What’s new in iOS 27 beta 6
Apple released iOS 27 beta 6 to developers on August 17, 2026, just six days after beta 5. The build number is 24A5418b (replacing… The post appeared first on MacDailyNews.

Read more »

Latest macOS Golden Gate beta adds unique dynamic wallpapers
Apple's macOS Golden Gate has reached its sixth developer beta, which includes new dynamic wallpapers and updated traffic light window control icons.macOS 27 beta 6 adds two new dynamic wallpapers.On Monday, a week after the fifth developer beta arrived, Apple made macOS 27 beta 6 available for download. Though the update is a relatively light release, it delivers key visual enhancements.With the latest developer beta, Apple added two dynamic wallpapers, both featuring the Golden Gate Bridge. They're effectively video files: one offering a daytime view of the bridge, and the other showing it in the evening. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

macOS Tahoe 26.6.1 fixed a pretty major screen-sharing flaw
Macworld A recent report by the security firm Calif provides details for a security patch that was included in the macOS Tahoe 26.6.1 update released last week. Apple also released macOS 15.7.9 and 14.8.9 updates that provide the same security fix. While Apple’s release notes state that through the vulnerability, “an attacker on the network may be able to authenticate to Screen Sharing without valid credentials,” Apple doesn’t usually provide details on any found security hole, leaving the explanation to the researchers and others. In this case, the inner workings of the vulnerability were discussed at the Black Hat conference last week. Screen sharing is a built-in macOS feature that’s quite useful for administering multiple Macs on a network. From one Mac, a user with the proper credentials can log on to another Mac. Screen sharing displays the remote Mac’s desktop as a window on the user’s display. However, screen sharing had an authentication issue that involved improper state management during authentication. This allowed unauthorized users to try to log on. In its own report, the National Cyber Security in the Netherlands reported that “port 5900 was accessible from the internet.” Port 5900 refers to the TCP port in macOS for screen sharing. If you are a frequent user of macOS’s screen sharing, it’s important to install the update to patch this vulnerability. Since the update contains only the security fix, it won’t take too long to install, but you will need to restart the Mac. Macworld has several guides to help, including a guide on whether or not you need antivirus software, a list of Mac viruses, malware, and trojans, and a comparison of Mac security software.

Read more »

Leaker details A20 Pro chip’s new speed gains
iPhone 18 Pro and iPhone Ultra will be unveiled next month with a new A20 Pro chip, and this weekend a reputable leaker shared performance gains to expect per supply chain sources.

Read more »

Apple releases macOS Tahoe 26.6.2
Apple has released macOS Tahoe 26.6.2, a security-focused update for the current generation of its desktop operating system. The update… The post appeared first on MacDailyNews.

Read more »

Here’s what’s new with iOS 27 beta 6
Apple released iOS 27 beta 6 today, giving developer beta testers the next preview update since iOS 27 debuted at WWDC. Developer beta testers can download the new beta now. iOS 27 is a major iPhone update centered around Siri AI, Apple Intelligence, Liquid Glass refinements, and a long list of quality-of-life changes. Here’s what we’ve found so far in iOS 27 beta 6.

Read more »

MagSafe Monday: The Urban Fit is my favorite budget alternative to Apple’s wallet
Apple’s MagSafe wallet is likely the default option for most people looking to carry a driver’s license, a credit card, and a little cash on the back of their iPhone. Apple’s Find My integration is nice, but that convenience comes at a price, literally, since it costs about double what most third-party MagSafe wallets cost. Some people also hate the material choice as well. The Urban Fit remains one of my favorite alternatives to Apple’s own wallet. At roughly half the cost, it holds up to three cards and still works great as a MagSafe wallet.

Read more »

iPhone 18 Pro's A20 will be faster, power efficient, cost a lot
The A20 and A20 Pro chips in the iPhone 18 Pro will benefit hugely from TSMC's 2-nanometer process, but Apple will pay dearly for the performance and power consumption improvements.The A20 is on the way for the iPhone 18 generation, starting with the A20 ProApple is widely expected to use TSMC's 2-nanometer process to produce its next generation of chips. This includes the inbound A20 and A20 Pro arriving in the iPhone 18 Pro and Pro Max, as well as the iPhone Ultra.There is also always an expectation of performance improvements with Apple's chips, and especially so for a die shrink. If a leaker is accurate with their claim, it could be substantial. Rumor Score: 🤯 Likely Continue Reading on AppleInsider | Discuss on our Forums

Read more »

