Ugreen Nexode Qi2 Powerbank 20000mAh 145W Max review: smart pillar with plenty of power
Macworld At a glanceExpert's Rating Pros High capacity 15W Qi2 wireless charging pad Informative display Cons High price Our Verdict The pillar design of the Nexode Qi2 Power Bank has its advantages, especially when using the Qi2 charging slot. The performance is faultless and the informative display is equally impressive. Price When Reviewed This value will show the geolocated pricing text for product undefined Best Pricing Today Price When Reviewed$179.99 Best Prices Today: Ugreen Nexode Qi2 Power Bank 20000mAh 145W Retailer Price $179.99 View Deal Price comparison from over 24,000 stores worldwide Product Price Price comparison from Backmarket The pillar design of the Ugreen Nexode Qi2 Power Bank is reminiscent of a skyscraper—albeit a squat one. It offers an impressive 20000mAh battery capacity in a small footprint. And just like a skyscraper, it has something on top: a 65-degree tilting Qi2 wireless charging station provides additional convenience and flexibility when charging. A striking feature is the large display, as we have seen in other Nexode power banks. The screen provides informative information about the connected interface and the charging power. However, this only applies to the three interfaces and not to the Qi2 charging port. Thomas Bergbold There is also a large percentage display and the estimated duration of how long the power bank can deliver energy at that power, or how long it will take until the Nexode power bank is charged. Incidentally, this took around 1.5 hours in our test. Thomas Bergbold Speaking of power, the Nexode Power Bank can deliver a maximum of 145W. In detail, this is a maximum of 15W at the Qi2 charging station, 100W at the first USB-C port, 45W at the second USB-C and 22.5W at the USB-A. The Nexode Power Bank can be charged itself via USB-C1 with 65W and USB-C2 with 45W. Four devices can be charged simultaneously. As expected, the charging time is faultless. An iPhone 15 is charged by 50% within 30 minutes on the USB-C and 32% on the Qi2 charging port. The 11-inch iPad Pro also charges at 36% and the MacBook Air M3 at 36%. You can also use the power bank as a desktop charging station when you connect a high-powered USB-C wall charger to the USB-C port on the back of the power bank. Thomas Bergbold What you rarely hear from manufacturers is the life expectancy of the battery. Ugreen specifies 1,000 charging cycles, after which the battery will still have 80% of its original capacity. The cells used are of type 21700, so theoretically a repair should be possible. To prevent damage to the battery and the connected devices, Ugreen has installed appropriate protective circuits—for example, for temperature, voltage and current. Another interesting feature is protection against deep discharge, which is something you rarely find. And while we’re on the subject of protection, proper rubber feet not only provide good protection for furniture, but also ensure a secure stand. Price The Ugreen Nexode Qi2 20000mAh Power Bank 140W costs $179.99 / £179.99. The price is high but is explained by the useful Qi2 charging slot. If you don’t need this, you are better off with the otherwise comparable Nexode 130 watt power bank that we reviewed previously. Thomas Bergbold Should you buy the Ugreen Nexode Qi2 Power Bank? If your MacBook urgently needs power, but the socket is far away, the Ugreen Nexode Power Bank comes into its own. The upright design is ideal for a standing desk. And at the same time, the iPhone is also supplied with power via the Qi2 charging slot. It’s practical that you can tilt the Qi2 charging station to see the display. With a full capacity of 20000mAh and a maximum output of 145W, the Nexode Qi2 145W Power Bank won’t run out of steam any time soon.

Read more »

Apple and Amazon get $600 million UK lawsuit dismissed
A lawsuit claiming that Apple and Amazon colluded to fix the price of Apple products and reduce competition, has been rejected by a UK tribunal.Apple and Amazon have been accused of price-fixingIn one of three similar cases accusing Apple and Amazon of price fixing, the UK's Competition Appeal Tribunal has ruled that the case cannot continue to trial. The decision to dismiss the case is reportedly an unusual one as the tribunal more often allows claimants to pursue cases further.In this situation, the mass lawsuit — Britain's equivalent of a class-action one — was brought by consumer law academic and professor of law, Christine Riefa. She brought the suit on behalf of potentially 36 million British consumers who bought Apple or Beats products. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Zens Nightstand Charger Pro 2 review: Slim speed for the nightstand
Macworld At a glanceExpert's Rating Pros Fast charging Compact and heavy Cons Apple Watch charging slot difficult to open High price Our Verdict The Nightstand Charger Pro 2 is a great charging station—and not just for the bedside table. It combines high charging speeds with a premium choice of materials and excellent workmanship. The only drawback: the charging slot for the Apple Watch could be a little easier to access. Price When Reviewed This value will show the geolocated pricing text for product undefined Best Pricing Today Retailer Price Zens $109.99 View Deal $119.99 View Deal Price comparison from over 24,000 stores worldwide Product Price Price comparison from Backmarket Price When Reviewed$109.99 Best Prices Today: Zens Nightstand Charger Pro 2 Retailer Price Zens $109.99 View Deal $119.99 View Deal Price comparison from over 24,000 stores worldwide Product Price Price comparison from Backmarket With an edge length of less than 10cm and a height of 8cm, the Zens Nightstand Charger 2 looks small on the bedside table. To prevent it from being accidentally pushed to the side, it has a rubber coating on the underside and, thanks to its zinc alloy materials, weighs a hefty and stable 326 grams. The 15W MagSafe-compatible Qi2 charging pad can be folded out to activate the iPhone’s standby mode. A charging slot for the Apple Watch is hidden behind the iPhone charging pad. If you need it, simply fold it up. Thomas Bergbold Thanks to Qi2 with 15W, the charging speed is high. After 30 minutes, we measured 30 per cent for the iPhone 15 and 60 per cent for the Apple Watch 7. A 20W power adapter is included with the Nightstand Charger 2. We would have preferred a little higher but this should be just enough for wireless charging of iPhone and Watch. Thomas Bergbold Verdict It has to be noted that this charging station is not cheap at $110/£90, but it is a premium-build charging station. The metal workmanship is high quality, the charging speed is fast and the footprint is perfect for the bedside table. Our only point of criticism is that the charging module for the Apple Watch is a fingernail killer. It is difficult to fold out of its recessed position.

Read more »

