iPhone 18e Could Get Two Key Upgrades While Keeping 60Hz Display
Apple's upcoming iPhone 18e model will retain a 60Hz display but could gain an upgraded front-facing camera, according to the leaker known as "Digital Chat Station." In a new post on Weibo, the leaker said that the device will feature a 6.12-inch OLED display using low-temperature polycrystalline silicon (LTPS) technology, the A20 chip, and a single 48-megapixel rear camera. They were less definitive about the front-facing camera, saying it could be upgraded to 24 megapixels. The specifications suggest that the iPhone 18e will offer no major display or rear camera hardware upgrades over the previous two generations. Both the iPhone 16e and iPhone 17e feature approximately 6.1-inch ‌OLED‌ displays with a 60Hz refresh rate and a single 48-megapixel rear camera. The post does not detail the rear camera's sensor or lens, so smaller hardware changes remain possible. The A20 chip would represent a more significant upgrade. Like the A20 Pro chip in the iPhone 18 Pro, the A20 is expected to use a 2nm manufacturing process, bringing notable performance and power efficiency improvements over the iPhone 17e's 3nm A19 chip. It would also bring the device into line with the upcoming standard iPhone 18, which is expected to use the same chip. The front-facing camera claim is less clear. Digital Chat Station specified 24 megapixels, although it is unclear whether this refers to a new camera or is a mistaken reference to the 18-megapixel Center Stage camera introduced with the iPhone 17 lineup. A 24-megapixel camera was widely rumored before those devices launched. Either resolution would represent an upgrade over the 12-megapixel front camera used by the iPhone 16e and ‌iPhone 17e‌. Digital Chat Station previously claimed that the iPhone 18e would retain a 60Hz LTPS display. An earlier report from Korea suggested that an LTPO display capable of supporting 120Hz ProMotion could reach the entry-level iPhone with the "iPhone 19e" in 2028. The iPhone 18e is expected to launch in spring 2027, alongside the standard ‌iPhone 18‌ and iPhone Air 2.Related Roundup: iPhone 17eTag: Digital Chat StationBuyer's Guide: iPhone 17e (Neutral)This article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

New iMac and 14-Inch MacBook Pro With M6 Chip Expected Tomorrow
After announcing a new iPad mini today, Apple is expected to introduce updated iMac and 14-inch MacBook Pro models on Tuesday, both with the M6 chip that debuted in the new Mac mini in August. No design changes have been rumored for these Macs. Finally, higher-end 14-inch and 16-inch MacBook Pro models with touch-enabled OLED displays are expected to be announced on Wednesday.Related Roundups: iMac, MacBook ProTag: Mark GurmanBuyer's Guide: iMac (Don't Buy), MacBook Pro (Caution)Related Forums: iMac, MacBook ProThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

JAŸ-Z to Headline 2027 Apple Music Super Bowl LXI Halftime Show
Apple and the NFL today announced that rapper Jay-Z ("JAŸ-Z") will headline the 2027 Apple Music Super Bowl LXI Halftime Show at SoFi Stadium in the Los Angeles area. Super Bowl LXI will take place on Sunday, February 14 next year, meaning that Jay-Z will be performing on Valentine's Day. In the U.S., the big game will air on ABC and ESPN, with the Apple Music Halftime Show typically starting around 8:00 p.m. to 8:15 p.m. Eastern Time. It is not yet known who else will perform alongside Jay-Z. Apple Music has sponsored the Super Bowl Halftime Show since 2022, with previous performers including Rihanna, Kendrick Lamar, Bad Bunny, and others.Tags: Apple Music, NFL, Super BowlThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

macOS 27.2 Stops Upgrades From Removing Rosetta
Upgrading to macOS 27 no longer removes an existing Rosetta installation, according to Apple's enterprise release notes for macOS 27.2. Previously, upgrading to macOS 27 removed existing installations of Rosetta, the translation tool that lets Intel-based apps run on Apple silicon Macs. macOS 27 remains the final release with full Rosetta support. Apple plans to phase out general-purpose support starting with macOS 28.Related Roundup: macOS Golden GateTag: RosettaRelated Forum: macOS Golden GateThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