macOS 26 Tahoe Guide: All the new features in macOS Tahoe, including the latest update
Macworld Like its counterparts on the other Apple devices, on September 15, 2025 macOS got a brand new look along with a new name: macOS 26. Because Apple is aligning the names of all the operating systems this year, the new version of macOS is called macOS 26 rather than macOS 16. It also takes the name Tahoe, inspired by the lake, beaches, and the ski resorts of that area of California.  Along with a big redesign, macOS 26 brings new Continuity features to bring your iPad, iPhone, and Mac even closer together, a brand new Phone app, and more. Spotlight also gets its biggest ever update with the ability to action things like sending emails directly from Spotlight.  macOS Tahoe might have launched, but Apple is continuing development with new features being added every couple of months – the latest update being macOS 26.6.2. You can get a first look at the new upcoming features via Apple’s developer and public betas, which are available to download if you join the beta program (we explain how to do so below). You will find all the things you need to know about macOS Tahoe and all its new features below, including which Macs are compatible with macOS 26 and the new features you can expect, including what’s been added since the September launch, and what’s coming in the next update. Stay tuned to this superguide for everything you need to know about macOS 26 Tahoe. macOS 26 Tahoe: Summary The new version of macOS, called macOS 26 Tahoe, was released on September 15 2025. The latest version–macOS 26.6.2–arrived on August 17, 2026. macOS 26 Tahoe is still being developed and you can access new features before they are launched via the Developer and Public Betas. Tahoe runs on Macs released since 2019. macOS 26 Tahoe runs on all M-series Macs, but it runs on a small number of Intel-powered models. Apple has confirmed that macOS Tahoe will be the last macOS version to support Intel-powered Macs; from macOS 27 Intel Macs will not be supported. With its new Liquid Glass interface, macOS 26 has its biggest design change since 2013. New features in macOS Tahoe include more options for personalization, improvements to Spotlight and Shortcuts app, and the introduction of a Phone app on the Mac and all the associated features. What is the latest version of macOS 26 Tahoe? Latest version of macOS is macOS Tahoe 26.6.2, which arrived on August 17, 2026. Apple released the first version of macOS 26 Tahoe on September 15, 2025. The release coincided with the iOS 26 update. Since then the following updates to Tahoe have been issued by Apple: macOS 26 – September 15, 2025 macOS 26.0.1 – September 29, 2025 macOS 26.1 – November 3, 2025 macOS 26.2 – December 12, 2025 macOS 26.3 – February 11, 2026 macOS 25.3.1 – March 4, 2026 macOS 26.4 – March 24, 2026 macOS 26.4.1 – April 9, 2026 macOS 26.5 – May 11, 2026 macOS 26.5.1 – June 1, 2026 macOS 26.5.2 – June 29, 2026 macOS 26.6 – July 27, 2026 macOS 26.6.1 – August 6, 2026 macOS 26.6.2 – August 17, 2026 Wondering whether to install macOS Tahoe? Read: macOS Tahoe vs macOS Sequoia: What’s different, what’s new, and should you update? What’s coming in the next version of macOS? macOS 26.6.x or macOS 26.7 – release date tbc With macOS 27 Golden Gate coming in the fall, Apple will not perform any major updates to macOS 26 Tahoe. If APple does release macOS 26 updates from here on out, they will be security patches, bug enhancements, and performance improvements. On June 8, Apple will hold its WWDC event at which the company will reveal news about what’s coming in macOS 27 later in 2026. The macOS 26.6 update is unlikely to arrive before the WWDC Keynote. With Apple already working on the next update to macOS, we are less likely to see new features for macOS 26. Future updates to macOS 26 are more likely to relate to bug fixes and security updates, unless Apple needs to release new features for compatibility with upcoming new products. Apple runs a developer beta as well as a public beta so that upcoming new features can be tested. Both betas are free, though the developer beta requires a free registration as a developer. Apple issues updates to the betas fairly regularly. The public beta updates tend to come a day or two after the updated developer beta. If you are interested in trying out the beta, you can join Apple’s beta program. For help installing the macOS beta, see our guide to installing the macOS beta. New features that have arrived in macOS 26 Tahoe since launch Development continues even after the official macOS update is released, as Apple seeks to introduce new features that missed the initial introduction date. Below you can see all the new macOS features that have arrived with each iteration of macOS 26 since it’s initial launch in September 2025. New features in macOS 26.6.2 This update provides security fixes for the Mac. New features in macOS 26.6.1 This update contains only a security update. According to the release notes, An attacker on the network may be able to authenticate to Screen Sharing without valid credentials.” New features in macOS 26.6 It appears that macOS 26.6 starts the indexing process for Siri AI in macOS 27. This is done so that the index won’t take as long once macOS 27 is released this fall. This update also has over 140 security patches, several bug fixes, and performance enhancements. Apple New features in macOS 26.5.2 This update has no new features and contains security fixes. Apple has released a support document that has the details on the security fixes. New features in macOS 26.5.1 The macOS 26.5.1 update only contains a bug fix for M5 Macs. According to the release notes, “This update addresses an issue for enterprise users where Macs with an M5 chip could unexpectedly shut down when using certain content filtering network extensions.” No new features are included in the update. New features in macOS 26.5 With macOS 26.5, Apple added a new option for desktop Mac owners who think it’s too difficult to reach their Mac’s power button. A new option labeled “Start up when power is connected” now appears in the Energy section of System Settings for the Mac mini, iMac, and Mac Studio. An Apple support document explains that “Your Mac will now automatically turn on whenever you connect it to power, such as when plugging it into a power outlet or restoring power using an external power switch.” This should be helpful for those who find the on switch awkward to reach on the Mac mini. Apple also included several features that are also in iOS 26.5 and iPadOS 26.5: Maps now has Suggested Places and ads Power control setting in Energy for Mac mini, Mac Studio, and iMac enables you to power off or restart your Mac using assistive accessories like switches RCS end-to-en encryption Bug fixes and security enhancement New features in macOS 26.4.1 macOS 26.4 is specific to the M5 MacBook Air and the M5 Pro and M5 Max MacBook Pros released in March 2026. It fixes an issue that can occur when using content filter extensions and connecting to a Wi-Fi network on those machines. New features in macOS 26.4 Battery management feature: A manual battery charge limit for MacBooks. This is a feature previously exclusive to iPhones that allows users to cap their battery charge at 80 percent, 100 percent, or any five-percent increment in between to reduce long-term wear and tear. Terminal warning: A new Terminal paste warning alerts users who paste in suspicious commands that scammers encourage pasting text into Terminal. Apple Music “Playlist Playground”: A new feature that uses Apple Intelligence to generate or edit playlists based on text prompts or a selection of songs. Writing Tools and Summaries: Continued integration of system-wide AI tools for proofreading and summarizing text. Apple Podcasts update: A new video podcast experience that utilizes HTTP Live Streaming (HLS) to allow users to switch seamlessly between watching and listening to shows. Apple Music update: The interface for albums and playlists has been updated so that the background color dynamically matches the album artwork. Freeform: The whiteboarding app has received a “Creator Studio” update, which includes new features and a refreshed app icon. Advanced Fingerprinting Protection: macOS 26.4 includes critical security patches and expands on privacy features like Advanced Fingerprinting Protection. Stolen Device Protection: This a feature, first seen on iPhone, is expected to be enabled by default starting with this release. Eight new emoji: Ballet Dancer, Distorted Face, Fight Cloud, Hairy Creature (Bigfoot), Landslide, Orca, Treasure Chest, and Trombone Rosetta 2 warnings: Support for the transition layer for Intel-based apps will end with macOS 27. New features in macOS 26.3.1 External Display Support: macOS 26.3.1 adds support for the 2026 models of the Studio Display and Studio Display XDR. If you’re planning on investing in a Studio Display, you’ll need to install this update, according to the release notes. It also includes security patches and bug fixes. Apple New features in macOS 26.3 This update continues the refinement of the major features introduced with the initial launch of macOS 26 Tahoe. In iOS 26.3 there were a number of EU-mandated changes. It is also optimized for the M5 Pro and M5 Max chips, which are due to launch. Read our iOS 26 guide for more information. New features in macOS 26.2 macOS Tahoe 26.2, released in late 2025, introduced several specialized updates focusing on video conferencing enhancements, AI development tools, and hardware-specific performance boosts. While it was not considered a massive overhaul, it brought a few “genius” utility features that improved the daily user experience, particularly for those working in remote or low-light environments. Edge Light: The most prominent consumer-facing feature in macOS 26.2 is Edge Light, a virtual ring light designed to improve webcam image quality. It places a bright white border around the display to mimic a selfie ring light, significantly improving visibility in dark rooms. It uses the Neural Engine to detect the user’s face for appropriate light adjustment and can even detect the cursor to hide the light when it might interfere with navigation. Users can adjust the intensity of the light and choose between warmer or cooler color temperatures. It requires an M-series Mac, but on M4 Macs and later, the feature can be set to enable automatically when low light is detected . AI and Developer Enhancements: For developers and power users, macOS 26.2 introduced significant updates to machine learning frameworks and hardware clustering. Developers using the open-source MLX framework can now leverage the Neural Accelerator in the M5 chip. The update enhanced the ability to create AI clusters using the Mac Studio’s Thunderbolt 5 connectivity. Security Updates: Critical patches for vulnerabilities, aligning with security fixes found in iPadOS 26.2. Interface Polish: Continued refinement of the “Liquid Glass” UI, which introduced more translucency and visionOS-style effects across the system. Performance: General “under-the-hood” changes to improve system stability and responsiveness . New features in macOS 26.1 The macOS 26.1 update includes fixes for problems with games controllers and some other issues. There are a lot more changes coming to iPhones with iOS 26.1. New features in macOS 26.1 include: Liquid Glass: Ability to tone down Liquid Glass effect. Choose between clear and tinted look for increased opacity. AutoMix support for Apple Music over AirPlay. FaceTime audio improvements over low-bandwidth. Regional Communication Safety and Web content filters for adult websites. Icons: Changes to the Macintosh HD icon. New TV app icon with Apple TV+ rebranded to Apple TV. A new Results from Clipboard setting for Spotlight, where the user can turn on/off Spotlight’s ability to search and display clipboard items. Users can also set an expiration time for the clipboard and clear the Clipboard history. (Settings > Spotlight > Results from Clipboard.) macOS Tahoe 26.1 has a new Spotlight setting for Clipboard management.Foundry macOS 26 Tahoe problems & fixes YouTube / Apple Some M3 Ultra Mac Studio users have reported that they are unable to install macOS Tahoe. It seems the problematic Mac Studios already had Sequoia 15.7 installed, and during the attempted installation, Tahoe would look for a driver, and when it failed to find it, it resulted in a failed installation. The macOS 26.0.1 update addresses the initial bugs, including the Mac Studio installation bug. macOS 26 Tahoe supported devices: Which Macs get macOS Tahoe Requires M-series chip or Intel-based Mac computers with a T2 Security Chip Apple Intelligence features require M1 or later No Intel support from macOS 27 onwards When Apple updates the operating system for its devices, it sometimes means that certain models are no longer supported. The good news is that Macs that ran macOS Sonoma will be able to run the new macOS. Apple states that the base requirement includes Macs with M-series chips and Intel-based Mac computers with a T2 security chip. Here are Macs with Apple Silicon that will be able to run macOS Tahoe: MacBook Air (M1/2020 and later) MacBook Pro (M1/2020 and later) iMac (M1/2021 and later) Mac mini (M1/2020 and later) Mac Studio (M1/2022 and later) Mac Pro (M2/2023 and later) There are four Intel-powered Macs able to run macOS Tahoe. These models won’t support Apple Intelligence features: MacBook Pro (16‑inch, Intel/2019) MacBook Pro (13‑inch, Intel/2020, Four Thunderbolt 3 ports) iMac (Intel/mid 2020) Mac Pro (Intel/2019) Apple confirmed that this is the last version of macOS that will run on Intel Macs.  What were the biggest changes in macOS 26 Tahoe macOS 26 Tahoe represents one of the most significant overhauls to Apple’s desktop operating system in over a decade. The update is characterized by a dramatic visual redesign, the introduction of core mobile apps to the Mac, and a complete rethinking of system-wide tools like Spotlight. We’ll run through each new feature in detail below, including the Liquid Glass redesign, Spotlight overhaul, new apps, new iPhone features that are coming to the Mac and more… macOS 26 Tahoe design: Liquid Glass and other interface changes  Apple At WWDC in June, Apple showed off some enticing new features for macOS that will be coming later in 2025. A number of new features and interface enhancements were promised, but one of the biggest changes is coming to all of Apple’s products: a new design based on a graphical user interface that Apple is calling Liquid Glass. Apple showed off the brand new look for macOS in the WWDC keynote. As with Apple’s other operating systems, macOS Tahoe uses Apple’s new Liquid Glass effect to create reflective, glossy elements around the interface. The Liquid Glass elements will change color to reflect the content beneath as you scroll and will dynamically react. Buttons appear more curved and less flat. You’ll see the effect in the Dock, sidebars, toolbars, and elsewhere. The menu bar is fully transparent, and you can adjust the transparency of icons in the Dock, for example. If you don’t like the new transparent look or if it affects how well you can see items, there is a way to reduce it, and in some instances, turn it in off altogether. Read: How to reduce transparency in macOS Tahoe. This is the first time in years that Apple has made significant changes to the visual style of macOS, and it certainly makes the OS appear more modern. @macworld.com Top 3 features in macOS Tahoe from WWDC #wwdc #macostahoe #fyp ♬ original sound – Macworld – Macworld macOS Tahoe interface changes  Apple Apple says the design overhaul will elevate the key elements of macOS and enhance the macOS experience. The cleaner design is intended to help the user to focus on their content rather than other distractions, while elements like the translucent menu bar will make the screen feel larger.  Users will be able to choose to add third-party apps to the menu bar and even drag widgets and buttons from the Control Centre into the menu bar, thanks to a customizable layout, similar to iOS 18. Users will also be able to add controls for their favorite apps to the Control Centre. We have a guide to how to use Control Centre in macOS Tahoe where you can read about how to add controls, remove the ones you don’t want, and arrange them in a way that makes sense for you. Apple is taking advantage of the Liquid Glass introduction to bring some new icon designs to the Mac as well to help give macOS a fresh look. Some of the icons look drastically different, for others the changes are more subtle. The ‘hard drive’ icon will now be replaced with one that looks more like an SSD, for example. The new icons tend to take the form of ‘squircles’. The changes may make some third party icons less recognisable. Take a look at: 21 of the new macOS Tahoe icons with new designs for the Finder, Automator, Calendar and Contacts icons among others. You can change the icons if you want, read: How to change the icon of a macOS storage device. The new Finder icon.Apple macOS will also gain a feature that arrived on the iPhone and iPad with iOS 18: tinted and dark app icons. Users will be able to personalize their Mac in other ways, too, such as changing the color of folders and adding emoji or symbols to help them identify folders. Users can also pick personalised wallpapers and choose theme colors. If you want to change your folder color read: How to change folder color and add icons in Tahoe. New dynamic screensavers will be included. One, based on the default macOS Tahoe wallpaper, depicts the landscapes of South Lake Tahoe in a stylized artistic manner, is available in both light and dark versions. See how it looks in Tahoe’s gorgeous new screen saver. There are up to 15 other new screensavers with images of Tahoe at various time of the day, Himalayas, Goa, The Ganges and more. macOS Tahoe Spotlight overhaul Apple Spotlight has always been much more than a search tool built into macOS, helping users find anything on their Macs, make calculations and conversions, and more. In macOS Tahoe, Spotlight will be able to do even more. Spotlight’s design and functionality have been completely rethought for macOS 26, with changes that will help Mac users get things done faster. Rather than being a single bar, on the right-hand side of the new Spotlight search box, you will find icons for things like apps, files, Shortcuts, Actions, and clipboard. Select one of these buttons, and Spotlight’s box expands to house relevant items in an easy-to-browse view. When you search for something, you’ll see relevant filters under your search terms – click one to quickly apply it. Not only will Spotlight be the easiest way to find anything on your Mac, but in macOS 26, Spotlight will be contextually aware so it can make suggestions based on what you are doing. Search results will be listed based on their relevance to you, and it will be possible to use new filtering options for more specific search results.  Spotlight will also have the ability to perform actions that normally require you to be inside an app. For example, you will be able to create a calendar event, begin an audio recording, or play a podcast from within Spotlight. It will even let you fill out parameters for actions, such as typing out an email message and filling in the recipient and subject. You can essentially compose an email from inside Spotlight, without opening your email app. This will be simplified further with Quick Keys, with which you will be able to type a short string of letters to launch an action, such as typing “sm” to start sending a message to a friend. An App Intents API will make it possible for third-party developers to add Spotlight shortcuts for their applications. One of the most exciting new arrivals in Spotlight is Clipboard History, something we have wanted for years. Instead of being limited to pasting the last copied item, you will be able to view previous text and photos you’ve copied and re-insert them as needed. Why did it take Apple so long to offer this? Apple Tied to the new Spotlight is the new Apps app, which replaces Launchpad, which has been a feature of Macs for more than a decade and provides users with a Home page like view of all their apps. Instead Spotlight will be the means of finding apps. This will take some adjustment, especially if you were a Launchpad user. Learn more about Apps replacing Launchpad, and if you want to get Launchpad back we have a tutorial to show you how. macOS 26 Tahoe: New and updated apps  There are also lots of updates coming to Apple apps that are included with iPads, iPhones, and Macs. Many of the changes are shared across all the new apps, but there are a number of Mac-specific updates coming.  Phone app A Phone app on the Mac is the latest Continuity feature to come to macOS. Continuity is Apple’s name for the features that work seamlessly between Macs, iPad and iPhones, these include Handoff (which enables you to start a task on one device and switch to another to finish it), Universal Clipboard (which allows you to copy something on one device and paste it on another), and Universal Control (where you can use one mouse and keyboard to interface with more than one Mac), among other features.  With the new Phone app, users will be able to receive their calls and voicemail on the Mac. The Phone app is getting some new features of its own, including Call Screening, which is designed to help you avoid spam calls, and Hold Assist, which means you will never have to listen to hold music again. With Call Screening, before a call is put through, an unknown caller will have to share their name and reason for calling, and you will then be provided with that information. With Hold Assist, when you join a queue to wait for a call operator and the hold music starts, you can choose to be called back.  YouTube / Apple Live Activities Another feature that demonstrates the interoperability between the iPhone and Mac is Live Activities. In iOS 18, you can see a live update on your Lock Screen relating to things like a takeaway order. Live Activities show the process of a food delivery driver, for example. Now, that functionality is coming to the Mac. It will be powered by the iPhone Mirroring function, and will take the form of an iPhone-style widget that you will see on the screen of your Mac. Games app The Games app is another one that is available across all three main operating system updates: iOS, iPadOS, and macOS. As with the iOS Games app, the Games app on the Mac will bring together all the games you have on your Mac (bought from the App Store, Apple Arcade and elsewhere), as well as your friends list, achievements, and leaderboards. Tabs will make it easy to find the games you and your friends are playing. A new Game Overlay will make it easy to adjust settings for a particular game. You’ll also be able to chat with friends and ask them to play. @macworld.com New Mac gaming features just dropped! #wwdc25 #gaming #apple #fyp ♬ original sound – Macworld – Macworld There is also a new Low Power Mode coming, which gamers will be able to turn on to maximise battery life when playing games.  And in related news, Metal 4 is coming, which will enable next-gen features for Mac game developers, such as MetalFX Frame Interpolation and MetalFX De-noising.  Apple Shortcuts  Apple The Shortcuts app is getting an overhaul in macOS Tahoe. Shortcuts is a tool for automating tasks and repetitive actions. For those with more specific needs, there is also Automator on the Mac, but Shortcuts is simple to use and available on iPhone and iPad as well. In Tahoe, Shortcuts will be able to run workflows based on factors like time of day, or in response to an email from a specific person arriving. This functionality was previously limited to the iPhone and iPad versions. There are new intelligent actions available that can be used to create Smart Shortcuts. Apple Intelligence and ChatGPT can be used to enhance these Shortcuts. Apple says that “Users will see dedicated actions for features like summarizing text with Writing Tools or creating images with Image Playground.” Live Translation  One of the most useful new features announced at WWDC is Live Translation. With Live Translation, you can text a friend who speaks a different language and have the translations appear in real time, or get instant translations during a phone call or FaceTime conference. Everyone gets their own translator.  You’ll be able to take advantage of Live Translation in the Phone app, Messages, and FaceTime on your Mac. Apple Journal The Journal app, which arrived on iOS in 2023, is coming to the Mac (and iPad). Terminal Terminal is getting a colorful redesign and the Liquid Glass treatment, with support for 24-bit color and the ability to use Powerline fonts. Reminders Reminders is getting some help from Apple Intelligence. Reminders will scan a website, note, email or other content, then decide the most relevant action items for you based on its findings. You’ll be able to use Apple Intelligence to automatically categorize your reminders into sections, making them easier to find There are also changes coming to Safari, Messages, Photos, FaceTime, and Notes. 

