Immerse yourself in your music with these Beats Solo 4 headphones for just $90
Macworld TL;DR: Get these Warm White (Open Box) Beats Solo 4 On-Ear Headphones for just $89.99 (reg. $199.99). What is modern life without a good set of headphones? They’re a lifesaver for long commutes, working out at the gym, doing chores around the house, and even when you want to make a quick call without everyone around you getting involved. With these Beats Solo 4, you can do it all. We’re talking 50-hour battery life, spatial audio, and Bluetooth 5.3 connection for just $89.99 (reg. $199.99). The Beats Solo 4 are designed for both powerful sound and ultra-lightweight comfort for activity-based flexibility. And thanks to the Personalized Spatial Audio feature and dynamic head tracking, the sound quality you receive will always be immersive. They also come with Fast Fuel recharge, which gives you up to 5 hours of playback after just 10 minutes of charging. What’s more, the Beats Solo 4 seamlessly integrate with both iOS and Android to provide you with one-touch pairing, audio sharing, compatibility with device tracking features, and automatic pre-pairing across devices. Part of the reason these headphones are such a great deal is that they’re Open Box. This just means they were categorized as excess inventory; and since this one is “new,” it’ll arrive with zero cosmetic flaws. So, why not give them a try? Get these Warm White Beats Solo 4 (Open Box) for just $89.99 (reg. $199.99). Beats Solo 4 On-Ear Headphones – Warm White (Open Box)See Deal StackSocial prices subject to change.

Read more »

macOS 27 Golden Gate Guide: All the new features coming to compatible Macs, 2026 release date and more
Macworld Apple has officially unveiled macOS 27 Golden Gate, the next major update for the Mac, bringing Apple’s next-generation Apple Intelligence platform to compatible devices. The update introduces an all-new Siri AI assistant, major upgrades to apps including Safari, Photos, Messages, Mail and Calendar, as well as expanded child safety features, design refinements and performance improvements throughout the operating system. Golden Gate continues Apple’s tradition of naming macOS releases after iconic Californian landmarks. Among the headline additions are Siri AI, a completely redesigned version of Siri powered by Apple Intelligence, new AI-powered tools across Apple’s apps, enhanced photo editing capabilities, smarter web browsing in Safari, and new automation features that make it easier to get things done on a Mac. macOS 27 will be supported on all Macs powered by Apple silicon, marking the end of the road for Intel-based Macs. While Intel models are no longer eligible for the new operating system, Apple is expected to continue providing security updates for those devices for some time. The developer and public betas of macOS 27 are available now. Following several months of testing, Apple is expected to release the finished version to all users this autumn. This hub covers everything Apple has announced for macOS 27 Golden Gate, including new features, compatibility details, beta release information, Apple Intelligence enhancements and the all-new Siri AI experience. What’s New in macOS 27 Golden Gate at a glance Apple Siri AI: A completely redesigned Siri powered by Apple Intelligence that can understand personal context, answer questions from the web, and take actions across apps. Visual Intelligence on Mac: Ask questions about anything on your screen, including images, files and text, using a dedicated shortcut. Safari AI Tools: Automatically groups related tabs, monitors websites for changes such as price drops, and can even generate custom extensions from a description. Apple Intelligence across apps: Adds AI-powered features to Messages, Mail, Calendar, Photos and Shortcuts to help write, organise, edit and automate tasks. Child Safety Upgrades: Introduces Ask to Browse, Time Allowances, enhanced Communication Safety and redesigned parental controls to help keep children safe online. Siri AI: Siri powered macOS 27 features Foiundry Apple’s biggest focus in macOS 27 Golden Gate is Siri AI, a completely redesigned version of Siri powered by Apple Intelligence. Rather than functioning as a simple voice assistant, Siri AI is designed to act as a conversational AI assistant that can answer questions, understand personal information, access web knowledge, and perform actions across apps and services. At a glance: What’s new with Siri AI? Conversational AI assistant: Siri AI will be far more capable than previous versions of Siri, according to Apple, allowing users to ask open-ended questions, brainstorm ideas, conduct research, and hold natural back-and-forth conversations rather than relying on simple voice commands. Dedicated Siri app: macOS 27 will offer a standalone Siri app that stores conversations in one place and sync them across Apple devices through iCloud. For example, users could start a conversation on their Mac and continue it later on their iPhone or iPad. Personal context awareness: Siri will be able to understand information stored across your messages, emails, notes, photos and files. Apple says Siri will be able to locate specific information, find content you’ve saved in the past, and surface relevant details based on your personal data. Web-powered answers: Unlike previous versions of Siri, Siri AI will be able to access up-to-date information from the web to answer questions on virtually any topic. Apple says it will be able to help with research, interview preparation, learning new subjects and gathering information quickly. App actions and automation: Siri AI will be able to take action across apps including Messages, Music, Reminders and more. Users will be able to edit messages, manage playlists, create reminders and perform other tasks using natural language rather than navigating menus manually. Spotlight integration: Siri AI will be built directly into Spotlight Search on macOS. Users will be able to type questions into Spotlight, receive AI-generated answers, and launch Siri-powered searches without opening a separate app or switching to a web browser. Visual Intelligence on Mac: For the first time, Visual Intelligence is coming to macOS. Users will be able to select content on screen and ask Siri questions about images, files, documents and text, allowing the assistant to understand and respond to onscreen content. Integrated Writing Tools: Siri AI will generate text from scratch, rewrite drafts, summarise content and refine existing writing. Apple says it will even adapt its tone, wording and punctuation to match how users typically communicate with individual contacts. Improved dictation: Apple says it will significantly upgrade systemwide dictation with better speech recognition. Dictation will automatically add punctuation, capitalisation and formatting while improving accuracy, making it easier to turn spoken words into polished text. Custom Siri voices: Users will be able to personalise Siri by selecting a voice and adjusting its pace and expressiveness. Apple says this allows Siri to sound more natural and better suited to individual preferences, although the feature requires newer Apple silicon hardware. Availability: Apple says Siri AI will enter beta later this year and initially support English. It requires Apple Intelligence-compatible hardware. Apple Intelligence across macOS 27 As well as powering Siri, the enhanced Apple Intelligence will power some other systemwide features in macOS 27. Systemwide Proofreading: Apple Intelligence will provide automatic proofreading and improved spelling and grammar suggestions throughout the operating system. Intelligent File and Folder Naming: In macOS 27 names for files and folders will be automatically suggested based on their contents. Privacy: Apple emphasised that the new AI architecture maintains privacy protections. Apple claims Apple Intelligence continues to use on-device processing whenever possible and relies on Private Cloud Compute when additional processing power is required. Personal data processed through Private Cloud Compute is not stored or made accessible to Apple, and the system remains open to independent verification by security researchers. Safari features coming in macOS 27 Notify Me in SafariApple Safari is set to gain several Apple Intelligence-powered features in macOS 27, including the ability to automatically organise tabs into topics, monitor webpages for changes such as price drops and restocks with Notify Me, and generate custom browser extensions from a text description. Automatic Tab Topics: Safari will be able to automatically group related tabs into topics. Apple says that by continually organizing tabs as users browse, Safari will help keep research and projects organized. Notify Me: Safari will be able to monitor web pages for changes. For example, users will be able to ask Safari to watch for product restocks, price changes, or other updates and receive notifications when those changes occur. Describe an Extension: Users will be able to create custom Safari extensions simply by describing what they want. Apple says Safari can generate the extension directly from a text description and add it to the toolbar. Messages and Mail features coming in macOS 27 Messages and Mail are to gain deeper Apple Intelligence integration in macOS 27. For example, Mail and Messages are will offer smarter Smart Reply suggestions that can reflect a user’s personal writing style. One-Tap Suggestions in Messages: Messages will suggest actions based on conversation context. Apple says users will be able to quickly create reminders, notes, or perform other tasks directly from a conversation. Smarter Photo Suggestions: Messages will identify and surface relevant photos based on keywords, people, and locations mentioned in chats. Personalized Smart Reply: Both Messages and Mail will be able to mimic a user’s writing style depending on the recipient for a ‘Smart Reply’. More Relevant Search in Mail: Mail will introduce a new search ranking system designed to surface the most relevant results first. Photos features coming in macOS 27 A new suite of AI-powered editing tools are coming to Photos in macOS 27 that should make it easier to transform and improve photos without needing advanced editing skills. Spatial Reframing: It will be possible to intelligently reframe images, recomposing images after they’ve been taken. Extend Tool: A new Extend tool will expand photos beyond their original boundaries. Enhanced Clean Up: The updated Clean Up tool will be able to remove larger unwanted objects from images more effectively than it can presently. Design and Interface Changes in macOS 27 Apple macOS Golden Gate will feature several UI tweaks that address some of the criticisms of macOS 26’s Liquid Glass. For example, macOS 27 will offer improved readability and stronger contrast than Liquid Glass does currently. Changes include: Improved readability with more refined Liquid Glass effects throughout macOS. Better contrast to make interface elements easier to distinguish. More consistent refraction effects across windows, menus and controls. Updated toolbars with a cleaner, more unified design. Edge-to-edge sidebars that extend fully to the edge of windows rather than appearing to float. Refreshed menu bar icons with a more polished appearance. Background bars behind window controls to make icon clusters stand out more clearly. More consistent rounded window corners throughout the operating system. Liquid Glass app icons that add greater depth and a more three-dimensional look. Customisable Liquid Glass appearance, allowing users to adjust the effect from ultra-clear to fully tinted. Performance Improvements in macOS 27 Apple says macOS 27 delivers performance improvements throughout the operating system, including: Faster AirDrop transfers Faster network file browsing Faster Safari start page loading macOS 27 will also add support for higher-resolution ultrawide displays, including 5K at 120Hz. Display arrangements will also be remembered more reliably when reconnecting monitors. macOS 27 Compatible Macs The MacBook Neo and other Macs in Apple’s current lineup will all be compatible with macOS 27.Foundry Apple confirmed that macOS 27 Golden Gate is compatible with: MacBook Neo (A18 Pro, 2026) MacBook Air (Apple silicon, 2020 and later) MacBook Pro (Apple silicon, 2020 and later) iMac (Apple silicon, 2021 and later) Mac mini (Apple silicon, 2020 and later) Mac Studio (2022 and later) Mac Pro (Apple silicon, 2023 and later) All those Macs will be able to support Apple Intelligence, but some Siri AI features require M3 with at least 12GB of unified memory or later. macOS 27 release date: When will macOS 27 be available? First developer beta: June 8, 2026 First public beta: July 13 2026 Final version: September 2026 Apple debut macOS 27 in a keynote at WWDC26. The official version of macOS 27 will not be available until later in 2026. In recent years, Apple has released macOS at the same time as iOS. The iOS release has been happening during the second week of September, so Monday, September 14, is our guess as to when macOS 27 becomes available to everyone. When will the macOS 27 beta be released? Apple However, it isn’t necessary to wait until the fall to try out the new features in macOS 27. Apple released the first developer beta at WWDC. The first public beta became available on July 13, 2026. The beta cycle includes several iterations as Apple refines the software. Here’s how you can participate in the beta program. We have an Apple WWDC event blog if you want to read expert commentary and our immediate reactions and what the WWDC news means to you. FAQ 1. When is macOS 27 coming out Apple hasn’t confirmed exactly when macOS 27 will be available to install, but it usually launches to the general public in September, or at the latest October. Once macOS 27 launches Apple will likely continue beta development to test new features that weren’t available at launch. 2. Should I install the macOS 27 beta? Whether you should install the macOS 27 beta depends on your needs, technical expertise, and tolerance for bugs and instability. Beta software can introduce crashes, data loss, app compatibility problems, excessive battery drain, reduced performance, and other unexpected issues. For most users, the recommendation is simple: don’t install it. If you’re eager to try the new features, it’s better to wait for the Public Beta and avoid installing it on your primary Mac. Developers are a different case. The Developer Beta is available now through Apple’s Developer Program, allowing app creators to test their software against new APIs, frameworks, and system features before the public release. If you’re not a developer, think carefully before installing the Developer Beta, as it is typically less stable and more prone to bugs than later beta releases. Regardless of which beta you choose, make sure you have a complete backup of your Mac before upgrading. 3. Which Macs get macOS 27 All M-series Macs will get macOS 27, and the MacBook Neo. Certain Siri features will only be available for M3 Macs and newer. 4. Should Intel Mac owners upgrade now? Intel Mac owners should upgrade to Apple Silicon as soon as possible. The transition away from Intel hardware has reached a critical turning point, with software support rapidly vanishing and a new generation of affordable entry-level hardware making the switch more accessible than ever. Apple has confirmed that macOS 27 will not support any Intel-based Macs. While a small number of Intel models may receive security patches for older versions of macOS until September 2028, they are already excluded from modern flagship features. Those with Intel Macs also miss out on many features, including Apple Intelligence. 5. What does the end of Rosetta support mean? macOS 27 will end support for Rosetta 2, Apple’s translation technology that allows Intel-based Mac apps to run on Apple Silicon Macs. The end of Rosetta 2 support marks the final stage of Apple’s transition away from Intel-based architecture, effectively terminating the ability of M-series Macs to run older software designed for Intel processors. Rosetta 2 has served as a “translator” or “transition layer” since 2020, allowing Apple silicon to execute x86_64 instructions. The move further accelerates Apple’s transition away from Intel-era software. As of the macOS 26.4 update, users are already seeing Rosetta 2 warnings. 6. When is macOS usually updated? Here is a history of release dates for macOS: macOS 26 Tahoe: September 15, 2025 macOS 15 Sequoia: September 16, 2024 macOS 14 Sonoma: September 26, 2023 macOS 13 Ventura: October 25, 2022 macOS 12 Monterey: October 25, 2021 macOS 11 Big Sur: November 19, 2020 macOS 10.15 Catalina: October 7, 2019 macOS 10.14 Mojave: September 24, 2018 macOS 10.13 High Sierra: September 25, 2017 macOS 10.12 Sierra: September 20, 2016

