News

Apple and Corning plan to open a new Apple-Corning Innovation Center at their Central Kentucky plant

Apple and Corning also plan to open a new Apple-Corning Innovation Center at the Central Kentucky plant that will play a role in the development and engineering of new materials for future products, the article adds. In August 2025 the two companies announced a...

Apple TV now has 8.5% of the streaming market (and lots of folks like such services ad-free)

Apple TV has seen a price hike, but that may not be a big problem. Within a month of canceling their pay TV subscriptions, around 31% of traditional cord-cutters signed up for a new streaming service during the first quarter — five times higher than the normal sign-up...

More MacTech News

Opinion

Analyst predicts features of the iPhone 17, iPhone 18, and iPhone 19

Talk about a powerful crystal ball! In a new Medium post, analyst Ming-Chi Kuo offers his predictions for the iPhone 17, iPhone 18, and iPhone 19 that will likely arrive in 2025, 2026, and 2027. He says the high-end iPhone 17 model is expected to feature an upgraded...

More Opinion

Scanners

Saturday August 29
01:02 am
9to5Mac Daily: August 28, 2026 – Foldable iPhone expectations, more | 9 to 5 Mac
9to5Mac Daily: August 28, 2026 – Foldable iPhone expectations, more
Listen to a recap of the top stories of the day from 9to5Mac. 9to5Mac Daily is available on iTunes and Apple’s Podcasts app, Stitcher, TuneIn, Google Play, or through our dedicated RSS feed for Overcast and other podcast players. Sponsored by Backblaze: Backup you can rely on. Save 20% with code 9to5daily.
Read more »
Friday August 28
10:30 pm
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month | 9 to 5 Mac
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month
The US has some of the most expensive mobile phone plans in the world, and many people are paying $60 to $100 per month or more without questioning it. Switching to Tello Mobile can bring the cost of your plan down to as little as $5 a month, and even the unlimited plan is just $25 a month – all while using America’s largest 5G network …
Read more »
10:30 pm
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month | 9 to 5 Mac
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month
The US has some of the most expensive mobile phone plans in the world, and many people are paying $60 to $100 per month or more without questioning it. Switching to Tello Mobile can bring the cost of your plan down to as little as $5 a month, and even the unlimited plan is just $25 a month – all while using America’s largest 5G network …
Read more »
10:30 pm
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month | 9 to 5 Mac
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month
The US has some of the most expensive mobile phone plans in the world, and many people are paying $60 to $100 per month or more without questioning it. Switching to Tello Mobile can bring the cost of your plan down to as little as $5 a month, and even the unlimited plan is just $25 a month – all while using America’s largest 5G network …
Read more »
10:30 pm
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month | 9 to 5 Mac
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month
The US has some of the most expensive mobile phone plans in the world, and many people are paying $60 to $100 per month or more without questioning it. Switching to Tello Mobile can bring the cost of your plan down to as little as $5 a month, and even the unlimited plan is just $25 a month – all while using America’s largest 5G network …
Read more »
10:30 pm
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month | 9 to 5 Mac
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month
The US has some of the most expensive mobile phone plans in the world, and many people are paying $60 to $100 per month or more without questioning it. Switching to Tello Mobile can bring the cost of your plan down to as little as $5 a month, and even the unlimited plan is just $25 a month – all while using America’s largest 5G network …
Read more »
10:30 pm
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month | 9 to 5 Mac
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month
The US has some of the most expensive mobile phone plans in the world, and many people are paying $60 to $100 per month or more without questioning it. Switching to Tello Mobile can bring the cost of your plan down to as little as $5 a month, and even the unlimited plan is just $25 a month – all while using America’s largest 5G network …
Read more »
10:30 pm
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month | 9 to 5 Mac
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month
The US has some of the most expensive mobile phone plans in the world, and many people are paying $60 to $100 per month or more without questioning it. Switching to Tello Mobile can bring the cost of your plan down to as little as $5 a month, and even the unlimited plan is just $25 a month – all while using America’s largest 5G network …
Read more »
10:30 pm
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month | 9 to 5 Mac
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month
The US has some of the most expensive mobile phone plans in the world, and many people are paying $60 to $100 per month or more without questioning it. Switching to Tello Mobile can bring the cost of your plan down to as little as $5 a month, and even the unlimited plan is just $25 a month – all while using America’s largest 5G network …
Read more »
10:30 pm
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month | 9 to 5 Mac
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month
The US has some of the most expensive mobile phone plans in the world, and many people are paying $60 to $100 per month or more without questioning it. Switching to Tello Mobile can bring the cost of your plan down to as little as $5 a month, and even the unlimited plan is just $25 a month – all while using America’s largest 5G network …
Read more »
10:30 pm
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month | 9 to 5 Mac
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month
The US has some of the most expensive mobile phone plans in the world, and many people are paying $60 to $100 per month or more without questioning it. Switching to Tello Mobile can bring the cost of your plan down to as little as $5 a month, and even the unlimited plan is just $25 a month – all while using America’s largest 5G network …
Read more »
10:30 pm
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month | 9 to 5 Mac
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month
The US has some of the most expensive mobile phone plans in the world, and many people are paying $60 to $100 per month or more without questioning it. Switching to Tello Mobile can bring the cost of your plan down to as little as $5 a month, and even the unlimited plan is just $25 a month – all while using America’s largest 5G network …
Read more »
10:30 pm
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month | 9 to 5 Mac
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month
The US has some of the most expensive mobile phone plans in the world, and many people are paying $60 to $100 per month or more without questioning it. Switching to Tello Mobile can bring the cost of your plan down to as little as $5 a month, and even the unlimited plan is just $25 a month – all while using America’s largest 5G network …
Read more »
10:30 pm
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month | 9 to 5 Mac
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month
The US has some of the most expensive mobile phone plans in the world, and many people are paying $60 to $100 per month or more without questioning it. Switching to Tello Mobile can bring the cost of your plan down to as little as $5 a month, and even the unlimited plan is just $25 a month – all while using America’s largest 5G network …
Read more »
10:30 pm
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month | 9 to 5 Mac
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month
The US has some of the most expensive mobile phone plans in the world, and many people are paying $60 to $100 per month or more without questioning it. Switching to Tello Mobile can bring the cost of your plan down to as little as $5 a month, and even the unlimited plan is just $25 a month – all while using America’s largest 5G network …
Read more »
10:30 pm
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month | 9 to 5 Mac
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month
The US has some of the most expensive mobile phone plans in the world, and many people are paying $60 to $100 per month or more without questioning it. Switching to Tello Mobile can bring the cost of your plan down to as little as $5 a month, and even the unlimited plan is just $25 a month – all while using America’s largest 5G network …
Read more »
10:30 pm
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month | 9 to 5 Mac
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month
The US has some of the most expensive mobile phone plans in the world, and many people are paying $60 to $100 per month or more without questioning it. Switching to Tello Mobile can bring the cost of your plan down to as little as $5 a month, and even the unlimited plan is just $25 a month – all while using America’s largest 5G network …
Read more »
10:30 pm
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month | 9 to 5 Mac
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month
The US has some of the most expensive mobile phone plans in the world, and many people are paying $60 to $100 per month or more without questioning it. Switching to Tello Mobile can bring the cost of your plan down to as little as $5 a month, and even the unlimited plan is just $25 a month – all while using America’s largest 5G network …
Read more »
10:30 pm
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month | 9 to 5 Mac
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month
The US has some of the most expensive mobile phone plans in the world, and many people are paying $60 to $100 per month or more without questioning it. Switching to Tello Mobile can bring the cost of your plan down to as little as $5 a month, and even the unlimited plan is just $25 a month – all while using America’s largest 5G network …
Read more »
10:30 pm
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month | 9 to 5 Mac
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month
The US has some of the most expensive mobile phone plans in the world, and many people are paying $60 to $100 per month or more without questioning it. Switching to Tello Mobile can bring the cost of your plan down to as little as $5 a month, and even the unlimited plan is just $25 a month – all while using America’s largest 5G network …
Read more »
10:30 pm
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month | 9 to 5 Mac
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month
The US has some of the most expensive mobile phone plans in the world, and many people are paying $60 to $100 per month or more without questioning it. Switching to Tello Mobile can bring the cost of your plan down to as little as $5 a month, and even the unlimited plan is just $25 a month – all while using America’s largest 5G network …
Read more »
10:30 pm
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month | 9 to 5 Mac
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month
The US has some of the most expensive mobile phone plans in the world, and many people are paying $60 to $100 per month or more without questioning it. Switching to Tello Mobile can bring the cost of your plan down to as little as $5 a month, and even the unlimited plan is just $25 a month – all while using America’s largest 5G network …
Read more »
10:30 pm
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month | 9 to 5 Mac
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month
The US has some of the most expensive mobile phone plans in the world, and many people are paying $60 to $100 per month or more without questioning it. Switching to Tello Mobile can bring the cost of your plan down to as little as $5 a month, and even the unlimited plan is just $25 a month – all while using America’s largest 5G network …
Read more »
10:30 pm
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month | 9 to 5 Mac
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month
The US has some of the most expensive mobile phone plans in the world, and many people are paying $60 to $100 per month or more without questioning it. Switching to Tello Mobile can bring the cost of your plan down to as little as $5 a month, and even the unlimited plan is just $25 a month – all while using America’s largest 5G network …
Read more »
10:30 pm
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month | 9 to 5 Mac
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month
The US has some of the most expensive mobile phone plans in the world, and many people are paying $60 to $100 per month or more without questioning it. Switching to Tello Mobile can bring the cost of your plan down to as little as $5 a month, and even the unlimited plan is just $25 a month – all while using America’s largest 5G network …
Read more »
10:30 pm
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month | 9 to 5 Mac
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month
The US has some of the most expensive mobile phone plans in the world, and many people are paying $60 to $100 per month or more without questioning it. Switching to Tello Mobile can bring the cost of your plan down to as little as $5 a month, and even the unlimited plan is just $25 a month – all while using America’s largest 5G network …
Read more »
10:30 pm
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month | 9 to 5 Mac
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month
The US has some of the most expensive mobile phone plans in the world, and many people are paying $60 to $100 per month or more without questioning it. Switching to Tello Mobile can bring the cost of your plan down to as little as $5 a month, and even the unlimited plan is just $25 a month – all while using America’s largest 5G network …
Read more »
10:30 pm
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month | 9 to 5 Mac
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month
The US has some of the most expensive mobile phone plans in the world, and many people are paying $60 to $100 per month or more without questioning it. Switching to Tello Mobile can bring the cost of your plan down to as little as $5 a month, and even the unlimited plan is just $25 a month – all while using America’s largest 5G network …
Read more »
10:30 pm
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month | 9 to 5 Mac
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month
The US has some of the most expensive mobile phone plans in the world, and many people are paying $60 to $100 per month or more without questioning it. Switching to Tello Mobile can bring the cost of your plan down to as little as $5 a month, and even the unlimited plan is just $25 a month – all while using America’s largest 5G network …
Read more »
10:30 pm
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month | 9 to 5 Mac
Most people overpay for their phone plan – Tello Mobile maxes out at $25/month
The US has some of the most expensive mobile phone plans in the world, and many people are paying $60 to $100 per month or more without questioning it. Switching to Tello Mobile can bring the cost of your plan down to as little as $5 a month, and even the unlimited plan is just $25 a month – all while using America’s largest 5G network …
Read more »