Read more »

Apple squashes iPhone security bugs with latest iOS update
Apple released iOS 26.6.1 and macOS Tahoe 26.6.2, small but important updates focused on security. iPadOS 26.6.1 is out, too. (via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)

Read more »

iOS 26.6.1 has fixes for 20+ security issues on iPhone, details here
Apple released iOS 26.6.1 today, a new software update for iPhone that includes fixes for 20+ security issues. Here are the details.

Read more »

macOS 27 Golden Gate beta 6 features redesigned traffic light window controls
macOS 27 Golden Gate beta 6 introduces redesigned traffic light window controls. The new look resembles older Mac OS X systems with more detail in each button.

Read more »

Apple has shipped iOS 26.6.1, and you should install it soon
Apple has released an update for iOS 26.6.1 for all users, with the usual inclusion of security fixes, making it a must-install for your iPhone.iOS 26 is the current generation for iOS. While Apple is constantly beta-testing its 27-generation operating systems, it's still shipping updates to its earlier releases. That includes the current-gen versions.On Monday, as part of its swathe of releases, Apple issued its update for iOS 26.6.1. The update, which it rolled a release candidate for on August 10, can be downloaded to an iPhone running iOS 26.6 or earlier. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Apple rolls out Release Candidates for macOS Tahoe 26.7 and macOS Sequoia 15.8
Alongside macOS 27 developer beta 6, Apple also released the first RCs for macOS Tahoe 26.7 and macOS Sequoia 15.8. Here are the details.

Read more »

Apple releases iOS 26.6.1 for iPhone
Apple has released iOS 26.6.1, a point update for iPhone users, on August 17, 2026. The software is available now via… The post appeared first on MacDailyNews.

Read more »

The AirPods 4 with ANC is $44 Off
The AirPods have been redesigned for your comfort, featuring a shorter stem, quick-press controls to manage calls and music, and a refined contour with better stability. The device is powered by the H2 chip for great call and sound quality. The AirPods 4 feature Active Noise Cancellation to block outside noise when you put them […] The post appeared first on iLounge.

Read more »

Apple Warned by Commerce Secretary in United States Not to Buy Memory from China
Apple has been warned by Howard Lutnick, the United States Commerce Secretary, not to purchase memory chips for Macs from China. Apple has reportedly tested memory chips from CXMT to help alleviate the shortage of memory. CXMT is on the 1260H list, or the Chinese Military Company Blacklist. This list includes companies that are believed […] The post appeared first on iLounge.

Read more »

First EV Ferrari Designed by Jony Ive Sold at Auction for $40 million
The Ferrari Luce, the first EV vehicle for Ferrari designed by Jony Ive, has been sold for $40 million in an auction. The vehicle was Ferrari making an attempt in the growing market of Electric Vehicles. The $40 million deal marks one of the highest amount of money ever spent for a Ferrari. The last […] The post appeared first on iLounge.

Read more »

Apple releases iOS 26.6.1 for iPhone, here’s what’s new
Apple has just released iOS 26.6.1, a new software update for iPhone. Here’s what’s new.

Read more »

AirPods Pro 4 Could Get Many Models and New Features
We could see a significant upgrade for the AirPods Pro; one model is expected to have improved AI and infrared cameras. Gesture support for the AirPods has been researched by Apple since 2020. The cameras will not have video and photo capture capabilities, but rather will serve as a way for the AI to recognize […] The post appeared first on iLounge.

Read more »

The 4-pack AirTag 2 is $10 Off
The second-generation AirTag features a more sustainable design, made with 85% recycled plastic for the enclosure, with 100% fiber-based packaging. Enjoy a battery life of over a year for the base battery and easy battery replacement. The AirTag does not store location history or data, and only authorized people and you are able to see […] The post appeared first on iLounge.

Read more »

The 4-pack AirTag 2 is $10 Off
The second-generation AirTag features a more sustainable design, made with 85% recycled plastic for the enclosure, with 100% fiber-based packaging. Enjoy a battery life of over a year for the base battery and easy battery replacement. The AirTag does not store location history or data, and only authorized people and you are able to see […] The post appeared first on iLounge.

Read more »

The 4-pack AirTag 2 is $10 Off
The second-generation AirTag features a more sustainable design, made with 85% recycled plastic for the enclosure, with 100% fiber-based packaging. Enjoy a battery life of over a year for the base battery and easy battery replacement. The AirTag does not store location history or data, and only authorized people and you are able to see […] The post appeared first on iLounge.

Read more »

The 4-pack AirTag 2 is $10 Off
The second-generation AirTag features a more sustainable design, made with 85% recycled plastic for the enclosure, with 100% fiber-based packaging. Enjoy a battery life of over a year for the base battery and easy battery replacement. The AirTag does not store location history or data, and only authorized people and you are able to see […] The post appeared first on iLounge.

Read more »

The 4-pack AirTag 2 is $10 Off
The second-generation AirTag features a more sustainable design, made with 85% recycled plastic for the enclosure, with 100% fiber-based packaging. Enjoy a battery life of over a year for the base battery and easy battery replacement. The AirTag does not store location history or data, and only authorized people and you are able to see […] The post appeared first on iLounge.

Read more »

The 4-pack AirTag 2 is $10 Off
The second-generation AirTag features a more sustainable design, made with 85% recycled plastic for the enclosure, with 100% fiber-based packaging. Enjoy a battery life of over a year for the base battery and easy battery replacement. The AirTag does not store location history or data, and only authorized people and you are able to see […] The post appeared first on iLounge.

Read more »

Apple's sixth 27-gen developer betas arrive as the fall release draws closer
Weeks away from a probable launch, Apple has outed its sixth developer betas for iOS 27, iPadOS 27, tvOS 27, watchOS 27, visionOS 27, and macOS 27.An earlier iOS 27 beta screenThe Apple Developer Beta program has now reached the sixth round for iOS 27, iPadOS 27, macOS 27 Golden Gate, tvOS 27, watchOS 27, and visionOS 27.The sixth appears after the fifth, which Apple brought out on August 10. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

110 Countries Sent Threat Notifications by Apple Regarding Attacks
Users are being notified of a new wave of threats when they are under attack by spyware. Users in 110 countries have received the notification; steps are provided in the notification. Just because you received a threat notification does not mean you have been hacked; it is a warning that you are a potential target […] The post appeared first on iLounge.

Read more »

110 Countries Sent Threat Notifications by Apple Regarding Attacks
Users are being notified of a new wave of threats when they are under attack by spyware. Users in 110 countries have received the notification; steps are provided in the notification. Just because you received a threat notification does not mean you have been hacked; it is a warning that you are a potential target […] The post appeared first on iLounge.

Read more »

Who’s Tracking You? Use This New Service to Find Out
It can be daunting to determine who's responsible for showing ads on the websites we visit, or who's harvesting data from the mobile apps we use every day. That information is already semi-public, but it is not easily parsed and traditionally much of it has remained walled away in the hands of large advertising platforms. Not anymore: A powerful and free new service called DecryptAds scrapes and correlates this adtech data and makes it simple to quickly learn a great deal about the entities that are tracking you.

Read more »

Microsoft Plugs Nearly 400 Security Holes
Microsoft today released updates to remedy at least 398 security vulnerabilities in its Windows operating systems and supported software, including one weakness that is already being actively exploited and two others that were publicly detailed prior to today.

Read more »

Canadian Man Pleads Guilty in Snowflake Extortions
A 26-year-old Canadian man once described as one of the most consequential cybercrime threat actors of 2024 has pleaded guilty to computer fraud and conspiracy to hack and extort more than 165 organizations that used the cloud data storage provider Snowflake. Connor Riley Moucka, of Kitchener, Ontario, also admitted to stealing call and text history records of more than 100 million AT&T customers.