Read more »

ChatGPT’s iPhone app gets a handy shortcut to attach recent photos more quickly
Users who rely on ChatGPT for quick visual searches can now add photos to a conversation more quickly with a new gesture. Here’s how.

Read more »

Bank of America predicts a bolder Apple under new CEO John Ternus
As Tim Cook prepares to hand the CEO reins to longtime hardware chief John Ternus on September 1st, Bank of America analysts expect… The post appeared first on MacDailyNews.

Read more »

Apple Cuts Jobs In Siri, Vision Pro Immersive Video and Gaming Teams
Apple is cutting more than 200 jobs as it shifts resources toward a rebuilt, AI-powered Siri and other future products. Roughly 100 positions are being eliminated from the Vision Pro organization, including much of its gaming team and some immersive-video staff. Another 100 cuts are hitting the Siri and software teams. Bloomberg reports: In a statement, Apple acknowledged that it was realigning some teams "to evolve our business to deliver the best experiences for our users." "While we will create new roles as part of this change, it will also impact a limited number of existing roles," the company said. "We are grateful to these team members for their contributions, and we are committed to supporting them throughout their transition, including opportunities to apply for other roles at Apple." The Siri reshuffling is tied to an upcoming AI-infused version of the assistant, which is built on a new technical architecture. That shift requires a change in the necessary expertise, prompting the company to eliminate a small number of existing roles, reallocate resources and create new positions supporting the updated Siri. The changes to the Intelligent Systems Experience team reflect an effort to reorganize work on AI-powered capabilities. As more groups bring AI functions to apps, features and services, Apple is realigning teams to match priorities and accelerate development. The restructuring will eliminate some existing positions while creating new roles. Read more of this story at Slashdot.

Read more »

Emmy-winning ‘Stillwater’ returns to Apple TV with five new episodes
Apple TV subscribers can now watch the entire new season of Stillwater, the platform’s award-winning mindfulness-focused animated series. Watch the trailer below.

Read more »

Epic accuses Apple of sidestepping App Store antitrust deal in Brazil
Apple has until Monday to respond to a complaint Epic Games filed with Brazil’s antitrust watchdog, where it accuses the company of adopting restrictive interpretations of its obligations under a recent App Store antitrust deal in the country. Here are the details.

Read more »

Hidden macOS code reveals new details about AirPods with cameras
Macworld Thanks to a video accidentally included in the macOS 26.7 beta, we got our first real confirmation that Apple is, as rumored, working on AirPods with cameras in them. Despite the video and references being found in such a recent beta, we’re assured that this product isn’t actually shipping until next year. Now, thanks to an eagle-eyed member of the MacRumors forums, we have some idea of the capabilities of the in-development AirPods with cameras. The user found a framework called “AccessorySensorManager” that provides some details of how these things might work. First, it appears that the AirPods do not take images for you to save. Instead, they send still images in the background for Visual Intelligence to process, but nothing gets saved to your Photos app or anything like that. The cameras seemingly operate in two modes: active and passive. Active mode is when a request is made (such as asking Siri), and each earbud captures a 640×640 image and returns a 1024×1024 processed image to your iPhone. In Passive mode, the cameras take really low-resolution 320×320 or 512×512 images at a continuous rate. While the framework focuses on standard color images, there may be other capabilities not listed, such as infrared spectrum captures. Passive mode seems to be for background environment detection…to see if there’s a person in front of you, if you moved to a busy street, and so on. The actual camera sensors may be higher resolution, but for a variety of reasons (bandwidth, battery life, processing speed, etc.) Apple seems to be using lower-res images. There’s mention of some processing capabilities such as lens distortion correction, dual camera calibration, and compensation for head motion. While the earbuds can take multiple images in a series, there is no video recording. The framework includes control for a hardware indicator and its brightness, which likely means that both earbuds will have some sort of recording light. This is all subject to change, of course, especially since these AirPods aren’t expected to arrive until next fall. Test features revealed in beta frameworks are sometimes incomplete or don’t take into account later optimizations or hardware changes.

Read more »

Apple lays off 200 employees to focus on ‘new devices’ and AI
Macworld According to a report by Bloomberg, Apple is laying off and “realigning” several employees in multiple departments in order to “focus on new devices and artificial intelligence.” About 200 employees are affected. The Vision Pro team has eliminated 100 jobs, with most of the cuts happening in teams focused on gaming and immersive video, according to the report. Bloomberg says employees were told that the changes are being made to better address how the Vision Pro is being used by its customers. Immersive video, in particular, is an expensive endeavor that has “strained the business given the limited number of active Vision Pro users.” The other 100 eliminated jobs were from the Siri and software teams. With the shift from Siri as a voice-activated interface to the new Siri AI, Apple needs to redefine the Siri team with “a change in the necessary expertise.” Apple is also reorganizing its Intelligent Systems Experience team to focus its efforts on AI. In response to the report, Apple released the following statement to Bloomberg: While we will create new roles as part of this change, it will also impact a limited number of existing roles. We are grateful to these team members for their contributions, and we are committed to supporting them throughout their transition, including opportunities to apply for other roles at Apple. Apple statement released to Bloomberg While job cuts are never a good sign, no one would be surprised by Apple’s reasoning behind them. The Vision Pro was released over two years ago (with an M5 update in October 2025), and if it has made an impact, it’s in specific niche markets–it has not made an impression with the general public. Reports have said that Apple shifted its focus from developing a low-cost Vision Pro headset to smart glasses that would compete with the likes of Meta. The only thing surprising about the layoffs with the Siri team is that they didn’t happen sooner. Siri AI has been in development for quite some time now, so a reorganization seems to be part of the process.

Read more »

Apple Watch Series 12 and Ultra 4 to get one big upgrade at perfect time
Apple Watch Series 12 and Ultra 4 are launching next month, and rumors indicate they’ll pack a big upgrade—a new, more powerful chip—that will arrive at just the right time.

Read more »

When is Apple Pay coming to your Walmart? Here’s the full schedule
Earlier today, Walmart officially announced it will finally start rolling out Apple Pay after holding out for more than a decade. When will Apple Pay come to your Walmart location? I got my hands on the full launch plan with all that information…

Read more »

Apple Watch ECG saves triathlete’s life
A triathlete credits his Apple Watch with saving his life after its electrocardiogram (ECG) feature flagged signs of atrial fibrillation… The post appeared first on MacDailyNews.

Read more »

Apple paid Ireland $17 billion last year as EU back-tax case came due
The Financial Times reports that new tax disclosures showed Apple paid Ireland $17 billion in corporate income taxes in 2025, accounting for 40% of its worldwide total. Here are the details.

Read more »

Apple refurb store: Apple TV 4K is back, Apple Watch Ultra 3 offers, more
We’re back with our check-in for what’s new on Apple’s official Certified Refurbished Store this week. This week’s highlights include the MacBook Neo, new MacBook Air configurations, Apple Watch Ultra 3, and more.

