Save $300 on M4 MacBook Air with 24GB RAM, 1TB SSD – now just $1,299
Save $300 on a popular M4 MacBook Air configuration with a bump up to 24GB of RAM and 1TB of storage.Get Apple's M4 MacBook Air 24GB, 1TB for just $1,299 - Image credit: AppleTo activate the exclusive savings, shop through this special pricing link or the pricing link on our M4 13-inch MacBook Air 24GB/1TB product page from a laptop or desktop computer.Buy M4 13" MacBook Air 24GB/1TB for $1,299 Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Tim Cook’s ‘top priority’ product could finally take shape next year
Next year will bring a huge lineup of 20+ new Apple products. And the unveiling of Apple Glasses could be a key step toward Tim Cook’s “top priority” AR product finally launching. more…

Read more »

Apple COO Sabih Khan meets with China’s vice commerce minister
China's Vice Commerce Minister Li Chenggang met with Apple's Chief Operating Officer Sabih Khan to discuss the company's operations in China… The post appeared first on MacDailyNews.

Read more »

Apple will launch 20+ new products next year, here’s what’s coming
The new year is almost here, and Apple has a packed product lineup for 2026. Rumors indicate up to 25 new products will launch, here’s an overview of everything new on Apple’s roadmap. more…

Read more »

Coupon code: Get 1TB of cloud storage, just $130 for life
Koofr lifetime cloud storage plan gives you 1TB of space, accessible from any device. Pay just $129.99 for the cheapest cloud storage around. (via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)

Read more »

All the products Apple killed in 2025 — with more to come in 2026
Whether named "obsolete," "vintage" or "discontinued," these are all the products Apple did away with 2025, with more to come soon. (via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)

Read more »

iPhone 18 trial production set to begin in February, paving way for spring 2027 launch
Apple is set to kick off trial production for the iPhone 18 shortly after the Chinese New Year holiday. This means small-scale test runs… The post appeared first on MacDailyNews.

Read more »

Deals: Level Lock+ Matter Apple Home Key lock, 2025 orange Alpine Loop, M4 Pro MacBook Pro up to $700 off, more
Alongside ongoing $250 price drops on the M4 MacBook Air lineup and AirPods Pro 3 down at $199 on Amazon, today’s 9to5Toys Lunch Break does have some new deals to scope out. Firstly, we have the return on Amazon all-time low pricing on Level’s Lock+ (Matter) model with Apple Home Key at nearly 25% off. But we also spotted new lows hitting a pair of Apple’s 2025 Apple Watch Ultra bands – the orange Alpine Loop and the black Trail Loop – as well as this refurb 16-inch 24GB M4 Pro MacBook Pro is $700 off the list price right now, and even more down below.  more…

Read more »

Today in Apple history: iPhone comes to the world’s biggest carrier
On December 22, 2013, Apple announced a deal with China Mobile to bring the iPhone to the world's largest telecom company. (via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)

Read more »

Deals: AirPods Pro 3 $199, Apple Watch Series 11 $299, M4 MacBook Air $749 with delivery by Christmas
There's still time to grab last-minute Apple gifts at substantial discounts with delivery by Christmas.Save up to $400 on Apple with delivery by Christmas on many items - Image credit: AppleAmazon and B&H have numerous last-minute holiday deals available, with delivery by Christmas to many locations. As always, be sure to check delivery dates for your specific address during checkout. But at press time, you can pick up an Apple Watch Series 11 for $299 ($100 off), AirPods Pro 3 for $199, and more.AirPods Continue Reading on AppleInsider | Discuss on our Forums

Read more »

iPhone Fold crease-free screen glass may not be ready yet
The iPhone Fold is expected to arrive in the fall, but technical challenges may still exist for the display and screen glass that aren't yet solved.iPhone Fold could take on the look of two iPhone Air models fused together - Image Credit: AppleInsiderThe biggest part of the long-rumored iPhone Fold is the internal display, with Apple doing what it can to avoid it creasing over the long term. However, it now seems that Apple could be cutting it close for a fall release, which could impact the initially available supply of the model.In a weekend post, Weibo leaker Digital Chat Station discussed the iPhone Fold and Apple's attempt to create a "visually crease-free" screen for it. Apple is thought to be trying out the use of ultra-thin flexible glass (UFG) for the display, which uses materials of varying thickness to allow the display to bend. Rumor Score: 🤔 Possible Continue Reading on AppleInsider | Discuss on our Forums

Read more »

iOS 26.3 release date: Here’s when the next iPhone update will arrive
Apple’s first iPhone update of the new year will be iOS 26.3, which just recently debuted in beta. Here’s the expected iOS 26.3 release date for all users. more…

Read more »

Apple COO Sabih Khan tells China the company is committed to long-term partnerships
New Apple COO Sabih Khan has met with China's international trade negotiator, with both sides reportedly making general promises about continuing to work together.Apple's Sabih Khan (left) and China's Li Chenggang — image credits: Apple and WikipediaSabih Khan's predecessor as Apple Chief Operating Officer, Jeff Williams, made several such visits to China before his retirement, sometimes alongside CEO Tim Cook. Now China's Ministry of Commerce has announced that Khan has continued that relationship, this time meeting with Li Chenggang, International Trade Negotiator and Vice Minister of the ministry.There are very few details of the meeting, even in the Ministry of Commerce's own official announcement. It's not even said where the two met, although it's likely to have been at the Ministry's offices in Beijing. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Resideo's Scott Harkins talks about the new Honeywell Home X8S on HomeKit Insider
On this week's episode of the HomeKit Insider podcast, Scott Harkins from Resideo joins to talk about the new Honeywell Home X8S Matter thermostat and the future of the smart home.HomeKit Insider PodcastScott Harkins serves as the Senior VP of Sales at Resideo, that also overseas the Honeywell Home brand. After a tepid first few steps, the brand is going all-in on Matter with the launch of the Honeywell Home X8S thermostat.This thermostat, announced ahead of CES, is aimed at the premium market alongside Ecobee and Nest. It has a customizable touchscreen display, optional room sensors, and IAQ monitoring built-in. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Apple Wallet’s iOS 26 boarding passes now offered by three major airlines
iOS 26 brought a bunch of great changes to Apple’s Wallet app, including an upgraded experience for boarding passes. Another major airline has recently added support for the new boarding passes, making at least three total so far. Here are the details. more…