Apple’s string of failures shows just how badly things need to change
Macworld Truly, Apple’s rise from near-bankruptcy to being one of the most valuable companies in the world is a story for the business history books. But as legendary football coach/analyst John Madden frequently said, “Winning is the best deodorant.” (that’s American football, for our U.K. audience.) When you’re riding high–and have been riding high for a couple of decades–it’s very hard to notice the parts of your business that have begun to emit a bit of an odor. To take another page from football, Apple has a winning playbook, and it keeps using it. But if you keep calling the same plays without adapting and reacting, a winning playbook can become something much worse. In the past year, two major Apple product launches show just how calcified the company’s strategy has become–and how much it needs to change. The unnecessary product launch It was clear as a bell to anyone who knew anything about Apple that the Vision Pro wasn’t going to be a mass-market product. More than a year before the product shipped, there were rumors that it would be priced at more than $2,000 (a full $1,500 lower than its actual shipping price). Even at $2,000, it seemed like Apple’s headset couldn’t find much of a customer base. For months, I couldn’t believe that it wasn’t just going to be sold as a Developer Kit. I think the Vision Pro and visionOS have a lot of potential in the long run, but it’s the earliest of days right now, and it’s going to take many years for this bet to pay off, if it ever does. Developers and users can buy a Vision Pro to get some amazing tech demos and imagine the future, but I wouldn’t recommend one to any regular person today. But Apple hasn’t shipped a weird, niche, early-adopters-only product in decades. (To Apple’s credit, this is a way in which it isn’t sticking to the usual playbook.) Since Steve Jobs came back, pretty much everything has been calibrated to reach a large worldwide market of potential customers. As a result, the company’s product roll-out engine–a legendary one, copied across industries because it’s so successful–revved itself up and prepared to introduce the Vision Pro. What a waste of time, money, and attention. It took eight months for Tim Cook to tell the Wall Street Journal that “At $3,500, it’s not a mass-market product… it’s an early-adopter product. People who want to have tomorrow’s technology today—that’s who it’s for.” He’s not wrong, but it took him eight months to admit it because Apple is just not wired to quietly release a product that’s not really for the masses. To be fair, the world is not wired to accept any Apple product announcement as anything but earth-shattering. We’ve all been conditioned by Apple’s success and marketing strategies to think that way. That Vision Pro launch was counterproductive. Now, the product carries at least a whiff of failure, and it could have been avoided. They weren’t ever going to sell millions of first-generation Vision Pros. Apple could’ve shown it off as a tech demo or released it as a developer kit, and the narrative would have been different. It may be years before the Apple Vision Pro is a product the general consumer would consider.Apple But again, Apple’s just not wired that way. It’s a splashy product launch or nothing. The feature roll-out overreaction Apple got caught flat-footed on AI, a potentially existential mistake. To its credit, the company reacted: June’s WWDC announcements were primarily related to Apple Intelligence. The company needed to send a message that it might not be ahead, exactly, but it was on it and there was going to be AI goodness in Apple products, too. I have no complaints about any of that. But what followed shows that Apple’s too busy following its old playbook: In the fall, Apple began a full-court press of marketing for the new iPhone and other devices that focused on Apple Intelligence. It used Apple Intelligence to try to sell new iPhones, even though the features weren’t available! Over the ensuing months, it oversold many of the features while continuing to promise functionality that is still waiting in the wings. Apple Intelligence, as currently constituted, is half-baked–and I’m being generous. Anyone who carefully follows Apple understands why it’s this way, and I’d even say that I’m optimistic that the company will get out in front of it given enough time. But right now, implementations of many features are slapdash at best, and some of the most dazzling features announced in June are unlikely to ship until it’s almost June again. The execution of Apple Intelligence has not be able to live up to the hype.Foundry Apple needs to flog new iPhones every fall, it’s true. But was it the right call to sell a not-quite-there (figuratively or even literally) feature? It doesn’t seem so to me. And it undercuts Apple’s response to criticism of its problematic news summaries that it’s just beta software. Sure it is–beta software that’s shipping in final software and being heavily promoted to customers. Going through the motions A lot of Apple’s biggest blunders in the last decade seem tied to old ways of thinking, not adapting themselves to changing times. It has reacted to design failures like the “butterfly” keyboard in laptops slowly and tentatively. The Meta Ray-Ban sunglasses seem to exist very much in a product niche occupied by AirPods, but Bloomberg’s Mark Gurman suggests that we shouldn’t expect an Apple response until 2026 at the earliest. Apple once was able to create the iPod in a crash program in a matter of months, but today’s Apple is apparently the kind of ocean liner that takes a very long time to course correct. And then there’s the company’s reaction to regulation–and, indeed, many of its anti-competitive policies and product strategies. A lot of these strategies are straight out of the playbook built by Steve Jobs during his return to the company and inculcated into the corporate culture. In those days, Apple was an underdog that was fresh from a near-death experience and desperately had to scrape to survive. Today’s Apple is a titan, but it still behaves like it’s a put-upon underdog in danger of being taken advantage of by the cold, cruel world. It’s a real “are we the baddies” moment in the making if the company would have a modicum of introspection. Success has been very, very good to Apple in so many ways. But many of the traits that brought Apple here have become weaknesses. For the company to make the next couple of decades successful, it needs to show more adaptability.

Read more »

Parallels Desktop 20.2 update released, offers improved X86 and virtual machine support
The Parallels Desktop 20.2 update has been released, the new version offering 64-bit x86 emulation for Apple Silicon and more enhancements to make Apple Intelligence Writing Tools work with Windows apps. The update adds several key changes to the virtualization tool, chief among them being an early technology preview of x86 emulation for Apple Silicon […] Source

Read more »

Arizona TSMC plant nears completion, testing, and shipment of A-series chips
The first of the mass-produced U.S. made A-series chips is about to begin at TSMC’s Arizona plant. According to Nikkei Asia, test production of the chips at the new plant has been completed, and Apple is in the final stages of verifying their quality and performance. As such, the first batch of commercially viable chips […] Source

Read more »

Get $45 to spend when you get a Costco Gold Star Membership for $65
Macworld Life is expensive, but it may be a little easier to manage if you start consolidating your errands into one location: Costco. Sure, a Gold Star Membership costs $65, but now it also comes with a $45 Digital Costco Shop Card. That’s $45 to spend in person or online at Costco. Here’s how to make that happen:  First, you have to either be a new member or have had your membership expire for 18 months or longer. If you’ve been putting off renewing your membership, here’s your sign.  Next, you’ll buy your Costco Gold Star Membership here for $65. That’s the same price you’d normally pay, by the way. Important: make sure to use a valid email when you sign up. That’s because within two weeks of redeeming your membership, you’ll get your $45 Digital Costco Shop Card in your inbox.  All that’s left is to go shopping. You can use your $45 in-person or online. How many hotdogs would that cover?  It might be time to trade all those little errands for a trip to Costco.  Get a Costco 1-Year gold Star Membership and a $45 Digital Costco Shop Card for $65.    Costco 1-Year Gold Star Membership + $45 Digital Costco Shop Card – $65 See Deal StackSocial prices subject to change. 

Read more »

Parallels Can Now Run x86 Windows and Linux On Apple Silicon Mac
Parallels Desktop now supports running 64-bit x86 operating systems on Apple Silicon Macs through its proprietary emulation engine, enabling users to run traditional Windows and Linux distributions. However, performance is said to be "really slow." How-To Geek reports: The latest Parallels Desktop 20.2 update adds early support for x86 emulation on Apple Silicon, allowing traditional x86 PC operating systems to work on newer Mac computers. There were already apps like UTM that could do it (most of them are based on QEMU), but this feature uses Parallels' "proprietary emulation engine" paired with Apple's built-in hypervisor. [...] Parallels on Apple Silicon can now "run existing x86_64 Windows 10, Windows 11*, Windows Server 2019/2022, and some Linux distributives with UEFI BIOS via Parallels Emulator." You can also create new Windows 10 21H2 and Windows Server 2022 virtual machines if needed. There are some big limitations. You can only run 64-bit x86 operating systems -- sorry, FreeDOS fans -- but those 64-bit operating systems can run 32-bit applications. There's also no support for USB devices, nested virtualization (so WSL2 won't work), or the Parallels hypervisor. Performance will also be "really slow," since x86 instructions have to be translated to ARM. The company said, "Windows boot time is about 2-7 minutes, depending on your hardware. Windows operating system responsiveness is also low." Read more of this story at Slashdot.