Read more »

Apple lays off 200+ people across Vision Pro and Siri teams
Apple is cutting jobs across multiple teams, according to a new Bloomberg report. All told, the company has cut more than 200 jobs across teams working on Vision Pro, Siri, and software engineering.

Read more »

Apple's latest layoffs extend past just Vision Pro development teams
A day after we broke the news of about 60 layoffs across the Apple Vision project, there are reportedly more in the Siri team too.Siri AI gets to live in this orb on Wes' deskCiting people familiar with the matter, the same as we did, Mark Gurman from Bloomberg has exposed more layoffs inside Apple. This time, beyond the Apple Vision team, there are layoffs in Apple's Siri team.All told, including Apple Vision Immersive Video, Apple Vision gaming, and Siri, there are about 200 layoffs in total. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Your iPhone’s USB-C port to do much more than charge
USB-C, now present on every current iPhone model, opens up far more possibilities than simply topping up the battery… The post appeared first on MacDailyNews.

Read more »

HomeKit Weekly: Homey secures Matter 1.5 certification to expand bridging and energy support
Athom has announced that it has officially achieved Homey Pro mini, and the Homey Self Hosted Server. This update brings important upgrades for both native device integration and cross-platform device bridging.

Read more »

iPadOS 27 adds three features to make iPad more like the Mac
iPadOS and macOS used to be very different software platforms. But especially since iPadOS 26, the two have become a lot more alike. And that’s even more true this year, with iPadOS 27 adding three features that make the iPad more Mac-like than ever.

Read more »

Grok Bot is an all-new iPhone and Mac app from SpaceXAI and Cursor [U]
SpaceXAI and Cursor are in the process of becoming a single company, but first, the two firms are releasing an all-new iPhone and Mac app called Grok Bot.

Read more »

iPhone 18 Pro release date: Here’s when Apple’s new flagship is coming
Apple’s new flagship iPhone 18 Pro and iPhone Ultra will be unveiled soon, following the same release pattern the company has kept for years. Here’s when to expect the iPhone 18 Pro announcement and release date, plus details on the lineup.

Read more »

Garmin’s $200 Whoop rival misses the appeal of screenless trackers
Garmin has entered the booming category of screenless fitness trackers with the Cirqa Smart Band, a $200 device designed to challenge… The post appeared first on MacDailyNews.

Read more »

M6 MacBook Pro rumors: Improved performance, in a familiar form factor
There's more coming than just an OLED MacBook Pro in the fall. Apple's 14-inch MacBook Pro is expected to get a big speed boost with the M6 chip. Here's what the rumor mill has to say.Apple's base model M6 MacBook Pro will introduce performance improvements, but not much else.While Apple plans to overhaul its MacBook Pro line with OLED panels and touchscreen support, we'll still see one more model boasting the current design. Known internally as the J804, the base model 14-inch MacBook Pro will likely mark the debut of the M6 chip, in an all-too-familiar laptop chassis.In essence, the M6 MacBook Pro will feature the same miniLED screen with ProMotion support, the same six-speaker sound system, the same assortment of ports, and presumably the same $1,999 starting price as the current M5 model. However, the chip inside might be a lot more powerful. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Another disguised Russian banking app has topped the US iPhone App Store
Back in June, we flagged three instances of U.S.-sanctioned Russian banks sneaking client apps onto the App Store. Two months later, another example has climbed to the top of the iPhone App Store.

Read more »

Leaked Apple code reveals how AirPods cameras will actually work
Code in macOS 26.7 reveals how Apple's AirPods with cameras may capture, process and protect your photos. (via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)

Read more »

This powerhouse M5 Pro MacBook Pro with 48GB of RAM is $400 off
Macworld MacBook Pro M5 Pro View Deal (function () { document.querySelector("#sticky-promo-block a").addEventListener("click", function(e) { const debug = document.location.host.search(/lndo.site|go-vip.net/) !== -1; const text = this.closest("#sticky-promo-block").querySelector("p.promo-title").textContent; const data = { event: "stickyConversionUnitClick", eventCategory: "Sticky Conversion", eventAction: "Click", eventLabel: text }; if(debug)console.log("Sticky Conversion CLick - pushing to dataLayer: ", data); dataLayer.push(data); return true; }); })(); If you’re looking for a new laptop for back-to-school or just want to upgrade an old model, you can grab one of Apple’s best MacBook Pro configurations for a whopping $400 off at B&H right now. The specs are impressive—an M5 Pro processor, 48GB of RAM, and 1TB of storage for just $2,899, an excellent price to pay if you’re looking for a machine that will last for years to come. Running on the M5 Pro chip with its 18-core CPU and 20-Core GPU, this laptop is an absolute powerhouse. Every one of those GPU cores packs a Neural Accelerator, so if your work is AI-heavy, this MacBook is more than ready to handle it all. Pair that with 48GB of unified memory, and this laptop breezes through demanding workloads without breaking a sweat. Whether you want to edit 4K footage, juggle massive image libraries, compile large codebases, or mix hundreds of audio tracks at once, this MacBook Pro can do it all. And with all-day battery life and a super-fast 1TB SSD, you’ll be able to work on giant files and videos wherever you are. And if you need more, you can attach a Thunderbolt 5 drive that’ll feel just as fast. Of course, the 14.2-inch Liquid Retina XDR display is one you’ll love looking at for long hours. With 1,600 nits of peak brightness, a billion colors, and super-accurate shades, there’s nothing not to love about this display, no matter how bright the room is. So whether you’re a pro or a student, this laptop is a powerful machine at a fantastic price. At $2,899, a full $400 off, the M5 Pro MacBook Pro delivers serious power, a stunning display, and all-day battery life in a portable package built to last.

Read more »

When New DF Posts Drop in a Forest and No One Is There to Read Them
https://daringfireball.net/

Read more »

Walmart finally caves and starts accepting Apple Pay
Walmart, America's retail giant, is finally giving in to Apple Pay. Customers will soon be able to easily pay with an iPhone or Apple Watch. (via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)

Read more »

Apple Music to introduce ‘Made With AI’ labels for AI-generated music later this year
Apple Music is preparing to make AI use in songs more transparent to listeners. The streaming service announced that it will begin… The post appeared first on MacDailyNews.

Read more »

Here’s everything we learned about AirPods with cameras this week
It’s been a busy week for rumors surrounding Apple’s upcoming AirPods with cameras. Here’s a roundup of everything we’ve learned about camera-equipped AirPods Pro this week.

Read more »

Who’s Tracking You? Use This New Service to Find Out
It can be daunting to determine who's responsible for showing ads on the websites we visit, or who's harvesting data from the mobile apps we use every day. That information is already semi-public, but it is not easily parsed and traditionally much of it has remained walled away in the hands of large advertising platforms. Not anymore: A powerful and free new service called DecryptAds scrapes and correlates this adtech data and makes it simple to quickly learn a great deal about the entities that are tracking you.

Read more »

Microsoft Plugs Nearly 400 Security Holes
Microsoft today released updates to remedy at least 398 security vulnerabilities in its Windows operating systems and supported software, including one weakness that is already being actively exploited and two others that were publicly detailed prior to today.

Read more »

Canadian Man Pleads Guilty in Snowflake Extortions
A 26-year-old Canadian man once described as one of the most consequential cybercrime threat actors of 2024 has pleaded guilty to computer fraud and conspiracy to hack and extort more than 165 organizations that used the cloud data storage provider Snowflake. Connor Riley Moucka, of Kitchener, Ontario, also admitted to stealing call and text history records of more than 100 million AT&T customers.

Read more »