Read more »

iPhone Fold and future Galaxy foldable may end up copying the original Pixel Fold
After Google pivoted away from its stout book-like foldable form factor found in the original Pixel Fold, Apple’s coming iPhone Fold and a future Samsung foldable may just end up copying the same idea. more…

Read more »

Apple TV has three fan-favorite shows returning soon, here’s what’s coming
Apple TV has put together a strong lineup to kick off 2026, including three fan-favorite shows returning soon that you still have time to catch up on. Here’s what’s coming. more…

Read more »

Grab four AirTags for just under $65 and finish your holiday shopping
Macworld If there’s one thing everyone in your life needs, it’s a set of AirTags. A simple AirTag attached to your keychain or popped into a pocket can make sure it never gets lost. And today you can get a four-pack for $65, just $2 off its all-time low. View at Amazon These AirTags are super light and tiny, and they’re super easy to pair with iPhones and iPads. And it’s just as simple if you lose something—just open up the app to see all the tags’ locations on the map. If the tags are within reach, you can have them make a sound, and if they’re farther away, they’ll just ping off of other iPhones and iPads in the area. So, if you attach one of these tags to your luggage and it gets lost at the airport, you’ll be able to track it down before the airline does. We loved the AirTags when we reviewed them, giving them a four-star rating. Our only issue is that you’ll need a separate keyring to attach them to your keys, but you can save more than half off on a pair at Woot. So, stop wasting time, and grab a four-pack of AirTags for $65 at Amazon before the deal expires. Buy now at Amazon

Read more »

Reddit comment led police to identify Brown University shooter
A comment in a Reddit thread was what led police and FBI investigators to identify the Brown University shooter. Rhode Island Attorney General Peter Neronha said the comment on Reddit was what enabled police to track down the rental car which enabled them to identify the shooter … more…

Read more »

Apple TV claims three spots on TIME’s list of the 10 best TV shows of 2025 — more than any other streamer or network
Apple TV claims three spots on TIME's list of the 10 best TV shows of 2025, underscoring its dominance in delivering critically acclaimed… The post appeared first on MacDailyNews.

Read more »

iPhone Fold’s key display breakthrough may still be in flux, per leak
It’s the time of year when Apple finalizes many design details and specs for next fall’s flagship iPhone lineup. But the latest leak indicates a key feature of the iPhone Fold’s display—the crease free design—is still very much in flux. more…

Read more »

Italy slaps Apple with $115 million penalty in App Tracking Transparency case
Italy's antitrust watchdog, the AGCM, announced on Monday that it has imposed a €98.6 million ($115.53 million) fine on Apple and two… The post appeared first on MacDailyNews.

Read more »