Read more »

Vulnerability Summary for the Week of July 27, 2026
High Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info @fastify/rate-limit--@fastify/rate-limit @fastify/rate-limit before 11.2.0 keys rate-limit buckets by the verbatim client IP string returned from request.ip. Because a single IPv6 client can control a large address range (a /64 holds 2^64 distinct addresses) and the same address has multiple valid textual representations, an IPv6 capable client can defeat the rate-limit boundary by rotating addresses or by rewriting the same address in different forms. Applications that use @fastify/rate-limit to protect endpoints such as authentication, password reset, OTP delivery, or expensive API calls can be bypassed by IPv6 clients behind a proxy that surfaces IPv6 to the origin when trustProxy is enabled. The issue is fixed in @fastify/rate-limit 11.2.0, where the default key generator normalizes IPv6 addresses to their canonical form, collapses IPv4 mapped IPv6 to IPv4, and applies a configurable prefix mask (default /64) via a new ipv6Subnet option. 2026-07-29 7.3 CVE-2026-15144 acacode--swagger-typescript-api swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, templates/base/http-clients/axios-http-client.ejs interpolates servers[0].url from src/code-gen-process.ts into the HttpClient constructor without escaping, allowing an attacker-controlled OpenAPI spec to inject code that executes when new HttpClient() or new Api() is constructed. This issue is fixed in version 13.12.2. 2026-07-29 8.3 CVE-2026-54661 acacode--swagger-typescript-api swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/code-gen-process.ts createApiConfig copies servers[0].url into apiConfig.baseUrl, and templates/base/http-clients/fetch-http-client.ejs interpolates apiConfig.baseUrl into the generated HttpClient baseUrl field without escaping, allowing an attacker-controlled OpenAPI spec to inject TypeScript static field code that executes when the generated fetch client module is imported. This issue is fixed in version 13.12.2. 2026-07-29 8.3 CVE-2026-54662 acacode--swagger-typescript-api swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-parser/base-schema-parsers/enum.ts passes components.schemas.*.enum[i] values to Ts.StringValue in src/configuration.ts without escaping before templates/base/enum-data-contract.ejs renders TypeScript enum declarations, allowing an attacker-controlled OpenAPI spec to inject code that executes when the generated module is imported. This issue is fixed in version 13.12.2. 2026-07-29 8.3 CVE-2026-54664 acacode--swagger-typescript-api swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-routes/schema-routes.ts passes OpenAPI path keys through parseRouteName to templates/default/procedure-call.ejs and templates/modular/procedure-call.ejs without escaping JavaScript template literal interpolation, allowing an attacker-controlled path containing ${...} to execute when the generated method is called. This issue is fixed in version 13.12.2. 2026-07-29 8.3 CVE-2026-54666 acacode--swagger-typescript-api swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts getRemoteRequestHeaders forwards --authorizationToken to every URL fetched by fetchRemoteSchemaDocument while warmUpRemoteSchemasCache resolves external $ref URLs, allowing an attacker-controlled OpenAPI spec to exfiltrate the developer or CI bearer token to a cross-origin endpoint. This issue is fixed in version 13.12.2. 2026-07-29 7.4 CVE-2026-54660 acowebs--Dynamic Pricing With Discount Rules for WooCommerce Unauthenticated Cross Site Scripting (XSS) in Dynamic Pricing With Discount Rules for WooCommerce = 1.4.0-beta.27 through = 1.7.0-beta.0 through sk) inside smc_cdc_msg_recv(). No reference is held across the lock release. The only reference pinning the socket while the connection is discoverable in the link group is taken in smc_lgr_register_conn() (sock_hold) and dropped in __smc_lgr_unregister_conn() (sock_put), both under conns_lock. Once the handler drops conns_lock, a concurrent close() - > smc_release() - > smc_conn_free() - > smc_lgr_unregister_conn() can drop that reference and free the smc_sock, so the handler's later sock_hold() runs on freed memory: WARNING: lib/refcount.c:25 at refcount_warn_saturate Workqueue: rxe_wq do_work refcount_warn_saturate (lib/refcount.c:25) smc_cdc_msg_recv (net/smc/smc_cdc.c:430) smc_cdc_rx_handler (net/smc/smc_cdc.c:502) smc_wr_rx_tasklet_fn (net/smc/smc_wr.c:445) tasklet_action_common (kernel/softirq.c:938) handle_softirqs (kernel/softirq.c:622) Kernel panic - not syncing: panic_on_warn set Only SMC-R is affected. The SMC-D receive tasklet is stopped by tasklet_kill(&conn- >rx_tsklet) in smc_conn_free() before the connection is unregistered, so it cannot run concurrently with the free. Take the socket reference while still holding conns_lock, so the registration reference can no longer be the last one, and drop it once the handler is done. 2026-07-27 9.8 CVE-2026-64541 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: sctp: validate STALE_COOKIE cause length before reading staleness When an ERROR chunk with a STALE_COOKIE cause is received in the COOKIE_ECHOED state, sctp_sf_do_5_2_6_stale() reads the 4-byte Measure of Staleness that follows the cause header: err = (struct sctp_errhdr *)(chunk- >skb- >data); stale = ntohl(*(__be32 *)((u8 *)err + sizeof(*err))); err is the first cause in the chunk, not the STALE_COOKIE cause that caused the dispatch, and nothing guarantees the staleness field is present. sctp_walk_errors() only requires a cause to be as long as the 4-byte header, so for a STALE_COOKIE cause of length 4 the read runs past the cause, and for a minimal ERROR chunk past skb- >tail. The value is echoed to the peer in the Cookie Preservative of the reply INIT, leaking uninitialized memory. sctp_sf_cookie_echoed_err() already walks to the STALE_COOKIE cause, so check its length there and pass it to sctp_sf_do_5_2_6_stale(), which reads that cause instead of the first one. A STALE_COOKIE cause too short to hold the staleness field is discarded. The read is reachable by any peer that can drive an association into COOKIE_ECHOED, including an unprivileged process using a raw SCTP socket in a user and network namespace. 2026-07-27 9.1 CVE-2026-64551 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop The loop in is_ap_in_tkip() iterates over IEs without verifying that enough bytes remain before dereferencing the IE header or its payload: - pIE- >element_id and pIE- >length are read without checking that i + sizeof(*pIE) data + 12, which requires pIE- >length >= 16. For WLAN_EID_RSN it compares pIE- >data + 8, requiring pIE- >length >= 12. Neither requirement is checked. Add the missing IE header and payload bounds checks and guard each data access with an explicit pIE- >length minimum, matching the pattern established in update_beacon_info(). 2026-07-27 8.1 CVE-2026-64536 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() genelink_rx_fixup() splits an aggregated RX frame into its individual packets, using a per-packet length taken from device-supplied data. That length is only bounded by GL_MAX_PACKET_LEN (1514); it is never compared against how many bytes were actually received. A malicious GeneLink (GL620A) device can therefore send a short URB whose header claims packet_count > 1 and a first packet of up to 1514 bytes. skb_put_data(gl_skb, packet- >packet_data, size); then copies past the end of the receive buffer and hands the adjacent slab contents up the network stack, an out-of-bounds read that leaks kernel heap. No privilege is required: the path runs in the usbnet RX softirq as soon as the interface is up. BUG: KASAN: slab-out-of-bounds in genelink_rx_fixup (drivers/net/usb/gl620a.c:112) Read of size 1514 at addr ffff888011309708 by task ksoftirqd/0/14 Call Trace: ... __asan_memcpy (mm/kasan/shadow.c:105) genelink_rx_fixup (include/linux/skbuff.h:2814 drivers/net/usb/gl620a.c:112) usbnet_bh (drivers/net/usb/usbnet.c:572 drivers/net/usb/usbnet.c:1589) process_one_work (kernel/workqueue.c:3322) bh_worker (kernel/workqueue.c:3405) tasklet_action (kernel/softirq.c:965) handle_softirqs (kernel/softirq.c:622) run_ksoftirqd (kernel/softirq.c:1076) ... skb_pull() already verifies that the requested length fits the buffer and returns NULL otherwise. Move it ahead of the copy and check its result, so a packet that overruns the received data is rejected before it is read. Well-formed frames, whose packets are fully present, are unaffected. 2026-07-27 8.1 CVE-2026-64540 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: net: usb: net1080: validate packet_len before pad-byte access in rx_fixup For an even packet_len, net1080_rx_fixup() reads the pad byte at skb- >data[packet_len] before the skb- >len != packet_len check further down, and packet_len is only bounded against NC_MAX_PACKET. A malicious NetChip 1080 device can send a short frame advertising a large even packet_len (e.g. 0x4000), so the pad-byte read lands past the end of the skb: BUG: KASAN: slab-out-of-bounds in net1080_rx_fixup Read of size 1 at addr ffff8880106c83c6 by task ksoftirqd/0/14 ... net1080_rx_fixup (drivers/net/usb/net1080.c:384) usbnet_bh (drivers/net/usb/usbnet.c:1589) process_one_work (kernel/workqueue.c:3322) bh_worker (kernel/workqueue.c:3708) tasklet_action (kernel/softirq.c:965) handle_softirqs (kernel/softirq.c:622) ... Reject the frame when packet_len >= skb- >len before reading. 2026-07-27 8.1 CVE-2026-64547 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() When the scatterlist ring is full or nearly full, bpf_msg_push_data() enters a copy fallback path and computes copy + len for the page allocation size. Since len comes from BPF with arg3_type = ARG_ANYTHING and both are u32, a crafted len can wrap the sum to a small value, causing an undersized allocation followed by an out-of-bounds memcpy. BUG: unable to handle page fault for address: ffffed104089a402 Oops: Oops: 0000 [#1] SMP KASAN NOPTI Call Trace: __asan_memcpy (mm/kasan/shadow.c:105) bpf_msg_push_data (net/core/filter.c:2852 net/core/filter.c:2788) bpf_prog_9ed8b5711920a7d7+0x2e/0x36 sk_psock_msg_verdict (net/core/skmsg.c:934) tcp_bpf_sendmsg (net/ipv4/tcp_bpf.c:421 net/ipv4/tcp_bpf.c:584) __sys_sendto (net/socket.c:2206) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) Add an overflow check before the allocation. 2026-07-27 8.4 CVE-2026-64548 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: virtio-net: fix len check in receive_big() receive_big() bounds the device-announced length by (big_packets_num_skbfrags + 1) * PAGE_SIZE. That is still too loose: add_recvbuf_big() sets sg[1] to start at offset sizeof(struct padded_vnet_hdr) into the first page, so the chain actually carries hdr_len + (PAGE_SIZE - sizeof(padded_vnet_hdr)) + big_packets_num_skbfrags * PAGE_SIZE bytes -- 20 bytes less than the check allows for the common hdr_len == 12 case. A malicious virtio backend can announce a len in that gap. page_to_skb() then walks one frag past the page chain, storing a NULL page- >private into skb_shinfo()- >frags[MAX_SKB_FRAGS], which is both an out-of-bounds write past the static frag array and a NULL frag handed up the rx path. Bound len by the size add_recvbuf_big() actually advertised. 