News

Apple renews ‘Knife Edge: Chasing Michelin Stars’ for a second season

Apple TV has announced an eight-part second season for acclaimed, BAFTA Award-nominated docuseries “Knife Edge: Chasing Michelin Stars.” It comes from world-famous chef, restaurateur, author and executive producer Gordon Ramsay (“Next Level Chef,” “Ramsay’s Kitchen...

Kansas City Public Schools transitioning to an ‘all-Apple district’

Kansas City Public Schools has announced that it’s transitioning to an “all-Apple district.” Over time, it will replace more than 30,000 Windows PC and Chromebooks with “more secure, durable, and reliable Apple devices,” said KCPS Chief Technology Officer Scott Jones....

More MacTech News

Opinion

Analyst predicts features of the iPhone 17, iPhone 18, and iPhone 19

Talk about a powerful crystal ball! In a new Medium post, analyst Ming-Chi Kuo offers his predictions for the iPhone 17, iPhone 18, and iPhone 19 that will likely arrive in 2025, 2026, and 2027. He says the high-end iPhone 17 model is expected to feature an upgraded...

More Opinion

Scanners

Thursday May 21
24 minutes ago
Brye song that hit 100M streams was produced in GarageBand on school iPad | 9 to 5 Mac
Brye song that hit 100M streams was produced in GarageBand on school iPad
Indie singer-songwriter Brye has shared a TikTok video revealing that her song Lemons – that notched up 100M streams – was produced in GarageBand on a school iPad with a cheap plug-in mic. The pop singer, whose full name is Bryanna Noelle Sebring, says her experience demonstrates that you don’t need fancy equipment in order to achieve a music hit – and echoes the promise made by Steve Jobs when launching the app for the Mac back in 2004 … more…
Read more »
48 minutes ago
These $13 earbuds are exactly what your iPhone 17 Pro needs | Macworld
These $13 earbuds are exactly what your iPhone 17 Pro needs
Macworld Jelanry USB-C Earphones View Deal (function () { document.querySelector("#sticky-promo-block a").addEventListener("click", function(e) { const debug = document.location.host.search(/lndo.site|go-vip.net/) !== -1; const text = this.closest("#sticky-promo-block").querySelector("p.promo-title").textContent; const data = { event: "stickyConversionUnitClick", eventCategory: "Sticky Conversion", eventAction: "Click", eventLabel: text }; if(debug)console.log("Sticky Conversion CLick - pushing to dataLayer: ", data); dataLayer.push(data); return true; }); })(); Apple isn’t usually a big fan of bright and fun colors for its iPhones, which is why Cosmic Orange is such a hit. And if you’re like us and instantly grabbed the iPhone 17 Pro in Cosmic Orange, then we’ve got the perfect accessory for you. These wired earbuds have an old-school vibe with a Cosmic Orange flair and only cost $12.55 after applying the 10 percent coupon at Amazon. The Cosmic Orange color is likely to be discontinued this year, but the abnormally bright shade has already secured its place as one of the best iPhone colors ever made. So until Apple makes a pair of orange AirPods, these USB-C headphones are the next best thing. They’re fun and bright, and, since they’re wired, you won’t be able to lose them. Even better, the buds have a little magnet on them so they clasp together around your neck when you’re not using them. Oh, and you’ll even get a mini portable storage case for them, so you won’t even have to worry about them getting tangled up in knots when shoving them into your pocket. If you’re old enough to remember the good old days of wired headphones, then you’ll be happy to hear that these come with a built-in mic so you can take calls, as well as on-wire music and call controls. Classic. Just like Cosmic Orange.
Read more »
1 hour ago
OLED MacBook Pro screens on-track amid talk of delayed launch | 9 to 5 Mac
OLED MacBook Pro screens on-track amid talk of delayed launch
We’ve long been expecting a major redesign of the MacBook Pro this year, with an OLED screen one of the key features. However, a Bloomberg report last month suggested that the launch might be delayed into early next year. We still don’t have any clarity on that, but a new supply chain report does seem to suggest that Apple’s manufacturing partners are now gearing up for production … more…
Read more »
1 hour ago
Today in Apple history: Apple’s ‘Get a Mac’ campaign comes to an end | Cult of Mac
Today in Apple history: Apple’s ‘Get a Mac’ campaign comes to an end
On May 21, 2010, Apple quietly ended its award-winning "Get a Mac" ad campaign starring Justin Long as a Mac and John Hodgman as a PC. (via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)
Read more »
1 hour ago
OLED MacBook Pro screens on schedule after manufacturing difficulties | AppleInsider
OLED MacBook Pro screens on schedule after manufacturing difficulties
A new supply chain report says that Samsung Display is now able to mass produce the complex screens for the forthcoming OLED MacBook Pro, and should start shipping to Apple soon.The display of the current-gen M5 MacBook ProThe long-rumored MacBook Pro with a higher quality display based on twin-stack OLED technology (what Apple refers to as tandem OLED) has recently been said to be delayed from late 2026 to early 2027. But that was because of the global chip shortage, and reportedly there were now also difficulties with mass producing the screen.According to The Elec, those problems were specifically because of the complexity of manufacturing a large, 14-inch or 16-inch OLED display. But the difficulties have reportedly been surmounted, to the extent that Samsung Display is currently seeing yields of over 90%. Rumor Score: 🤯 Likely Continue Reading on AppleInsider | Discuss on our Forums
Read more »
11:06 am
Busting the Apple Tax myth, once and for all | Macworld
Busting the Apple Tax myth, once and for all
Macworld When Apple launched the $599 MacBook Neo, there were pained cries of disbelief from the tech media and the general public alike. “B-b-but Apple is for gullible suckers with too much money!” they exclaimed. “Its products are overpriced! Out of touch! Won’t somebody please think of the Apple Tax?” But to more astute Apple watchers, the MacBook Neo was just the latest in a long line of reasonably priced devices from the Cupertino marquee. And while the tides of affordability have ebbed and flowed over the years, a vein of fair pricing and premium quality has run through Apple’s lineup from start to finish. If you’ve been paying attention, the idea that Apple can put out a remarkably good laptop for $600 should not feel at all unusual. In fact, that kind of value for money is everywhere you look in the Apple Store. It’s something that can be traced right back to Apple’s foundation, flowing through its DNA despite the shifting sands of the tech industry. And you can bet it’s here to stay. The MacBook Neo’s incredible value When initial reports surfaced that Apple was working on a secret low-cost laptop that would run on a mobile chip, many were quick to pooh-pooh the idea. A mobile chip? In a laptop computer? Don’t those Apple sheeple realize they’ll be throttled within seconds of booting up that overpriced garbage? Of course, we all know that nothing of the sort is happening with the MacBook Neo. That comes down to two big factors. The first is that anyone paying $600 for a laptop has modest needs. If you’re interested in a laptop in that sort of price range, you’re not after something that can crunch enormous datasets or chew through 4K gaming at 120fps. Checking your email, browsing the web, listening to music–these are the sorts of simple tasks that a laptop like this is built for. When that’s what you are up to, throttling is less of a concern. The other, more pertinent, factor is the Apple silicon that powers the MacBook Neo. Unlike many products in the PC or Android space, Apple’s mobile chips and desktop chips run on the same architecture. The A-series chips that power the iPhone are essentially the little siblings of the M-series chips in the Mac. The chips outfitted in an Apple laptop are not gimped in any way. Add to that the fact that Apple’s mobile chips are the best in the industry–it’s not even close–and the idea that an A-series laptop is underpowered is well and truly destroyed. Even the tasks that the iPhone 17 Pro Max was designed to handle struggle to slow down its A19 Pro. Do you really think any MacBook Neo customer is going to test the chip’s limits when they draw up that simple Pages document? Worried about a mobile processor in a laptop? You don’t need to be if it’s a MacBook.Foundry But it’s not just the phenomenal power for the price that makes the MacBook Neo such a great bargain; there’s also the build quality. Start sniffing around the lower end of the laptop market, and you’re confronted with a sea of tacky plastic chassis, flimsy, wobbly keyboards, and small, uncomfortable trackpads. This is an area where price compromises are stubborn, obvious, and keenly felt. Pick up the MacBook Neo and it’s clear that it’s in a separate class entirely. Apple kept the metal frame found in all of its laptops, which exudes the kind of quality that budget competitors cannot hope to match. The Magic Keyboard is present and correct, and while the trackpad lacks haptic feedback, it’s still usable at every point on its surface. Touch the MacBook Neo and you know it’s something different. And that’s absolutely key. Apple knows that first impressions matter, and if you’re picking up a rickety plastic laptop every day, you’re going to be acutely aware that it’s poorly made. It might not sound like much, but that kind of dedication to quality, even at the budget end where concessions must inevitably be made, is a perfect example of the shortcomings of the Apple Tax myth. No MacBook Neo customer is paying over the odds here. If anything, the opposite is true. Price-conscious shoppers deserve quality, even if they need to save money. The MacBook Neo provides that in spades. Samsung’s Galaxy S26 Ultra (right) costs $100 more than the iPhone 17 Pro, yet the iPhone obliterates it in terms of performance.Foundry Overpriced versus expensive While the MacBook Neo might represent low-cost affordability, Apple’s more expensive devices still offer tremendous value for money. Most Apple products fall under one of these two headers: either surprisingly low in price, or more expensive but packed full of premium features. The MacBook Neo might be the most obvious example of Apple cramming in the value, but it’s far from the only one. The iPhone 17 Pro costs $1,199 to the Samsung Galaxy S26 Ultra’s $1,299, yet obliterates it in terms of performance. The iMac is by far the best all-in-one desktop on the market and is very reasonably priced. And don’t even get me started on the Mac mini versus its pint-sized competition. Yet the myth that Apple’s products are overpriced persists. It seems to me that this comes down to a simple idea: people are confusing overpriced with expensive. If something is overpriced, the perceived value for money drops as the cost increases. An expensive product, though, can still be a fantastic bargain: the value rises in line with (or faster than) the cost. True, you’ll often pay more up front for Apple products than for rivals’ offerings. No one can deny that the Mac Studio costs a big old heap of change, after all. But that doesn’t necessarily mean that it’s in any way overpriced. Even Apple’s most expensive Mac Studio offers good performance value.Foundry Think of it like this. If you had the chance to pay $1,000 for a MacBook Air or $700 for a similar Windows laptop, you might think the latter is the better deal. But if that Windows laptop only lasts you two to three years and the MacBook lasts you six, then Apple’s device is a much better bargain. Over that six-year period, you’d have to buy two or three Windows laptops for a total of $1,400 to $2,100. Suddenly, that $1,000 MacBook Air seems like quite the steal. This isn’t just a fantasy example, either. There have been numerous reports and studies over the years that show that Apple’s products endure far longer than those from other companies. They’re sturdier, more capable, and built to last. Simply put, you get what you pay for. Smart and cheap and good When you trace a path back through Apple’s history, affordability has often been a key consideration for the company. Take the Apple I, for example, the very first product that Apple put out into the world. When looking for a microprocessor for the computer, Apple co-founder Steve Wozniak balked at the price of the then-current Intel 8080 CPU–each one “cost almost more than my monthly rent,” he said–and instead designed the computer without a chip until one arrived that was affordable enough. When it finally arrived, it wasn’t the fastest chip on the market, but it allowed Apple to focus on getting the details right while keeping the Apple I’s price down. Or take the time in 2007 when Steve Jobs was asked whether he wanted Apple to overtake the PC in market share. He told the interviewer that Apple’s goal was to make “the best personal computers in the world and to make products we are proud to sell and would recommend to our family and friends. And we want to do that at the lowest price we can.” The problem, Jobs said, is that “we just can’t ship junk.” “What you’ll find,” Jobs continued, “is that our products are usually not premium priced. You go and price out our competitors’ products and you add the features that you have to add to make them useful, and you’ll find in some cases they are more expensive than our products.” This was something that mattered to Jobs. The idea of shipping a low-quality, low-effort device just to keep the costs down–a product that was cheap in every sense of the word–was anathema to him because it compromised the product, the experience, and Apple’s good name too much. Instead, Apple raised the price but also raised the quality in equal measure. As a result, Apple gained a reputation for premium tendencies, but many people forgot that the higher price came alongside a better fit and finish. Perhaps the best summation of this philosophy was, again, espoused by Jobs himself. Speaking to biographer Walter Isaacson, Jobs compared Apple to the modestly priced Eichler homes that were built for working-class families in the 1950s. “Eichler did a great thing,” Jobs said. “His houses were smart and cheap and good. They brought clean design and simple taste to lower-income people … I love it when you can bring really great design and simple capability to something that doesn’t cost much. It was the original vision for Apple.” That idea served Apple well for its first 50 years. With the MacBook Neo and many of its other products, Apple is bringing that mindset into the next half-century.
Read more »
11:00 am
AT&T announces new $15/month ‘Build-a-Plan’ wireless plan | 9 to 5 Mac
AT&T announces new $15/month ‘Build-a-Plan’ wireless plan
AT&T has just announced a new wireless plan—‘Build-a-Plan’—that lets customers choose exactly the right features for them, and it starts at just $15/month. Here are the details. more…
Read more »
09:38 am
Apple’s OLED MacBook plans get a big boost from Samsung | Cult of Mac
Apple’s OLED MacBook plans get a big boost from Samsung
Samsung Display’s latest OLED production breakthrough could benefit Apple’s upcoming MacBook Pro refresh. (via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)
Read more »
08:00 am
You’ll love this $60 portable charger at airports, coffee shops & while out and about | Macworld
You’ll love this $60 portable charger at airports, coffee shops & while out and about
Macworld TL;DR: The VIONTA B5 is a compact solid-state power bank with magnetic charging, 20W fast charging, and a foldable kickstand for $59.99. A good portable charger is one of those things you don’t think much about until you’re stuck at 12% battery in an airport. The difference is that some chargers feel like cheap emergency backups, while others actually stand strong through your day-to-day hustle. At just $59.99 (reg. $75), the VIONTA B5 stands out because it uses a solid-state battery instead of a traditional lithium battery pack. That matters for both safety and reliability. Solid-state batteries are designed to run cooler and more stably, which helps reduce some of the concerns people have around overheating or travel-related battery issues. The magnetic wireless charging snaps into place easily, while the built-in foldable stand rotates 360 degrees so you can prop your phone up while you work or watch. The charger also supports 20W USB-C fast charging and can power two devices simultaneously. Despite all that, it remains compact enough to toss into a backpack, carry-on, or jacket pocket without being annoying to carry. Enjoy an everyday smart tech upgrade with this VIONTA B5 portable fast-charging power bank while it’s just $59.99 (reg. $75). VIONTA B5 5000 mAh Solid-State Power Bank with Foldable StandSee Deal StackSocial prices subject to change.
Read more »
08:00 am
A new AI tool can generate images, videos, and avatars on your iPhone, and a 5-year plan is on sale for $64 | Macworld
A new AI tool can generate images, videos, and avatars on your iPhone, and a 5-year plan is on sale for $64
Macworld TL;DR: ARTA is an AI design tool that actually works well on iOS and Android, and it’s only $64 for a 5-year plan with code AI20. Creating interesting visuals used to mean spending hours learning software you’d barely use, and more often than not, those apps were virtually unusable on mobile. ARTA puts AI image generation, video creation, avatar building, and photo editing in one mobile app, and a 5-year Premium Plan is only $64 right now (reg. $199.99). This platform runs on some of the most popular image generation AI models around and doesn’t ask you to pay a separate subscription for each one. That includes Stable Diffusion, Flux, GPT-4o, and Nano Banana, and it gives you 500 weekly credits to use across all of them. Generate images from text prompts or existing photos, turn static images into short videos, create studio-quality headshots from a single selfie, or experiment with AI fashion and makeup looks. Over 45 art styles run from photorealistic to anime and retro pop, and the content gallery updates regularly with new trending formats. For anyone who wants a full AI creative studio on their iPhone, use code AI20 to get an ARTA AI Premium 5-year plan for $64. ARTA AI Premium Plan: 5-Year SubscriptionSee Deal StackSocial prices subject to change.
Read more »
07:15 am
Macworld Podcast: AI updates; the MacBook Neo effect | Macworld
Macworld Podcast: AI updates; the MacBook Neo effect
Macworld The MacBook Neo has had a profound effect on the laptop market. On this episode of the Macworld Podcast, we discuss the recent announcements by Microsoft and Google that are directly influenced by Apple’s most affordable laptop. This is episode 984 with Michael Simon, David Price, and Roman Loyola. Watch episode 984 on YouTube Listen to episode 984 on Apple Podcasts
Read more »
12:51 am
ACSI: Samsung edges out Apple in cell phone satisfaction, while Apple Watch ties at the top | 9 to 5 Mac
ACSI: Samsung edges out Apple in cell phone satisfaction, while Apple Watch ties at the top
The American Customer Satisfaction Index (ACSI) has published this year’s Telecommunications, Cell Phone, and Smartwatch Study. Here’s how the iPhone and the Apple Watch did. more…
Read more »
12:31 am
Adobe Photoshop update brings on-device AI processing, but there is a catch | 9 to 5 Mac
Adobe Photoshop update brings on-device AI processing, but there is a catch
Adobe released Photoshop version 27.7 today, and one of the most interesting additions is an on-device AI model for the Remove tool that, alas, comes with rather steep hardware requirements. Here are the details. more…
Read more »
12:23 am
SteelSeries Arctis Nova 7X Gen 2 review: The Mac gaming headset to beat | AppleInsider
SteelSeries Arctis Nova 7X Gen 2 review: The Mac gaming headset to beat
The SteelSeries Arctis Nova 7X Gen 2 is an updated version of a popular headset, adding Mac support for the first time, and it has immediately become the model that all other headsets need to beat.SteelSeries Arctis Nova 7X Gen 2 review: The gaming headset for Mac usersSteelSeries is a mainstay of the gaming accessory market, making some of the most popular headsets. Its Nova 7 sits towards the top of its audio lineup, and while the X version adds Xbox support, it works with everything.With this second-generation model, SteelSeries has iterated on a winning formula. The result is one of the best gaming headsets around right now, especially in its $200 price bracket. Continue Reading on AppleInsider | Discuss on our Forums
Read more »
Wednesday May 20
11:48 pm
Eddy Cue named 2026 Cannes Lions Entertainment Person of the Year | 9 to 5 Mac
Eddy Cue named 2026 Cannes Lions Entertainment Person of the Year
Apple SVP of Services and Health Eddy Cue has been chosen as this year’s recipient of the Entertainment Person of the Year Award, which will be presented next month at the Cannes Lions festival. Here are the details. more…
Read more »
11:48 pm
Eddy Cue named 2026 Cannes Lions Entertainment Person of the Year | 9 to 5 Mac
Eddy Cue named 2026 Cannes Lions Entertainment Person of the Year
Apple SVP of Services and Health Eddy Cue has been chosen as this year’s recipient of the Entertainment Person of the Year Award, which will be presented next month at the Cannes Lions festival. Here are the details. more…
Read more »
11:43 pm
Apple’s titanium iPhone experiment may not be over just yet | Cult of Mac
Apple’s titanium iPhone experiment may not be over just yet
Apple may be working on a way to make titanium iPhones run cooler. (via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)
Read more »
10:41 pm
Apple lets Fortnite back on the App Store, but the fight isn’t over yet | Cult of Mac
Apple lets Fortnite back on the App Store, but the fight isn’t over yet
Fortnite’s global App Store comeback marks a major moment for Epic Games, but the legal dispute is still unresolved. (via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)
Read more »
10:33 pm
The Outsiders celebrates Apple Design Awards 2026 nomination with biggest update yet | 9 to 5 Mac
The Outsiders celebrates Apple Design Awards 2026 nomination with biggest update yet
Just days after being nominated for a 2026 Apple Design Award in the Interaction category, The Outsiders rolled out a major update with Home Screen widgets, expanded workout import options, new metrics, additional workout types, and more. Here are the details. more…
Read more »
09:06 pm
Kansas City Public Schools are going all-in on Apple | AppleInsider
Kansas City Public Schools are going all-in on Apple
More than 30,000 Windows PCs and Chromebooks are getting the boot as Kansas City prepares to transition its public school students exclusively to Apple devices.Kansas City Public Schools have procured more than 4,500 MacBook Neos as part of its transition to an "All-Apple District" On Wednesday, Kansas City Public Schools elaborated on its decision to become an "All-Apple District." The district says the move reflects its commitment to providing the highest quality education to its students."Students are now proud of their schools because they have the best products," KCPS Chief Technology Officer Scott Jones said in a statement. The district believes that Apple devices have an edge over the competition, calling them "secure, durable, and reliable." Continue Reading on AppleInsider | Discuss on our Forums
Read more »
09:00 pm
Apple’s App Store stopped over $2.2 billion in fraudulent transactions in 2025 | Mac Daily News
Apple’s App Store stopped over $2.2 billion in fraudulent transactions in 2025
Apple's App Store was built on two core principles: provide users with a secure, trusted place to discover apps, and offer developers… The post appeared first on MacDailyNews.
Read more »
08:48 pm
Apple TV renews ‘Knife Edge: Chasing Michelin Stars’ for a second season | 9 to 5 Mac
Apple TV renews ‘Knife Edge: Chasing Michelin Stars’ for a second season
‘Knife Edge: Chasing Michelin Stars’ has been renewed for a second season on Apple TV, following an acclaimed eight-part season 1. Here’s what to expect from season 2. more…
Read more »
08:36 pm
tvOS 27 will give Apple TV 4K a useful new display setting | 9 to 5 Mac
tvOS 27 will give Apple TV 4K a useful new display setting
Next month tvOS 27 will be unveiled, the next major version of Apple TV 4K software, and Apple confirmed this week that it will bring a useful new display setting: Larger Text. more…
Read more »
08:13 pm
Apple shares hit new all-time closing high | Mac Daily News
Apple shares hit new all-time closing high
In Nasdaq trading today, shares of Apple Inc. rose to hit a new all-time closing high. Apple’s all-time intraday high… The post appeared first on MacDailyNews.
Read more »
08:12 pm
Audio that relies too heavily on AI-generated sound won't be on Apple Music | AppleInsider
Audio that relies too heavily on AI-generated sound won't be on Apple Music
Music Labels will do better with music that doesn't use that much AI, Apple has warned, as it tries to keep the humanity in songs.Apple Music asks distributors to label AI worksLike other areas of the creative world, artificial intelligence is becoming part of the music we listen to. However, Apple has issued a warning to the industry at large that it is working to combat the influx of AI audio content.In an open letter to music labels and music industry partners seen by 9to5Mac titled "What we're doing to keep music fair," Apple Music offers a balanced take. There are benefits to AI, even in music, but it is working to make things fair for those who don't use it. Continue Reading on AppleInsider | Discuss on our Forums
Read more »
07:55 pm
Kansas City Public Schools to replace 30,000 Windows PCs and Chromebooks with Apple devices | 9 to 5 Mac
Kansas City Public Schools to replace 30,000 Windows PCs and Chromebooks with Apple devices
Following a quick comment during Apple’s Q2 2026 earnings call, the Kansas City Public Schools website has elaborated on its plan to transition to an “all-Apple district.” Here are the details. more…
Read more »
07:31 pm
Hovercraft is a new Mac app that makes video call presentations feel more personal | 9 to 5 Mac
Hovercraft is a new Mac app that makes video call presentations feel more personal
The simple act of sharing your screen in a way that feels natural during a video call can be overly complicated. Hovercraft is a new Mac app that solves a very specific problem around screen sharing during video calls. more…
Read more »
07:00 pm
Apple TV announces season two renewal for “Knife Edge: Chasing Michelin Stars” | Mac Daily News
Apple TV announces season two renewal for “Knife Edge: Chasing Michelin Stars”
Today, Apple TV announced an eight-part second season for acclaimed, BAFTA Award-nominated docuseries “Knife Edge: Chasing Michelin Stars,” hailing from world-famous chef, restaurateur, author and executive producer Gordon Ramsay (“Next Level Chef,” “Ramsay’s Kitchen Nightmares”) and Studio Ramsay Global, and hosted by Topjaw’s Jesse Burgess. Exploring the high-stakes world of international fine dining with exclusive […] The post appeared first on MacDailyNews.
Read more »
06:54 pm
Apple Music shares what it is doing to ‘keep music fair’ in an AI world | 9 to 5 Mac
Apple Music shares what it is doing to ‘keep music fair’ in an AI world
The streaming service Apple Music today shared an open letter with music labels and industry partners entitled ‘What We’re Doing to Keep Music Fair’, reaffirming its commitment to help the music business navigate the use of AI responsibly. The company said it believes technology should amplify artists, not replace them. Apple says AI music represents significantly less than 1% of all plays on the service, but it is being proactive to keep a fair, level playing field for all creators. more…
Read more »
06:49 pm
Wow! This loaded M3 iPad Air is just $849 after a massive $400 off | Macworld
Wow! This loaded M3 iPad Air is just $849 after a massive $400 off
Macworld Apple iPad Air M3 View Deal (function () { document.querySelector("#sticky-promo-block a").addEventListener("click", function(e) { const debug = document.location.host.search(/lndo.site|go-vip.net/) !== -1; const text = this.closest("#sticky-promo-block").querySelector("p.promo-title").textContent; const data = { event: "stickyConversionUnitClick", eventCategory: "Sticky Conversion", eventAction: "Click", eventLabel: text }; if(debug)console.log("Sticky Conversion CLick - pushing to dataLayer: ", data); dataLayer.push(data); return true; }); })(); We don’t often see deals on Apple devices that are impressive enough to make our jaws drop, but we got one today: For the first time, you can get a massive $400 discount on the 11-inch M3 iPad Air. Yes, you read that right. Instead of shelling out $1,249 for this decked-out model, you can get it for a mere $849. That’s a fantastic price for a tablet that comes with an M3 chip, 1TB of storage, as well as 5G connectivity, and since it’s the first time we see such a deep dive, you should most definitely check it out, especially if you’ve been waiting for the “right time” to get a tablet. As we’ve told you before, we simply adore this tablet, giving it a solid 4-star rating in our review for its outstanding performance and the fantastic battery life. The 11-inch Liquid Retina display will look gorgeous in all lighting situations, delivering vibrant colors and great contrast. It’s a great tool to use for streaming, photo editing, and even gaming, and with the savings, you can grab an Apple Pencil Pro or Magic Keyboard and still come out ahead. The tablet comes with both Wi-Fi 6E and cellular 5G, so you get a high-speed internet connection anywhere you go. It’s true that the M3 processor doesn’t hit the same speeds the newer M4 does, but you won’t find that model with a massive 1TB of storage and 5G for such a low price anytime soon. So grab this one while it’s still on sale and in stock!
Read more »