iPhone Air review three months later: Compromise is good
The iPhone Air remains controversial even three months after its release, but after a quarter of a year with one in my pocket, I'm in no rush to go back to a Pro Max.iPhone Air three-month review: An iPhone like no otherThe arrival of the iPhone Air in September 2025 came after months of rumors. It's rare for any iPhone to live up to that kind of hype, but the iPhone Air did it.It was every bit as thin and light as we'd been told to expect by every leaker under the sun. And even after Apple announced it, seeing was most definitely believing — you really need to get your hands on an iPhone Air to understand it. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Boox Note Air 5 C review: An already good e-ink reader made a little bit better
The Boox Note Air 5 C e-ink tablet and ebook reader doesn't try to fix what isn't broken, but its internal upgrades help an already solid tablet become just a bit stronger.Boox Note Air 5 CIn October, Boox rolled out an update to its Boox Note Air line. That means we're now on the fifth iteration, and I was curious to see what it had changed. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Baseus PicoGo AF21 3-in-1 Qi2.2 Wireless Charger review: More than meets the eye
Macworld At a glanceExpert's Rating Pros 3-in-1 Compact and foldable Fastest iPhone wireless charging Apple Watch fast charging Adjustable iPhone pad Cons 25W only for iPhone 16 and later Our Verdict This versatile 3-in-1 charger has the looks of a desktop charger but the portability of a travel charger. Its neat design is a pleasure to adjust, and the speed is as fast as you can get from a wireless iPhone/Watch/AirPods charger. Price When Reviewed This value will show the geolocated pricing text for product undefined Best Pricing Today Price When Reviewed$89.99 Best Prices Today: Baseus 3-in-1 PicoGo 25W Wireless Charger (AF21) Retailer Price $69.99 View Deal $89.99 View Deal Baseus $89.99 View Deal Price comparison from over 24,000 stores worldwide Product Price Price comparison from Backmarket With the PicoGo AF21, Baseus has created a Transformers-like multi-device charger that unfolds into a highly adjustable and super-speedy iPhone charging stand that also powers up the Apple Watch and AirPods case. Unlike most 3-in-1 charging stands, you can set it into quite different positions depending on how and where you are using it to charge your favorite Apple devices. As soon as you unfold it, you’re sure to get a few admiring glances. Simon Jary PicoGo AF21: Design Before we investigate the charger’s impressive performance, the most notable thing about the PicoGo AF21is its size in conjunction with its features. Folded up, it measures just 2.97 x 3.15 x 1.5 inches (7.5 x 8 x 3.8cm) and weighs 9oz (254g), small enough to slide into a pants pocket. Simon Jary It can be used as a flat iPhone charger in its folded state—and even charge a Watch when flat—but comes into its own when gently unfolded. The iPhone charging pad raises on a single arm to about an inch above the desktop. There are taller iPhone charging stands, for sure, but few are as lightweight and portable as the PicoGo AF21. The brace bracket is adjustable from 0-55 degrees, and the charging pad 0-115 degrees. Simon Jary The cleverest design element is the Apple Watch charger that slides out from behind the iPhone charging pad and can sit vertically at 90 degrees or fully horizontally at 180 degrees. PicoGo AF21: Performance The PicoGo AF21 utilizes the latest and fastest Qi 2.2 technology that pushes wireless charging to near the same speed you’ll get from jamming a charging cable into the iPhone’s port. The most basic MagSafe-compatible wireless chargers can output 7.5W of power, while a certified MagSafe or Qi2 charger doubles that to 15W. But the very latest MagSafe/Qi 2.2 chargers push out 25W of power. In real terms, this equates to an iPhone recharging from 0-50 percent in around half an hour, which would take some 45 minutes at 15W. In our test recharging an iPhone 16 Pro on the PicoGo AF21, we got to 50 percent in 27 minutes, which equals the fastest speeds we saw on the less-portable Anker Prime 3-in-1 Charging Stand. If charging overnight, that speed jump won’t matter, but it will certainly save you time when you’re in a hurry to get your iPhone back to life as quickly as possible. After reaching 50 percent, all chargers slow down in order to protect the device’s battery, which is why we usually quote comparable charging times at the start of the cycle. Note too that only the iPhone 16 and iPhone 17 families support full 25W charging, while the Air can handle 20W. Older iPhones using a 25W-capable charger are pegged back to the previous 15W maximum. See our feature on which wireless charging tech is best for each iPhone for more details. Some 25W chargers introduce active-cooling elements—such as ESR’s CryoBoost, Belkin’s ChillBoost, and Anker’s AirCool—to reduce the charging heat that can push the iPhone to switch off charging to protect its battery. Baseus hasn’t incorporated any active cooling into the PicoGo AF21, so it’s possible that charging could be slowed in harsher conditions, but we didn’t notice any issues. Alternatives to the PicoGo AF21 The closest rival to the PicoGo AF21 is Kuxiu’s X40 Turbo, a similar foldable 3-in-1 charger that charges at 25W. The metal X40 Turbo is even smaller folded up at just 2.5 x 2.5 x 0.7 inches (6.4 x 6.4 x 1.8cm) when folded up and weighs less too at 5.2oz (148g), compared to the AF21’s 3 x 3.15 x 1.5 inches (7.5 x 8 x 3.8cm) and 9oz (254g) weight. However, the PicoGo AF21 is more adjustable, especially the nifty Watch charger at the back. The X40’s design features a more traditional stand arrangement and is available in a wider choice of four colors. Simon Jary PicoGo AF21: Price The Baseus PicoGo AF21 3-in-1 Qi2.2 Wireless Charger is priced at $90 and is available only in the U.S. at the time of writing. That’s a good price for such a portable and adjustable 25W charger. Baseus ships a 45W USB-C wall charger and charging cable in the box. The rival Kuxiu X40 Turbo has a pricier $100 MSRP, but can usually be found at a discount. Check out all our reviews of the best 3-in-1 magnetic wireless chargers for a wide variety of choices. Simon Jary Should you buy the Baseus PicoGo AF21 3-in-1 Qi2.2 Wireless Charger? This versatile 3-in-1 charger has the looks of a desktop charger but the portability of a travel charger. Its neat design is a pleasure to adjust, and the speed is as fast as you can get from a wireless iPhone/Watch/AirPods charger.

Read more »

Apple cozies up to Samsung as RAM gets ridiculously expensive
Samsung has always been a part of the iPhone supply chain, and Apple is about to lean on the company more as RAM prices skyrocket worldwide.A Samsung LPDDR5X memory chip - Image Credit: SamsungThe Apple supply chain relies on multiple companies when it comes to memory. Samsung already provides Apple with a lot of the memory for its manufacturing needs, but its share should be expanding in the coming years.According to sources of Korea Economic Daily, Apple's renewals of long-term agreements will be more beneficial for Samsung. Apple will reportedly increase the amount of memory it sources from Samsung to about 60% to 70% of the iPhone 17 supply. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Apple about to test iPhone 18 production, ready for new split-launch plan
A leaker with a good track record says that suppliers are gearing up for iPhone 18 production as the company prepares for its new split-launch plan. The new strategy will see the base model iPhone 18 go on sale earlier in the year, with production potentially underway by mid-February … more…

Read more »

Don't expect big changes in the iPhone 18 Pro design
A new report claims that the iPhone 18 series will enter test production soon, but also that the Pro models will closely resemble the current design.The iPhone 18 Pro is expected to deliver a multitude of improvements.There have been many reports of significant updates to the iPhone 18 Pro, though most expect that the differences will be internal. Now a new claim from leaker Fixed Focus Digital includes the caution (in translation) that "the appearance change is not as large as everyone thought."The leaker also claims that testing is to begin on the whole iPhone 18 range after New Year's Day. He or she further says that there will be tests of mass production. Rumor Score: 🤯 Likely Continue Reading on AppleInsider | Discuss on our Forums

Read more »

MacSync Stealer variant finds a way to bypass Apple malware protections
We’ve recently seen how ChatGPT was used to trick Mac users into installing MacStealer, and now a different tactic has been found to persuade users to install a version of MacSync Stealer. The Mac remains a relatively difficult target for attackers thanks to Apple’s protections against the installation of malware. However, Mac malware is on the increase, and two recently-discovered tactics discovered by security researchers highlight the creative approaches some attackers are using … more…