Older Siri Remotes Now Show Up in Find My With iOS 27.2
With iOS 27.2 and tvOS 27.2, second- and third-generation Siri Remotes can be tracked using the Find My app. There has been an option to locate a lost ‌Siri‌ Remote with an iPhone since iOS 17, but remotes did not previously show up in the ‌Find My‌ app. Locating a remote had to be done with the Apple TV Remote widget in the Control Center, which made the option hard to find. Supported ‌Siri‌ Remotes are now listed in the ‌Find My‌ app right alongside other devices, a more intuitive option for iOS and macOS users. With the upcoming fourth-generation ‌Apple TV‌ 4K, Apple is adding a speaker and Precision Finding to the ‌Siri‌ Remote to make it easier to find when misplaced. Older remotes are not able to play a sound and do not have Precision Finding. When the fourth-generation ‌Apple TV‌ was announced, Apple said ‌Find My‌ support would be available on the 2nd-generation ‌Siri‌ Remote and later, and it's here now. Related Roundups: Apple TV, iOS 27, iPadOS 27Tags: Find My, SiriBuyer's Guide: Apple TV (Buy Now)Related Forums: Apple TV and Home Theater, iOS 27This article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

iPhone Duo Features Independent Rotation Lock Controls
The iPhone Duo can lock the screen orientation of its two displays independently. Enabling Orientation Lock from Control Center applies only to the display you're using at the time, so the outer display can stay locked in portrait while the inner display is free to rotate as you open and reposition the phone. The separation offers a little more flexibility. For example, you could keep the outer display locked in portrait for reading while reclining on the sofa, but leave the inner display free to rotate into landscape for watching videos, without having to toggle Orientation Lock each time. The only caveat is that videos still rotate automatically when the Duo is propped up in "tent mode," regardless of Orientation Lock.Related Roundup: iPhone DuoBuyer's Guide: iPhone Duo (Buy Now)Related Forum: iPhoneThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