Older posts

Thursday May 21
51 minutes ago
Apple Debuts Sleep Apnea Alerts and Hearing Test Features in India | MacRumors
Apple Debuts Sleep Apnea Alerts and Hearing Test Features in India
Apple has announced the rollout of two new device features in India: sleep apnea notifications for Apple Watch, and Hearing Test for AirPods Pro. Sleep apnea is a condition in which breathing repeatedly stops and starts during sleep, often leading to poor rest. The Apple Watch detects signs of the disorder by using its accelerometer to track subtle wrist movements associated with irregular breathing patterns. When these disturbances occur repeatedly across several nights, the watch can flag a potential case of sleep apnea. The feature is supported on the Apple Watch Series 9, Series 10, Series 11, Apple Watch Ultra 2, and Apple Watch Ultra 3, and is available in more than 150 countries worldwide. To receive an initial reading, users need to wear the watch consistently for several nights, although nightly breathing disturbances are logged in the iPhone's Health app. Hearing tests can be conducted by connecting AirPods Pro 2 or AirPods Pro 3 to an iPhone running iOS 18.1 or later or an iPad running iPadOS 18.1 or later. The hearing test mimics the hearing tests one might encounter at a doctor's office or when visiting an audiologist. Tones at different frequencies and sound levels play in each ear, with users instructed to tap the iPhone's display whenever a sound is heard. Apple tests four frequencies, including 500Hz, 1kHz, 2kHz, and 4kHz. Results up to 25 dBHL indicate little to no hearing loss. 26 to 40 dBHL is a sign of mild hearing loss, while results of 41 to 60 dBHL suggest moderate hearing loss. 61 to 80 dBHL is severe hearing loss, and a result above 80 dBHL is considered profound hearing loss. The results, which include an audiogram, are stored in the Health app, and can be shared with a healthcare provider to have more informed conversations. Apple Health features are now available in over 160 countries and regions globally, according to a post on X by Apple's Greg Joswiak. Joswiak's post also suggests that Apple recently brought its Hearing Aid feature to Italy and hypertension notifications to Taiwan. Tag: IndiaThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
1 hour ago
iPhone 19 Pro Prototype in Testing Allegedly Has Quad-Curved Display | MacRumors
iPhone 19 Pro Prototype in Testing Allegedly Has Quad-Curved Display
Apple is testing an iPhone 19 Pro with a display that curves around all four edges of the device, a leaker out of China has claimed. According to Weibo-based Digital Chat Station, the 2027-generation Pro device, currently at the evaluation stage, has a hole-punch cutout in the display for the front-facing camera, but Face ID is completely hidden under the panel. The claim is notable because multiple reports suggest Apple is aiming to launch a 20th-anniversary iPhone next year featuring a quad-curved display with no cutouts. Whether Apple plans to position the commemorative model as an ultra-premium tier above its Pro and Pro Max lineup has remained unclear, but the leaker's latest comments suggest that could be the case. That said, if Apple is planning to use quad-curved panels across both the iPhone 19 Pro and iPhone 19 Pro Max, it would leave the company less room to differentiate them from the rumored commemorative iPhone. One way Apple could play it is to keep the uninterrupted display exclusive to the 20th-anniversary iPhone while leaving a hole-punch cutout in the 19 Pro models – an option that the leaker's comments do seem to imply. However, Apple is said to be finding it particularly challenging to get both the Face ID system and the front-facing camera under the panel, with the selfie camera proving to be the most difficult to hide. If existing technologies can't hide the camera under the panel without degrading quality, Apple is unlikely to go ahead with it – which would leave the 2027 iPhone series' differentiation outlined here unresolved. Digital Chat Station has more than three million followers on Weibo, and has a track record of accurately leaking Apple-related information. For example, they accurately revealed the overall design of the iPhone Air and iPhone 17 Pro, as well as the triple 48-megapixel rear camera system of the ‌iPhone 17 Pro.‌ Recently, the leaker claimed Apple's first foldable, expected to arrive alongside the iPhone 18 Pro models, will be called "iPhone Ultra."Tags: 20th-Anniversary iPhone, Digital Chat StationThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
08:41 am
MacBook Pro OLED Display Production Clears Key Hurdle | MacRumors
MacBook Pro OLED Display Production Clears Key Hurdle
Apple's first OLED MacBook Pro models have cleared a major manufacturing hurdle, with panel supplier Samsung Display having reportedly achieved yields above 90 percent on its Gen 8.6 OLED production line. According to Korean publication The Elec, some individual process stages are now reaching yields as high as 95 percent, a level that the display industry considers "golden yield" territory for stable mass production. The report says Samsung could begin shipping OLED laptop panels through the supply chain as early as June. The panels are expected to be used in future 14-inch and 16-inch MacBook Pro models, with estimated supply volumes of around 2 million units this year. The rapid yield improvement is notable because OLED laptop panels are a lot harder to manufacture than smartphone displays due to their larger size and stricter brightness and lifespan requirements. For example, MacBook Pro panels are expected to use brighter tandem two-stack OLED technology like Apple's OLED iPad Pro models, oxide TFT backplanes for improved battery life, and an anti-moisture sealing protection method called hybrid encapsulation. Samsung began its Gen 8.6 IT OLED investment in 2023 and is currently operating one of two planned production lines. Depending on demand for the OLED MacBook Pro models, which will reportedly have touchscreen capability for the first time, Samsung could activate the second line and expand capacity further. Bloomberg's Mark Gurman has repeatedly stated that 14-inch and 16-inch OLED MacBook Pro models are slated to launch in late 2026 to early 2027, but the latter time frame is now said to be more likely due to the industry-wide chip shortage. Related Roundup: MacBook ProTags: OLED, The ElecBuyer's Guide: MacBook Pro (Buy Now)Related Forum: MacBook ProThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
Wednesday May 20
07:20 pm
iOS 27's New AI Voice Control Feature Hints at Major Siri Upgrade Coming Soon | MacRumors
iOS 27's New AI Voice Control Feature Hints at Major Siri Upgrade Coming Soon
Every May, Apple previews new accessibility features coming to devices like the iPhone, iPad, and Mac. The announcement typically occurs a few days before Global Accessibility Awareness Day, and it offers a glimpse into what will be included in the next major releases of Apple's software platforms, such as iOS, iPadOS, and macOS. This year, one of the new capabilities shown off by Apple is natural language support for the Voice Control feature on the iPhone and iPad. Voice Control is receiving an Apple Intelligence upgrade that will make the feature "more intuitive than ever," according to Apple. Specifically, iPhone and iPad users will be able to describe on-screen buttons and controls with natural language, instead of having to remember exact labels, numbers, or descriptions like before. For example, users will be able to say things like "tap the guide about best restaurants" in Apple Maps or "tap the purple folder" in the Files app. AI-powered Voice Control hints at the more personalized version of Siri that Apple first announced all the way back at WWDC 2024. At the time, Apple said Siri would gain on-screen awareness, which would essentially turn the assistant into an AI agent that is capable of understanding natural language and taking action for you. Correct me if I'm wrong but it sure looks like Apple just casually dropped agentic AI being built into iPhone Yes, in this video it's being used for Voice Control, but if a person can control their iPhone with natural language so can an AI agent! pic.twitter.com/S6DQOiQGsO— Dylan (@DylanMcD8) May 19, 2026 Apple's own example was an iPhone user asking Siri about their mother's flight and lunch reservation plans based on info retrieved from the Mail and Messages apps, and it was later reported that Siri will be able to do things such as comment on an Instagram post, or scroll through a shopping app and add something to your cart. Overall, the revamped Siri is expected to have a better understanding of a user's personal context, on-screen awareness, and deeper per-app controls. In March 2025, Apple announced that these capabilities were delayed until later this year. The new-and-improved Siri is expected to be a tentpole feature of iOS 27, iPadOS 27, and macOS 27, which will be unveiled on June 8 and should be released to the public in September. The more personalized Siri will likely require an iPhone 15 Pro or newer, a Mac with an M1 chip or newer, or an iPad with an A17 Pro or M1 chip or newer.Related Roundup: iOS 27Tags: Accessibility, Apple Intelligence, SiriThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
04:46 pm
Apple Says iOS 27 Can Automatically Add Captions to Your Personal iPhone Videos | MacRumors
Apple Says iOS 27 Can Automatically Add Captions to Your Personal iPhone Videos
Apple this week previewed new accessibility features that are coming later this year, and one is particularly notable: automatic captions for personal videos. For videos that do not already have captions, Apple said a new on-device speech recognition model can automatically generate them for spoken audio. According to Apple, this feature will be available for videos that you record on your iPhone, videos that you receive from friends and family, and videos that are streamed online. The automatic captions will initially be limited to English in the U.S. and Canada. Apple ensured that the captions are generated privately, and you will be able to customize their appearance in the video playback menu or in the Settings app. The feature will be supported across the iPhone, iPad, Mac, Apple TV, and Vision Pro, with the "later this year" timing pointing to iOS 27, iPadOS 27, macOS 27, tvOS 27, and visionOS 27. Apple will unveil those software versions during its WWDC 2026 keynote, which begins on Monday, June 8 at 10 a.m. Pacific Time, so we expect to learn more about this feature and its exact implementation in a few weeks from now.Related Roundup: iOS 27Tag: AccessibilityThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
03:45 pm
Samsung Overtakes Apple for Top Smartphone Customer Satisfaction | MacRumors
Samsung Overtakes Apple for Top Smartphone Customer Satisfaction
Samsung has edged past Apple for the top spot in customer satisfaction for cell phones, according to the American Customer Satisfaction Index's 2026 Telecommunications, Cell Phone, and Smartwatch Study, published this week. Samsung scores 81 in the ACSI's cell phone rankings while Apple posts 80, breaking last year's tie between the two companies for satisfaction leadership. The overall cell phone industry score rose 1% to 79 this year, recovering from a sharp 4% decline in 2025 that had pushed it to its lowest point in a decade. The ACSI says satisfaction improves most when new features translate into everyday value without introducing new pain points, citing battery life tradeoffs as an example. AI integration, measured by the ACSI for the first time, scores 85 overall, signaling that customers are not only aware of AI features but find them useful, while improvements in battery life, up 5% to 81. For the cell phone industry, the highest-rated customer experience metrics are the fundamental functions of making phone calls and sending text messages, both scoring 86. AI feature performance debuts at 85, nearly matching those top table-stakes interactions, suggesting that AI is moving from novelty to practical utility for many customers. Among new flagship owners, Samsung's latest Galaxy S-series leads at 84, followed by new iPhone owners at 82, with Google's flagship models scoring 80. Satisfaction with flagship models overall scores 82, far outpacing legacy phones at 76 and foldables at 72. In the foldable segment, Samsung holds a clear lead with an ACSI score of 80, which is 8 points ahead of Google at 72 and 10 points ahead of Motorola at 70. The ACSI notes that foldable owners are three times as likely to complain as non-foldable owners, and says competitive dynamics in the segment may shift as Apple's rumored entry into the foldable market is anticipated for later this year. Apple is widely expected to debut a foldable iPhone alongside the iPhone 18 Pro models this fall, featuring a 7.8-inch inner display and a 5.5-inch cover screen, priced at around $2,000. In the smartwatch category, Apple holds steady at 80, while Samsung drops 4% to create a first-place tie at the top of the leaderboard. Customer experience characteristics of smartwatches are universally rated higher this year at the industry level, with the biggest gains including ease of navigating menus and settings, up 7% to 80, and app and accessory connectivity, up 5% to 83. The ACSI study is based on 26,963 completed surveys, with customers contacted via email between April 2025 and March 2026.Tag: SamsungThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
03:33 pm
Apple Provides Update on App Store, Highlights Key 2025 Safety Stats | MacRumors
Apple Provides Update on App Store, Highlights Key 2025 Safety Stats
Apple today shared stats that paint the App Store as a safe and trusted place for both customers and developers, even though the reality is that fraudulent or deceptive apps continue to make it past Apple's review process from time to time. In 2025, Apple said its App Review team evaluated more than 9.1 million App Store submissions, with a mix of human review and AI. The company rejected over two million of these submissions, including over 1.2 million new apps and nearly 800,000 pending app updates, for failing to adhere to the App Store's Review Guidelines. As bad actors continue to evolve their methods, Apple said it continuously improves its multilayered defenses, leveraging a combination of human review and advanced machine learning in an attempt to detect and prevent malicious activity. "By utilizing AI to rapidly identify complex malicious patterns, analyze app similarity, and flag potentially problematic changes in app updates, Apple's systems help human reviewers focus their expertise where it matters most," said Apple. "This not only improves the customer experience by ensuring a high-quality, curated storefront, it also helps legitimate developers get their great apps and updates to users faster." Apple added that it terminated 193,000 developer accounts over fraud concerns and prevented over $2.2 billion in potentially fraudulent transactions in 2025. In 2025, Apple processed over 1.3 billion App Store reviews and ratings. Using a mix of human review and AI, the company said it identified and blocked close to 195 million fraudulent reviews and ratings from ever appearing. "Apple's Trust and Safety teams integrate AI throughout the entire moderation process to detect spam, offensive content, and inauthentic reviews at scale," the company explained. "Additionally, AI-powered dashboards and rapid data analysis tools accelerate the discovery of new fraud vectors, enabling Apple's teams to react quickly to deceptive activity and protect the integrity of the platform." Apple's press release contains many more stats that highlight the company's efforts to ensure the App Store is secure, even if they are not perfect.Tag: App StoreThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
02:42 pm
Ugreen Debuts Pocket-Sized Chargers for Your Apple Devices | MacRumors
Ugreen Debuts Pocket-Sized Chargers for Your Apple Devices
Accessory maker Ugreen has expanded its Nexode and MagFlow Air lineup of chargers with a set of compact units aimed squarely at Apple users. First up is the Nexode Air 65W charger, which Ugreen is pitching as a travel-friendly option for MacBook Air owners, but it should work just as well for iPhones, iPads, and other USB-C devices. (Its Cosmic Orange-style finish twins particularly well with the iPhone 17 Pro.) Ugreen describes the unit as pocket-sized while still delivering up to 65W of fast charging, and it features the company's Ugreen's Thermal Guard temperature control for safety. For users who want a thinner option, Ugreen is also touting its Nexode Air 45W Charger Slim, plus there's a new MagFlow Air Magnetic Power Bank 10000mAh – a Qi2-certified 15W magnetic battery with a built-in USB-C cable, a second USB-C port, and ATL battery cells inside. The company's broader existing Air lineup includes a thicker Nexode Air 65W Charger Slim and a less bulky 5000mAh version of the MagFlow Air. The Nexode Air 65W Charger and 45W Slim are priced at $39.99, with the 10000mAh MagFlow Air at $79.99. All the chargers are available now over on Ugreen's official site as well as Amazon.com. Note: MacRumors is an affiliate partner with Amazon. When you click a link and make a purchase, we may receive a small payment, which helps us keep the site running.Tag: UgreenThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
01:57 pm
Apple's Eddy Cue to Receive 'Entertainment Person of the Year' Award | MacRumors
Apple's Eddy Cue to Receive 'Entertainment Person of the Year' Award
Apple senior vice president Eddy Cue will be honored as "Entertainment Person of the Year" at the Cannes Lions festival next month, recognizing his leadership of the company's entertainment and services business (via Variety). Cue will deliver a keynote on the opening day of the festival, which runs from June 22 to June 26 in the south of France. He will be joined by producer Jerry Bruckheimer, whose film "F1: The Movie" was released by Apple last year. In a statement, Lions CEO Simon Cook said: Eddy Cue has consistently pushed the boundaries of entertainment and storytelling, building platforms and experiences that have redefined how audiences engage with culture. Under his leadership, Apple has not only produced world-class content but has also shaped the future of entertainment through innovation, creativity and an unwavering commitment to quality. We're delighted to honor Eddy as our 2026 Entertainment Person of the Year. Cue told Variety last year that as streaming platforms multiplied, Apple saw an opportunity to focus on quality over volume. "We saw that the world was changing, and it seemed like everybody was going after quantity. We thought there was an opening for us, if we really focused on high quality," he said. Apple TV+ launched in November 2019 and has since compiled an impressive awards record. The streamer earned best picture at the Oscars for its 2021 drama "CODA," and "The Studio" set records at last year's Emmy Awards with 13 wins, which is the most by a comedy series in a single year and the most by a first-year series.Tags: Apple TV Service, Eddy CueThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
01:38 pm
Amazon Takes $150 Off Every 15-Inch M5 MacBook Air | MacRumors
Amazon Takes $150 Off Every 15-Inch M5 MacBook Air
Amazon today has every model of the 15-inch M5 MacBook Air on sale at record low prices, starting at $1,149.00 for the 512GB model, down from $1,299.00. This sale includes all three configurations of the 15-inch M5 MacBook Air on sale in most color options. Note: MacRumors is an affiliate partner with Amazon. When you click a link and make a purchase, we may receive a small payment, which helps us keep the site running. You'll find $150 off every model on Amazon, also including both 1TB models. Best Buy is matching these deals as part of its ongoing Memorial Day sale, which we began tracking yesterday. As of writing, we aren't tracking any deals on the 13-inch M5 MacBook Air. $150 OFF15-inch M5 MacBook Air (512GB) for $1,149.00 $150 OFF15-inch M5 MacBook Air (16GB/1TB) for $1,349.00 $150 OFF15-inch M5 MacBook Air (24GB/1TB) for $1,549.00 If you're on the hunt for more discounts, be sure to visit our Apple Deals roundup where we recap the best Apple-related bargains of the past week. Deals Newsletter Interested in hearing more about the best deals you can find in 2026? Sign up for our Deals Newsletter and we'll keep you updated so you don't miss the biggest deals of the season! Related Roundup: Apple DealsThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
11:43 am
Discord Voice and Video Calls Now End-to-End Encrypted by Default | MacRumors
Discord Voice and Video Calls Now End-to-End Encrypted by Default
Discord says it has switched on end-to-end encryption (E2EE) by default for every voice and video call across its platforms, including desktop, mobile, web, and consoles like PlayStation and Xbox. The rollout covers DMs, group DMs, voice channels, and Go Live streams. There's no opt-in required, or any setting to change. Stage channels are the only exception, given that they're built for broadcasting to larger audiences rather than personal chats. The protection runs on DAVE, an open-source protocol Discord first introduced in September 2024. In a blog post, Discord's Mark Smith said building it was slow and complicated, partly because a single Discord call can mix people on phones, laptops, browsers, and game consoles in the same conversation. Announcing the change, Smith said: "Building an E2EE protocol that works seamlessly across all of those surfaces simultaneously is, to my knowledge, unlike anything else that's been shipped. DAVE is likely one of the internet's most platform-diverse E2EE voice and video implementations."Discord says it's now stripping out the remaining client code that allowed unencrypted fallback, so that encrypted calls will be the only option rather than a default. "We have no current plans to extend E2EE to text messages," added Smith. The completed rollout stands in stark contrast to policy changes by Meta, which recently removed its encryption feature for Instagram DMs.Tags: Discord, EncryptionThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
10:57 am
WhatsApp Tests Read-Triggered Disappearing Messages | MacRumors
WhatsApp Tests Read-Triggered Disappearing Messages
WhatsApp is getting a new setting for disappearing messages that causes them to vanish based on a countdown that starts only after they've been read. Spotted by WaBetaInfo in the latest WhatsApp TestFlight beta, the new option starts a countdown after the recipient reads the message, rather than starting the countdown when the message is sent. The countdown options with the "After reading" setting chosen include the usual "5 minutes," "1 hour," and "12 hours." The setting appears in the "Default messsage timer" menu, so perhaps WhatsApp will find a different home for the option or (more likely) rename the settings page to something like "Message timer options." The new feature is said to be available to "some" beta testers on iOS and Android, but WABetaInfo believes that some users on the public WhatsApp version on the App Store may have access to the option already. Disappearing messages can be set as the default behavior for all new chats on the end-to-end encrypted messaging platform, so this new After reading option will likely be a welcome addition for particularly privacy-conscious users, and it could also be a potential storage-saver for heavy users of the app.Tags: WABetaInfo, WhatsAppThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
Tuesday May 19
10:53 pm
Plex Tripling Lifetime Plex Pass Price to $750 in July | MacRumors
Plex Tripling Lifetime Plex Pass Price to $750 in July
Media platform Plex today said that it is increasing the price of its Lifetime Plex Pass option to $750, which is a $500 increase from the current $250 price tag. Plex said that the updated price reflects the "real, ongoing value" of the software that it plans to build and maintain. The company has considered removing the Lifetime Plex Pass because recurring subscriptions pay for long-term development, but Plex wants to continue to offer it because it's a "valuable option" for many in the Plex community.Over the years, as our software and product has evolved, the breadth of features and benefits included with your Plex Pass has expanded. This increase ensures we can continue to invest resources into building and maintaining the Plex personal media software, while continuing to offer a Lifetime option.For those unfamiliar with Plex, it is media server software that lets users stream their library of content from a device with the server software installed to any other connected smartphone, tablet, or TV. The Plex Pass unlocks features like server management, hardware transcoding, offline downloads, mobile syncing, remote streaming, and more. Plex previously increased the cost of the Lifetime Plex Pass from $120 to $250 in March 2025. Plex customers who previously bought a Lifetime Plex Pass will still be able to access the benefits and perks associated with a Plex Pass with no change. Customers can purchase a Lifetime Plex Pass for $250 prior to when the price changes. Plex is also not increasing the price of its subscription Plex Pass, which is $7 per month or $70 per year. In addition to announcing the upcoming price change to the Lifetime Plex Pass, Plex shared its roadmap. It is working to implement improvements to downloads like grouping by show, and updates to its mobile apps. The Lifetime Plex Pass price increase will go into effect on July 1, 2026 at 12:01 a.m. UTC.Tag: PlexThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
09:34 pm
Google's First AI Smart Glasses Launching This Fall With iPhone Support | MacRumors
Google's First AI Smart Glasses Launching This Fall With iPhone Support
Google today said that its first "intelligent eyewear" product is set to launch this fall. It is teaming up with Samsung and eyewear manufacturers Gentle Monster and Warby Parker to launch new AI audio glasses. The glasses will run Android XR, which is Google's platform for smart glasses and AR/VR headsets. There are cameras, speakers, and microphones in the glasses, but there is no display in the lenses. Google previewed two of the designs coming from Gentle Monster and Warby Parker, though there will be other options. Google says the two companies will have "full collections" available when the glasses launch. The glasses support Gemini AI, with Gemini integrated into all of the available features. Users will be able to say "Hey Google" or tap the side of the frame to bring up Gemini, and Google says the AI can do the following: Gives information about what the wearer sees, like reviews for a restaurant nearby, the name of a cloud formation, or details on a confusing parking sign. Offer sight-based navigation with turn-by-turn directions. Gemini can add stops or locate nearby locations like restaurants based on user preferences. Manage calls, send texts, and summarize messages. Listen to music. Capture photos and videos and edit them with Google's Nano Banana AI image editing engine. Translate speech and writing in real time. Complete multi-step tasks like ordering coffee via DoorDash. Use apps on a connected smartphone with voice-based commands. Google says that its upcoming glasses will be able to work with iPhones in addition to Android smartphones. Apple is working on its own AI smart glasses that are expected to have similar capabilities, but rumors suggest Apple's glasses won't be ready until 2027. In the future, Google plans to launch "display glasses" that have a small display in the lens to relay information from Gemini, but that product is not coming until later.Tag: GoogleThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
09:02 pm
Apple Taps Virtual Avatar Firm Animato's Expertise and Intellectual Property | MacRumors
Apple Taps Virtual Avatar Firm Animato's Expertise and Intellectual Property
Apple has quietly agreed to hire employees and license intellectual property of Animato, a small California-based company that has developed software for creating virtual avatars used in video chats and tutoring, according to a European Commission filing spotted by MacRumors. The acquisition was filed under the EU's Digital Markets Act in January 2026, and appears to be what's known as a "structured acqui-hire." In other words, Apple is able to make employment offers to certain Animato employees and receive a non-exclusive license to the company's intellectual property, as well as acquire its patent applications.Apple Inc. ("Apple") will have the right to make employment offers to and hire certain employees of Animato, Inc. ("Animato"), receive a non-exclusive license to Animato's intellectual property rights, and acquire Animato's patent applications. Animato develops and distributes software that creates virtual avatars for video chats and tutoring.Animato was founded in October 2022 by Francesco Rossi, who previously spent seven years at Apple before leaving to start the company. Animato is best known for a free app called "Call Annie," which launched in April 2023, and gave ChatGPT a real-time animated avatar face, allowing users to have video-style conversations with the AI chatbot. The app later moved into language learning by offering avatar tutors for practicing English, Spanish, French, German, Japanese, Mandarin, and Korean through video conversations. Animato also came out with a macOS virtual camera app called Animato Studio that let users make themselves appear as fantasy figures and anime avatars during video calls and live streams. Both App Store listings have since been removed following the acquisition, and the Call Annie website says the app has been discontinued. It's Apple's second acquisition of a digital avatar company in just over a year. In January 2025, Apple acquired technology, IP, and physical assets from TrueMeeting, a company specializing in the development of digital avatar technology for meetings. Apple already offers avatar-style technology with Memoji on iPhone and its Personas feature on Apple Vision Pro, the latter of which generates a realistic digital representation of the user for FaceTime calls.Tags: Animato, Apple AcquisitionThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
08:25 pm
Nintendo's New 'Pictonico' iOS Game Turns Your Photos Into Minigames | MacRumors
Nintendo's New 'Pictonico' iOS Game Turns Your Photos Into Minigames
Nintendo today announced a new mobile game called Pictonico, which is set to launch on Thursday, May 28. Pictonico turns photos into minigames like those you see in WarioWare. The app's website features players taking photos of themselves and their friends, with the app altering the photos in different ways. In one example, the person's mouth opens up widely to chomp on corn with a tap, and in another, a person is bundled up with a mummy and the goal is to unwrap the mummy. There are 80 minigames to play through, at normal, high-speed, and danger zone speeds that make gameplay more challenging. As players progress through the levels, the game will get more difficult. Pictonico can use photos from the Photo Library, or photos taken with the iPhone's camera from the game interface. Nintendo says that photos remain on device and are not sent to its servers. Pictonico was co-developed with Intelligent Systems, which is the studio that created the WarioWare game series. According to Nintendo, the game is free to try, with three minigames available at no cost. Unlocking the "Volume 1" games costs $7.99, while a "Volume 2" series is available for $5.99. Pictonico is available for pre-order from the App Store. [Direct Link]Tag: PhotosThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
07:04 pm
Google I/O 2026 Roundup: Gemini 3.5, AI Search, Android XR Glasses, and More | MacRumors
Google I/O 2026 Roundup: Gemini 3.5, AI Search, Android XR Glasses, and More
Google held its annual Google I/O event today, launching new AI products and giving us a look at what's coming in the near future. Google I/O is Google's equivalent of Apple's Worldwide Developers Conference, and Google's announcements offer insight into what Apple is going to be competing with in the coming months. We've rounded up everything Google announced at I/O across its product lineup. Gemini Gemini Omni - Gemini Omni is a new model that can create anything from any input, and that is better at simulating gravity and kinetic energy. It combines Gemini intelligence with generative models like Nano Banana and Veo. It supports conversational language video editing, and allows users to upload videos and edit any element in the video. Omni is starting with video, but Google's Demis Hassabis says it will eventually be able to create any output from any input. Gemini Omni Flash - Gemini Omni Flash is the first Omni model that Google is releasing, and it is available starting today in the Gemini app. Gemini 3.5 Flash - Gemini 3.5 Flash is a new model that Google's Sundar Pichai said combines frontier intelligence with action. Flash is better across almost all benchmarks compared to 3.1 Pro, and it is "comparable to the best models" but faster. Gemini 3.5 Flash is available for everyone today across Google's products and APIs. Gemini 3.5 Pro - Google is testing Gemini 3.5 Pro internally, and it's coming next month. Gemini App - Google redesigned the Gemini app with a new Neural Expressive design language that's rolling out today on desktop, iOS, and Android. It features fluid animations, vibrant colors, haptic feedback, and new typography. It's also getting custom regional dialects in the next few months. Gemini Omni is available for paid Plus, Pro, and Ultra subscribers in the Gemini app today, making it easier to create and edit videos. AI Agents for Gemini - Gemini is getting AI agents, like a Daily Brief agent that presents users with a customized daily digest. Daily Brief is rolling out today for paid subscribers. Gemini Mac App - Mac users will be able to select a bunch of images and documents in Finder, and then press the Function key to give Gemini a voice command on what to do with the files. Google's demo involved sending an email to a dog kennel with the dog's information and image, with info pulled from Finder to generate an email using Gmail in Chrome. Voice support and Gemini Spark are coming to the Gemini Mac app this summer. Gemini for Science - Gemini for Science is a collection of science tools, and there's also a Co-Scientist collaborative AI research partner. AI Content Identification Identifying AI-generated Images - C2PA content credentials are coming to Gemini and Chrome. Google's tools can tell if an image was captured with a camera or made with AI, and can determine whether an image captured with a camera was edited with AI. Users will be able to right-click on an image in Chrome and ask Gemini whether it was generated with AI. Antigravity Antigravity 2.0 - Google is launching a new agent-first Antigravity 2.0 app for the desktop that uses Gemini 3.5 Flash. Antigravity is Google's coding tool, and the equivalent of Copilot, Codex, and Claude Code. Gemini 3.5 Flash is 12x faster in Antigravity, which optimizes token use. Antigravity 2.0 is available globally for everyone. Gemini Spark Gemini Spark - Gemini Spark is a personal AI agent that helps users navigate their digital life. Gemini Spark runs on virtual machines through Google Cloud, and it is able to operate 24/7, with no need to have a laptop open for it to run. It's accessible through the Gemini app, but there will also be options to email or message it. It uses Gemini 3.5 Flash and Antigravity to work on long-running tasks in the background. It integrates with Google tools now, and Google is debuting MCP support for third-party apps in the coming weeks. Gemini Spark can do multi-step ongoing tasks, planning out subtasks and going through the steps. Gemini Spark will be available for Google AI Ultra subscribers in the U.S. next week, and it will work with Chrome later this summer. Google Search Google Search - Google Search AI Mode and AI Overviews now use Gemini 3.5 Flash. "Google Search is AI Search," was Google's messaging. There's a new Google Search box that's been reimagined with AI, and it changes based on how you're using it and goes "beyond autocomplete" to help you better ask questions. The search box supports images, files, videos, and Chrome tabs as input in addition to text. Pichai said it's the biggest upgrade to the search box in over 25 years, and it's rolling out today. Google is also combining AI Overviews and AI Mode into one interface. Agents in Search - Search is gaining support for creating and managing multiple AI agents. It can keep users updated on what's going on in the world, like changes in the stock market, and send alerts. Search will be able to monitor changes on webpages, so users can get alerts on things like sneaker drops. Information Agents are coming to search in the summer, and Google plans to add more agents. Coding in Search - Agentic coding capabilities are coming to Search. Search will be able to build a custom response on the fly with dynamic layouts, interactive widgets, and more for queries. It uses Antigravity and 3.5 Flash. Search can create tools, trackers, widgets, and dashboards. Generative UI in Search is rolling out this summer for everyone with no charge. Antigravity in Search for building custom experiences is coming in the summer for subscribers first. Shopping in Search - Google has a new Universal Cart coming this summer to Search and the Gemini app. It's an intelligent shopping cart that works across merchants and services. You can add things to the cart when reading Gmail, watching YouTube, or browsing the web, then check out on Google or on third-party retailer sites. Google has a Universal Commerce Protocol and an Agents Payment Protocol for agentic shopping. The payments feature lets AI agents make payments on your behalf using parameters that you set like a brand and price. It's coming to Gemini Spark later this year. YouTube Ask YouTube - YouTube is getting an Ask YouTube feature, which is similar to the Ask Maps AI feature. It uses Gemini and lets users ask questions. It supports context and follow-up questions, and it's in testing now. It will roll out broadly in the United States this summer. Google Docs Docs Live - With AI integration in Docs Live, users can speak or write parameters of what they need, and Gemini can create a document. Google's Sundar Pichai said users could "brain dump" and then let Gemini "do the rest." The feature supports text-based commands for creating and editing content. Hardware Android XR Audio Glasses - The first Android XR audio glasses are coming this fall, providing all-day access to Gemini with responses privately spoken into the wearer's ear. The glasses can be used for taking photos, listening to music, making calls, and tapping into apps. Google worked with Gentle Monster and Warby Parker on the design of the glasses, and Samsung on hardware. The glasses will pair with Android and iOS devices. Miscellaneous Announcements Google AI Ultra Plan - Google has a new $100 Ultra plan, and it's dropping the price of its top-tier Ultra plan from $250 to $200. Android AI Agents - Android Halo lets Android users keep an eye on AI agents, and it shows activity at the top of an Android device. It's coming to Android later this year. Google Pics - Google Pics is Google's new image generating and editing tool in Google Workspace. It can create posters, flyers, infographics, and more, similar to Canva. Content is watermarked with SynthID. Pics is rolling out this summer. Stitch - Stitch is Google's Figma-like tool that lets users build apps and websites. This year, Google is adding real-time collaborative design with Stitch Agent, exports to Antigravity, and publishing directly to Netlify. Google Flow - Google Flow, Google's "AI creative studio" for creatives, is getting Gemini Omni, AI agents for executing multiple actions at once, and custom tools with Flow Tools. New Google Flow features are available today. Many of Google's new features are rolling out today, with the rest planned for later this year. Apple is going to hold its WWDC 2026 keynote on June 8, and that's when we'll see if Apple debuts equivalent features.Tags: Android, Gemini, Google, Google I/OThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
05:26 pm
Apple Sports App Updated With 2026 World Cup Features, Expands to 90 More Countries | MacRumors
Apple Sports App Updated With 2026 World Cup Features, Expands to 90 More Countries
Apple today announced that its Apple Sports app is now available in more than 90 additional countries, including Australia, New Zealand, Japan, India, Singapore, South Korea, Taiwan, Thailand, the Philippines, Saudi Arabia, the United Arab Emirates, South Africa, and many others across the Asia-Pacific, Middle East, and Africa. The app was already released in North America, South America, and Europe. In total, it is now available in 170 countries and regions around the world. Apple also said the app offers these 2026 FIFA World Cup features: Tournament bracket view: The clean, scrollable view of matchups and results for each round allows fans to easily track a team's progression from the group stage through their final match. Visual formations: Enhanced game cards feature visual formations for each team's starting lineup to provide deeper tactical insight ahead of each match. One tap to Apple News: Apple News connects fans directly to comprehensive editorial coverage, including the latest headlines.Apple Sports supports the Live Activities feature, allowing users to follow their favorite World Cup teams and keep track of scores for each match at a glance on the iPhone's Lock Screen or Dynamic Island, and on the Apple Watch. "The World Cup unites fans across the globe, making it the ideal moment to bring Apple Sports to even more users," said Oliver Schusser, Apple's vice president of Music, Sports, Apple TV, and Beats. "Apple Sports was designed to be fast and simple, giving fans an easy way to stay on top of scores, stats, and the action that matters most in real time." The app remains available on the iPhone only.Tags: Apple Sports, FIFA, World CupThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
04:57 pm
Apple 'Shakes Up' Oversight of Product Design Ahead of CEO Change | MacRumors
Apple 'Shakes Up' Oversight of Product Design Ahead of CEO Change
In his new role as Chief Hardware Officer, Apple's longtime chipmaking chief Johny Srouji has reorganized the company's hardware development leadership "to speed up work on future devices," according to Bloomberg's Mark Gurman. The reshuffling is aimed at bringing chip and product development closer together. "The hardware shake-up is also meant to better integrate teams working on in-house silicon with those creating products," explained Gurman. The report said oversight of Apple's product design is moving from Kate Bergeron to two of her longtime deputies: Shelly Goldberg and Dave Pakula. Goldberg was already in charge of Mac product design, while Pakula led Apple Watch, iPad, and AirPods product design, but now they will oversee all of Apple's products. Apple's product design group is distinct from the industrial design group, the report explained. "Industrial design drives the overall vision and appearance of new devices, while product design focuses on translating those concepts into actual products that can be shipped to consumers," said Gurman. Bergeron is gaining oversight of product reliability across all Apple devices, and she will continue to lead the team overseeing which materials are used for products. With John Ternus set to become Apple CEO on September 1, the report said two of Ternus' former deputies will now report directly to Srouji: Matt Costello, who has led development of Apple's home and audio products, and Kevin Lynch, who runs a special projects group focused on the development of robotics devices. The report outlines many other role changes, with the reorganization sounding quite significant overall heading into the Ternus era of Apple.Tags: Bloomberg, John Ternus, Johny Srouji, Mark GurmanThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
03:16 pm
Apple's First Retail Stores Opened 25 Years Ago Today | MacRumors
Apple's First Retail Stores Opened 25 Years Ago Today
Apple's retail operation turns 25 years old today, marking a quarter century since the company opened its first stores on May 19, 2001. Steve Jobs personally guided members of the press through the Tysons Corner store four days before it opened, after Apple announced the retail initiative on May 15. Some 500 visitors lined up before dawn on opening day, with the queue growing to over 1,000 by the time the doors opened at 10 a.m. The two stores, located at Tysons Corner Center in McLean, Virginia and Glendale Galleria in California, welcomed over 7,700 visitors and recorded $599,000 in combined sales across their opening weekend. The decision to enter brick-and-mortar retail came at a precarious moment for Apple. With a market share hovering around 2.8%, the company was struggling to showcase its products through third-party retailers, where Macs were routinely relegated to dusty corners staffed by clerks with limited product knowledge. Jobs believed Apple would never shed its "cult" image unless it controlled the entire customer experience right down to the point of purchase. As he told Walter Isaacson for his biography: "Unless we could find ways to get our message to customers at the store, we were screwed." To lead the retail push, Jobs recruited Ron Johnson, who had transformed Target's image with his designer merchandise line. Together they refined the store concept in a secret warehouse prototype, working through every detail from the single-entrance layout to the Genius Bar, which Johnson modeled on the service experience at Ritz-Carlton hotels. Gap CEO Mickey Drexler, who had joined Apple's board in 1999, also played a key role in shaping the retail vision. Skepticism was widespread at the time. Apple's sales had dropped 29% the previous year, Gateway had just shuttered 40 of its own stores, and Channel Marketing analyst David Goldstein publicly predicted Apple would be "turning out the lights on a very painful and expensive mistake" within two years. By 2003, Apple was recording $3 million in profit per store, per quarter, with approximately 60,000 visitors at each location. Apple Retail hit $1.2 billion in revenue in 2004, breaking the record for the fastest retail operation to reach a billion-dollar milestone. The company today operates more than 500 stores across 27 countries, with each location generating approximately $5,500 per square foot annually, among the highest figures in the retail industry. The original Tysons Corner store relocated and reopened in a larger, redesigned space within the same mall in May 2023. Apple retail stores in both Tysons Corner and Glendale Galleria locations remain open today.Tag: RetailThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
02:47 pm
Best Buy Hosts Memorial Day Sale With Notable Apple and Tech Deals | MacRumors
Best Buy Hosts Memorial Day Sale With Notable Apple and Tech Deals
Best Buy kicked off its annual Memorial Day sale this week, with notable markdowns on Apple devices, TVs, headphones and speakers, monitors, appliances, and much more. This sale is set to last through Memorial Day on Monday, May 25, and you don't need to be a My Best Buy Plus or Total member to see the deals. Note: MacRumors is an affiliate partner with Best Buy. When you click a link and make a purchase, we may receive a small payment, which helps us keep the site running. In terms of Apple devices, you can find solid deals on MacBook Air, iPad, MacBook Pro, Beats accessories, and more. In most cases Best Buy is offering same day pick-up on these products, and there are several free shipping options as well. SITEWIDE SALEBest Buy Memorial Day Sale Some of the biggest discounts you'll find in Best Buy's Memorial Day Sale are on TVs, with major savings from popular brands like Insignia, Samsung, and LG. Best Buy has Samsung's popular line of The Frame TVs on sale, including the 65-inch 2025 model for $999.99 ($600 off) and the 65-inch The Frame Pro for $1,499.99 ($400 off), both of which match record low prices. Apple 20W USB-C Power Adapter - $14.99 ($4 off) 11-inch iPad - $299.00 ($50 off) AirPods Max (Gen 1) - $449.99 ($100 off) 15-inch M5 MacBook Air - $1,149.00 ($150 off) 16-inch M5 Pro MacBook Pro - $2,449.00 ($250 off) TVs 55-inch Toshiba C350 4K Smart Fire TV - $249.99 ($150 off) 65-inch Samsung U7900 4K Smart TV - $329.99 ($140 off) 65-inch LG UA7050 4K Smart TV - $329.99 ($160 off) 75-inch LG LED 4K Smart TV - $449.99 ($240 off) 98-inch Hisense QLED 4K Smart Google TV - $999.99 ($1,300 off) 65-inch Samsung The Frame TV (2025) - $999.99 ($600 off) 65-inch LG OLED 4K Smart TV - $1,299.99 ($1,400 off) 65-inch Samsung The Frame Pro - $1,499.99 ($400 off) Monitors 27-inch Samsung Curved 100Hz Monitor - $149.99 ($50 off) 34-inch LG UltraWide 100Hz Monitor - $239.99 ($60 off) 34-inch LG Smart Monitor - $299.99 ($50 off) 27-inch Samsung Odyssey OLED G5 Gaming Monitor - $379.99 ($120 off) 27-inch Alienware Gaming Monitor - $699.99 ($200 off) 49-inch Samsung Odyssey OLED Curved Monitor - $999.99 ($700 off) Audio Beats Pill - $99.99 ($50 off) Beats Solo 4 Headphones - $149.99 ($50 off) Beats Studio Pro Headphones - $249.99 ($100 off) Bose QuietComfort Ultra Headphones - $299.00 ($130 off) Sonos Move 2 - $399.00 ($100 off) Sony Bravia Theater Bar 6 - $499.99 ($200 off) If you're on the hunt for more discounts, be sure to visit our Apple Deals roundup where we recap the best Apple-related bargains of the past week. Deals Newsletter Interested in hearing more about the best deals you can find in 2026? Sign up for our Deals Newsletter and we'll keep you updated so you don't miss the biggest deals of the season! Related Roundup: Apple DealsThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
02:46 pm
WhatsApp Begins Rolling Out Redesigned Media Share Sheet on iOS | MacRumors
WhatsApp Begins Rolling Out Redesigned Media Share Sheet on iOS
WhatsApp is rolling out a new media attachment sheet on iOS, providing iPhone users with a faster way to share their most recent files without losing sight of the chat. Usually in WhatsApp, sharing media within a chat requires you to tap a plus button to reveal the app's custom share sheet, and then tap into photos to see your full library, which takes over most of the screen. As spotted by app tinkerer WABetaInfo, the updated media sharing interface makes it easier to directly browse recent photos and videos without losing the thread of the conversation, thanks to a new recents section. The recents section appears under the share menu icons as a compact 4x4 grid that acts as a horizontal strip that you can swipe through. If you keep scrolling to the end of the strip and still can't find what you're looking for, WhatsApp expands the view and reveals the full media gallery. It can also be quickly invoked by pressing and holding on the plus button in the input bar. The new interface is showing up for some users of the latest WhatsApp for iOS 26.19.75, but not everyone who updates will see it immediately. It seems WhatsApp is still testing performance before a global rollout for iPhone users. The latest change follows the recent introduction of WhatsApp's new Plus subscription for power users on iOS. It takes away nothing of the existing free functionality, but adds things like premium sticker packs, new interface colors, and new icons.Tags: WABetaInfo, WhatsAppThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
01:40 pm
Apple Re-Releases a Sold-Out iPhone MagSafe Grip in Three New Colors | MacRumors
Apple Re-Releases a Sold-Out iPhone MagSafe Grip in Three New Colors
Apple today re-released the Hikawa Grip & Stand for iPhone in three new colors, after the original version sold out last year. The accessory is available to order on Apple's online store worldwide, with U.S. pricing set at $54.95. The latest color options include Orange Swirl, Glow Blue, and Speckled Stone. Designed by Bailey Hikawa and produced by PopSockets, Apple says the accessory was created with accessibility in mind, in close collaboration with individuals with a wide range of disabilities affecting grip, strength, and mobility. The ergonomic grip magnetically attaches to any iPhone with MagSafe, and it doubles as an iPhone stand. Apple says the grip is made with "premium silicone with a soft touch feel." Given the accessory is no longer a limited-edition product and is now being mass produced by PopSockets, hopefully supply will be more plentiful this time around. At the time of this writing, Apple's online store in the U.S. is currently showing mid-June delivery estimates for the grip, so there is still a one-month wait.Tags: Accessibility, Hikawa, MagSafe, PopSocketsThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
01:31 pm
Ray-Ban Meta Smart Glasses On Sale for Up to 25% Off This Week | MacRumors
Ray-Ban Meta Smart Glasses On Sale for Up to 25% Off This Week
Ray-Ban has kicked off a major discount across numerous retailers this week, taking 15 percent off the second generation Meta smart glasses, and 25 percent off the first generation. We're tracking these deals at Amazon and Best Buy below, and they are set to last through May 26. Note: MacRumors is an affiliate partner with some of these vendors. When you click a link and make a purchase, we may receive a small payment, which helps us keep the site running. Starting with the new Ray-Ban Meta Wayfarer (Gen 2), you can get these sunglasses starting at $322.15, down from $379.00. Both Amazon and Best Buy have this deal, along with numerous other options with different lens colors and frame colors. $57 OFFRay-Ban Meta (Gen 2) Wayfarer for $322.15 For the first generation models, you can get the Ray-Ban Meta Wayfarer for $223.99, down from $299.00. Both models have a free delivery estimated by the end of this week, with many locations offering same-day delivery on Amazon as well. $75 OFFRay-Ban Meta (Gen 1) Wayfarer for $223.99 The Ray-Ban Meta smart glasses allow you to take hands-free photos and short videos, listen to music, make phone calls, and ask Meta AI questions. You can also livestream directly through Instagram or Facebook with the glasses. The big difference between each generation is in improved photo and video quality on the gen 2, plus better battery life. If you're on the hunt for more discounts, be sure to visit our Apple Deals roundup where we recap the best Apple-related bargains of the past week. Deals Newsletter Interested in hearing more about the best deals you can find in 2026? Sign up for our Deals Newsletter and we'll keep you updated so you don't miss the biggest deals of the season! Related Roundup: Apple DealsThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »
01:08 pm
Fortnite Returns to the App Store Worldwide as Epic Signals 'Final Battle' With Apple | MacRumors
Fortnite Returns to the App Store Worldwide as Epic Signals 'Final Battle' With Apple
Fortnite is back on the App Store in every country except Australia, Epic Games announced today, as the company declared it is entering the "final battle" of its long-running legal dispute with Apple. Epic said the decision to push Fortnite back onto iOS globally was prompted by Apple's own words to the U.S. Supreme Court, in which Apple acknowledged that "regulators around the world are watching this case to determine what commission rate Apple may charge on covered purchases in huge markets outside the United States." Epic CEO Tim Sweeney framed the move as a strategic provocation, writing on X that the return marks "the beginning of the end of the Apple Tax worldwide." The return follows Fortnite's reinstatement to the U.S. App Store in May 2025 after nearly five years off the platform. The return was forced after District Judge Yvonne Gonzalez Rogers threatened to require the Apple official overseeing app decisions to appear in court, which prompted Apple to approve the submission. Today's worldwide rollout extends that comeback to most remaining markets, with Epic expressing confidence that an upcoming court-ordered transparency process will expose what the company calls Apple's "junk fees." Apple knows the U.S. federal court will force it to be transparent about how it charges its App Store fees. Fortnite is returning to the App Store now because we are confident that once Apple is forced to show its costs, governments around the world will not allow Apple junk fees to stand. In late April, the Ninth Circuit Court of Appeals reversed a stay that had allowed Apple to pause its compliance with rulings on ‌App Store‌ fees, sending the case back to Judge Gonzalez Rogers to determine what commission Apple can charge on purchases made via external links, if any. Epic said it will "continue to challenge Apple's anticompetitive ‌App Store‌ practices of banning alternative app stores and competition in payments," pointing to regulatory momentum in Japan, the European Union, and the United Kingdom. The company alleged that Apple has "evaded the laws with scare screens, fees and onerous requirements" in each of those jurisdictions. Australia is the one major market where Fortnite has not returned. Epic said it won its court case there and that an Australian court found many of Apple's developer terms to be unlawful, but Apple continues to enforce those terms regardless. Epic said it cannot return "under an illegal payment arrangement" and is waiting for a court order to compel Apple to comply.Tags: Apple Antitrust, App Store, Australia, Epic Games, Epic Games vs. AppleThis article, "" first appeared on MacRumors.comDiscuss this article in our forums
Read more »