Read more »

Italy fines Apple $115 million over App Tracking Transparency
The Italian antitrust agency says Apple abuses its dominant market position with the App Store and has fined it $115 million having apparently misunderstood App Tracking Transparency.Apple's App Store award trophyItaly's Autorita Garante Della Concorrenza E Del Mercato (AGCM) competition authority began an investigation back in May 2023. At the time, it said this was in part because Apple imposed "a more restrictive privacy policy" on third-party developers than it does itself.The privacy policy is Apple's App Tracking Transparency (ATT), which was in iOS 14.5 as a way to let users decide whether each specific app developer should be allowed to track their activity. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Dismantling Defenses: Trump 2.0 Cyber Year in Review
The Trump administration has pursued a staggering range of policy pivots this past year that threaten to weaken the nation’s ability and willingness to address a broad spectrum of technology challenges, from cybersecurity and privacy to countering disinformation, fraud and corruption. These shifts, along with the president’s efforts to restrict free speech and freedom of the press, have come at such a rapid clip that many readers probably aren’t even aware of them all.

Read more »

Most Parked Domains Now Serving Malicious Content
Direct navigation -- the act of visiting a website by manually typing a domain name in a web browser -- has never been riskier: A new study finds the vast majority of "parked" domains -- mostly expired or dormant domain names, or common misspellings of popular websites -- are now configured to redirect visitors to sites that foist scams and malware.

Read more »

Computer Virus Protection Tips and How to Remove a Virus from Your Computer
Computer viruses continue to be a widespread and costly problem, affecting everyone from casual computer users to major organizations. Some of the most damaging incidents in history started with small actions that could have happened to anyone. The Melissa virus spread in 1999 because thousands of people opened what looked like a normal email attachment. […] The post appeared first on The Mac Security Blog.

Read more »

Microsoft Patch Tuesday, December 2025 Edition
Microsoft today pushed updates to fix at least 56 security flaws in its Windows operating systems and supported software. This final Patch Tuesday of 2025 tackles one zero-day bug that is already being exploited, as well as two publicly disclosed vulnerabilities.

Read more »

Drones to Diplomas: How Russia’s Largest Private University is Linked to a $25M Essay Mill
A sprawling academic cheating network turbocharged by Google Ads that has generated nearly $25 million in revenue has curious connections to a Kremlin-connected oligarch whose Russian university builds drones for Russia's war against Ukraine.

Read more »

SMS Phishers Pivot to Points, Taxes, Fake Retailers
China-based phishing groups blamed for non-stop scam SMS messages about a supposed wayward package or unpaid toll fee are promoting a new offering, just in time for the holiday shopping season: Phishing kits for mass-creating fake but convincing e-commerce websites that convert customer payment card data into mobile wallets from Apple and Google. Experts say these same phishing groups also are now using SMS lures that promise unclaimed tax refunds and mobile rewards points.

Read more »