iOS 27.2 Features: Everything New in iOS 27.2
Apple released iOS 27.2, uniting the iPhone Duo and other iPhone models on the same version of iOS. iOS 27.2 is the first major iOS 27 update, and it adds several useful new features. Siri AI Improvements Siri AI can recall past conversations you had with it, so you can ask ‌Siri‌ about something it told you before, like a restaurant it previously recommended. It's also able to draw on more sources: Photos attached to Messages Calendar event attendees Voicemails Apple says you'll also get better results from Safari history and Reading List. There's a redesigned Excluded Apps feature that lets you quickly select which apps ‌Siri‌, Search, and suggestions can access. The prior App Access feature required excluding apps individually. There's also granular text selection, so you can select and copy just the part of a ‌Siri‌ response you need. ‌Siri‌ AI requires an iPhone 15 Pro or later. Siri AI Languages ‌Siri‌ AI is now available in more languages, including French, Japanese, Korean, Portuguese, and Spanish. ‌Siri‌ AI is still not available in the EU or mainland China. Messages Suggestions in Messages have been added in iOS 27.2. The feature was available during the ‌iOS 27‌ beta testing period, but was removed before launch. Messages suggestions show tappable shortcuts in a conversation based on context, so you can do things like track a package with a tap, or add a dinner invite to the Calendar app. You can choose the suggestions you want, with options to add Calendar, Reminders, Notes, Maps, and Flights and Packages. Apple Music iOS 27.2 introduces a new Apple Music icon that goes with Apple's recent ‌Apple Music‌ rebranding. The icon is black and white, replacing the red icon. Apple also changed the color of the highlights in the navigation bar and other areas of the ‌Apple Music‌ app to remove the red color. Photos Shared Albums in the ‌Photos‌ app now have an edit option for captions and comments. Apple also added a feature for avoiding duplicate photos, and there's now a reminder before albums expire so users can save important photos and videos. SynthID iOS 27.2 includes SynthID labeling for Image Playground images and some ‌Photos‌ app edits. Watermarks are added when using Extend and Reframe in ‌Photos‌, and for large edits with the Clean Up tool. You can check images for SynthID using Google's SynthID Detector website. Podcasts The Home tab in the Podcasts app has separate sections for New Episodes and Continue Playing. The new sections replace Up Next. Games The Friends tab in the Games app now includes context on friend suggestions and shows recent games played on friends' player pages. Apple TV Apple TV app users can now create profiles in the account settings section on the iPhone and iPad. Profiles only require a name, profile rating, and information about whether the user is a child. Creating a profile for a child limits content to a PG rating by default, but there is a customize option for finer control. Users can select age ratings for TV shows and movies that are appropriate for the child based on their age. Phone The Call Context feature in the Phone app reminds you of a contact's anniversary when you call them, as long as you've saved the date in the Contacts app. FaceTime FaceTime Dual Capture is now available in group ‌FaceTime‌ calls. Dual Capture is a feature that lets you stream ‌FaceTime‌ video content from the front and rear cameras at the same time. On a compatible device running ‌iOS 27‌, flipping the camera while on a ‌FaceTime‌ call automatically turns on Dual Capture. Dual Capture is available on the iPhone 17, ‌iPhone 17‌ Pro, ‌iPhone 17‌ Pro Max, iPhone Air, iPhone 18 Pro, ‌iPhone 18 Pro‌ Max, and ‌iPhone Duo‌. Apple also added an option to add a third-party sign language interpreter or live captioner to a call. Shortcuts ‌iOS 27‌ includes new automations, actions, and improvements for the Shortcuts app. There's a new "when my iPhone is opened or closed" automation for the ‌iPhone Duo‌. An updated Workout automation adds support for the Fitness app, and the App automation can provide the name of the app that was closed. Window layout can be configured with the "Show Actions" and Show Describe a Shortcut" menu items, and Shortcut names and icons can be edited from the library. iPhone Duo Updates iOS 27.2 adds Apple Pencil USB-C support to the ‌iPhone Duo‌. It also includes Edge Light to illuminate your face during video calls. Multiview iOS 27.2 expands Multiview in the ‌Apple TV‌ app to the iPhone, so users can watch up to four live sports streams simultaneously. Multiview works for sports events included in an ‌Apple TV‌ subscription: Major League Soccer (MLS), Formula 1 (F1) in the U.S., and Friday Night Baseball doubleheaders during the Major League Baseball season. Clock App There are smaller a.m. and p.m. labels in the alarm list in the Clock app. EU - App Tracking Transparency App Tracking Transparency supports an alternative expanded prompt for EU users along with re-prompting on an annual basis. The alternative prompt is required for users in France, Germany, Italy, Poland, and Romania. Health App Apple tested its redesigned Health app in the iOS 27.2 beta, but it won't be coming out until later this year and is not included in iOS 27.2. Security Fixes iOS 27.2 addresses more than 160 security vulnerabilities. None of the vulnerabilities were actively exploited, but it's always a good idea to update when this many fixes are included.Related Roundups: iOS 27, iPadOS 27Related Forum: iOS 27This article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

Why Can't iPhone Duo Users Make Eye Contact on FaceTime?
FaceTime's Eye Contact setting is missing on the iPhone Duo, MacRumors can confirm. The setting was first flagged as absent by MacRumors forum member TwoBytes, who noticed their eyes looking "a little off" during a call. Introduced in iOS 14, Eye Contact uses machine learning to subtly adjust your eyes during a video call to make it seem like you're looking into the camera lens, even though you're actually looking at the image of the other person on your screen. While it may seem the obvious cause, the iPhone Duo's lack of Face ID and TrueDepth camera is unlikely to be the reason for Eye Contact's absence, since iPhone SE models with Touch ID also include the option in Settings. One possibility is the position of the inner display's under-display camera, which sits toward the right-hand side of the screen, away from the center where the other caller's face usually appears. Correcting for that larger, sideways offset is going to be different than for the small vertical gap on a regular iPhone. The Duo's design also means the camera's position relative to your gaze changes depending on which display you're using and what the device's folded state is. Apple already restricts Eye Tracking – a gaze-based accessibility feature – to when the Duo is fully open. Eye Contact setting on iPhone 18 Pro (left) vs iPhone Duo We've reached out to Apple for a technical explanation about the lack of Eye Contact on the iPhone Duo.Related Roundup: iPhone DuoTag: FaceTimeBuyer's Guide: iPhone Duo (Buy Now)Related Forum: iPhoneThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