Read more »

How to record audio and create transcripts in Notes in iOS 18
The Notes app in iOS 18 and iPadOS 18 makes it easy to add an audio recording to a note, and create a written transcription of it if desired. Here's how to do it.Notes can record audio and provide transcriptions, starting with iOS and iPadOS 18.It has long been possible to add an audio recording to a note created in the Notes app, but in earlier iOS versions it was a little more cumbersome. Users would open the Voice Memos app, record the audio, and then attach that recording to a new note in the Notes app.As of iOS 18, that functionality is directly available in Notes — though it is still somewhat hidden until you know how to find it. The big change compared to the previous Voice Memos app is that Notes can now also provide a written transcript of what was said, if you are using an iPhone 12 or later. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Copyright trial over Apple TV+ show 'Servant' could lead to $81 million fine
Apple TV+ show "Servant" allegedly stole key elements from a 2013 film called "The Truth About Emmanuel," and the trial is back on with a jury set to decide if Apple and M. Night Shyamalan should be fined $81 million.Apple TV+ show 'Servant.' Image source: AppleDirector Francesca Gregorini sued in January 2020, and the case was initially thrown out. She alleges that the dark themes surrounding a reborn doll and similar shots between the properties are enough to suggest copyright infringement.According to a report from Variety, creators of the show and M. Night Shyamalan will testify to a jury. The jurors will watch "The Truth About Emmanuel" and the first three episodes of "Servant" to help make a determination. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Vego Kitchen Composter review: keep food scraps out of the trash
If you're tired of smelly garbage, the Vego Kitchen Composter is a great way to responsibly dispose of food scraps — if you're fine with sacrificing the countertop space.Vego Kitchen ComposterFood waste is a big deal. While the numbers vary depending on your source, it's estimated that the average American throws away anywhere between 200 and 400 pounds of food a year.That might not seem like a big deal because that averages about 0.82 pounds of waste a day — about 2.5 apples or a little less than one russet potato. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Opera browser makes it easier to interact with its AI through a new iOS widget
The popular Opera web browser has just released a major update for its iPhone and iPad app. With the new version, Opera is making it easier for users to interact with Aria – the company’s built-in AI – through new Home Screen widgets. Read on as we detail everything that’s new with the latest Opera update for iOS. more…

Read more »

Save $250 to $300 on these M4 Pro MacBook Pros with exclusive deals
Always on a quest to bring readers the steepest savings, AppleInsider has partnered with B&H Photo to drop prices on two MacBook Pro configurations from Apple's M4 Pro line.Exclusive discounts are dropping MacBook Pros by up to $300.The first 14-inch MacBook Pro model features Apple's M4 Pro chip with a 12-core CPU and 16-core GPU. It also has 24GB of unified memory and a bump up to 1TB of storage. Normally retailing for $2,199, you can grab the laptop in Space Black for $1,949 when you shop through the pricing links in this post from a laptop or desktop computer (activation instructions can be found below). Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Apple releases third developer beta of watchOS 11.3 for testing
watchOS 11.3 has received its third developer beta, following the arrival of similar beta updates for the HomePod and Apple TV only hours earlier.Apple has released the third developer beta of watchOS 11.3.On Tuesday, Apple first released the third developer betas of tvOS 18.3 and HomePod OS 18.3, respectively. Now, the company has deployed a beta software release for its Apple Watch platform.The third developer beta of watchOS 11.3 increases the build number to 2S5550a, up from the previous 22S5540e, which was released on January 7, 2025. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

With President Trump inbound, EU reassesses tech probes into Apple, Google and Meta
The European Union (EU) is reassessing its investigations of tech groups including Apple and others, just as President Donald Trump… The post appeared first on MacDailyNews.

Read more »

watchOS 11.3 beta 3 now available for developers
Apple has released a new beta 3 update. Just hours after the recent debut of beta 3 for tvOS and HomePod only, watchOS 11.3 has received its beta 3 update too. more…

Read more »

Apple releases first MagSafe Charger firmware in nearly two years
Macworld Just like iPhones and iPads, Apple’s chargers and cables also have tiny computers inside that need occasional updates. Today it’s the MagSafe Charger’s turn—for the first time since May 2023. Apple has issued an update for the 25W MagSafe Charger to bring the accessory to a new firmware version from the previous version (128.0). This is the fifth firmware update the accessory has received but the first for the newest 25W model. There doesn’t appear to be a separate update for the older charger. Apple released the original MagSafe Charger, topped out at 15W and had a 1-meter cable, in 2020 alongside the iPhone 12. This updated model with 25W charging and a 2-meter cable arrived in September 2024 with the iPhone 16. There’s no way to directly update the MagSafe Charger. When it is attached to your iPhone, the firmware will be updated at some point, usually overnight. To check the firmware of your charger, attach it to your iPhone, then head to the Settings app, then General > About and tap the Apple MagSafe Charger tab near the bottom of the page. If the firmware version is later than 128.0, you are on the newest version.

Read more »

Why Vision Pro is Apple’s best reason yet to bring Touch ID back to iPhone
Apple introduced Face ID on iPhone all the way back in 2017, and Touch ID quickly became absent from all but the budget iPhone SE. Now, the SE is about to lose it too. But I think it’s actually the perfect time to bring Touch ID back across the entire iPhone lineup, and Vision Pro is why. more…

Read more »

Apple’s Calculator app will get one of its best features back in iOS 18.3
Macworld When iOS 18 launched last fall, we got an all-new Calculator app. It’s got some great features, including Math Notes, which lets you scribble down calculations to solve, and unit conversions, which converts things like currency and weight without heading to Safari. It even arrived on the iPad for the first time, with has a full set of features and a brand-new unified interface across platforms. But one of the most useful features of the old iOS calculator app didn’t make it to the new iOS 18 version: repeating operations. On the old Calculator, like most calculators, you were able to perform an operation, say 2×2, and press the equal sign to get 4. Then if you pressed the equal sign again, it would repeat the last operation (x2), and you’d get 8. Then again to get 16, and so on. It was a useful way to compute compounding interest or a long series of repeating additions, but for some reason, Apple took it away in iOS 18 and macOS 15. Maybe you didn’t notice, but many users did and have expressed frustration over the past few months that it was gone. In the iOS/iPadOS 18.3 and macOS 15.3 betas, the feature is back, and you can once again mash the equals key over and over and repeat the last operation to your heart’s content. Apple is expected to release the new updates in late January or early February, so you won’t have too long to wait.

Read more »

Apple TV+ unveils the second season trailer for ‘Eva the Owlet’
Apple TV+ on Tuesday revealed the trailer for the second season of the beloved animated kids and family series “Eva the Owlet,” premiering… The post appeared first on MacDailyNews.

Read more »

Apple joins Ultra Accelerator Link Consortium to help develop next-gen AI data center tech
Ultra Accelerator Link Consortium (UALink) has announced the expansion of its Board of Directors with the election of Apple, Alibaba Cloud… The post appeared first on MacDailyNews.