Vulnerability Summary for the Week of November 24, 2025
High Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info Patch Info 0x4m4--HexStrike AI By providing a command-line argument starting with a semi-colon ; to an API endpoint created by the EnhancedCommandExecutor class of the HexStrike AI MCP server, the resultant composed command is executed directly in the context of the MCP server's normal privilege; typically, this is root. There is no attempt to sanitize these arguments in the default configuration of this MCP server at the affected version (as of commit 2f3a5512 in September of 2025). 2025-11-30 9.1 CVE-2025-35028 https://takeonme.org/gcves/GCVE-1337-2025-00000000000000000000000000000000000000000000000000111111111111111111111111000000000000000000000000000000000000000000000000000000011  AMD--AMD Prof Improper return value within AMD uProf can allow a local attacker to bypass KSLR, potentially resulting in loss of confidentiality or availability. 2025-11-24 7.1 CVE-2025-48510 https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-9019.html  AMD--Xilinx Run Time (XRT) Improper input validation within the XOCL driver may allow a local attacker to generate an integer overflow condition, potentially resulting in loss of confidentiality or availability. 2025-11-24 8 CVE-2025-52538 https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8014.html  AMD--Xilinx Run Time (XRT) Inadequate lock protection within Xilinx Run time may allow a local attacker to trigger a Use-After-Free condition potentially resulting in loss of confidentiality or availability 2025-11-24 7.3 CVE-2025-0003 https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8014.html  AMD--Xilinx Run Time (XRT) Improper input validation within the XOCL driver may allow a local attacker to generate an integer overflow condition, potentially resulting in crash or denial of service. 2025-11-24 7.3 CVE-2025-0005 https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8014.html  AMD--Xilinx Run Time (XRT) A buffer overflow with Xilinx Run Time Environment may allow a local attacker to read or corrupt data from the advanced extensible interface (AXI), potentially resulting in loss of confidentiality, integrity, and/or availability. 2025-11-24 7.3 CVE-2025-52539 https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8014.html  ASR--Lapwing_Linux Out-of-bounds Read vulnerability in ASR1903ASR3901 in ASR Lapwing_Linux on Linux (nr_fw modules). This vulnerability is associated with program files Code/nr_fw/DLP/src/NrCgi.C. This issue affects Lapwing_Linux: before 2025/11/26. 2025-11-26 7.4 CVE-2025-13735 https://www.asrmicro.com/en/goods/psirt?cid=41  blubrry--PowerPress Podcasting plugin by Blubrry The Blubrry PowerPress plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in all versions up to, and including, 11.15.2. This is due to the plugin validating file extensions but not halting execution when validation fails in the 'powerpress_edit_post' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. 2025-11-27 8.8 CVE-2025-13536 https://www.wordfence.com/threat-intel/vulnerabilities/id/d420ee49-e7b3-43d8-a263-8a93abd1133c?source=cvehttps://plugins.trac.wordpress.org/browser/powerpress/tags/11.14.1/powerpressadmin.php#L3068https://plugins.trac.wordpress.org/browser/powerpress/tags/11.14.1/powerpressadmin.php#L3012https://plugins.trac.wordpress.org/browser/powerpress/tags/11.14.1/powerpressadmin.php#L2368https://plugins.trac.wordpress.org/changeset/3402635/  Chanjet--CRM A vulnerability has been found in Chanjet CRM up to 20251106. The impacted element is an unknown function of the file /tools/upgradeattribute.php. The manipulation of the argument gblOrgID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. 2025-11-30 7.3 CVE-2025-13788 VDB-333792 | Chanjet CRM upgradeattribute.php sql injectionVDB-333792 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #690084 | Chanjet CRM V1.0 SQL Injectionhttps://github.com/Bellingham-max/CVE/issues/1  code-projects--COVID Tracking System A vulnerability was detected in code-projects COVID Tracking System 1.0. This issue affects some unknown processing of the file /login.php. The manipulation of the argument code results in sql injection. The attack may be performed from remote. The exploit is now public and may be used. 2025-11-24 7.3 CVE-2025-13585 VDB-333349 | code-projects COVID Tracking System login.php sql injectionVDB-333349 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #699840 | code-projects COVID Tracking System V1.0 SQL Injectionhttps://github.com/beamyou/CVE/issues/4https://code-projects.org/  code-projects--Jonnys Liquor A security flaw has been discovered in code-projects Jonnys Liquor 1.0. Affected by this issue is some unknown functionality of the file /detail.php of the component GET Parameter Handler. Performing manipulation of the argument Product results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited. 2025-11-24 7.3 CVE-2025-13582 VDB-333346 | code-projects Jonnys Liquor GET Parameter detail.php sql injectionVDB-333346 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #699554 | code-projects Jonnys Liquor 1.0 /detail.php SQL injectionhttps://github.com/rassec2/dbcve/issues/5https://code-projects.org/  code-projects--Library System A vulnerability has been found in code-projects Library System 1.0. This affects an unknown function of the file /index.php of the component Login. The manipulation of the argument Username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. 2025-11-24 7.3 CVE-2025-13578 VDB-333342 | code-projects Library System Login index.php sql injectionVDB-333342 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #699536 | code-projects Library System 1.0 index.php SQL Injectionhttps://github.com/rassec2/dbcve/issues/4https://code-projects.org/  code-projects--Question Paper Generator A weakness has been identified in code-projects Question Paper Generator 1.0. This affects an unknown part of the file /signupscript.php of the component POST Parameter Handler. Executing manipulation of the argument Fname can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be exploited. 2025-11-24 7.3 CVE-2025-13583 VDB-333347 | code-projects Question Paper Generator POST Parameter signupscript.php sql injectionVDB-333347 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #699591 | code-projects question paper 1.0 /signupscript.php SQL Injectionhttps://github.com/rassec2/dbcve/issues/6https://code-projects.org/  cursor--cursor Improper neutralization of special elements used in an OS command ('command injection') in Cursor allows an unauthorized attacker to execute commands that are outside of those specified in the allowlist, resulting in arbitrary code execution. 2025-11-26 9.8 CVE-2025-62354 https://hiddenlayer.com/sai_security_advisor/2025-11-cursor/  Dassault Systmes--DELMIA Service Process Engineer A stored Cross-site Scripting (XSS) vulnerability affecting Service Items Management in DELMIA Service Process Engineer on Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session. 2025-11-24 8.7 CVE-2025-10555 https://www.3ds.com/trust-center/security/security-advisories/cve-2025-10555  Dassault Systmes--ENOVIA Product Manager A stored Cross-site Scripting (XSS) vulnerability affecting Requirements in ENOVIA Product Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session. 2025-11-24 8.7 CVE-2025-10554 https://www.3ds.com/trust-center/security/security-advisories/cve-2025-10554  DirectoryThemes--Tiger The Tiger theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 101.2.1. This is due to the 'paypal-submit.php' file not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site. 2025-11-27 9.8 CVE-2025-13675 https://www.wordfence.com/threat-intel/vulnerabilities/id/4750b57e-7d8d-49d7-bbbf-46483eb97bd9?source=cvehttps://themeforest.net/item/tiger-social-network-theme-for-companies-professionals/16203995  DirectoryThemes--Tiger The Tiger theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 101.2.1. This is due to the plugin allowing a user to update the user role through the $user- >set_role() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator. 2025-11-27 8.8 CVE-2025-13680 https://www.wordfence.com/threat-intel/vulnerabilities/id/645f60ad-c8e5-47ec-94f1-960de4ef7838?source=cvehttps://themeforest.net/item/tiger-social-network-theme-for-companies-professionals/16203995  Eaton--Eaton Galileo Software Improper input sanitization in the file archives upload functionality of Eaton Galileo software allows traversing paths which could lead into an attacker with local access to execute unauthorized code or commands. This security issue has been fixed in the latest version of Galileo which is available on the Eaton download center. 