iOS 27.2 Fixes Over 160 Security Vulnerabilities
Apple's iOS 27.2 and iPadOS 27.2 updates fix more than 160 security vulnerabilities, which means it's a good idea to install the software as soon as you can. An Apple Intelligence vulnerability that could let a remote attacker access sensitive data was fixed, as was a Hide My Email bug that could leak the user's real email address. There are more than 30 WebKit fixes, and approximately 15 kernel bugs have been addressed. Six CVEs credit Calif, the team that jailbroke the iPhone Duo on launch day and demonstrated an untethered iOS 27.0.1 jailbreak. Calif researcher Stefan Esser recently said that "most" of the vulnerabilities used for its jailbreak are fixed in iOS 27.2. Apple did not say any of the flaws are known to be actively exploited, but with details published, devices that are not updated could be subject to attack. The number of security fixes in iOS updates continues to grow as AI models have gotten better at locating vulnerabilities. Anthropic Research is credited on three fixes, and four cite OpenAI. Apple has also released iOS 26.7.2 for devices not yet updated to iOS 27. It has many of the same security fixes.Related Roundups: iOS 27, iPadOS 27Related Forum: iOS 27This article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

iPhone AI Images and Edits Now Have a Hidden Watermark
Images generated with Image Playground and some photos edited with Apple Intelligence will now include a SynthID watermark. Apple announced plans to add SynthID support back in June, and the feature is live in iOS 27.2. SynthID is a Google-created tool that identifies AI-generated content. It watermarks images and videos at the pixel level instead of adding metadata. Google says it does not affect image quality and is meant to survive cropping, filters, and compression. SynthID is used by Google, Apple, OpenAI, and others. There is no option on the iPhone for detecting SynthID watermarks, and to check for them, you need to use the SynthID Detector website. When we tested the Photos app tools, images altered with Extend and Reframe had SynthID watermarks when checked, but Clean Up watermarking seemed to depend on the size of the edit. With small edits, no watermark was added. Larger Clean Up edits included a SynthID watermark. Images created with ‌Image Playground‌ will all have the SynthID watermark.Related Roundups: iOS 27, iPadOS 27Related Forum: iOS 27This article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

iOS 27.2 Lets You Watch Four Live Sports Streams on iPhone
iOS 27.2 expands Multiview to the iPhone, so users can watch up to four live sports streams simultaneously. Multiview works for sports events included in an Apple TV subscription: Major League Soccer (MLS), Formula 1 (F1) in the U.S., and Friday Night Baseball doubleheaders during the Major League Baseball season. With Formula 1, users can select a preset team Multiview for live events, or build their own from multiple F1 feeds like onboard cameras and track maps. Multiview was previously available on the ‌Apple TV‌ 4K and the Vision Pro. The ‌Apple TV‌ supports watching four sports streams and the Vision Pro supports watching five.Related Roundups: iOS 27, iPadOS 27Related Forum: iOS 27This article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

iOS 27.2 Expands Dual Capture to Group FaceTime
The iOS 27.2 update Apple released today allows the FaceTime Dual Capture feature to be used in Group ‌FaceTime‌ calls. Dual Capture is a feature that lets you stream ‌FaceTime‌ video content from the front and rear cameras at the same time. On a compatible device running iOS 27, flipping the camera while on a ‌FaceTime‌ call automatically turns on Dual Capture. Dual Capture is available on the iPhone 17, ‌iPhone 17‌ Pro, ‌iPhone 17‌ Pro Max, iPhone Air, iPhone 18 Pro, ‌iPhone 18 Pro‌ Max, and iPhone Duo. The ‌iPhone Duo‌ also supports Duo ‌FaceTime‌, an option that uses the under-display camera on the inner display and the outer display camera to let a second person join a group call without having to squeeze everyone into a single frame. With iOS 27.2, Apple also added an option to add a third-party sign language interpreter or live captioner to a call. Related Roundups: iOS 27, iPadOS 27Tag: FaceTimeRelated Forum: iOS 27This article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