Older posts

Monday May 11
05:25 pm
New and improved: Agent governance, intelligent workflows, and connected app experiences | Office for Mac
New and improved: Agent governance, intelligent workflows, and connected app experiences
See what's new in Copilot Studio, April 2026: updates to workflows, increased control over agent operations, and an expanded agent usage estimator. The post appeared first on Microsoft 365 Blog.
Read more »
Tuesday May 05
10:00 am
Microsoft 365 Copilot, human agency, and the opportunity for every organization | Office for Mac
Microsoft 365 Copilot, human agency, and the opportunity for every organization
As AI and agents take on more of the execution, people have more agency than ever to unlock their ambition, direct what gets done, and own the outcomes. The post appeared first on Microsoft 365 Blog.
Read more »
10:00 am
Copilot Cowork: From conversation to action across skills, integrations, and devices | Office for Mac
Copilot Cowork: From conversation to action across skills, integrations, and devices
Today, we’re announcing additional capabilities in Cowork to expand on what it can make possible for you. The post appeared first on Microsoft 365 Blog.
Read more »
Friday May 01
03:00 pm
Microsoft Agent 365, now generally available, expands capabilities and integrations | Office for Mac
Microsoft Agent 365, now generally available, expands capabilities and integrations
Microsoft Agent 365 helps you take control of agent sprawl as your control plane to observe, govern, and secure agents and their interactions. The post appeared first on Microsoft 365 Blog.
Read more »
Thursday April 23
12:00 am
Copilot’s agentic capabilities in Word, Excel, and PowerPoint are generally available | Office for Mac
Copilot’s agentic capabilities in Word, Excel, and PowerPoint are generally available
From first draft to final polish, Copilot acts as a true collaborator, taking action while you stay in control. The post appeared first on Microsoft 365 Blog.
Read more »
Monday April 13
03:00 pm
Bring your everyday business apps into the flow of work with agents in Microsoft 365 Copilot | Office for Mac
Bring your everyday business apps into the flow of work with agents in Microsoft 365 Copilot
Microsoft 365 Copilot can now bring your go-to apps directly into the conversation, which closes the gap between AI-powered insight and real, in-app action. The post appeared first on Microsoft 365 Blog.
Read more »
Wednesday April 01
09:45 pm
New and improved: Multi-agent orchestration, connected experiences, and faster prompt iteration | Office for Mac
New and improved: Multi-agent orchestration, connected experiences, and faster prompt iteration
Learn what’s new in Copilot Studio: Multi-agent systems are now generally available, plus recent updates to the Prompt Editor and governance controls. The post appeared first on Microsoft 365 Blog.
Read more »
Monday March 30
01:00 pm
Copilot Cowork: Now available in Frontier | Office for Mac
Copilot Cowork: Now available in Frontier
Today, Copilot Cowork—designed for long-running, multi-step work in Microsoft 365—is available via the Frontier program. The post appeared first on Microsoft 365 Blog.
Read more »
Wednesday March 25
01:00 pm
New In-App Purchase and subscription data now available in Analytics | ADC Headlines
New In-App Purchase and subscription data now available in Analytics
Analytics in App Store Connect receives its biggest update since its launch, including a refreshed user experience that makes it easier to measure the performance of your apps and games. Updates include: More than 100 new metrics. Now you can access monetization and subscription data in Analytics to better understand the performance of your In-App Purchases and offers. New cohort capabilities. Analyze user behavior based on common attributes — such as download date, download source, offer start date, and more — to measure how a particular group of users performs over time. For example, if you’ve expanded your app to a new region, you can monitor how long it takes users in that region to make a purchase compared to other more established regions. Cohort data is aggregated to ensure user privacy. New peer group benchmarks. Discover how you stack up to peers with two new monetization benchmarks: download-to-paid conversion and proceeds per download. Benchmarks incorporate differential privacy techniques to protect individual developer performance while also providing meaningful and actionable insights. Two new subscription reports. Export these via the Analytics Reports API to perform offline analysis and integrate Analytics into your own data systems. Additional filters. Apply up to seven filters to your selected metrics at once allowing you to drill down further and uncover additional insights. App Store Analytics Guide. This new guide in App Store Connect Help enables you to develop a data-driven strategy and understand App Store tools and features you can use to grow your business. Learn about measuring performance with AnalyticsRead the new Analytics guide
Read more »

Reviews & KoolTools

Unbreakable Style: The Best Hardshell Phone Cases on the Market

Are you looking for the ultimate protection for your smartphone? Hardshell phone cases are the answer. These cases are designed to withstand impact. They keep your phone safe from drops and scratches. In a world full of choices, how do you find the best? We have...

Plugable’s 5-in-1 USB Hub expands your MacBook Pro or MacBook Air’s connection options

The new 5-in-1 USB-C hub from Plugable turns two Mac laptop ports into (as the name implies) five, including Ethernet and more. Designed specifically for MacBook Pro and MacBook Air models, the hub (with the moniker AMS-5IN1E) fits flush against the host Mac and adds...

More Reviews & KoolTools

Community and More

MacTech Events and COVID

Due to the pandemic, the regional MacTech Pro events were pushed into 2021 — as early as reasonably possible. This means at best, early in the third quarter of the year. But depending on guidance and public health, it could be later than that. Once there are details,...