2025-11-27 7.3 CVE-2025-59890 https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2025-1024.pdf  Elated Themes--FindAll Listing The FindAll Listing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.5. This is due to the 'findall_listing_user_registration_additional_params' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site. Note: The vulnerability can only be exploited if the FindAll Membership plugin is also activated, because user registration is in that plugin. 2025-11-27 9.8 CVE-2025-13538 https://www.wordfence.com/threat-intel/vulnerabilities/id/14981949-271c-4f98-a6a1-b00619f1436d?source=cvehttps://themeforest.net/item/findall-business-directory-theme/24415962  Elated Themes--FindAll Membership The FindAll Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.4. This is due to the plugin not properly logging in a user with the data that was previously verified through the 'findall_membership_check_facebook_user' and the 'findall_membership_check_google_user' functions. This makes it possible for unauthenticated attackers to log in as administrative users, as long as they have an existing account on the site which can easily be created by default through the temp user functionality, and access to the administrative user's email. 2025-11-27 9.8 CVE-2025-13539 https://www.wordfence.com/threat-intel/vulnerabilities/id/a856a96a-68d2-462d-b523-840668980807?source=cvehttps://themeforest.net/item/findall-business-directory-theme/24415962  factionsecurity--faction FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to version 1.7.1, an extension execution path in Faction's extension framework permits untrusted extension code to execute arbitrary system commands on the server when a lifecycle hook is invoked, resulting in remote code execution (RCE) on the host running Faction. Due to a missing authentication check on the /portal/AppStoreDashboard endpoint, an attacker can access the extension management UI and upload a malicious extension without any authentication, making this vulnerability exploitable by unauthenticated users. This issue has been patched in version 1.7.1. 2025-11-26 9.7 CVE-2025-66022 https://github.com/factionsecurity/faction/security/advisories/GHSA-xr72-2g43-586whttps://github.com/factionsecurity/faction/commit/c6389f1c76175b7c1c68d1a87b389311b16c62c3  fugue-project--fugue Fugue is a unified interface for distributed computing that lets users execute Python, Pandas, and SQL code on Spark, Dask, and Ray with minimal rewrites. In version 0.9.2 and prior, there is a remote code execution vulnerability by pickle deserialization via FlaskRPCServer. The Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the _decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC server. The vulnerability exists in the RPC communication mechanism where the client can send arbitrary serialized Python objects that will be deserialized on the server side, allowing attackers to execute arbitrary code on the victim's machine. This issue has been patched via commit 6f25326. 2025-11-25 8.8 CVE-2025-62703 https://github.com/fugue-project/fugue/security/advisories/GHSA-xv5p-fjw5-vrj6https://github.com/fugue-project/fugue/commit/6f25326779fd1f528198098d6287c5a863176fc0  geoserver--geoserver GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.26.2 and before 2.25.6, an XML External Entity (XXE) vulnerability was identified. The application accepts XML input through a specific endpoint /geoserver/wms operation GetMap. However, this input is not sufficiently sanitized or restricted, allowing an attacker to define external entities within the XML request. This issue has been patched in GeoServer 2.25.6, GeoServer 2.26.3, and GeoServer 2.27.0. 2025-11-25 8.2 CVE-2025-58360 https://github.com/geoserver/geoserver/security/advisories/GHSA-fjf5-xgmq-5525https://osgeo-org.atlassian.net/browse/GEOS-11682  GitLab--GitLab GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that could have allowed an unauthenticated user to cause a Denial of Service condition by sending specifically crafted requests containing malicious JSON payloads. 2025-11-26 7.5 CVE-2025-12571 GitLab Issue #579168HackerOne Bug Bounty Report #3362239  GL-Inet--GL-AXT1800 A firmware downgrade vulnerability exists in the OTA Update functionality of GL-Inet GL-AXT1800 4.7.0. A specially crafted .tar file can lead to a firmware downgrade. An attacker can perform a man-in-the-middle attack to trigger this vulnerability. 2025-11-24 8.3 CVE-2025-44018 https://talosintelligence.com/vulnerability_reports/TALOS-2025-2230  HCL Software--iNotes HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input. A remote, unauthenticated attacker can specially craft a URL to execute script in a victim's Web browser within the security context of the hosting Web site and/or steal the victim's cookie-based authentication credentials. 2025-11-25 8.1 CVE-2025-0248 https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0127032  Huawei--HarmonyOS Permission control vulnerability in the memory management module. Impact: Successful exploitation of this vulnerability may affect confidentiality. 2025-11-28 9.3 CVE-2025-64314 https://consumer.huawei.com/cn/support/bulletinlaptops/2025/11/  Huawei--HarmonyOS Permission control vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. 2025-11-28 8.4 CVE-2025-58302 https://consumer.huawei.com/en/support/bulletin/2025/11/  Huawei--HarmonyOS UAF vulnerability in the screen recording framework module. Impact: Successful exploitation of this vulnerability may affect availability. 2025-11-28 8.4 CVE-2025-58303 https://consumer.huawei.com/en/support/bulletin/2025/11/  Huawei--HarmonyOS Permission control vulnerability in the distributed component. Impact: Successful exploitation of this vulnerability may affect service confidentiality. 2025-11-28 8 CVE-2025-58310 https://consumer.huawei.com/en/support/bulletin/2025/11/  Huawei--HarmonyOS Vulnerability of improper criterion security check in the call module. Impact: Successful exploitation of this vulnerability may cause features to perform abnormally. 2025-11-28 7.3 CVE-2025-58308 https://consumer.huawei.com/en/support/bulletin/2025/11/  Huawei--HarmonyOS DoS vulnerability in the video-related system service module. Impact: Successful exploitation of this vulnerability may affect availability. 2025-11-28 7.3 CVE-2025-58316 https://consumer.huawei.com/en/support/bulletin/2025/11/  Janitza--UMG 96-PA An unauthenticated remote attacker can send a specially crafted Modbus read command to the device which leads to a denial of service. 2025-11-24 7.5 CVE-2025-41729 https://certvde.com/de/advisories/VDE-2025-094  kiteworks--security-advisories Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, a bug in Kiteworks MFT could cause under certain circumstances that a user's active session would not properly time out due to inactivity. This issue has been patched in version 9.1.0. 2025-11-29 7.1 CVE-2025-53896 https://github.com/kiteworks/security-advisories/security/advisories/GHSA-23h2-3jj8-58hm  kiteworks--security-advisories Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, the back-end of Kiteworks MFT is vulnerable to an incorrectly specified destination in a communication channel which allows an attacker with administrative privileges on the system under certain circumstances to intercept upstream communication which could lead to an escalation of privileges. This issue has been patched in version 9.1.0. 2025-11-29 7.2 CVE-2025-53899 https://github.com/kiteworks/security-advisories/security/advisories/GHSA-5gx5-vcpp-8cr5  Logpoint--SIEM An issue was discovered in Logpoint before 7.7.0. Insufficient input validation and a lack of output escaping in multiple components leads to a cross-site scripting (XSS) vulnerability. 2025-11-27 8.5 CVE-2025-66359 https://servicedesk.logpoint.com/hc/en-us/articles/29158899698333-XSS-Vulnerability-due-to-insufficient-input-validation  Mattermost--Mattermost Mattermost versions 10.12.x