Here's Why Apple's Next Pre-Orders Begin on Wednesday at 10:10 AM
Apple said the new iPad mini that it announced today will be available to pre-order starting at a quite specific time on Wednesday: 10:10 a.m. Pacific Time. Apple invited selected tech reporters and content creators to an experience in Los Angeles on Wednesday at 10 a.m. Pacific Time. Bloomberg's Mark Gurman believes Apple will kick off the experience by playing a short video unveiling the rumored MacBook Pro with a touchscreen, and then start taking pre-orders immediately afterward. In other words, the video should be around 10 minutes long, and this would explain why pre-orders for the new iPad mini and likely the MacBook Pro with a touchscreen are set to begin at exactly 10:10 a.m. Pacific Time. It is likely that pre-orders for new iMac and 14-inch MacBook Pro models with the M6 chip will begin at that time too. One final "inside baseball" thought: If this plan proves to be accurate, a press release for the MacBook Pro with a touchscreen might not appear on the Apple Newsroom website until closer to 10 a.m. Pacific Time on Wednesday, whereas the new iPad mini's press release came out at a much earlier 6 a.m. Pacific Time today.Related Roundup: iPad miniBuyer's Guide: iPad Mini (Coming Soon)Related Forum: iPadThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

Apple Says Siri AI Will Support Even More Languages Later This Year
Apple today announced that Siri AI will gain support for Chinese (Traditional), Norwegian, Turkish, and Vietnamese later this year. The feature initially supported English only when it launched in September, with support for French, Japanese, Korean, Portuguese, and Spanish added in iOS 27.2 and corresponding updates.Related Roundups: iOS 27, iPadOS 27Tags: Siri, Siri AIRelated Forum: iOS 27This article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

Apple Releases iOS 27.2 With New Siri AI Languages
Apple today released iOS 27.2 and iPadOS 27.2, the first major updates to the iOS 27 and iPadOS 27 operating systems that came out in September. iOS 27.2 is available for all iPhones able to run ‌iOS 27‌, including the iPhone Duo, while iPadOS 27.2 is available for all iPads able to run ‌iPadOS 27‌, including the newly announced OLED iPad mini. The iOS 27.2 update expands Siri AI to new languages, including French, Japanese, Korean, Portuguese, and Spanish. It also adds profiles for the Apple TV app, a new icon and branding for Apple Music, and support for AI suggestions in the Messages app for taking quick actions in apps like Calendar and Reminders. In the European Union, it introduces an alternative expanded prompt for App Tracking Transparency. Apple's release notes for iOS 27.2 are below. Siri AI (All iPhone 16 models and later, iPhone 15 Pro, iPhone 15 Pro Max) - Siri AI can recall your past conversations, so you can ask Siri about something it told you before, like the restaurants it recommended last week - Siri AI can draw from more sources to give you a great answer, including photos attached in Messages, Calendar event attendees, your voicemails, and better results from Safari history and Reading List - Excluded Apps lets you choose which apps Siri, Search, and suggestions can access, all from one setting - Granular text selection lets you select and copy just the part of a Siri response you need - Siri AI is available in more languages, with support tor French, Japanese, Korean, Portuguese, and Spanish. Siri AI is not available in the EU or mainland China Other - Suggestions in Messages help you take action based on the context of your conversations, like adding a Calendar invite for a dinner - Shared Albums in Photos adds the ability to edit captions and comments, to avoid adding duplicate photos, and can display a reminder before albums expire so participants can save important photos and videos - Support for SynthID watermarking to help identify whether an image was generated or modified with generative tools in Photos and Image Playground - The Home tab in the Podcasts app offers two separate sections for New Episodes and Continue Playing, letting you find the latest updates from your shows and then pick up where you left off - Friends tab in the Games app provides context on friend suggestions and shows recent games played on friends' player pages - Simple Profiles in the Apple TV app lets everyone in your household have their own profile, with recommendations that fit what they like to watch - FaceTime supports adding a third party sign language interpreter or live captioner to a call Apple has separate release notes for the ‌iPhone Duo‌: This update provides enhancements to Siri AI with the ability to retain useful context from previous Siri interactions as well as draw from a wider range of personal context. iPhone Duo gets support for Apple Pencil, as well as Edge Light to illuminate your face during video calls. This update also introduces Suggestions in Messages that help you take quick actions in apps like Calendar and Reminders based on context from your conversation. This release includes additional features, bug fixes, and security updates for your iPhone Duo. iOS 27.2 and iPadOS 27.2 can be downloaded over the air by going to Settings > General > Software Update. Apple also released iOS 26.7.2 with security updates.Related Roundups: iOS 27, iPadOS 27Tag: SiriRelated Forum: iOS 27This article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