Vulnerability Summary for the Week of July 27, 2026
High Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info @fastify/rate-limit--@fastify/rate-limit @fastify/rate-limit before 11.2.0 keys rate-limit buckets by the verbatim client IP string returned from request.ip. Because a single IPv6 client can control a large address range (a /64 holds 2^64 distinct addresses) and the same address has multiple valid textual representations, an IPv6 capable client can defeat the rate-limit boundary by rotating addresses or by rewriting the same address in different forms. Applications that use @fastify/rate-limit to protect endpoints such as authentication, password reset, OTP delivery, or expensive API calls can be bypassed by IPv6 clients behind a proxy that surfaces IPv6 to the origin when trustProxy is enabled. The issue is fixed in @fastify/rate-limit 11.2.0, where the default key generator normalizes IPv6 addresses to their canonical form, collapses IPv4 mapped IPv6 to IPv4, and applies a configurable prefix mask (default /64) via a new ipv6Subnet option. 2026-07-29 7.3 CVE-2026-15144 acacode--swagger-typescript-api swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, templates/base/http-clients/axios-http-client.ejs interpolates servers[0].url from src/code-gen-process.ts into the HttpClient constructor without escaping, allowing an attacker-controlled OpenAPI spec to inject code that executes when new HttpClient() or new Api() is constructed. This issue is fixed in version 13.12.2. 2026-07-29 8.3 CVE-2026-54661 acacode--swagger-typescript-api swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/code-gen-process.ts createApiConfig copies servers[0].url into apiConfig.baseUrl, and templates/base/http-clients/fetch-http-client.ejs interpolates apiConfig.baseUrl into the generated HttpClient baseUrl field without escaping, allowing an attacker-controlled OpenAPI spec to inject TypeScript static field code that executes when the generated fetch client module is imported. This issue is fixed in version 13.12.2. 2026-07-29 8.3 CVE-2026-54662 acacode--swagger-typescript-api swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-parser/base-schema-parsers/enum.ts passes components.schemas.*.enum[i] values to Ts.StringValue in src/configuration.ts without escaping before templates/base/enum-data-contract.ejs renders TypeScript enum declarations, allowing an attacker-controlled OpenAPI spec to inject code that executes when the generated module is imported. This issue is fixed in version 13.12.2. 2026-07-29 8.3 CVE-2026-54664 acacode--swagger-typescript-api swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-routes/schema-routes.ts passes OpenAPI path keys through parseRouteName to templates/default/procedure-call.ejs and templates/modular/procedure-call.ejs without escaping JavaScript template literal interpolation, allowing an attacker-controlled path containing ${...} to execute when the generated method is called. This issue is fixed in version 13.12.2. 2026-07-29 8.3 CVE-2026-54666 acacode--swagger-typescript-api swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts getRemoteRequestHeaders forwards --authorizationToken to every URL fetched by fetchRemoteSchemaDocument while warmUpRemoteSchemasCache resolves external $ref URLs, allowing an attacker-controlled OpenAPI spec to exfiltrate the developer or CI bearer token to a cross-origin endpoint. This issue is fixed in version 13.12.2. 2026-07-29 7.4 CVE-2026-54660 acowebs--Dynamic Pricing With Discount Rules for WooCommerce Unauthenticated Cross Site Scripting (XSS) in Dynamic Pricing With Discount Rules for WooCommerce = 1.4.0-beta.27 through = 1.7.0-beta.0 through sk) inside smc_cdc_msg_recv(). No reference is held across the lock release. The only reference pinning the socket while the connection is discoverable in the link group is taken in smc_lgr_register_conn() (sock_hold) and dropped in __smc_lgr_unregister_conn() (sock_put), both under conns_lock. Once the handler drops conns_lock, a concurrent close() - > smc_release() - > smc_conn_free() - > smc_lgr_unregister_conn() can drop that reference and free the smc_sock, so the handler's later sock_hold() runs on freed memory: WARNING: lib/refcount.c:25 at refcount_warn_saturate Workqueue: rxe_wq do_work refcount_warn_saturate (lib/refcount.c:25) smc_cdc_msg_recv (net/smc/smc_cdc.c:430) smc_cdc_rx_handler (net/smc/smc_cdc.c:502) smc_wr_rx_tasklet_fn (net/smc/smc_wr.c:445) tasklet_action_common (kernel/softirq.c:938) handle_softirqs (kernel/softirq.c:622) Kernel panic - not syncing: panic_on_warn set Only SMC-R is affected. The SMC-D receive tasklet is stopped by tasklet_kill(&conn- >rx_tsklet) in smc_conn_free() before the connection is unregistered, so it cannot run concurrently with the free. Take the socket reference while still holding conns_lock, so the registration reference can no longer be the last one, and drop it once the handler is done. 2026-07-27 9.8 CVE-2026-64541 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: sctp: validate STALE_COOKIE cause length before reading staleness When an ERROR chunk with a STALE_COOKIE cause is received in the COOKIE_ECHOED state, sctp_sf_do_5_2_6_stale() reads the 4-byte Measure of Staleness that follows the cause header: err = (struct sctp_errhdr *)(chunk- >skb- >data); stale = ntohl(*(__be32 *)((u8 *)err + sizeof(*err))); err is the first cause in the chunk, not the STALE_COOKIE cause that caused the dispatch, and nothing guarantees the staleness field is present. sctp_walk_errors() only requires a cause to be as long as the 4-byte header, so for a STALE_COOKIE cause of length 4 the read runs past the cause, and for a minimal ERROR chunk past skb- >tail. The value is echoed to the peer in the Cookie Preservative of the reply INIT, leaking uninitialized memory. sctp_sf_cookie_echoed_err() already walks to the STALE_COOKIE cause, so check its length there and pass it to sctp_sf_do_5_2_6_stale(), which reads that cause instead of the first one. A STALE_COOKIE cause too short to hold the staleness field is discarded. The read is reachable by any peer that can drive an association into COOKIE_ECHOED, including an unprivileged process using a raw SCTP socket in a user and network namespace. 2026-07-27 9.1 CVE-2026-64551 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop The loop in is_ap_in_tkip() iterates over IEs without verifying that enough bytes remain before dereferencing the IE header or its payload: - pIE- >element_id and pIE- >length are read without checking that i + sizeof(*pIE) data + 12, which requires pIE- >length >= 16. For WLAN_EID_RSN it compares pIE- >data + 8, requiring pIE- >length >= 12. Neither requirement is checked. Add the missing IE header and payload bounds checks and guard each data access with an explicit pIE- >length minimum, matching the pattern established in update_beacon_info(). 2026-07-27 8.1 CVE-2026-64536 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() genelink_rx_fixup() splits an aggregated RX frame into its individual packets, using a per-packet length taken from device-supplied data. That length is only bounded by GL_MAX_PACKET_LEN (1514); it is never compared against how many bytes were actually received. A malicious GeneLink (GL620A) device can therefore send a short URB whose header claims packet_count > 1 and a first packet of up to 1514 bytes. skb_put_data(gl_skb, packet- >packet_data, size); then copies past the end of the receive buffer and hands the adjacent slab contents up the network stack, an out-of-bounds read that leaks kernel heap. No privilege is required: the path runs in the usbnet RX softirq as soon as the interface is up. BUG: KASAN: slab-out-of-bounds in genelink_rx_fixup (drivers/net/usb/gl620a.c:112) Read of size 1514 at addr ffff888011309708 by task ksoftirqd/0/14 Call Trace: ... __asan_memcpy (mm/kasan/shadow.c:105) genelink_rx_fixup (include/linux/skbuff.h:2814 drivers/net/usb/gl620a.c:112) usbnet_bh (drivers/net/usb/usbnet.c:572 drivers/net/usb/usbnet.c:1589) process_one_work (kernel/workqueue.c:3322) bh_worker (kernel/workqueue.c:3405) tasklet_action (kernel/softirq.c:965) handle_softirqs (kernel/softirq.c:622) run_ksoftirqd (kernel/softirq.c:1076) ... skb_pull() already verifies that the requested length fits the buffer and returns NULL otherwise. Move it ahead of the copy and check its result, so a packet that overruns the received data is rejected before it is read. Well-formed frames, whose packets are fully present, are unaffected. 2026-07-27 8.1 CVE-2026-64540 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: net: usb: net1080: validate packet_len before pad-byte access in rx_fixup For an even packet_len, net1080_rx_fixup() reads the pad byte at skb- >data[packet_len] before the skb- >len != packet_len check further down, and packet_len is only bounded against NC_MAX_PACKET. A malicious NetChip 1080 device can send a short frame advertising a large even packet_len (e.g. 0x4000), so the pad-byte read lands past the end of the skb: BUG: KASAN: slab-out-of-bounds in net1080_rx_fixup Read of size 1 at addr ffff8880106c83c6 by task ksoftirqd/0/14 ... net1080_rx_fixup (drivers/net/usb/net1080.c:384) usbnet_bh (drivers/net/usb/usbnet.c:1589) process_one_work (kernel/workqueue.c:3322) bh_worker (kernel/workqueue.c:3708) tasklet_action (kernel/softirq.c:965) handle_softirqs (kernel/softirq.c:622) ... Reject the frame when packet_len >= skb- >len before reading. 2026-07-27 8.1 CVE-2026-64547 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() When the scatterlist ring is full or nearly full, bpf_msg_push_data() enters a copy fallback path and computes copy + len for the page allocation size. Since len comes from BPF with arg3_type = ARG_ANYTHING and both are u32, a crafted len can wrap the sum to a small value, causing an undersized allocation followed by an out-of-bounds memcpy. BUG: unable to handle page fault for address: ffffed104089a402 Oops: Oops: 0000 [#1] SMP KASAN NOPTI Call Trace: __asan_memcpy (mm/kasan/shadow.c:105) bpf_msg_push_data (net/core/filter.c:2852 net/core/filter.c:2788) bpf_prog_9ed8b5711920a7d7+0x2e/0x36 sk_psock_msg_verdict (net/core/skmsg.c:934) tcp_bpf_sendmsg (net/ipv4/tcp_bpf.c:421 net/ipv4/tcp_bpf.c:584) __sys_sendto (net/socket.c:2206) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) Add an overflow check before the allocation. 2026-07-27 8.4 CVE-2026-64548 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: virtio-net: fix len check in receive_big() receive_big() bounds the device-announced length by (big_packets_num_skbfrags + 1) * PAGE_SIZE. That is still too loose: add_recvbuf_big() sets sg[1] to start at offset sizeof(struct padded_vnet_hdr) into the first page, so the chain actually carries hdr_len + (PAGE_SIZE - sizeof(padded_vnet_hdr)) + big_packets_num_skbfrags * PAGE_SIZE bytes -- 20 bytes less than the check allows for the common hdr_len == 12 case. A malicious virtio backend can announce a len in that gap. page_to_skb() then walks one frag past the page chain, storing a NULL page- >private into skb_shinfo()- >frags[MAX_SKB_FRAGS], which is both an out-of-bounds write past the static frag array and a NULL frag handed up the rx path. Bound len by the size add_recvbuf_big() actually advertised. 