2026-07-27 8.4 CVE-2026-64552 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() br_ip6_fragment() gets prevhdr, a pointer into the skb head, from ip6_find_1stfragopt(), then calls skb_checksum_help(). For a cloned skb skb_checksum_help() reallocates the head via pskb_expand_head(), leaving prevhdr dangling. It is later dereferenced in ip6_frag_next(), causing a use-after-free write. Save prevhdr's offset before skb_checksum_help() and recompute it after, like commit ef0efcd3bd3f ("ipv6: Fix dangling pointer when ipv6 fragment"). BUG: KASAN: slab-use-after-free in ip6_frag_next (net/ipv6/ip6_output.c:857) Write of size 1 at addr ffff888013ff5016 by task exploit/141 Call Trace: ... kasan_report (mm/kasan/report.c:595) ip6_frag_next (net/ipv6/ip6_output.c:857) br_ip6_fragment (net/ipv6/netfilter.c:212) nf_ct_bridge_post (net/bridge/netfilter/nf_conntrack_bridge.c:407) nf_hook_slow (net/netfilter/core.c:619) br_forward_finish (net/bridge/br_forward.c:66) __br_forward (net/bridge/br_forward.c:115) maybe_deliver (net/bridge/br_forward.c:191) br_flood (net/bridge/br_forward.c:245) br_handle_frame_finish (net/bridge/br_input.c:229) br_handle_frame (net/bridge/br_input.c:442) ... packet_sendmsg (net/packet/af_packet.c:3114) ... do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Kernel panic - not syncing: Fatal exception in interrupt 2026-07-27 8.8 CVE-2026-64554 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops() kvm_hyp_handle_mops() resets the single-step state machine as part of rewinding state for a MOPS exception by modifying vcpu_cpsr() and writing the result directly into hardware. In the case of nested virtualization, vcpu_cpsr() is a synthetic value such that the rest of KVM can deal with vEL2 cleanly. That means the value requires translation before being written into hardware, which is unfortunately missing from the MOPS handler. Fix it by directly modifying SPSR_EL2 and avoiding the synthetic state altogether, which will be resynchronized on the next 'full' exit back to KVM. 2026-07-27 8.8 CVE-2026-64555 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() l2cap_sock_new_connection_cb() returned l2cap_pi(sk)- >chan after release_sock(parent). Once the parent lock is dropped the newly enqueued child socket sk is reachable via the accept queue, so another task can accept and free it before the callback dereferences sk, resulting in a use-after-free. Rework the - >new_connection() op so the core, rather than the callback, owns the child channel's lifetime. The op now receives a pre-allocated new_chan and returns an errno instead of allocating and returning a channel. l2cap_new_connection() allocates the child channel and links it into the conn list via __l2cap_chan_add() before invoking the callback, so the conn-list reference keeps the channel alive once release_sock(parent) exposes the socket to other tasks. Channel configuration that was duplicated in l2cap_sock_init() and the various new_connection callbacks is consolidated into l2cap_chan_set_defaults(), which now inherits from the parent channel when one is supplied. 2026-07-29 8.8 CVE-2026-64557 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff ("net: openvswitch: remove misbehaving actions length check") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure. 2026-07-27 7.8 CVE-2026-64531 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation} In do_action()'s UpdateRecordDataRoot (fslog.c:3489) and UpdateRecordDataAllocation (fslog.c:3697) cases, the memmove destination is `Add2Ptr(e, le16_to_cpu(e- >view.data_off))`, where e- >view.data_off comes from an on-disk NTFS_DE inside an INDEX_ROOT or INDEX_BUFFER. Neither case validates view.data_off + dlen against e- >size; the existing check_if_index_root / check_if_alloc_index helpers walk the entry chain and validate the entry's offset, but not its internal view fields. The neighbouring read sites (e.g., fs/ntfs3/index.c when iterating view entries) check view.data_off + view.data_size size. Apply the same bound at the two memmove sites. Reproduced under UML+KASAN on mainline 8d90b09e6741 via pr_warn-only probe instrumentation: with view.data_off forced to 0xFFFC, the memmove writes 32 bytes past the end of the NTFS_DE. This is similar in shape to Pavitra Jha's 2026-05-02 patch "fs/ntfs3: prevent oob in case UpdateRecordDataRoot" () which proposes calling ntfs3_bad_de_range(); that helper does not exist in mainline. This patch uses inline checks. 2026-07-27 7.8 CVE-2026-64532 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate lcns_follow in log_replay conversion log_replay() converts DIR_PAGE_ENTRY_32 records into DIR_PAGE_ENTRY records when replaying version 0 restart tables. During this conversion, the memmove() length is derived directly from the on-disk lcns_follow field: memmove(&dp- >vcn, &dp0- >vcn_low, 2 * sizeof(u64) + le32_to_cpu(dp- >lcns_follow) * sizeof(u64)); check_rstbl() validates restart table structure, but does not constrain per-entry lcns_follow values relative to the entry size. A malformed filesystem image can provide an oversized lcns_follow value, causing the conversion memmove() to access memory beyond the bounds of the allocated restart table buffer. The same field is later used to bound iteration over page_lcns[], so validating lcns_follow during conversion also prevents downstream out-of-bounds access from the same malformed metadata. Compute the maximum valid lcns_follow from the already-validated restart table entry size and reject entries that exceed this bound. Reuse the existing t16/t32 scratch variables already declared in log_replay() to avoid introducing new declarations. [almaz.alexandrovich@paragon-software.com: fixed the conflicts] 2026-07-27 7.8 CVE-2026-64533 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix stack OOB write when prepending the Flags AD eir_create_adv_data() builds the advertising data into a fixed-size buffer ("size", 31 for the legacy path). It may prepend a 3-byte "Flags" AD structure (LE_AD_NO_BREDR on an LE-only controller) and then copies the per-instance data without checking that it still fits: memcpy(ptr, adv- >adv_data, adv- >adv_data_len); tlv_data_max_len() only reserves those 3 bytes when the user-supplied flags carry a managed-flags bit, so an instance added with flags == 0 is accepted with adv_data_len up to the full buffer. At advertise time the flags are still prepended, and the memcpy() writes 3 + adv_data_len bytes into the size-byte buffer: BUG: KASAN: stack-out-of-bounds in eir_create_adv_data (net/bluetooth/eir.c:301) Write of size 31 at addr ffff88800a547bdc by task kworker/u9:0/65 Workqueue: hci0 hci_cmd_sync_work __asan_memcpy (mm/kasan/shadow.c:106) eir_create_adv_data (net/bluetooth/eir.c:301) hci_update_adv_data_sync (net/bluetooth/hci_sync.c:1310) hci_schedule_adv_instance_sync (net/bluetooth/hci_sync.c:1817) hci_cmd_sync_work (net/bluetooth/hci_sync.c:332) This frame has 1 object: [32, 64) 'cp' The "Flags" structure is added by the kernel, not requested by userspace, so only prepend it when it fits together with the instance advertising data; when there is no room for both, drop the flags rather than the user-provided data. Reachable by a local user with CAP_NET_ADMIN owning an LE-only controller on the legacy advertising path. 2026-07-27 7.8 CVE-2026-64539 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: tipc: fix use-after-free of the discoverer in tipc_disc_rcv() bearer_disable() frees b- >disc with tipc_disc_delete()'s plain kfree(), but tipc_disc_rcv() still dereferences b- >disc in RX softirq under rcu_read_lock() (tipc_udp_recv - > tipc_rcv - > tipc_disc_rcv). L2 bearers are safe thanks to the synchronize_net() in tipc_disable_l2_media(), but the UDP bearer defers that call to the cleanup_bearer() workqueue, so the discoverer is freed with no grace period: BUG: KASAN: slab-use-after-free in tipc_disc_rcv (net/tipc/discover.c:149) Read of size 8 at addr ffff88802348b728 by task poc_tipc/184 tipc_disc_rcv (net/tipc/discover.c:149) tipc_rcv (net/tipc/node.c:2126) tipc_udp_recv (net/tipc/udp_media.c:391) udp_rcv (net/ipv4/udp.c:2643) ip_local_deliver_finish (net/ipv4/ip_input.c:241) Freed by task 181: kfree (mm/slub.c:6565) bearer_disable (net/tipc/bearer.c:418) tipc_nl_bearer_disable (net/tipc/bearer.c:1001) The bearer is freed with kfree_rcu(); free the discoverer the same way. Add an rcu_head to struct tipc_discoverer and free it and its skb from an RCU callback. Because the RCU callback (tipc_disc_free_rcu) lives in module text, a call_rcu() that is still pending when the tipc module is unloaded would invoke a freed function. Add an rcu_barrier() to tipc_exit() after the bearer subsystem has been torn down, so all pending discoverer callbacks have run before the module text goes away. Reachable from an unprivileged user namespace: the TIPCv2 genl family is netnsok and its bearer commands have no GENL_ADMIN_PERM. Needs CONFIG_TIPC and CONFIG_TIPC_MEDIA_UDP. 2026-07-27 7.8 CVE-2026-64543 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: net, bpf: check master for NULL in xdp_master_redirect() xdp_master_redirect() dereferences the result of netdev_master_upper_dev_get_rcu() without a NULL check, but that helper returns NULL when the receiving device has no upper-master adjacency. The reach guard only checks netif_is_bond_slave(). On bond slave release bond_upper_dev_unlink() drops the upper-master adjacency before clearing IFF_SLAVE, so an XDP_TX reaching xdp_master_redirect() in that window still passes netif_is_bond_slave() while master is already NULL, and faults on master- >flags at offset 0xb0: BUG: kernel NULL pointer dereference, address: 00000000000000b0 RIP: 0010:xdp_master_redirect (net/core/filter.c:4432) Call Trace: xdp_master_redirect (net/core/filter.c:4432) bpf_prog_run_generic_xdp (include/net/xdp.h:700) do_xdp_generic (net/core/dev.c:5608) __netif_receive_skb_one_core (net/core/dev.c:6204) process_backlog (net/core/dev.c:6319) __napi_poll (net/core/dev.c:7729) net_rx_action (net/core/dev.c:7792) handle_softirqs (kernel/softirq.c:622) __dev_queue_xmit (include/linux/bottom_half.h:33) packet_sendmsg (net/packet/af_packet.c:3082) __sys_sendto (net/socket.c:2252) Kernel panic - not syncing: Fatal exception in interrupt The missing check dates back to the original code; commit 1921f91298d1 ("net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master") later added the master- >flags read where the fault now lands but kept the unconditional deref. Check master for NULL before use; a NULL master is treated the same as one that is not up. 2026-07-27 7.5 CVE-2026-64545 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: drm/edid: fix OOB read in drm_parse_tiled_block() drm_parse_tiled_block() casts the DisplayID block to a struct displayid_tiled_block and reads the full fixed layout up to tile- >topology_id[7] without checking block- >num_bytes. The DisplayID iterator only validates the declared payload length, so a crafted EDID can advertise a tiled-display block (tag DATA_BLOCK_TILED_DISPLAY, or DATA_BLOCK_2_TILED_DISPLAY_TOPOLOGY for v2.0) with a small num_bytes at the end of a DisplayID extension. The read then runs past the end of the exact-sized kmemdup()'d EDID allocation, a heap out-of-bounds read. Reject blocks shorter than the spec's 22-byte tiled payload before reading the fixed struct, as drm_parse_vesa_mso_data() already does. BUG: KASAN: slab-out-of-bounds in drm_edid_connector_update Read of size 2 at addr ffff888010077700 by task exploit/147 dump_stack_lvl (lib/dump_stack.c:94 ...) print_report (mm/kasan/report.c:378 ...) kasan_report (mm/kasan/report.c:595) drm_edid_connector_update (drivers/gpu/drm/drm_edid.c:7581) bochs_connector_helper_get_modes (drivers/gpu/drm/tiny/bochs.c:574) drm_helper_probe_single_connector_modes (drivers/gpu/drm/drm_probe_helper.c:426) status_store (drivers/gpu/drm/drm_sysfs.c:219) ... vfs_write (fs/read_write.c:595 fs/read_write.c:688) ksys_write (fs/read_write.c:740) 2026-07-27 7.1 CVE-2026-64546 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: validate MAP frame length before ingress parsing When ingress deaggregation is disabled, rmnet_map_ingress_handler() passes the skb straight to __rmnet_map_ingress_handler(), skipping the length validation that rmnet_map_deaggregate() performs on the aggregated path. The parser then dereferences the MAP header and csum header/trailer based on the on-wire pkt_len without checking skb- >len, so a short frame is read out of bounds: BUG: KASAN: slab-out-of-bounds in rmnet_map_checksum_downlink_packet Read of size 1 at addr ffff88801118ed00 by task exploit/147 Call Trace: ... rmnet_map_checksum_downlink_packet (drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c:413) __rmnet_map_ingress_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:96) rmnet_rx_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:129) __netif_receive_skb_core.constprop.0 (net/core/dev.c:6089) netif_receive_skb (net/core/dev.c:6460) tun_get_user (drivers/net/tun.c:1955) tun_chr_write_iter (drivers/net/tun.c:2001) vfs_write (fs/read_write.c:688) ksys_write (fs/read_write.c:740) do_syscall_64 (arch/x86/entry/syscall_64.c:94) ... Factor that validation out of rmnet_map_deaggregate() into rmnet_map_validate_packet_len() and run it on the no-aggregation path too. The MAP header is bounds-checked first, since this path can receive a frame shorter than the header. 