Apple Releases macOS Golden Gate 27.2
Apple today released macOS Golden Gate 27.2, the first major update to the macOS 27 operating system that launched in September. Mac users can download ‌macOS Golden Gate‌ 27.2 by opening up the System Settings app and using the Software Update option. ‌macOS Golden Gate‌ 27.2 overhauls the brightness and volume sliders, plus it expands Siri AI to new languages including French, Japanese, Korean, Portuguese, and Spanish.Related Roundup: macOS Golden GateRelated Forum: macOS Golden GateThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

Apple Releases watchOS 27.2 With Siri AI Enhancements
Apple today released watchOS 27.2, the first major update to the watchOS 27 operating system. watchOS 27.2 can be downloaded through the Settings app on the watch or the Apple Watch app on a connected iPhone. Software can only be installed when the Apple Watch is on the charger and has over 50 percent battery. According to Apple's release notes, watchOS 27.2 introduces new Siri AI features and extends ‌Siri‌ AI to new languages. This update provides enhancements to Siri AI, including the ability to retain useful context from previous Siri interactions, draw from a wider range of personal context, and deliver faster responses on your watch. This update also includes other features, bug fixes, and security updates for your Apple Watch. - Siri AI can recall your past conversations, so you can ask Siri about something it told you before, like the restaurants it recommended last week - Siri AI can draw from more sources to give you a great answer, including photos attached in Messages, Calendar event attendees, your voicemails, and better results from Safari history and Reading List from your phone - Excluded Apps lets you choose which apps Siri, Search, and suggestions can access, all from one setting on your phone - Siri AI now provides faster responses on Apple Watch - Siri AI is available in more languages, with support for French, Japanese, Korean, Portuguese, and Spanish. Siri AI is not available in the EU or mainland China ‌Siri‌ AI is also faster than before, and can draw on more sources when offering up answers.Related Roundups: watchOS 26, watchOS 27Tag: SiriRelated Forum: Apple WatchThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

Apple Releases HomePod 27.2 Software With Sound Glow for Existing HomePods
Apple today released new HomePod 27.2 software for the ‌HomePod‌ and ‌HomePod‌ mini. ‌HomePod‌ Software 27.2 brings a new Sound Glow option to the ‌HomePod‌, ‌HomePod‌ mini, and upcoming HomePod mini 2. Sound Glow causes the top of a ‌HomePod‌ or ‌HomePod‌ mini to light up with color that pulses in sync with the music that's playing. The feature draws colors from album artwork, and it works with songs, podcasts, and Apple's ambient music feature. The update also adds support for using HomePods as the default speaker for a Mac, plus it allows four HomePods or ‌HomePod mini 2‌ speakers to be used as surround sound for the new Apple TV. A new Lock Controls option disables tough interactions with the top of the ‌HomePod‌. ‌HomePod‌ software can be installed on the Home app on the iPhone, iPad, or Mac by tapping on the More button, choosing Home Settings, and then using the Software Update option. If automatic updates are turned on, the new ‌HomePod‌ software will be installed automatically. The ‌HomePod mini 2‌ is launching on Friday, October 30, while the new ‌Apple TV‌ 4K is coming out on November 13. Related Roundups: HomePod, HomePod mini 2Buyer's Guide: HomePod (Caution), HomePod Mini (Buy Now)Related Forum: HomePod, HomeView, CarPlay – Home & Auto TechThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