2026-07-27 8.4 CVE-2026-64552 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() br_ip6_fragment() gets prevhdr, a pointer into the skb head, from ip6_find_1stfragopt(), then calls skb_checksum_help(). For a cloned skb skb_checksum_help() reallocates the head via pskb_expand_head(), leaving prevhdr dangling. It is later dereferenced in ip6_frag_next(), causing a use-after-free write. Save prevhdr's offset before skb_checksum_help() and recompute it after, like commit ef0efcd3bd3f ("ipv6: Fix dangling pointer when ipv6 fragment"). BUG: KASAN: slab-use-after-free in ip6_frag_next (net/ipv6/ip6_output.c:857) Write of size 1 at addr ffff888013ff5016 by task exploit/141 Call Trace: ... kasan_report (mm/kasan/report.c:595) ip6_frag_next (net/ipv6/ip6_output.c:857) br_ip6_fragment (net/ipv6/netfilter.c:212) nf_ct_bridge_post (net/bridge/netfilter/nf_conntrack_bridge.c:407) nf_hook_slow (net/netfilter/core.c:619) br_forward_finish (net/bridge/br_forward.c:66) __br_forward (net/bridge/br_forward.c:115) maybe_deliver (net/bridge/br_forward.c:191) br_flood (net/bridge/br_forward.c:245) br_handle_frame_finish (net/bridge/br_input.c:229) br_handle_frame (net/bridge/br_input.c:442) ... packet_sendmsg (net/packet/af_packet.c:3114) ... do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Kernel panic - not syncing: Fatal exception in interrupt 2026-07-27 8.8 CVE-2026-64554 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops() kvm_hyp_handle_mops() resets the single-step state machine as part of rewinding state for a MOPS exception by modifying vcpu_cpsr() and writing the result directly into hardware. In the case of nested virtualization, vcpu_cpsr() is a synthetic value such that the rest of KVM can deal with vEL2 cleanly. That means the value requires translation before being written into hardware, which is unfortunately missing from the MOPS handler. Fix it by directly modifying SPSR_EL2 and avoiding the synthetic state altogether, which will be resynchronized on the next 'full' exit back to KVM. 2026-07-27 8.8 CVE-2026-64555 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() l2cap_sock_new_connection_cb() returned l2cap_pi(sk)- >chan after release_sock(parent). Once the parent lock is dropped the newly enqueued child socket sk is reachable via the accept queue, so another task can accept and free it before the callback dereferences sk, resulting in a use-after-free. Rework the - >new_connection() op so the core, rather than the callback, owns the child channel's lifetime. The op now receives a pre-allocated new_chan and returns an errno instead of allocating and returning a channel. l2cap_new_connection() allocates the child channel and links it into the conn list via __l2cap_chan_add() before invoking the callback, so the conn-list reference keeps the channel alive once release_sock(parent) exposes the socket to other tasks. Channel configuration that was duplicated in l2cap_sock_init() and the various new_connection callbacks is consolidated into l2cap_chan_set_defaults(), which now inherits from the parent channel when one is supplied. 2026-07-29 8.8 CVE-2026-64557 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff ("net: openvswitch: remove misbehaving actions length check") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure. 2026-07-27 7.8 CVE-2026-64531 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation} In do_action()'s UpdateRecordDataRoot (fslog.c:3489) and UpdateRecordDataAllocation (fslog.c:3697) cases, the memmove destination is `Add2Ptr(e, le16_to_cpu(e- >view.data_off))`, where e- >view.data_off comes from an on-disk NTFS_DE inside an INDEX_ROOT or INDEX_BUFFER. Neither case validates view.data_off + dlen against e- >size; the existing check_if_index_root / check_if_alloc_index helpers walk the entry chain and validate the entry's offset, but not its internal view fields. The neighbouring read sites (e.g., fs/ntfs3/index.c when iterating view entries) check view.data_off + view.data_size size. Apply the same bound at the two memmove sites. Reproduced under UML+KASAN on mainline 8d90b09e6741 via pr_warn-only probe instrumentation: with view.data_off forced to 0xFFFC, the memmove writes 32 bytes past the end of the NTFS_DE. This is similar in shape to Pavitra Jha's 2026-05-02 patch "fs/ntfs3: prevent oob in case UpdateRecordDataRoot" () which proposes calling ntfs3_bad_de_range(); that helper does not exist in mainline. This patch uses inline checks. 2026-07-27 7.8 CVE-2026-64532 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate lcns_follow in log_replay conversion log_replay() converts DIR_PAGE_ENTRY_32 records into DIR_PAGE_ENTRY records when replaying version 0 restart tables. During this conversion, the memmove() length is derived directly from the on-disk lcns_follow field: memmove(&dp- >vcn, &dp0- >vcn_low, 2 * sizeof(u64) + le32_to_cpu(dp- >lcns_follow) * sizeof(u64)); check_rstbl() validates restart table structure, but does not constrain per-entry lcns_follow values relative to the entry size. A malformed filesystem image can provide an oversized lcns_follow value, causing the conversion memmove() to access memory beyond the bounds of the allocated restart table buffer. The same field is later used to bound iteration over page_lcns[], so validating lcns_follow during conversion also prevents downstream out-of-bounds access from the same malformed metadata. Compute the maximum valid lcns_follow from the already-validated restart table entry size and reject entries that exceed this bound. Reuse the existing t16/t32 scratch variables already declared in log_replay() to avoid introducing new declarations. [almaz.alexandrovich@paragon-software.com: fixed the conflicts] 2026-07-27 7.8 CVE-2026-64533 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix stack OOB write when prepending the Flags AD eir_create_adv_data() builds the advertising data into a fixed-size buffer ("size", 31 for the legacy path). It may prepend a 3-byte "Flags" AD structure (LE_AD_NO_BREDR on an LE-only controller) and then copies the per-instance data without checking that it still fits: memcpy(ptr, adv- >adv_data, adv- >adv_data_len); tlv_data_max_len() only reserves those 3 bytes when the user-supplied flags carry a managed-flags bit, so an instance added with flags == 0 is accepted with adv_data_len up to the full buffer. At advertise time the flags are still prepended, and the memcpy() writes 3 + adv_data_len bytes into the size-byte buffer: BUG: KASAN: stack-out-of-bounds in eir_create_adv_data (net/bluetooth/eir.c:301) Write of size 31 at addr ffff88800a547bdc by task kworker/u9:0/65 Workqueue: hci0 hci_cmd_sync_work __asan_memcpy (mm/kasan/shadow.c:106) eir_create_adv_data (net/bluetooth/eir.c:301) hci_update_adv_data_sync (net/bluetooth/hci_sync.c:1310) hci_schedule_adv_instance_sync (net/bluetooth/hci_sync.c:1817) hci_cmd_sync_work (net/bluetooth/hci_sync.c:332) This frame has 1 object: [32, 64) 'cp' The "Flags" structure is added by the kernel, not requested by userspace, so only prepend it when it fits together with the instance advertising data; when there is no room for both, drop the flags rather than the user-provided data. Reachable by a local user with CAP_NET_ADMIN owning an LE-only controller on the legacy advertising path. 2026-07-27 7.8 CVE-2026-64539 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: tipc: fix use-after-free of the discoverer in tipc_disc_rcv() bearer_disable() frees b- >disc with tipc_disc_delete()'s plain kfree(), but tipc_disc_rcv() still dereferences b- >disc in RX softirq under rcu_read_lock() (tipc_udp_recv - > tipc_rcv - > tipc_disc_rcv). L2 bearers are safe thanks to the synchronize_net() in tipc_disable_l2_media(), but the UDP bearer defers that call to the cleanup_bearer() workqueue, so the discoverer is freed with no grace period: BUG: KASAN: slab-use-after-free in tipc_disc_rcv (net/tipc/discover.c:149) Read of size 8 at addr ffff88802348b728 by task poc_tipc/184 tipc_disc_rcv (net/tipc/discover.c:149) tipc_rcv (net/tipc/node.c:2126) tipc_udp_recv (net/tipc/udp_media.c:391) udp_rcv (net/ipv4/udp.c:2643) ip_local_deliver_finish (net/ipv4/ip_input.c:241) Freed by task 181: kfree (mm/slub.c:6565) bearer_disable (net/tipc/bearer.c:418) tipc_nl_bearer_disable (net/tipc/bearer.c:1001) The bearer is freed with kfree_rcu(); free the discoverer the same way. Add an rcu_head to struct tipc_discoverer and free it and its skb from an RCU callback. Because the RCU callback (tipc_disc_free_rcu) lives in module text, a call_rcu() that is still pending when the tipc module is unloaded would invoke a freed function. Add an rcu_barrier() to tipc_exit() after the bearer subsystem has been torn down, so all pending discoverer callbacks have run before the module text goes away. Reachable from an unprivileged user namespace: the TIPCv2 genl family is netnsok and its bearer commands have no GENL_ADMIN_PERM. Needs CONFIG_TIPC and CONFIG_TIPC_MEDIA_UDP. 2026-07-27 7.8 CVE-2026-64543 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: net, bpf: check master for NULL in xdp_master_redirect() xdp_master_redirect() dereferences the result of netdev_master_upper_dev_get_rcu() without a NULL check, but that helper returns NULL when the receiving device has no upper-master adjacency. The reach guard only checks netif_is_bond_slave(). On bond slave release bond_upper_dev_unlink() drops the upper-master adjacency before clearing IFF_SLAVE, so an XDP_TX reaching xdp_master_redirect() in that window still passes netif_is_bond_slave() while master is already NULL, and faults on master- >flags at offset 0xb0: BUG: kernel NULL pointer dereference, address: 00000000000000b0 RIP: 0010:xdp_master_redirect (net/core/filter.c:4432) Call Trace: xdp_master_redirect (net/core/filter.c:4432) bpf_prog_run_generic_xdp (include/net/xdp.h:700) do_xdp_generic (net/core/dev.c:5608) __netif_receive_skb_one_core (net/core/dev.c:6204) process_backlog (net/core/dev.c:6319) __napi_poll (net/core/dev.c:7729) net_rx_action (net/core/dev.c:7792) handle_softirqs (kernel/softirq.c:622) __dev_queue_xmit (include/linux/bottom_half.h:33) packet_sendmsg (net/packet/af_packet.c:3082) __sys_sendto (net/socket.c:2252) Kernel panic - not syncing: Fatal exception in interrupt The missing check dates back to the original code; commit 1921f91298d1 ("net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master") later added the master- >flags read where the fault now lands but kept the unconditional deref. Check master for NULL before use; a NULL master is treated the same as one that is not up. 2026-07-27 7.5 CVE-2026-64545 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: drm/edid: fix OOB read in drm_parse_tiled_block() drm_parse_tiled_block() casts the DisplayID block to a struct displayid_tiled_block and reads the full fixed layout up to tile- >topology_id[7] without checking block- >num_bytes. The DisplayID iterator only validates the declared payload length, so a crafted EDID can advertise a tiled-display block (tag DATA_BLOCK_TILED_DISPLAY, or DATA_BLOCK_2_TILED_DISPLAY_TOPOLOGY for v2.0) with a small num_bytes at the end of a DisplayID extension. The read then runs past the end of the exact-sized kmemdup()'d EDID allocation, a heap out-of-bounds read. Reject blocks shorter than the spec's 22-byte tiled payload before reading the fixed struct, as drm_parse_vesa_mso_data() already does. BUG: KASAN: slab-out-of-bounds in drm_edid_connector_update Read of size 2 at addr ffff888010077700 by task exploit/147 dump_stack_lvl (lib/dump_stack.c:94 ...) print_report (mm/kasan/report.c:378 ...) kasan_report (mm/kasan/report.c:595) drm_edid_connector_update (drivers/gpu/drm/drm_edid.c:7581) bochs_connector_helper_get_modes (drivers/gpu/drm/tiny/bochs.c:574) drm_helper_probe_single_connector_modes (drivers/gpu/drm/drm_probe_helper.c:426) status_store (drivers/gpu/drm/drm_sysfs.c:219) ... vfs_write (fs/read_write.c:595 fs/read_write.c:688) ksys_write (fs/read_write.c:740) 2026-07-27 7.1 CVE-2026-64546 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: validate MAP frame length before ingress parsing When ingress deaggregation is disabled, rmnet_map_ingress_handler() passes the skb straight to __rmnet_map_ingress_handler(), skipping the length validation that rmnet_map_deaggregate() performs on the aggregated path. The parser then dereferences the MAP header and csum header/trailer based on the on-wire pkt_len without checking skb- >len, so a short frame is read out of bounds: BUG: KASAN: slab-out-of-bounds in rmnet_map_checksum_downlink_packet Read of size 1 at addr ffff88801118ed00 by task exploit/147 Call Trace: ... rmnet_map_checksum_downlink_packet (drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c:413) __rmnet_map_ingress_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:96) rmnet_rx_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:129) __netif_receive_skb_core.constprop.0 (net/core/dev.c:6089) netif_receive_skb (net/core/dev.c:6460) tun_get_user (drivers/net/tun.c:1955) tun_chr_write_iter (drivers/net/tun.c:2001) vfs_write (fs/read_write.c:688) ksys_write (fs/read_write.c:740) do_syscall_64 (arch/x86/entry/syscall_64.c:94) ... Factor that validation out of rmnet_map_deaggregate() into rmnet_map_validate_packet_len() and run it on the no-aggregation path too. The MAP header is bounds-checked first, since this path can receive a frame shorter than the header. 