More Community

Software & Services Scanners

Monday May 18
08:48 pm
CISA Admin Leaked AWS GovCloud Keys on Github | Krebs on Security
CISA Admin Leaked AWS GovCloud Keys on Github
Until this past weekend, a contractor for the Cybersecurity & Infrastructure Security Agency (CISA) maintained a public GitHub repository that exposed credentials to several highly privileged AWS GovCloud accounts and a large number of internal CISA systems. Security experts said the public archive included files detailing how CISA builds, tests and deploys software internally, and that it represents one of the most egregious government data leaks in recent history.
Read more »
Tuesday May 12
09:46 pm
Patch Tuesday, May 2026 Edition | Krebs on Security
Patch Tuesday, May 2026 Edition
Artificial intelligence platforms may be just as susceptible to social engineering as human beings, but they are proving remarkably good at finding security vulnerabilities in human-made computer code. That reality is on full display this month with some of the more widely-used software makers -- including Apple, Google, Microsoft, Mozilla and Oracle -- fixing near record volumes of security bugs, and/or quickening the tempo of their patch releases.
Read more »
Friday May 08
02:58 am
Canvas Breach Disrupts Schools & Colleges Nationwide | Krebs on Security
Canvas Breach Disrupts Schools & Colleges Nationwide
An ongoing data extortion attack targeting the widely-used education technology platform Canvas disrupted classes and coursework at school districts and universities across the United States today, after a cybercrime group defaced the service's login page with a ransom demand that threatened to leak data from 275 million students and faculty across nearly 9,000 educational institutions.
Read more »
Tuesday May 05
04:16 pm
Vulnerability Summary for the Week of April 27, 2026 | US-CERT Alerts
Vulnerability Summary for the Week of April 27, 2026
High Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info Patch Info n/a-- OVMS3 3.3.005 Buffer overflow vulnerability in Open Vehicle Monitoring System 3 (OVMS3) 3.3.005. In canformat_gvret.cpp, the length field in GVRET binary data is not properly validated, allowing remote attackers to cause a denial of service or possibly execute arbitrary code via crafted GVRET frames. 2026-05-01 10 CVE-2026-37541 https://github.com/openvehicles/Open-Vehicle-Monitoring-System-3https://gist.github.com/sgInnora/f4ac66faeefe07a653ceeb3f58cdc381 tendacn[.]com-- W308R Tenda W308R v2 V5.07.48 contains a cookie session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient session validation. Attackers can send GET requests to the goform/AdvSetDns endpoint with a crafted admin language cookie to change DNS servers and redirect user traffic to malicious sites. 2026-04-29 9.8 CVE-2018-25316 ExploitDB-44373VulnCheck Advisory: Tenda W308R v2 V5.07.48 Cookie Session Weakness DNS Change tendacn[.]com--W3002R Tenda W3002R/A302/W309R wireless routers version V5.07.64_en contain a cookie session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient session validation. Attackers can send GET requests to the /goform/AdvSetDns endpoint with a crafted admin language cookie to change primary and secondary DNS servers, redirecting user traffic to malicious DNS servers. 2026-04-29 9.8 CVE-2018-25317 ExploitDB-44380VulnCheck Advisory: Tenda W3002R/A302/W309R V5.07.64_en Cookie Session Weakness DNS Change tendacn[.]com--FH303/A300 Tenda FH303/A300 firmware V5.07.68_EN contains a session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient cookie validation. Attackers can send GET requests to the /goform/AdvSetDns endpoint with a crafted admin cookie to change DNS servers and redirect user traffic to malicious sites. 2026-04-29 9.8 CVE-2018-25318 ExploitDB-44381VulnCheck Advisory: Tenda FH303/A300 V5.07.68_EN Cookie Session Weakness DNS Change Weaver Network Co., Ltd.--E-office Weaver (Fanwei) E-office versions prior to 10.0_20221201 contain an unauthenticated arbitrary file upload vulnerability in the OfficeServer.php endpoint that allows remote attackers to upload malicious files by sending multipart POST requests with arbitrary filenames and disguised content types. Attackers can upload PHP webshells to the Document directory and execute them via HTTP GET requests to achieve remote code execution as the web server user. Exploitation evidence was first observed by the Shadowserver Foundation on 2022-10-10 (UTC). 2026-04-30 9.8 CVE-2022-50993 https://service.e-office.cn/knowledge/detail/5https://cn-sec.com/archives/1453025.htmlhttps://bbs.chaitin.cn/topic/37https://www.vulncheck.com/advisories/weaver-e-office-10-0-20221201-unauthenticated-arbitrary-file-read-via-xmlrpcservlet synway[.]net-- SMG Gateway Management Synway SMG Gateway Management Software contains an OS command injection vulnerability in the RADIUS configuration endpoint at /en/9-2radius.php where the radius_address POST parameter is split and interpolated directly into a sed command without sanitization. An unauthenticated remote attacker can inject arbitrary shell commands by submitting a POST request with crafted radius_address, radius_address2, shared_secret2, source_ip, timeout, or retry parameters along with save=1 and enable_radius=1 to achieve remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-07-11 (UTC). 2026-04-30 9.8 CVE-2025-71284 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/synway/synwaysmg-radius-rce.yamlhttps://mrxn.net/jswz/synway-9-2radius-rce.htmlhttps://mp.weixin.qq.com/s/PyepoFSuQ63E3RnpQa9nsAhttps://www.synway.net/https://www.vulncheck.com/advisories/synway-smg-gateway-management-software-os-command-injection-via-radius-address Directorist Booking--Directorist Booking Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Directorist Booking allows SQL Injection.This issue affects Directorist Booking: from n/a before 3.0.2. 2026-04-27 9.3 CVE-2026-22336 https://patchstack.com/database/wordpress/plugin/directorist-booking/vulnerability/wordpress-directorist-booking-plugin-2-4-1-sql-injection-vulnerability?_s_id=cve Directorist--Directorist Social Login Incorrect Privilege Assignment vulnerability in Directorist Directorist Social Login allows Privilege Escalation.This issue affects Directorist Social Login: from n/a before 2.1.4. 2026-04-27 9.8 CVE-2026-22337 https://patchstack.com/database/wordpress/plugin/directorist-social-login/vulnerability/wordpress-directorist-social-login-plugin-2-1-1-privilege-escalation-vulnerability?_s_id=cve Milesight--MS-Cxx63-PD Specific firmware versions of Milesight AIOT cameras use SSL certificates with default private keys. 2026-04-27 9.8 CVE-2026-32644 https://www.cisa.gov/news-events/ics-advisories/icsa-26-113-03https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-113-03.jsonhttps://www.milesight.com/support/download/firmware n/a--Automotive Grade Linux (AGL) AGL app-framework-main thru 17.1.12 contains a Zip Slip path traversal vulnerability (CWE-22) combined with a TOCTOU race condition (CWE-367) in the widget installation flow. The is_valid_filename function in wgtpkg-zip.c validates ZIP entry names but does not check for dot notation directory traversal sequences it only blocks absolute paths. The zread extraction function uses openat(workdirfd, filename, O_CREAT) which resolves dot notation values relative to the work directory, allowing files to be written anywhere on the filesystem. Critically, in function install_widget in file wgtpkg-install.c, extraction via zread occurs BEFORE signature verification via check_all_signatures. Even if signature verification fails, the error cleanup (remove_workdir) only deletes the temporary work directory files written outside via path traversal persist permanently. 2026-05-01 9.8 CVE-2026-37531 https://gerrit.automotivelinux.org/gerrit/src/app-framework-mainhttps://gist.github.com/sgInnora/8526eedcfd826d05ef1fc45d8f405643 n/a-- cannelloni v2.0.0 Buffer overflow vulnerability in cannelloni v2.0.0 in CAN frame parsing in parser.cpp in function parseCANFrame, and decoder.cpp in function decodeFrame allowing remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted CAN FD frames. 2026-05-01 9.8 CVE-2026-37539 https://github.com/mguentner/cannellonihttps://gist.github.com/sgInnora/f4ac66faeefe07a653ceeb3f58cdc381 Carlson Software--VASCO-B GNSS Receiver The Carlson VASCO-B GNSS Receiver lacks an authentication mechanism, allowing an attacker with network access to directly access and modify its configuration and operational functions without needing credentials. 2026-04-28 9.4 CVE-2026-3893 https://www.carlsonsw.com/support-and-training/https://www.cve.org/CVERecord?id=CVE-2026-3893https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-113-02.json Mersenne--Prime95 Prime95 29.4b8 contains a local buffer overflow vulnerability that allows attackers to execute arbitrary code by exploiting structured exception handling (SEH) mechanisms. Attackers can inject malicious payload through the optional proxy hostname field in the PrimeNet connection settings to trigger the overflow and execute system commands. 2026-04-29 8.4 CVE-2018-25299 ExploitDB-44649Official Product HomepageProduct ReferenceVulnCheck Advisory: Prime95 29.4b8 Local Buffer Overflow via SEH xataboost--XATABoost CMS XATABoost CMS 1.0.0 contains a union-based SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the id parameter. Attackers can send GET requests to news.php with malicious id values to extract sensitive database information. 2026-04-29 8.2 CVE-2018-25300 ExploitDB-44622Official Product HomepageVulnCheck Advisory: XATABoost CMS 1.0.0 SQL Injection via news.php Easy MPEG--Easy MPEG to DVD Burner Easy MPEG to DVD Burner 1.7.11 contains a structured exception handling (SEH) local buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying a malicious username string. Attackers can craft a payload containing junk data, SEH chain pointers, and shellcode that overwrites the SEH handler to redirect execution and run arbitrary commands like opening calc.exe. 2026-04-29 8.4 CVE-2018-25301 ExploitDB-44565Product ReferenceVulnCheck Advisory: Easy MPEG to DVD Burner 1.7.11 SEH Local Buffer Overflow Alloksoft--Allok Video to DVD Burner Allok Video to DVD Burner 2.6.1217 contains a stack-based buffer overflow vulnerability in the License Name field that allows local attackers to execute arbitrary code by triggering a structured exception handler (SEH) overwrite. Attackers can craft a malicious input string with 780 bytes of junk data followed by SEH chain pointers and shellcode, then paste it into the License Name field during registration to achieve code execution. 2026-04-29 8.4 CVE-2018-25303 ExploitDB-44518Official Product HomepageVulnCheck Advisory: Allok Video to DVD Burner 2.6.1217 Buffer Overflow SEH Filehippo--Free Download Manager Free Download Manager 2.0 Built 417 contains a local buffer overflow vulnerability in the URL import functionality that allows attackers to trigger a structured exception handler (SEH) chain exploitation. Attackers can craft a malicious URL file that, when imported through the File > Import > Import lists of downloads menu, causes a buffer overflow in the Location header response that overwrites the SEH chain and executes arbitrary code. 2026-04-29 8.4 CVE-2018-25304 ExploitDB-44499Product ReferenceVulnCheck Advisory: Free Download Manager 2.0 Built 417 Local Buffer Overflow SEH Sysgauge--SysGauge Pro SysGauge Pro 4.6.12 contains a local buffer overflow vulnerability in the Register function that allows local attackers to overwrite the structured exception handler by supplying a crafted unlock key. Attackers can inject shellcode through the Unlock Key field during registration to execute arbitrary code with application privileges. 2026-04-29 8.4 CVE-2018-25307 ExploitDB-44455VulnCheck Advisory: SysGauge Pro 4.6.12 Local Buffer Overflow SEH donmik--Buddypress Xprofile Custom Fields Type BuddyPress Xprofile Custom Fields Type 2.6.3 contains a remote code execution vulnerability that allows authenticated users to delete arbitrary files by manipulating unescaped POST parameters. Attackers can modify the field_hiddenfile and field_deleteimg parameters during profile editing to unlink files from the server. 2026-04-29 8.8 CVE-2018-25308 ExploitDB-44432Official Product HomepageVulnCheck Advisory: BuddyPress Xprofile Custom Fields Type 2.6.3 Remote Code Execution Alloksoft--WMV to AVI MPEG DVD WMV Converter Allok soft WMV to AVI MPEG DVD WMV Converter 4.6.1217 contains a buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying an oversized string in the License Name field. Attackers can craft a malicious input containing shellcode with structured exception handler (SEH) overwrite to bypass protections and execute code with application privileges. 2026-04-29 8.4 CVE-2018-25314 ExploitDB-44365Official Product HomepageProduct ReferenceVulnCheck Advisory: Allok soft WMV to AVI MPEG DVD WMV Converter 4.6.1217 Buffer Overflow Alloksoft--Video Joiner Alloksoft Video joiner 4.6.1217 contains a buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying a malicious string in the License Name field. Attackers can craft a payload with structured exception handler (SEH) overwrite and shellcode to achieve code execution when the application processes the license registration input. 2026-04-29 8.4 CVE-2018-25315 ExploitDB-44364Official Product HomepageProduct ReferenceVulnCheck Advisory: Alloksoft Video joiner 4.6.1217 Buffer Overflow via License Name marketingfire--Widget Options Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets The Widget Options - Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.2.2 via the Display Logic feature. This is due to the plugin using eval() on user-supplied Display Logic expressions with an insufficient blocklist/allowlist that can be bypassed using array_map with string concatenation, combined with a lack of authorization enforcement on the extended_widget_opts_block attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server. The vulnerability was partially patched in version 4.2.0. 2026-05-02 8.8 CVE-2026-2052 https://www.wordfence.com/threat-intel/vulnerabilities/id/68023557-fc92-4cf6-96b4-405ff5a5fd5a?source=cvehttps://plugins.trac.wordpress.org/browser/widget-options/trunk/includes/widgets/gutenberg/gutenberg-toolbar.php#L843https://plugins.trac.wordpress.org/browser/widget-options/trunk/includes/extras.php#L495https://plugins.trac.wordpress.org/browser/widget-options/trunk/includes/extras.php#L534https://plugins.trac.wordpress.org/changeset/3481338/https://plugins.trac.wordpress.org/changeset/3514411/ Milesight--MS-Cxx63-PD An out-of-bounds memory access vulnerability exists in specific firmware versions of Milesight AIOT cameras. 2026-04-27 8.8 CVE-2026-20766 https://www.cisa.gov/news-events/ics-advisories/icsa-26-113-03https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-113-03.jsonhttps://www.milesight.com/support/download/firmware wclovers--WCFM Frontend Manager for WooCommerce The WCFM - Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.25 via the 'wcfm_delete_wcfm_customer' due to missing validation on the 'customerid' user controlled key. This makes it possible for authenticated attackers, with Vendor-level access and above, to delete arbitrary users, including Administrators. 2026-05-02 8.1 CVE-2026-2554 https://www.wordfence.com/threat-intel/vulnerabilities/id/21e397a4-0b32-4b13-a46b-c465acea0796?source=cvehttps://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.24/core/class-wcfm-customer.php#L386https://plugins.trac.wordpress.org/changeset/3483695/ opencats--OpenCATS OpenCATS prior to commit 3002a29 contains a PHP code injection vulnerability in the installer AJAX endpoint that allows unauthenticated attackers to execute arbitrary code by injecting PHP statements into the databaseConnectivity action parameter. Attackers can break out of the define() string context in config.php using a single quote and statement separator to inject malicious PHP code that persists and executes on every subsequent page load when the installation wizard remains incomplete. 2026-04-28 8.1 CVE-2026-27760 https://chocapikk.com/posts/2026/opencats-installer-rce/https://github.com/opencats/OpenCATS/pull/706https://github.com/opencats/OpenCATS/commit/3002a29f4c3cada1aa2c4f3d4ae4e189906606b6https://github.com/opencats/OpenCATS/blob/46e4727/lib/CATSUtility.php#L142-L172https://github.com/opencats/OpenCATS/blob/46e4727/modules/install/ajax/ui.php#L130https://www.vulncheck.com/advisories/opencats-php-code-injection-via-installer-ajax-endpoint Milesight--MS-Cxx63-PD Specific firmware versions of Milesight AIOT camera firmware contain hard-coded credentials. 2026-04-27 8.8 CVE-2026-27785 https://www.cisa.gov/news-events/ics-advisories/icsa-26-113-03https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-113-03.jsonhttps://www.milesight.com/support/download/firmware Cockpit--Cockpit CMS Cockpit CMS contains an authenticated remote code execution vulnerability in the /cockpit/collections/save_collection endpoint that allows authenticated attackers with collection management privileges to inject arbitrary PHP code into collection rules parameters. Attackers can inject malicious PHP code through rule parameters which is written directly to server-side PHP files and executed via include() to achieve arbitrary command execution on the underlying server. 2026-04-29 8.8 CVE-2026-34965 https://github.com/agentejo/cockpithttps://gist.github.com/thepiyushkumarshukla/64d2318518b17f529bc3ccb11fd5be90https://github.com/agentejo/cockpit/commits/494765e4f0fb9484f320aee0c6ee889b6fa789b9https://www.vulncheck.com/advisories/cockpit-cms-authenticated-remote-code-execution-via-collections n/a--(UDS) & OBD-II (On Board Diagnostics for Vehicles) miaofng/uds-c commit e506334e270d77b20c0bc259ac6c7d8c9b702b7a (2016-10-05) contains a stack buffer overflow in send_diagnostic_request. A 6-byte stack buffer (MAX_DIAGNOSTIC_PAYLOAD_SIZE=6) receives memcpy at offset 1+pid_length with payload_length bytes. MAX_UDS_REQUEST_PAYLOAD_LENGTH=7, so 1+2+7=10 exceeds buffer by 4 bytes. No bounds check on payload_length before memcpy. 2026-05-01 8.8 CVE-2026-37536 https://github.com/miaofng/uds-chttps://github.com/openxc/uds-chttps://gist.github.com/sgInnora/f4ac66faeefe07a653ceeb3f58cdc381 n/a--Open-SAE-J1939 (Daniel Martensson) collin80/Open-SAE-J1939 thru commit 744024d4306bc387857dfce439558336806acb06 (2023-03-08) contains an integer underflow leading to out-of-bounds write in Transport Protocol Data Transfer handling. At line 23: uint8_t index = data[0] - 1. When data[0] (sequence number from CAN frame) is 0, index underflows to 255. Subsequent write at tp_dt- >data[255*7 + i-1] reaches offset 1791, exceeding the MAX_TP_DT buffer (1785 bytes) by 6 bytes. 2026-05-01 8.1 CVE-2026-37537 https://github.com/DanielMartensson/Open-SAE-J1939https://github.com/collin80/Open-SAE-J1939https://gist.github.com/sgInnora/f4ac66faeefe07a653ceeb3f58cdc381 openampproject[.]org--OpenAMP v2025.10.0 OpenAMP v2025.10.0 ELF loader contains an integer overflow vulnerability in firmware image parsing. In elf_loader.c, it performs multiplication of two attacker-controlled 16-bit values from the ELF header without overflow checking. On 32-bit embedded systems (STM32MP1, Zynq, i.MX), large values can cause the product to wrap around to a small value. 2026-05-01 8.4 CVE-2026-37540 https://github.com/OpenAMP/open-amphttps://github.com/OpenAMP/open-amp/blob/main/lib/remoteproc/elf_loader.chttps://gist.github.com/sgInnora/f4ac66faeefe07a653ceeb3f58cdc381 n/a--MixPHP Framework 2.x Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The sync-invoke TCP server (Server.php:87) receives data from a TCP socket, passes it directly to OpisClosureunserialize(), then executes the result via call_user_func(). No authentication or signature verification exists on the TCP connection. An attacker with access to the localhost TCP port (server binds 127.0.0.1) can send a crafted serialized PHP closure to achieve arbitrary code execution. 2026-05-01 8.4 CVE-2026-37552 https://github.com/mix-php/mixhttps://github.com/mix-php/mix/blob/v2.2.17/src/sync-invoke/src/Server.phphttps://gist.github.com/sgInnora/fa46386840fe978a30d7e53c458f2975 benjaminprojas--WP Editor The WP Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.9.2. This is due to missing nonce verification in the 'add_plugins_page' and 'add_themes_page' functions. This makes it possible for unauthenticated attackers to overwrite arbitrary plugin and theme PHP files with attacker-controlled code via a forged request, granted they can trick a site administrator into performing an action such as clicking a link. 2026-05-01 8.8 CVE-2026-3772 https://www.wordfence.com/threat-intel/vulnerabilities/id/b1bc4a87-d5de-4d66-9cc5-802ef11f886c?source=cvehttps://plugins.trac.wordpress.org/browser/wp-editor/trunk/classes/WPEditorPlugins.php#L60https://plugins.trac.wordpress.org/browser/wp-editor/trunk/classes/WPEditorThemes.php#L103https://plugins.trac.wordpress.org/changeset/3480577/ chartbrew--chartbrew Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, Chartbrew allows authenticated users with access to one project to update or delete a SharePolicy record that belongs to a different project. The affected routes authorize the caller against the project in the URL path, but they never verify that policy_id belongs to that project. This permits cross-project modification of dashboard sharing rules, including visibility, password requirements, allowed parameters, and expiration settings. This issue has been patched in version 5.0.0. 2026-04-30 8.1 CVE-2026-40600 https://github.com/chartbrew/chartbrew/security/advisories/GHSA-pq8h-2h99-39xmhttps://github.com/chartbrew/chartbrew/releases/tag/v5.0.0 TRENDnet--TEW-821DAP A security vulnerability has been detected in TRENDnet TEW-821DAP 1.12B01. Impacted is the function auto_update_firmware of the component Firmware Udpate. The manipulation of the argument str leads to buffer overflow. The attack may be initiated remotely. The vendor explains: "That firmware version will only work on our hardware version v1.xR. We have already EOL that product 8 years ago and are no longer selling". This vulnerability only affects products that are no longer supported by the maintainer. 2026-05-02 8.8 CVE-2026-7607 VDB-360564 | TRENDnet TEW-821DAP Firmware Udpate auto_update_firmware buffer overflowVDB-360564 | CTI Indicators (IOB, IOC, IOA)Submit #806214 | Trendnet TEW-821DAP v1.12B01 CWE-120 Buffer Copy without Checking Size of Inputhttps://github.com/IOTRes/IOT_Firmware_Update/blob/main/Trendnet/TEW-821DAP_BO.md carazo--Import and export users and customers The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 2.0.8 via the `save_extra_user_profile_fields()` function. This is due to an incomplete blocklist that correctly restricts capability meta keys for the primary site (e.g., `wp_capabilities`, `wp_user_level`) but fails to block the equivalent meta keys for any other subsite in a WordPress Multisite network (e.g., `wp_2_capabilities`, `wp_2_user_level`), allowing these keys to pass the `in_array()` check and be written directly to user meta via `update_user_meta()`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to escalate their privileges to Administrator on any subsite within the Multisite network by submitting a crafted profile update to `/wp-admin/profile.php`. Exploitation requires that an administrator has previously imported a CSV file containing multisite-prefixed capability column headers and has enabled the 'Show fields in profile?' option, which causes those keys to be stored in the `acui_columns` option and exposed as editable fields on the user profile page. 2026-05-02 8.8 CVE-2026-7641 https://www.wordfence.com/threat-intel/vulnerabilities/id/368cff00-6a86-443e-aec4-4115a229a3c1?source=cvehttps://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/trunk/classes/columns.php#L221https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.8/classes/columns.php#L221https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/trunk/classes/columns.php#L198https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.8/classes/columns.php#L198https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/trunk/classes/helper.php#L150https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.8/classes/helper.php#L150https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/trunk/classes/multisite.php#L21https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.8/classes/multisite.php#L21https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.6/classes/columns.php#L221https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.6/classes/columns.php#L198https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.6/classes/helper.php#L150https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.6/classes/multisite.php#L21https://plugins.trac.wordpress.org/changeset/3515646 Cozmoslabs--Profile Builder Pro The Profile Builder Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 3.14.5. This is due to the use of PHP's maybe_unserialize() function on the attacker-controlled 'args' POST parameter within the wppb_request_users_pins_action_callback() AJAX handler, which lacked any nonce verification, type checking, or input validation before deserialization. Because the handler was registered with both wp_ajax_ and wp_ajax_nopriv_ hooks, it was reachable by completely unauthenticated users. This makes it possible for unauthenticated attackers to inject arbitrary PHP objects into application memory. 2026-05-02 8.1 CVE-2026-7647 https://www.wordfence.com/threat-intel/vulnerabilities/id/c7b897f5-f988-4515-83bc-456f041d7e2e?source=cvehttps://plugins.trac.wordpress.org/browser/profile-builder-pro/trunk/add-ons/user-listing/one-map-listing.php#L271https://plugins.trac.wordpress.org/browser/profile-builder-pro/tags/3.14.5/add-ons/user-listing/one-map-listing.php#L271https://plugins.trac.wordpress.org/browser/profile-builder-pro/trunk/add-ons/user-listing/one-map-listing.php#L13https://plugins.trac.wordpress.org/browser/profile-builder-pro/tags/3.14.5/add-ons/user-listing/one-map-listing.php#L13 Shenzhen Libituo Technology--LBT-T300-HW1 A flaw has been found in Shenzhen Libituo Technology LBT-T300-HW1 up to 1.2.8. This issue affects the function start_single_service of the component Web Management Interface. Executing a manipulation of the argument vpn_pptp_server/vpn_l2tp_server can lead to buffer overflow. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-03 8.8 CVE-2026-7674 VDB-360827 | Shenzhen Libituo Technology LBT-T300-HW1 Web Management start_single_service buffer overflowVDB-360827 | CTI Indicators (IOB, IOC, IOA)Submit #800705 | Libtor Technology lbt-t300-hw1 closure, xreq). The NULL propagation chain through afb-context.c:110 (context- >credentials = afb_cred_addref(NULL)) and afb-cred.c:163 (returns NULL when cred is NULL) confirms that credentials are zeroed before the target API executes. The attacker controls both api and verb parameters via JSON input, allowing execution of any registered API with a NULL credential context. APIs that rely on context- >credentials for authorization decisions may fail open when receiving NULL credentials, enabling privilege escalation. This vulnerability was introduced in commit abbb4599f0b921c6f434b6bd02bcfb277eecf745 on 2018-02-14. 2026-05-01 7.8 CVE-2026-37525 https://gerrit.automotivelinux.org/gerrit/src/app-framework-binderhttps://gist.github.com/sgInnora/8526eedcfd826d05ef1fc45d8f405643 n/a--Automotive Grade Linux (AGL) afb-daemon v19.90.0 AGL app-framework-binder (afb-daemon) through v19.90.0 allows any local process to execute privileged supervision commands (Exit, Do, Sclose, Config, Trace, Debug, Token, slist) without authentication via the abstract Unix socket @urn:AGL:afs:supervision:socket. The on_supervision_call function in src/afb-supervision.c dispatches all 8 commands without any credential verification. The abstract socket has no DAC protection, as acknowledged in the official CAUTION comment in src/afs-supervision.h. This allows a low-privileged local process to kill the daemon (DoS via Exit command), execute arbitrary API calls (via Do command), close arbitrary user sessions (via Sclose command), or leak the entire global configuration (via Config command). The vulnerability was introduced in commit b8c9d5de384efcfa53ebdb3f0053d7b3723777e1 on 2017-06-29. 2026-05-01 7.8 CVE-2026-37526 https://gerrit.automotivelinux.org/gerrit/src/app-framework-binderhttps://gist.github.com/sgInnora/8526eedcfd826d05ef1fc45d8f405643 n/a--Automotive Grade Linux (AGL) aglservice v17.1.12 AGL agl-service-can-low-level thru 17.1.12 contains a heap buffer over-read in the isotp-c library. In isotp_continue_receive (receive.c:87-89), the payload_length for a Single Frame is extracted from a 4-bit nibble in the CAN frame data, yielding values 0-15. However, a standard CAN frame is only 8 bytes, with payload starting at data[1] (7 bytes available). When payload_length exceeds the available data (e.g., nibble=15 but only 7 payload bytes exist), memcpy(message.payload, &data[1], payload_length) reads up to 8 bytes past the end of the data buffer. 2026-05-01 7.1 CVE-2026-37532 https://gerrit.automotivelinux.org/gerrit/apps/agl-service-can-low-levelhttps://gist.github.com/sgInnora/8526eedcfd826d05ef1fc45d8f405643 n/a--Automotive Grade Linux (AGL) isotp-c openxc/isotp-c thru commit 5a5d19245f65189202719321facd49ce6f5d46ac (2021-08-09) contains an out-of-bounds read in the ISO-TP Single Frame receive handler, where the 4-bit payload length nibble is used directly as the memcpy size without validating it against the actual CAN data length. A malicious CAN frame with an oversized length nibble can cause memory reads beyond the buffer, allowing attackers to cause a denial of service, or gain sensitive information. 2026-05-01 7.1 CVE-2026-37535 https://github.com/openxc/isotp-chttps://github.com/openxc/isotp-c/blob/master/src/isotp/receive.chttps://gist.github.com/sgInnora/f4ac66faeefe07a653ceeb3f58cdc381 n/a-- Vanetza V2X v26.02 An issue was discovered in Vanetza V2X v26.02 allowing remote unauthorized attackers to cause a denial of service. The vulnerability exists in the GeoNetworking packet processing pipeline where OpenSSL exceptions from ECC point validation (invalid compressed point, point not on curve) are not properly caught by the Router::indicate() call chain. The openssl_wrapper.cpp check() function (line 19) throws openssl::Exception when OpenSSL operations fail. The parser's catch block in parse_secured() should catch these, but the exception escapes through subsequent processing stages (indicate_common, indicate_extended). This causes std::terminate, crashing the V2X receiver. 2026-05-01 7.5 CVE-2026-37554 https://github.com/riebl/vanetzahttps://github.com/riebl/vanetza/blob/master/vanetza/security/openssl_wrapper.cpphttps://github.com/riebl/vanetza/blob/master/vanetza/geonet/router.cpphttps://gist.github.com/sgInnora/45128ae15d52df7238680a8f2da8359f chartbrew--chartbrew Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, Chartbrew exposes public chart retrieval and export routes that only verify project-level public access and, for exports, a team-level export toggle. The routes do not verify whether the target chart is actually allowed on the public report or whether the governing SharePolicy permits public access. An unauthenticated attacker who knows a chart identifier in a public project can read or export chart data for charts that were intentionally hidden from the report. This issue has been patched in version 5.0.0. 2026-04-30 7.5 CVE-2026-40595 https://github.com/chartbrew/chartbrew/security/advisories/GHSA-mq7q-6xh6-5649https://github.com/chartbrew/chartbrew/releases/tag/v5.0.0 cyberhobo--Geo Mashup The Geo Mashup plugin for WordPress is vulnerable to Time-Based SQL Injection via the 'sort' parameter in all versions up to, and including, 1.13.18. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. The `esc_sql()` function is applied but is ineffective in the `ORDER BY` context because the value is not enclosed in quotes. Additionally, while a `sanitize_sort_arg()` allowlist-based sanitizer was added in version 1.13.18, it is only applied in the AJAX code path (`sanitize_query_args()`) and not in the `render-map.php` or template tag code paths. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database via a time-based blind approach. 2026-05-02 7.5 CVE-2026-4060 https://www.wordfence.com/threat-intel/vulnerabilities/id/2fa5ae9a-532c-40f9-b70a-217f0f9cd473?source=cvehttps://plugins.trac.wordpress.org/browser/geo-mashup/trunk/geo-mashup-db.php#L1767https://plugins.trac.wordpress.org/browser/geo-mashup/trunk/geo-mashup-db.php#L1785https://plugins.trac.wordpress.org/browser/geo-mashup/trunk/render-map.php#L166https://plugins.trac.wordpress.org/changeset/3503627/ chartbrew--chartbrew Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, Chartbrew exposes POST /api/chart/:chart_id/query without authentication. The endpoint only checks team.allowReportRefresh and does not verify that the target chart belongs to a public report, that the project is public, or that sharing policy allows the operation. An unauthenticated attacker who knows a chart identifier can trigger a data refresh and retrieve the current data of private charts. This issue has been patched in version 5.0.0. 2026-04-30 7.5 CVE-2026-40601 https://github.com/chartbrew/chartbrew/security/advisories/GHSA-cpr6-mhgm-893whttps://github.com/chartbrew/chartbrew/releases/tag/v5.0.0 cyberhobo--Geo Mashup The Geo Mashup plugin for WordPress is vulnerable to Time-Based SQL Injection via the 'map_post_type' parameter in all versions up to, and including, 1.13.18. This is due to the `SearchResults` hook explicitly calling `stripslashes_deep($_POST)` which removes WordPress magic quotes protection, followed by the unsanitized `map_post_type` value being concatenated into an `IN(...)` clause without `esc_sql()` or `$wpdb- >prepare()`. The 'any' branch of the same code correctly applies `array_map('esc_sql', ...)`, but the else branch does not. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database via a time-based blind approach. Exploitation requires the Geo Search feature to be enabled in plugin settings. 2026-05-02 7.5 CVE-2026-4061 https://www.wordfence.com/threat-intel/vulnerabilities/id/cc3cf6c5-643e-49ca-b09c-bd7cfec328ee?source=cvehttps://plugins.trac.wordpress.org/browser/geo-mashup/trunk/geo-mashup-db.php#L1748https://plugins.trac.wordpress.org/browser/geo-mashup/trunk/php/Hooks/SearchResults.php#L39https://plugins.trac.wordpress.org/browser/geo-mashup/trunk/php/Search.php#L152https://plugins.trac.wordpress.org/changeset/3503627/ cyberhobo--Geo Mashup The Geo Mashup plugin for WordPress is vulnerable to Time-Based SQL Injection via the 'object_ids' and 'exclude_object_ids' parameters in all versions up to, and including, 1.13.18. This is due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL query. The `esc_sql()` function is applied but is ineffective because the values are placed in an unquoted `IN(...)` / `NOT IN(...)` SQL context - `esc_sql()` only escapes quote characters and provides no protection against parenthesis or SQL keyword injection. Additionally, while a numeric-only sanitizer exists in `sanitize_query_args()`, it is only applied in the AJAX code path and not in the `render-map.php` or template tag code paths. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database via a time-based blind approach. 2026-05-02 7.5 CVE-2026-4062 https://www.wordfence.com/threat-intel/vulnerabilities/id/abc5ed0a-504f-4d8c-9662-a4c9f7c7acb8?source=cvehttps://plugins.trac.wordpress.org/browser/geo-mashup/trunk/geo-mashup-db.php#L1755https://plugins.trac.wordpress.org/browser/geo-mashup/trunk/geo-mashup-db.php#L1759https://plugins.trac.wordpress.org/browser/geo-mashup/trunk/render-map.php#L166https://plugins.trac.wordpress.org/changeset/3503627/ n/a--libssh2 A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such manipulation of the argument username_len/password_len leads to integer overflow. The attack may be launched remotely. The name of the patch is 256d04b60d80bf1190e96b0ad1e91b2174d744b1. A patch should be applied to remediate this issue. 2026-05-01 7.3 CVE-2026-7598 VDB-360555 | libssh2 userauth.c userauth_password integer overflowVDB-360555 | CTI Indicators (IOB, IOC, IOA)Submit #805564 | libssh2 Shell interface, gaining root-level access to the device. 2026-04-29 4.3 CVE-2018-25310 ExploitDB-44387Vulnerability AdvisoryVulnCheck Advisory: VideoFlow Digital Video Protection DVP 10 Authenticated Remote Code Execution gnu--wget2 wget2 accepts a server certificate with incorrect Key Usage (KU) or Extended Key Usage (EKU). If the attackers compromise a certificate (with the associated private key) issued for a different purpose, they may be able to reuse it for TLS server authentication. 2026-04-29 4.8 CVE-2026-1858 https://www.tenable.com/security/research/tra-2026-37 wazuh--wazuh Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 1.0.0 to before version 4.14.4, a heap-based out-of-bounds WRITE occurs in GetAlertData, resulting in writing a NULL byte exactly 1 byte before the start of the buffer allocated by strdup. Due to unsigned integer underflow and pointer arithmetic wrapping, the write lands at offset -1 from the buffer, corrupting heap metadata. A malicious actor can potentially leverage this issue through a compromised agent to cause denial of service or heap corruption by injecting a specially crafted alert into the alerts log file monitored by wazuh-logcollector. This issue has been patched in version 4.14.4. 2026-04-29 4.4 CVE-2026-26204 https://github.com/wazuh/wazuh/security/advisories/GHSA-j4c7-hwjw-8857https://github.com/wazuh/wazuh/releases/tag/v4.14.4 Oracle Corporation--Oracle Linux An unprivileged attacker can craft a user-space process with a malicious ELF binary containing an out-of-range sh_link field. When root-level dtrace attaches to -- or instruments -- that process (via dtrace -p , pid probes, or USDT), the ELF parser reads heap memory beyond the allocated section cache array without any bounds check. This results in an uninitialized/out-of-bounds heap read that can cause a NULL pointer dereference crash of the dtrace process (DoS), or -- depending on heap layout -- a read-then-use of a garbage pointer controlled by adjacent allocations, providing a foothold toward further exploitation in a privileged context. 2026-05-01 4.4 CVE-2026-35233 Oracle Advisory n/a-- V2Board v1.7.4 SQL Injection via ORDER BY clause in V2Board thru 1.7.4. In app/Http/Controllers/Admin/UserController.php, the sort parameter from user input is passed directly to User::orderBy($sort, $sortType) without validation. An authenticated admin can sort users by any database column including password, remember_token, and other sensitive fields, enabling information disclosure through ordering analysis. 2026-05-01 4.9 CVE-2026-37505 https://github.com/v2board/v2boardhttps://gist.github.com/sgInnora/1330e1a82caa79906eec55eeff2c99b9 nextlevelbuilder--ui-ux-pro-max-skill A vulnerability has been found in nextlevelbuilder ui-ux-pro-max-skill up to 2.5.0. Affected by this issue is the function data.get of the file .claude/skills/design-system/scripts/generate-slide.py of the component Slide Generator. Such manipulation leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through a pull request but has not reacted yet. 2026-05-01 4.3 CVE-2026-7596 VDB-360549 | nextlevelbuilder ui-ux-pro-max-skill Slide Generator generate-slide.py data.get cross site scriptingVDB-360549 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #805510 | nextlevelbuilder ui-ux-pro-max-skill 2.5.0 Slide Generator Multiple Stored XSShttps://github.com/nextlevelbuilder/ui-ux-pro-max-skill/issues/247https://github.com/nextlevelbuilder/ui-ux-pro-max-skill/pull/274https://github.com/nextlevelbuilder/ui-ux-pro-max-skill/ n/a--Open5GS A vulnerability has been found in Open5GS up to 2.7.6. Affected is an unknown function of the file src/amf/gmm-handler.c of the component AMF. The manipulation of the argument reg_type leads to denial of service. The attack is possible to be carried out remotely. Upgrading to version 2.7.7 is able to address this issue. The identifier of the patch is ebc66942b6f8f1fab2d640e71cf4e9f1a423b426. It is advisable to upgrade the affected component. 2026-05-02 4.3 CVE-2026-7601 VDB-360558 | Open5GS AMF gmm-handler.c denial of serviceVDB-360558 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #805675 | Open5GS v.2.7.6 Denial of Servicehttps://github.com/open5gs/open5gs/issues/4321https://github.com/open5gs/open5gs/commit/ebc66942b6f8f1fab2d640e71cf4e9f1a423b426https://github.com/open5gs/open5gs/releases/tag/v2.7.7https://github.com/open5gs/open5gs/ itsourcecode--Courier Management System A vulnerability was determined in itsourcecode Courier Management System 1.0. Affected is an unknown function of the file /edit_user.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. 2026-05-02 4.7 CVE-2026-7612 VDB-360569 | itsourcecode Courier Management System edit_user.php sql injectionVDB-360569 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #806275 | itsourcecode Courier Management System V1.0 SQL Injectionhttps://github.com/ltranquility/submit/issues/12https://itsourcecode.com/ ChatGPTNextWeb--NextChat A flaw has been found in ChatGPTNextWeb NextChat up to 2.16.1. This impacts an unknown function of the file Next.js of the component API Endpoint. Executing a manipulation can lead to permissive cross-domain policy with untrusted domains. The attack may be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet. 2026-05-02 4.3 CVE-2026-7643 VDB-360755 | ChatGPTNextWeb NextChat API Endpoint Next.js cross-domain policyVDB-360755 | CTI Indicators (IOB, IOC, IOA)Submit #806833 | ChatGPTNextWeb NextChat 2.16.1 Permissive CORS Wildcard Policyhttps://github.com/ChatGPTNextWeb/NextChat/issues/6756https://github.com/ChatGPTNextWeb/NextChat/ n/a--crmeb_java A vulnerability was detected in crmeb_java up to 1.3.4. This vulnerability affects unknown code of the file crmeb/crmeb-service/src/main/java/com/zbkj/service/service/impl/UploadServiceImpl.java of the component Admin Upload. Performing a manipulation of the argument model results in unrestricted upload. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-03 4.7 CVE-2026-7673 VDB-360826 | crmeb_java Admin Upload UploadServiceImpl.java unrestricted uploadVDB-360826 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #800684 | crmeb crmeb_java 1.3.4 Unrestricted Uploadhttps://fx4tqqfvdw4.feishu.cn/docx/EgMOdHyq6oyxhux5vpJcr5cgnAf?from=from_copylink kerwincui--FastBee A vulnerability was found in kerwincui FastBee up to 1.2.1. The affected element is the function ToolController.download of the file springboot/fastbee-open-api/src/main/java/com/fastbee/data/controller/ToolController.java of the component Tool Download Endpoint. The manipulation of the argument fileName results in path traversal. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-03 4.3 CVE-2026-7676 VDB-360829 | kerwincui FastBee Tool Download Endpoint ToolController.java ToolController.download path traversalVDB-360829 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #800723 | kerwincui FastBee ≤ 1.2.1 Path Traversalhttps://fx4tqqfvdw4.feishu.cn/docx/Yv1gdAzFpoHCUUxDdKSculR4nKf?from=from_copylink jsbroks--COCO Annotator A weakness has been identified in jsbroks COCO Annotator up to 0.11.1. Affected is an unknown function of the file backend/webserver/api/datasets.py of the component Data Endpoint. Executing a manipulation of the argument folder can lead to path traversal. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-03 4.3 CVE-2026-7680 VDB-360833 | jsbroks COCO Annotator Data Endpoint datasets.py path traversalVDB-360833 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #801150 | jsbroks COCO Annotator 0.11.1 Absolute Path Traversalhttps://github.com/natanmorette-thoropass/thoropass-vuln-research-program/tree/main/2026/Path%20Traversal%20via%20Dataset%20Folder%20Parameter AMTT--Hotel Broadband Operation System A vulnerability was determined in AMTT Hotel Broadband Operation System 1.0. Affected is an unknown function of the file /manager/card/cardhand_submit.php. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-03 4.7 CVE-2026-7697 VDB-360866 | AMTT Hotel Broadband Operation System cardhand_submit.php sql injectionVDB-360866 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #803272 | Anmei Century (Beijing) Technology Co., Ltd. Hotel Broadband Operation System v1.0 SQL Injectionhttps://github.com/testnet0/testnet/issues/74 Telegram--Desktop A security vulnerability has been detected in Telegram Desktop up to 6.7.5. This vulnerability affects the function RequestButton of the file Telegram/SourceFiles/boxes/url_auth_box.cpp of the component Bot API. The manipulation of the argument login_url leads to null pointer dereference. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-03 4.3 CVE-2026-7701 VDB-360870 | Telegram Desktop Bot API url_auth_box.cpp RequestButton null pointer dereferenceVDB-360870 | CTI Indicators (IOB, IOC, IOA)Submit #804341 | Telegram Telegram Desktop
Read more »
Thursday April 30
02:04 pm
Anti-DDoS Firm Heaped Attacks on Brazilian ISPs | Krebs on Security
Anti-DDoS Firm Heaped Attacks on Brazilian ISPs
A Brazilian tech firm that specializes in protecting networks from distributed denial-of-service (DDoS) attacks has been enabling a botnet responsible for an extended campaign of massive DDoS attacks against other network operators in Brazil, KrebsOnSecurity has learned. The firm's chief executive says the malicious activity resulted from a security breach and was likely the work of a competitor trying to tarnish his company's public image.
Read more »
Monday April 27
04:22 pm
Vulnerability Summary for the Week of April 20, 2026 | US-CERT Alerts
Vulnerability Summary for the Week of April 20, 2026
High Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info Patch Info Thinkphp--ThinkPHP ThinkPHP 5.0.23 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by invoking functions through the routing parameter. Attackers can craft requests to the index.php endpoint with malicious function parameters to execute system commands with application privileges. 2026-04-22 9.8 CVE-2018-25270 ExploitDB-45978Official Product HomepageProduct ReferenceVulnCheck Advisory: ThinkPHP 5.0.23 Remote Code Execution via invokefunction Elba--ELBA5 ELBA5 5.8.0 contains a remote code execution vulnerability that allows attackers to obtain database credentials and execute arbitrary commands with SYSTEM level permissions. Attackers can connect to the database using default connector credentials, decrypt the DBA password, and execute commands via the xp_cmdshell stored procedure or add backdoor users to the BEDIENER table. 2026-04-22 9.8 CVE-2018-25272 ExploitDB-45905Official Product HomepageVulnCheck Advisory: ELBA5 5.8.0 Remote Code Execution via Database Access Lizardsystems--Terminal Services Manager Terminal Services Manager 3.1 contains a stack-based buffer overflow vulnerability in the computer names field that allows local attackers to execute arbitrary code by triggering structured exception handling. Attackers can craft a malicious input file with shellcode and jump instructions that overwrite the SEH handler pointer to execute calc.exe or other payloads when imported through the add computers wizard. 2026-04-22 8.4 CVE-2018-25259 ExploitDB-46058Official Product HomepageVulnCheck Advisory: Terminal Services Manager 3.1 Buffer Overflow SEH Magix--MAGIX Music Editor MAGIX Music Editor 3.1 contains a buffer overflow vulnerability in the FreeDB Proxy Options dialog that allows local attackers to execute arbitrary code by exploiting structured exception handling. Attackers can craft a malicious payload, paste it into the Server field via the CD menu's FreeDB Proxy Options, and trigger code execution when settings are accepted. 2026-04-22 8.4 CVE-2018-25260 ExploitDB-46056Official Product HomepageProduct ReferenceVulnCheck Advisory: MAGIX Music Editor 3.1 Buffer Overflow via SEH Iperiusbackup--Iperius Backup Iperius Backup 5.8.1 contains a local buffer overflow vulnerability in the structured exception handling (SEH) mechanism that allows local attackers to execute arbitrary code by supplying a malicious file path. Attackers can create a backup job with a crafted payload in the external file location field that triggers a buffer overflow when the backup job executes, enabling code execution with application privileges. 2026-04-22 8.4 CVE-2018-25261 ExploitDB-46059Official Product HomepageVulnCheck Advisory: Iperius Backup 5.8.1 Local Buffer Overflow SEH faleemi--Faleemi Desktop Software Faleemi Desktop Software 1.8.2 contains a local buffer overflow vulnerability in the Device alias field that allows local attackers to trigger a structured exception handler (SEH) overwrite. Attackers can craft a malicious payload and paste it into the Device alias field within the Managing Log interface to execute arbitrary code with calculator proof-of-concept execution. 2026-04-26 8.4 CVE-2018-25263 ExploitDB-45492Product ReferenceVulnCheck Advisory: Faleemi Desktop Software 1.8.2 Local Buffer Overflow SEH Lizardsystems--LanSpy LanSpy 2.0.1.159 contains a local buffer overflow vulnerability in the scan section that allows local attackers to execute arbitrary code by exploiting structured exception handling mechanisms. Attackers can craft malicious payloads using egghunter techniques to locate and execute shellcode, triggering code execution through SEH chain manipulation and controlled jumps. 2026-04-22 8.4 CVE-2018-25265 ExploitDB-46018Official Product HomepageVulnCheck Advisory: LanSpy 2.0.1.159 Local Buffer Overflow Lizardsystems--LanSpy LanSpy 2.0.1.159 contains a local buffer overflow vulnerability that allows attackers to overwrite the instruction pointer by supplying oversized input to the scan field. Attackers can craft a payload with 688 bytes of padding followed by 4 bytes of controlled data to crash the application or potentially achieve code execution. 2026-04-22 8.4 CVE-2018-25268 ExploitDB-45968Official Product HomepageVulnCheck Advisory: LanSpy 2.0.1.159 Local Buffer Overflow via Scan Field Securimport--iSmartViewPro iSmartViewPro 1.5 contains a structured exception handling (SEH) buffer overflow vulnerability in the 'Save Path for Snapshot and Record file' field that allows local attackers to execute arbitrary code. Attackers can input a crafted payload exceeding 260 bytes through the System Setup interface to overwrite SEH records and execute shellcode with application privileges. 2026-04-26 8.4 CVE-2018-25283 ExploitDB-45349Product ReferenceVulnCheck Advisory: iSmartViewPro 1.5 Buffer Overflow via SavePath Parameter Cewe-Photoworld--CEWE Photoshow CEWE Photoshow 6.3.4 contains a buffer overflow vulnerability in the login dialog that allows attackers to crash the application by submitting oversized input. Attackers can inject 4000 bytes of data into the email address and password fields to trigger a denial of service condition. 2026-04-26 7.5 CVE-2018-25294 ExploitDB-45211Official Product HomepageProduct ReferenceVulnCheck Advisory: CEWE Photoshow 6.3.4 Buffer Overflow Denial of Service Fortra--GoAnywhere MFT The login limit is not enforced on the SFTP service of Fortra's GoAnywhere MFT prior to 7.10.0 if the Web User attempting to be logged in to is configured to log in with an SSH Key, making the SSH key vulnerable to being guessed via Brute Force. 2026-04-21 7.3 CVE-2025-14362 https://fortra.com/security/advisories/product-security/FI-2026-002 Back to top Medium Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info Patch Info Angryip--Angry IP Scanner for Linux Angry IP Scanner for Linux 3.5.3 contains a denial of service vulnerability that allows local attackers to crash the application by supplying malformed input to the port selection field. Attackers can craft a malicious string containing buffer overflow patterns and paste it into the Preferences Ports tab to trigger an application crash. 2026-04-22 6.2 CVE-2018-25262 ExploitDB-46038Official Product HomepageVulnCheck Advisory: Angry IP Scanner for Linux 3.5.3 Denial of Service Acutesystems--TransMac TransMac 12.2 contains a buffer overflow vulnerability in the license key input field that allows local attackers to crash the application by submitting an oversized string. Attackers can generate a payload file containing 4000 bytes of data, paste it into the License Key field, and trigger a denial of service condition. 