2026-07-27 7.3 CVE-2026-64550 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: perf/core: Detach event groups during remove_on_exec perf_event_remove_on_exec() removes events by calling perf_event_exit_event(). For top-level events, this removes the event from the context with DETACH_EXIT only. This can leave inconsistent group state when a removed event is a group leader and the group contains siblings without remove_on_exec. If the group was active, the surviving siblings can remain active and attached to the removed leader's sibling list, but are no longer represented by a valid group leader on the PMU context active lists. A later close of the removed leader uses DETACH_GROUP and can promote the still-active siblings from this stale group state. The next schedule-in can then add an already-linked active_list entry again, corrupting the PMU context active list. With DEBUG_LIST enabled, this is caught as a list_add double-add in merge_sched_in(). Fix this by detaching group relationships when remove_on_exec removes an event. This preserves the existing task-exit and revoke behavior, while ensuring surviving siblings are ungrouped before the removed event leaves the context. 2026-07-29 7.8 CVE-2026-64556 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in pkey_pckmo handler implementation Explicitly check the length of the target buffer in the pkey_pckmo implementation of the key_to_protkey() handler function. The handler function fails, if the generated output data exceeds the length of the provided target buffer. 2026-07-29 7.8 CVE-2026-64558 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in PKEY_VERIFYPROTK ioctl Explicitly check the buffer length request structure provided by user-space and fail, if it exceeds the buffer size. 2026-07-29 7.8 CVE-2026-64559 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by non-leader exec() race Wongi and Jungwoo decoded and reported a non-leader exec() related race which can result in an UAF: sys_timer_delete() exec() posix_cpu_timer_del() // Observes old leader p = pid_task(pid, pid_type); de_thread() switch_leader(); release_task(old_leader) __exit_signal(old_leader) sighand = lock(old_leader, sighand); posix_cpu_timers*_exit(); sighand = lock_task_sighand(p) unhash_task(old_leader); sh = lock(p, sighand) old_leader- >sighand = NULL; unlock(sighand); (p- >sighand == NULL) unlock(sh) return NULL; // Returns without action if(!sighand) return 0; free_posix_timer(); This is "harmless" unless the deleted timer was armed and enqueued in p- >signal because on exec() a TGID targeted timer is inherited. As sys_timer_delete() freed the underlying posix timer object run_posix_cpu_timers() or any timerqueue related add/delete operations on other timers will access the freed object's timerqueue node, which results in an UAF. There is a similar problem vs. posix_cpu_timer_set(). For regular posix timers it just transiently returns -ESRCH to user space, but for the use case in do_cpu_nanosleep() it's the same UAF just that the k_itimer is allocated on the stack. Also posix_cpu_timer_rearm() fails to rearm the timer, which means it stops to expire. While debating solutions Frederic pointed out another problem: posix_cpu_timer_del(tmr) __exit_signal(p) posix_cpu_timers*_exit(p); unhash_task(p); p- >sighand = NULL; sh = lock_task_sighand(p) sighand = p- >sighand; if (!sighand) return NULL; lock(sighand); if (!sh) WARN_ON_ONCE(timer_queued(tmr)); On weakly ordered architectures it is not guaranteed that posix_cpu_timer_del() will observe the stores in posix_cpu_timers*_exit() when p- >sighand is observed as NULL, which means the WARN() can be a false positive. Solve these issues by: 1) Changing the store in __exit_signal() to smp_store_release(). 2) Adding a smp_acquire__after_ctrl_dep() into the !sighand path of lock_task_sighand(). 3) Creating a helper function for looking up the task and locking sighand which does not return when sighand == NULL. Instead it retries the task lookup and only if that fails it gives up. 4) Using that helper in the three affected functions. #1/#2 ensures that the reader side which observes sighand == NULL also observes all preceeding stores, i.e. the stores in posix_cpu_timers*_exit() and the ones in unhash_task(). #3 ensures that the above described non-leader exec() situation is handled gracefully. When the task lookup returns the old leader, but sighand == NULL then it retries. In the non-leader exec() case the subsequent task lookup will observe the new leader due to #1/#2. In normal exit() scenarios the subsequent lookup fails. When the task lookup fails, the function also checks whether the timer is still enqueued and issues a warning if that's the case. Unfortunately there is nothing which can be done about it, but as the task is already not longer visible the timer should not be accessed anymore. This check also requires memory ordering, which is not provided when the first lookup fails. To achieve that the check is preceeded by a smp_rmb() which pairs with the smp_wmb() in write_seqlock() in __exit_signal(). That ensures that the stores in posix_cpu_timers*_exit() are visible. The history of the non-leader exec() issue goes back to the early days of posix CPU timers, which stored a pointer to the group leader task in the timer. That obviously fails when a non-leader exec() switches the leader. commit e0a70217107e ("posix-cpu-timers: workaround to suppress the problems with mt exec") added a temporary workaround for that in 2010 which surv ---truncated--- 2026-07-29 7.8 CVE-2026-64560 litestar-org--litestar Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie being excluded from automatic escaping by the template engine when configured inline with documentation recommendations. This issue has been patched in version 2.20.0. 2026-07-28 8.1 CVE-2026-48060 magepeopleteam--Booking and Rental Manager Unauthenticated Other Vulnerability Type in Booking and Rental Manager by(), so Laravel derived a constant cache key (md5('authentication')) shared by every request. An unauthenticated attacker sending roughly ten requests per minute from a single IP, most cheaply against the checkpoint endpoint (which has no reCAPTCHA), exhausts the shared counter and causes HTTP 429 for every user attempting to log in or complete two-factor authentication, a panel-wide authentication denial of service that also locks out administrators. This issue is fixed in version 1.13.0. 2026-07-28 7.5 CVE-2026-61609 pterodactyl--wings Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, {{config.}} placeholders in egg configuration-file templates allow a low-privileged user to read {{config.token}}, {{config.token_id}}, and {{config.docker.registries}} from the full daemon configuration. This issue is fixed in version 1.12.3. 2026-07-31 9.9 CVE-2026-52855 pterodactyl--wings Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a malformed packet received during the SFTP connection handshake causes a Go panic. This issue is fixed in version 1.13.0. 2026-07-31 7.5 CVE-2026-52856 QuantumCloud--Simple Link Directory Pro Unauthenticated Server Side Request Forgery (SSRF) in Simple Link Directory Pro 'post'`, any author-level user who has authored a `wwp_requests` post - such as one created via the wholesale registration form - can access this nonce and submit the role-assignment request. 2026-07-29 8.8 CVE-2026-12144 savonrb--savon Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all_operations interpolates attacker-controlled WSDL operation names into Ruby source passed to module_eval, allowing Ruby code execution in the application process. This issue is fixed in version 2.17.2. 2026-07-31 8.1 CVE-2026-53510 Sender--Sender Newsletter, SMS and Email Marketing Automation for WooCommerce Administrator SQL Injection in Sender - Newsletter, SMS and Email Marketing Automation for WooCommerce subscribe() callback after it had already called params- >notify(conn, params, NULL, 0). Per the public GATT API, a notify callback with NULL data is the documented signal that the subscription has terminated and the bt_gatt_subscribe_params struct may be freed or reused by the application; calling subscribe() on the struct afterwards is a use-after-free, including an indirect call through the freed params- >subscribe function pointer. The error branch is remotely (adjacent) reachable: a Zephyr device acting as a GATT client that calls bt_gatt_subscribe() can be driven into this ordering when a connected GATT server peer answers the CCC write with an ATT Error Response (the peer-supplied error code flows through att_error_rsp - > att_handle_rsp into gatt_write_ccc_rsp). For applications that free or recycle subscription parameters in their notification-termination handler, this results in memory corruption, a crash (denial of service), or potentially attacker-influenced control flow. The fix reorders the handler so the subscribe() callback runs before the terminating notify(NULL) in both the error and unsubscribe paths. 2026-07-31 7.6 CVE-2026-10685 zephyrproject--zephyr The OCPP 1.6 client in subsys/net/lib/ocpp parsed inbound WAMP RPC frames in parse_rpc_msg() (subsys/net/lib/ocpp/ocpp_j.c) using a hand-rolled helper, extract_string_field(), that copied the message's uid and action fields with strncpy(out_buf, token + 1, outlen - 1) and then scanned the result with strchr(out_buf, '"'). Because strncpy does not NUL-terminate the destination when the source is at least outlen - 1 (127) bytes long, the subsequent strchr reads past the 128-byte destination buffer into adjacent stack memory; if a " byte is found beyond the buffer, a one-byte out-of-bounds NUL write also occurs. A related defect in extract_payload() runs strchr/strrchr over the receive buffer, which may not be NUL-terminated when a maximal-length frame fills it. The parsed bytes come directly from the OCPP central-system server over a websocket: the reader thread fills recv_buf via websocket_recv_msg() and calls parse_rpc_msg() on each inbound DATA frame (subsys/net/lib/ocpp/ocpp.c). A malicious or compromised central server, or an on-path attacker (OCPP is commonly deployed over plain ws://), can send an RPC frame whose uid or action field is 127+ bytes with no closing quote, triggering the out-of-bounds access. The primary impact is a remotely triggerable denial of service: the unbounded scan can fault on an unmapped page, and the stray NUL write can corrupt adjacent stack state. The over-read data is not reflected to the peer, so disclosure is limited. The feature is EXPERIMENTAL and must be explicitly enabled (CONFIG_OCPP). The fix replaces the manual parser with the bounds-respecting json_mixed_arr_parse() and copies the extracted uid with an explicitly NUL-terminated buffer, eliminating both over-reads. 2026-08-02 7 CVE-2026-10848 zip-lib--zip-lib Versions of the package zip-lib before 1.1.0 are vulnerable to Directory Traversal via the caching mechanism for path validation during the extraction process. An attacker can bypass security checks designed to prevent directory traversal. The intended security function, isOutsideTargetFolder, only checks and caches the path status when the initial directory symlink is created during the first extraction. 