Read more »

Cybersecurity Best Practices: Essential Tips for Modern Mac Security
Cybersecurity affects every person who uses a device, connects to the internet, pays bills online, or stores important files digitally. The rise of cloud services, mobile apps, and complex online accounts has created new opportunities for criminals to target individuals. Mac users benefit from strong built-in protections, but threats now focus less on operating systems […] The post appeared first on The Mac Security Blog.

Read more »

What Is a Network Security Key? How to Find Your Wi-Fi Password on Any Device
If you have ever tried connecting a new phone, laptop, tablet, or smart home device to your Wi-Fi network, you have likely been asked for something called a network security key. The name sounds technical, but it simply refers to the password that protects your wireless network. Understanding what a network security key is, how […] The post appeared first on The Mac Security Blog.

Read more »

Meet Rey, the Admin of ‘Scattered Lapsus$ Hunters’
A prolific cybercriminal group that calls itself "Scattered LAPSUS$ Hunters" made headlines regularly this year by stealing data from and publicly mass extorting dozens of major corporations. But the tables seem to have turned somewhat for "Rey," the moniker chosen by the technical operator and public face of the hacker group: Earlier this week, Rey confirmed his real life identity and agreed to an interview after KrebsOnSecurity tracked him down and contacted his father.

Read more »

Is Your Android TV Streaming Box Part of a Botnet?
On the surface, the Superbox media streaming devices for sale at retailers like BestBuy and Walmart may seem like a steal: They offer unlimited access to more than 2,200 pay-per-view and streaming services like Netflix, ESPN and Hulu, all for a one-time fee of around $400. But security experts warn these TV boxes require intrusive software that forces the user's network to relay Internet traffic for others, traffic that is often tied to cybercrime activity such as advertising fraud and account takeovers.

Read more »

Best Apple Holiday Sale: Take $250 off all 13-inch and 15-inch M4 MacBook Airs
Amazon has all 13" M4 MacBook Airs and 15" M4 MacBook Airs on Holiday sale for $250 off Apple's MSRP, starting at only $749. Be sure to select Amazon as the seller, rather than a third-party: - 13" M4 MacBook Air (16GB/256GB): $749, $250 off - 13" M4 MacBook Air (16GB/512GB): $949, $250 off - 13" M4 MacBook Air (24GB/512GB): $1149, $250 off - 15" M4 MacBook Air (16GB/256GB): $949, $250 off - 15" M4 MacBook Air (16GB/512GB): $1149, $250 off - 15" M4 MacBook Air (24GB/512GB/): $1349, $250 off Their prices are the lowest available for new M4 MacBook Airs anywhere and the best Holiday deal on Apple products available right now. For the latest sales & prices, see our 13" MacBook Air Price Tracker and 15" MacBook Air Price Tracker, both updated daily.

Read more »

Holiday Sale: Get an 11-inch A16 iPad today for $75 off MSRP, only $274
Walmart is offering a $75 Holiday discount on Apple's 11" A16 WiFi iPads, now priced at only $274. Sale price for online orders only, in-store price may vary. Order online and choose free shipping or free local store pickup (if available): - 11" 128GB WiFi A16 iPad: $274, $75 off MSRP - 11" 256GB WiFi A16 iPad: $374, $75 off MSRP - 11" 512GB WiFi A16 iPad: $574, $75 off MSRP These are the lowest Holiday sale prices currently available for Apple iPads. Note that not all colors are in stock at the time of this post (see their site for details). For the latest prices & deals, keep an eye on our iPad Price Tracker, updated daily.

Read more »

Walmart has AirPods on Holiday sale right now starting at only $74
Walmart has Apple AirPods on Holiday sale on their online store for up to $55 off MSRP. Order online and choose free shipping or free local store pickup (if available): - AirPods 4: $74, $55 off - AirPods 4 with ANC: $139.99, $40 off - AirPods Pro 3: $199, $50 off These are the lowest Holiday sale prices available right now for Apple AirPods. Keep an eye on our AirPods Price Tracker for the latest prices and deals, updated daily.

Read more »

Walmart has clearance 13-inch M1 MacBook Airs on sale for only $599
Walmart has clearance, but new, Apple 13" M1 MacBook Airs (8GB RAM, 256GB SSD) available online for $599, $400 off original MSRP, in Space Gray, Silver, and Gold colors. These are new MacBooks for sale by Walmart directly, not a third-party seller. These sale prices are available for online orders only. Order online, and choose free shipping or free local store pickup (if available). Delivery is available as soon as December 23rd. Note that stock status may vary, check Walmart's site for availability. For the latest sales & prices, see our 13" MacBook Air Price Tracker, updated daily.

Read more »

Mac Studio with M4 Max CPU on Holiday sale for $1799, $200 off Apple’s MSRP
B&H Photo has the standard-configuration Mac Studio model with Apple's M4 Max CPU in stock today and on Holiday sale for $200 off MSRP, now $1799 (10-Core CPU and 32GB RAM/512GB SSD). B&H also offers free 1-2 day shipping to most US addresses. Their price is the lowest available for this model. For the latest prices and sales, see our Mac Studio Price Tracker, updated daily.