2026-04-26 6.2 CVE-2018-25264 ExploitDB-45493VulnCheck Advisory: TransMac 12.2 Denial of Service via License Key Field Angryip--Angry IP Scanner Angry IP Scanner 3.5.3 contains a buffer overflow vulnerability in the preferences dialog that allows local attackers to crash the application by supplying an excessively large string. Attackers can generate a file containing a massive buffer of repeated characters and paste it into the unavailable value field in the display preferences to trigger a denial of service. 2026-04-22 6.2 CVE-2018-25266 ExploitDB-45993Official Product HomepageVulnCheck Advisory: Angry IP Scanner 3.5.3 Denial of Service via Preferences Buffer Overflow Ultraiso--UltraISO UltraISO 9.7.1.3519 contains a local buffer overflow vulnerability in the Output FileName field of the Make CD/DVD Image dialog that allows attackers to overwrite SEH and SE handler records. Attackers can craft a malicious filename string with 304 bytes of data followed by SEH record overwrite values and paste it into the Output FileName field to trigger a denial of service crash. 2026-04-22 6.2 CVE-2018-25267 ExploitDB-45996Official Product HomepageVulnCheck Advisory: UltraISO 9.7.1.3519 Buffer Overflow via Output FileName icewarp--ICEWARP Client ICEWARP 11.0.0.0 contains a cross-site scripting vulnerability that allows attackers to inject malicious HTML elements into emails by embedding base64-encoded payloads in object and embed tags. Attackers can craft emails containing data URIs with embedded scripts that execute in the client when the email is viewed, compromising user sessions and stealing sensitive information. 2026-04-22 6.1 CVE-2018-25269 ExploitDB-45974Official Product HomepageVulnCheck Advisory: ICEWARP 11.0.0.0 Cross-Site Scripting via Email HTML Injection Textpad--Textpad Textpad 8.1.2 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long buffer string through the Run command interface. Attackers can paste a 5000-byte payload into the Command field via Tools > Run to trigger a buffer overflow that crashes the application. 2026-04-22 6.2 CVE-2018-25271 ExploitDB-45956Official Product HomepageProduct ReferenceVulnCheck Advisory: Textpad 8.1.2 Denial of Service via Run Command Acutesystems--CrossFont CrossFont 7.5 contains a buffer overflow vulnerability that allows local attackers to crash the application by submitting an oversized payload in the License Key field. Attackers can generate a malicious file containing 4000 bytes of data, paste it into the License Key input field, and trigger an application crash when processing the input. 2026-04-26 6.2 CVE-2018-25273 ExploitDB-45494VulnCheck Advisory: CrossFont 7.5 Denial of Service via License Key Field infrarecorder--InfraRecorder InfraRecorder 0.53 contains a denial of service vulnerability that allows local attackers to crash the application by importing a maliciously crafted text file. Attackers can create a text file containing 6000 bytes of data and import it through the Edit menu's Import function to trigger an application crash. 2026-04-26 6.2 CVE-2018-25274 ExploitDB-45413VulnCheck Advisory: InfraRecorder 0.53 Denial of Service via txt File Import faleemi--Faleemi Plus Faleemi Plus 1.0.2 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying oversized input strings. Attackers can paste a 2000-byte payload into the Camera name and DID number fields during camera addition to trigger an application crash. 2026-04-26 6.2 CVE-2018-25275 ExploitDB-45414Product ReferenceVulnCheck Advisory: Faleemi Plus 1.0.2 Denial of Service via Buffer Overflow Br-Software--PixGPS PixGPS 1.1.8 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an oversized string to the folder path input field. Attackers can craft a payload exceeding 6000 bytes and paste it into the 'Folder with picture files' field to trigger a denial of service condition. 2026-04-26 6.2 CVE-2018-25277 ExploitDB-45381Product ReferenceVulnCheck Advisory: PixGPS 1.1.8 Buffer Overflow Denial of Service Picajet--PicaJet FX PicaJet FX 2.6.5 contains a denial of service vulnerability that allows local attackers to crash the application by submitting oversized input to registration fields. Attackers can paste a 6000-byte buffer into the Registration Name and Registration Key fields via the Help menu's Register PicaJet dialog to trigger an application crash. 2026-04-26 6.2 CVE-2018-25278 ExploitDB-45383VulnCheck Advisory: PicaJet FX 2.6.5 Denial of Service via Registration Fields Convertimagetotext--jiNa OCR Image to Text jiNa OCR Image to Text 1.0 contains a denial of service vulnerability that allows local attackers to crash the application by processing a malformed PNG file. Attackers can create a specially crafted PNG file with an oversized buffer and trigger the crash when the application attempts to convert the file to PDF. 2026-04-26 6.2 CVE-2018-25279 ExploitDB-45380Product ReferenceVulnCheck Advisory: jiNa OCR Image to Text 1.0 Denial of Service via PNG ZenMap--ZenMap Nmap 7.70 contains a denial of service vulnerability that allows local attackers to crash the application by processing malicious XML files with exponential entity expansion. Attackers can create a crafted XML file with nested entity definitions and open it through ZenMap's scan import functionality to cause the program to consume excessive system resources and crash. 2026-04-26 6.2 CVE-2018-25282 ExploitDB-45357Product ReferenceVulnCheck Advisory: Nmap 7.70 Denial of Service via XML Entity Expansion Hdtune--HD Tune Pro HD Tune Pro 5.70 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an excessively long string in the folder/file name field. Attackers can trigger a denial of service by entering a 6000-byte payload through the File > Options > Save dialog's folder/file name input field. 2026-04-26 6.2 CVE-2018-25284 ExploitDB-45298Official Product HomepageProduct ReferenceVulnCheck Advisory: HD Tune Pro 5.70 Denial of Service via Options Dialog Hdtune--Easy PhotoResQ Easy PhotoResQ 1.0 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an excessively long string in the Folder/filename field. Attackers can input a 6000-byte payload through the File Options dialog to trigger a denial of service condition. 2026-04-26 6.2 CVE-2018-25286 ExploitDB-45300Official Product HomepageVulnCheck Advisory: Easy PhotoResQ 1.0 Buffer Overflow Denial of Service Editorsoftware--StyleWriter StyleWriter 1.0 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an excessively long string. Attackers can paste a 6000-byte payload into the Pattern to Find or Advice Message fields in the Add Pattern dialog to trigger a denial of service condition. 2026-04-26 6.2 CVE-2018-25288 ExploitDB-45250Official Product HomepageProduct ReferenceVulnCheck Advisory: StyleWriter 1.0 Denial of Service via Pattern Input Ezbsystems--Softdisk Softdisk 3.0.3 contains a buffer overflow vulnerability in the registration code dialog that allows local attackers to crash the application by supplying an oversized string. Attackers can trigger the vulnerability by entering a 6000-byte payload in the Registration Name field through the Help menu's Enter Registration Code dialog to cause a denial of service. 2026-04-26 6.2 CVE-2018-25289 ExploitDB-45245Official Product HomepageProduct ReferenceVulnCheck Advisory: Softdisk 3.0.3 Buffer Overflow Denial of Service Ezbsystems--Easyboot Easyboot 6.6.0 contains a buffer overflow vulnerability in the Replace Text function that allows local attackers to crash the application by supplying an oversized string. Attackers can trigger the vulnerability by accessing File > Tools > Replace Text and pasting a 7000-byte payload into the text fields to cause a denial of service. 2026-04-26 6.2 CVE-2018-25290 ExploitDB-45241Official Product HomepageVulnCheck Advisory: Easyboot 6.6.0 Buffer Overflow Denial of Service Pj64-Emu--Project64 Project64 2.3.2 contains a buffer overflow vulnerability in the Plugin Directory settings field that allows local attackers to crash the application by supplying an excessively long string. Attackers can input a 6000-byte payload into the Plugin Directory field through the Options > Settings > Directories interface to trigger an application crash when settings are reopened. 2026-04-26 6.2 CVE-2018-25291 ExploitDB-45229Official Product HomepageVulnCheck Advisory: Project64 2.3.2 Denial of Service via Plugin Directory Bome--Restorator Bome Restorator 1793 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an excessively long string in the Name field. Attackers can create a malicious payload exceeding 4000 bytes and paste it into the Name input field to trigger an application crash and denial of service. 2026-04-26 6.2 CVE-2018-25292 ExploitDB-45223Official Product HomepageProduct ReferenceVulnCheck Advisory: Bome Restorator 1793 Denial of Service via Buffer Overflow Mersenne--Prime95 Prime95 29.4b7 contains a buffer overflow vulnerability in the PrimeNet connection dialog that allows local attackers to crash the application by supplying an excessively long string in the optional proxy password field. Attackers can trigger a denial of service by entering a 6000-byte payload into the proxy password parameter, causing the application to crash when processing the connection settings. 2026-04-26 6.2 CVE-2018-25293 ExploitDB-45226Official Product HomepageProduct ReferenceVulnCheck Advisory: Prime95 29.4b7 Denial of Service via Proxy Password Field P10--ObserverIP Scan Tool ObserverIP Scan Tool 1.4.0.1 contains a denial of service vulnerability that allows local attackers to crash the application by submitting an excessively long string in the IP input field. Attackers can paste a 2000-byte buffer of repeated characters into the IP field and trigger a search operation to cause an application crash. 2026-04-26 6.2 CVE-2018-25295 ExploitDB-45204Official Product HomepageProduct ReferenceVulnCheck Advisory: ObserverIP Scan Tool 1.4.0.1 Denial of Service via IP Field Wansview--Wansview Wansview 1.0.2 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying oversized input strings. Attackers can inject 2000-byte payloads into the Camera name and DID number fields during camera addition to trigger application crashes. 2026-04-26 6.2 CVE-2018-25297 ExploitDB-45194VulnCheck Advisory: Wansview 1.0.2 Denial of Service via Buffer Overflow 94Cb--Carbon Forum Carbon Forum 5.9.0 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavaScript code through the Forum Name field in dashboard settings. Attackers with admin privileges can store JavaScript payloads in the Forum Name field that execute in the browsers of all users visiting the forum, enabling session hijacking and data theft. 2026-04-22 6.4 CVE-2024-58344 ExploitDB-52043Official Product HomepageProduct ReferenceVulnCheck Advisory: Carbon Forum 5.9.0 Persistent XSS via Forum Name Field GitLab--GitLab GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have allowed an authenticated user to cause denial of service under certain conditions by exhausting server resources by making crafted requests to a discussions endpoint. 2026-04-22 6.5 CVE-2025-0186 HackerOne Bug Bounty Report #2915694https://gitlab.com/gitlab-org/gitlab/-/work_items/511312https://about.gitlab.com/releases/2026/04/22/patch-release-gitlab-18-11-1-released/ GitLab--GitLab GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.4 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have allowed an authenticated user to cause denial of service by overwhelming system resources under certain conditions due to insufficient resource allocation limits in the GraphQL API. 2026-04-22 6.5 CVE-2025-3922 HackerOne Bug Bounty Report #3098035https://gitlab.com/gitlab-org/gitlab/-/work_items/537422https://about.gitlab.com/releases/2026/04/22/patch-release-gitlab-18-11-1-released/ Picajet--RoboImport RoboImport 1.2.0.72 contains a denial of service vulnerability that allows local attackers to crash the application by submitting oversized input to registration fields. Attackers can paste a 6000-byte buffer into the Registration Name and Registration Key fields and click Register to trigger an application crash. 2026-04-26 5.5 CVE-2018-25276 ExploitDB-45382Product ReferenceVulnCheck Advisory: RoboImport 1.2.0.72 Denial of Service via Registration Fields Infiltration-Systems--Infiltrator Network Security Scanner Infiltrator Network Security Scanner 4.6 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an oversized input string. Attackers can paste a 6000-byte payload into the Scan Target field and trigger a denial of service condition when the Scan button is clicked. 2026-04-26 5.5 CVE-2018-25280 ExploitDB-45390Product ReferenceVulnCheck Advisory: Infiltrator Network Security Scanner 4.6 Denial of Service Maxprog--iCash iCash 7.6.5 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an oversized payload through the Connect to Server dialog. Attackers can paste a 7000-byte string into the Host field and click Connect to trigger an application crash. 2026-04-26 5.5 CVE-2018-25281 ExploitDB-45388VulnCheck Advisory: iCash 7.6.5 Denial of Service via Connect to Server Fathom--Fathom Fathom 2.4 contains a buffer overflow vulnerability in the Authorization Code field that allows local attackers to crash the application by submitting an oversized input string. Attackers can paste a 6000-byte payload into the Authorization Code field and click Activate to trigger a denial of service condition. 2026-04-26 5.5 CVE-2018-25285 ExploitDB-45294Official Product HomepageProduct ReferenceVulnCheck Advisory: Fathom 2.4 Denial of Service via Authorization Code Buffer Overflow Hdtune--Drive Power Manager Drive Power Manager 1.10 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an excessively long string in the Name field. Attackers can paste a 6000-byte payload into the Name field and click Register to trigger a denial of service condition. 2026-04-26 5.5 CVE-2018-25287 ExploitDB-45299Official Product HomepageVulnCheck Advisory: Drive Power Manager 1.10 Denial of Service via Name Field P10--Central Management Software P10 Central Management Software 1.4.13 contains a buffer overflow vulnerability in the login password field that allows local attackers to crash the application by submitting an oversized input string. Attackers can paste a 2000-byte payload into the password field and click login to trigger an application crash and denial of service. 2026-04-26 5.5 CVE-2018-25296 ExploitDB-45207Official Product HomepageVulnCheck Advisory: P10 Central Management Software 1.4.13 Denial of Service Fortra--GoAnywhere MFT Encrypted values in Fortra's GoAnywhere MFT prior to version 7.10.0 and GoAnywhere Agents prior to version 2.2.0 utilize a static IV which allows admin users to brute-force decryption of data. 2026-04-21 5.8 CVE-2025-1241 https://fortra.com/security/advisories/product-security/FI-2026-001 OpenSC--OpenSC Multiple uses of uninitialized variables were found in libopensc that may lead to information disclosure or application crash. An attack requires a crafted USB device or smart card that would present the system with specially crafted responses to the APDUs 2026-04-23 5.7 CVE-2025-13763 https://access.redhat.com/security/cve/CVE-2025-13763RHBZ#2417581https://github.com/OpenSC/OpenSC/security/advisories/GHSA-2v44-fq35-98vvhttps://github.com/OpenSC/OpenSC/wiki/CVE-2025-13763 HCLSoftware--BigFix Service Management (SM) HCL BigFix Service Management (SM) Discovery is vulnerable to unenforced encryption due to port 80 (HTTP) being open, allowing unencrypted access. An attacker with access to the network traffic can sniff packets from the connection and uncover the data. 2026-04-21 5.3 CVE-2025-31981 https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0127605 IBM--Security Verify Directory (Container) IBM Security Verify Directory (Container) 10.0.0 through 10.0.0.3 IBM Security Verify Directory could be vulnerable to malicious file upload by not validating file type. A privileged user could upload malicious files into the system that can be sent to victims for performing further attacks against the system. 2026-04-22 5.5 CVE-2025-36074 https://www.ibm.com/support/pages/node/7268907 hubspotdev--HubSpot All-In-One Marketing Forms, Popups, Live Chat The HubSpot All-In-One Marketing - Forms, Popups, Live Chat plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.3.32 via the leadin/public/admin/class-adminconstants.php file. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract a list of all installed plugins and their versions which can be leveraged for reconnaissance and further attacks. 2026-04-24 4.3 CVE-2025-11762 https://www.wordfence.com/threat-intel/vulnerabilities/id/2a8c62e6-f459-433a-b0c4-c79285ea7fe9?source=cvehttps://research.cleantalk.org/CVE-2025-11762https://plugins.trac.wordpress.org/browser/leadin/tags/11.3.33/public/admin/class-adminconstants.php Back to top Low Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info Patch Info HCLSoftware--BigFix Service Management (SM) HCL BigFix Service Management is susceptible to HTTP Request Smuggling. HTTP request smuggling vulnerabilities arise when websites route HTTP requests through web servers with inconsistent HTTP parsing. HTTP Smuggling exploits inconsistencies in request parsing between front-end and back-end servers, allowing attackers to bypass security controls and perform attacks like cache poisoning or request hijacking. 2026-04-21 3.7 CVE-2025-31958 https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124209 Back to top Severity Not Yet Assigned PrimaryVendor -- Product Description Published CVSS Score Source Info Patch Info NWCLARK--Storable Storable versions before 3.05 for Perl has a stack overflow. The retrieve_hook function stored the length of the class name into a signed integer but in read operations treated the length as unsigned. This allowed an attacker to craft data that could trigger the overflow. 2026-04-21 not yet calculated CVE-2017-20230 https://github.com/Perl/perl5/issues/15831https://github.com/Perl/perl5/commit/a258c17c6937f79529c8319a829310e09cdbd216.patchhttps://metacpan.org/release/RURBAN/Storable-3.05/changeshttps://www.nntp.perl.org/group/perl.perl5.porters/2017/01/msg242533.htmlhttps://www.nntp.perl.org/group/perl.perl5.porters/2017/01/msg242703.html Seeyon Internet Software--A8-V5 Collaborative Management Software Seeyon OA A8 contains an unauthenticated arbitrary file write vulnerability in the /seeyon/htmlofficeservlet endpoint that allows remote attackers to write arbitrary files to the web application root by sending specially crafted POST requests with custom base64-encoded payloads. Attackers can write JSP webshells to the web root and execute them through the web server to achieve arbitrary OS command execution with web server privileges. Exploitation evidence was first observed by the Shadowserver Foundation on 2021-03-26 (UTC). 2026-04-21 not yet calculated CVE-2019-25714 https://sourceforge.net/software/product/A8/https://web.archive.org/web/20190821034711/http://wyb0.com/posts/2019/seeyon-htmlofficeservlet-getshell/https://wiki.96.mk/Web%E5%AE%89%E5%85%A8/%E8%87%B4%E8%BF%9Coa/%E8%87%B4%E8%BF%9C%20OA%20A8%20htmlofficeservlet%20getshell%20%E6%BC%8F%E6%B4%9E/https://static-aliyun-doc.oss-cn-hangzhou.aliyuncs.com/download/pdf/90916/Security_Notification_reseller_en-US.pdfhttps://www.broadcom.com/support/security-center/attacksignatures/detail?asid=31713https://www.fortiguard.com/encyclopedia/ips/48874/seeyon-office-anywhere-htmlofficeservlet-arbitrary-file-uploadhttps://www.vulncheck.com/advisories/seeyon-office-anywhere-oa-a8-unauthenticated-arbitrary-file-write-via-htmlofficeservlet Unknown--Email Encoder The Email Encoder WordPress plugin before 2.3.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). 2026-04-20 not yet calculated CVE-2024-7083 https://wpscan.com/vulnerability/7aeb6891-e159-4ed8-b1a9-a551140c9fcc/ Semantic MediaWiki--Semantic MediaWiki Cross-Site Scripting (XSS) vulnerability reflected in Semantic MediaWiki. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL using the '/index.php/Speciaal:GefacetteerdZoeken' endpoint parameter. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user. 2026-04-21 not yet calculated CVE-2025-10354 https://www.incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-xss-semantic-mediawiki EfficientLab, LLC--Controlio EfficientLab Controlio before v1.3.95 contains a DLL hijacking vulnerability caused by weak folder permissions in the installation directory. A local attacker can place a specially crafted DLL in this directory and achieve arbitrary code execution with highest privileges, because the affected service runs as NT AUTHORITYSYSTEM. 2026-04-23 not yet calculated CVE-2025-10549 https://r.sec-consult.com/controliohttps://kb.controlio.net/hc/en-us/articles/45777908471185-Client-Update-April-15-2026-ver-1-3-95 Fudo Security--Fudo Enterprise Fudo Enterprise in versions from 5.5.0 through 5.6.2 allows low privileged users to access certain administrator-only resources via improperly protected API endpoints. This includes sensitive information such as system logs and parts of system configuration settings. This vulnerability has been fixed in version 5.6.3 2026-04-20 not yet calculated CVE-2025-13480 https://www.fudosecurity.com/product/enterprisehttps://cert.pl/en/posts/2026/04/CVE-2025-13480https://download.fudosecurity.com/documentation/fudo/5_6/rn/RN_5.6.3.pdf Zervit--portable HTTP/Web server Zervit's portable HTTP/web server is vulnerable to remote DoS attacks when a configuration reset request is made. The vulnerability is caused by inadequate validation of user-supplied input. An attacker can exploit this vulnerability by sending malicious requests. If the vulnerability is successfully exploited, the application can be made to stop responding, resulting in a DoS condition. It is possible to manually restart the application. 2026-04-21 not yet calculated CVE-2025-13826 https://www.incibe.es/en/incibe-cert/notices/aviso/incorrect-input-validation-zervit-portable-httpweb-server ATRODO--Net:Dropbear Net:Dropbear versions before 0.14 for Perl contains a vulnerable version of libtomcrypt. Net:Dropbear versions before 0.14 includes versions of Dropbear 2019.78 or earlier. These include versions of libtomcrypt v1.18.1 or earlier, which is affected by CVE-2016-6129 and CVE-2018-12437. 2026-04-21 not yet calculated CVE-2025-15638 https://www.cve.org/CVERecord?id=CVE-2016-6129https://www.cve.org/CVERecord?id=CVE-2018-12437https://metacpan.org/release/ATRODO/Net-Dropbear-0.14/source/dropbear/libtomcrypt/changes PHP Point Of Sale--PHP Point Of Sale HTML injection vulnerability in PHP Point of Sale v19.4. This vulnerability allows an attacker to render HTML in the victim's browser due to a lack of proper validation of user input by sending a request to '/reports/generate/specific_customer', ussing 'start_date_formatted' y 'end_date_formatted' parameters. 2026-04-21 not yet calculated CVE-2025-41011 https://www.incibe.es/en/incibe-cert/notices/aviso/html-injection-php-point-sale-0 Zeon Global Tech--Zeon Academy Pro SQL injection vulnerability in Zeon Academy Pro by Zeon Global Tech. This vulnerability allows an attacker to retrieve, create, update, and delete databases by sending a POST request using the parameter 'phonenumber' in '/private/continue-upload.php'. 2026-04-21 not yet calculated CVE-2025-41029 https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-zeon-academy-pro-zeon-global-tech Back to top
Read more »
Tuesday April 21
02:53 pm
‘Scattered Spider’ Member ‘Tylerb’ Pleads Guilty | Krebs on Security
‘Scattered Spider’ Member ‘Tylerb’ Pleads Guilty
A 24-year-old British national and senior member of the cybercrime group "Scattered Spider" has pleaded guilty to wire fraud conspiracy and aggravated identity theft. Tyler Robert Buchanan admitted his role in a series of text-message phishing attacks in the summer of 2022 that allowed the group to hack into at least a dozen major technology companies and steal tens of millions of dollars worth of cryptocurrency from investors.
Read more »
Thursday April 16
03:28 pm
Most secure browser for Mac in 2026 | Intego Mac Security
Most secure browser for Mac in 2026
For most Mac users, your browser is where a lot of online life happens — reading emails, logging into accounts, using web apps, shopping, and banking. It’s also where a small mistake can lead to a bigger problem, whether that means downloading something that looked harmless or signing into a phishing page that seemed real […] The post appeared first on The Mac Security Blog.
Read more »
Tuesday April 14
09:47 pm
Patch Tuesday, April 2026 Edition | Krebs on Security
Patch Tuesday, April 2026 Edition
Microsoft today pushed software updates to fix a staggering 167 security vulnerabilities in its Windows operating systems and related software, including a SharePoint Server zero-day and a publicly disclosed weakness in Windows Defender dubbed "BlueHammer." Separately, Google Chrome fixed its fourth zero-day of 2026, and an emergency update for Adobe Reader nixes an actively exploited flaw that can lead to remote code execution.
Read more »
Friday April 10
05:13 pm
Why more Mac attacks now rely on social engineering | Intego Mac Security
Why more Mac attacks now rely on social engineering
Recent security findings suggest a change in how Mac users are being targeted. Instead of searching for technical gaps in software, attackers are finding ways to ask users to run commands themselves. This pattern shows up across different reports, from fake apps that look legitimate to scam pages that guide users into pasting commands into […] The post appeared first on The Mac Security Blog.
Read more »
Tuesday April 07
07:01 pm
The new Intego Antivirus is here — everything you need to know about Intego ONE | Intego Mac Security
The new Intego Antivirus is here — everything you need to know about Intego ONE
Intego ONE is Intego’s new all-in-one Mac security app, built to make protection easier to manage in one place. Instead of juggling separate tools, you get antivirus protection, firewall protection, SmartClean, and VPN in one Mac-focused app, depending on your plan. If you’ve used Intego products before, the shift is straightforward — fewer moving parts […] The post appeared first on The Mac Security Blog.
Read more »