Friday August 28
07:24 pm
Steve Jobs' 8th Grade Science Project Sells for $34,375 | MacRumors
Steve Jobs' 8th Grade Science Project Sells for $34,375
A science project that Apple co-founder Steve Jobs built for his 8th-grade science fair sold at auction for $34,375. Jobs was attending Cupertino Jr. High when he designed the project, which is titled "What is the SCR?" The lot includes a display board built from plywood with three explanatory panels and a 10-page report with the same title. The left panel has a wooden model of a "typical silicon-controlled rectifier with its four alternate layers of P- and N-Type semiconductor material," while the center test circuits demonstrate the basic principles and characteristics of the silicon-controlled rectifier, as well as how it is most widely used. The right panel has a diagram and description of a 25-amp silicon-controlled rectifier. The project is labeled with Jobs' name, and the accompanying report is titled "What is the Silicon-Controlled Rectifier by Steve Jobs, Science, Mrs. Yakel, Feb. 29, 1968." A note included on the project instructs judges to plug in Circuit II and the oscilloscope to see it operate, and it asks them to "please unplug!" the device after testing it. Jobs' science fair project came from John Chovanec, Jobs' stepbrother. Chovanec's mother, Marilyn, married Paul Jobs in 1990 and continued to live in the Jobs family home in Los Altos. After Paul Jobs died in 1993, Steve Jobs declined to collect some of his personal belongings that remained in the home. Chovanec apparently asked Jobs to collect the items several times and at one point said he would keep the items himself instead. "Fine, but I don't want to be bothered about it again," Jobs reportedly responded. Chovanec previously sold other items from Jobs' early years, including posters, magazines, bow ties, a desk, and more. A 1977 Apple Computer poster sold for $659,900, while an Apple–1 Byte Shop wooden case owned by Jobs sold for $254,375. The bow ties sold for $113,580.Tag: Steve JobsThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
06:01 pm
Apple's Siri Settlement: Here's When iPhone Owners Can Submit Claims | MacRumors
Apple's Siri Settlement: Here's When iPhone Owners Can Submit Claims
In May, Apple agreed to pay $250 million to settle a U.S. class action lawsuit over Siri AI's delayed launch, and eligible iPhone users could receive up to a $95 payout. Today, a new court document revealed when customers will likely be able to begin submitting claims. If the dates proposed by Apple's lawyers are approved by the judge, eligible customers would begin to be notified about the settlement on Monday, September 21 this year, and claim submissions would likely begin around that date. The claims period would end on Monday, December 21, giving customers around 90 days to take action. Earlier this month, the judge set the final approval hearing for February 24, 2027, so payments to customers are not expected to begin until next year. For now, no action is required from customers, as the settlement website with a claims form has yet to go live. We will continue to provide updates on the case as they become available. Below, we have answered some key questions regarding the lawsuit. Why Was Apple Sued? In June 2024, Apple previewed new Siri capabilities powered by Apple Intelligence, including understanding of a user's personal context, on-screen awareness, and deeper per-app controls. For example, Apple showed an iPhone user asking Siri about their mother's flight and lunch reservation plans based on info from the Mail and Messages apps. Apple advertised those Siri features in product presentations, on its website, in a TV commercial starring actor Bella Ramsey, and elsewhere. In March 2025, Apple delayed the launch of the personalized version of Siri, leading to the company being hit with a class action lawsuit alleging false advertising. In a statement, Apple touted a range of other Apple Intelligence features it had already released. Nevertheless, Apple agreed to settle the lawsuit "to stay focused" on "delivering the most innovative products and services to our users." Apple finally announced "Siri AI" at WWDC 2026 in June, and the revamped assistant is available to test on the iOS 27 beta ahead of a September release. Am I Eligible? To be eligible to submit a claim, you must reside in the U.S. and have purchased any iPhone 15 Pro or iPhone 16 model between June 10, 2024 and March 29, 2025. The full list of eligible iPhone models: iPhone 15 Pro iPhone 15 Pro Max iPhone 16 iPhone 16e iPhone 16 Plus iPhone 16 Pro iPhone 16 Pro Max It is unlikely that individuals who submit a claim will still need to have physical possession of an eligible iPhone model. However, there is a possibility that proof of purchase or other information will be required, such as the device's serial number. Exact requirements will be outlined on the settlement website, which is still not live. How Much Will Apple Pay Me? According to the terms of the settlement, each person who files an eligible claim will receive a per-device payment of $25, but this amount could increase up to $95 if the total number of claims submitted is lower than anticipated. Where and When Can I Submit a Claim? Later this year, a settlement website is expected to go live with an online claims form.Tags: Apple Lawsuits, Siri, Siri AIThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
05:27 pm
Which Macs Will Get an M6 Chip and Which Won't? | MacRumors
Which Macs Will Get an M6 Chip and Which Won't?
Apple announced new Mac mini machines this week, and the lower-end models include the first M6 chip. The M6 era will be a little complicated, because few Macs are going to get it. We won't have M6 Pro or M6 Max chips, which shakes up the Mac lineup for the next couple of years. Subscribe to the MacRumors YouTube channel for more videos. Devices With M6 The ‌Mac mini‌ is the first Mac with an M6, but the chip is going to come to a couple of other products in the lineup. MacBook Pro - The 14-inch entry-level MacBook Pro could be updated with an M6 chip in October 2026. iMac - The 24-inch iMac is also expected to get the M6 chip, likely around the time the ‌MacBook Pro‌ is updated. MacBook Air - The MacBook Air could get the M6 chip in early 2027. iPad Pro - The next iPad Pro could get the M6 chip. iPad Air - A future version of the iPad Air is likely to adopt the M6. Apple usually keeps the ‌iPad Air‌ processor one generation behind the ‌iPad Pro‌. M6 Pro and M6 Max Apple isn't going to make M6 Pro or M6 Max chips, according to Bloomberg, so the M6 will be the first standalone Apple silicon chip that won't have more powerful variants. Instead of manufacturing M6 Pro and M6 Max chips, Apple is speeding up its chip development timeline to bring the M7 Pro and M7 Max to market more quickly. The M7 Pro and M7 Max will have technologies that support on-device AI and GPU-intensive software, so they better meet growing demand for processors with those capabilities. M5 Makes Up the Gap Macs that would have used an M6 Pro or M6 Max chip are going to be stuck with the M5 Pro and M5 Max until the M7 family is ready. That means the high-end OLED "MacBook Ultra" we're expecting in late 2026 or early 2027 is going to use the same M5 Pro and M5 Max chips that are in the current ‌MacBook Pro‌ models. It's also possible it will get the M5 Ultra. The new ‌Mac mini‌ also got the M5 Pro instead of an M6 Pro chip. The new Mac Studio announced alongside the ‌Mac mini‌ uses M5 Max and M5 Ultra chips. Short Life Span The M6 isn't going to be around for long, because Apple plans to launch the M7 in the first half of 2027. The M7 Pro and M7 Max will follow at the end of the year. M6 Features The M6 is Apple's first chip built on a new 2-nanometer process that increases transistor density on a smaller die. The process change improves performance and efficiency. It has a 12-core CPU with what Apple says is the world's fastest CPU core, a larger 12-core GPU with Neural Accelerators for each core, a new Dual 16-core Neural Engine, and up to 170GB/s memory bandwidth. The GPU has updated shader core architecture, Dynamic Caching, hardware-accelerated ray tracing, and 50 percent higher geometry rates for complex graphics.This article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
05:27 pm
Which Macs Will Get an M6 Chip and Which Won't? | MacRumors
Which Macs Will Get an M6 Chip and Which Won't?
Apple announced new Mac mini machines this week, and the lower-end models include the first M6 chip. The M6 era will be a little complicated, because few Macs are going to get it. We won't have M6 Pro or M6 Max chips, which shakes up the Mac lineup for the next couple of years. Subscribe to the MacRumors YouTube channel for more videos. Devices With M6 The ‌Mac mini‌ is the first Mac with an M6, but the chip is going to come to a couple of other products in the lineup. MacBook Pro - The 14-inch entry-level MacBook Pro could be updated with an M6 chip in October 2026. iMac - The 24-inch iMac is also expected to get the M6 chip, likely around the time the ‌MacBook Pro‌ is updated. MacBook Air - The MacBook Air could get the M6 chip in early 2027. iPad Pro - The next iPad Pro could get the M6 chip. iPad Air - A future version of the iPad Air is likely to adopt the M6. Apple usually keeps the ‌iPad Air‌ processor one generation behind the ‌iPad Pro‌. M6 Pro and M6 Max Apple isn't going to make M6 Pro or M6 Max chips, according to Bloomberg, so the M6 will be the first standalone Apple silicon chip that won't have more powerful variants. Instead of manufacturing M6 Pro and M6 Max chips, Apple is speeding up its chip development timeline to bring the M7 Pro and M7 Max to market more quickly. The M7 Pro and M7 Max will have technologies that support on-device AI and GPU-intensive software, so they better meet growing demand for processors with those capabilities. M5 Makes Up the Gap Macs that would have used an M6 Pro or M6 Max chip are going to be stuck with the M5 Pro and M5 Max until the M7 family is ready. That means the high-end OLED "MacBook Ultra" we're expecting in late 2026 or early 2027 is going to use the same M5 Pro and M5 Max chips that are in the current ‌MacBook Pro‌ models. It's also possible it will get the M5 Ultra. The new ‌Mac mini‌ also got the M5 Pro instead of an M6 Pro chip. The new Mac Studio announced alongside the ‌Mac mini‌ uses M5 Max and M5 Ultra chips. Short Life Span The M6 isn't going to be around for long, because Apple plans to launch the M7 in the first half of 2027. The M7 Pro and M7 Max will follow at the end of the year. M6 Features The M6 is Apple's first chip built on a new 2-nanometer process that increases transistor density on a smaller die. The process change improves performance and efficiency. It has a 12-core CPU with what Apple says is the world's fastest CPU core, a larger 12-core GPU with Neural Accelerators for each core, a new Dual 16-core Neural Engine, and up to 170GB/s memory bandwidth. The GPU has updated shader core architecture, Dynamic Caching, hardware-accelerated ray tracing, and 50 percent higher geometry rates for complex graphics.This article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
05:27 pm
Which Macs Will Get an M6 Chip and Which Won't? | MacRumors
Which Macs Will Get an M6 Chip and Which Won't?
Apple announced new Mac mini machines this week, and the lower-end models include the first M6 chip. The M6 era will be a little complicated, because few Macs are going to get it. We won't have M6 Pro or M6 Max chips, which shakes up the Mac lineup for the next couple of years. Subscribe to the MacRumors YouTube channel for more videos. Devices With M6 The ‌Mac mini‌ is the first Mac with an M6, but the chip is going to come to a couple of other products in the lineup. MacBook Pro - The 14-inch entry-level MacBook Pro could be updated with an M6 chip in October 2026. iMac - The 24-inch iMac is also expected to get the M6 chip, likely around the time the ‌MacBook Pro‌ is updated. MacBook Air - The MacBook Air could get the M6 chip in early 2027. iPad Pro - The next iPad Pro could get the M6 chip. iPad Air - A future version of the iPad Air is likely to adopt the M6. Apple usually keeps the ‌iPad Air‌ processor one generation behind the ‌iPad Pro‌. M6 Pro and M6 Max Apple isn't going to make M6 Pro or M6 Max chips, according to Bloomberg, so the M6 will be the first standalone Apple silicon chip that won't have more powerful variants. Instead of manufacturing M6 Pro and M6 Max chips, Apple is speeding up its chip development timeline to bring the M7 Pro and M7 Max to market more quickly. The M7 Pro and M7 Max will have technologies that support on-device AI and GPU-intensive software, so they better meet growing demand for processors with those capabilities. M5 Makes Up the Gap Macs that would have used an M6 Pro or M6 Max chip are going to be stuck with the M5 Pro and M5 Max until the M7 family is ready. That means the high-end OLED "MacBook Ultra" we're expecting in late 2026 or early 2027 is going to use the same M5 Pro and M5 Max chips that are in the current ‌MacBook Pro‌ models. It's also possible it will get the M5 Ultra. The new ‌Mac mini‌ also got the M5 Pro instead of an M6 Pro chip. The new Mac Studio announced alongside the ‌Mac mini‌ uses M5 Max and M5 Ultra chips. Short Life Span The M6 isn't going to be around for long, because Apple plans to launch the M7 in the first half of 2027. The M7 Pro and M7 Max will follow at the end of the year. M6 Features The M6 is Apple's first chip built on a new 2-nanometer process that increases transistor density on a smaller die. The process change improves performance and efficiency. It has a 12-core CPU with what Apple says is the world's fastest CPU core, a larger 12-core GPU with Neural Accelerators for each core, a new Dual 16-core Neural Engine, and up to 170GB/s memory bandwidth. The GPU has updated shader core architecture, Dynamic Caching, hardware-accelerated ray tracing, and 50 percent higher geometry rates for complex graphics.This article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
05:27 pm
Which Macs Will Get an M6 Chip and Which Won't? | MacRumors
Which Macs Will Get an M6 Chip and Which Won't?
Apple announced new Mac mini machines this week, and the lower-end models include the first M6 chip. The M6 era will be a little complicated, because few Macs are going to get it. We won't have M6 Pro or M6 Max chips, which shakes up the Mac lineup for the next couple of years. Subscribe to the MacRumors YouTube channel for more videos. Devices With M6 The ‌Mac mini‌ is the first Mac with an M6, but the chip is going to come to a couple of other products in the lineup. MacBook Pro - The 14-inch entry-level MacBook Pro could be updated with an M6 chip in October 2026. iMac - The 24-inch iMac is also expected to get the M6 chip, likely around the time the ‌MacBook Pro‌ is updated. MacBook Air - The MacBook Air could get the M6 chip in early 2027. iPad Pro - The next iPad Pro could get the M6 chip. iPad Air - A future version of the iPad Air is likely to adopt the M6. Apple usually keeps the ‌iPad Air‌ processor one generation behind the ‌iPad Pro‌. M6 Pro and M6 Max Apple isn't going to make M6 Pro or M6 Max chips, according to Bloomberg, so the M6 will be the first standalone Apple silicon chip that won't have more powerful variants. Instead of manufacturing M6 Pro and M6 Max chips, Apple is speeding up its chip development timeline to bring the M7 Pro and M7 Max to market more quickly. The M7 Pro and M7 Max will have technologies that support on-device AI and GPU-intensive software, so they better meet growing demand for processors with those capabilities. M5 Makes Up the Gap Macs that would have used an M6 Pro or M6 Max chip are going to be stuck with the M5 Pro and M5 Max until the M7 family is ready. That means the high-end OLED "MacBook Ultra" we're expecting in late 2026 or early 2027 is going to use the same M5 Pro and M5 Max chips that are in the current ‌MacBook Pro‌ models. It's also possible it will get the M5 Ultra. The new ‌Mac mini‌ also got the M5 Pro instead of an M6 Pro chip. The new Mac Studio announced alongside the ‌Mac mini‌ uses M5 Max and M5 Ultra chips. Short Life Span The M6 isn't going to be around for long, because Apple plans to launch the M7 in the first half of 2027. The M7 Pro and M7 Max will follow at the end of the year. M6 Features The M6 is Apple's first chip built on a new 2-nanometer process that increases transistor density on a smaller die. The process change improves performance and efficiency. It has a 12-core CPU with what Apple says is the world's fastest CPU core, a larger 12-core GPU with Neural Accelerators for each core, a new Dual 16-core Neural Engine, and up to 170GB/s memory bandwidth. The GPU has updated shader core architecture, Dynamic Caching, hardware-accelerated ray tracing, and 50 percent higher geometry rates for complex graphics.This article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
05:27 pm
Which Macs Will Get an M6 Chip and Which Won't? | MacRumors
Which Macs Will Get an M6 Chip and Which Won't?
Apple announced new Mac mini machines this week, and the lower-end models include the first M6 chip. The M6 era will be a little complicated, because few Macs are going to get it. We won't have M6 Pro or M6 Max chips, which shakes up the Mac lineup for the next couple of years. Subscribe to the MacRumors YouTube channel for more videos. Devices With M6 The ‌Mac mini‌ is the first Mac with an M6, but the chip is going to come to a couple of other products in the lineup. MacBook Pro - The 14-inch entry-level MacBook Pro could be updated with an M6 chip in October 2026. iMac - The 24-inch iMac is also expected to get the M6 chip, likely around the time the ‌MacBook Pro‌ is updated. MacBook Air - The MacBook Air could get the M6 chip in early 2027. iPad Pro - The next iPad Pro could get the M6 chip. iPad Air - A future version of the iPad Air is likely to adopt the M6. Apple usually keeps the ‌iPad Air‌ processor one generation behind the ‌iPad Pro‌. M6 Pro and M6 Max Apple isn't going to make M6 Pro or M6 Max chips, according to Bloomberg, so the M6 will be the first standalone Apple silicon chip that won't have more powerful variants. Instead of manufacturing M6 Pro and M6 Max chips, Apple is speeding up its chip development timeline to bring the M7 Pro and M7 Max to market more quickly. The M7 Pro and M7 Max will have technologies that support on-device AI and GPU-intensive software, so they better meet growing demand for processors with those capabilities. M5 Makes Up the Gap Macs that would have used an M6 Pro or M6 Max chip are going to be stuck with the M5 Pro and M5 Max until the M7 family is ready. That means the high-end OLED "MacBook Ultra" we're expecting in late 2026 or early 2027 is going to use the same M5 Pro and M5 Max chips that are in the current ‌MacBook Pro‌ models. It's also possible it will get the M5 Ultra. The new ‌Mac mini‌ also got the M5 Pro instead of an M6 Pro chip. The new Mac Studio announced alongside the ‌Mac mini‌ uses M5 Max and M5 Ultra chips. Short Life Span The M6 isn't going to be around for long, because Apple plans to launch the M7 in the first half of 2027. The M7 Pro and M7 Max will follow at the end of the year. M6 Features The M6 is Apple's first chip built on a new 2-nanometer process that increases transistor density on a smaller die. The process change improves performance and efficiency. It has a 12-core CPU with what Apple says is the world's fastest CPU core, a larger 12-core GPU with Neural Accelerators for each core, a new Dual 16-core Neural Engine, and up to 170GB/s memory bandwidth. The GPU has updated shader core architecture, Dynamic Caching, hardware-accelerated ray tracing, and 50 percent higher geometry rates for complex graphics.This article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
04:16 pm
This New App Brings 1990s 'After Dark' Screen Savers to Modern macOS | MacRumors
This New App Brings 1990s 'After Dark' Screen Savers to Modern macOS
As noted by Daring Fireball's John Gruber, developer Jeff Halter has released a new Afterglow app that allows you to run classic After Dark screen savers on modern macOS versions. "Afterglow is an emulator built specifically for running After Dark modules -- the original 68k module code, not a remake or port -- with no dependencies on ROMs or classic Mac OS," said Halter, who has several fun nostalgic projects, such as After Dark space shooter Lunacy and HyperCard player Stacks.This article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
04:16 pm
This New App Brings 1990s 'After Dark' Screen Savers to Modern macOS | MacRumors
This New App Brings 1990s 'After Dark' Screen Savers to Modern macOS
As noted by Daring Fireball's John Gruber, developer Jeff Halter has released a new Afterglow app that allows you to run classic After Dark screen savers on modern macOS versions. "Afterglow is an emulator built specifically for running After Dark modules -- the original 68k module code, not a remake or port -- with no dependencies on ROMs or classic Mac OS," said Halter, who has several fun nostalgic projects, such as After Dark space shooter Lunacy and HyperCard player Stacks.This article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
04:16 pm
This New App Brings 1990s 'After Dark' Screen Savers to Modern macOS | MacRumors
This New App Brings 1990s 'After Dark' Screen Savers to Modern macOS
As noted by Daring Fireball's John Gruber, developer Jeff Halter has released a new Afterglow app that allows you to run classic After Dark screen savers on modern macOS versions. "Afterglow is an emulator built specifically for running After Dark modules -- the original 68k module code, not a remake or port -- with no dependencies on ROMs or classic Mac OS," said Halter, who has several fun nostalgic projects, such as After Dark space shooter Lunacy and HyperCard player Stacks.This article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
04:16 pm
This New App Brings 1990s 'After Dark' Screen Savers to Modern macOS | MacRumors
This New App Brings 1990s 'After Dark' Screen Savers to Modern macOS
As noted by Daring Fireball's John Gruber, developer Jeff Halter has released a new Afterglow app that allows you to run classic After Dark screen savers on modern macOS versions. "Afterglow is an emulator built specifically for running After Dark modules -- the original 68k module code, not a remake or port -- with no dependencies on ROMs or classic Mac OS," said Halter, who has several fun nostalgic projects, such as After Dark space shooter Lunacy and HyperCard player Stacks.This article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
04:16 pm
This New App Brings 1990s 'After Dark' Screen Savers to Modern macOS | MacRumors
This New App Brings 1990s 'After Dark' Screen Savers to Modern macOS
As noted by Daring Fireball's John Gruber, developer Jeff Halter has released a new Afterglow app that allows you to run classic After Dark screen savers on modern macOS versions. "Afterglow is an emulator built specifically for running After Dark modules -- the original 68k module code, not a remake or port -- with no dependencies on ROMs or classic Mac OS," said Halter, who has several fun nostalgic projects, such as After Dark space shooter Lunacy and HyperCard player Stacks.This article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
04:12 pm
The MacRumors Show: Apple's Surprisingly Big Week of Announcements | MacRumors
The MacRumors Show: Apple's Surprisingly Big Week of Announcements
It's been an unusually big week for Apple announcements. On this week's episode of The MacRumors Show, we discuss the new Mac mini and Mac Studio, the M6 and M5 Ultra chips, and invites to Apple's September event. Subscribe to The MacRumors Show YouTube channel for more videos Apple confirmed on Wednesday that its annual iPhone event will take place on Wednesday, September 9 at Apple Park, starting at 10:00 a.m. Pacific Time, with select members of the media invited to attend. The event's tagline is "Surprise and Shine." Apple is expected to introduce at least six new products, including the the Apple Watch Series 12, Apple Watch Ultra 4, iPhone 18 Pro, ‌iPhone 18 Pro‌ Max, and the first foldable iPhone. Pre-orders should follow shortly after, and along with release dates for iOS 27, iPadOS 27 and macOS 27 Golden Gate. Apple announced the new Mac mini on Tuesday, offering M6 and M5 Pro chip options. The machine gains an N1 networking chip, bringing Wi-Fi 7 and Bluetooth 6, and moves to 2.5Gb Ethernet as standard, up from 1Gb, with a 10Gb option. Thunderbolt 5 is restricted to the M5 Pro model, which gets three Thunderbolt 5 ports while the M6 model keeps Thunderbolt 4. Genlock support over USB-C also helps to sync a display's refresh timing to a camera such as the iPhone 17 Pro. Pricing starts at $899 with 16GB and 256GB, rising to $1,699 for the M5 Pro at 24GB and 512GB. Pre-orders are now open, with launch on September 22. The M6 is Apple's first 2nm chip. Its 12-core CPU is split into 2 super cores, 4 performance cores and 6 efficiency cores, making it the first Apple chip to combine all three core types in one design. Super cores are Apple's top tier, optimized for single-threaded speed. The 12-core GPU features a Neural Accelerator in each core for the first time in a ‌Mac mini‌. The GPU also adds an updated shader architecture, Dynamic Caching, and hardware-accelerated ray tracing, while an all-new Dual 16-core Neural Engine doubles peak compute over the previous generation, with system frameworks able to drive both engines at once. Memory starts at 16GB and tops out at 32GB, running at up to 170GB/s. M5 Pro scales further, to an 18-core CPU, a 20-core GPU and up to 64GB at 307GB/s. The new Mac Studio arrived alongside the ‌Mac mini‌, with M5 Max and M5 Ultra chip options. The M5 Max offers an 18-core CPU with 6 super cores and 12 performance cores, an up-to-40-core GPU with Neural Accelerators in every core, and up to 128GB of memory at 614GB/s, with the GPU running up to 50% faster than the previous generation. Both configurations move to a next-generation SSD architecture on PCIe Gen 6 for up to twice the storage performance, and gain up to six Thunderbolt 5 ports at 120Gb/s, and the same genlock support as the ‌Mac mini‌. Apple's N1 chip also brings Wi-Fi 7 and Bluetooth 6 to the ‌Mac Studio‌. Pricing starts at $2,499 for the M5 Max at 36GB and 512GB, and $5,499 for the M5 Ultra at 96GB and 1TB, with the 512GB memory option not arriving until late October. The M5 Ultra is Apple's first quad-die chip, using a next-generation version of UltraFusion to join two dual-die M5 Max chips into a single processor. The result is a CPU with up to 36 cores, 12 super and 24 performance, delivering 1.25x the single-threaded and 1.3x the multithreaded performance of the M3 Ultra. Its up-to-80-core GPU is the most powerful Apple silicon GPU ever made and the first on an Ultra chip to feature Neural Accelerators. Second-generation Dynamic Caching, hardware-accelerated mesh shading and third-generation ray tracing lift graphics up 40% over the M3 Ultra, and the chip features a 32-core Neural Engine. Memory reaches 512GB at 1.2TB/s, which is a 50% bandwidth increase. Other announcements this week included a new, softer Apple Polishing Cloth at $9, down from $19, and refreshed U.S. Magic Keyboards for the Mac, now featuring glyphs instead of edge text. Apple Support's 1-800-APL-CARE line is also now answered by a generative AI assistant in the U.S. and Canada. The MacRumors Show has its own YouTube channel, so make sure you're subscribed to keep up with new episodes and clips. Subscribe to The MacRumors Show YouTube channel! You can also listen to ‌The MacRumors Show‌ on Apple Podcasts, Spotify, Overcast, or other podcast apps. You can also copy our RSS feed directly into your player. If you haven't already listened to the previous episode of The MacRumors Show, catch up to hear our discussion with YouTuber Michael Fisher about key rumors about the "iPhone Ultra" and how the device could compare to rivals. Subscribe to ‌The MacRumors Show‌ for new episodes every week, where we discuss some of the topical news breaking here on MacRumors, often joined by interesting guests such as Kayci Lacob, Kevin Nether, John Gruber, Mark Gurman, Jon Prosser, Luke Miani, Matthew Cassinelli, Brian Tong, Quinn Nelson, Jared Nelson, Eli Hodapp, Mike Bell, Sara Dietschy, iJustine, Jon Rettinger, Andru Edwards, Arnold Kim, Ben Sullins, Marcus Kane, Christopher Lawley, Frank McShan, David Lewis, Tyler Stalman, Sam Kohl, Federico Viticci, Thomas Frank, Jonathan Morrison, Ross Young, Ian Zelbo, and Rene Ritchie. ‌The MacRumors Show‌ is on X @MacRumorsShow, so be sure to give us a follow to keep up with the podcast. You can also email us at podcast@macrumors.com or head over to The MacRumors Show forum thread. Remember to rate and review the podcast, and let us know what subjects and guests you would like to see in the future.Tag: The MacRumors ShowThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
04:12 pm
The MacRumors Show: Apple's Surprisingly Big Week of Announcements | MacRumors
The MacRumors Show: Apple's Surprisingly Big Week of Announcements
It's been an unusually big week for Apple announcements. On this week's episode of The MacRumors Show, we discuss the new Mac mini and Mac Studio, the M6 and M5 Ultra chips, and invites to Apple's September event. Subscribe to The MacRumors Show YouTube channel for more videos Apple confirmed on Wednesday that its annual iPhone event will take place on Wednesday, September 9 at Apple Park, starting at 10:00 a.m. Pacific Time, with select members of the media invited to attend. The event's tagline is "Surprise and Shine." Apple is expected to introduce at least six new products, including the the Apple Watch Series 12, Apple Watch Ultra 4, iPhone 18 Pro, ‌iPhone 18 Pro‌ Max, and the first foldable iPhone. Pre-orders should follow shortly after, and along with release dates for iOS 27, iPadOS 27 and macOS 27 Golden Gate. Apple announced the new Mac mini on Tuesday, offering M6 and M5 Pro chip options. The machine gains an N1 networking chip, bringing Wi-Fi 7 and Bluetooth 6, and moves to 2.5Gb Ethernet as standard, up from 1Gb, with a 10Gb option. Thunderbolt 5 is restricted to the M5 Pro model, which gets three Thunderbolt 5 ports while the M6 model keeps Thunderbolt 4. Genlock support over USB-C also helps to sync a display's refresh timing to a camera such as the iPhone 17 Pro. Pricing starts at $899 with 16GB and 256GB, rising to $1,699 for the M5 Pro at 24GB and 512GB. Pre-orders are now open, with launch on September 22. The M6 is Apple's first 2nm chip. Its 12-core CPU is split into 2 super cores, 4 performance cores and 6 efficiency cores, making it the first Apple chip to combine all three core types in one design. Super cores are Apple's top tier, optimized for single-threaded speed. The 12-core GPU features a Neural Accelerator in each core for the first time in a ‌Mac mini‌. The GPU also adds an updated shader architecture, Dynamic Caching, and hardware-accelerated ray tracing, while an all-new Dual 16-core Neural Engine doubles peak compute over the previous generation, with system frameworks able to drive both engines at once. Memory starts at 16GB and tops out at 32GB, running at up to 170GB/s. M5 Pro scales further, to an 18-core CPU, a 20-core GPU and up to 64GB at 307GB/s. The new Mac Studio arrived alongside the ‌Mac mini‌, with M5 Max and M5 Ultra chip options. The M5 Max offers an 18-core CPU with 6 super cores and 12 performance cores, an up-to-40-core GPU with Neural Accelerators in every core, and up to 128GB of memory at 614GB/s, with the GPU running up to 50% faster than the previous generation. Both configurations move to a next-generation SSD architecture on PCIe Gen 6 for up to twice the storage performance, and gain up to six Thunderbolt 5 ports at 120Gb/s, and the same genlock support as the ‌Mac mini‌. Apple's N1 chip also brings Wi-Fi 7 and Bluetooth 6 to the ‌Mac Studio‌. Pricing starts at $2,499 for the M5 Max at 36GB and 512GB, and $5,499 for the M5 Ultra at 96GB and 1TB, with the 512GB memory option not arriving until late October. The M5 Ultra is Apple's first quad-die chip, using a next-generation version of UltraFusion to join two dual-die M5 Max chips into a single processor. The result is a CPU with up to 36 cores, 12 super and 24 performance, delivering 1.25x the single-threaded and 1.3x the multithreaded performance of the M3 Ultra. Its up-to-80-core GPU is the most powerful Apple silicon GPU ever made and the first on an Ultra chip to feature Neural Accelerators. Second-generation Dynamic Caching, hardware-accelerated mesh shading and third-generation ray tracing lift graphics up 40% over the M3 Ultra, and the chip features a 32-core Neural Engine. Memory reaches 512GB at 1.2TB/s, which is a 50% bandwidth increase. Other announcements this week included a new, softer Apple Polishing Cloth at $9, down from $19, and refreshed U.S. Magic Keyboards for the Mac, now featuring glyphs instead of edge text. Apple Support's 1-800-APL-CARE line is also now answered by a generative AI assistant in the U.S. and Canada. The MacRumors Show has its own YouTube channel, so make sure you're subscribed to keep up with new episodes and clips. Subscribe to The MacRumors Show YouTube channel! You can also listen to ‌The MacRumors Show‌ on Apple Podcasts, Spotify, Overcast, or other podcast apps. You can also copy our RSS feed directly into your player. If you haven't already listened to the previous episode of The MacRumors Show, catch up to hear our discussion with YouTuber Michael Fisher about key rumors about the "iPhone Ultra" and how the device could compare to rivals. Subscribe to ‌The MacRumors Show‌ for new episodes every week, where we discuss some of the topical news breaking here on MacRumors, often joined by interesting guests such as Kayci Lacob, Kevin Nether, John Gruber, Mark Gurman, Jon Prosser, Luke Miani, Matthew Cassinelli, Brian Tong, Quinn Nelson, Jared Nelson, Eli Hodapp, Mike Bell, Sara Dietschy, iJustine, Jon Rettinger, Andru Edwards, Arnold Kim, Ben Sullins, Marcus Kane, Christopher Lawley, Frank McShan, David Lewis, Tyler Stalman, Sam Kohl, Federico Viticci, Thomas Frank, Jonathan Morrison, Ross Young, Ian Zelbo, and Rene Ritchie. ‌The MacRumors Show‌ is on X @MacRumorsShow, so be sure to give us a follow to keep up with the podcast. You can also email us at podcast@macrumors.com or head over to The MacRumors Show forum thread. Remember to rate and review the podcast, and let us know what subjects and guests you would like to see in the future.Tag: The MacRumors ShowThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
04:12 pm
The MacRumors Show: Apple's Surprisingly Big Week of Announcements | MacRumors
The MacRumors Show: Apple's Surprisingly Big Week of Announcements
It's been an unusually big week for Apple announcements. On this week's episode of The MacRumors Show, we discuss the new Mac mini and Mac Studio, the M6 and M5 Ultra chips, and invites to Apple's September event. Subscribe to The MacRumors Show YouTube channel for more videos Apple confirmed on Wednesday that its annual iPhone event will take place on Wednesday, September 9 at Apple Park, starting at 10:00 a.m. Pacific Time, with select members of the media invited to attend. The event's tagline is "Surprise and Shine." Apple is expected to introduce at least six new products, including the the Apple Watch Series 12, Apple Watch Ultra 4, iPhone 18 Pro, ‌iPhone 18 Pro‌ Max, and the first foldable iPhone. Pre-orders should follow shortly after, and along with release dates for iOS 27, iPadOS 27 and macOS 27 Golden Gate. Apple announced the new Mac mini on Tuesday, offering M6 and M5 Pro chip options. The machine gains an N1 networking chip, bringing Wi-Fi 7 and Bluetooth 6, and moves to 2.5Gb Ethernet as standard, up from 1Gb, with a 10Gb option. Thunderbolt 5 is restricted to the M5 Pro model, which gets three Thunderbolt 5 ports while the M6 model keeps Thunderbolt 4. Genlock support over USB-C also helps to sync a display's refresh timing to a camera such as the iPhone 17 Pro. Pricing starts at $899 with 16GB and 256GB, rising to $1,699 for the M5 Pro at 24GB and 512GB. Pre-orders are now open, with launch on September 22. The M6 is Apple's first 2nm chip. Its 12-core CPU is split into 2 super cores, 4 performance cores and 6 efficiency cores, making it the first Apple chip to combine all three core types in one design. Super cores are Apple's top tier, optimized for single-threaded speed. The 12-core GPU features a Neural Accelerator in each core for the first time in a ‌Mac mini‌. The GPU also adds an updated shader architecture, Dynamic Caching, and hardware-accelerated ray tracing, while an all-new Dual 16-core Neural Engine doubles peak compute over the previous generation, with system frameworks able to drive both engines at once. Memory starts at 16GB and tops out at 32GB, running at up to 170GB/s. M5 Pro scales further, to an 18-core CPU, a 20-core GPU and up to 64GB at 307GB/s. The new Mac Studio arrived alongside the ‌Mac mini‌, with M5 Max and M5 Ultra chip options. The M5 Max offers an 18-core CPU with 6 super cores and 12 performance cores, an up-to-40-core GPU with Neural Accelerators in every core, and up to 128GB of memory at 614GB/s, with the GPU running up to 50% faster than the previous generation. Both configurations move to a next-generation SSD architecture on PCIe Gen 6 for up to twice the storage performance, and gain up to six Thunderbolt 5 ports at 120Gb/s, and the same genlock support as the ‌Mac mini‌. Apple's N1 chip also brings Wi-Fi 7 and Bluetooth 6 to the ‌Mac Studio‌. Pricing starts at $2,499 for the M5 Max at 36GB and 512GB, and $5,499 for the M5 Ultra at 96GB and 1TB, with the 512GB memory option not arriving until late October. The M5 Ultra is Apple's first quad-die chip, using a next-generation version of UltraFusion to join two dual-die M5 Max chips into a single processor. The result is a CPU with up to 36 cores, 12 super and 24 performance, delivering 1.25x the single-threaded and 1.3x the multithreaded performance of the M3 Ultra. Its up-to-80-core GPU is the most powerful Apple silicon GPU ever made and the first on an Ultra chip to feature Neural Accelerators. Second-generation Dynamic Caching, hardware-accelerated mesh shading and third-generation ray tracing lift graphics up 40% over the M3 Ultra, and the chip features a 32-core Neural Engine. Memory reaches 512GB at 1.2TB/s, which is a 50% bandwidth increase. Other announcements this week included a new, softer Apple Polishing Cloth at $9, down from $19, and refreshed U.S. Magic Keyboards for the Mac, now featuring glyphs instead of edge text. Apple Support's 1-800-APL-CARE line is also now answered by a generative AI assistant in the U.S. and Canada. The MacRumors Show has its own YouTube channel, so make sure you're subscribed to keep up with new episodes and clips. Subscribe to The MacRumors Show YouTube channel! You can also listen to ‌The MacRumors Show‌ on Apple Podcasts, Spotify, Overcast, or other podcast apps. You can also copy our RSS feed directly into your player. If you haven't already listened to the previous episode of The MacRumors Show, catch up to hear our discussion with YouTuber Michael Fisher about key rumors about the "iPhone Ultra" and how the device could compare to rivals. Subscribe to ‌The MacRumors Show‌ for new episodes every week, where we discuss some of the topical news breaking here on MacRumors, often joined by interesting guests such as Kayci Lacob, Kevin Nether, John Gruber, Mark Gurman, Jon Prosser, Luke Miani, Matthew Cassinelli, Brian Tong, Quinn Nelson, Jared Nelson, Eli Hodapp, Mike Bell, Sara Dietschy, iJustine, Jon Rettinger, Andru Edwards, Arnold Kim, Ben Sullins, Marcus Kane, Christopher Lawley, Frank McShan, David Lewis, Tyler Stalman, Sam Kohl, Federico Viticci, Thomas Frank, Jonathan Morrison, Ross Young, Ian Zelbo, and Rene Ritchie. ‌The MacRumors Show‌ is on X @MacRumorsShow, so be sure to give us a follow to keep up with the podcast. You can also email us at podcast@macrumors.com or head over to The MacRumors Show forum thread. Remember to rate and review the podcast, and let us know what subjects and guests you would like to see in the future.Tag: The MacRumors ShowThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
04:12 pm
The MacRumors Show: Apple's Surprisingly Big Week of Announcements | MacRumors
The MacRumors Show: Apple's Surprisingly Big Week of Announcements
It's been an unusually big week for Apple announcements. On this week's episode of The MacRumors Show, we discuss the new Mac mini and Mac Studio, the M6 and M5 Ultra chips, and invites to Apple's September event. Subscribe to The MacRumors Show YouTube channel for more videos Apple confirmed on Wednesday that its annual iPhone event will take place on Wednesday, September 9 at Apple Park, starting at 10:00 a.m. Pacific Time, with select members of the media invited to attend. The event's tagline is "Surprise and Shine." Apple is expected to introduce at least six new products, including the the Apple Watch Series 12, Apple Watch Ultra 4, iPhone 18 Pro, ‌iPhone 18 Pro‌ Max, and the first foldable iPhone. Pre-orders should follow shortly after, and along with release dates for iOS 27, iPadOS 27 and macOS 27 Golden Gate. Apple announced the new Mac mini on Tuesday, offering M6 and M5 Pro chip options. The machine gains an N1 networking chip, bringing Wi-Fi 7 and Bluetooth 6, and moves to 2.5Gb Ethernet as standard, up from 1Gb, with a 10Gb option. Thunderbolt 5 is restricted to the M5 Pro model, which gets three Thunderbolt 5 ports while the M6 model keeps Thunderbolt 4. Genlock support over USB-C also helps to sync a display's refresh timing to a camera such as the iPhone 17 Pro. Pricing starts at $899 with 16GB and 256GB, rising to $1,699 for the M5 Pro at 24GB and 512GB. Pre-orders are now open, with launch on September 22. The M6 is Apple's first 2nm chip. Its 12-core CPU is split into 2 super cores, 4 performance cores and 6 efficiency cores, making it the first Apple chip to combine all three core types in one design. Super cores are Apple's top tier, optimized for single-threaded speed. The 12-core GPU features a Neural Accelerator in each core for the first time in a ‌Mac mini‌. The GPU also adds an updated shader architecture, Dynamic Caching, and hardware-accelerated ray tracing, while an all-new Dual 16-core Neural Engine doubles peak compute over the previous generation, with system frameworks able to drive both engines at once. Memory starts at 16GB and tops out at 32GB, running at up to 170GB/s. M5 Pro scales further, to an 18-core CPU, a 20-core GPU and up to 64GB at 307GB/s. The new Mac Studio arrived alongside the ‌Mac mini‌, with M5 Max and M5 Ultra chip options. The M5 Max offers an 18-core CPU with 6 super cores and 12 performance cores, an up-to-40-core GPU with Neural Accelerators in every core, and up to 128GB of memory at 614GB/s, with the GPU running up to 50% faster than the previous generation. Both configurations move to a next-generation SSD architecture on PCIe Gen 6 for up to twice the storage performance, and gain up to six Thunderbolt 5 ports at 120Gb/s, and the same genlock support as the ‌Mac mini‌. Apple's N1 chip also brings Wi-Fi 7 and Bluetooth 6 to the ‌Mac Studio‌. Pricing starts at $2,499 for the M5 Max at 36GB and 512GB, and $5,499 for the M5 Ultra at 96GB and 1TB, with the 512GB memory option not arriving until late October. The M5 Ultra is Apple's first quad-die chip, using a next-generation version of UltraFusion to join two dual-die M5 Max chips into a single processor. The result is a CPU with up to 36 cores, 12 super and 24 performance, delivering 1.25x the single-threaded and 1.3x the multithreaded performance of the M3 Ultra. Its up-to-80-core GPU is the most powerful Apple silicon GPU ever made and the first on an Ultra chip to feature Neural Accelerators. Second-generation Dynamic Caching, hardware-accelerated mesh shading and third-generation ray tracing lift graphics up 40% over the M3 Ultra, and the chip features a 32-core Neural Engine. Memory reaches 512GB at 1.2TB/s, which is a 50% bandwidth increase. Other announcements this week included a new, softer Apple Polishing Cloth at $9, down from $19, and refreshed U.S. Magic Keyboards for the Mac, now featuring glyphs instead of edge text. Apple Support's 1-800-APL-CARE line is also now answered by a generative AI assistant in the U.S. and Canada. The MacRumors Show has its own YouTube channel, so make sure you're subscribed to keep up with new episodes and clips. Subscribe to The MacRumors Show YouTube channel! You can also listen to ‌The MacRumors Show‌ on Apple Podcasts, Spotify, Overcast, or other podcast apps. You can also copy our RSS feed directly into your player. If you haven't already listened to the previous episode of The MacRumors Show, catch up to hear our discussion with YouTuber Michael Fisher about key rumors about the "iPhone Ultra" and how the device could compare to rivals. Subscribe to ‌The MacRumors Show‌ for new episodes every week, where we discuss some of the topical news breaking here on MacRumors, often joined by interesting guests such as Kayci Lacob, Kevin Nether, John Gruber, Mark Gurman, Jon Prosser, Luke Miani, Matthew Cassinelli, Brian Tong, Quinn Nelson, Jared Nelson, Eli Hodapp, Mike Bell, Sara Dietschy, iJustine, Jon Rettinger, Andru Edwards, Arnold Kim, Ben Sullins, Marcus Kane, Christopher Lawley, Frank McShan, David Lewis, Tyler Stalman, Sam Kohl, Federico Viticci, Thomas Frank, Jonathan Morrison, Ross Young, Ian Zelbo, and Rene Ritchie. ‌The MacRumors Show‌ is on X @MacRumorsShow, so be sure to give us a follow to keep up with the podcast. You can also email us at podcast@macrumors.com or head over to The MacRumors Show forum thread. Remember to rate and review the podcast, and let us know what subjects and guests you would like to see in the future.Tag: The MacRumors ShowThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
04:12 pm
The MacRumors Show: Apple's Surprisingly Big Week of Announcements | MacRumors
The MacRumors Show: Apple's Surprisingly Big Week of Announcements
It's been an unusually big week for Apple announcements. On this week's episode of The MacRumors Show, we discuss the new Mac mini and Mac Studio, the M6 and M5 Ultra chips, and invites to Apple's September event. Subscribe to The MacRumors Show YouTube channel for more videos Apple confirmed on Wednesday that its annual iPhone event will take place on Wednesday, September 9 at Apple Park, starting at 10:00 a.m. Pacific Time, with select members of the media invited to attend. The event's tagline is "Surprise and Shine." Apple is expected to introduce at least six new products, including the the Apple Watch Series 12, Apple Watch Ultra 4, iPhone 18 Pro, ‌iPhone 18 Pro‌ Max, and the first foldable iPhone. Pre-orders should follow shortly after, and along with release dates for iOS 27, iPadOS 27 and macOS 27 Golden Gate. Apple announced the new Mac mini on Tuesday, offering M6 and M5 Pro chip options. The machine gains an N1 networking chip, bringing Wi-Fi 7 and Bluetooth 6, and moves to 2.5Gb Ethernet as standard, up from 1Gb, with a 10Gb option. Thunderbolt 5 is restricted to the M5 Pro model, which gets three Thunderbolt 5 ports while the M6 model keeps Thunderbolt 4. Genlock support over USB-C also helps to sync a display's refresh timing to a camera such as the iPhone 17 Pro. Pricing starts at $899 with 16GB and 256GB, rising to $1,699 for the M5 Pro at 24GB and 512GB. Pre-orders are now open, with launch on September 22. The M6 is Apple's first 2nm chip. Its 12-core CPU is split into 2 super cores, 4 performance cores and 6 efficiency cores, making it the first Apple chip to combine all three core types in one design. Super cores are Apple's top tier, optimized for single-threaded speed. The 12-core GPU features a Neural Accelerator in each core for the first time in a ‌Mac mini‌. The GPU also adds an updated shader architecture, Dynamic Caching, and hardware-accelerated ray tracing, while an all-new Dual 16-core Neural Engine doubles peak compute over the previous generation, with system frameworks able to drive both engines at once. Memory starts at 16GB and tops out at 32GB, running at up to 170GB/s. M5 Pro scales further, to an 18-core CPU, a 20-core GPU and up to 64GB at 307GB/s. The new Mac Studio arrived alongside the ‌Mac mini‌, with M5 Max and M5 Ultra chip options. The M5 Max offers an 18-core CPU with 6 super cores and 12 performance cores, an up-to-40-core GPU with Neural Accelerators in every core, and up to 128GB of memory at 614GB/s, with the GPU running up to 50% faster than the previous generation. Both configurations move to a next-generation SSD architecture on PCIe Gen 6 for up to twice the storage performance, and gain up to six Thunderbolt 5 ports at 120Gb/s, and the same genlock support as the ‌Mac mini‌. Apple's N1 chip also brings Wi-Fi 7 and Bluetooth 6 to the ‌Mac Studio‌. Pricing starts at $2,499 for the M5 Max at 36GB and 512GB, and $5,499 for the M5 Ultra at 96GB and 1TB, with the 512GB memory option not arriving until late October. The M5 Ultra is Apple's first quad-die chip, using a next-generation version of UltraFusion to join two dual-die M5 Max chips into a single processor. The result is a CPU with up to 36 cores, 12 super and 24 performance, delivering 1.25x the single-threaded and 1.3x the multithreaded performance of the M3 Ultra. Its up-to-80-core GPU is the most powerful Apple silicon GPU ever made and the first on an Ultra chip to feature Neural Accelerators. Second-generation Dynamic Caching, hardware-accelerated mesh shading and third-generation ray tracing lift graphics up 40% over the M3 Ultra, and the chip features a 32-core Neural Engine. Memory reaches 512GB at 1.2TB/s, which is a 50% bandwidth increase. Other announcements this week included a new, softer Apple Polishing Cloth at $9, down from $19, and refreshed U.S. Magic Keyboards for the Mac, now featuring glyphs instead of edge text. Apple Support's 1-800-APL-CARE line is also now answered by a generative AI assistant in the U.S. and Canada. The MacRumors Show has its own YouTube channel, so make sure you're subscribed to keep up with new episodes and clips. Subscribe to The MacRumors Show YouTube channel! You can also listen to ‌The MacRumors Show‌ on Apple Podcasts, Spotify, Overcast, or other podcast apps. You can also copy our RSS feed directly into your player. If you haven't already listened to the previous episode of The MacRumors Show, catch up to hear our discussion with YouTuber Michael Fisher about key rumors about the "iPhone Ultra" and how the device could compare to rivals. Subscribe to ‌The MacRumors Show‌ for new episodes every week, where we discuss some of the topical news breaking here on MacRumors, often joined by interesting guests such as Kayci Lacob, Kevin Nether, John Gruber, Mark Gurman, Jon Prosser, Luke Miani, Matthew Cassinelli, Brian Tong, Quinn Nelson, Jared Nelson, Eli Hodapp, Mike Bell, Sara Dietschy, iJustine, Jon Rettinger, Andru Edwards, Arnold Kim, Ben Sullins, Marcus Kane, Christopher Lawley, Frank McShan, David Lewis, Tyler Stalman, Sam Kohl, Federico Viticci, Thomas Frank, Jonathan Morrison, Ross Young, Ian Zelbo, and Rene Ritchie. ‌The MacRumors Show‌ is on X @MacRumorsShow, so be sure to give us a follow to keep up with the podcast. You can also email us at podcast@macrumors.com or head over to The MacRumors Show forum thread. Remember to rate and review the podcast, and let us know what subjects and guests you would like to see in the future.Tag: The MacRumors ShowThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
03:52 pm
Apple TV Buys an Existing Hit for the First Time Ever | MacRumors
Apple TV Buys an Existing Hit for the First Time Ever
Apple TV has bought the worldwide rights to "Small Prophets," breaking with how it normally operates in acquiring an existing English-language hit rather than commissioning a show of its own from the start. ‌Apple TV‌ has typically developed or, at the very least, commissioned shows in-house and given them their premiere on the service, regardless of where they may eventually end up. This was the model behind the BBC's "Trying," which ‌Apple TV‌+ produced first and later licensed to the BBC once its own run had finished. Apple has also picked up individual foreign-language titles in the past, such as the French-Japanese drama "Drops of God." "Small Prophets" marks new ground since it is an English-language series and it had already become a broadcast hit elsewhere before Apple stepped in. The acquisition, reported by Deadline, follows a run on BBC Two that produced the strongest 28-day launch numbers for a comedy on the channel since 2022, a 100% score on Rotten Tomatoes, and the International Panorama award at this year's Series Mania festival. "Small Prophets" will stream on ‌Apple TV‌ worldwide starting on October 7, with the exception of the UK, where the show debuted on BBC iPlayer and BBC Two earlier this year. Viewers in the UK will be able to continue watching it on iPlayer before it eventually moves to ‌Apple TV‌. The show is written, created, and directed by Mackenzie Crook, best known for appearing in "The Office" and "The Detectorists." Small Prophets follows Quigley as the eccentric Michael Sleep, an ordinary man who, since his darling Clea disappeared seven years ago, has worked in a DIY store, while visiting his elderly dad Brian and hoping for Clea to return. One day, Brian shares an old recipe for a potion so a skeptical Michael can create homunculi – magical spirits that can predict the future – to learn if he will see Clea again. Michael gets help from his young DIY store co-worker Kacey and their unlikely friendship blossoms through a dislike of store manager Gordon, while his nosy neighbors obsess about what Michael is doing in the garden shed. The show, set in and around suburban Manchester and is seeped in Crook's trademark gentleness... includes animated elements to show the more magical elements of the story. Deadline compared "Small Prophets" to "Ted Lasso," which recently began its fourth season as ‌Apple TV‌'s biggest premiere ever, favoring a gentler, more serialized storytelling style over a traditional sitcom. Related Roundup: Apple TVTags: Apple TV Service, Apple TV ShowsBuyer's Guide: Apple TV (Don't Buy)Related Forum: Apple TV and Home TheaterThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
03:52 pm
Apple TV Buys an Existing Hit for the First Time Ever | MacRumors
Apple TV Buys an Existing Hit for the First Time Ever
Apple TV has bought the worldwide rights to "Small Prophets," breaking with how it normally operates in acquiring an existing English-language hit rather than commissioning a show of its own from the start. ‌Apple TV‌ has typically developed or, at the very least, commissioned shows in-house and given them their premiere on the service, regardless of where they may eventually end up. This was the model behind the BBC's "Trying," which ‌Apple TV‌+ produced first and later licensed to the BBC once its own run had finished. Apple has also picked up individual foreign-language titles in the past, such as the French-Japanese drama "Drops of God." "Small Prophets" marks new ground since it is an English-language series and it had already become a broadcast hit elsewhere before Apple stepped in. The acquisition, reported by Deadline, follows a run on BBC Two that produced the strongest 28-day launch numbers for a comedy on the channel since 2022, a 100% score on Rotten Tomatoes, and the International Panorama award at this year's Series Mania festival. "Small Prophets" will stream on ‌Apple TV‌ worldwide starting on October 7, with the exception of the UK, where the show debuted on BBC iPlayer and BBC Two earlier this year. Viewers in the UK will be able to continue watching it on iPlayer before it eventually moves to ‌Apple TV‌. The show is written, created, and directed by Mackenzie Crook, best known for appearing in "The Office" and "The Detectorists." Small Prophets follows Quigley as the eccentric Michael Sleep, an ordinary man who, since his darling Clea disappeared seven years ago, has worked in a DIY store, while visiting his elderly dad Brian and hoping for Clea to return. One day, Brian shares an old recipe for a potion so a skeptical Michael can create homunculi – magical spirits that can predict the future – to learn if he will see Clea again. Michael gets help from his young DIY store co-worker Kacey and their unlikely friendship blossoms through a dislike of store manager Gordon, while his nosy neighbors obsess about what Michael is doing in the garden shed. The show, set in and around suburban Manchester and is seeped in Crook's trademark gentleness... includes animated elements to show the more magical elements of the story. Deadline compared "Small Prophets" to "Ted Lasso," which recently began its fourth season as ‌Apple TV‌'s biggest premiere ever, favoring a gentler, more serialized storytelling style over a traditional sitcom. Related Roundup: Apple TVTags: Apple TV Service, Apple TV ShowsBuyer's Guide: Apple TV (Don't Buy)Related Forum: Apple TV and Home TheaterThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
03:52 pm
Apple TV Buys an Existing Hit for the First Time Ever | MacRumors
Apple TV Buys an Existing Hit for the First Time Ever
Apple TV has bought the worldwide rights to "Small Prophets," breaking with how it normally operates in acquiring an existing English-language hit rather than commissioning a show of its own from the start. ‌Apple TV‌ has typically developed or, at the very least, commissioned shows in-house and given them their premiere on the service, regardless of where they may eventually end up. This was the model behind the BBC's "Trying," which ‌Apple TV‌+ produced first and later licensed to the BBC once its own run had finished. Apple has also picked up individual foreign-language titles in the past, such as the French-Japanese drama "Drops of God." "Small Prophets" marks new ground since it is an English-language series and it had already become a broadcast hit elsewhere before Apple stepped in. The acquisition, reported by Deadline, follows a run on BBC Two that produced the strongest 28-day launch numbers for a comedy on the channel since 2022, a 100% score on Rotten Tomatoes, and the International Panorama award at this year's Series Mania festival. "Small Prophets" will stream on ‌Apple TV‌ worldwide starting on October 7, with the exception of the UK, where the show debuted on BBC iPlayer and BBC Two earlier this year. Viewers in the UK will be able to continue watching it on iPlayer before it eventually moves to ‌Apple TV‌. The show is written, created, and directed by Mackenzie Crook, best known for appearing in "The Office" and "The Detectorists." Small Prophets follows Quigley as the eccentric Michael Sleep, an ordinary man who, since his darling Clea disappeared seven years ago, has worked in a DIY store, while visiting his elderly dad Brian and hoping for Clea to return. One day, Brian shares an old recipe for a potion so a skeptical Michael can create homunculi – magical spirits that can predict the future – to learn if he will see Clea again. Michael gets help from his young DIY store co-worker Kacey and their unlikely friendship blossoms through a dislike of store manager Gordon, while his nosy neighbors obsess about what Michael is doing in the garden shed. The show, set in and around suburban Manchester and is seeped in Crook's trademark gentleness... includes animated elements to show the more magical elements of the story. Deadline compared "Small Prophets" to "Ted Lasso," which recently began its fourth season as ‌Apple TV‌'s biggest premiere ever, favoring a gentler, more serialized storytelling style over a traditional sitcom. Related Roundup: Apple TVTags: Apple TV Service, Apple TV ShowsBuyer's Guide: Apple TV (Don't Buy)Related Forum: Apple TV and Home TheaterThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
03:52 pm
Apple TV Buys an Existing Hit for the First Time Ever | MacRumors
Apple TV Buys an Existing Hit for the First Time Ever
Apple TV has bought the worldwide rights to "Small Prophets," breaking with how it normally operates in acquiring an existing English-language hit rather than commissioning a show of its own from the start. ‌Apple TV‌ has typically developed or, at the very least, commissioned shows in-house and given them their premiere on the service, regardless of where they may eventually end up. This was the model behind the BBC's "Trying," which ‌Apple TV‌+ produced first and later licensed to the BBC once its own run had finished. Apple has also picked up individual foreign-language titles in the past, such as the French-Japanese drama "Drops of God." "Small Prophets" marks new ground since it is an English-language series and it had already become a broadcast hit elsewhere before Apple stepped in. The acquisition, reported by Deadline, follows a run on BBC Two that produced the strongest 28-day launch numbers for a comedy on the channel since 2022, a 100% score on Rotten Tomatoes, and the International Panorama award at this year's Series Mania festival. "Small Prophets" will stream on ‌Apple TV‌ worldwide starting on October 7, with the exception of the UK, where the show debuted on BBC iPlayer and BBC Two earlier this year. Viewers in the UK will be able to continue watching it on iPlayer before it eventually moves to ‌Apple TV‌. The show is written, created, and directed by Mackenzie Crook, best known for appearing in "The Office" and "The Detectorists." Small Prophets follows Quigley as the eccentric Michael Sleep, an ordinary man who, since his darling Clea disappeared seven years ago, has worked in a DIY store, while visiting his elderly dad Brian and hoping for Clea to return. One day, Brian shares an old recipe for a potion so a skeptical Michael can create homunculi – magical spirits that can predict the future – to learn if he will see Clea again. Michael gets help from his young DIY store co-worker Kacey and their unlikely friendship blossoms through a dislike of store manager Gordon, while his nosy neighbors obsess about what Michael is doing in the garden shed. The show, set in and around suburban Manchester and is seeped in Crook's trademark gentleness... includes animated elements to show the more magical elements of the story. Deadline compared "Small Prophets" to "Ted Lasso," which recently began its fourth season as ‌Apple TV‌'s biggest premiere ever, favoring a gentler, more serialized storytelling style over a traditional sitcom. Related Roundup: Apple TVTags: Apple TV Service, Apple TV ShowsBuyer's Guide: Apple TV (Don't Buy)Related Forum: Apple TV and Home TheaterThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
03:52 pm
Apple TV Buys an Existing Hit for the First Time Ever | MacRumors
Apple TV Buys an Existing Hit for the First Time Ever
Apple TV has bought the worldwide rights to "Small Prophets," breaking with how it normally operates in acquiring an existing English-language hit rather than commissioning a show of its own from the start. ‌Apple TV‌ has typically developed or, at the very least, commissioned shows in-house and given them their premiere on the service, regardless of where they may eventually end up. This was the model behind the BBC's "Trying," which ‌Apple TV‌+ produced first and later licensed to the BBC once its own run had finished. Apple has also picked up individual foreign-language titles in the past, such as the French-Japanese drama "Drops of God." "Small Prophets" marks new ground since it is an English-language series and it had already become a broadcast hit elsewhere before Apple stepped in. The acquisition, reported by Deadline, follows a run on BBC Two that produced the strongest 28-day launch numbers for a comedy on the channel since 2022, a 100% score on Rotten Tomatoes, and the International Panorama award at this year's Series Mania festival. "Small Prophets" will stream on ‌Apple TV‌ worldwide starting on October 7, with the exception of the UK, where the show debuted on BBC iPlayer and BBC Two earlier this year. Viewers in the UK will be able to continue watching it on iPlayer before it eventually moves to ‌Apple TV‌. The show is written, created, and directed by Mackenzie Crook, best known for appearing in "The Office" and "The Detectorists." Small Prophets follows Quigley as the eccentric Michael Sleep, an ordinary man who, since his darling Clea disappeared seven years ago, has worked in a DIY store, while visiting his elderly dad Brian and hoping for Clea to return. One day, Brian shares an old recipe for a potion so a skeptical Michael can create homunculi – magical spirits that can predict the future – to learn if he will see Clea again. Michael gets help from his young DIY store co-worker Kacey and their unlikely friendship blossoms through a dislike of store manager Gordon, while his nosy neighbors obsess about what Michael is doing in the garden shed. The show, set in and around suburban Manchester and is seeped in Crook's trademark gentleness... includes animated elements to show the more magical elements of the story. Deadline compared "Small Prophets" to "Ted Lasso," which recently began its fourth season as ‌Apple TV‌'s biggest premiere ever, favoring a gentler, more serialized storytelling style over a traditional sitcom. Related Roundup: Apple TVTags: Apple TV Service, Apple TV ShowsBuyer's Guide: Apple TV (Don't Buy)Related Forum: Apple TV and Home TheaterThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
03:52 pm
Apple TV Buys an Existing Hit for the First Time Ever | MacRumors
Apple TV Buys an Existing Hit for the First Time Ever
Apple TV has bought the worldwide rights to "Small Prophets," breaking with how it normally operates in acquiring an existing English-language hit rather than commissioning a show of its own from the start. ‌Apple TV‌ has typically developed or, at the very least, commissioned shows in-house and given them their premiere on the service, regardless of where they may eventually end up. This was the model behind the BBC's "Trying," which ‌Apple TV‌+ produced first and later licensed to the BBC once its own run had finished. Apple has also picked up individual foreign-language titles in the past, such as the French-Japanese drama "Drops of God." "Small Prophets" marks new ground since it is an English-language series and it had already become a broadcast hit elsewhere before Apple stepped in. The acquisition, reported by Deadline, follows a run on BBC Two that produced the strongest 28-day launch numbers for a comedy on the channel since 2022, a 100% score on Rotten Tomatoes, and the International Panorama award at this year's Series Mania festival. "Small Prophets" will stream on ‌Apple TV‌ worldwide starting on October 7, with the exception of the UK, where the show debuted on BBC iPlayer and BBC Two earlier this year. Viewers in the UK will be able to continue watching it on iPlayer before it eventually moves to ‌Apple TV‌. The show is written, created, and directed by Mackenzie Crook, best known for appearing in "The Office" and "The Detectorists." Small Prophets follows Quigley as the eccentric Michael Sleep, an ordinary man who, since his darling Clea disappeared seven years ago, has worked in a DIY store, while visiting his elderly dad Brian and hoping for Clea to return. One day, Brian shares an old recipe for a potion so a skeptical Michael can create homunculi – magical spirits that can predict the future – to learn if he will see Clea again. Michael gets help from his young DIY store co-worker Kacey and their unlikely friendship blossoms through a dislike of store manager Gordon, while his nosy neighbors obsess about what Michael is doing in the garden shed. The show, set in and around suburban Manchester and is seeped in Crook's trademark gentleness... includes animated elements to show the more magical elements of the story. Deadline compared "Small Prophets" to "Ted Lasso," which recently began its fourth season as ‌Apple TV‌'s biggest premiere ever, favoring a gentler, more serialized storytelling style over a traditional sitcom. Related Roundup: Apple TVTags: Apple TV Service, Apple TV ShowsBuyer's Guide: Apple TV (Don't Buy)Related Forum: Apple TV and Home TheaterThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
03:52 pm
Apple TV Buys an Existing Hit for the First Time Ever | MacRumors
Apple TV Buys an Existing Hit for the First Time Ever
Apple TV has bought the worldwide rights to "Small Prophets," breaking with how it normally operates in acquiring an existing English-language hit rather than commissioning a show of its own from the start. ‌Apple TV‌ has typically developed or, at the very least, commissioned shows in-house and given them their premiere on the service, regardless of where they may eventually end up. This was the model behind the BBC's "Trying," which ‌Apple TV‌+ produced first and later licensed to the BBC once its own run had finished. Apple has also picked up individual foreign-language titles in the past, such as the French-Japanese drama "Drops of God." "Small Prophets" marks new ground since it is an English-language series and it had already become a broadcast hit elsewhere before Apple stepped in. The acquisition, reported by Deadline, follows a run on BBC Two that produced the strongest 28-day launch numbers for a comedy on the channel since 2022, a 100% score on Rotten Tomatoes, and the International Panorama award at this year's Series Mania festival. "Small Prophets" will stream on ‌Apple TV‌ worldwide starting on October 7, with the exception of the UK, where the show debuted on BBC iPlayer and BBC Two earlier this year. Viewers in the UK will be able to continue watching it on iPlayer before it eventually moves to ‌Apple TV‌. The show is written, created, and directed by Mackenzie Crook, best known for appearing in "The Office" and "The Detectorists." Small Prophets follows Quigley as the eccentric Michael Sleep, an ordinary man who, since his darling Clea disappeared seven years ago, has worked in a DIY store, while visiting his elderly dad Brian and hoping for Clea to return. One day, Brian shares an old recipe for a potion so a skeptical Michael can create homunculi – magical spirits that can predict the future – to learn if he will see Clea again. Michael gets help from his young DIY store co-worker Kacey and their unlikely friendship blossoms through a dislike of store manager Gordon, while his nosy neighbors obsess about what Michael is doing in the garden shed. The show, set in and around suburban Manchester and is seeped in Crook's trademark gentleness... includes animated elements to show the more magical elements of the story. Deadline compared "Small Prophets" to "Ted Lasso," which recently began its fourth season as ‌Apple TV‌'s biggest premiere ever, favoring a gentler, more serialized storytelling style over a traditional sitcom. Related Roundup: Apple TVTags: Apple TV Service, Apple TV ShowsBuyer's Guide: Apple TV (Don't Buy)Related Forum: Apple TV and Home TheaterThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
03:52 pm
Apple TV Buys an Existing Hit for the First Time Ever | MacRumors
Apple TV Buys an Existing Hit for the First Time Ever
Apple TV has bought the worldwide rights to "Small Prophets," breaking with how it normally operates in acquiring an existing English-language hit rather than commissioning a show of its own from the start. ‌Apple TV‌ has typically developed or, at the very least, commissioned shows in-house and given them their premiere on the service, regardless of where they may eventually end up. This was the model behind the BBC's "Trying," which ‌Apple TV‌+ produced first and later licensed to the BBC once its own run had finished. Apple has also picked up individual foreign-language titles in the past, such as the French-Japanese drama "Drops of God." "Small Prophets" marks new ground since it is an English-language series and it had already become a broadcast hit elsewhere before Apple stepped in. The acquisition, reported by Deadline, follows a run on BBC Two that produced the strongest 28-day launch numbers for a comedy on the channel since 2022, a 100% score on Rotten Tomatoes, and the International Panorama award at this year's Series Mania festival. "Small Prophets" will stream on ‌Apple TV‌ worldwide starting on October 7, with the exception of the UK, where the show debuted on BBC iPlayer and BBC Two earlier this year. Viewers in the UK will be able to continue watching it on iPlayer before it eventually moves to ‌Apple TV‌. The show is written, created, and directed by Mackenzie Crook, best known for appearing in "The Office" and "The Detectorists." Small Prophets follows Quigley as the eccentric Michael Sleep, an ordinary man who, since his darling Clea disappeared seven years ago, has worked in a DIY store, while visiting his elderly dad Brian and hoping for Clea to return. One day, Brian shares an old recipe for a potion so a skeptical Michael can create homunculi – magical spirits that can predict the future – to learn if he will see Clea again. Michael gets help from his young DIY store co-worker Kacey and their unlikely friendship blossoms through a dislike of store manager Gordon, while his nosy neighbors obsess about what Michael is doing in the garden shed. The show, set in and around suburban Manchester and is seeped in Crook's trademark gentleness... includes animated elements to show the more magical elements of the story. Deadline compared "Small Prophets" to "Ted Lasso," which recently began its fourth season as ‌Apple TV‌'s biggest premiere ever, favoring a gentler, more serialized storytelling style over a traditional sitcom. Related Roundup: Apple TVTags: Apple TV Service, Apple TV ShowsBuyer's Guide: Apple TV (Don't Buy)Related Forum: Apple TV and Home TheaterThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »

Monday August 24
06:00 pm
Update: New domain for Sign in with Apple | ADC Headlines
Update: New domain for Sign in with Apple
Starting later this year, new Sign in with Apple addresses, previously issued on privaterelay.appleid.com, will be issued on private.icloud.com. Existing addresses on privaterelay.appleid.com will continue to work and forward mail to users without interruption.After further consideration and reviewing community feedback, iCloud+ Hide My Email addresses will remain on icloud.com. What you need to do Developers with apps or websites that use Sign in with Apple should ensure that their account systems, email validation logic, and allowlists accept addresses on the new private.icloud.com domain in addition to the existing privaterelay.appleid.com domain.Learn more about Sign in with Apple Communicating using the Private Email Relay Service
Read more »
Thursday July 30
01:00 pm
The next measure of AI momentum is work transformed | Office for Mac
The next measure of AI momentum is work transformed
In yesterday’s earnings call, we shared that Microsoft 365 Copilot has surpassed 30 million paid seats, with net seat adds more than doubling quarter over quarter. The post appeared first on Microsoft 365 Blog.
Read more »

Reviews & KoolTools

Unbreakable Style: The Best Hardshell Phone Cases on the Market

Are you looking for the ultimate protection for your smartphone? Hardshell phone cases are the answer. These cases are designed to withstand impact. They keep your phone safe from drops and scratches. In a world full of choices, how do you find the best? We have...

Plugable’s 5-in-1 USB Hub expands your MacBook Pro or MacBook Air’s connection options

The new 5-in-1 USB-C hub from Plugable turns two Mac laptop ports into (as the name implies) five, including Ethernet and more. Designed specifically for MacBook Pro and MacBook Air models, the hub (with the moniker AMS-5IN1E) fits flush against the host Mac and adds...

More Reviews & KoolTools

Community and More

MacTech Events and COVID

Due to the pandemic, the regional MacTech Pro events were pushed into 2021 — as early as reasonably possible. This means at best, early in the third quarter of the year. But depending on guidance and public health, it could be later than that. Once there are details,...