Read more »

The M2 MacBook Air is back under $800 right now
Macworld The MacBook Air M2 is a great deal at $999 especially now that it has 16GB of RAM. But right now, you can save $200 at Amazon, not quite the same fantastic discount we saw on Black Friday, but not far off either. This is one of the best laptops you can possibly get because it’s affordable, super light and thin, and perfectly capable of getting you through the day, whether you want to work, stream content, or have fun. The M2 chip is fast, powerful, and perfectly capable of handling everyday tasks, including some content creation. Paired with the 16GB of RAM it comes with, you’ve got a real speedy device at your fingers. The 13.6-inch Liquid Retina Display is absolutely gorgeous, and it’s actually one of our favorite things about this laptop. It also has a great battery life that will last you through the day without needing to hunt down your charger. Also, if you have to participate in video meetings often, you’ll be doing it in style because the laptop has a 1080p cam, a three-mic array, and a four-speaker sound system. Don’t miss out on the chance to get the M2 MacBook Air for $799 right now at Amazon. But we’d hurry up because this deal won’t last forever. Buy now at Amazon

Read more »

ChatGPT wants to become your reminder app with new ‘Tasks’ feature
OpenAI on Tuesday announced a new feature coming to ChatGPT, which will turn the chatbot into a reminder app. Called “Tasks,” the feature will let users ask ChatGPT to remind them about their tasks and even create periodic alerts for specific situations. more…

Read more »

Top tips for traveling with AirTags in your luggage
Traveling is a lot easier if you can track your stuff with AirTags in your luggage. Make sure it’s with you all along your journey. (via Cult of Mac - Apple news, rumors, reviews and how-tos)

Read more »

Apple Watch Ultra 3 might get my upgrade for its software, not hardware
Apple Watch Ultra 3 is coming later this year. It will reportedly feature satellite connectivity, 5G cellular, and high blood pressure detection. But the thing that might win me over isn’t hardware, and it isn’t even actually new at all. more…

Read more »

Severance season 2 promos try to out-weird the show itself
With new episodes of Apple TV+'s strangely engrossing workplace series coming Friday, two new "Severance" season two promos get weird. (via Cult of Mac - Apple news, rumors, reviews and how-tos)

Read more »

OpenAI takes on Apple’s Siri with ‘Tasks’
OpenAI announced Tuesday the beta launch of "Tasks" for ChatGPT, marking its entry into the virtual assistant market and positioning it… The post appeared first on MacDailyNews.

Read more »

Apple seeds third developer beta of tvOS 18.3
Apple has moved on to its third round of developer betas, but it has started quietly with a trial of tvOS 18.3's third beta, along with HomePod OS 18.3.Apple TV 4KThe third beta for tvOS 18.3 follows after the second, which surfaced on January 7. The first round was issued on December 16.It's also accompanied by the third developer beta of HomePod OS 18.3, which is used by the HomePod and HomePod mini. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Apple releases beta 3 for tvOS 18.3 and HomePod 18.3
Apple released new betas today, but only for two of its platforms. tvOS 18.3 and HomePod 18.3 have received new developer beta 3 updates, bringing them ahead of the rest of Apple’s platforms in the beta cycle. more…

Read more »

Microsoft: Happy 2025. Here’s 161 Security Updates
Microsoft today unleashed updates to plug a whopping 161 security vulnerabilities in Windows and related software, including three "zero-day" weaknesses that are already under active attack. Redmond's inaugural Patch Tuesday of 2025 bundles more fixes than the company has shipped in one go since 2017.

Read more »

A Day in the Life of a Prolific Voice Phishing Crew
Besieged by scammers seeking to phish user accounts over the telephone, Apple and Google frequently caution that they will never reach out unbidden to users this way. However, new details about the internal operations of a prolific voice phishing gang show the group routinely abuses legitimate services at Apple and Google to force a variety of outbound communications to their users, including emails, automated phone calls and system-level messages sent to all signed-in devices.

Read more »

U.S. Army Soldier Arrested in AT&T, Verizon Extortions
Federal authorities have arrested and indicted a 20-year-old U.S. Army soldier on suspicion of being Kiberphant0m, a cybercriminal who has been selling and leaking sensitive customer call records stolen earlier this year from AT&T and Verizon. As first reported by KrebsOnSecurity last month, the accused is a communications specialist who was recently stationed in South Korea.

Read more »

Happy 15th Anniversary, KrebsOnSecurity!
KrebsOnSecurity.com turns 15 years old today! Maybe it's indelicate to celebrate the birthday of a cybercrime blog that mostly publishes bad news, but happily many of 2024's most engrossing security stories were about bad things happening to bad guys. It's also an occasion to note that despite my publishing fewer stories than ever this past year, we somehow managed to attract near record levels of readership (thank you!).

Read more »

Web Hacking Service ‘Araneida’ Tied to Turkish IT Firm
Cybercriminals are selling hundreds of thousands of credential sets stolen with the help of a cracked version of Acunetix, a powerful commercial web app vulnerability scanner, new research finds. The cracked software is being resold as a cloud-based attack tool by at least two different services, one of which KrebsOnSecurity traced to an information technology firm based in Turkey.

Read more »

How to Lose a Fortune with Just One Bad Click
Adam Griffin is still in disbelief over how quickly he was robbed of nearly $500,000 in cryptocurrencies. A scammer called using a real Google phone number to warn his Gmail account was being hacked, sent email security alerts directly from google.com, and ultimately seized control over the account by convincing him to click "yes" to a Google prompt on his mobile device.

Read more »

How Cryptocurrency Turns to Cash in Russian Banks
A financial firm registered in Canada has emerged as the payment processor for dozens of Russian cryptocurrency exchanges and websites hawking cybercrime services aimed at Russian-speaking customers, new research finds. Meanwhile, an investigation into the Vancouver street address used by this company shows it is home to dozens of foreign currency dealers, money transfer businesses, and cryptocurrency exchanges -- none of which are physically located there.

Read more »

Patch Tuesday, December 2024 Edition
Microsoft today released updates to plug at least 70 security holes in Windows and Windows software, including one vulnerability that is already being exploited in active attacks. The zero-day seeing exploitation involves CVE-2024-49138, a security weakness in the Windows Common… Read More »

Read more »

U.S. Offered $10M for Hacker Just Arrested by Russia
In January 2022, KrebsOnSecurity identified a Russian man named Mikhail Matveev as "Wazawaka," a cybercriminal who was deeply involved in the formation and operation of multiple ransomware groups. The U.S. government indicted Matveev as a top ransomware purveyor a year later, offering $10 million for information leading to his arrest. Last week, the Russian government reportedly arrested Matveev and charged him with creating malware used to extort companies.

Read more »

Why Phishers Love New TLDs Like .shop, .top and .xyz
Phishing attacks increased nearly 40 percent in the year ending August 2024, with much of that growth concentrated at a small number of new generic top-level domains (gTLDs) -- such as .shop, .top, .xyz -- that attract scammers with rock-bottom prices and no meaningful registration requirements, new research finds. Meanwhile, the nonprofit entity that oversees the domain name industry is moving forward with plans to introduce a slew of new gTLDs.