Older posts

Tuesday May 19
03:59 pm
Apple Sports expands to more than 90 new countries and regions | Apple Newsroom
Apple Sports expands to more than 90 new countries and regions
Apple Sports is now available in more than 170 countries and regions, including more than 90 new markets.
Read more »
03:59 pm
Apple Sports expands to more than 90 new countries and regions | Apple Newsroom
Apple Sports expands to more than 90 new countries and regions
Apple Sports is now available in more than 170 countries and regions, including more than 90 new markets.
Read more »
Tuesday March 24
02:59 pm
Introducing Apple Business — a new all-in-one platform for businesses of all sizes | Apple Newsroom
Introducing Apple Business — a new all-in-one platform for businesses of all sizes
Apple today announced Apple Business, a new all-in-one platform that allows companies to manage devices and reach more customers.
Read more »

Thursday May 21
07:27 am
Increased 5XX errors in Porto Alegre and Curitiba, Brazil | CloudFlare
Increased 5XX errors in Porto Alegre and Curitiba, Brazil
May 21, 07:27 UTCResolved - Cloudflare saw an from 06:28 AM - 07:02 AM UTC. Issue has now been resolved
Read more »
04:52 am
GRU (São Paulo) on 2026-05-21 | CloudFlare
GRU (São Paulo) on 2026-05-21
THIS IS A SCHEDULED EVENT May 21, 05:00 - 11:00 UTCMay 21, 04:38 UTCScheduled - We will be performing scheduled maintenance in GRU (São Paulo) datacenter on 2026-05-21 between 05:00 and 11:00 UTC.Traffic might be re-routed from this location, hence there is a possibility of a slight increase in latency during this maintenance window for end-users in the affected region. For PNI / CNI customers connecting with us in this location, please make sure you are expecting this traffic to fail over elsewhere during this maintenance window as network interfaces in this datacentre may become temporarily unavailable.You can now subscribe to these notifications via Cloudflare dashboard and receive these updates directly via email, PagerDuty and webhooks (based on your plan): https://developers.cloudflare.com/notifications/notification-available/#cloudflare-status.
Read more »
Wednesday May 20
11:57 pm
Delays between Zap execution | Zapier
Delays between Zap execution
Status: InvestigatingWe have identified delays between Zap execution and when runs become visible in Zap History. Importantly, Zap executions themselves are not failing or delayed — this issue only impacts the visibility of Zap History data in the UI. Our team is actively investigating the issue and we will continue to provide updates as soon as more information becomes available.
Read more »
09:22 pm
Investigating elevated errors and issues loading comments | Reddit
Investigating elevated errors and issues loading comments
May 20, 14:22 PDTIdentified - We've identified the issue and you should now start to see comments load properly again. We're still monitoring the situation!May 20, 13:58 PDTUpdate - We are continuing to investigate this issue.May 20, 13:58 PDTInvestigating - We're currently investigating this issue. While this is ongoing, you may have trouble loading comment threads on www.reddit.com, and the native apps
Read more »
07:47 pm
Cloudflare Access delayed audit logs | CloudFlare
Cloudflare Access delayed audit logs
May 20, 19:47 UTCMonitoring - A fix has been implemented and we are monitoring the results.May 20, 19:40 UTCIdentified - An issue with delay audit logs for Access has been identified. A fix is being prepared to resolve the delayed logs.
Read more »
05:21 pm
Workers subrequests returning 1006 | CloudFlare
Workers subrequests returning 1006
May 20, 17:21 UTCIdentified - We have identified the problem and working to resolve.May 20, 17:19 UTCInvestigating - Cloudflare is aware of and investigating customer reports of some errors.We are working to analyse and mitigate this problem. More updates to follow shortly.
Read more »
05:16 pm
Code Steps failing with “No response from child process” across Zaps/APIs | Zapier
Code Steps failing with “No response from child process” across Zaps/APIs
Status: InvestigatingStarting around 1:55 p.m. UTC, Code by Zapier steps have started failing with the error: "No response from child process" Our team is actively investigating and has engaged the owning engineering team.Affected components Instant Triggers (Degraded performance) Searches & Writes (Degraded performance) Polling Triggers (Degraded performance)
Read more »
03:00 pm
Elevated number of 520 errors in Europe region | CloudFlare
Elevated number of 520 errors in Europe region
May 20, 15:00 UTCResolved - Between 15:00-15:20 UTC Customer traffic in Europe region may have experienced an increased rate of 520 errors
Read more »
01:06 pm
Increased HTTP 502 Errors in Buenos Aires | CloudFlare
Increased HTTP 502 Errors in Buenos Aires
May 20, 13:06 UTCInvestigating - Cloudflare is investigating an increased level of HTTP 502 errors in Buenos Aires. We are working to analyse and mitigate this problem. More updates to follow shortly.
Read more »
12:43 pm
LinkedIn Integrations— authentication and connection errors | Zapier
LinkedIn Integrations— authentication and connection errors
Status: InvestigatingWe are currently experiencing intermittent authentication and connection issues affecting our LinkedIn, LinkedIn Conversions, and LinkedIn Lead Gen Forms integrations. Users may see authentication failures or connection errors when attempting to use Zaps with these LinkedIn integrations. These issues began around 1:50am EDT on May 20th and are impacting a subset of our users. LinkedIn's platform is experiencing widespread API issues, resulting in elevated error rates (primarily 401 authentication failures and 500 server errors). This has been confirmed on LinkedIn's API status page. We are actively monitoring the situation and working with LinkedIn to track their recovery progress. We apologize for any disruption this may cause to your workflows. We'll continue to monitor this closely and will update you as the situation develops.
Read more »
07:22 am
MIA (Miami) on 2026-05-21 | CloudFlare
MIA (Miami) on 2026-05-21
THIS IS A SCHEDULED EVENT May 21, 05:30 - 11:30 UTCMay 20, 07:16 UTCScheduled - We will be performing scheduled maintenance in MIA (Miami) datacenter on 2026-05-21 between 05:30 and 11:30 UTC.Traffic might be re-routed from this location, hence there is a possibility of a slight increase in latency during this maintenance window for end-users in the affected region. For PNI / CNI customers connecting with us in this location, please make sure you are expecting this traffic to fail over elsewhere during this maintenance window as network interfaces in this datacentre may become temporarily unavailable.You can now subscribe to these notifications via Cloudflare dashboard and receive these updates directly via email, PagerDuty and webhooks (based on your plan): https://developers.cloudflare.com/notifications/notification-available/#cloudflare-status.
Read more »
01:08 am
UPDATE: **Summary** NotebookLM customers are experiencing an issue where account tiers are being incorrectly downgraded. Affected Ultra & Pro tier users are seeing Free tier features. **Description** We are continuing to investigate an issue with NotebookLM where customers may experience a temporary downgrade in their account tier. Our engineering team has identified a potential root cause related to a recent software update and is currently working on a mitigation plan. We will provide an update by Tuesday, 2026-05-19 20:30 PDT with current details. **Customer Symtomps** Customers may notice lower resource limits (e.g., hitting limits for Studio artifacts, source count per notebook, etc) and the absence of premium features like advanced sharing and analytics. **Workaround** None at this time | Google Apps
UPDATE: **Summary** NotebookLM customers are experiencing an issue where account tiers are being incorrectly downgraded. Affected Ultra & Pro tier users are seeing Free tier features. **Description** We are continuing to investigate an issue with NotebookLM where customers may experience a temporary downgrade in their account tier. Our engineering team has identified a potential root cause related to a recent software update and is currently working on a mitigation plan. We will provide an update by Tuesday, 2026-05-19 20:30 PDT with current details. **Customer Symtomps** Customers may notice lower resource limits (e.g., hitting limits for Studio artifacts, source count per notebook, etc) and the absence of premium features like advanced sharing and analytics. **Workaround** None at this time
Incident began at 2026-05-19 22:29 (times are in Coordinated Universal Time (UTC)).Summary NotebookLM customers are experiencing an issue where account tiers are being incorrectly downgraded. Affected Ultra & Pro tier users are seeing Free tier features. Description We are continuing to investigate an issue with NotebookLM where customers may experience a temporary downgrade in their account tier. Our engineering team has identified a potential root cause related to a recent software update and is currently working on a mitigation plan. We will provide an update by Tuesday, 2026-05-19 20:30 PDT with current details. Customer Symtomps Customers may notice lower resource limits (e.g., hitting limits for Studio artifacts, source count per notebook, etc) and the absence of premium features like advanced sharing and analytics. Workaround None at this time Affected products: NotebookLM
Read more »
Tuesday May 19
11:23 pm
Customer with a large number of app restrictions cannot manage custom actions. | Zapier
Customer with a large number of app restrictions cannot manage custom actions.
Status: MonitoringOur Engineering team is currently monitoring reports indicating that Enterprise users with a high number of app restrictions (over 100) are unable to modify or manage custom actions. Affected users will see the following error when viewing custom actions. We couldn't determine whether this app is restricted. Please try again in a moment. We'll continue to keep our customers informed as we identify the root cause and resolve the issue.
Read more »
10:09 pm
Cloudflare Access AI control – MCP server creation impacted | CloudFlare
Cloudflare Access AI control – MCP server creation impacted
May 19, 22:09 UTCUpdate - We are continuing to investigate this issue.May 19, 21:59 UTCInvestigating - Customers may experience issue adding new MCP Servers or authenticating existing ones through the Zero Trust Dash
Read more »
09:53 pm
PHX (Phoenix) on 2026-05-21 | CloudFlare
PHX (Phoenix) on 2026-05-21
THIS IS A SCHEDULED EVENT May 21, 09:00 - 11:00 UTCMay 19, 21:40 UTCScheduled - We will be performing scheduled maintenance in PHX (Phoenix) datacenter on 2026-05-21 between 09:00 and 11:00 UTC.Traffic might be re-routed from this location, hence there is a possibility of a slight increase in latency during this maintenance window for end-users in the affected region. For PNI / CNI customers connecting with us in this location, please make sure you are expecting this traffic to fail over elsewhere during this maintenance window as network interfaces in this datacentre may become temporarily unavailable.You can now subscribe to these notifications via Cloudflare dashboard and receive these updates directly via email, PagerDuty and webhooks (based on your plan): https://developers.cloudflare.com/notifications/notification-available/#cloudflare-status.
Read more »
07:48 pm
Emerging Service Issue – GPU Deployment | Linode
Emerging Service Issue – GPU Deployment
May 19, 19:48 UTCIdentified - Our team is investigating an emerging service issue affecting GPU provisioning in all regions. At this time deployment of RTX PRO 6000 Blackwell plans in unavailable. We will share additional updates as we have more information.
Read more »
07:16 pm
Intermittent Cloudflare Dashboard SSO login failures with Okta | CloudFlare
Intermittent Cloudflare Dashboard SSO login failures with Okta
May 19, 19:16 UTCInvestigating - Cloudflare is investigating reports of intermittent authentication failures when logging into the Cloudflare Dashboard using SSO with Okta as the identity provider. Affected users may see a "failed to fetch" error during the login process.Dashboard access via other identity providers and direct username/password login are not currently reported as affected. Cloudflare Access application authentication is not currently reported as affected.Cloudflare Engineering is actively investigating the issue and will provide updates as more information becomes available.
Read more »
03:54 pm
Cloudflare Dashboard and Cloudflare API service issues | CloudFlare
Cloudflare Dashboard and Cloudflare API service issues
May 19, 15:54 UTCMonitoring - A fix has been implemented and we are monitoring the results.May 19, 15:36 UTCIdentified - Cloudflare is investigating issues with Cloudflare Dashboard and related APIs. These issues do not affect the serving of cached files via the Cloudflare CDN or other security features at the Cloudflare Edge. Customers using the Dashboard / Cloudflare APIs are impacted as requests might fail and/or errors may be displayed.
Read more »
03:25 pm
Digital Experience in Cloudflare Zero Trust Latency | CloudFlare
Digital Experience in Cloudflare Zero Trust Latency
May 19, 15:25 UTCInvestigating - Actions related to Digital Experience are delayed, Cloudflare is aware and investigating.
Read more »
12:54 pm
PER (Perth) on 2026-05-19 | CloudFlare
PER (Perth) on 2026-05-19
THIS IS A SCHEDULED EVENT May 19, 14:00 UTC - May 20, 21:00 UTCMay 19, 12:40 UTCScheduled - We will be performing scheduled maintenance in PER (Perth) datacenter between 2026-05-19 14:00 and 2026-05-20 21:00 UTC.Traffic might be re-routed from this location, hence there is a possibility of a slight increase in latency during this maintenance window for end-users in the affected region. For PNI / CNI customers connecting with us in this location, please make sure you are expecting this traffic to fail over elsewhere during this maintenance window as network interfaces in this datacentre may become temporarily unavailable.You can now subscribe to these notifications via Cloudflare dashboard and receive these updates directly via email, PagerDuty and webhooks (based on your plan): https://developers.cloudflare.com/notifications/notification-available/#cloudflare-status.
Read more »