More Community

Software & Services Scanners

Thursday August 27
11:04 am
Two Alleged ‘TeamPCP’ Hackers Arrested in Australia | Krebs on Security
Two Alleged ‘TeamPCP’ Hackers Arrested in Australia
Authorities in Australia have arrested two men believed to be members of TeamPCP, a prolific cybercrime and data extortion group blamed for perpetrating the longest running spree of software supply chain attacks ever. In a statement released today, the Australian Federal Police (AFP) said two unnamed suspects from Western Australia, aged 21 and 23, were arrested in connection with a "sophisticated cybercrime syndicate that allegedly created malicious open-source software to rob thousands of global businesses." The AFP did not name the defendants, but KrebsOnSecurity learned the 21-year-old suspect's real identity in June, and has been communicating with him ever since. This story includes interviews with TeamPCP's self-described spokesperson, and examines clues left behind by the TeamPCP leader that likely led to his undoing.
Read more »
11:04 am
Two Alleged ‘TeamPCP’ Hackers Arrested in Australia | Krebs on Security
Two Alleged ‘TeamPCP’ Hackers Arrested in Australia
Authorities in Australia have arrested two men believed to be members of TeamPCP, a prolific cybercrime and data extortion group blamed for perpetrating the longest running spree of software supply chain attacks ever. In a statement released today, the Australian Federal Police (AFP) said two unnamed suspects from Western Australia, aged 21 and 23, were arrested in connection with a "sophisticated cybercrime syndicate that allegedly created malicious open-source software to rob thousands of global businesses." The AFP did not name the defendants, but KrebsOnSecurity learned the 21-year-old suspect's real identity in June, and has been communicating with him ever since. This story includes interviews with TeamPCP's self-described spokesperson, and examines clues left behind by the TeamPCP leader that likely led to his undoing.
Read more »
Monday August 24
11:11 am
Vulnerability Summary for the Week of August 17, 2026 | US-CERT Alerts
Vulnerability Summary for the Week of August 17, 2026
High Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info 101gen--Automation Web Platform Notifications and OTP for WooCommerce, Advanced Country Code The Automation Web Platform - Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 4.8.6. This is due to the handle_email_otp_return() function returning the secret magic login token in the response to a publicly accessible OTP request, rather than only delivering it to the user's email address. This makes it possible for unauthenticated attackers to log in as any user on the site, including administrators, if they know that user's email address. 2026-08-21 9.8 CVE-2026-77264 10Web--Form Maker by 10Web Unauthenticated Cross Site Scripting (XSS) in Form Maker by 10Web = 0.8.41 and < 0.8.64 contain a vulnerability in the exec_shell_interact (alias exec_interact) tool, whose approval_requirement returns ApprovalRequirement::Auto. This overrides the default Required approval for code-executing tools, so LLM-controlled stdin is written into an already-approved long-running interactive shell (e.g., a python3 -i REPL, mysql, ssh, or sudo -i session) without any approval prompt. An attacker who can inject instructions via untrusted content the agent ingests (a fetched page, MCP result, or repo file) can cause commands to run at the privilege level of that approved process. Fixed in 0.8.64. 2026-08-18 7 CVE-2026-75857 Hmbown--CodeWhale CodeWhale (packages codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain a remote code execution vulnerability in the rlm_eval tool. The tool's approval_requirement() returns ApprovalRequirement::Auto, which the engine treats as 'never prompt,' causing arbitrary model-supplied Python code to run in a python3 interpreter without consulting the user's configured --approval-policy and without any approval prompt or audit step. An attacker can induce the agent to execute arbitrary code via prompt injection in untrusted content the agent reads (a web page, fetched URL, repository file, or MCP tool result); the companion rlm_open tool can stage such content. Code runs on the user's machine at the user's privilege level. Fixed in 0.8.64. 2026-08-18 7.8 CVE-2026-75858 Hmbown--CodeWhale CodeWhale versions before 0.8.64 fail to validate file paths in the project config instructions field, allowing attackers to read arbitrary files on the victim's system. A malicious .codewhale/config.toml file in a cloned repository can specify paths outside the workspace that are read and injected into the AI system prompt for exfiltration. 2026-08-18 7.5 CVE-2026-75859 Hmbown--CodeWhale CodeWhale versions before 0.8.64 fail to properly validate the allow_shell configuration parameter from project config files, allowing attackers to enable arbitrary shell command execution by committing a malicious .codewhale/config.toml file to a repository. When a user clones and opens the repository in CodeWhale, the AI model gains access to exec_shell and task_shell tools, enabling execution of arbitrary shell commands on the victim's machine without explicit user consent. 2026-08-18 7.8 CVE-2026-75911 Hmbown--CodeWhale CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the git_blame tool that allows attackers to read arbitrary files by injecting git options into the unvalidated rev parameter. Attackers can supply rev values like --contents=/path/to/file to exfiltrate sensitive files such as SSH keys and credentials through the tool output returned to the model. 2026-08-18 7.4 CVE-2026-75912 Hmbown--CodeWhale CodeWhale versions before 0.8.64 contain a path traversal vulnerability in the image_analyze tool that fails to canonicalize symlinks before reading files. Attackers can create workspace symlinks pointing to external files with image extensions to leak file bytes to the vision endpoint without user approval. 2026-08-18 7.5 CVE-2026-75914 Hmbown--CodeWhale CodeWhale versions before 0.8.64 contain an environment variable exposure vulnerability in the js_execution tool that fails to scrub parent process environment variables before spawning Node.js. Attackers can craft malicious JavaScript code executed by the tool to read process.env and leak API keys, cloud credentials, and authentication tokens back to the model context. 2026-08-18 7.5 CVE-2026-75915 hoppscotch--hoppscotch Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member's private User data, while toggleHistoryStarStatus and removeRequestFromHistory in the UserHistory service accept another user's history identifier without enforcing userUid ownership, allowing an authenticated workspace member to read private request history, session data, request contents, authorization headers, environment values, and settings and to modify or delete the victim's private history entries. This issue is fixed in version 2026.6.0. 2026-08-18 7.6 CVE-2026-69189 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote attacker to bypass security restrictions due to the exposure of intermediate certificate authority private keys in a publicly available update file. 2026-08-19 9.1 CVE-2026-15065 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command. 2026-08-19 9.9 CVE-2026-15068 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to gain root privileges due to improper authentication. 2026-08-19 9.8 CVE-2026-16656 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command. 2026-08-19 9.9 CVE-2026-16816 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to impersonate the TNC policy server and modify traffic due to improper certificate validation. 2026-08-19 9.3 CVE-2026-16822 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an integer underflow. 2026-08-19 9.8 CVE-2026-16834 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information due to an integer underflow in the IPv4 IP-options parser. 2026-08-19 9.4 CVE-2026-16839 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write. 2026-08-19 9.8 CVE-2026-16840 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a heap buffer overflow. 2026-08-19 9.8 CVE-2026-16845 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack buffer overflow. 2026-08-19 9.8 CVE-2026-16862 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack buffer overflow. 2026-08-19 9.8 CVE-2026-16864 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow. 2026-08-19 9.8 CVE-2026-16872 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command. 2026-08-19 9.8 CVE-2026-16882 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack buffer overflow. 2026-08-19 9.8 CVE-2026-16885 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack buffer overflow. 2026-08-19 9.8 CVE-2026-16894 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code or cause a denial of service due to an out-of-bounds write. 2026-08-19 9.6 CVE-2026-16903 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack buffer overflow. 2026-08-19 9.8 CVE-2026-16913 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to an integer overflow. 2026-08-19 9.8 CVE-2026-16917 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to improper validation of network-supplied pointers. 2026-08-19 9.8 CVE-2026-16919 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to overwrite arbitrary files due to improper neutralization of special elements in input. 2026-08-20 9.1 CVE-2026-16926 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a buffer overflow. 2026-08-20 9.8 CVE-2026-17040 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a use-after-free vulnerability. 2026-08-20 9.8 CVE-2026-17118 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow. 2026-08-20 9.8 CVE-2026-17122 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a format string vulnerability. 2026-08-20 9.8 CVE-2026-17136 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a buffer overflow. 2026-08-20 9.8 CVE-2026-17141 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper authentication. 2026-08-20 9.8 CVE-2026-17142 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to improper privilege management. 2026-08-20 9.8 CVE-2026-17145 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a buffer overflow. 2026-08-20 9.8 CVE-2026-17152 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack buffer overflow. 2026-08-20 9.8 CVE-2026-17157 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to an integer overflow during size computation. 2026-08-20 9.8 CVE-2026-17160 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to a buffer overflow. 2026-08-20 9.3 CVE-2026-17422 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command. 2026-08-20 9.9 CVE-2026-18835 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 's nimesis registration service could allow a remote attacker to overwrite files due to path traversal. 2026-08-19 8.2 CVE-2026-15061 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote attacker to gain unauthorized access to AIX systems due to improper validation of TLS certificates. 2026-08-19 8.1 CVE-2026-15078 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to access NFS-exported filesystems due to improper authentication. 2026-08-19 8.2 CVE-2026-16686 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a heap buffer overflow. 2026-08-19 8.8 CVE-2026-16814 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack buffer overflow. 2026-08-19 8.8 CVE-2026-16841 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command. 2026-08-19 8.8 CVE-2026-16842 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command. 2026-08-19 8.8 CVE-2026-16844 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a heap buffer overflow. 2026-08-19 8.8 CVE-2026-16847 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of shell metacharacters in DHCP options. 2026-08-19 8.8 CVE-2026-16848 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to command injection via crafted Router Advertisements. 2026-08-19 8.8 CVE-2026-16850 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to manipulate network traffic and DNS configuration due to improper authentication. 2026-08-19 8.2 CVE-2026-16857 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to command injection. 2026-08-19 8.8 CVE-2026-16865 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow. 2026-08-19 8.8 CVE-2026-16877 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write. 2026-08-19 8.8 CVE-2026-16901 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to an off-by-one error in bounds checking. 2026-08-19 8.8 CVE-2026-16909 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary code due to a stack buffer overflow. 2026-08-19 8.8 CVE-2026-16911 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary commands due to improper validation of the ODMDIR environment variable. 2026-08-20 8.8 CVE-2026-16932 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to a heap-based buffer overflow. 2026-08-20 8.8 CVE-2026-16934 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to a buffer overflow. 2026-08-20 8.8 CVE-2026-16936 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to a heap-based buffer overflow. 2026-08-20 8.2 CVE-2026-16943 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to an integer underflow. 2026-08-20 8.8 CVE-2026-16996 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to improper authentication. 2026-08-20 8.1 CVE-2026-17000 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a heap buffer overflow. 2026-08-20 8.3 CVE-2026-17006 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information and cause a denial of service due to a kernel heap over-read. 2026-08-20 8.1 CVE-2026-17060 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow. 2026-08-20 8.1 CVE-2026-17138 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow. 2026-08-20 8.5 CVE-2026-17168 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a heap-based buffer overflow. 2026-08-20 8.8 CVE-2026-17436 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service and potentially disclose sensitive information due to an integer underflow. 2026-08-20 8.2 CVE-2026-18670 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command. 2026-08-20 8.4 CVE-2026-18824 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a heap-based buffer overflow. 2026-08-20 8.8 CVE-2026-18832 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to improper validation of an attacker-controlled pointer. 2026-08-20 8.2 CVE-2026-18840 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to an out-of-bounds write. 2026-08-20 8.4 CVE-2026-18842 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a buffer overflow. 2026-08-20 8.1 CVE-2026-19437 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 has a pointer validation flaw exists in the AIX Virtual SCSI (vSCSI) initiator driver. Successful exploitation may result in denial of service, privilege escalation, or full compromise of the client LPAR kernel. 2026-08-20 8.2 CVE-2026-19442 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 has a vulnerability in cmdnim that may allow an unprivileged local user to executes the payload as root. 2026-08-20 8.8 CVE-2026-19449 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM server process is crashing during client registration due to buffer overflow. 2026-08-19 7.5 CVE-2026-14970 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption. 2026-08-19 7.5 CVE-2026-16690 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to improper privilege management. 2026-08-19 7.8 CVE-2026-16703 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an out-of-bounds write. 2026-08-19 7.5 CVE-2026-16706 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a NULL pointer dereference. 2026-08-19 7.5 CVE-2026-16817 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption. 2026-08-19 7.5 CVE-2026-16818 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service and compromise data integrity due to a time-of-check time-of-use race condition. 2026-08-19 7.7 CVE-2026-16819 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to unbounded recursion. 2026-08-19 7.5 CVE-2026-16824 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption. 2026-08-19 7.5 CVE-2026-16831 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption. 2026-08-19 7.5 CVE-2026-16836 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to improper handling of a missing SSL client certificate. 2026-08-19 7.5 CVE-2026-16837 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to overwrite critical files and obtain sensitive information due to a time-of-check to time-of-use (TOCTOU) race condition. 2026-08-19 7 CVE-2026-16838 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a use-after-free. 2026-08-19 7.4 CVE-2026-16851 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an integer overflow. 2026-08-19 7.5 CVE-2026-16852 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to improperly scrubbed environment variables. 2026-08-19 7.8 CVE-2026-16869 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to achieve local privilege escalation due to an out-of-bounds write. 2026-08-19 7.8 CVE-2026-16873 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to obtain root privileges due to improper enforcement of RBAC authentication roles. 2026-08-19 7.8 CVE-2026-16874 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary commands due to shell metacharacter injection. 2026-08-19 7.8 CVE-2026-16875 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to a time-of-check to time-of-use (TOCTOU) race condition. 2026-08-20 7 CVE-2026-16922 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to improper privilege management. 2026-08-20 7 CVE-2026-16923 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an improper calculation of a memory offset during IPsec decapsulation. 2026-08-20 7.5 CVE-2026-16924 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to achieve privilege escalation due to improper authorization. 2026-08-20 7.1 CVE-2026-16925 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain root privileges due to a time-of-check to time-of-use (TOCTOU) race condition. 2026-08-20 7.3 CVE-2026-16927 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a heap-based buffer overflow. 2026-08-20 7.5 CVE-2026-16928 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to a time-of-check to time-of-use (TOCTOU) race condition. 2026-08-20 7.8 CVE-2026-16935 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to improper privilege management. 2026-08-20 7.8 CVE-2026-16937 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to a stack-based buffer overflow. 2026-08-20 7.8 CVE-2026-16945 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to a heap buffer overflow. 2026-08-20 7.8 CVE-2026-16946 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to improper resolution of symbolic links. 2026-08-20 7.1 CVE-2026-16989 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to improper handling of symbolic links. 2026-08-20 7.8 CVE-2026-16991 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary commands due to improper privilege management. 2026-08-20 7.8 CVE-2026-16997 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to compromise the confidentiality and integrity of the system due to an out-of-bounds write. 2026-08-20 7.7 CVE-2026-17003 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to improper certificate validation. 2026-08-20 7.7 CVE-2026-17024 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to uncontrolled recursion. 2026-08-20 7.5 CVE-2026-17121 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to an out-of-bounds read. 2026-08-20 7.8 CVE-2026-17124 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an integer overflow. 2026-08-20 7.5 CVE-2026-17159 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to improper validation of an array size field. 2026-08-20 7.5 CVE-2026-17163 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a NULL pointer dereference. 2026-08-20 7.5 CVE-2026-17165 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to improper validation of an allocation size. 2026-08-20 7.5 CVE-2026-17170 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to overwrite arbitrary files due to improper resolution of symbolic links. 2026-08-20 7.8 CVE-2026-17171 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information and cause a denial of service due to an out-of-bounds read. 2026-08-20 7.7 CVE-2026-17423 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a stack buffer overflow. 2026-08-20 7.5 CVE-2026-17425 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to obtain sensitive information or cause a denial of service due to an out-of-bounds read. 2026-08-20 7.9 CVE-2026-18716 IBM--AIX IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 allows a remote unauthenticated attacker can send a crafted UDP packet to a reachable RPC service, resulting in complete system unavailability and requiring an LPAR restart. 2026-08-20 7.5 CVE-2026-19446 IBM--DS8A00 (R10.0 - R10.1) IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an attacker to bypass security authentication due to improperly encoding of DSCLI command output to obtain sensitive information or cause a denial of service. 2026-08-19 7.4 CVE-2025-36254 IBM--DS8A00( R10.0 - R10.1 ) IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an authenticated user to create a user with privileged user roles due to improper privileged defined with unsafe actions. 2026-08-19 7.5 CVE-2025-36255 IBM--Langflow OSS IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to overwrite administrator email information and abuse the server as an outbound relay due to missing authentication for the registration endpoint. 2026-08-19 7.5 CVE-2026-19875 IBM--Portieris IBM Portieris 0.5.0 through 0.14.2 could allow a remote authenticated attacker to bypass image policy enforcement due to improper authorization of pod owner references. 2026-08-19 8.1 CVE-2026-18544 IBM--Power Systems Firmware IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the ASMI web interface. An unauthenticated attacker with network access can send the FSP a malformed request, allowing arbitrary code execution, giving the attacker full control over the managed system, resulting in a confidentiality, integrity, and availability impact. 2026-08-19 9.6 CVE-2026-16687 IBM--Power Systems Firmware IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the FSP management network protocol. An unauthenticated attacker on the management network can bypass authentication and perform any administrative operation on the managed system, including control of partition power state, configuration, and console access across all hosted partitions, resulting in a confidentiality, integrity, and availability impact to the managed system. 2026-08-19 9.6 CVE-2026-16835 IBM--Power Systems Firmware IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the FSP management network protocol. An attacker with authenticated HMC administrator access can execute arbitrary code on the service processor, giving full control over the managed system, resulting in a confidentiality, integrity, and availability impact. 2026-08-19 8.4 CVE-2026-16832 IBM--Power Systems Firmware IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by a vulnerability in the interface between the BMC/FSP and the host system. An attacker with service account or root access to the BMC/FSP can execute arbitrary code on the host system, giving full control over the host system and all hosted partitions, resulting in a confidentiality, integrity, and availability impact. 2026-08-19 8.2 CVE-2026-16930 IBM--Power Systems Firmware IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, FW950.00 through FW950.H2, OP940.00 through OP940.a1 (Power9), and OP940.00 through OP940.81 (Power HMC) is affected by a vulnerability in the interface between the BMC/FSP and the host system. An attacker with service account or root access to the BMC/FSP can read and write arbitrary regions of host system memory, giving full control over the host system and all hosted partitions, resulting in a confidentiality, integrity, and availability impact. 2026-08-19 8.2 CVE-2026-16933 IBM--Power Systems Firmware IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, FW950.00 through FW950.H2, OP940.00 through OP940.a1 (Power9), and OP940.00 - OP940.81 (Power HMC) is affected by a vulnerability in host firmware configuration parsing. An attacker with service-level access to the BMC/FSP can supply specially crafted configuration data, compromising the host firmware boot stage and everything subsequently loaded by it, resulting in a confidentiality, integrity, and availability impact to the managed system. 2026-08-19 8.2 CVE-2026-17093 IBM--Power Systems Firmware Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, FW950.00 through FW950.H2, OP940.00 through OP940.a1, and OP940.00 - OP940.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the BMC/FSP can exploit this vulnerability, allowing arbitrary code to be executed in the host firmware runtime, giving full control over the managed system, resulting in a confidentiality, integrity, and availability impact to the managed system. 2026-08-19 8.2 CVE-2026-17100 IBM--Power Systems Firmware IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, FW950.00 through FW950.H2, OP940.00 through OP940.a1 (Power9), and OP940.00 - OP940.81 (Power HMC) is affected by a vulnerability in the interface between the BMC/FSP and the host system. An attacker with service account or root access to the BMC/FSP can write arbitrary data to hardware control registers, allowing full control over the host system and all hosted partitions, resulting in a confidentiality, integrity, and availability impact. 2026-08-19 8.1 CVE-2026-17429 IBM--Power Systems Firmware IBM Power Systems Firmware FW1120.00, and FW1110.00 through FW1110.30 is affected by a vulnerability in the interface between the BMC and the host system. An attacker with service access to the BMC can send a specially crafted command, allowing arbitrary code to be executed on the host system, giving full control over the host system and all hosted partitions, resulting in a confidentiality, integrity, and availability impact. 2026-08-19 8.2 CVE-2026-17494 IBM--Power Systems Firmware IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the ASMI web interface. An attacker who can lure a logged-in ASMI administrator to visit a crafted web page can, under specific conditions, silently perform administrative actions on the FSP on behalf of that administrator, resulting in a confidentiality, integrity, and availability impact to the managed system. 2026-08-19 8.3 CVE-2026-18848 IBM--Power Systems Firmware Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by a vulnerability in the host firmware boot process image validation path. An attacker with service access to the service processor can supply a maliciously crafted code update image, allowing arbitrary code to be executed on the host system. Successful exploitation could result in a confidentiality, integrity, and availability impact to the affected host system. 2026-08-19 8.2 CVE-2026-19234 IBM--Power Systems Firmware IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the ASMI web interface. An unauthenticated attacker on the management network can cause the ASMI web server to crash with possible memory corruption and generate an error log; hosted partitions are not affected. The ASMI web interface will restart automatically; however, repeated exploitation could result in a sustained loss of access to the ASMI management interface, resulting in an integrity and availability impact. 2026-08-19 7.6 CVE-2026-16828 IBM--Power Systems Firmware IBM Power Systems Firmware FW950.00 through FW950.H2, OP940.00 through OP940.a1 (Power9), and OP940.00 - OP940.81 (Power HMC) is affected by a vulnerability in host firmware NVRAM parsing. An attacker with root access to a guest partition on an OpenPOWER system can write a specially crafted NVRAM image, causing the host firmware boot stage to crash with possible memory corruption. This condition persists until operator intervention - clearing NVRAM via the service processor - to restore normal operation. This vulnerability only affects OpenPOWER systems; systems running PowerVM are not affected. Successful exploitation results in an integrity and availability impact to the managed system. 2026-08-19 7.3 CVE-2026-17042 IBM--Power Systems Firmware IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by a vulnerability in the interface between the BMC/FSP and the host system. An attacker with service account or root access to the BMC/FSP can access and disrupt host processor state, potentially affecting the managed system and all hosted partitions, resulting in an confidentiality, and availability impact. 2026-08-19 7.9 CVE-2026-17063 IBM--PowerVM Hypervisor IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can exploit this vulnerability, allowing arbitrary code to be executed in the host firmware runtime, giving full control over the managed system, resulting in a confidentiality, integrity, and availability impact to the managed system. 2026-08-19 8.2 CVE-2026-16661 IBM--PowerVM Hypervisor IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to read or modify arbitrary regions of Hostboot memory, compromising the host firmware boot stack and the hypervisor subsequently loaded by it. Successful exploitation results in a confidentiality, integrity, and availability impact to the managed system. 2026-08-19 8.2 CVE-2026-16707 IBM--PowerVM Hypervisor IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the PowerVM hypervisor call interface. An attacker with root access to a guest partition can issue a specially crafted hypervisor call to inject an arbitrary amount of data into hypervisor or partition memory, resulting in either a crash causing a full platform re-IPL and terminating all hosted partitions, or corruption of hypervisor or partition memory. The PowerVM hypervisor will restart automatically; however, repeated exploitation could result in a sustained availability impact. Successful exploitation results in an integrity and availability impact to the managed system. 2026-08-19 8.4 CVE-2026-17091 IBM--PowerVM Hypervisor IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 Power Systems Firmware is affected by a vulnerability in partition firmware during network boot. An unauthenticated attacker with access to the same network as a partition performing a network boot can prevent that partition from completing its boot sequence. On partitions where OS secure boot is not enabled, which is the default configuration, the attacker can also substitute the boot image, compromising everything subsequently loaded by that partition. Other partitions and the managed system are not affected. Only partitions actively performing a network boot are affected, resulting in a confidentiality, integrity, and availability impact. 2026-08-19 8.1 CVE-2026-17414 IBM--PowerVM Hypervisor IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the PowerVM hypervisor call interface. An attacker with root access to a guest partition can issue a specially crafted hypervisor call causing a virtual processor to become permanently unresponsive, requiring a full platform re-IPL to restore normal operation. In some cases this may also cause the guest to inject a small amount of data into hypervisor or partition memory with no attacker control over the target location. Successful exploitation results in an integrity and availability impact to the managed system. 2026-08-19 7.3 CVE-2026-17097 IBM--PowerVM Hypervisor IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 Power Systems Firmware is affected by a vulnerability in partition firmware during network boot. An unauthenticated attacker on the same network as a partition undergoing network boot can send a malformed packet, allowing arbitrary code to be executed in the partition firmware and compromising everything subsequently loaded by that partition. Other partitions and the managed system are not affected. Only partitions actively performing a network boot are affected, resulting in a confidentiality, integrity, and availability impact. 2026-08-19 7.5 CVE-2026-18821 IBM--PowerVM Hypervisor IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the service processor can write specially crafted configuration data, causing the host firmware boot stack to crash with possible memory corruption during system initialisation, resulting in an integrity and availability impact to the managed system. 2026-08-19 7.3 CVE-2026-18871 ICEcoder--ICEcoder ICEcoder 8.1 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by chaining an authentication bypass, CSRF validation bypass, and unsanitized command execution. Attackers can send a single HTTP POST request to the terminal endpoint with a password parameter to bypass authentication, a non-empty csrf parameter to skip CSRF validation, and an arbitrary command string passed directly to proc_open() to achieve remote code execution as the web-server user. 2026-08-19 9.8 CVE-2026-63722 indilib--indi INDI (Instrument Neutral Distributed Interface) indiserver through 2.2.4.2, fixed in commit 96bbd7f, contains a stack buffer overflow vulnerability that allows unauthenticated remote attackers to crash the daemon by sending malformed XML with mismatched tags whose names exceed 1024 bytes. Attackers can send a single TCP packet on port 7624 with mismatched XML tags to trigger an unbounded sprintf() write into a fixed 1024-byte stack buffer in MsgQueue.cpp, terminating the daemon and disrupting all active client and driver sessions. 2026-08-17 7.5 CVE-2026-71979 indithemes--IT Residence Subscriber Arbitrary File Upload in IT Residence defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options. 2026-08-18 7.5 CVE-2026-66046 libexpat--libexpat Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex member past allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a wild pointer dereference causing a segfault. This vulnerability was introduced by the fix for CVE-2026-66046. 2026-08-20 7.5 CVE-2026-76641 libfuse--sshfs SSHFS is a network filesystem client for connecting to SSH servers. Prior to version 3.7.6, a rogue SFTP server can return absolute symlink targets or relative targets containing parent-directory components that SSHFS passes through FUSE for resolution by the client kernel against the local filesystem. The documented transform_symlinks mitigation does not contain relative targets because transform_symlink() returns early at sshfs.c:2181, while sshfs_readlink() at sshfs.c:2234 to sshfs.c:2236 otherwise copies the server-supplied link target to the kernel. A victim or victim-side tool that follows such a link through ordinary operations such as cp, rsync, backup tooling, or an editor can disclose readable local files back to the server or write server-controlled content to writable local files, potentially including startup or scheduled-task files. This issue is fixed in version 3.7.6. 2026-08-19 9.3 CVE-2026-47187 libfuse--sshfs SSHFS is a network filesystem client for connecting to SSH servers. From version 1.4 until 3.7.6, SSHFS accepts a bracketed mount source such as [-oProxyCommand=CMD]:/path and find_base_path() removes the brackets, leaving a host value that begins with - and is passed directly to ssh as a command-line argument. When a caller also supplies a path-valued sftp_server, ssh treats the normalized host as an option and the server path as its destination, causing an injected ProxyCommand to execute locally before any connection or authentication succeeds. The attack requires a caller or wrapper that passes an attacker-controlled mount source to SSHFS with the required sftp_server configuration and results in arbitrary command execution as the user running SSHFS. This issue is fixed in version 3.7.6. 2026-08-19 7 CVE-2026-48711 libgit2--libgit2 libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 performs a fixed-size strncmp in set_data in src/libgit2/transports/smart_pkt.c without first verifying that the smart-protocol pkt-line capability buffer contains 14 bytes. A malicious Git server can make bytes after the pkt-line complete object-format=, causing format_str to advance beyond the pkt-line and the following memchr length calculation to underflow. The resulting heap out-of-bounds walk can crash a client during the first refs-advertisement packet over HTTP, HTTPS, SSH, or the Git protocol. This issue is fixed in versions 1.8.6 and 1.9.5. 2026-08-20 7.5 CVE-2026-53587 LibVNC--libvncserver LibVNCClient is a library for easy implementation of a VNC client. In versions 0.9.12 through 0.9.15, a malicious (or man-in-the-middle) VNC server can force a connecting `libvncclient` to write attacker-controlled data past the end of its framebuffer. This is an out-of-bounds heap write with attacker-controlled length, contents, and offset. It needs no authentication (the attacker is the server), works in a default build with default settings, and fires from a single `FramebufferUpdate` the moment the victim connects. It crashes any client unconditionally (denial of service); we also demonstrated it overwriting an application callback pointer and redirecting execution to attacker-chosen code (code execution) under the default configuration. Commit 540332be3e0acc566fa64da6f1b4680c72c724dd patches the issue. 2026-08-21 8.8 CVE-2026-50538 liedekef--Events Made Easy The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the eme_single_event_page_template function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. The stored traversal payload is triggered passively when any visitor loads the affected single-event page, meaning post-submission execution does not require additional attacker interaction. 2026-08-20 7.5 CVE-2026-75963 liftoff-sr--CIPster A security flaw has been discovered in liftoff-sr CIPster 1802525be27d33e19a9a83c163e331a1d13b1892. The impacted element is the function CipAttribute::GetAttrData/CipAttribute::SetAttrData of the file ciptypes.h of the component Generic Attribute Logic. Performing a manipulation results in memory corruption. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The patch is named e745d9d4a8ca3a13689066983a1269fe1e567674. It is suggested to install a patch to address this issue. 2026-08-20 7.3 CVE-2026-76987 Linuxfabrik--monitoring-plugins linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses those modules to run external monitoring commands. From the earliest affected releases until linuxfabrik-lib 5.0.0 and Linuxfabrik Monitoring Plugins 6.0.0, check plugins embedded user-controlled values in command strings passed to lib.shell.shell_exec(), which split strings at pipe characters and executed the resulting commands. In check-plugins/restic-check/restic-check, the --repo parameter could inject a pipe-delimited command into a constructed restic invocation, and sudo-authorized execution allowed a compromised nagios or icinga account to run that command as root. The shared library also accepted command strings and a shell parameter, while numerous plugins constructed external commands from attacker-influenced arguments. The fixes require argv lists, always use shell=False, remove pipe splitting, and reject option-like positional values through lib.shell.safe_cli_value(). These issues are fixed in linuxfabrik-lib 5.0.0 and Linuxfabrik Monitoring Plugins 6.0.0. 2026-08-18 7.8 CVE-2026-55426 logto-io--logto Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's email subaddressing blocklist in packages/core/src/libraries/sign-in-experience/email-blocklist-policy.ts used the attacker-controlled domain from email input to construct subaddressingRegex when blockSubaddressing was enabled. The permissive emailRegEx accepted multiple at signs and regular expression metacharacters, and POST /api/experience/verification/verification-code could therefore cause catastrophic backtracking in subaddressingRegex.test(email). The resulting event-loop stall could make authentication, token issuance, SSO, and the administrative console unavailable. This issue is fixed in version 1.41.0. 2026-08-19 7.5 CVE-2026-62317 louislam--dockge Dockge validates a stack name only on the write path. In backend/stack.ts the allow-list check in validate(), which requires the name to match ^[a-z0-9_-]+$, is reached from save() alone, while the path getter returns path.join(this.server.stacksDir, this.name) and Stack.getStack builds path.join(server.stacksDir, stackName) with no check. The socket handlers in backend/agent-socket-handlers/docker-socket-handler.ts confirm the caller is logged in and that the name is a string, then pass it straight to Stack.getStack, so a name containing traversal sequences resolves outside the managed stacks directory. An authenticated user can therefore read the composeENV and composeYAML values of any directory the server process can reach, which discloses the secrets in that directory's .env or Compose file, and can invoke delete(), which runs docker compose down and then fsAsync.rm on the traversed path with recursive and force set, removing that directory. Disclosure is limited to files named .env or an accepted Compose filename, and deletion requires the target directory to hold a valid Compose file so that docker compose down exits successfully. Dockge commonly runs as root with access to the Docker socket, so the reachable set includes unrelated applications on the host. Instances configured with disableAuth, a supported option that logs the caller in as admin automatically, expose both operations without authentication. 2026-08-20 8.8 CVE-2026-73040 lukeseager--WordPress Persistent Login Subscriber SQL Injection in WordPress Persistent Login
Read more »
Friday August 14
11:24 am
Who’s Tracking You? Use This New Service to Find Out | Krebs on Security
Who’s Tracking You? Use This New Service to Find Out
It can be daunting to determine who's responsible for showing ads on the websites we visit, or who's harvesting data from the mobile apps we use every day. That information is already semi-public, but it is not easily parsed and traditionally much of it has remained walled away in the hands of large advertising platforms. Not anymore: A powerful and free new service called DecryptAds scrapes and correlates this adtech data and makes it simple to quickly learn a great deal about the entities that are tracking you.
Read more »
Tuesday August 11
09:28 pm
Microsoft Plugs Nearly 400 Security Holes | Krebs on Security
Microsoft Plugs Nearly 400 Security Holes
Microsoft today released updates to remedy at least 398 security vulnerabilities in its Windows operating systems and supported software, including one weakness that is already being actively exploited and two others that were publicly detailed prior to today.
Read more »
Thursday August 06
05:00 pm
Canadian Man Pleads Guilty in Snowflake Extortions | Krebs on Security
Canadian Man Pleads Guilty in Snowflake Extortions
A 26-year-old Canadian man once described as one of the most consequential cybercrime threat actors of 2024 has pleaded guilty to computer fraud and conspiracy to hack and extort more than 165 organizations that used the cloud data storage provider Snowflake. Connor Riley Moucka, of Kitchener, Ontario, also admitted to stealing call and text history records of more than 100 million AT&T customers.
Read more »
Monday August 03
11:14 am
Vulnerability Summary for the Week of July 27, 2026 | US-CERT Alerts
Vulnerability Summary for the Week of July 27, 2026
High Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info @fastify/rate-limit--@fastify/rate-limit @fastify/rate-limit before 11.2.0 keys rate-limit buckets by the verbatim client IP string returned from request.ip. Because a single IPv6 client can control a large address range (a /64 holds 2^64 distinct addresses) and the same address has multiple valid textual representations, an IPv6 capable client can defeat the rate-limit boundary by rotating addresses or by rewriting the same address in different forms. Applications that use @fastify/rate-limit to protect endpoints such as authentication, password reset, OTP delivery, or expensive API calls can be bypassed by IPv6 clients behind a proxy that surfaces IPv6 to the origin when trustProxy is enabled. The issue is fixed in @fastify/rate-limit 11.2.0, where the default key generator normalizes IPv6 addresses to their canonical form, collapses IPv4 mapped IPv6 to IPv4, and applies a configurable prefix mask (default /64) via a new ipv6Subnet option. 2026-07-29 7.3 CVE-2026-15144 acacode--swagger-typescript-api swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, templates/base/http-clients/axios-http-client.ejs interpolates servers[0].url from src/code-gen-process.ts into the HttpClient constructor without escaping, allowing an attacker-controlled OpenAPI spec to inject code that executes when new HttpClient() or new Api() is constructed. This issue is fixed in version 13.12.2. 2026-07-29 8.3 CVE-2026-54661 acacode--swagger-typescript-api swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/code-gen-process.ts createApiConfig copies servers[0].url into apiConfig.baseUrl, and templates/base/http-clients/fetch-http-client.ejs interpolates apiConfig.baseUrl into the generated HttpClient baseUrl field without escaping, allowing an attacker-controlled OpenAPI spec to inject TypeScript static field code that executes when the generated fetch client module is imported. This issue is fixed in version 13.12.2. 2026-07-29 8.3 CVE-2026-54662 acacode--swagger-typescript-api swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-parser/base-schema-parsers/enum.ts passes components.schemas.*.enum[i] values to Ts.StringValue in src/configuration.ts without escaping before templates/base/enum-data-contract.ejs renders TypeScript enum declarations, allowing an attacker-controlled OpenAPI spec to inject code that executes when the generated module is imported. This issue is fixed in version 13.12.2. 2026-07-29 8.3 CVE-2026-54664 acacode--swagger-typescript-api swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-routes/schema-routes.ts passes OpenAPI path keys through parseRouteName to templates/default/procedure-call.ejs and templates/modular/procedure-call.ejs without escaping JavaScript template literal interpolation, allowing an attacker-controlled path containing ${...} to execute when the generated method is called. This issue is fixed in version 13.12.2. 2026-07-29 8.3 CVE-2026-54666 acacode--swagger-typescript-api swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts getRemoteRequestHeaders forwards --authorizationToken to every URL fetched by fetchRemoteSchemaDocument while warmUpRemoteSchemasCache resolves external $ref URLs, allowing an attacker-controlled OpenAPI spec to exfiltrate the developer or CI bearer token to a cross-origin endpoint. This issue is fixed in version 13.12.2. 2026-07-29 7.4 CVE-2026-54660 acowebs--Dynamic Pricing With Discount Rules for WooCommerce Unauthenticated Cross Site Scripting (XSS) in Dynamic Pricing With Discount Rules for WooCommerce = 1.4.0-beta.27 through = 1.7.0-beta.0 through sk) inside smc_cdc_msg_recv(). No reference is held across the lock release. The only reference pinning the socket while the connection is discoverable in the link group is taken in smc_lgr_register_conn() (sock_hold) and dropped in __smc_lgr_unregister_conn() (sock_put), both under conns_lock. Once the handler drops conns_lock, a concurrent close() - > smc_release() - > smc_conn_free() - > smc_lgr_unregister_conn() can drop that reference and free the smc_sock, so the handler's later sock_hold() runs on freed memory: WARNING: lib/refcount.c:25 at refcount_warn_saturate Workqueue: rxe_wq do_work refcount_warn_saturate (lib/refcount.c:25) smc_cdc_msg_recv (net/smc/smc_cdc.c:430) smc_cdc_rx_handler (net/smc/smc_cdc.c:502) smc_wr_rx_tasklet_fn (net/smc/smc_wr.c:445) tasklet_action_common (kernel/softirq.c:938) handle_softirqs (kernel/softirq.c:622) Kernel panic - not syncing: panic_on_warn set Only SMC-R is affected. The SMC-D receive tasklet is stopped by tasklet_kill(&conn- >rx_tsklet) in smc_conn_free() before the connection is unregistered, so it cannot run concurrently with the free. Take the socket reference while still holding conns_lock, so the registration reference can no longer be the last one, and drop it once the handler is done. 2026-07-27 9.8 CVE-2026-64541 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: sctp: validate STALE_COOKIE cause length before reading staleness When an ERROR chunk with a STALE_COOKIE cause is received in the COOKIE_ECHOED state, sctp_sf_do_5_2_6_stale() reads the 4-byte Measure of Staleness that follows the cause header: err = (struct sctp_errhdr *)(chunk- >skb- >data); stale = ntohl(*(__be32 *)((u8 *)err + sizeof(*err))); err is the first cause in the chunk, not the STALE_COOKIE cause that caused the dispatch, and nothing guarantees the staleness field is present. sctp_walk_errors() only requires a cause to be as long as the 4-byte header, so for a STALE_COOKIE cause of length 4 the read runs past the cause, and for a minimal ERROR chunk past skb- >tail. The value is echoed to the peer in the Cookie Preservative of the reply INIT, leaking uninitialized memory. sctp_sf_cookie_echoed_err() already walks to the STALE_COOKIE cause, so check its length there and pass it to sctp_sf_do_5_2_6_stale(), which reads that cause instead of the first one. A STALE_COOKIE cause too short to hold the staleness field is discarded. The read is reachable by any peer that can drive an association into COOKIE_ECHOED, including an unprivileged process using a raw SCTP socket in a user and network namespace. 2026-07-27 9.1 CVE-2026-64551 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop The loop in is_ap_in_tkip() iterates over IEs without verifying that enough bytes remain before dereferencing the IE header or its payload: - pIE- >element_id and pIE- >length are read without checking that i + sizeof(*pIE) data + 12, which requires pIE- >length >= 16. For WLAN_EID_RSN it compares pIE- >data + 8, requiring pIE- >length >= 12. Neither requirement is checked. Add the missing IE header and payload bounds checks and guard each data access with an explicit pIE- >length minimum, matching the pattern established in update_beacon_info(). 2026-07-27 8.1 CVE-2026-64536 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() genelink_rx_fixup() splits an aggregated RX frame into its individual packets, using a per-packet length taken from device-supplied data. That length is only bounded by GL_MAX_PACKET_LEN (1514); it is never compared against how many bytes were actually received. A malicious GeneLink (GL620A) device can therefore send a short URB whose header claims packet_count > 1 and a first packet of up to 1514 bytes. skb_put_data(gl_skb, packet- >packet_data, size); then copies past the end of the receive buffer and hands the adjacent slab contents up the network stack, an out-of-bounds read that leaks kernel heap. No privilege is required: the path runs in the usbnet RX softirq as soon as the interface is up. BUG: KASAN: slab-out-of-bounds in genelink_rx_fixup (drivers/net/usb/gl620a.c:112) Read of size 1514 at addr ffff888011309708 by task ksoftirqd/0/14 Call Trace: ... __asan_memcpy (mm/kasan/shadow.c:105) genelink_rx_fixup (include/linux/skbuff.h:2814 drivers/net/usb/gl620a.c:112) usbnet_bh (drivers/net/usb/usbnet.c:572 drivers/net/usb/usbnet.c:1589) process_one_work (kernel/workqueue.c:3322) bh_worker (kernel/workqueue.c:3405) tasklet_action (kernel/softirq.c:965) handle_softirqs (kernel/softirq.c:622) run_ksoftirqd (kernel/softirq.c:1076) ... skb_pull() already verifies that the requested length fits the buffer and returns NULL otherwise. Move it ahead of the copy and check its result, so a packet that overruns the received data is rejected before it is read. Well-formed frames, whose packets are fully present, are unaffected. 2026-07-27 8.1 CVE-2026-64540 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: net: usb: net1080: validate packet_len before pad-byte access in rx_fixup For an even packet_len, net1080_rx_fixup() reads the pad byte at skb- >data[packet_len] before the skb- >len != packet_len check further down, and packet_len is only bounded against NC_MAX_PACKET. A malicious NetChip 1080 device can send a short frame advertising a large even packet_len (e.g. 0x4000), so the pad-byte read lands past the end of the skb: BUG: KASAN: slab-out-of-bounds in net1080_rx_fixup Read of size 1 at addr ffff8880106c83c6 by task ksoftirqd/0/14 ... net1080_rx_fixup (drivers/net/usb/net1080.c:384) usbnet_bh (drivers/net/usb/usbnet.c:1589) process_one_work (kernel/workqueue.c:3322) bh_worker (kernel/workqueue.c:3708) tasklet_action (kernel/softirq.c:965) handle_softirqs (kernel/softirq.c:622) ... Reject the frame when packet_len >= skb- >len before reading. 2026-07-27 8.1 CVE-2026-64547 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() When the scatterlist ring is full or nearly full, bpf_msg_push_data() enters a copy fallback path and computes copy + len for the page allocation size. Since len comes from BPF with arg3_type = ARG_ANYTHING and both are u32, a crafted len can wrap the sum to a small value, causing an undersized allocation followed by an out-of-bounds memcpy. BUG: unable to handle page fault for address: ffffed104089a402 Oops: Oops: 0000 [#1] SMP KASAN NOPTI Call Trace: __asan_memcpy (mm/kasan/shadow.c:105) bpf_msg_push_data (net/core/filter.c:2852 net/core/filter.c:2788) bpf_prog_9ed8b5711920a7d7+0x2e/0x36 sk_psock_msg_verdict (net/core/skmsg.c:934) tcp_bpf_sendmsg (net/ipv4/tcp_bpf.c:421 net/ipv4/tcp_bpf.c:584) __sys_sendto (net/socket.c:2206) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) Add an overflow check before the allocation. 2026-07-27 8.4 CVE-2026-64548 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: virtio-net: fix len check in receive_big() receive_big() bounds the device-announced length by (big_packets_num_skbfrags + 1) * PAGE_SIZE. That is still too loose: add_recvbuf_big() sets sg[1] to start at offset sizeof(struct padded_vnet_hdr) into the first page, so the chain actually carries hdr_len + (PAGE_SIZE - sizeof(padded_vnet_hdr)) + big_packets_num_skbfrags * PAGE_SIZE bytes -- 20 bytes less than the check allows for the common hdr_len == 12 case. A malicious virtio backend can announce a len in that gap. page_to_skb() then walks one frag past the page chain, storing a NULL page- >private into skb_shinfo()- >frags[MAX_SKB_FRAGS], which is both an out-of-bounds write past the static frag array and a NULL frag handed up the rx path. Bound len by the size add_recvbuf_big() actually advertised. 2026-07-27 8.4 CVE-2026-64552 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() br_ip6_fragment() gets prevhdr, a pointer into the skb head, from ip6_find_1stfragopt(), then calls skb_checksum_help(). For a cloned skb skb_checksum_help() reallocates the head via pskb_expand_head(), leaving prevhdr dangling. It is later dereferenced in ip6_frag_next(), causing a use-after-free write. Save prevhdr's offset before skb_checksum_help() and recompute it after, like commit ef0efcd3bd3f ("ipv6: Fix dangling pointer when ipv6 fragment"). BUG: KASAN: slab-use-after-free in ip6_frag_next (net/ipv6/ip6_output.c:857) Write of size 1 at addr ffff888013ff5016 by task exploit/141 Call Trace: ... kasan_report (mm/kasan/report.c:595) ip6_frag_next (net/ipv6/ip6_output.c:857) br_ip6_fragment (net/ipv6/netfilter.c:212) nf_ct_bridge_post (net/bridge/netfilter/nf_conntrack_bridge.c:407) nf_hook_slow (net/netfilter/core.c:619) br_forward_finish (net/bridge/br_forward.c:66) __br_forward (net/bridge/br_forward.c:115) maybe_deliver (net/bridge/br_forward.c:191) br_flood (net/bridge/br_forward.c:245) br_handle_frame_finish (net/bridge/br_input.c:229) br_handle_frame (net/bridge/br_input.c:442) ... packet_sendmsg (net/packet/af_packet.c:3114) ... do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Kernel panic - not syncing: Fatal exception in interrupt 2026-07-27 8.8 CVE-2026-64554 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops() kvm_hyp_handle_mops() resets the single-step state machine as part of rewinding state for a MOPS exception by modifying vcpu_cpsr() and writing the result directly into hardware. In the case of nested virtualization, vcpu_cpsr() is a synthetic value such that the rest of KVM can deal with vEL2 cleanly. That means the value requires translation before being written into hardware, which is unfortunately missing from the MOPS handler. Fix it by directly modifying SPSR_EL2 and avoiding the synthetic state altogether, which will be resynchronized on the next 'full' exit back to KVM. 2026-07-27 8.8 CVE-2026-64555 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() l2cap_sock_new_connection_cb() returned l2cap_pi(sk)- >chan after release_sock(parent). Once the parent lock is dropped the newly enqueued child socket sk is reachable via the accept queue, so another task can accept and free it before the callback dereferences sk, resulting in a use-after-free. Rework the - >new_connection() op so the core, rather than the callback, owns the child channel's lifetime. The op now receives a pre-allocated new_chan and returns an errno instead of allocating and returning a channel. l2cap_new_connection() allocates the child channel and links it into the conn list via __l2cap_chan_add() before invoking the callback, so the conn-list reference keeps the channel alive once release_sock(parent) exposes the socket to other tasks. Channel configuration that was duplicated in l2cap_sock_init() and the various new_connection callbacks is consolidated into l2cap_chan_set_defaults(), which now inherits from the parent channel when one is supplied. 2026-07-29 8.8 CVE-2026-64557 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff ("net: openvswitch: remove misbehaving actions length check") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure. 2026-07-27 7.8 CVE-2026-64531 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation} In do_action()'s UpdateRecordDataRoot (fslog.c:3489) and UpdateRecordDataAllocation (fslog.c:3697) cases, the memmove destination is `Add2Ptr(e, le16_to_cpu(e- >view.data_off))`, where e- >view.data_off comes from an on-disk NTFS_DE inside an INDEX_ROOT or INDEX_BUFFER. Neither case validates view.data_off + dlen against e- >size; the existing check_if_index_root / check_if_alloc_index helpers walk the entry chain and validate the entry's offset, but not its internal view fields. The neighbouring read sites (e.g., fs/ntfs3/index.c when iterating view entries) check view.data_off + view.data_size size. Apply the same bound at the two memmove sites. Reproduced under UML+KASAN on mainline 8d90b09e6741 via pr_warn-only probe instrumentation: with view.data_off forced to 0xFFFC, the memmove writes 32 bytes past the end of the NTFS_DE. This is similar in shape to Pavitra Jha's 2026-05-02 patch "fs/ntfs3: prevent oob in case UpdateRecordDataRoot" () which proposes calling ntfs3_bad_de_range(); that helper does not exist in mainline. This patch uses inline checks. 2026-07-27 7.8 CVE-2026-64532 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate lcns_follow in log_replay conversion log_replay() converts DIR_PAGE_ENTRY_32 records into DIR_PAGE_ENTRY records when replaying version 0 restart tables. During this conversion, the memmove() length is derived directly from the on-disk lcns_follow field: memmove(&dp- >vcn, &dp0- >vcn_low, 2 * sizeof(u64) + le32_to_cpu(dp- >lcns_follow) * sizeof(u64)); check_rstbl() validates restart table structure, but does not constrain per-entry lcns_follow values relative to the entry size. A malformed filesystem image can provide an oversized lcns_follow value, causing the conversion memmove() to access memory beyond the bounds of the allocated restart table buffer. The same field is later used to bound iteration over page_lcns[], so validating lcns_follow during conversion also prevents downstream out-of-bounds access from the same malformed metadata. Compute the maximum valid lcns_follow from the already-validated restart table entry size and reject entries that exceed this bound. Reuse the existing t16/t32 scratch variables already declared in log_replay() to avoid introducing new declarations. [almaz.alexandrovich@paragon-software.com: fixed the conflicts] 2026-07-27 7.8 CVE-2026-64533 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix stack OOB write when prepending the Flags AD eir_create_adv_data() builds the advertising data into a fixed-size buffer ("size", 31 for the legacy path). It may prepend a 3-byte "Flags" AD structure (LE_AD_NO_BREDR on an LE-only controller) and then copies the per-instance data without checking that it still fits: memcpy(ptr, adv- >adv_data, adv- >adv_data_len); tlv_data_max_len() only reserves those 3 bytes when the user-supplied flags carry a managed-flags bit, so an instance added with flags == 0 is accepted with adv_data_len up to the full buffer. At advertise time the flags are still prepended, and the memcpy() writes 3 + adv_data_len bytes into the size-byte buffer: BUG: KASAN: stack-out-of-bounds in eir_create_adv_data (net/bluetooth/eir.c:301) Write of size 31 at addr ffff88800a547bdc by task kworker/u9:0/65 Workqueue: hci0 hci_cmd_sync_work __asan_memcpy (mm/kasan/shadow.c:106) eir_create_adv_data (net/bluetooth/eir.c:301) hci_update_adv_data_sync (net/bluetooth/hci_sync.c:1310) hci_schedule_adv_instance_sync (net/bluetooth/hci_sync.c:1817) hci_cmd_sync_work (net/bluetooth/hci_sync.c:332) This frame has 1 object: [32, 64) 'cp' The "Flags" structure is added by the kernel, not requested by userspace, so only prepend it when it fits together with the instance advertising data; when there is no room for both, drop the flags rather than the user-provided data. Reachable by a local user with CAP_NET_ADMIN owning an LE-only controller on the legacy advertising path. 2026-07-27 7.8 CVE-2026-64539 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: tipc: fix use-after-free of the discoverer in tipc_disc_rcv() bearer_disable() frees b- >disc with tipc_disc_delete()'s plain kfree(), but tipc_disc_rcv() still dereferences b- >disc in RX softirq under rcu_read_lock() (tipc_udp_recv - > tipc_rcv - > tipc_disc_rcv). L2 bearers are safe thanks to the synchronize_net() in tipc_disable_l2_media(), but the UDP bearer defers that call to the cleanup_bearer() workqueue, so the discoverer is freed with no grace period: BUG: KASAN: slab-use-after-free in tipc_disc_rcv (net/tipc/discover.c:149) Read of size 8 at addr ffff88802348b728 by task poc_tipc/184 tipc_disc_rcv (net/tipc/discover.c:149) tipc_rcv (net/tipc/node.c:2126) tipc_udp_recv (net/tipc/udp_media.c:391) udp_rcv (net/ipv4/udp.c:2643) ip_local_deliver_finish (net/ipv4/ip_input.c:241) Freed by task 181: kfree (mm/slub.c:6565) bearer_disable (net/tipc/bearer.c:418) tipc_nl_bearer_disable (net/tipc/bearer.c:1001) The bearer is freed with kfree_rcu(); free the discoverer the same way. Add an rcu_head to struct tipc_discoverer and free it and its skb from an RCU callback. Because the RCU callback (tipc_disc_free_rcu) lives in module text, a call_rcu() that is still pending when the tipc module is unloaded would invoke a freed function. Add an rcu_barrier() to tipc_exit() after the bearer subsystem has been torn down, so all pending discoverer callbacks have run before the module text goes away. Reachable from an unprivileged user namespace: the TIPCv2 genl family is netnsok and its bearer commands have no GENL_ADMIN_PERM. Needs CONFIG_TIPC and CONFIG_TIPC_MEDIA_UDP. 2026-07-27 7.8 CVE-2026-64543 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: net, bpf: check master for NULL in xdp_master_redirect() xdp_master_redirect() dereferences the result of netdev_master_upper_dev_get_rcu() without a NULL check, but that helper returns NULL when the receiving device has no upper-master adjacency. The reach guard only checks netif_is_bond_slave(). On bond slave release bond_upper_dev_unlink() drops the upper-master adjacency before clearing IFF_SLAVE, so an XDP_TX reaching xdp_master_redirect() in that window still passes netif_is_bond_slave() while master is already NULL, and faults on master- >flags at offset 0xb0: BUG: kernel NULL pointer dereference, address: 00000000000000b0 RIP: 0010:xdp_master_redirect (net/core/filter.c:4432) Call Trace: xdp_master_redirect (net/core/filter.c:4432) bpf_prog_run_generic_xdp (include/net/xdp.h:700) do_xdp_generic (net/core/dev.c:5608) __netif_receive_skb_one_core (net/core/dev.c:6204) process_backlog (net/core/dev.c:6319) __napi_poll (net/core/dev.c:7729) net_rx_action (net/core/dev.c:7792) handle_softirqs (kernel/softirq.c:622) __dev_queue_xmit (include/linux/bottom_half.h:33) packet_sendmsg (net/packet/af_packet.c:3082) __sys_sendto (net/socket.c:2252) Kernel panic - not syncing: Fatal exception in interrupt The missing check dates back to the original code; commit 1921f91298d1 ("net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master") later added the master- >flags read where the fault now lands but kept the unconditional deref. Check master for NULL before use; a NULL master is treated the same as one that is not up. 2026-07-27 7.5 CVE-2026-64545 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: drm/edid: fix OOB read in drm_parse_tiled_block() drm_parse_tiled_block() casts the DisplayID block to a struct displayid_tiled_block and reads the full fixed layout up to tile- >topology_id[7] without checking block- >num_bytes. The DisplayID iterator only validates the declared payload length, so a crafted EDID can advertise a tiled-display block (tag DATA_BLOCK_TILED_DISPLAY, or DATA_BLOCK_2_TILED_DISPLAY_TOPOLOGY for v2.0) with a small num_bytes at the end of a DisplayID extension. The read then runs past the end of the exact-sized kmemdup()'d EDID allocation, a heap out-of-bounds read. Reject blocks shorter than the spec's 22-byte tiled payload before reading the fixed struct, as drm_parse_vesa_mso_data() already does. BUG: KASAN: slab-out-of-bounds in drm_edid_connector_update Read of size 2 at addr ffff888010077700 by task exploit/147 dump_stack_lvl (lib/dump_stack.c:94 ...) print_report (mm/kasan/report.c:378 ...) kasan_report (mm/kasan/report.c:595) drm_edid_connector_update (drivers/gpu/drm/drm_edid.c:7581) bochs_connector_helper_get_modes (drivers/gpu/drm/tiny/bochs.c:574) drm_helper_probe_single_connector_modes (drivers/gpu/drm/drm_probe_helper.c:426) status_store (drivers/gpu/drm/drm_sysfs.c:219) ... vfs_write (fs/read_write.c:595 fs/read_write.c:688) ksys_write (fs/read_write.c:740) 2026-07-27 7.1 CVE-2026-64546 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: validate MAP frame length before ingress parsing When ingress deaggregation is disabled, rmnet_map_ingress_handler() passes the skb straight to __rmnet_map_ingress_handler(), skipping the length validation that rmnet_map_deaggregate() performs on the aggregated path. The parser then dereferences the MAP header and csum header/trailer based on the on-wire pkt_len without checking skb- >len, so a short frame is read out of bounds: BUG: KASAN: slab-out-of-bounds in rmnet_map_checksum_downlink_packet Read of size 1 at addr ffff88801118ed00 by task exploit/147 Call Trace: ... rmnet_map_checksum_downlink_packet (drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c:413) __rmnet_map_ingress_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:96) rmnet_rx_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:129) __netif_receive_skb_core.constprop.0 (net/core/dev.c:6089) netif_receive_skb (net/core/dev.c:6460) tun_get_user (drivers/net/tun.c:1955) tun_chr_write_iter (drivers/net/tun.c:2001) vfs_write (fs/read_write.c:688) ksys_write (fs/read_write.c:740) do_syscall_64 (arch/x86/entry/syscall_64.c:94) ... Factor that validation out of rmnet_map_deaggregate() into rmnet_map_validate_packet_len() and run it on the no-aggregation path too. The MAP header is bounds-checked first, since this path can receive a frame shorter than the header. 2026-07-27 7.3 CVE-2026-64550 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: perf/core: Detach event groups during remove_on_exec perf_event_remove_on_exec() removes events by calling perf_event_exit_event(). For top-level events, this removes the event from the context with DETACH_EXIT only. This can leave inconsistent group state when a removed event is a group leader and the group contains siblings without remove_on_exec. If the group was active, the surviving siblings can remain active and attached to the removed leader's sibling list, but are no longer represented by a valid group leader on the PMU context active lists. A later close of the removed leader uses DETACH_GROUP and can promote the still-active siblings from this stale group state. The next schedule-in can then add an already-linked active_list entry again, corrupting the PMU context active list. With DEBUG_LIST enabled, this is caught as a list_add double-add in merge_sched_in(). Fix this by detaching group relationships when remove_on_exec removes an event. This preserves the existing task-exit and revoke behavior, while ensuring surviving siblings are ungrouped before the removed event leaves the context. 2026-07-29 7.8 CVE-2026-64556 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in pkey_pckmo handler implementation Explicitly check the length of the target buffer in the pkey_pckmo implementation of the key_to_protkey() handler function. The handler function fails, if the generated output data exceeds the length of the provided target buffer. 2026-07-29 7.8 CVE-2026-64558 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in PKEY_VERIFYPROTK ioctl Explicitly check the buffer length request structure provided by user-space and fail, if it exceeds the buffer size. 2026-07-29 7.8 CVE-2026-64559 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by non-leader exec() race Wongi and Jungwoo decoded and reported a non-leader exec() related race which can result in an UAF: sys_timer_delete() exec() posix_cpu_timer_del() // Observes old leader p = pid_task(pid, pid_type); de_thread() switch_leader(); release_task(old_leader) __exit_signal(old_leader) sighand = lock(old_leader, sighand); posix_cpu_timers*_exit(); sighand = lock_task_sighand(p) unhash_task(old_leader); sh = lock(p, sighand) old_leader- >sighand = NULL; unlock(sighand); (p- >sighand == NULL) unlock(sh) return NULL; // Returns without action if(!sighand) return 0; free_posix_timer(); This is "harmless" unless the deleted timer was armed and enqueued in p- >signal because on exec() a TGID targeted timer is inherited. As sys_timer_delete() freed the underlying posix timer object run_posix_cpu_timers() or any timerqueue related add/delete operations on other timers will access the freed object's timerqueue node, which results in an UAF. There is a similar problem vs. posix_cpu_timer_set(). For regular posix timers it just transiently returns -ESRCH to user space, but for the use case in do_cpu_nanosleep() it's the same UAF just that the k_itimer is allocated on the stack. Also posix_cpu_timer_rearm() fails to rearm the timer, which means it stops to expire. While debating solutions Frederic pointed out another problem: posix_cpu_timer_del(tmr) __exit_signal(p) posix_cpu_timers*_exit(p); unhash_task(p); p- >sighand = NULL; sh = lock_task_sighand(p) sighand = p- >sighand; if (!sighand) return NULL; lock(sighand); if (!sh) WARN_ON_ONCE(timer_queued(tmr)); On weakly ordered architectures it is not guaranteed that posix_cpu_timer_del() will observe the stores in posix_cpu_timers*_exit() when p- >sighand is observed as NULL, which means the WARN() can be a false positive. Solve these issues by: 1) Changing the store in __exit_signal() to smp_store_release(). 2) Adding a smp_acquire__after_ctrl_dep() into the !sighand path of lock_task_sighand(). 3) Creating a helper function for looking up the task and locking sighand which does not return when sighand == NULL. Instead it retries the task lookup and only if that fails it gives up. 4) Using that helper in the three affected functions. #1/#2 ensures that the reader side which observes sighand == NULL also observes all preceeding stores, i.e. the stores in posix_cpu_timers*_exit() and the ones in unhash_task(). #3 ensures that the above described non-leader exec() situation is handled gracefully. When the task lookup returns the old leader, but sighand == NULL then it retries. In the non-leader exec() case the subsequent task lookup will observe the new leader due to #1/#2. In normal exit() scenarios the subsequent lookup fails. When the task lookup fails, the function also checks whether the timer is still enqueued and issues a warning if that's the case. Unfortunately there is nothing which can be done about it, but as the task is already not longer visible the timer should not be accessed anymore. This check also requires memory ordering, which is not provided when the first lookup fails. To achieve that the check is preceeded by a smp_rmb() which pairs with the smp_wmb() in write_seqlock() in __exit_signal(). That ensures that the stores in posix_cpu_timers*_exit() are visible. The history of the non-leader exec() issue goes back to the early days of posix CPU timers, which stored a pointer to the group leader task in the timer. That obviously fails when a non-leader exec() switches the leader. commit e0a70217107e ("posix-cpu-timers: workaround to suppress the problems with mt exec") added a temporary workaround for that in 2010 which surv ---truncated--- 2026-07-29 7.8 CVE-2026-64560 litestar-org--litestar Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie being excluded from automatic escaping by the template engine when configured inline with documentation recommendations. This issue has been patched in version 2.20.0. 2026-07-28 8.1 CVE-2026-48060 magepeopleteam--Booking and Rental Manager Unauthenticated Other Vulnerability Type in Booking and Rental Manager by(), so Laravel derived a constant cache key (md5('authentication')) shared by every request. An unauthenticated attacker sending roughly ten requests per minute from a single IP, most cheaply against the checkpoint endpoint (which has no reCAPTCHA), exhausts the shared counter and causes HTTP 429 for every user attempting to log in or complete two-factor authentication, a panel-wide authentication denial of service that also locks out administrators. This issue is fixed in version 1.13.0. 2026-07-28 7.5 CVE-2026-61609 pterodactyl--wings Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, {{config.}} placeholders in egg configuration-file templates allow a low-privileged user to read {{config.token}}, {{config.token_id}}, and {{config.docker.registries}} from the full daemon configuration. This issue is fixed in version 1.12.3. 2026-07-31 9.9 CVE-2026-52855 pterodactyl--wings Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a malformed packet received during the SFTP connection handshake causes a Go panic. This issue is fixed in version 1.13.0. 2026-07-31 7.5 CVE-2026-52856 QuantumCloud--Simple Link Directory Pro Unauthenticated Server Side Request Forgery (SSRF) in Simple Link Directory Pro 'post'`, any author-level user who has authored a `wwp_requests` post - such as one created via the wholesale registration form - can access this nonce and submit the role-assignment request. 2026-07-29 8.8 CVE-2026-12144 savonrb--savon Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all_operations interpolates attacker-controlled WSDL operation names into Ruby source passed to module_eval, allowing Ruby code execution in the application process. This issue is fixed in version 2.17.2. 2026-07-31 8.1 CVE-2026-53510 Sender--Sender Newsletter, SMS and Email Marketing Automation for WooCommerce Administrator SQL Injection in Sender - Newsletter, SMS and Email Marketing Automation for WooCommerce subscribe() callback after it had already called params- >notify(conn, params, NULL, 0). Per the public GATT API, a notify callback with NULL data is the documented signal that the subscription has terminated and the bt_gatt_subscribe_params struct may be freed or reused by the application; calling subscribe() on the struct afterwards is a use-after-free, including an indirect call through the freed params- >subscribe function pointer. The error branch is remotely (adjacent) reachable: a Zephyr device acting as a GATT client that calls bt_gatt_subscribe() can be driven into this ordering when a connected GATT server peer answers the CCC write with an ATT Error Response (the peer-supplied error code flows through att_error_rsp - > att_handle_rsp into gatt_write_ccc_rsp). For applications that free or recycle subscription parameters in their notification-termination handler, this results in memory corruption, a crash (denial of service), or potentially attacker-influenced control flow. The fix reorders the handler so the subscribe() callback runs before the terminating notify(NULL) in both the error and unsubscribe paths. 2026-07-31 7.6 CVE-2026-10685 zephyrproject--zephyr The OCPP 1.6 client in subsys/net/lib/ocpp parsed inbound WAMP RPC frames in parse_rpc_msg() (subsys/net/lib/ocpp/ocpp_j.c) using a hand-rolled helper, extract_string_field(), that copied the message's uid and action fields with strncpy(out_buf, token + 1, outlen - 1) and then scanned the result with strchr(out_buf, '"'). Because strncpy does not NUL-terminate the destination when the source is at least outlen - 1 (127) bytes long, the subsequent strchr reads past the 128-byte destination buffer into adjacent stack memory; if a " byte is found beyond the buffer, a one-byte out-of-bounds NUL write also occurs. A related defect in extract_payload() runs strchr/strrchr over the receive buffer, which may not be NUL-terminated when a maximal-length frame fills it. The parsed bytes come directly from the OCPP central-system server over a websocket: the reader thread fills recv_buf via websocket_recv_msg() and calls parse_rpc_msg() on each inbound DATA frame (subsys/net/lib/ocpp/ocpp.c). A malicious or compromised central server, or an on-path attacker (OCPP is commonly deployed over plain ws://), can send an RPC frame whose uid or action field is 127+ bytes with no closing quote, triggering the out-of-bounds access. The primary impact is a remotely triggerable denial of service: the unbounded scan can fault on an unmapped page, and the stray NUL write can corrupt adjacent stack state. The over-read data is not reflected to the peer, so disclosure is limited. The feature is EXPERIMENTAL and must be explicitly enabled (CONFIG_OCPP). The fix replaces the manual parser with the bounds-respecting json_mixed_arr_parse() and copies the extracted uid with an explicitly NUL-terminated buffer, eliminating both over-reads. 2026-08-02 7 CVE-2026-10848 zip-lib--zip-lib Versions of the package zip-lib before 1.1.0 are vulnerable to Directory Traversal via the caching mechanism for path validation during the extraction process. An attacker can bypass security checks designed to prevent directory traversal. The intended security function, isOutsideTargetFolder, only checks and caches the path status when the initial directory symlink is created during the first extraction. 2026-07-28 7.5 CVE-2026-17524 Back to top Medium Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info 100plugins--Open User Map Contributor Cross Site Scripting (XSS) in Open User Map prepare() or any integer casting. Additionally, the nonce verification check is performed after the SQL query has already executed, providing no protection against the injection. This makes it possible for authenticated attackers with subscriber-level access and above to inject arbitrary SQL commands, potentially leading to unauthorized extraction of sensitive database contents including user credentials and configuration data. 2026-07-28 6.5 CVE-2026-6251 chrisvrichardson--MapPress Maps for WordPress Unauthenticated Sensitive Data Exposure in MapPress Maps for WordPress prepare(). The wp_unslash() call explicitly removes the backslash escaping that WordPress's wp_magic_quotes() adds to all $_POST data, neutralizing the only layer of SQL injection protection. The sanitize_text_field() function applied afterward offers no SQL protection. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries to the existing query. 2026-08-01 6.5 CVE-2026-6453 CyberTimon--RapidRAW RapidRAW before 1.6.0 does not validate the lutPath field in preset files before passing it to File::open() in lut_processing.rs. On Windows, a UNC path in lutPath causes an outbound SMB connection to an attacker-controlled host, leaking the victim's NTLMv2 credentials. The vulnerable code path is reachable through two vectors: community presets fetched automatically from the remote preset repository when the victim opens the Community tab, and individual preset files imported directly by the victim via the preset import feature (handle_import_presets_from_file in file_management.rs). The second vector does not require control of the community preset repository and is triggered when a user imports a preset file shared through Discord, forums, or similar channels. 2026-07-30 6.5 CVE-2026-64816 DaveGamble--cJSON cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSON_Compare(). When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested document of a few hundred bytes (depth around 40) compared for equality consumes hours of CPU, and the cost roughly doubles with each additional level of nesting. An application that calls cJSON_Compare() on attacker-influenced JSON that is structurally equal to a reference document is exposed to a denial-of-service condition. 2026-07-29 5.9 CVE-2026-67216 DaveGamble--cJSON cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in apply_patch() in cJSON_Utils.c. For a replace operation that is missing its value member, or a move operation whose destination path cannot be resolved, the existing target member is detached and deleted before the operation is fully validated, so the target document is mutated while cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() returns a failure status. An attacker who can supply the patch document can destroy addressable members of the target document even though the API reports that the patch failed, defeating the all-or-nothing behavior callers rely on to reject bad patches. 2026-07-29 5.3 CVE-2026-67217 davejesch--Database Collation Fix The Database Collation Fix plugin for WordPress is vulnerable to time-based SQL Injection via the 'force-collation-algorithm' parameter in all versions up to, and including, 1.2.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires a trigger.txt file to be present in the plugin's directory (/wp-content/plugins/database-collation-fix/trigger.txt), a condition created by DesktopServer integration events such as site creation, copy, import, move, export, or deploy. 2026-08-01 5.3 CVE-2026-15018 decidim--decidim Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the normal download_your_data flow requires the requester to be logged in as the export owner, but the resulting Active Storage blob redirect URL can be replayed without authentication by anyone who obtains it. This is because Decidim::DownloadYourDataController#download_file authenticates the export owner but redirects to a signed Active Storage blob URL that is no longer bound to the owner session. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2. 2026-07-31 6.5 CVE-2026-45377 decidim--decidim Decidim is a participatory democracy framework. From 0.31.1 before 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, a participant can directly load /admin/demographics/questions/edit_questions and reach the demographics questionnaire editor without the required administrator authorization. The demographics questionnaire editor should require admin access, but the route under /admin/demographics/questions renders the editor interface without checking whether the caller is an admin. A normal participant can load the page and see the live update form action, which proves the protected interface is reachable. This issue is fixed in versions 0.31.5 and 0.32.0.rc2. 2026-07-31 5.4 CVE-2026-45086 decidim--decidim Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the GET /admin/organization/users search interpolates params[:term] into raw Arel.sql ORDER BY similarity expressions before sanitization, allowing an authenticated organization administrator to execute blind PostgreSQL expressions and infer data through timing differences. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2. 2026-07-31 5.5 CVE-2026-45376 decidim--decidim Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verification admin controllers load pending Authorization records by raw identifier without confirming current_organization ownership, allowing an administrator from one tenant to view, approve, or reject another tenant's ID-document request. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2. 2026-07-31 4.9 CVE-2026-45330 deveasel--Demi One Click Demo Import, Backup & Site Migration The Demi - One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Copy in all versions up to, and including, 0.0.8 via the handle_restore_step function. This is due to missing HTTP access controls on the wp-content/uploads/demi-backup-state/ directory, which exposes the cryptographic restore key used to both authenticate the unauthenticated AJAX handler and forge signed restore-state envelopes. This makes it possible for unauthenticated attackers to copy arbitrary files to attacker-controlled destinations on the server. An active restore operation must have been initiated, which writes the .restore_key and .restore_step_token files to the public upload directory, before the exposed secrets can be harvested and chained to achieve unauthenticated arbitrary file copy. 2026-07-28 5.3 CVE-2026-15012 devitemsllc--ShopLentor All-in-One WooCommerce Growth & Store Enhancement Plugin The ShopLentor - All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.5 via the 'optionSection' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to read arbitrary wp_options rows - including internal plugin news feed data, WooCommerce block pattern transients, and third-party configuration records - whose values are stored as arrays-of-arrays containing 'title' keys, enabling cross-plugin data leakage. 2026-07-28 4.3 CVE-2026-16797 devitemsllc--ShopLentor All-in-One WooCommerce Growth & Store Enhancement Plugin The ShopLentor - All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. 2026-07-28 4.9 CVE-2026-16811 dfir-iris--iris-web The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks. 2026-07-30 5.9 CVE-2026-16971 dfir-iris--iris-web The IRIS web application in version 2.4.26 and possibly others does not protect its user authentication against brute-force attacks. 2026-07-30 5.9 CVE-2026-18362 dfir-iris--iris-web The IRIS web application in version 2.4.26 and possibly others contains a logout functionality which is ineffective. Stolen session cookies can therefore be misused for a long time. 2026-07-30 4.2 CVE-2026-16970 dotonpaper--Pinpoint Booking System Version 2 The Pinpoint Booking System - Version 2 plugin for WordPress is vulnerable to blind SQL Injection via the 'field' parameter in all versions up to, and including, 2.9.9.6.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The nonce required to reach the vulnerable endpoint is emitted on all plugin admin pages loaded under manage_options, making it trivially obtainable by any authenticated administrator. 2026-08-01 4.9 CVE-2026-15403 drakkan--SFTPGo SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in a permitted directory that point to files in directories where download, upload, or overwrite permissions are denied. Attackers can exploit the create_symlinks permission combined with read and write access in one directory to read or modify files in restricted directories, as operations are authorized against the link's directory permissions rather than the dereferenced target's directory permissions. 2026-07-30 4.2 CVE-2026-10031 edge22--GenerateBlocks The GenerateBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Dynamic Tag Injection in HTML Attributes in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A Contributor-level attacker can store the malicious payload by placing a dynamic tag such as {{post_meta key:...}} in a non-URL HTML attribute (e.g., title, aria-label, alt, or data-* attributes) of a GenerateBlocks element block, then setting the corresponding unprotected post meta key via the Custom Fields metabox to a value containing a closing quote and an injected event-handler attribute. 2026-08-01 6.4 CVE-2026-13458 eLyiN--gemini-bridge gemini-bridge is a lightweight MCP server bridging AI agents to Google's Gemini AI via the official CLI. From 1.0.0 until 1.3.1, consult_gemini_with_files in inline mode read any file path supplied in the files argument without confining it to the working directory, then forwarded the contents to the Gemini CLI. Because the caller also controls query, the file contents are echoed back through the Gemini round-trip (and sent to Google), making this an arbitrary local file read. This issue is fixed in version 1.3.1. 2026-07-31 6.2 CVE-2026-54785 facturadorvirtual--Facturacin Electrnica Costa Rica The FacturaciÃ³n ElectrÃ³nica Costa Rica plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on the (global scope, included by fvcr_admin_page_html) function. This makes it possible for unauthenticated attackers to modify the plugin's configuration, including API tokens, access tokens, economic activity, Hacienda environment mode, invoice and ticket emission flags, exchange rate, and branch settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. 2026-07-29 4.3 CVE-2026-9720 Flipper Code--WP Maps Insertion of Sensitive Information Into Sent Data vulnerability in Flipper Code WP Maps allows Retrieve Embedded Sensitive Data. This issue affects WP Maps: from n/a through 4.9.6. 2026-07-31 4.3 CVE-2026-28144 foomagoo--Plugin Organizer The Plugin Organizer plugin for WordPress is vulnerable to SQL Injection via the 'PO_plugin_path' parameter in versions up to, and including, 10.2.4. This is due to insufficient escaping on the user-supplied parameter in the perform_plugin_search() function, where esc_sql() output is passed as the replacement string to preg_replace(), which collapses backslash escapes and defeats the quoting protection; additionally, the AJAX handler lacks both nonce verification and capability checks. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. 2026-07-28 6.5 CVE-2026-15304 Franky--Events Made Easy Unauthenticated Broken Access Control in Events Made Easy prepare() format string, bypassing parameterization entirely. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. 2026-07-28 6.5 CVE-2026-15267 Themeisle--Feedzy Contributor Server Side Request Forgery (SSRF) in Feedzy
Read more »
Thursday July 30
04:49 pm
Read This Before You Buy That TV Streaming Stick | Krebs on Security
Read This Before You Buy That TV Streaming Stick
Security experts have been sounding the alarm for years about the risks of using generic TV boxes that promise unlimited content streaming for a one-time fee, warning that they secretly rent the user's Internet connection out to strangers. But a groundbreaking new analysis finds these devices also routinely spoof themselves as mobile phones clicking ads on AI-generated websites as part of sprawling operation that seeks to defraud online merchants and advertising networks.
Read more »
Wednesday July 22
01:10 am
LG to Ban Residential Proxies from Smart TV Apps | Krebs on Security
LG to Ban Residential Proxies from Smart TV Apps
The home appliance giant LG Electronics USA said this week it plans to suspend any apps built for its smart TVs that turn one's television into an always-on residential proxy node. The move comes less than a month after researchers found that more than 42 percent of games and other apps available for download on LG's webOS store allow unknown third-parties to route their Internet traffic through a user's TV.
Read more »
Tuesday July 14
07:22 pm
Microsoft Patches a Record 570 Security Flaws | Krebs on Security
Microsoft Patches a Record 570 Security Flaws
Microsoft Corp. today released software updates to plug at least 570 security holes in its Windows operating systems and other software, almost triple the number of vulnerabilities the software giant fixed in its record-smashing Patch Tuesday release last month. Microsoft attributed the burgeoning patch counts to vulnerability discoveries aided by artificial intelligence.
Read more »
Monday July 13
03:03 pm
Lessons Learned from CISA’s Recent GitHub Leak | Krebs on Security
Lessons Learned from CISA’s Recent GitHub Leak
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a postmortem on a data leak in which a contractor published dozens of internal CISA credentials -- including AWS Govcloud keys -- in a public GitHub repository for almost six months before being notified by KrebsOnSecurity. Experts say the gaps identified in the agency's initial response provide important lessons that all security teams should absorb.
Read more »

