - 13" M3 MacBook Pro/16GB/256GB: $999, $100 off - 13" M3 MacBook Pro/16GB/512GB: $1199, $100 off - 13" M3 MacBook Pro/24GB/512GB: $1399, $100 off - 13" M2 MacBook Air/256GB: $899, $100 off Details at Apple Education. Not in the US? Click for the Canada store.

Read more »

Free iPhone 16 at Boost Mobile plus Unlimited service for $65 per month with Infinite Access
Boost Mobile, an MVNO using AT&T and T-Mobile's networks, is offering a free 128GB iPhone 16, 16 Plus, or 16 Pro including service with their Unlimited plan (30GB of premium data) for a total charge of $65 per month...their Infinite Access Plan. The per month charge includes a new iPhone every year, plus the Unlimited network access charge. No trade-in is required. iPhones with more storage are also available, but for a few dollars more per month. This deal is live today at Boost Mobile. For the latest prices & sales, keep an eye on our iPhone Price Tracker, updated daily.

Read more »

Free iPhone 16 at Boost Mobile plus Unlimited service for $65 per month with Infinite Access
Boost Mobile, an MVNO using AT&T and T-Mobile's networks, is offering a free 128GB iPhone 16, 16 Plus, or 16 Pro including service with their Unlimited plan (30GB of premium data) for a total charge of $65 per month...their Infinite Access Plan. The per month charge includes a new iPhone every year, plus the Unlimited network access charge. No trade-in is required. iPhones with more storage are also available, but for a few dollars more per month. This deal is live today at Boost Mobile. For the latest prices & sales, keep an eye on our iPhone Price Tracker, updated daily.

Read more »

Amazon is offering a $100 discount on 7th-generation 2024 iPad minis
Amazon is offering $100 discounts on Apple's new 2024 WiFi iPad minis, each with free shipping. These are the lowest prices available for new minis anywhere. - 8.3" 128GB WiFi iPad mini: $399, $100 off MSRP - 8.3" 256GB WiFi iPad mini: $499, $100 off MSRP - 8.3" 512GB WiFi iPad mini: $699, $100 off MSRP For the latest prices and sales, see our iPad mini Price Tracker, updated daily.

Read more »

14-inch M4 MacBook Pros on sale today for $150-$200 off MSRP
B&H Photo has 14-inch M4 MacBook Pros on sale right now for $150-$200 off MSRP. B&H offers free 1-2 day shipping to most US addresses: - 14" M4 MacBook Pro (16GB/512GB/Gray): $1449, $150 off MSRP - 14" M4 MacBook Pro (16GB/1TB/Gray): $1599, $200 off MSRP - 14" M4 MacBook Pro (24GB/1TB/Gray): $1799, $200 off MSRP These are currently the lowest prices available for new M4-powered 14" MacBook Pros among the Apple retailers we track. For the latest sales and prices, keep an eye on our 14-inch MacBook Pro Price Tracker, updated daily.

Read more »

Clearance M2 Mac minis available starting at only $499
Best Buy has clearance M2 Mac minis available on their online store starting at $499. Sale prices for online orders only: - Mac mini M2 CPU (8GB/256GB): $499, save $100 - Mac mini M2 CPU (8GB/512GB): $599, save $200 For the latest prices and sales, keep an eye on our Mac mini Price Tracker, updated daily.

Read more »

Clearance 16-inch M3 Pro MacBook Pro (36GB/1TB) on sale for $2499, $400 off MSRP
Apple 16" MacBook Pros with M3 Pro CPUs are on clearance sale for $400 off original MSRP at B&H Photo. Snag a Space Black model with 36GB of memory and a 512GB SSD for only $2499, $400 off Apple's original asking price. B&H offers free 1-2 day shipping to most US addresses: - 16" M3 Pro MacBook Pro (36GB/512GB): $2499, $400 off MSRP For the latest prices and sales, see our 16" MacBook Pro Price Tracker, updated daily.

Read more »

Amazon has Apple Watch SE models on sale today for $50 off MSRP
Amazon has Apple Watch SE models on sale right now for $50 off MSRP, each including free shipping. Their prices are the lowest currently available for SE Watches: - 40mm Apple Watch SE GPS: $199, save $50 - 44mm Apple Watch SE GPS: $299, save $50 - 40mm Apple Watch SE GPS + Cellular: $249, save $50 - 44mm Apple Watch SE GPS + Cellular: $279, save $50 Note that their sale prices may be restricted to certain band colors (see their site for details), and stock is likely to come and go. For the latest prices & sales, keep an eye on our Apple Watch Price Tracker, updated daily.

Read more »