2026-07-27 7.3 CVE-2026-64550 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: perf/core: Detach event groups during remove_on_exec perf_event_remove_on_exec() removes events by calling perf_event_exit_event(). For top-level events, this removes the event from the context with DETACH_EXIT only. This can leave inconsistent group state when a removed event is a group leader and the group contains siblings without remove_on_exec. If the group was active, the surviving siblings can remain active and attached to the removed leader's sibling list, but are no longer represented by a valid group leader on the PMU context active lists. A later close of the removed leader uses DETACH_GROUP and can promote the still-active siblings from this stale group state. The next schedule-in can then add an already-linked active_list entry again, corrupting the PMU context active list. With DEBUG_LIST enabled, this is caught as a list_add double-add in merge_sched_in(). Fix this by detaching group relationships when remove_on_exec removes an event. This preserves the existing task-exit and revoke behavior, while ensuring surviving siblings are ungrouped before the removed event leaves the context. 2026-07-29 7.8 CVE-2026-64556 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in pkey_pckmo handler implementation Explicitly check the length of the target buffer in the pkey_pckmo implementation of the key_to_protkey() handler function. The handler function fails, if the generated output data exceeds the length of the provided target buffer. 2026-07-29 7.8 CVE-2026-64558 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in PKEY_VERIFYPROTK ioctl Explicitly check the buffer length request structure provided by user-space and fail, if it exceeds the buffer size. 2026-07-29 7.8 CVE-2026-64559 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by non-leader exec() race Wongi and Jungwoo decoded and reported a non-leader exec() related race which can result in an UAF: sys_timer_delete() exec() posix_cpu_timer_del() // Observes old leader p = pid_task(pid, pid_type); de_thread() switch_leader(); release_task(old_leader) __exit_signal(old_leader) sighand = lock(old_leader, sighand); posix_cpu_timers*_exit(); sighand = lock_task_sighand(p) unhash_task(old_leader); sh = lock(p, sighand) old_leader- >sighand = NULL; unlock(sighand); (p- >sighand == NULL) unlock(sh) return NULL; // Returns without action if(!sighand) return 0; free_posix_timer(); This is "harmless" unless the deleted timer was armed and enqueued in p- >signal because on exec() a TGID targeted timer is inherited. As sys_timer_delete() freed the underlying posix timer object run_posix_cpu_timers() or any timerqueue related add/delete operations on other timers will access the freed object's timerqueue node, which results in an UAF. There is a similar problem vs. posix_cpu_timer_set(). For regular posix timers it just transiently returns -ESRCH to user space, but for the use case in do_cpu_nanosleep() it's the same UAF just that the k_itimer is allocated on the stack. Also posix_cpu_timer_rearm() fails to rearm the timer, which means it stops to expire. While debating solutions Frederic pointed out another problem: posix_cpu_timer_del(tmr) __exit_signal(p) posix_cpu_timers*_exit(p); unhash_task(p); p- >sighand = NULL; sh = lock_task_sighand(p) sighand = p- >sighand; if (!sighand) return NULL; lock(sighand); if (!sh) WARN_ON_ONCE(timer_queued(tmr)); On weakly ordered architectures it is not guaranteed that posix_cpu_timer_del() will observe the stores in posix_cpu_timers*_exit() when p- >sighand is observed as NULL, which means the WARN() can be a false positive. Solve these issues by: 1) Changing the store in __exit_signal() to smp_store_release(). 2) Adding a smp_acquire__after_ctrl_dep() into the !sighand path of lock_task_sighand(). 3) Creating a helper function for looking up the task and locking sighand which does not return when sighand == NULL. Instead it retries the task lookup and only if that fails it gives up. 4) Using that helper in the three affected functions. #1/#2 ensures that the reader side which observes sighand == NULL also observes all preceeding stores, i.e. the stores in posix_cpu_timers*_exit() and the ones in unhash_task(). #3 ensures that the above described non-leader exec() situation is handled gracefully. When the task lookup returns the old leader, but sighand == NULL then it retries. In the non-leader exec() case the subsequent task lookup will observe the new leader due to #1/#2. In normal exit() scenarios the subsequent lookup fails. When the task lookup fails, the function also checks whether the timer is still enqueued and issues a warning if that's the case. Unfortunately there is nothing which can be done about it, but as the task is already not longer visible the timer should not be accessed anymore. This check also requires memory ordering, which is not provided when the first lookup fails. To achieve that the check is preceeded by a smp_rmb() which pairs with the smp_wmb() in write_seqlock() in __exit_signal(). That ensures that the stores in posix_cpu_timers*_exit() are visible. The history of the non-leader exec() issue goes back to the early days of posix CPU timers, which stored a pointer to the group leader task in the timer. That obviously fails when a non-leader exec() switches the leader. commit e0a70217107e ("posix-cpu-timers: workaround to suppress the problems with mt exec") added a temporary workaround for that in 2010 which surv ---truncated--- 2026-07-29 7.8 CVE-2026-64560 litestar-org--litestar Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie being excluded from automatic escaping by the template engine when configured inline with documentation recommendations. This issue has been patched in version 2.20.0. 2026-07-28 8.1 CVE-2026-48060 magepeopleteam--Booking and Rental Manager Unauthenticated Other Vulnerability Type in Booking and Rental Manager by(), so Laravel derived a constant cache key (md5('authentication')) shared by every request. An unauthenticated attacker sending roughly ten requests per minute from a single IP, most cheaply against the checkpoint endpoint (which has no reCAPTCHA), exhausts the shared counter and causes HTTP 429 for every user attempting to log in or complete two-factor authentication, a panel-wide authentication denial of service that also locks out administrators. This issue is fixed in version 1.13.0. 2026-07-28 7.5 CVE-2026-61609 pterodactyl--wings Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, {{config.}} placeholders in egg configuration-file templates allow a low-privileged user to read {{config.token}}, {{config.token_id}}, and {{config.docker.registries}} from the full daemon configuration. This issue is fixed in version 1.12.3. 2026-07-31 9.9 CVE-2026-52855 pterodactyl--wings Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a malformed packet received during the SFTP connection handshake causes a Go panic. This issue is fixed in version 1.13.0. 2026-07-31 7.5 CVE-2026-52856 QuantumCloud--Simple Link Directory Pro Unauthenticated Server Side Request Forgery (SSRF) in Simple Link Directory Pro 'post'`, any author-level user who has authored a `wwp_requests` post - such as one created via the wholesale registration form - can access this nonce and submit the role-assignment request. 2026-07-29 8.8 CVE-2026-12144 savonrb--savon Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all_operations interpolates attacker-controlled WSDL operation names into Ruby source passed to module_eval, allowing Ruby code execution in the application process. This issue is fixed in version 2.17.2. 2026-07-31 8.1 CVE-2026-53510 Sender--Sender Newsletter, SMS and Email Marketing Automation for WooCommerce Administrator SQL Injection in Sender - Newsletter, SMS and Email Marketing Automation for WooCommerce subscribe() callback after it had already called params- >notify(conn, params, NULL, 0). Per the public GATT API, a notify callback with NULL data is the documented signal that the subscription has terminated and the bt_gatt_subscribe_params struct may be freed or reused by the application; calling subscribe() on the struct afterwards is a use-after-free, including an indirect call through the freed params- >subscribe function pointer. The error branch is remotely (adjacent) reachable: a Zephyr device acting as a GATT client that calls bt_gatt_subscribe() can be driven into this ordering when a connected GATT server peer answers the CCC write with an ATT Error Response (the peer-supplied error code flows through att_error_rsp - > att_handle_rsp into gatt_write_ccc_rsp). For applications that free or recycle subscription parameters in their notification-termination handler, this results in memory corruption, a crash (denial of service), or potentially attacker-influenced control flow. The fix reorders the handler so the subscribe() callback runs before the terminating notify(NULL) in both the error and unsubscribe paths. 2026-07-31 7.6 CVE-2026-10685 zephyrproject--zephyr The OCPP 1.6 client in subsys/net/lib/ocpp parsed inbound WAMP RPC frames in parse_rpc_msg() (subsys/net/lib/ocpp/ocpp_j.c) using a hand-rolled helper, extract_string_field(), that copied the message's uid and action fields with strncpy(out_buf, token + 1, outlen - 1) and then scanned the result with strchr(out_buf, '"'). Because strncpy does not NUL-terminate the destination when the source is at least outlen - 1 (127) bytes long, the subsequent strchr reads past the 128-byte destination buffer into adjacent stack memory; if a " byte is found beyond the buffer, a one-byte out-of-bounds NUL write also occurs. A related defect in extract_payload() runs strchr/strrchr over the receive buffer, which may not be NUL-terminated when a maximal-length frame fills it. The parsed bytes come directly from the OCPP central-system server over a websocket: the reader thread fills recv_buf via websocket_recv_msg() and calls parse_rpc_msg() on each inbound DATA frame (subsys/net/lib/ocpp/ocpp.c). A malicious or compromised central server, or an on-path attacker (OCPP is commonly deployed over plain ws://), can send an RPC frame whose uid or action field is 127+ bytes with no closing quote, triggering the out-of-bounds access. The primary impact is a remotely triggerable denial of service: the unbounded scan can fault on an unmapped page, and the stray NUL write can corrupt adjacent stack state. The over-read data is not reflected to the peer, so disclosure is limited. The feature is EXPERIMENTAL and must be explicitly enabled (CONFIG_OCPP). The fix replaces the manual parser with the bounds-respecting json_mixed_arr_parse() and copies the extracted uid with an explicitly NUL-terminated buffer, eliminating both over-reads. 2026-08-02 7 CVE-2026-10848 zip-lib--zip-lib Versions of the package zip-lib before 1.1.0 are vulnerable to Directory Traversal via the caching mechanism for path validation during the extraction process. An attacker can bypass security checks designed to prevent directory traversal. The intended security function, isOutsideTargetFolder, only checks and caches the path status when the initial directory symlink is created during the first extraction. 