Thursday August 27
01:59 pm
Exciting updates for Sneaky Sasquatch come to Apple Arcade | Apple Newsroom
Exciting updates for Sneaky Sasquatch come to Apple Arcade
Through October 7, Sneaky Sasquatch transforms Subway Surfers+ with the charm and aesthetic of the hit open-world Apple Arcade game.
Read more »
Tuesday August 25
01:00 pm
Apple introduces new Mac Studio with M5 Max and M5 Ultra | Apple Newsroom
Apple introduces new Mac Studio with M5 Max and M5 Ultra
Apple announced the new Mac Studio, featuring M5 Max and the all-new M5 Ultra, delivering a monumental leap in AI performance and even faster graphics.
Read more »
12:59 pm
Apple unveils a more powerful Mac mini featuring the all-new M6 and M5 Pro | Apple Newsroom
Apple unveils a more powerful Mac mini featuring the all-new M6 and M5 Pro
Apple announced the new Mac mini with the all-new M6 and powerful M5 Pro, delivering a dramatic boost in performance and more versatility in its supersmall desktop design.
Read more »
12:58 pm
Apple introduces M6 and M5 Ultra for a big leap in performance and AI compute | Apple Newsroom
Apple introduces M6 and M5 Ultra for a big leap in performance and AI compute
Apple debuted M6 in the new Mac mini and M5 Ultra in the new Mac Studio, providing an extraordinary leap in performance and AI capabilities.
Read more »
Tuesday August 18
03:59 pm
Apple announces changes for apps in the European Union | Apple Newsroom
Apple announces changes for apps in the European Union
Apple today announced changes to its business terms for apps in the European Union, following close collaboration with the European Commission.
Read more »
Tuesday August 11
01:59 pm
Apple Arcade levels up with Block Blast!+ and Art of Fauna: Cozy Puzzles+ | Apple Newsroom
Apple Arcade levels up with Block Blast!+ and Art of Fauna: Cozy Puzzles+
Apple Arcade upgrades its catalog of hit puzzle games with Block Blast+ and Art of Fauna: Cozy Puzzles+.
Read more »
Monday August 03
02:59 pm
Leagues Cup kicks off tomorrow, August 4, on Apple TV | Apple Newsroom
Leagues Cup kicks off tomorrow, August 4, on Apple TV
The Concacaf-sanctioned competition featuring 18 clubs from Major League Soccer and 18 clubs from Liga MX — kicks off tomorrow, August 4, on Apple TV.
Read more »
Thursday July 30
08:30 pm
Apple reports third quarter results | Apple Newsroom
Apple reports third quarter results
Apple today announced financial results for its fiscal 2026 third quarter ended June 27, 2026.
Read more »
Tuesday July 28
12:20 pm
Apple Upgrade launches in the United States | Apple Newsroom
Apple Upgrade launches in the United States
Apple Upgrade — a new hardware leasing program — is now available on the Apple Store online, in the Apple Store app, and at Apple Store locations in the United States.
Read more »
Tuesday July 14
01:59 pm
Madden NFL 27 Arcade Edition brings gridiron action to Apple Arcade on August 6 | Apple Newsroom
Madden NFL 27 Arcade Edition brings gridiron action to Apple Arcade on August 6
Apple Arcade grows its roster of hit sports games with the addition of EA SPORTS Madden NFL 27 and more coming in August.
Read more »
Thursday July 09
12:42 am
Apple scores record 89 Emmy Award nominations | Apple Newsroom
Apple scores record 89 Emmy Award nominations
Apple scored a historic 89 nominations across 15 programs for the 78th Primetime Emmy Awards.
Read more »