Older posts

Showcase

Kool Tools: Pegasus3 Symply Edition

Promise Technology and Symply have launched the Pegasus3 Symply Edition, the next generation of the Pegasus desktop RAID storage system. The new system combines 40 Gb/s Thunderbolt 3 performance with Symply's storage management suite. The Pegasus3 Symply Edition is a...

Kool Tools: TimeCache

The Rolling Stones told us that time was on our side (or at least Mick Jagger's side). That's not always true, but with TimeCache (http://www.pandaware.com/timecache/index.html) for Mac OS X from PandaWare we can at least keep track of it. With TimeCache -- now...

Kool Tools: PDF Editor for Mac

Editing PDF files on Mac OS X can be tough, but a product from AnyBizSoft, a Wondershare company focused on PDF solutions, simplifies the process. PDF Editor for Mac, integrates AnyBizSoft's existing PDF to Word conversion technology. It not only enables users to edit...

Kool Tools: Aunsoft’s Video Converter for the Mac

Aunsoft Video Converter for Mac (http://www.aunsoft.com/video-converter-mac/) is a US$35 Mac video converting tool you can use to convert just about any type of video for use on a variety of Apple devices. What's more, it also boasts a several editing features. This...

More Showcase

Scanners “By The Numbers”

Wednesday May 20
02:07 pm
15″ M5 MacBook Airs on sale again for $150 at Amazon — Lowest Prices Yet | MacPrices.net
15″ M5 MacBook Airs on sale again for $150 at Amazon — Lowest Prices Yet
Amazon is now offering some of the best pricing yet on Apple’s 15-inch M5 MacBook Air lineup, with $150 discounts across all configurations. The popular 16GB/512GB model has dropped to about $1149 from Apple’s $1299 MSRP, and similar savings are showing up on higher storage and memory options as well. Check current deals at Amazon. For the latest sales and deals, see our 15" MacBook Air Price Tracker, updated daily.
Read more »
Friday May 15
03:52 pm
Amazon Discounts Space Black 14″ M5 MacBook Pros by Up to $300 Off MSRP | MacPrices.net
Amazon Discounts Space Black 14″ M5 MacBook Pros by Up to $300 Off MSRP
Amazon is now offering some of the best prices we’ve seen so far on Apple’s Space Black 14-inch M5 MacBook Pro lineup, with discounts ranging from $199 to $300 below Apple’s standard MSRP. The base 16GB RAM/1TB SSD model is now down to $1499.99 versus Apple’s $1699 MSRP, while the upgraded 32GB RAM/1TB SSD version has dropped to $1799 compared to Apple’s $2099 MSRP. Check current Amazon pricing here. The middle 24GB RAM/1TB SSD configuration is also discounted to $1749, or $150 below Apple pricing. Together, these are currently among the lowest prices available for Space Black 14″ M5 MacBook Pro models from Apple’s major retailers. For the latest sales and deals, see our 14" MacBook Pro Price Tracker, updated daily.
Read more »
Thursday May 14
10:34 pm
Amazon Cuts Prices on 16″ M5 Pro/Max MacBook Pros — $250 Off MSRP | MacPrices.net
Amazon Cuts Prices on 16″ M5 Pro/Max MacBook Pros — $250 Off MSRP
Amazon is now discounting Apple’s entire 16-inch M5 Pro and M5 Max MacBook Pro lineup by $250 off MSRP, with every listed configuration currently reduced below Apple’s standard pricing. The sale includes both Black and Silver models across the M5 Pro and M5 Max families, with prices starting at $2449.99 for the 24GB/1TB M5 Pro configuration. Check current Amazon pricing here. Higher-end M5 Max models are also seeing the same consistent $250 discounts, including the 36GB/2TB configuration at $3649.99 and the 48GB/2TB version at $4149.99. See these models here. These are currently the lowest prices available among Apple’s major retailers. For the latest sales and deals, see our 16" MacBook Pro Price Tracker, updated daily.
Read more »
12:26 pm
Verizon Drops AirPods Pro 3 to $199 — Lowest Price Available Anywhere Right Now | MacPrices.net
Verizon Drops AirPods Pro 3 to $199 — Lowest Price Available Anywhere Right Now
Verizon is currently offering Apple’s AirPods Pro 3 for $199, down from Apple’s standard $249 MSRP. That’s a clean $50 discount (20% off), and right now it appears to be the lowest widely available price from any major Apple retailer. Check current Verizon pricing here. The sale price applies to online orders only, and Verizon also offers free shipping or free local store pickup (if available in your area). Unlike many carrier promotions, Verizon service is not required to purchase the AirPods. For the latest sales and deals, see our AirPods Price Tracker, updated daily.
Read more »
Wednesday May 13
07:06 pm
Total Wireless Has One of the Most Aggressive iPhone 17e Deals Right Now | MacPrices.net
Total Wireless Has One of the Most Aggressive iPhone 17e Deals Right Now
Total Wireless is currently offering one of the more aggressive iPhone 17e deals available right now. Customers signing up for the carrier’s $60/month Total 5G+ Unlimited plan can get the phone for $0 per month over 24 months, effectively covering the full cost of Apple’s $599 MSRP iPhone 17e. Check the current Total Wireless deal here. If you’d rather buy the phone outright, Total is also offering $200 off the full retail price, dropping the iPhone 17e to about $399 with qualifying plans and port-in activation. That combination of upfront savings and financing flexibility makes this one of the stronger prepaid iPhone deals available right now. For the latest sales and deals, see our iPhone Price Tracker, updated daily.
Read more »
05:56 pm
MacBook Neo Still In Stock at Walmart While Apple Slips to 2–3 Week Delays | MacPrices.net
MacBook Neo Still In Stock at Walmart While Apple Slips to 2–3 Week Delays
The MacBook Neo continues to stay in stock across Walmart’s online store, even as availability tightens at many other retailers and Apple’s own delivery estimates have slipped to roughly 2–3 weeks for many configurations. Check current MacBook Neo availability at Walmart. What makes Walmart stand out right now is the combination of immediate availability, fast free shipping, and free local store pickup options (where available). For buyers who don’t want to wait weeks for Apple delivery windows, Walmart has quietly become one of the easiest places to actually get a MacBook Neo quickly. For the latest sales and deals, see our MacBook Neo Price Tracker, updated daily.
Read more »
12:54 pm
Upgraded 32GB/1TB 14″ M5 MacBook Pros Drop Up to $300 Off at Amazon & B&H | MacPrices.net
Upgraded 32GB/1TB 14″ M5 MacBook Pros Drop Up to $300 Off at Amazon & B&H
Amazon and B&H are now offering major discounts on Apple’s upgraded 32GB/1TB 14-inch M5 MacBook Pro configurations, with the Silver model down to $1799 and the Space Black version at $1849, compared to Apple’s standard $2099 MSRP. That works out to savings of $250-$300 off, making these some of the strongest discounts we’ve seen so far on upgraded M5 MacBook Pro models. Check the deals at Amazon and B&H. B&H is also continuing to offer free 1–2 day shipping to most U.S. addresses, making it one of the fastest ways to get one without paying full price. For the latest sales and deals, see our 14" MacBook Pro Price Tracker, updated daily.
Read more »
Sunday May 10
02:13 pm
New 32GB/1TB M5 14″ MacBook Pro Drops to $1849 at Amazon, $250 off! | MacPrices.net
New 32GB/1TB M5 14″ MacBook Pro Drops to $1849 at Amazon, $250 off!
Amazon is now offering Apple’s new 32GB/1TB M5 14-inch MacBook Pro for $1849, down from Apple’s standard $1999 MSRP. That’s a clean $250 discount on one of the more desirable upgraded configurations in the lineup. Check current pricing at Amazon here. Deals on upgraded MacBook Pro configurations tend to arrive more slowly than base models, which makes this one stand out a bit more than the typical entry-level sale. For the latest sales and deals, see our 14" MacBook Pro Price Tracker, updated daily.
Read more »
Friday May 08
06:36 pm
B&H Undercuts Other Retailers on This 16″ M5 Max MacBook Pro Deal | MacPrices.net
B&H Undercuts Other Retailers on This 16″ M5 Max MacBook Pro Deal
B&H Photo currently has the 16-inch M5 Max MacBook Pro (18-core CPU/36GB RAM/2TB SSD) on sale for $3649, compared to Apple’s standard $3899 MSRP. That’s a solid $250 discount overall—and about $50 cheaper than the next-best Apple retailers right now. Check current pricing at B&H here. B&H also adds free 1–2 day shipping to most U.S. addresses, which makes this one of the quickest and easiest ways to get a high-end M5 Max MacBook Pro without paying full price. For the latest sales and deals, see our 16" MacBook Pro Price Tracker, updated daily.
Read more »
Thursday May 07
03:26 pm
MacBook Neo Stock Check: Which Retailers Have Apple’s New Neo Available Right Now? | MacPrices.net
MacBook Neo Stock Check: Which Retailers Have Apple’s New Neo Available Right Now?
MacBook Neo inventory is changing quickly, with some colors and configurations much easier to find than others. There are a few clear patterns in the current MacBook Neo inventory picture. Indigo and Silver models appear to be the easiest configurations to find right now, especially at Amazon, B&H Photo, and Walmart. If you want the fastest shipping, those colors are currently the safest places to start. The Citrus models, on the other hand, continue to look like the hardest MacBook Neo configurations to find. Several retailers are either showing limited stock or no availability at all, which suggests buyers looking for Citrus may need to check back often or move quickly when stock appears. See the latest stock status, shipping estimates, and retailer availability below, then visit our MacBook Neo Price Tracker for current prices and daily updates.
Read more »
Wednesday May 06
09:10 pm
Metro Drops iPhone 17 to $529.99 for Switchers | MacPrices.net
Metro Drops iPhone 17 to $529.99 for Switchers
Metro by T-Mobile is offering a strong upfront discount on Apple’s iPhone 17, dropping the price to just $529.99 when you open a new account and transfer your existing phone number. That’s $300 below the phone’s regular $829.99 price, making it one of the better no-trade-in iPhone 17 deals currently available. See Metro by T-Mobile's Deal Here For more iPhone deals across Apple retailers and wireless carriers, see our iPhone Price Tracker, updated regularly.
Read more »
03:10 pm
Space Black 14″ M5 MacBook Pros Drop Below Apple Pricing at Amazon & B&H | MacPrices.net
Space Black 14″ M5 MacBook Pros Drop Below Apple Pricing at Amazon & B&H
Amazon and B&H are both offering some of the best prices right now on Apple’s Space Black 14-inch M5 MacBook Pro lineup, with meaningful discounts on the 16GB/1TB and 24GB/1TB configurations. The 16GB/1TB model has dropped to $1539 at Amazon and $1549 at B&H versus Apple’s $1699 MSRP. The 24GB/1TB version is now $200 off Apple's MSRP, $1699 at Amazon and $1699 at B&H. For the latest sales and deals, see our 14" MacBook Pro Price Tracker, updated daily.
Read more »

Older posts

Tuesday May 19
10:22 am
Apple MacBook Memorial Day Deals at Best Buy: Up to $2,000 off + free shipping | DealNews Laptops
Apple MacBook Memorial Day Deals at Best Buy: Up to $2,000 off + free shipping
Best Buy is offering MacBook Air and MacBook Pro models on sale, including new, open-box, and refurbished configurations with M1 through M5 chips. We’ve pictured this Apple 15″ M5 MacBook Air Laptop (2026) for $1,149 ($150 off.) Shop Now at Best Buy
Read more »
08:31 am
Apple iPad Air M3 11″ 1TB WiFi Tablet (2025) for $849 + free shipping | DealNews iPads
Apple iPad Air M3 11″ 1TB WiFi Tablet (2025) for $849 + free shipping
Amazon offers the Apple iPad Air M3 11″ 1TB WiFi Tablet (2025) in several colors (Blue pictured) for $849. That’s $300 off and the lowest price it’s been. Shipping is free. Buy Now at Amazon
Read more »
Sunday May 17
10:12 am
Open-Box Apple & Samsung Deals at eBay + free shipping | DealNews iPads
Open-Box Apple & Samsung Deals at eBay + free shipping
quickshipelectronics is offering open-box Apple and Samsung products at eBay. The open-box MacBook Air 15″ M4 is $800, down from $1,199; the open-box iPad Air 13″ M3 128GB is $549, down from $799; and the open-box Samsung Galaxy Tab S10+ 12.4″ 512GB is $700, down from $1,120. Shop Now at eBay Features Open-box condition across […]
Read more »
Friday May 15
07:59 am
Apple MacBook Air M5 15.3″ Laptop + free shipping | DealNews Laptops
Apple MacBook Air M5 15.3″ Laptop + free shipping
At $1,149, down from $1,299, this is Amazon's best-ever price for Apple's latest MacBook Air, updated in 2026 with the M5 chip. Wi-Fi 7 and Bluetooth 6 support are notable additions at this tier.Buy this if: You want a large-screen MacBook with the latest Apple silicon without stepping up to MacBook Pro pricing. Shop Now at Amazon
Read more »
Thursday May 14
10:39 am
Refurb Apple MacBook Pro 9th-Gen i9 16″ Laptop (2019) for $497 + free shipping | DealNews Laptops
Refurb Apple MacBook Pro 9th-Gen i9 16″ Laptop (2019) for $497 + free shipping
At eBay, get the Refurb Apple MacBook Pro 9th-Gen i9 16″ Laptop (2019) for $497. That’s a savings of $203. Shipping is free. It’s backed by a one-year Allstate warranty. Buy Now at eBay
Read more »
10:34 am
Refurb 4th-Gen. Apple iPad Pro 12.9″ 256GB WiFi Tablet (2020) for $470 + free shipping | DealNews iPads
Refurb 4th-Gen. Apple iPad Pro 12.9″ 256GB WiFi Tablet (2020) for $470 + free shipping
At eBay, get the Refurb 4th-Gen. Apple iPad Pro 12.9″ 256GB WiFi Tablet (2020) for $470. That’s the best price we could find by $50. Shipping is free. It’s backed by a one-year Allstate warranty. Buy Now at eBay
Read more »
Wednesday May 13
08:41 pm
Apple 14″ MacBook Pro M5 Laptop w/ 24GB RAM (Late 2025) for $1,499 + free shipping | DealNews Laptops
Apple 14″ MacBook Pro M5 Laptop w/ 24GB RAM (Late 2025) for $1,499 + free shipping
B&H Photo Video offers the Apple 14″ MacBook Pro M5 Laptop w/ 24GB RAM (Late 2025) for $1,499. That’s a $250 low. Shipping is free. Buy Now at B&H Photo Video Features Apple M5 10-Core CPU 24GB RAM; 512GB SSD 14.2″ 3024×1964 Liquid Retina XDR Display MacOS Model: Z1KH000BZ
Read more »
04:00 pm
Apple iPad Savings at Best Buy + free shipping | DealNews iPads
Apple iPad Savings at Best Buy + free shipping
Best Buy is offering savings on Apple iPad Air (M3) and iPad Pro (M5) models, with discounts up to $250 off. Deals include the Apple iPad Air M3 11″ 128GB Wi-Fi + Cellular Tablet for $499 (down from $799, pictured). Free shipping is available on all orders. Shop Now at Best Buy Features Apple M3 […]
Read more »
12:53 pm
Apple Macbook Pro 9th-Gen. i9 16″ Laptop w/ 16GB RAM for $497 + free shipping | DealNews Laptops
Apple Macbook Pro 9th-Gen. i9 16″ Laptop w/ 16GB RAM for $497 + free shipping
Bag this 29% discount right now. It's well over $500 in brand new condition elsewhere. A 1-year Allstate warranty applies. Buy Now at eBay
Read more »
Tuesday May 12
03:05 pm
Apple 13″ M5 MacBook Air (2026) for $949 + free shipping | DealNews Laptops
Apple 13″ M5 MacBook Air (2026) for $949 + free shipping
Amazon offers the Apple 13″ M5 MacBook Air (2026) for $949. That’s the best price we could find by $50. Shipping is free. Buy Now at Amazon Features 13.6″ 2560×1664 display Apple M5 CPU 16GB RAM Mac OS Model: MDHE4LL/A
Read more »
12:26 pm
Refurb 10th-Gen. Apple iPad 256GB Tablet (2022) for $360 + free shipping | DealNews iPads
Refurb 10th-Gen. Apple iPad 256GB Tablet (2022) for $360 + free shipping
It's over $400 in brand new condition elsewhere. A 1-year Allstate warranty applies. Shipping is free. Buy Now at eBay
Read more »
12:12 pm
Refurb Apple MacBook Pro M1 10-Core 16″ Laptop (2021) for $760 | DealNews Laptops
Refurb Apple MacBook Pro M1 10-Core 16″ Laptop (2021) for $760
Get the Refurb Apple MacBook Pro M1 16-Core 16″ Laptop (2021) for $760. That’s the best price we could find by $19. Shipping is free and it’s backed by a one-year Allstate warranty. Buy Now at eBay Features Apple M1 Pro Chip with 10-Core CPU and 16-Core GPU 16GB RAM, 1TB SSD macOS
Read more »
09:44 am
Apple MacBook Top Deals at Best Buy: Up to 83% off + free shipping | DealNews Laptops
Apple MacBook Top Deals at Best Buy: Up to 83% off + free shipping
Save on almost 250 models, with prices starting from $270 for refurbs. We’ve pictured the Apple 14″ MacBook Air M4 Laptop w/ 1TB SSD for $1,299 ($300 savings). My Best Buy members get free shipping on all orders (it’s free to join). Shop Now at Best Buy
Read more »
Monday May 11
11:13 am
Refurb Apple MacBook Pro M1 Pro 16.2″ Laptop (2021) for $660 + free shipping | DealNews Laptops
Refurb Apple MacBook Pro M1 Pro 16.2″ Laptop (2021) for $660 + free shipping
At eBay, get the Refurb Apple MacBook Pro M1 Pro 16.2″ Laptop (2021) for $660. That’s a low by $40 and the second-beat price we’ve seen. It’s backed by a one-year Allstate warranty. Buy Now at eBay Features Apple M1 Pro CPU & 14-core GPU 16.2″ Liquid Retina XDR display 32GB RAM & 512GB SSD […]
Read more »
07:34 am
Apple Pencil Pro for $99 + free shipping | DealNews Accessories
Apple Pencil Pro for $99 + free shipping
Amazon offers the Apple Pencil Pro for $99. That's the second-beat price we've seen it at and a savings of $30. Shipping is free. Buy Now at Amazon Features squeeze to bring up a toolset (w/ haptic feedback) tilt & rotation detection works w/ Find My app Model: MX2D3AM/A
Read more »

Older posts

No feed items found.