2026-07-28 7.5 CVE-2026-17524 Back to top Medium Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info 100plugins--Open User Map Contributor Cross Site Scripting (XSS) in Open User Map prepare() or any integer casting. Additionally, the nonce verification check is performed after the SQL query has already executed, providing no protection against the injection. This makes it possible for authenticated attackers with subscriber-level access and above to inject arbitrary SQL commands, potentially leading to unauthorized extraction of sensitive database contents including user credentials and configuration data. 2026-07-28 6.5 CVE-2026-6251 chrisvrichardson--MapPress Maps for WordPress Unauthenticated Sensitive Data Exposure in MapPress Maps for WordPress prepare(). The wp_unslash() call explicitly removes the backslash escaping that WordPress's wp_magic_quotes() adds to all $_POST data, neutralizing the only layer of SQL injection protection. The sanitize_text_field() function applied afterward offers no SQL protection. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries to the existing query. 2026-08-01 6.5 CVE-2026-6453 CyberTimon--RapidRAW RapidRAW before 1.6.0 does not validate the lutPath field in preset files before passing it to File::open() in lut_processing.rs. On Windows, a UNC path in lutPath causes an outbound SMB connection to an attacker-controlled host, leaking the victim's NTLMv2 credentials. The vulnerable code path is reachable through two vectors: community presets fetched automatically from the remote preset repository when the victim opens the Community tab, and individual preset files imported directly by the victim via the preset import feature (handle_import_presets_from_file in file_management.rs). The second vector does not require control of the community preset repository and is triggered when a user imports a preset file shared through Discord, forums, or similar channels. 2026-07-30 6.5 CVE-2026-64816 DaveGamble--cJSON cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSON_Compare(). When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested document of a few hundred bytes (depth around 40) compared for equality consumes hours of CPU, and the cost roughly doubles with each additional level of nesting. An application that calls cJSON_Compare() on attacker-influenced JSON that is structurally equal to a reference document is exposed to a denial-of-service condition. 2026-07-29 5.9 CVE-2026-67216 DaveGamble--cJSON cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in apply_patch() in cJSON_Utils.c. For a replace operation that is missing its value member, or a move operation whose destination path cannot be resolved, the existing target member is detached and deleted before the operation is fully validated, so the target document is mutated while cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() returns a failure status. An attacker who can supply the patch document can destroy addressable members of the target document even though the API reports that the patch failed, defeating the all-or-nothing behavior callers rely on to reject bad patches. 2026-07-29 5.3 CVE-2026-67217 davejesch--Database Collation Fix The Database Collation Fix plugin for WordPress is vulnerable to time-based SQL Injection via the 'force-collation-algorithm' parameter in all versions up to, and including, 1.2.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires a trigger.txt file to be present in the plugin's directory (/wp-content/plugins/database-collation-fix/trigger.txt), a condition created by DesktopServer integration events such as site creation, copy, import, move, export, or deploy. 2026-08-01 5.3 CVE-2026-15018 decidim--decidim Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the normal download_your_data flow requires the requester to be logged in as the export owner, but the resulting Active Storage blob redirect URL can be replayed without authentication by anyone who obtains it. This is because Decidim::DownloadYourDataController#download_file authenticates the export owner but redirects to a signed Active Storage blob URL that is no longer bound to the owner session. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2. 2026-07-31 6.5 CVE-2026-45377 decidim--decidim Decidim is a participatory democracy framework. From 0.31.1 before 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, a participant can directly load /admin/demographics/questions/edit_questions and reach the demographics questionnaire editor without the required administrator authorization. The demographics questionnaire editor should require admin access, but the route under /admin/demographics/questions renders the editor interface without checking whether the caller is an admin. A normal participant can load the page and see the live update form action, which proves the protected interface is reachable. This issue is fixed in versions 0.31.5 and 0.32.0.rc2. 2026-07-31 5.4 CVE-2026-45086 decidim--decidim Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the GET /admin/organization/users search interpolates params[:term] into raw Arel.sql ORDER BY similarity expressions before sanitization, allowing an authenticated organization administrator to execute blind PostgreSQL expressions and infer data through timing differences. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2. 2026-07-31 5.5 CVE-2026-45376 decidim--decidim Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verification admin controllers load pending Authorization records by raw identifier without confirming current_organization ownership, allowing an administrator from one tenant to view, approve, or reject another tenant's ID-document request. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2. 2026-07-31 4.9 CVE-2026-45330 deveasel--Demi One Click Demo Import, Backup & Site Migration The Demi - One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Copy in all versions up to, and including, 0.0.8 via the handle_restore_step function. This is due to missing HTTP access controls on the wp-content/uploads/demi-backup-state/ directory, which exposes the cryptographic restore key used to both authenticate the unauthenticated AJAX handler and forge signed restore-state envelopes. This makes it possible for unauthenticated attackers to copy arbitrary files to attacker-controlled destinations on the server. An active restore operation must have been initiated, which writes the .restore_key and .restore_step_token files to the public upload directory, before the exposed secrets can be harvested and chained to achieve unauthenticated arbitrary file copy. 2026-07-28 5.3 CVE-2026-15012 devitemsllc--ShopLentor All-in-One WooCommerce Growth & Store Enhancement Plugin The ShopLentor - All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.5 via the 'optionSection' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to read arbitrary wp_options rows - including internal plugin news feed data, WooCommerce block pattern transients, and third-party configuration records - whose values are stored as arrays-of-arrays containing 'title' keys, enabling cross-plugin data leakage. 2026-07-28 4.3 CVE-2026-16797 devitemsllc--ShopLentor All-in-One WooCommerce Growth & Store Enhancement Plugin The ShopLentor - All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. 2026-07-28 4.9 CVE-2026-16811 dfir-iris--iris-web The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks. 2026-07-30 5.9 CVE-2026-16971 dfir-iris--iris-web The IRIS web application in version 2.4.26 and possibly others does not protect its user authentication against brute-force attacks. 2026-07-30 5.9 CVE-2026-18362 dfir-iris--iris-web The IRIS web application in version 2.4.26 and possibly others contains a logout functionality which is ineffective. Stolen session cookies can therefore be misused for a long time. 2026-07-30 4.2 CVE-2026-16970 dotonpaper--Pinpoint Booking System Version 2 The Pinpoint Booking System - Version 2 plugin for WordPress is vulnerable to blind SQL Injection via the 'field' parameter in all versions up to, and including, 2.9.9.6.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The nonce required to reach the vulnerable endpoint is emitted on all plugin admin pages loaded under manage_options, making it trivially obtainable by any authenticated administrator. 2026-08-01 4.9 CVE-2026-15403 drakkan--SFTPGo SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in a permitted directory that point to files in directories where download, upload, or overwrite permissions are denied. Attackers can exploit the create_symlinks permission combined with read and write access in one directory to read or modify files in restricted directories, as operations are authorized against the link's directory permissions rather than the dereferenced target's directory permissions. 2026-07-30 4.2 CVE-2026-10031 edge22--GenerateBlocks The GenerateBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Dynamic Tag Injection in HTML Attributes in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A Contributor-level attacker can store the malicious payload by placing a dynamic tag such as {{post_meta key:...}} in a non-URL HTML attribute (e.g., title, aria-label, alt, or data-* attributes) of a GenerateBlocks element block, then setting the corresponding unprotected post meta key via the Custom Fields metabox to a value containing a closing quote and an injected event-handler attribute. 2026-08-01 6.4 CVE-2026-13458 eLyiN--gemini-bridge gemini-bridge is a lightweight MCP server bridging AI agents to Google's Gemini AI via the official CLI. From 1.0.0 until 1.3.1, consult_gemini_with_files in inline mode read any file path supplied in the files argument without confining it to the working directory, then forwarded the contents to the Gemini CLI. Because the caller also controls query, the file contents are echoed back through the Gemini round-trip (and sent to Google), making this an arbitrary local file read. This issue is fixed in version 1.3.1. 2026-07-31 6.2 CVE-2026-54785 facturadorvirtual--Facturacin Electrnica Costa Rica The Facturación Electrónica Costa Rica plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on the (global scope, included by fvcr_admin_page_html) function. This makes it possible for unauthenticated attackers to modify the plugin's configuration, including API tokens, access tokens, economic activity, Hacienda environment mode, invoice and ticket emission flags, exchange rate, and branch settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. 2026-07-29 4.3 CVE-2026-9720 Flipper Code--WP Maps Insertion of Sensitive Information Into Sent Data vulnerability in Flipper Code WP Maps allows Retrieve Embedded Sensitive Data. This issue affects WP Maps: from n/a through 4.9.6. 2026-07-31 4.3 CVE-2026-28144 foomagoo--Plugin Organizer The Plugin Organizer plugin for WordPress is vulnerable to SQL Injection via the 'PO_plugin_path' parameter in versions up to, and including, 10.2.4. This is due to insufficient escaping on the user-supplied parameter in the perform_plugin_search() function, where esc_sql() output is passed as the replacement string to preg_replace(), which collapses backslash escapes and defeats the quoting protection; additionally, the AJAX handler lacks both nonce verification and capability checks. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. 2026-07-28 6.5 CVE-2026-15304 Franky--Events Made Easy Unauthenticated Broken Access Control in Events Made Easy prepare() format string, bypassing parameterization entirely. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. 2026-07-28 6.5 CVE-2026-15267 Themeisle--Feedzy Contributor Server Side Request Forgery (SSRF) in Feedzy