Read more »

Vulnerability Summary for the Week of November 25, 2024
High Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info 1000 Projects--Portfolio Management System MCA  A vulnerability has been found in 1000 Projects Portfolio Management System MCA 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /register.php. The manipulation of the argument name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. 2024-11-26 7.3 CVE-2024-11744 1000 Projects--Portfolio Management System MCA  A vulnerability classified as critical was found in 1000 Projects Portfolio Management System MCA 1.0. This vulnerability affects unknown code of the file /forgot_password_process.php. The manipulation of the argument username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. 2024-11-27 7.3 CVE-2024-11819 1000projects -- beauty_parlour_management_system  A vulnerability classified as critical was found in 1000 Projects Beauty Parlour Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/edit-services.php. The manipulation of the argument sername leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. 2024-11-25 7.3 CVE-2024-11646 1000projects -- beauty_parlour_management_system  A vulnerability, which was classified as critical, has been found in 1000 Projects Beauty Parlour Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/view-appointment.php. The manipulation of the argument viewid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. 2024-11-25 7.3 CVE-2024-11647 1000projects -- beauty_parlour_management_system  A vulnerability, which was classified as critical, was found in 1000 Projects Beauty Parlour Management System 1.0. This affects an unknown part of the file /admin/add-customer.php. The manipulation of the argument name leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. 2024-11-25 7.3 CVE-2024-11648 1000projects -- beauty_parlour_management_system  A vulnerability has been found in 1000 Projects Beauty Parlour Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/search-appointment.php. The manipulation of the argument searchdata leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. 2024-11-25 7.3 CVE-2024-11649 AbsolutePlugins--Absolute Addons For Elementor  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AbsolutePlugins Absolute Addons For Elementor allows Local Code Inclusion.This issue affects Absolute Addons For Elementor: from n/a through 1.0.14. 2024-11-28 7.5 CVE-2024-52496 Advantech--EKI-6333AC-2G  A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (securityEngineID to local_record.engineid without proper bounds checking. 2024-11-27 3 CVE-2024-36468 Zabbix--Zabbix  When the webdriver for the Browser object downloads data from a HTTP server, the data pointer is set to NULL and is allocated only in curl_write_cb when receiving data. If the server's response is an empty document, then wd- >data in the code below will remain NULL and an attempt to read from it will result in a crash. 2024-11-27 3.3 CVE-2024-42328 Zabbix--Zabbix  The webdriver for the Browser object expects an error object to be initialized when the webdriver_session_query function fails. But this function can fail for various reasons without an error description and then the wd- >error will be NULL and trying to read from it will result in a crash. 2024-11-27 3.3 CVE-2024-42329 Zabbix--Zabbix  In the src/libs/zbxembed/browser.c file, the es_browser_ctor method retrieves a heap pointer from the Duktape JavaScript engine. This heap pointer is subsequently utilized by the browser_push_error method in the src/libs/zbxembed/browser_error.c file. A use-after-free bug can occur at this stage if the wd- >browser heap pointer is freed by garbage collection. 2024-11-27 3.3 CVE-2024-42331 Zabbix--Zabbix  The researcher is showing that due to the way the SNMP trap log is parsed, an attacker can craft an SNMP trap with additional lines of information and have forged data show in the Zabbix UI. This attack requires SNMP auth to be off and/or the attacker to know the community/auth details. The attack requires an SNMP item to be configured as text on the target host. 2024-11-27 3.7 CVE-2024-42332 Zabbix--Zabbix  When a URL is added to the map element, it is recorded in the database with sequential IDs. Upon adding a new URL, the system retrieves the last sysmapelementurlid value and increments it by one. However, an issue arises when a user manually changes the sysmapelementurlid value by adding sysmapelementurlid + 1. This action prevents others from adding URLs to the map element. 2024-11-26 2.2 CVE-2024-22117 Zabbix--Zabbix  When exporting media types, the password is exported in the YAML in plain text. This appears to be a best practices type issue and may have no actual impact. The user would need to have permissions to access the media types and therefore would be expected to have access to these passwords. 2024-11-27 2.7 CVE-2024-36464 Zabbix--Zabbix  The researcher is showing that it is possible to leak a small amount of Zabbix Server memory using an out of bounds read in src/libs/zbxmedia/email.c 2024-11-27 2.7 CVE-2024-42333 Back to top Severity Not Yet Assigned PrimaryVendor -- Product Description Published CVSS Score Source Info autolab--Autolab  Autolab is a course management service that enables auto-graded programming assignments. From Autolab versions v.3.0.0 onward students can download all assignments from another student, as long as they are logged in, using the download_all_submissions feature. This can allow for leakage of submissions to unauthorized users, such as downloading submissions from other students in the class, or even instructor test submissions, given they know their user IDs. This issue has been patched in commit `1aa4c769` which is not yet in a release version, but is expected to be included in version 3.0.3. Users are advised to either manually patch or to wait for version 3.0.3. As a workaround administrators can disable the feature. 2024-11-25 not yet calculated CVE-2024-53258 BoidCMS--BoidCMS  BoidCMS is a free and open-source flat file CMS for building simple websites and blogs, developed using PHP and uses JSON as a database. In affected versions a reflected Cross-site Scripting (XSS) vulnerability exists in the /admin?page=media endpoint in the file parameter, allowing an attacker to inject arbitrary JavaScript code. This code could be used to steal the user's session cookie, perform phishing attacks, or deface the website. This issue has been addressed in version 2.1.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability. 2024-11-25 not yet calculated CVE-2024-53255 bunkerity--bunkerweb  bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). A open redirect vulnerability exists in the loading endpoint, allowing attackers to redirect authenticated users to arbitrary external URLs via the "next" parameter. The loading endpoint accepts and uses an unvalidated "next" parameter for redirects. Ex. visiting: `/loading?next=https://google.com` while authenticated will cause the page will redirect to google.com. This vulnerability could be used in phishing attacks by redirecting users from a legitimate application URL to malicious sites. This issue has been addressed in version 1.5.11. Users are advised to upgrade. There are no known workarounds for this vulnerability. 2024-11-27 not yet calculated CVE-2024-53264 Century Systems Co., Ltd.--FutureNet NXR-G110 series  FutureNet NXR series routers provided by Century Systems Co., Ltd. have REST-APIs, which are configured as disabled in the initial (factory default) configuration. But, REST-APIs are unexpectedly enabled when the affected product is powered up, provided either http-server (GUI) or Web authentication is enabled. The factory default configuration makes http-server (GUI) enabled, which means REST-APIs are also enabled. The username and the password for REST-APIs are configured in the factory default configuration. As a result, an attacker may obtain and/or alter the affected product's settings via REST-APIs. 2024-11-29 not yet calculated CVE-2024-50357 Checkmk GmbH--Checkmk  Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions type] may result in an out-of-bounds access. To spot such missed invocations early in the future, checking the validity of link- >type in bpf_link_show_fdinfo() and emitting a warning when such invocations are missed. 2024-11-25 not yet calculated CVE-2024-53099 Linux--Linux  In the Linux kernel, the following vulnerability has been resolved: nvme: tcp: avoid race between queue_lock lock and destroy Commit 76d54bf20cdc ("nvme-tcp: don't access released socket during error recovery") added a mutex_lock() call for the queue- >queue_lock in nvme_tcp_get_address(). However, the mutex_lock() races with mutex_destroy() in nvme_tcp_free_queue(), and causes the WARN below. DEBUG_LOCKS_WARN_ON(lock- >magic != lock) WARNING: CPU: 3 PID: 34077 at kernel/locking/mutex.c:587 __mutex_lock+0xcf0/0x1220 Modules linked in: nvmet_tcp nvmet nvme_tcp nvme_fabrics iw_cm ib_cm ib_core pktcdvd nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables qrtr sunrpc ppdev 9pnet_virtio 9pnet pcspkr netfs parport_pc parport e1000 i2c_piix4 i2c_smbus loop fuse nfnetlink zram bochs drm_vram_helper drm_ttm_helper ttm drm_kms_helper xfs drm sym53c8xx floppy nvme scsi_transport_spi nvme_core nvme_auth serio_raw ata_generic pata_acpi dm_multipath qemu_fw_cfg [last unloaded: ib_uverbs] CPU: 3 UID: 0 PID: 34077 Comm: udisksd Not tainted 6.11.0-rc7 #319 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014 RIP: 0010:__mutex_lock+0xcf0/0x1220 Code: 08 84 d2 0f 85 c8 04 00 00 8b 15 ef b6 c8 01 85 d2 0f 85 78 f4 ff ff 48 c7 c6 20 93 ee af 48 c7 c7 60 91 ee af e8 f0 a7 6d fd 0b e9 5e f4 ff ff 48 b8 00 00 00 00 00 fc ff df 4c 89 f2 48 c1 RSP: 0018:ffff88811305f760 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffff88812c652058 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000001 RBP: ffff88811305f8b0 R08: 0000000000000001 R09: ffffed1075c36341 R10: ffff8883ae1b1a0b R11: 0000000000010498 R12: 0000000000000000 R13: 0000000000000000 R14: dffffc0000000000 R15: ffff88812c652058 FS: 00007f9713ae4980(0000) GS:ffff8883ae180000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fcd78483c7c CR3: 0000000122c38000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ? __warn.cold+0x5b/0x1af ? __mutex_lock+0xcf0/0x1220 ? report_bug+0x1ec/0x390 ? handle_bug+0x3c/0x80 ? exc_invalid_op+0x13/0x40 ? asm_exc_invalid_op+0x16/0x20 ? __mutex_lock+0xcf0/0x1220 ? nvme_tcp_get_address+0xc2/0x1e0 [nvme_tcp] ? __pfx___mutex_lock+0x10/0x10 ? __lock_acquire+0xd6a/0x59e0 ? nvme_tcp_get_address+0xc2/0x1e0 [nvme_tcp] nvme_tcp_get_address+0xc2/0x1e0 [nvme_tcp] ? __pfx_nvme_tcp_get_address+0x10/0x10 [nvme_tcp] nvme_sysfs_show_address+0x81/0xc0 [nvme_core] dev_attr_show+0x42/0x80 ? __asan_memset+0x1f/0x40 sysfs_kf_seq_show+0x1f0/0x370 seq_read_iter+0x2cb/0x1130 ? rw_verify_area+0x3b1/0x590 ? __mutex_lock+0x433/0x1220 vfs_read+0x6a6/0xa20 ? lockdep_hardirqs_on+0x78/0x100 ? __pfx_vfs_read+0x10/0x10 ksys_read+0xf7/0x1d0 ? __pfx_ksys_read+0x10/0x10 ? __x64_sys_openat+0x105/0x1d0 do_syscall_64+0x93/0x180 ? lockdep_hardirqs_on_prepare+0x16d/0x400 ? do_syscall_64+0x9f/0x180 ? lockdep_hardirqs_on+0x78/0x100 ? do_syscall_64+0x9f/0x180 ? __pfx_ksys_read+0x10/0x10 ? lockdep_hardirqs_on_prepare+0x16d/0x400 ? do_syscall_64+0x9f/0x180 ? lockdep_hardirqs_on+0x78/0x100 ? do_syscall_64+0x9f/0x180 ? lockdep_hardirqs_on_prepare+0x16d/0x400 ? do_syscall_64+0x9f/0x180 ? lockdep_hardirqs_on+0x78/0x100 ? do_syscall_64+0x9f/0x180 ? lockdep_hardirqs_on_prepare+0x16d/0x400 ? do_syscall_64+0x9f/0x180 ? lockdep_hardirqs_on+0x78/0x100 ? do_syscall_64+0x9f/0x180 ? lockdep_hardirqs_on_prepare+0x16d/0x400 ? do_syscall_64+0x9f/0x180 ? lockdep_hardirqs_on+0x78/0x100 ? do_syscall_64+0x9f/0x180 ? do_syscall_64+0x9f/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f9713f55cfa Code: 55 48 89 e5 48 83 ec 20 48 89 55 e8 48 89 75 f0 89 7d f8 e8 e8 74 f8 ff 48 8b 55 e8 48 8b 75 f0 4 ---truncated--- 2024-11-25 not yet calculated CVE-2024-53100 Linux--Linux  In the Linux kernel, the following vulnerability has been resolved: fs: Fix uninitialized value issue in from_kuid and from_kgid ocfs2_setattr() uses attr- >ia_mode, attr- >ia_uid and attr- >ia_gid in a trace point even though ATTR_MODE, ATTR_UID and ATTR_GID aren't set. Initialize all fields of newattrs to avoid uninitialized variables, by checking if ATTR_MODE, ATTR_UID, ATTR_GID are initialized, otherwise 0. 2024-11-25 not yet calculated CVE-2024-53101 Linux--Linux  In the Linux kernel, the following vulnerability has been resolved: nvme: make keep-alive synchronous operation The nvme keep-alive operation, which executes at a periodic interval, could potentially sneak in while shutting down a fabric controller. This may lead to a race between the fabric controller admin queue destroy code path (invoked while shutting down controller) and hw/hctx queue dispatcher called from the nvme keep-alive async request queuing operation. This race could lead to the kernel crash shown below: Call Trace: autoremove_wake_function+0x0/0xbc (unreliable) __blk_mq_sched_dispatch_requests+0x114/0x24c blk_mq_sched_dispatch_requests+0x44/0x84 blk_mq_run_hw_queue+0x140/0x220 nvme_keep_alive_work+0xc8/0x19c [nvme_core] process_one_work+0x200/0x4e0 worker_thread+0x340/0x504 kthread+0x138/0x140 start_kernel_thread+0x14/0x18 While shutting down fabric controller, if nvme keep-alive request sneaks in then it would be flushed off. The nvme_keep_alive_end_io function is then invoked to handle the end of the keep-alive operation which decrements the admin- >q_usage_counter and assuming this is the last/only request in the admin queue then the admin- >q_usage_counter becomes zero. If that happens then blk-mq destroy queue operation (blk_mq_destroy_ queue()) which could be potentially running simultaneously on another cpu (as this is the controller shutdown code path) would forward progress and deletes the admin queue. So, now from this point onward we are not supposed to access the admin queue resources. However the issue here's that the nvme keep-alive thread running hw/hctx queue dispatch operation hasn't yet finished its work and so it could still potentially access the admin queue resource while the admin queue had been already deleted and that causes the above crash. This fix helps avoid the observed crash by implementing keep-alive as a synchronous operation so that we decrement admin- >q_usage_counter only after keep-alive command finished its execution and returns the command status back up to its caller (blk_execute_rq()). This would ensure that fabric shutdown code path doesn't destroy the fabric admin queue until keep-alive request finished execution and also keep-alive thread is not running hw/hctx queue dispatch operation. 2024-11-25 not yet calculated CVE-2024-53102 Mozilla--Firefox  The application failed to account for exceptions thrown by the `loadManifestFromFile` method during add-on signature verification. This flaw, triggered by an invalid or unsupported extension manifest, could have caused runtime errors that disrupted the signature validation process. As a result, the enforcement of signature validation for unrelated add-ons may have been bypassed. Signature validation in this context is used to ensure that third-party applications on the user's computer have not tampered with the user's extensions, limiting the impact of this issue. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5. 2024-11-26 not yet calculated CVE-2024-11696 Mozilla--Firefox  On Android, Firefox may have inadvertently allowed viewing saved passwords without the required device PIN authentication. This vulnerability affects Firefox < 133. 2024-11-26 not yet calculated CVE-2024-11703 msg Suisse AG--EasyTax  A XML External Entity (XXE) vulnerability has been identified in Easy Tax Client Software 2023 1.2 and earlier across multiple platforms, including Windows, Linux, and macOS. 2024-11-29 not yet calculated CVE-2024-9044 n/a--n/a  FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse_options function of sbgdec.c within the libavformat module. When parsing certain options, the software does not adequately validate the input. This allows for negative duration values to be accepted without proper bounds checking. 2024-11-29 not yet calculated CVE-2024-35366 n/a--n/a  FFmpeg n6.1.1 has an Out-of-bounds Read via libavcodec/ppc/vp8dsp_altivec.c, static const vec_s8 h_subpel_filters_outer 2024-11-29 not yet calculated CVE-2024-35367 n/a--n/a  FFmpeg n7.0 is affected by a Double Free via the rkmpp_retrieve_frame function within libavcodec/rkmppdec.c. 2024-11-29 not yet calculated CVE-2024-35368 n/a--n/a  Ant-Media-Serverv2.8.2 is affected by Improper Output Neutralization for Logs. The vulnerability stems from insufficient input sanitization in the logging mechanism. Without proper filtering or validation, user-controllable data, such as identifiers or other sensitive information, can be included in log entries without restrictions. 2024-11-29 not yet calculated CVE-2024-35371 n/a--n/a  LinkStack 2.7.9 through 4.7.7 allows resourcesviewscomponentsfavicon.blade.php link SSRF. 2024-11-29 not yet calculated CVE-2024-35451 n/a--n/a  A deserialization vulnerability exists in the Stub class of the VarDumper module in Symfony v7.0.3. The vulnerability stems from deficiencies in the original implementation when handling properties with null or uninitialized values. An attacker could construct specific serialized data and use this vulnerability to execute unauthorized code. 2024-11-29 not yet calculated CVE-2024-36610 n/a--n/a  In Symfony v7.07, a security vulnerability was identified in the FormLoginAuthenticator component, where it failed to adequately handle cases where the username or password field of a login request is empty. This flaw could lead to various security risks, including improper authentication logic handling or denial of service. 2024-11-29 not yet calculated CVE-2024-36611 n/a--n/a  Zulip from 8.0 to 8.3 contains a memory leak vulnerability in the handling of popovers. 2024-11-29 not yet calculated CVE-2024-36612 n/a--n/a  FFmpeg n7.0 has a race condition vulnerability in the VP9 decoder. This could lead to a data race if video encoding parameters were being exported, as the side data would be attached in the decoder thread while being read in the output thread. 2024-11-29 not yet calculated CVE-2024-36615 n/a--n/a  An integer overflow in the component /libavformat/westwood_vqa.c of FFmpeg n6.1.1 allows attackers to cause a denial of service in the application via a crafted VQA file. 2024-11-29 not yet calculated CVE-2024-36616 n/a--n/a  FFmpeg n6.1.1 has an integer overflow vulnerability in the FFmpeg CAF decoder. 2024-11-29 not yet calculated CVE-2024-36617 n/a--n/a  FFmpeg n6.1.1 has a vulnerability in the AVI demuxer of the libavformat library which allows for an integer overflow, potentially resulting in a denial-of-service (DoS) condition. 2024-11-29 not yet calculated CVE-2024-36618 n/a--n/a  moby v25.0.0 - v26.0.2 is vulnerable to NULL Pointer Dereference via daemon/images/image_history.go. 2024-11-29 not yet calculated CVE-2024-36620 n/a--n/a  moby v25.0.5 is affected by a Race Condition in builder/builder-next/adapters/snapshot/layer.go. The vulnerability could be used to trigger concurrent builds that call the EnsureLayer function resulting in resource leaks/exhaustion. 2024-11-29 not yet calculated CVE-2024-36621 n/a--n/a  In RaspAP raspap-webgui 3.0.9 and earlier, a command injection vulnerability exists in the clearlog.php script. The vulnerability is due to improper sanitization of user input passed via the logfile parameter. 2024-11-29 not yet calculated CVE-2024-36622 n/a--n/a  moby v25.0.3 has a Race Condition vulnerability in the streamformatter package which can be used to trigger multiple concurrent write operations resulting in data corruption or application crashes. 2024-11-29 not yet calculated CVE-2024-36623 n/a--n/a  nodemcu before v3.0.0-release_20240225 was discovered to contain an integer overflow via the getnum function at /modules/struct.c. 2024-11-29 not yet calculated CVE-2024-36671 n/a--n/a  MSA FieldServer Gateway 5.0.0 through 6.5.2 allows cross-origin WebSocket hijacking. 2024-11-29 not yet calculated CVE-2024-45495 n/a--n/a  WithSecure Atlant (formerly F-Secure Atlant) 1.0.35-1 allows a remote Denial of Service because of memory corruption during scanning of a PE32 file. 2024-12-01 not yet calculated CVE-2024-45520 n/a--n/a  OpenVidReview 1.0 is vulnerable to Incorrect Access Control. The /upload route is accessible without authentication, allowing any user to upload files. 2024-11-27 not yet calculated CVE-2024-46054 n/a--n/a  Buffer Overflow vulnerability in SunBK201 umicat through v.0.3.2 and fixed in v.0.3.3 allows an attacker to execute arbitrary code via the power(uct_int_t x, uct_int_t n) in src/uct_upstream.c. 2024-11-29 not yet calculated CVE-2024-48406 n/a--n/a  Incorrect access control in Adapt Learning Adapt Authoring Tool