2026-07-28 7.5 CVE-2026-17524 Back to top Medium Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info 100plugins--Open User Map Contributor Cross Site Scripting (XSS) in Open User Map prepare() or any integer casting. Additionally, the nonce verification check is performed after the SQL query has already executed, providing no protection against the injection. This makes it possible for authenticated attackers with subscriber-level access and above to inject arbitrary SQL commands, potentially leading to unauthorized extraction of sensitive database contents including user credentials and configuration data. 2026-07-28 6.5 CVE-2026-6251 chrisvrichardson--MapPress Maps for WordPress Unauthenticated Sensitive Data Exposure in MapPress Maps for WordPress prepare(). The wp_unslash() call explicitly removes the backslash escaping that WordPress's wp_magic_quotes() adds to all $_POST data, neutralizing the only layer of SQL injection protection. The sanitize_text_field() function applied afterward offers no SQL protection. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries to the existing query. 2026-08-01 6.5 CVE-2026-6453 CyberTimon--RapidRAW RapidRAW before 1.6.0 does not validate the lutPath field in preset files before passing it to File::open() in lut_processing.rs. On Windows, a UNC path in lutPath causes an outbound SMB connection to an attacker-controlled host, leaking the victim's NTLMv2 credentials. The vulnerable code path is reachable through two vectors: community presets fetched automatically from the remote preset repository when the victim opens the Community tab, and individual preset files imported directly by the victim via the preset import feature (handle_import_presets_from_file in file_management.rs). The second vector does not require control of the community preset repository and is triggered when a user imports a preset file shared through Discord, forums, or similar channels. 2026-07-30 6.5 CVE-2026-64816 DaveGamble--cJSON cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSON_Compare(). When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested document of a few hundred bytes (depth around 40) compared for equality consumes hours of CPU, and the cost roughly doubles with each additional level of nesting. An application that calls cJSON_Compare() on attacker-influenced JSON that is structurally equal to a reference document is exposed to a denial-of-service condition. 2026-07-29 5.9 CVE-2026-67216 DaveGamble--cJSON cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in apply_patch() in cJSON_Utils.c. For a replace operation that is missing its value member, or a move operation whose destination path cannot be resolved, the existing target member is detached and deleted before the operation is fully validated, so the target document is mutated while cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() returns a failure status. An attacker who can supply the patch document can destroy addressable members of the target document even though the API reports that the patch failed, defeating the all-or-nothing behavior callers rely on to reject bad patches. 2026-07-29 5.3 CVE-2026-67217 davejesch--Database Collation Fix The Database Collation Fix plugin for WordPress is vulnerable to time-based SQL Injection via the 'force-collation-algorithm' parameter in all versions up to, and including, 1.2.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires a trigger.txt file to be present in the plugin's directory (/wp-content/plugins/database-collation-fix/trigger.txt), a condition created by DesktopServer integration events such as site creation, copy, import, move, export, or deploy. 2026-08-01 5.3 CVE-2026-15018 decidim--decidim Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the normal download_your_data flow requires the requester to be logged in as the export owner, but the resulting Active Storage blob redirect URL can be replayed without authentication by anyone who obtains it. This is because Decidim::DownloadYourDataController#download_file authenticates the export owner but redirects to a signed Active Storage blob URL that is no longer bound to the owner session. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2. 2026-07-31 6.5 CVE-2026-45377 decidim--decidim Decidim is a participatory democracy framework. From 0.31.1 before 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, a participant can directly load /admin/demographics/questions/edit_questions and reach the demographics questionnaire editor without the required administrator authorization. The demographics questionnaire editor should require admin access, but the route under /admin/demographics/questions renders the editor interface without checking whether the caller is an admin. A normal participant can load the page and see the live update form action, which proves the protected interface is reachable. This issue is fixed in versions 0.31.5 and 0.32.0.rc2. 2026-07-31 5.4 CVE-2026-45086 decidim--decidim Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the GET /admin/organization/users search interpolates params[:term] into raw Arel.sql ORDER BY similarity expressions before sanitization, allowing an authenticated organization administrator to execute blind PostgreSQL expressions and infer data through timing differences. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2. 2026-07-31 5.5 CVE-2026-45376 decidim--decidim Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verification admin controllers load pending Authorization records by raw identifier without confirming current_organization ownership, allowing an administrator from one tenant to view, approve, or reject another tenant's ID-document request. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2. 2026-07-31 4.9 CVE-2026-45330 deveasel--Demi One Click Demo Import, Backup & Site Migration The Demi - One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Copy in all versions up to, and including, 0.0.8 via the handle_restore_step function. This is due to missing HTTP access controls on the wp-content/uploads/demi-backup-state/ directory, which exposes the cryptographic restore key used to both authenticate the unauthenticated AJAX handler and forge signed restore-state envelopes. This makes it possible for unauthenticated attackers to copy arbitrary files to attacker-controlled destinations on the server. An active restore operation must have been initiated, which writes the .restore_key and .restore_step_token files to the public upload directory, before the exposed secrets can be harvested and chained to achieve unauthenticated arbitrary file copy. 2026-07-28 5.3 CVE-2026-15012 devitemsllc--ShopLentor All-in-One WooCommerce Growth & Store Enhancement Plugin The ShopLentor - All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.5 via the 'optionSection' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to read arbitrary wp_options rows - including internal plugin news feed data, WooCommerce block pattern transients, and third-party configuration records - whose values are stored as arrays-of-arrays containing 'title' keys, enabling cross-plugin data leakage. 2026-07-28 4.3 CVE-2026-16797 devitemsllc--ShopLentor All-in-One WooCommerce Growth & Store Enhancement Plugin The ShopLentor - All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. 2026-07-28 4.9 CVE-2026-16811 dfir-iris--iris-web The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks. 2026-07-30 5.9 CVE-2026-16971 dfir-iris--iris-web The IRIS web application in version 2.4.26 and possibly others does not protect its user authentication against brute-force attacks. 2026-07-30 5.9 CVE-2026-18362 dfir-iris--iris-web The IRIS web application in version 2.4.26 and possibly others contains a logout functionality which is ineffective. Stolen session cookies can therefore be misused for a long time. 2026-07-30 4.2 CVE-2026-16970 dotonpaper--Pinpoint Booking System Version 2 The Pinpoint Booking System - Version 2 plugin for WordPress is vulnerable to blind SQL Injection via the 'field' parameter in all versions up to, and including, 2.9.9.6.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The nonce required to reach the vulnerable endpoint is emitted on all plugin admin pages loaded under manage_options, making it trivially obtainable by any authenticated administrator. 2026-08-01 4.9 CVE-2026-15403 drakkan--SFTPGo SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in a permitted directory that point to files in directories where download, upload, or overwrite permissions are denied. Attackers can exploit the create_symlinks permission combined with read and write access in one directory to read or modify files in restricted directories, as operations are authorized against the link's directory permissions rather than the dereferenced target's directory permissions. 2026-07-30 4.2 CVE-2026-10031 edge22--GenerateBlocks The GenerateBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Dynamic Tag Injection in HTML Attributes in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A Contributor-level attacker can store the malicious payload by placing a dynamic tag such as {{post_meta key:...}} in a non-URL HTML attribute (e.g., title, aria-label, alt, or data-* attributes) of a GenerateBlocks element block, then setting the corresponding unprotected post meta key via the Custom Fields metabox to a value containing a closing quote and an injected event-handler attribute. 2026-08-01 6.4 CVE-2026-13458 eLyiN--gemini-bridge gemini-bridge is a lightweight MCP server bridging AI agents to Google's Gemini AI via the official CLI. From 1.0.0 until 1.3.1, consult_gemini_with_files in inline mode read any file path supplied in the files argument without confining it to the working directory, then forwarded the contents to the Gemini CLI. Because the caller also controls query, the file contents are echoed back through the Gemini round-trip (and sent to Google), making this an arbitrary local file read. This issue is fixed in version 1.3.1. 2026-07-31 6.2 CVE-2026-54785 facturadorvirtual--Facturacin Electrnica Costa Rica The Facturación Electrónica Costa Rica plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on the (global scope, included by fvcr_admin_page_html) function. This makes it possible for unauthenticated attackers to modify the plugin's configuration, including API tokens, access tokens, economic activity, Hacienda environment mode, invoice and ticket emission flags, exchange rate, and branch settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. 2026-07-29 4.3 CVE-2026-9720 Flipper Code--WP Maps Insertion of Sensitive Information Into Sent Data vulnerability in Flipper Code WP Maps allows Retrieve Embedded Sensitive Data. This issue affects WP Maps: from n/a through 4.9.6. 2026-07-31 4.3 CVE-2026-28144 foomagoo--Plugin Organizer The Plugin Organizer plugin for WordPress is vulnerable to SQL Injection via the 'PO_plugin_path' parameter in versions up to, and including, 10.2.4. This is due to insufficient escaping on the user-supplied parameter in the perform_plugin_search() function, where esc_sql() output is passed as the replacement string to preg_replace(), which collapses backslash escapes and defeats the quoting protection; additionally, the AJAX handler lacks both nonce verification and capability checks. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. 2026-07-28 6.5 CVE-2026-15304 Franky--Events Made Easy Unauthenticated Broken Access Control in Events Made Easy prepare() format string, bypassing parameterization entirely. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. 2026-07-28 6.5 CVE-2026-15267 Themeisle--Feedzy Contributor Server Side Request Forgery (SSRF) in Feedzy