Friday August 28
09:03 pm
Malaysia SMS Carrier Maintenance – Celcom | Twilio
Malaysia SMS Carrier Maintenance – Celcom
THIS IS A SCHEDULED EVENT Sep 1, 10:00 - 14:00 PDT Aug 28, 13:44 PDT Scheduled - The Celcom network in Malaysia is conducting a planned maintenance from 01 September 2026 at 10:00 PDT until 01 September 2026 at 14:00 PDT. During the maintenance window, there could be intermittent delays delivering SMS to Celcom Malaysia handsets.
Read more »
09:03 pm
Malaysia SMS Carrier Maintenance – Celcom | Twilio
Malaysia SMS Carrier Maintenance – Celcom
THIS IS A SCHEDULED EVENT Sep 8, 10:00 - 14:00 PDT Aug 28, 13:48 PDT Scheduled - The Celcom network in Malaysia is conducting a planned maintenance from 08 September 2026 at 10:00 PDT until 08 September 2026 at 14:00 PDT. During the maintenance window, there could be intermittent delays delivering SMS to Celcom Malaysia handsets.
Read more »
09:03 pm
Malaysia SMS Carrier Maintenance – Celcom | Twilio
Malaysia SMS Carrier Maintenance – Celcom
THIS IS A SCHEDULED EVENT Sep 7, 10:00 - 14:00 PDT Aug 28, 13:47 PDT Scheduled - The Celcom network in Malaysia is conducting a planned maintenance from 07 September 2026 at 10:00 PDT until 07 September 2026 at 14:00 PDT. During the maintenance window, there could be intermittent delays delivering SMS to Celcom Malaysia handsets.
Read more »
07:25 pm
UPDATE: **Summary:** Google Chat users are experiencing an issue where they receive notifications for new messages, but the actual messages fail to appear in their chat application unless the user refreshes their view. **Description:** We are experiencing an intermittent issue with Google Chat Friday, 2026-08-28 10:25 PDT. Our engineering team has investigated the issue and are currently working on mitigating the issue. We will provide more information by Friday, 2026-08-28 14:15 PDT with current details. We apologize to all who are affected by the disruption. **Customer Symptoms:** Users are experiencing an issue where they receive notifications for new messages, but the actual messages fail to appear in their chat application unless the user refreshes their view **Workaround:** Users can refresh to see new messages | Google Apps
UPDATE: **Summary:** Google Chat users are experiencing an issue where they receive notifications for new messages, but the actual messages fail to appear in their chat application unless the user refreshes their view. **Description:** We are experiencing an intermittent issue with Google Chat Friday, 2026-08-28 10:25 PDT. Our engineering team has investigated the issue and are currently working on mitigating the issue. We will provide more information by Friday, 2026-08-28 14:15 PDT with current details. We apologize to all who are affected by the disruption. **Customer Symptoms:** Users are experiencing an issue where they receive notifications for new messages, but the actual messages fail to appear in their chat application unless the user refreshes their view **Workaround:** Users can refresh to see new messages
Incident began at 2026-08-28 17:25 (times are in Coordinated Universal Time (UTC)).Summary: Google Chat users are experiencing an issue where they receive notifications for new messages, but the actual messages fail to appear in their chat application unless the user refreshes their view. Description: We are experiencing an intermittent issue with Google Chat Friday, 2026-08-28 10:25 PDT. Our engineering team has investigated the issue and are currently working on mitigating the issue. We will provide more information by Friday, 2026-08-28 14:15 PDT with current details. We apologize to all who are affected by the disruption. Customer Symptoms: Users are experiencing an issue where they receive notifications for new messages, but the actual messages fail to appear in their chat application unless the user refreshes their view Workaround: Users can refresh to see new messages Affected products: Google Chat
Read more »
07:04 pm
HKG (Hong Kong) on 2026-09-01 | CloudFlare
HKG (Hong Kong) on 2026-09-01
Aug 28, 19:01 UTCScheduled - We will be performing scheduled maintenance in HKG (Hong Kong) datacenter on 2026-09-01 between 18:00 and 23:00 UTC. Traffic might be re-routed from this location, hence there is a possibility of a slight increase in latency during this maintenance window for end-users in the affected region. For PNI / CNI customers connecting with us in this location, please make sure you are expecting this traffic to fail over elsewhere during this maintenance window as network interfaces in this datacentre may become temporarily unavailable. You can now subscribe to these notifications via Cloudflare dashboard and receive these updates directly via email, PagerDuty and webhooks (based on your plan): https://developers.cloudflare.com/notifications/notification-available/#cloudflare-status.
Read more »
05:58 pm
MNL (Manila) on 2026-08-28 | CloudFlare
MNL (Manila) on 2026-08-28
Aug 28, 17:31 UTCScheduled - We will be performing scheduled maintenance in MNL (Manila) datacenter on 2026-08-28 between 18:00 and 22:00 UTC. Traffic might be re-routed from this location, hence there is a possibility of a slight increase in latency during this maintenance window for end-users in the affected region. For PNI / CNI customers connecting with us in this location, please make sure you are expecting this traffic to fail over elsewhere during this maintenance window as network interfaces in this datacentre may become temporarily unavailable. You can now subscribe to these notifications via Cloudflare dashboard and receive these updates directly via email, PagerDuty and webhooks (based on your plan): https://developers.cloudflare.com/notifications/notification-available/#cloudflare-status.
Read more »
05:40 pm
Increased HTTP 5xx Errors in Singapore | CloudFlare
Increased HTTP 5xx Errors in Singapore
Aug 28, 17:40 UTCIdentified - We are continuing to work on a fix for this issue.Aug 28, 17:39 UTCIdentified - The issue has been identified and a fix is being implemented.Aug 28, 17:36 UTCInvestigating - Cloudflare is investigating an increased level of HTTP 5xx errors in Singapore. We are working to analyse and mitigate this problem. More updates to follow shortly.
Read more »
04:43 pm
SIN (Singapore) on 2026-09-01 | CloudFlare
SIN (Singapore) on 2026-09-01
Aug 28, 16:11 UTCScheduled - We will be performing scheduled maintenance in SIN (Singapore) datacenter on 2026-09-01 between 16:00 and 23:00 UTC. Traffic might be re-routed from this location, hence there is a possibility of a slight increase in latency during this maintenance window for end-users in the affected region. For PNI / CNI customers connecting with us in this location, please make sure you are expecting this traffic to fail over elsewhere during this maintenance window as network interfaces in this datacentre may become temporarily unavailable. You can now subscribe to these notifications via Cloudflare dashboard and receive these updates directly via email, PagerDuty and webhooks (based on your plan): https://developers.cloudflare.com/notifications/notification-available/#cloudflare-status.
Read more »
04:43 pm
SIN (Singapore) on 2026-09-01 | CloudFlare
SIN (Singapore) on 2026-09-01
Aug 28, 16:11 UTCScheduled - We will be performing scheduled maintenance in SIN (Singapore) datacenter on 2026-09-01 between 16:00 and 23:00 UTC. Traffic might be re-routed from this location, hence there is a possibility of a slight increase in latency during this maintenance window for end-users in the affected region. For PNI / CNI customers connecting with us in this location, please make sure you are expecting this traffic to fail over elsewhere during this maintenance window as network interfaces in this datacentre may become temporarily unavailable. You can now subscribe to these notifications via Cloudflare dashboard and receive these updates directly via email, PagerDuty and webhooks (based on your plan): https://developers.cloudflare.com/notifications/notification-available/#cloudflare-status.
Read more »
04:41 pm
SIN (Singapore) on 2026-09-01 | CloudFlare
SIN (Singapore) on 2026-09-01
Aug 28, 16:11 UTCScheduled - We will be performing scheduled maintenance in SIN (Singapore) datacenter on 2026-09-01 between 16:00 and 23:00 UTC. Traffic might be re-routed from this location, hence there is a possibility of a slight increase in latency during this maintenance window for end-users in the affected region. For PNI / CNI customers connecting with us in this location, please make sure you are expecting this traffic to fail over elsewhere during this maintenance window as network interfaces in this datacentre may become temporarily unavailable. You can now subscribe to these notifications via Cloudflare dashboard and receive these updates directly via email, PagerDuty and webhooks (based on your plan): https://developers.cloudflare.com/notifications/notification-available/#cloudflare-status.
Read more »
04:41 pm
SIN (Singapore) on 2026-09-01 | CloudFlare
SIN (Singapore) on 2026-09-01
Aug 28, 16:11 UTCScheduled - We will be performing scheduled maintenance in SIN (Singapore) datacenter on 2026-09-01 between 16:00 and 23:00 UTC. Traffic might be re-routed from this location, hence there is a possibility of a slight increase in latency during this maintenance window for end-users in the affected region. For PNI / CNI customers connecting with us in this location, please make sure you are expecting this traffic to fail over elsewhere during this maintenance window as network interfaces in this datacentre may become temporarily unavailable. You can now subscribe to these notifications via Cloudflare dashboard and receive these updates directly via email, PagerDuty and webhooks (based on your plan): https://developers.cloudflare.com/notifications/notification-available/#cloudflare-status.
Read more »
04:41 pm
SIN (Singapore) on 2026-09-01 | CloudFlare
SIN (Singapore) on 2026-09-01
Aug 28, 16:11 UTCScheduled - We will be performing scheduled maintenance in SIN (Singapore) datacenter on 2026-09-01 between 16:00 and 23:00 UTC. Traffic might be re-routed from this location, hence there is a possibility of a slight increase in latency during this maintenance window for end-users in the affected region. For PNI / CNI customers connecting with us in this location, please make sure you are expecting this traffic to fail over elsewhere during this maintenance window as network interfaces in this datacentre may become temporarily unavailable. You can now subscribe to these notifications via Cloudflare dashboard and receive these updates directly via email, PagerDuty and webhooks (based on your plan): https://developers.cloudflare.com/notifications/notification-available/#cloudflare-status.
Read more »
04:41 pm
SIN (Singapore) on 2026-09-01 | CloudFlare
SIN (Singapore) on 2026-09-01
Aug 28, 16:11 UTCScheduled - We will be performing scheduled maintenance in SIN (Singapore) datacenter on 2026-09-01 between 16:00 and 23:00 UTC. Traffic might be re-routed from this location, hence there is a possibility of a slight increase in latency during this maintenance window for end-users in the affected region. For PNI / CNI customers connecting with us in this location, please make sure you are expecting this traffic to fail over elsewhere during this maintenance window as network interfaces in this datacentre may become temporarily unavailable. You can now subscribe to these notifications via Cloudflare dashboard and receive these updates directly via email, PagerDuty and webhooks (based on your plan): https://developers.cloudflare.com/notifications/notification-available/#cloudflare-status.
Read more »
04:41 pm
SIN (Singapore) on 2026-09-01 | CloudFlare
SIN (Singapore) on 2026-09-01
Aug 28, 16:11 UTCScheduled - We will be performing scheduled maintenance in SIN (Singapore) datacenter on 2026-09-01 between 16:00 and 23:00 UTC. Traffic might be re-routed from this location, hence there is a possibility of a slight increase in latency during this maintenance window for end-users in the affected region. For PNI / CNI customers connecting with us in this location, please make sure you are expecting this traffic to fail over elsewhere during this maintenance window as network interfaces in this datacentre may become temporarily unavailable. You can now subscribe to these notifications via Cloudflare dashboard and receive these updates directly via email, PagerDuty and webhooks (based on your plan): https://developers.cloudflare.com/notifications/notification-available/#cloudflare-status.
Read more »
04:41 pm
SIN (Singapore) on 2026-09-01 | CloudFlare
SIN (Singapore) on 2026-09-01
Aug 28, 16:11 UTCScheduled - We will be performing scheduled maintenance in SIN (Singapore) datacenter on 2026-09-01 between 16:00 and 23:00 UTC. Traffic might be re-routed from this location, hence there is a possibility of a slight increase in latency during this maintenance window for end-users in the affected region. For PNI / CNI customers connecting with us in this location, please make sure you are expecting this traffic to fail over elsewhere during this maintenance window as network interfaces in this datacentre may become temporarily unavailable. You can now subscribe to these notifications via Cloudflare dashboard and receive these updates directly via email, PagerDuty and webhooks (based on your plan): https://developers.cloudflare.com/notifications/notification-available/#cloudflare-status.
Read more »
04:41 pm
SIN (Singapore) on 2026-09-01 | CloudFlare
SIN (Singapore) on 2026-09-01
Aug 28, 16:11 UTCScheduled - We will be performing scheduled maintenance in SIN (Singapore) datacenter on 2026-09-01 between 16:00 and 23:00 UTC. Traffic might be re-routed from this location, hence there is a possibility of a slight increase in latency during this maintenance window for end-users in the affected region. For PNI / CNI customers connecting with us in this location, please make sure you are expecting this traffic to fail over elsewhere during this maintenance window as network interfaces in this datacentre may become temporarily unavailable. You can now subscribe to these notifications via Cloudflare dashboard and receive these updates directly via email, PagerDuty and webhooks (based on your plan): https://developers.cloudflare.com/notifications/notification-available/#cloudflare-status.
Read more »
04:40 pm
SIN (Singapore) on 2026-09-01 | CloudFlare
SIN (Singapore) on 2026-09-01
Aug 28, 16:11 UTCScheduled - We will be performing scheduled maintenance in SIN (Singapore) datacenter on 2026-09-01 between 16:00 and 23:00 UTC. Traffic might be re-routed from this location, hence there is a possibility of a slight increase in latency during this maintenance window for end-users in the affected region. For PNI / CNI customers connecting with us in this location, please make sure you are expecting this traffic to fail over elsewhere during this maintenance window as network interfaces in this datacentre may become temporarily unavailable. You can now subscribe to these notifications via Cloudflare dashboard and receive these updates directly via email, PagerDuty and webhooks (based on your plan): https://developers.cloudflare.com/notifications/notification-available/#cloudflare-status.
Read more »
04:40 pm
SIN (Singapore) on 2026-09-01 | CloudFlare
SIN (Singapore) on 2026-09-01
Aug 28, 16:11 UTCScheduled - We will be performing scheduled maintenance in SIN (Singapore) datacenter on 2026-09-01 between 16:00 and 23:00 UTC. Traffic might be re-routed from this location, hence there is a possibility of a slight increase in latency during this maintenance window for end-users in the affected region. For PNI / CNI customers connecting with us in this location, please make sure you are expecting this traffic to fail over elsewhere during this maintenance window as network interfaces in this datacentre may become temporarily unavailable. You can now subscribe to these notifications via Cloudflare dashboard and receive these updates directly via email, PagerDuty and webhooks (based on your plan): https://developers.cloudflare.com/notifications/notification-available/#cloudflare-status.
Read more »
04:40 pm
SIN (Singapore) on 2026-09-01 | CloudFlare
SIN (Singapore) on 2026-09-01
Aug 28, 16:11 UTCScheduled - We will be performing scheduled maintenance in SIN (Singapore) datacenter on 2026-09-01 between 16:00 and 23:00 UTC. Traffic might be re-routed from this location, hence there is a possibility of a slight increase in latency during this maintenance window for end-users in the affected region. For PNI / CNI customers connecting with us in this location, please make sure you are expecting this traffic to fail over elsewhere during this maintenance window as network interfaces in this datacentre may become temporarily unavailable. You can now subscribe to these notifications via Cloudflare dashboard and receive these updates directly via email, PagerDuty and webhooks (based on your plan): https://developers.cloudflare.com/notifications/notification-available/#cloudflare-status.
Read more »
04:40 pm
SIN (Singapore) on 2026-09-01 | CloudFlare
SIN (Singapore) on 2026-09-01
Aug 28, 16:11 UTCScheduled - We will be performing scheduled maintenance in SIN (Singapore) datacenter on 2026-09-01 between 16:00 and 23:00 UTC. Traffic might be re-routed from this location, hence there is a possibility of a slight increase in latency during this maintenance window for end-users in the affected region. For PNI / CNI customers connecting with us in this location, please make sure you are expecting this traffic to fail over elsewhere during this maintenance window as network interfaces in this datacentre may become temporarily unavailable. You can now subscribe to these notifications via Cloudflare dashboard and receive these updates directly via email, PagerDuty and webhooks (based on your plan): https://developers.cloudflare.com/notifications/notification-available/#cloudflare-status.
Read more »

Showcase

Kool Tools: Pegasus3 Symply Edition

Promise Technology and Symply have launched the Pegasus3 Symply Edition, the next generation of the Pegasus desktop RAID storage system. The new system combines 40 Gb/s Thunderbolt 3 performance with Symply's storage management suite. The Pegasus3 Symply Edition is a...