Read more »

Apple has 8th generation iPads in stock today for only $229
Apple has Certified Refurbished 8th-generation 10.2" WiFi iPads available on their online store for only $229 in Space Gray or Silver colors. An Apple one-year warranty is included with each iPad, outer cases are new, batteries are new, and shipping is free: - 8th-gen 10.2" 32GB WiFi iPad: $229 These iPads may not last very long, so check Apple's site for the very latest stock status. They are the cheapest iPads for sale today at Apple. Keep an eye on our iPad Price Tracker for the latest prices & sales from Apple and its resellers, updated daily.

Read more »

Here’s how to use your Education discount to take up to $300 off new MacBooks at Apple
Need a new Apple MacBook Air or MacBook Pro? If you're a student, teacher, or staff member at any educational institution, you can use your .edu email address when ordering at Apple Education to take up to $300 off the price of a new MacBook. Even parents of students can qualify. Education discounts are also available on most build-to-order options, such as extra RAM and more storage. Here are the Apple Education discounts on standard-configuration MacBooks: - 16" M4 Pro MacBook Pros: from $2299, $200 off - 16" M4 Max MacBook Pros: from $3199, $300 off - 14" M4 MacBook Pros: from $1499, $100 off - 14" M4 Pro MacBook Pros: from $1849, $150-$200 off - 14" M4 Max MacBook Pros: from $2899, $300 off - 15" M3 MacBook Air/16GB/256GB: $1199, $100 off - 15" M3 MacBook Air/16GB/512GB: $1399, $100 off - 15" M3 MacBook Air/24GB/512GB: $1599, $100 off - 13" M3 MacBook Pro/16GB/256GB: $999, $100 off - 13" M3 MacBook Pro/16GB/512GB: $1199, $100 off - 13" M3 MacBook Pro/24GB/512GB: $1399, $100 off - 13" M2 MacBook Air/256GB: $899, $100 off Details at Apple Education. Not in the US? Click for the Canada store.