Read more »

Apple’s new 14-inch M5 MacBook Pros remain on Holiday sale for $250 off MSRP, prices start at $1349
Amazon is offering $250 discounts on new 14" M5 MacBook Pros as part of their Holiday sales, each including free shipping: - 14" M5 MacBook Pro (16GB/512GB/Black): $1349.99, MSRP $1599 - 14" M5 MacBook Pro (16GB/512GB/Silver): $1349, MSRP $1599 - 14" M5 MacBook Pro (16GB/1TB/Black): $1549, MSRP $1799 - 14" M5 MacBook Pro (16GB/1TB/Silver): $1729, MSRP $1799 - 14" M5 MacBook Pro (24GB/1TB/Black): $1849, MSRP $1999 - 14" M5 MacBook Pro (24GB/1TB/Silver): $1799, MSRP $1999 These are the lowest prices available for new M5 MacBook Pros right now. For the latest sales and prices, keep an eye on our 14-inch MacBook Pro Price Tracker, updated daily.

Read more »

Holiday Deal: Apple AirPods 4 for only $74, normally $129
Walmart has Apple AirPods 4 now on Holiday sale on their online store for $55 off MSRP, only $74. Order online and choose free shipping or free local store pickup (if available). This is the lowest price currently available for new AirPods among Apple's retailers: - AirPods 4: $74, $55 off Keep an eye on our AirPods Price Tracker for the latest prices and deals, updated daily.

Read more »

Apple’s 15-inch M4 MacBook Airs are back on Holiday sale again for $250 off MSRP, prices start at $949
Amazon has all 15" M4 MacBook Airs on Holiday sale again for $250 off Apple's MSRP, starting at only $949. Delivery is still available in time for Christmas. Be sure to select Amazon as the seller, rather than a third-party: - 15" M4 MacBook Air (16GB/256GB): $949, $250 off - 15" M4 MacBook Air (16GB/512GB): $1149, $250 off - 15" M4 MacBook Air (24GB/512GB/): $1349, $250 off These are the best Holiday sale prices currently available for 15" M4 MacBook Airs. For the latest sales & prices, see our 15" MacBook Air Price Tracker, updated daily.

Read more »

Holiday Sale: $70 off Apple’s 11-inch A16 iPad, now only $279
Walmart is offering a $70 Holiday discount on Apple's 11" A16 WiFi 128GB iPad, now priced at only $279. Sale price for online orders only, in-store price may vary. Order online and choose free shipping or free local store pickup (if available): - 11" 128GB WiFi A16 iPad: $279, $70 off MSRP For the latest prices & deals, keep an eye on our iPad Price Tracker, updated daily.

Read more »

Take $440 off Apple’s 16-inch MacBook Pros with the latest Holiday sale prices
Amazon has 16-inch M4 Pro and M4 Max MacBook Pros (Silver and Black colors) on sale for up to $440 off Apple's MSRP as part of their Holiday sales. Shipping is free. Be sure to select Amazon as the seller, rather than a third-party seller: - 16" M4 Pro MacBook Pro (24GB/512GB/Black): $2199, $300 off MSRP - 16" M4 Pro MacBook Pro (24GB/512GB/Silver): $2190.08, $309 off MSRP - 16" M4 Pro MacBook Pro (48GB/512GB/Black): $2529, $370 off MSRP - 16" M4 Pro MacBook Pro (48GB/512GB/Silver): $2549, $350 off MSRP - 16" M4 Max MacBook Pro (36GB/1TB/Black): $3063.84, $436 off MSRP - 16" M4 Max MacBook Pro (36GB/1TB/Silver): $3059.76, $440 off MSRP - 16" M4 Max MacBook Pro (48GB/1TB/Black): $3599, $400 off MSRP - 16" M4 Max MacBook Pro (48GB/1TB/Silver): $3599, $400 off MSRP These are the lowest Holiday sale prices on new 16" Apple MacBook Pros right now. For the latest sales and prices, keep an eye on our 16-inch MacBook Pro Price Tracker, updated daily.

Read more »

Sunday Holiday Sale: Take $200-$250 off M4 MacBook Airs, prices start at only $749
Amazon has all 13" M4 MacBook Airs and 15" M4 MacBook Airs on Holiday sale for $200-$250 off Apple's MSRP, starting at only $749. Be sure to select Amazon as the seller, rather than a third-party: - 13" M4 MacBook Air (16GB/256GB): $749, $250 off - 13" M4 MacBook Air (16GB/512GB): $949, $250 off - 13" M4 MacBook Air (24GB/512GB): $1149, $250 off - 15" M4 MacBook Air (16GB/256GB): $999, $200 off - 15" M4 MacBook Air (16GB/512GB): $1199, $200 off - 15" M4 MacBook Air (24GB/512GB/): $1399, $200 off Their prices are the lowest available for new M4 MacBook Airs anywhere and represent one of the best Holiday deals on Apple products available right now. For the latest sales & prices, see our 13" MacBook Air Price Tracker and 15" MacBook Air Price Tracker, both updated daily.

Read more »

Holiday Sale: M4 Mac minis available starting at only $479
Amazon has M4 and M4 Pro Mac minis on Holiday sale starting at only $479 and ranging up to $120 off MSRP. Shipping is free: - Mac mini M4 (16GB/256GB): $479, $120 off MSRP - Mac mini M4 (16GB/512GB): $699, $100 off MSRP - Mac mini M4 (24GB/512GB): $923, $26 off MSRP - Mac mini M4 Pro (24GB/512GB): $1287, $112 off MSRP These are the lowest Holiday sale prices currently available on Mac minis. For the latest prices and sales, keep an eye on our Mac mini Price Tracker, updated daily.

Read more »