Read more »

Read This Before You Buy That TV Streaming Stick
Security experts have been sounding the alarm for years about the risks of using generic TV boxes that promise unlimited content streaming for a one-time fee, warning that they secretly rent the user's Internet connection out to strangers. But a groundbreaking new analysis finds these devices also routinely spoof themselves as mobile phones clicking ads on AI-generated websites as part of sprawling operation that seeks to defraud online merchants and advertising networks.

Read more »

LG to Ban Residential Proxies from Smart TV Apps
The home appliance giant LG Electronics USA said this week it plans to suspend any apps built for its smart TVs that turn one's television into an always-on residential proxy node. The move comes less than a month after researchers found that more than 42 percent of games and other apps available for download on LG's webOS store allow unknown third-parties to route their Internet traffic through a user's TV.

Read more »

Microsoft Patches a Record 570 Security Flaws
Microsoft Corp. today released software updates to plug at least 570 security holes in its Windows operating systems and other software, almost triple the number of vulnerabilities the software giant fixed in its record-smashing Patch Tuesday release last month. Microsoft attributed the burgeoning patch counts to vulnerability discoveries aided by artificial intelligence.

Read more »

Lessons Learned from CISA’s Recent GitHub Leak
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a postmortem on a data leak in which a contractor published dozens of internal CISA credentials -- including AWS Govcloud keys -- in a public GitHub repository for almost six months before being notified by KrebsOnSecurity. Experts say the gaps identified in the agency's initial response provide important lessons that all security teams should absorb.

Read more »

Felons, Fraudsters Flog Offensive Cybersecurity Startup
A cybersecurity startup dangling millions of dollars to acquire zero-day security vulnerabilities in popular software is run by a pair of far-right conspiracy theorists and convicted felons whose most recent ventures included fake intelligence companies and a now-defunct AI-based lobbying platform they operated under assumed names.

Read more »

FBI Seizes NetNut Proxy Platform, Popa Botnet
The Federal Bureau of Investigation (FBI) said today it worked with industry partners to seize hundreds of domains associated with NetNut, a sprawling residential proxy service operated by the publicly-traded Israeli company Alarum Technologies [NASDAQ: ALAR]. The action comes roughly two weeks after KrebsOnSecurity published findings from multiple security firms connecting NetNut to the Popa botnet, a collection of at least two million devices that have been compromised by malicious software with little or no consent from victims.

Read more »

Scattered Spider Hackers Plead Guilty on Day 1 of Trial
Two men pleaded guilty in the United Kingdom this week to criminal charges stemming from an August 2024 cyberattack that crippled Transport for London, the entity responsible for the public transport network in the Greater London area. The duo were key members of a prolific cybercrime group known as Scattered Spider, and their guilty pleas came on the first day of what was expected to be a six-week trial.

Read more »

Today Only: B&H Takes $650 Off 16″ M5 Pro MacBook Pro with 48GB RAM
B&H has a particularly strong deal today on Apple's 16-inch M5 Pro MacBook Pro, dropping the Space Black model with 48GB RAM, a 1TB SSD, and Nano-Texture display to just $3099. That's a substantial $650 savings off its regular $3749 price. This is an unusually well-equipped configuration for the price, combining the 18-Core M5 Pro processor and 20-Core GPU with 48GB of unified memory and Apple's optional Nano-Texture display. Check the deal at B&H. This is a one-day deal scheduled to expire tonight at 11:59PM ET, so there's a fairly short window to take advantage of the $650 savings. B&H is also offering free shipping on the MacBook Pro. For the latest prices and deals across the lineup, see our 16" MacBook Pro Price Tracker, updated daily.

Read more »

Week’s Best Deals: $400-$500 Off 16-Inch M5 Max MacBook Pros
Amazon continues to offer substantial discounts on both standard 16-inch M5 Max MacBook Pro configurations. The 36GB/2TB model is currently $400 below Apple's MSRP, while the higher-end 48GB/2TB version is discounted by $500. The larger $500 discount applies to the flagship 48GB/2TB configuration, while the 36GB/2TB model is currently available at a $400 savings. Both discounts represent some of the lowest prices currently available on these professional-grade MacBook Pro configurations. Amazon is also offering fast shipping on available inventory, making this an attractive opportunity for buyers who have been waiting for lower pricing on Apple's most powerful notebook models. For the latest prices and availability, visit our 16" MacBook Pro Price Tracker, updated daily.

Read more »

Week’s Best AirPods Deals: AirPods Pro 3 $60 off, AirPods Max 2 $120 off at Amazon
Amazon's latest sales this week are delivering good AirPods prices, with discounts available across Apple's entire AirPods lineup. AirPods 4 are currently $99, AirPods 4 with ANC are $134.99, AirPods Pro 3 have dropped to $189, and AirPods Max 2 are now $429. Shop Amazon's AirPods deals here. The biggest discounts are available on AirPods Pro 3 and AirPods Max 2, which are currently selling for $60 and $120 below Apple's MSRP, respectively.Note that pricing can change quickly. For the latest sales and deals, see our AirPods Price Tracker, updated daily.

Read more »

Updated MacBook Price Trackers
Our Apple award-winning MacBook Price Trackers are continually updated with the latest information on prices, bundles, and availability for the new MacBook Neo, 16" and 14" M5, M5 Pro, & M5 Max MacBook Pros, along with 13" and 15" M5 MacBook Airs from Apple's authorized online retailers. We include prices for open-box MacBooks that might be available as well. Current sales range up to $150+ off MSRP for new MacBook Airs and $500+ off MacBook Pros: - 16" MacBook Pros - 14" MacBook Pros - 15" MacBook Airs - 13" MacBook Airs - MacBook Neos

Read more »

Red Pocket Offers $150 Off iPhone 17 Plus 50% Off Wireless Plans for Back-to-School
Red Pocket Mobile has launched several back-to-school deals, including a $150 rebate on the iPhone 17 and other eligible new iPhones, plus 50% off the first month of select monthly wireless plans. New customers can get 20GB of high-speed data for $20 or the 50GB Premium plan for $30 for their first month. Unlike most discount wireless providers, Red Pocket also lets you choose service using the AT&T, T-Mobile, or Verizon networks. Shop Red Pocket Mobile's latest deals See the latest iPhone prices and wireless deals on our iPhone Price Tracker.

Read more »

Best 13″ MacBook Air Deal Today: Amazon Takes $150 Off M5 Model With 24GB RAM
Amazon has one of the best deals available today on a 13-inch M5 MacBook Air, with this 24GB Sky Blue model currently selling for $150 below Apple's MSRP ($1649). Check the current sale price at Amazon. The discount makes this a particularly attractive option for anyone shopping for a new 13-inch MacBook Air, especially with Amazon also offering fast shipping on available inventory. For the latest prices and deals across the lineup, see our 13" MacBook Air Price Tracker, updated daily.

Read more »

Amazon Cuts Up to $500 Off 14-Inch M5 Pro MacBook Pro Models
Amazon is offering substantial discounts on Apple's 14-inch M5 Pro MacBook Pro lineup, with savings now reaching as much as $500 off Apple's MSRP. The 15-Core M5 Pro with 24GB RAM and a 1TB SSD is available for as low as $2346, while the 24GB/2TB version has dropped to just $2499 — a full $500 below Apple's $2999 MSRP. The higher-performance 18-Core M5 Pro with 24GB RAM and a 2TB SSD is also on sale for $2899, saving $300 compared to Apple's $3199 price. Shop the 24GB/1TB model, the 15-Core 24GB/2TB model, or the 18-Core 24GB/2TB model at Amazon. The $500 discount on the 15-Core 24GB/2TB model is particularly strong, giving buyers twice the SSD storage for the same $2499 price Apple charges for its standard 24GB/1TB configuration. Amazon is also offering fast shipping on available inventory. For the latest prices, availability, and deals, visit our 14" MacBook Pro Price Tracker, updated daily.

Read more »

iPads continue to be on sale for $50 off Apple’s MSRP, prices start at $399
Amazon continues to have 11th-generation A16 WiFi iPads in stock on sale for $50 off MSRP, starting at $399. Shipping is free: - 11" 11th-generation 128GB WiFi iPads: $399 $50 off MSRP - 11" 11th-generation 256GB WiFi iPads: $499 $50 off MSRP - 11" 11th-generation 512GB WiFi iPads: $699 $50 off MSRP Amazon's prices are the lowest iPads prices currently available for 11th-generation models. For the latest prices & deals, keep an eye on our iPad Price Tracker, updated daily.

Read more »

These Excellent iPhone 17e Deals Are Still Available at Total Wireless and Metro
Total Wireless and Metro by T-Mobile are still offering two of the better iPhone 17e promotions available today. One focuses on $0/month financing, while the other delivers one of the lowest upfront prices you'll find without a trade-in. See Total Wireless iPhone Deals See Metro by T-Mobile iPhone Deals For the latest prices from all major wireless carriers, see our iPhone Price Tracker.

Read more »

Select Apple Watch Ultra 3 models on sale for $100 off MSRP, now $699
Amazon is now offering the Apple Watch Ultra 3 for $699, a $100 discount from Apple’s $799 MSRP and the lowest price currently available among major Apple retailers. This is a solid opportunity for buyers who were waiting for a price drop. The Ultra line is designed for durability, long battery life, and advanced fitness and outdoor features, making it a strong option for more active users. View the deal here at Amazon, and compare all Apple Watch prices on our Apple Watch Price Tracker, updated daily.

Read more »

Amazon Continues $400-$500 Off 16-Inch M5 Max MacBook Pro Models, Lowest Prices Available
Amazon continues to offer substantial discounts on both standard 16-inch M5 Max MacBook Pro configurations. The 36GB/2TB model is currently $400 below Apple's MSRP, while the higher-end 48GB/2TB version is discounted by $500. The larger $500 discount applies to the flagship 48GB/2TB configuration, while the 36GB/2TB model is currently available at a $400 savings. Both discounts represent some of the lowest prices currently available on these professional-grade MacBook Pro configurations. Amazon is also offering fast shipping on available inventory, making this an attractive opportunity for buyers who have been waiting for lower pricing on Apple's most powerful notebook models. For the latest prices and availability, visit our 16" MacBook Pro Price Tracker, updated daily.

Read more »

Sunday Sale: Amazon Cuts $500 Off 14-Inch M5 Max MacBook Pro with 36GB RAM and 2TB SSD
Amazon has discounted Apple's 14-inch MacBook Pro with an M5 Max chip, 36GB of unified memory, and a 2TB SSD by $500. The configuration is currently available below Apple's MSRP, making it one of the better values we've found on the high-end 14-inch MacBook Pro lineup. Shop the deal at Amazon. The M5 Max version is designed for demanding professional workloads, including video editing, software development, AI projects, 3D rendering, and other graphics-intensive applications. With 36GB of unified memory and a spacious 2TB SSD, it also offers plenty of room for large files and creative projects. Amazon is also offering fast shipping on available inventory, making this a good opportunity to save on one of Apple's most powerful 14-inch notebooks while the discount remains available. For the latest MacBook Pro prices, availability, and deals, visit our 14" MacBook Pro Price Tracker, updated daily.

Read more »