Read more »

Here’s how to use your Education discount to take up to $300 off new MacBooks at Apple
Need a new Apple MacBook Air or MacBook Pro? If you're a student, teacher, or staff member at any educational institution, you can use your .edu email address when ordering at Apple Education to take up to $300 off the price of a new MacBook. Even parents of students can qualify. Education discounts are also available on most build-to-order options, such as extra RAM and more storage. Here are the Apple Education discounts on standard-configuration MacBooks: - 16" M4 Pro MacBook Pros: from $2299, $200 off - 16" M4 Max MacBook Pros: from $3199, $300 off - 14" M4 MacBook Pros: from $1499, $100 off - 14" M4 Pro MacBook Pros: from $1849, $150-$200 off - 14" M4 Max MacBook Pros: from $2899, $300 off - 15" M3 MacBook Air/16GB/256GB: $1199, $100 off - 15" M3 MacBook Air/16GB/512GB: $1399, $100 off - 15" M3 MacBook Air/24GB/512GB: $1599, $100 off - 13" M3 MacBook Pro/16GB/256GB: $999, $100 off - 13" M3 MacBook Pro/16GB/512GB: $1199, $100 off - 13" M3 MacBook Pro/24GB/512GB: $1399, $100 off - 13" M2 MacBook Air/256GB: $899, $100 off Details at Apple Education. Not in the US? Click for the Canada store.

Read more »

Free iPhone 16 at Boost Mobile plus Unlimited service for $65 per month with Infinite Access
Boost Mobile, an MVNO using AT&T and T-Mobile's networks, is offering a free 128GB iPhone 16, 16 Plus, or 16 Pro including service with their Unlimited plan (30GB of premium data) for a total charge of $65 per month...their Infinite Access Plan. The per month charge includes a new iPhone every year, plus the Unlimited network access charge. No trade-in is required. iPhones with more storage are also available, but for a few dollars more per month. This deal is live today at Boost Mobile. For the latest prices & sales, keep an eye on our iPhone Price Tracker, updated daily.

Read more »

Free iPhone 16 at Boost Mobile plus Unlimited service for $65 per month with Infinite Access
Boost Mobile, an MVNO using AT&T and T-Mobile's networks, is offering a free 128GB iPhone 16, 16 Plus, or 16 Pro including service with their Unlimited plan (30GB of premium data) for a total charge of $65 per month...their Infinite Access Plan. The per month charge includes a new iPhone every year, plus the Unlimited network access charge. No trade-in is required. iPhones with more storage are also available, but for a few dollars more per month. This deal is live today at Boost Mobile. For the latest prices & sales, keep an eye on our iPhone Price Tracker, updated daily.

Read more »

Amazon is offering a $100 discount on 7th-generation 2024 iPad minis
Amazon is offering $100 discounts on Apple's new 2024 WiFi iPad minis, each with free shipping. These are the lowest prices available for new minis anywhere. - 8.3" 128GB WiFi iPad mini: $399, $100 off MSRP - 8.3" 256GB WiFi iPad mini: $499, $100 off MSRP - 8.3" 512GB WiFi iPad mini: $699, $100 off MSRP For the latest prices and sales, see our iPad mini Price Tracker, updated daily.

Read more »

14-inch M4 MacBook Pros on sale today for $150-$200 off MSRP
B&H Photo has 14-inch M4 MacBook Pros on sale right now for $150-$200 off MSRP. B&H offers free 1-2 day shipping to most US addresses: - 14" M4 MacBook Pro (16GB/512GB/Gray): $1449, $150 off MSRP - 14" M4 MacBook Pro (16GB/1TB/Gray): $1599, $200 off MSRP - 14" M4 MacBook Pro (24GB/1TB/Gray): $1799, $200 off MSRP These are currently the lowest prices available for new M4-powered 14" MacBook Pros among the Apple retailers we track. For the latest sales and prices, keep an eye on our 14-inch MacBook Pro Price Tracker, updated daily.

Read more »

Clearance M2 Mac minis available starting at only $499
Best Buy has clearance M2 Mac minis available on their online store starting at $499. Sale prices for online orders only: - Mac mini M2 CPU (8GB/256GB): $499, save $100 - Mac mini M2 CPU (8GB/512GB): $599, save $200 For the latest prices and sales, keep an eye on our Mac mini Price Tracker, updated daily.

Read more »

Clearance 16-inch M3 Pro MacBook Pro (36GB/1TB) on sale for $2499, $400 off MSRP
Apple 16" MacBook Pros with M3 Pro CPUs are on clearance sale for $400 off original MSRP at B&H Photo. Snag a Space Black model with 36GB of memory and a 512GB SSD for only $2499, $400 off Apple's original asking price. B&H offers free 1-2 day shipping to most US addresses: - 16" M3 Pro MacBook Pro (36GB/512GB): $2499, $400 off MSRP For the latest prices and sales, see our 16" MacBook Pro Price Tracker, updated daily.

Read more »

Amazon has Apple Watch SE models on sale today for $50 off MSRP
Amazon has Apple Watch SE models on sale right now for $50 off MSRP, each including free shipping. Their prices are the lowest currently available for SE Watches: - 40mm Apple Watch SE GPS: $199, save $50 - 44mm Apple Watch SE GPS: $299, save $50 - 40mm Apple Watch SE GPS + Cellular: $249, save $50 - 44mm Apple Watch SE GPS + Cellular: $279, save $50 Note that their sale prices may be restricted to certain band colors (see their site for details), and stock is likely to come and go. For the latest prices & sales, keep an eye on our Apple Watch Price Tracker, updated daily.

Read more »

16-inch M4 Max MacBook Pros are on sale today for $400 off Apple’s MSRP
B&H Photo is offering a $350-$400 discount on new 16-inch MacBook Pros with M4 Max CPUs right now. B&H offers free 1-2 day shipping to most US addresses: - 16" M4 Max MacBook Pro (36GB/1TB/Black): $3149, $350 off MSRP - 16" M4 Max MacBook Pro (48GB/1TB/Black): $3599, $400 off MSRP Their prices are the lowest available today for new 16" M4 Max MacBook Pros among the Apple retailers we track. For the latest sales and prices, keep an eye on our 16-inch MacBook Pro Price Tracker, updated daily.

Read more »

Clearance Mac mini with M2 Pro CPU on clearance sale for only $899, $400 off original MSRP
Best Buy has clearance M2 Pro Mac minis on sale for $400 off original MSRP, now only $899. Sale price for online orders only, in-store price may vary. Order online, and choose free shipping or free local store pickup (if available): - Mac mini M2 Pro CPU (16GB/512GB): $899, save $400 For the latest prices and sales, keep an eye on our Mac mini Price Tracker, updated daily.

Read more »