Read more »

Read This Before You Buy That TV Streaming Stick
Security experts have been sounding the alarm for years about the risks of using generic TV boxes that promise unlimited content streaming for a one-time fee, warning that they secretly rent the user's Internet connection out to strangers. But a groundbreaking new analysis finds these devices also routinely spoof themselves as mobile phones clicking ads on AI-generated websites as part of sprawling operation that seeks to defraud online merchants and advertising networks.

Read more »

LG to Ban Residential Proxies from Smart TV Apps
The home appliance giant LG Electronics USA said this week it plans to suspend any apps built for its smart TVs that turn one's television into an always-on residential proxy node. The move comes less than a month after researchers found that more than 42 percent of games and other apps available for download on LG's webOS store allow unknown third-parties to route their Internet traffic through a user's TV.

Read more »

Microsoft Patches a Record 570 Security Flaws
Microsoft Corp. today released software updates to plug at least 570 security holes in its Windows operating systems and other software, almost triple the number of vulnerabilities the software giant fixed in its record-smashing Patch Tuesday release last month. Microsoft attributed the burgeoning patch counts to vulnerability discoveries aided by artificial intelligence.

Read more »

Lessons Learned from CISA’s Recent GitHub Leak
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a postmortem on a data leak in which a contractor published dozens of internal CISA credentials -- including AWS Govcloud keys -- in a public GitHub repository for almost six months before being notified by KrebsOnSecurity. Experts say the gaps identified in the agency's initial response provide important lessons that all security teams should absorb.

Read more »

Felons, Fraudsters Flog Offensive Cybersecurity Startup
A cybersecurity startup dangling millions of dollars to acquire zero-day security vulnerabilities in popular software is run by a pair of far-right conspiracy theorists and convicted felons whose most recent ventures included fake intelligence companies and a now-defunct AI-based lobbying platform they operated under assumed names.

Read more »

FBI Seizes NetNut Proxy Platform, Popa Botnet
The Federal Bureau of Investigation (FBI) said today it worked with industry partners to seize hundreds of domains associated with NetNut, a sprawling residential proxy service operated by the publicly-traded Israeli company Alarum Technologies [NASDAQ: ALAR]. The action comes roughly two weeks after KrebsOnSecurity published findings from multiple security firms connecting NetNut to the Popa botnet, a collection of at least two million devices that have been compromised by malicious software with little or no consent from victims.

Read more »

Scattered Spider Hackers Plead Guilty on Day 1 of Trial
Two men pleaded guilty in the United Kingdom this week to criminal charges stemming from an August 2024 cyberattack that crippled Transport for London, the entity responsible for the public transport network in the Greater London area. The duo were key members of a prolific cybercrime group known as Scattered Spider, and their guilty pleas came on the first day of what was expected to be a six-week trial.

Read more »

Amazon continues to offer $30 discount on Apple Watch SE 3 models, prices start at $219
Amazon has Apple Watch SE 3 models on sale for $30 off MSRP, shipping included: - 40mm Apple Watch SE GPS: $219, $30 off MSRP - 44mm Apple Watch SE GPS: $249, $30 off MSRP - 40mm Apple Watch SE GPS + 5G: $249, $30 off MSRP - 44mm Apple Watch SE GPS + 5G: $299, $30 off MSRP These are the lowest sale prices currently available for Apple Watch SE 3 models. For the latest prices & deals, keep an eye on our Apple Watch Price Tracker, updated daily.

Read more »

14-Inch M5 Max MacBook Pro with 36GB RAM and 2TB SSD on sale for $500 off Apple’s MSRP
Amazon continues to offer a $500 discount on Apple's 14-inch MacBook Pro with an M5 Max chip, 36GB of unified memory, and a 2TB SSD. The configuration is currently available for $3599, making it the best value we've found on the high-end 14-inch MacBook Pro. Shop the deal at Amazon. The M5 Max version is designed for demanding professional workloads, including video editing, software development, AI projects, 3D rendering, and other graphics-intensive applications. With 36GB of unified memory and a spacious 2TB SSD, it also offers plenty of room for large files and creative projects. Amazon is also offering fast shipping on available inventory, making this a good opportunity to save on one of Apple's most powerful 14-inch notebooks while the discount remains available. For the latest MacBook Pro prices, availability, and deals, visit our 14" MacBook Pro Price Tracker, updated daily.

Read more »

Amazon is taking $50 off Apple’s WiFi iPads
Amazon continues to have 11th-generation A16 WiFi iPads in stock on sale for $50 off MSRP, starting at $399. Shipping is free: - 11" 11th-generation 128GB WiFi iPads: $399 $50 off MSRP - 11" 11th-generation 256GB WiFi iPads: $499 $50 off MSRP - 11" 11th-generation 512GB WiFi iPads: $699 $50 off MSRP Amazon's prices are the lowest iPads prices currently available for 11th-generation models. For the latest prices & deals, keep an eye on our iPad Price Tracker, updated daily.

Read more »

Amazon offering slight $10 discount on MacBook Neos
Amazon is currently the only Apple retailer in our MacBook Neo Price Tracker offering a discount on all of Apple's newest Neos. While the savings are modest, Amazon has reduced both the 256GB and 512GB MacBook Neo by $10, making it the lowest-priced retailer we track for every configuration. Current pricing starts at $689 for the 256GB model, while the 512GB model is available for $789. Both prices are currently lower than Apple's MSRP, with no competing discounts available from the other major Apple retailers in our tracker. If you've been waiting for an opportunity to buy a MacBook Neo, Amazon currently offers the best pricing available, along with fast shipping on available inventory. For the latest MacBook Neo prices, availability, and deals, visit our MacBook Neo Price Tracker, updated daily.

Read more »

Today Only: B&H Takes $650 Off 16″ M5 Pro MacBook Pro with 48GB RAM
B&H has a particularly strong deal today on Apple's 16-inch M5 Pro MacBook Pro, dropping the Space Black model with 48GB RAM, a 1TB SSD, and Nano-Texture display to just $3099. That's a substantial $650 savings off its regular $3749 price. This is an unusually well-equipped configuration for the price, combining the 18-Core M5 Pro processor and 20-Core GPU with 48GB of unified memory and Apple's optional Nano-Texture display. Check the deal at B&H. This is a one-day deal scheduled to expire tonight at 11:59PM ET, so there's a fairly short window to take advantage of the $650 savings. B&H is also offering free shipping on the MacBook Pro. For the latest prices and deals across the lineup, see our 16" MacBook Pro Price Tracker, updated daily.

Read more »

Week’s Best Deals: $400-$500 Off 16-Inch M5 Max MacBook Pros
Amazon continues to offer substantial discounts on both standard 16-inch M5 Max MacBook Pro configurations. The 36GB/2TB model is currently $400 below Apple's MSRP, while the higher-end 48GB/2TB version is discounted by $500. The larger $500 discount applies to the flagship 48GB/2TB configuration, while the 36GB/2TB model is currently available at a $400 savings. Both discounts represent some of the lowest prices currently available on these professional-grade MacBook Pro configurations. Amazon is also offering fast shipping on available inventory, making this an attractive opportunity for buyers who have been waiting for lower pricing on Apple's most powerful notebook models. For the latest prices and availability, visit our 16" MacBook Pro Price Tracker, updated daily.

Read more »

Week’s Best AirPods Deals: AirPods Pro 3 $60 off, AirPods Max 2 $120 off at Amazon
Amazon's latest sales this week are delivering good AirPods prices, with discounts available across Apple's entire AirPods lineup. AirPods 4 are currently $99, AirPods 4 with ANC are $134.99, AirPods Pro 3 have dropped to $189, and AirPods Max 2 are now $429. Shop Amazon's AirPods deals here. The biggest discounts are available on AirPods Pro 3 and AirPods Max 2, which are currently selling for $60 and $120 below Apple's MSRP, respectively.Note that pricing can change quickly. For the latest sales and deals, see our AirPods Price Tracker, updated daily.

Read more »

Updated MacBook Price Trackers
Our Apple award-winning MacBook Price Trackers are continually updated with the latest information on prices, bundles, and availability for the new MacBook Neo, 16" and 14" M5, M5 Pro, & M5 Max MacBook Pros, along with 13" and 15" M5 MacBook Airs from Apple's authorized online retailers. We include prices for open-box MacBooks that might be available as well. Current sales range up to $150+ off MSRP for new MacBook Airs and $500+ off MacBook Pros: - 16" MacBook Pros - 14" MacBook Pros - 15" MacBook Airs - 13" MacBook Airs - MacBook Neos

Read more »

Red Pocket Offers $150 Off iPhone 17 Plus 50% Off Wireless Plans for Back-to-School
Red Pocket Mobile has launched several back-to-school deals, including a $150 rebate on the iPhone 17 and other eligible new iPhones, plus 50% off the first month of select monthly wireless plans. New customers can get 20GB of high-speed data for $20 or the 50GB Premium plan for $30 for their first month. Unlike most discount wireless providers, Red Pocket also lets you choose service using the AT&T, T-Mobile, or Verizon networks. Shop Red Pocket Mobile's latest deals See the latest iPhone prices and wireless deals on our iPhone Price Tracker.

Read more »

Best 13″ MacBook Air Deal Today: Amazon Takes $150 Off M5 Model With 24GB RAM
Amazon has one of the best deals available today on a 13-inch M5 MacBook Air, with this 24GB Sky Blue model currently selling for $150 below Apple's MSRP ($1649). Check the current sale price at Amazon. The discount makes this a particularly attractive option for anyone shopping for a new 13-inch MacBook Air, especially with Amazon also offering fast shipping on available inventory. For the latest prices and deals across the lineup, see our 13" MacBook Air Price Tracker, updated daily.

Read more »

Amazon Cuts Up to $500 Off 14-Inch M5 Pro MacBook Pro Models
Amazon is offering substantial discounts on Apple's 14-inch M5 Pro MacBook Pro lineup, with savings now reaching as much as $500 off Apple's MSRP. The 15-Core M5 Pro with 24GB RAM and a 1TB SSD is available for as low as $2346, while the 24GB/2TB version has dropped to just $2499 — a full $500 below Apple's $2999 MSRP. The higher-performance 18-Core M5 Pro with 24GB RAM and a 2TB SSD is also on sale for $2899, saving $300 compared to Apple's $3199 price. Shop the 24GB/1TB model, the 15-Core 24GB/2TB model, or the 18-Core 24GB/2TB model at Amazon. The $500 discount on the 15-Core 24GB/2TB model is particularly strong, giving buyers twice the SSD storage for the same $2499 price Apple charges for its standard 24GB/1TB configuration. Amazon is also offering fast shipping on available inventory. For the latest prices, availability, and deals, visit our 14" MacBook Pro Price Tracker, updated daily.

Read more »

iPads continue to be on sale for $50 off Apple’s MSRP, prices start at $399
Amazon continues to have 11th-generation A16 WiFi iPads in stock on sale for $50 off MSRP, starting at $399. Shipping is free: - 11" 11th-generation 128GB WiFi iPads: $399 $50 off MSRP - 11" 11th-generation 256GB WiFi iPads: $499 $50 off MSRP - 11" 11th-generation 512GB WiFi iPads: $699 $50 off MSRP Amazon's prices are the lowest iPads prices currently available for 11th-generation models. For the latest prices & deals, keep an eye on our iPad Price Tracker, updated daily.

Read more »