Kool Tools: TimeCache

The Rolling Stones told us that time was on our side (or at least Mick Jagger's side). That's not always true, but with TimeCache (http://www.pandaware.com/timecache/index.html) for Mac OS X from PandaWare we can at least keep track of it. With TimeCache -- now...

Kool Tools: PDF Editor for Mac

Editing PDF files on Mac OS X can be tough, but a product from AnyBizSoft, a Wondershare company focused on PDF solutions, simplifies the process. PDF Editor for Mac, integrates AnyBizSoft's existing PDF to Word conversion technology. It not only enables users to edit...

Kool Tools: Aunsoft’s Video Converter for the Mac

Aunsoft Video Converter for Mac (http://www.aunsoft.com/video-converter-mac/) is a US$35 Mac video converting tool you can use to convert just about any type of video for use on a variety of Apple devices. What's more, it also boasts a several editing features. This...

More Showcase

Scanners “By The Numbers”

Wednesday August 26
06:15 pm
B&H Launches Big MacBook Air Sale: 21 Models Discounted, Prices Start at $1199 | MacPrices.net
B&H Launches Big MacBook Air Sale: 21 Models Discounted, Prices Start at $1199
B&H has launched a broad MacBook Air sale covering 21 different configurations, with prices starting at just $1199 and discounts reaching as much as $300. The sale includes both 13-inch and 15-inch models, along with upgraded M5 configurations featuring as much as 32GB of unified memory and 2TB of SSD storage. Shop B&H's MacBook Air sale. Some of the more interesting deals aren't necessarily on Apple's standard configurations. B&H is also discounting a number of custom MacBook Air builds with additional memory and storage, including 24GB and 32GB configurations. For example, select 13-inch M5 models with 32GB RAM and a 512GB SSD are available for as little as $1549, while a 32GB/2TB configuration has dropped to $2349. On the 15-inch side, B&H has select 16GB/1TB M5 configurations starting at $1599, while 24GB/1TB models start at $1799. There's also a remaining 15-inch M4 MacBook Air with 16GB RAM and a 1TB SSD for $1499, which B&H lists as a $300 savings from its regular price. Many of these models are listed as limited supply at the current prices, and B&H is offering free 2-day shipping on most available configurations. Payboo cardholders may also be eligible for B&H's Save the Tax benefit. For the latest MacBook Air prices and deals, visit our 13" MacBook Air Price Tracker and 15" MacBook Air Price Tracker, updated daily.
Read more »
02:48 pm
Amazon Drops Space Gray 13″ M4 iPad Air 512GB Cellular to $1249.97 | MacPrices.net
Amazon Drops Space Gray 13″ M4 iPad Air 512GB Cellular to $1249.97
Amazon has a new 30-day low price on one specific 13-inch M4 iPad Air configuration: the Space Gray 512GB Wi-Fi + Cellular model is currently $1249.97. That’s $149 off Apple’s current $1399 price, and the discount appears to apply to the Space Gray model only. Other colors may be priced higher, so be sure to select Space Gray before checking out. Check Amazon’s current price, or compare prices in our iPad Air Price Tracker.
Read more »
Tuesday August 25
12:01 pm
Amazon has Apple’s 16-inch M5 Pro MacBook Pros on sale for up to $300 off MSRP | MacPrices.net
Amazon has Apple’s 16-inch M5 Pro MacBook Pros on sale for up to $300 off MSRP
Amazon is offering solid discounts on two of Apple's standard 16-inch M5 Pro MacBook Pro configurations. The 24GB RAM/1TB SSD model is currently $240 below Apple's MSRP at $2759.99, while the upgraded 48GB RAM/1TB SSD version is discounted by $300 to $3299. Shop the 24GB model or shop the 48GB model at Amazon. Both Space Black and Silver models are available at the same sale prices, giving buyers the flexibility to choose their preferred finish without paying a premium. These are currently among the best prices available on Apple's standard 16-inch M5 Pro lineup. Amazon is also offering fast shipping on available inventory, making this a good opportunity to save on a new MacBook Pro while the discounts remain available. For the latest prices, availability, and deals, visit our 16" MacBook Pro Price Tracker, updated daily.
Read more »
Saturday August 22
01:18 pm
B&H Slashes Prices on High-End M5 Pro and M5 Max MacBook Pros, Savings Reach $500 | MacPrices.net
B&H Slashes Prices on High-End M5 Pro and M5 Max MacBook Pros, Savings Reach $500
B&H has launched a particularly strong round of discounts on higher-end 14-inch and 16-inch M5 Pro and M5 Max MacBook Pros, including upgraded configurations with 48GB, 64GB, and even 128GB of unified memory. Prices currently start at just $2349 for a 14-inch M5 Pro model with 24GB RAM, a 1TB SSD, and Nano-Texture display. Among the standout deals, B&H has the 14-inch M5 Pro with 48GB RAM and a 1TB SSD for $2899, while a 16-inch M5 Pro with 48GB RAM and a 2TB SSD has dropped to $3599. Higher-end M5 Max models are also discounted, including a 14-inch 64GB/2TB configuration starting at $4699 and 16-inch models with as much as 128GB RAM. Shop B&H's current high-end M5 MacBook Pro deals. These deals are particularly notable following Apple's recent price increases, giving buyers shopping for higher-memory and higher-storage configurations an opportunity to save hundreds compared with current pricing. B&H lists many of the sale models as being available in limited quantities at these prices, with free shipping also available. For the latest prices and deals across Apple's MacBook Pro lineup, see our 14" MacBook Pro Price Tracker and 16" MacBook Pro Price Tracker, updated daily.
Read more »
Friday August 21
05:19 pm
Amazon continues to offer $30 discount on Apple Watch SE 3 models, prices start at $219 | MacPrices.net
Amazon continues to offer $30 discount on Apple Watch SE 3 models, prices start at $219
Amazon has Apple Watch SE 3 models on sale for $30 off MSRP, shipping included: - 40mm Apple Watch SE GPS: $219, $30 off MSRP - 44mm Apple Watch SE GPS: $249, $30 off MSRP - 40mm Apple Watch SE GPS + 5G: $249, $30 off MSRP - 44mm Apple Watch SE GPS + 5G: $299, $30 off MSRP These are the lowest sale prices currently available for Apple Watch SE 3 models. For the latest prices & deals, keep an eye on our Apple Watch Price Tracker, updated daily.
Read more »
11:59 am
14-Inch M5 Max MacBook Pro with 36GB RAM and 2TB SSD on sale for $500 off Apple’s MSRP | MacPrices.net
14-Inch M5 Max MacBook Pro with 36GB RAM and 2TB SSD on sale for $500 off Apple’s MSRP
Amazon continues to offer a $500 discount on Apple's 14-inch MacBook Pro with an M5 Max chip, 36GB of unified memory, and a 2TB SSD. The configuration is currently available for $3599, making it the best value we've found on the high-end 14-inch MacBook Pro. Shop the deal at Amazon. The M5 Max version is designed for demanding professional workloads, including video editing, software development, AI projects, 3D rendering, and other graphics-intensive applications. With 36GB of unified memory and a spacious 2TB SSD, it also offers plenty of room for large files and creative projects. Amazon is also offering fast shipping on available inventory, making this a good opportunity to save on one of Apple's most powerful 14-inch notebooks while the discount remains available. For the latest MacBook Pro prices, availability, and deals, visit our 14" MacBook Pro Price Tracker, updated daily.
Read more »
Wednesday August 19
02:02 pm
Amazon is taking $50 off Apple’s WiFi iPads | MacPrices.net
Amazon is taking $50 off Apple’s WiFi iPads
Amazon continues to have 11th-generation A16 WiFi iPads in stock on sale for $50 off MSRP, starting at $399. Shipping is free: - 11" 11th-generation 128GB WiFi iPads: $399 $50 off MSRP - 11" 11th-generation 256GB WiFi iPads: $499 $50 off MSRP - 11" 11th-generation 512GB WiFi iPads: $699 $50 off MSRP Amazon's prices are the lowest iPads prices currently available for 11th-generation models. For the latest prices & deals, keep an eye on our iPad Price Tracker, updated daily.
Read more »
02:00 pm
Amazon offering slight $10 discount on MacBook Neos | MacPrices.net
Amazon offering slight $10 discount on MacBook Neos
Amazon is currently the only Apple retailer in our MacBook Neo Price Tracker offering a discount on all of Apple's newest Neos. While the savings are modest, Amazon has reduced both the 256GB and 512GB MacBook Neo by $10, making it the lowest-priced retailer we track for every configuration. Current pricing starts at $689 for the 256GB model, while the 512GB model is available for $789. Both prices are currently lower than Apple's MSRP, with no competing discounts available from the other major Apple retailers in our tracker. If you've been waiting for an opportunity to buy a MacBook Neo, Amazon currently offers the best pricing available, along with fast shipping on available inventory. For the latest MacBook Neo prices, availability, and deals, visit our MacBook Neo Price Tracker, updated daily.
Read more »
Monday August 17
06:30 pm
Today Only: B&H Takes $650 Off 16″ M5 Pro MacBook Pro with 48GB RAM | MacPrices.net
Today Only: B&H Takes $650 Off 16″ M5 Pro MacBook Pro with 48GB RAM
B&H has a particularly strong deal today on Apple's 16-inch M5 Pro MacBook Pro, dropping the Space Black model with 48GB RAM, a 1TB SSD, and Nano-Texture display to just $3099. That's a substantial $650 savings off its regular $3749 price. This is an unusually well-equipped configuration for the price, combining the 18-Core M5 Pro processor and 20-Core GPU with 48GB of unified memory and Apple's optional Nano-Texture display. Check the deal at B&H. This is a one-day deal scheduled to expire tonight at 11:59PM ET, so there's a fairly short window to take advantage of the $650 savings. B&H is also offering free shipping on the MacBook Pro. For the latest prices and deals across the lineup, see our 16" MacBook Pro Price Tracker, updated daily.
Read more »
02:32 pm
Week’s Best Deals: $400-$500 Off 16-Inch M5 Max MacBook Pros | MacPrices.net
Week’s Best Deals: $400-$500 Off 16-Inch M5 Max MacBook Pros
Amazon continues to offer substantial discounts on both standard 16-inch M5 Max MacBook Pro configurations. The 36GB/2TB model is currently $400 below Apple's MSRP, while the higher-end 48GB/2TB version is discounted by $500. The larger $500 discount applies to the flagship 48GB/2TB configuration, while the 36GB/2TB model is currently available at a $400 savings. Both discounts represent some of the lowest prices currently available on these professional-grade MacBook Pro configurations. Amazon is also offering fast shipping on available inventory, making this an attractive opportunity for buyers who have been waiting for lower pricing on Apple's most powerful notebook models. For the latest prices and availability, visit our 16" MacBook Pro Price Tracker, updated daily.
Read more »
02:02 pm
Week’s Best AirPods Deals: AirPods Pro 3 $60 off, AirPods Max 2 $120 off at Amazon | MacPrices.net
Week’s Best AirPods Deals: AirPods Pro 3 $60 off, AirPods Max 2 $120 off at Amazon
Amazon's latest sales this week are delivering good AirPods prices, with discounts available across Apple's entire AirPods lineup. AirPods 4 are currently $99, AirPods 4 with ANC are $134.99, AirPods Pro 3 have dropped to $189, and AirPods Max 2 are now $429. Shop Amazon's AirPods deals here. The biggest discounts are available on AirPods Pro 3 and AirPods Max 2, which are currently selling for $60 and $120 below Apple's MSRP, respectively.Note that pricing can change quickly. For the latest sales and deals, see our AirPods Price Tracker, updated daily.
Read more »
Thursday August 13
08:53 pm
Updated MacBook Price Trackers | MacPrices.net
Updated MacBook Price Trackers
Our Apple award-winning MacBook Price Trackers are continually updated with the latest information on prices, bundles, and availability for the new MacBook Neo, 16" and 14" M5, M5 Pro, & M5 Max MacBook Pros, along with 13" and 15" M5 MacBook Airs from Apple's authorized online retailers. We include prices for open-box MacBooks that might be available as well. Current sales range up to $150+ off MSRP for new MacBook Airs and $500+ off MacBook Pros: - 16" MacBook Pros - 14" MacBook Pros - 15" MacBook Airs - 13" MacBook Airs - MacBook Neos
Read more »

Friday August 28
12:53 pm
Refurb Apple MacBook Air Core i5 13.3″ Laptop for $175 + free shipping | DealNews Laptops
Refurb Apple MacBook Air Core i5 13.3″ Laptop for $175 + free shipping
This refurbished Apple MacBook Air is $225 off the regular price at DailySteals. It's also $45 under Best Buy's offers and the lowest price we could find for this refurb from a reputable retailer. We've pictured the Apple MacBook Air 13.3", Core i5, 8GB RAM (2017), which includes a 128GB SSD, a 13.3" display, and a 90-day warranty. It ships with the original MagSafe charger. It ships free. Buy Now at dailysteals
Read more »
12:46 pm
Refurb Apple iPad Air 1st Gen 9.7″ 16GB Wi-Fi Tablet for $64 + free shipping over $25 | DealNews iPads
Refurb Apple iPad Air 1st Gen 9.7″ 16GB Wi-Fi Tablet for $64 + free shipping over $25
This refurbished iPad Air is listed at $64. That's the best price we could find for this refurb from a reputable retailer by $5. A 90-day warranty applies. It ships free. Buy Now at UntilGone
Read more »
12:39 pm
Refurb Apple MacBook Air Core i5 512GB SSD 13.3″ Laptop (2020) for $305 + free shipping | DealNews Laptops
Refurb Apple MacBook Air Core i5 512GB SSD 13.3″ Laptop (2020) for $305 + free shipping
This refurbished MacBook Air is $305. That's the best price we could find from a reputable retailer of this laptop by $25. It pairs 8GB of RAM with a 512GB solid state drive. It also includes a backlit keyboard and Touch ID. A 90-day warranty applies. It ships for free. Buy Now at UntilGone Features 1.1GHz Intel Core i5 CPU 8GB of RAM 512GB solid state drive for storage Retina display Backlit keyboard w/ Touch ID Aluminum case design 2020 release
Read more »
08:14 am
Apple iPad A 16 Flash Deals at Best Buy: Extra $50 off + free shipping | DealNews iPads
Apple iPad A 16 Flash Deals at Best Buy: Extra $50 off + free shipping
As one of its 24-Hour Flash Deals, Best Buy is knocking $50 off each of Apple's iPad A16 tablets. The discount applies to various colors and capacities, and puts the 128GB model at $399, the 256GB iPad at $499, and the 512GB one at $699. Shipping is free on each one and the deals all end today. Shop Now at Best Buy
Read more »
04:41 am
27-Inch iMac Carrying Case for $212 | DealNews Laptops
27-Inch iMac Carrying Case for $212
Anyone who ships their iMac to a new office or hauls it to shoots regularly will appreciate the padded, purpose-built fit that keeps the screen and body from taking damage in transit. Buy Now at Newegg Features 27 inch iMac compatibility Padded interior for screen protection Dedicated storage for computer accessories Secure transport design for travel Durable screen carrier bag
Read more »
03:43 am
Kenke iPad Air 11-Inch and 10.9-Inch Detachable Bluetooth Keyboard Case for $19 + free shipping w/ $35 | DealNews Accessories
Kenke iPad Air 11-Inch and 10.9-Inch Detachable Bluetooth Keyboard Case for $19 + free shipping w/ $35
Turns your iPad Air into a makeshift laptop with a detachable keyboard, useful if you want typing capability without carrying a separate accessory. Walmart has it for $18.89, about $2 off the $20.99 list price. Buy Now at Walmart Features Removable slim wireless Bluetooth keyboard Flexible multi-angle viewing stand Built-in stylus storage slot Auto sleep/wake smart cover Model: A3266
Read more »
Thursday August 27
10:28 pm
Refurbished 24-inch iMac Apple M4 Chip with 8-Core CPU and 8-Core GPU – Green – G1E42LL/A – $1,689.00 | Refurb Tracker
Refurbished 24-inch iMac Apple M4 Chip with 8-Core CPU and 8-Core GPU – Green – G1E42LL/A – $1,689.00
Refurbished 24-inch iMac Apple M4 Chip with 8-Core CPU and 8-Core GPU - Green – G1E42LL/A $1,689.00 Originally released October 2024 24-inch 4.5K Retina display 16GB unified memory 1TB SSD 12MP Center Stage camera with support for Desk View Two Thunderbolt / USB 4 ports Product page on the Apple Store…
Read more »
10:28 pm
Refurbished 24-inch iMac Apple M4 Chip with 10-Core CPU and 10-Core GPU, Gigabit Ethernet- Pink – G1K65LL/A – $2,199.00 | Refurb Tracker
Refurbished 24-inch iMac Apple M4 Chip with 10-Core CPU and 10-Core GPU, Gigabit Ethernet- Pink – G1K65LL/A – $2,199.00
Refurbished 24-inch iMac Apple M4 Chip with 10-Core CPU and 10-Core GPU, Gigabit Ethernet- Pink – G1K65LL/A $2,199.00 Originally released October 2024 24-inch 4.5K Retina display 32GB unified memory 1TB SSD 12MP Center Stage camera with support for Desk View Four Thunderbolt 4 ports Gigabit Ethernet Product page on the Apple Store…
Read more »
10:28 pm
Refurbished 24-inch iMac Apple M4 Chip with 10-Core CPU and 10-Core GPU, Gigabit Ethernet- Green – G1EN0LL/A – $1,859.00 | Refurb Tracker
Refurbished 24-inch iMac Apple M4 Chip with 10-Core CPU and 10-Core GPU, Gigabit Ethernet- Green – G1EN0LL/A – $1,859.00
Refurbished 24-inch iMac Apple M4 Chip with 10-Core CPU and 10-Core GPU, Gigabit Ethernet- Green – G1EN0LL/A $1,859.00 Originally released October 2024 24-inch 4.5K Retina display 16GB unified memory 1TB SSD 12MP Center Stage camera with support for Desk View Four Thunderbolt 4 ports Gigabit Ethernet Product page on the Apple Store…
Read more »
10:28 pm
Refurbished 24-inch iMac Apple M4 Chip with 10-Core CPU and 10-Core GPU, Gigabit Ethernet- Pink – G1K66LL/A – $2,629.00 | Refurb Tracker
Refurbished 24-inch iMac Apple M4 Chip with 10-Core CPU and 10-Core GPU, Gigabit Ethernet- Pink – G1K66LL/A – $2,629.00
Refurbished 24-inch iMac Apple M4 Chip with 10-Core CPU and 10-Core GPU, Gigabit Ethernet- Pink – G1K66LL/A $2,629.00 Originally released October 2024 24-inch 4.5K Retina display 32GB unified memory 2TB SSD 12MP Center Stage camera with support for Desk View Four Thunderbolt 4 ports Gigabit Ethernet Product page on the Apple Store…
Read more »
10:28 pm
Refurbished 24-inch iMac Apple M4 Chip with 10-Core CPU and 10-Core GPU, Gigabit Ethernet- Green – G1EM0LL/A – $1,609.00 | Refurb Tracker
Refurbished 24-inch iMac Apple M4 Chip with 10-Core CPU and 10-Core GPU, Gigabit Ethernet- Green – G1EM0LL/A – $1,609.00
Refurbished 24-inch iMac Apple M4 Chip with 10-Core CPU and 10-Core GPU, Gigabit Ethernet- Green – G1EM0LL/A $1,609.00 Originally released October 2024 24-inch 4.5K Retina display 24GB unified memory 256GB SSD 12MP Center Stage camera with support for Desk View Four Thunderbolt 4 ports Gigabit Ethernet Product page on the Apple Store…
Read more »
10:28 pm
Refurbished 24-inch iMac Apple M4 Chip with 10-Core CPU and 10-Core GPU, Gigabit Ethernet- Green – G1K34LL/A – $1,949.00 | Refurb Tracker
Refurbished 24-inch iMac Apple M4 Chip with 10-Core CPU and 10-Core GPU, Gigabit Ethernet- Green – G1K34LL/A – $1,949.00
Refurbished 24-inch iMac Apple M4 Chip with 10-Core CPU and 10-Core GPU, Gigabit Ethernet- Green – G1K34LL/A $1,949.00 Originally released October 2024 24-inch 4.5K Retina display 32GB unified memory 512GB SSD 12MP Center Stage camera with support for Desk View Four Thunderbolt 4 ports Gigabit Ethernet Product page on the Apple Store…
Read more »
10:28 pm
Refurbished 24-inch iMac Apple M4 Chip with 10-Core CPU and 10-Core GPU, Gigabit Ethernet, Nano-texture glass – Pink – G1K69LL/A – $2,629.00 | Refurb Tracker
Refurbished 24-inch iMac Apple M4 Chip with 10-Core CPU and 10-Core GPU, Gigabit Ethernet, Nano-texture glass – Pink – G1K69LL/A – $2,629.00
Refurbished 24-inch iMac Apple M4 Chip with 10-Core CPU and 10-Core GPU, Gigabit Ethernet, Nano-texture glass - Pink – G1K69LL/A $2,629.00 Originally released October 2024 24-inch 4.5K Retina display 24GB unified memory 2TB SSD 12MP Center Stage camera with support for Desk View Four Thunderbolt 4 ports Gigabit Ethernet Product page on the Apple Store…
Read more »
10:28 pm
Refurbished 24-inch iMac Apple M4 Chip with 10-Core CPU and 10-Core GPU, Gigabit Ethernet- Silver – G1EJ0LL/A – $1,859.00 | Refurb Tracker
Refurbished 24-inch iMac Apple M4 Chip with 10-Core CPU and 10-Core GPU, Gigabit Ethernet- Silver – G1EJ0LL/A – $1,859.00
Refurbished 24-inch iMac Apple M4 Chip with 10-Core CPU and 10-Core GPU, Gigabit Ethernet- Silver – G1EJ0LL/A $1,859.00 Originally released October 2024 24-inch 4.5K Retina display 16GB unified memory 1TB SSD 12MP Center Stage camera with support for Desk View Four Thunderbolt 4 ports Gigabit Ethernet Product page on the Apple Store…
Read more »
11:07 am
Open-box Apple MacBook Neo A18 Pro 256GB 13″ Laptop for $585 + free shipping | DealNews Laptops
Open-box Apple MacBook Neo A18 Pro 256GB 13″ Laptop for $585 + free shipping
At eBay, get this open-box Apple MacBook Neo A18 Pro 256GB 13″ Laptop for $585. That’s $14 less than Apple’s price for a refurb of the same model. Shipping is free. Buy Now at eBay Features Apple A18 Pro chip with 5-core graphics 8GB of memory 256GB of SSD storage 13″ display
Read more »

No feed items found.