Apple Releases tvOS 27.2 With HomePod Surround Sound Support
Apple today released tvOS 27.2, the first major update to the tvOS 27 operating system that runs on the Apple TV 4K. tvOS 27.2 can be downloaded using the Settings app on the ‌‌‌Apple TV‌‌‌. Open up Settings and go to System > Software Update to get the new software. ‌‌‌Apple TV‌‌‌ owners who have automatic software updates activated will be upgraded to tvOS 27.2 automatically. Today's update adds support for four-speaker surround sound, a feature that works with the HomePod, HomePod mini 2, and the upcoming ‌Apple TV‌ 4K. It allows the ‌Apple TV‌ 4K to be used with four ‌HomePod mini 2‌ speakers, four second-generation HomePods, or two HomePods and two ‌HomePod mini 2‌ speakers to get surround sound. The ‌HomePod mini 2‌ launches on October 30, while the fourth-generation ‌Apple TV‌ 4K will come out on November 13. Related Roundups: Apple TV, HomePodBuyer's Guide: Apple TV (Buy Now), HomePod (Caution)Related Forum: Apple TV and Home TheaterThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

Apple Releases visionOS 27.2
Apple today released visionOS 27.2, the first big update for the visionOS 27 operating system that runs on the Apple Vision Pro. visionOS 27.2 can be downloaded by opening the Settings app, selecting the General section, and choosing Software Update. Installing the update requires the headset to be removed, and a progress bar appears on the EyeSight display. The visionOS 27.2 update expands Siri AI to new languages, including French, Japanese, Korean, Portuguese, and Spanish. Related Roundup: Apple Vision ProBuyer's Guide: Vision Pro (Neutral)Related Forum: Apple Vision ProThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

Updates to Full Disk Access in macOS
We give developers powerful APIs to build incredible capabilities into their apps for Apple products, backed by a set of controls designed to protect users’ private data. Full Disk Access largely sidesteps these controls in order to allow backup apps to function properly on the Mac. Some developers are using Full Disk Access in ways that could put users at risk, exposing everything on their systems—including files, mail, messages, and even browsing history—without users’ full knowledge and understanding. For communication apps, this can also compromise the privacy of the people users are communicating with.Going forward, we will introduce additional controls to ensure that users who genuinely wish to grant an app this extraordinary level of access can only do so with very explicit user action. Addressing this is critical. As AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially. We are committed to ensuring users clearly understand these risks before granting such access, so they can make informed decisions about their own data and privacy.

Read more »

Introducing the new Copilot with Home, Code and Autopilot
We’re reimagining Microsoft Copilot to enable work as it evolves and to help expand what every individual and every organization can accomplish in the flow of human ambition. The post appeared first on AI at Work Blog.

Read more »

Building the system for AI at work
There's no shortage of sound and fury in AI right now. The post appeared first on Microsoft 365 Blog.

Read more »

Get ready with the latest beta releases
The beta versions of iOS 27.2, iPadOS 27.2, macOS 27.2, tvOS 27.2, visionOS 27.2, and watchOS 27.2 are now available. Get your apps ready by confirming they work as expected on these releases. And make sure to build and test with Xcode 27.2 to take advantage of the advancements in the latest SDKs.Note about iOS 27.1 and iPhone DuoWhen iPhone Duo becomes available on October 23, it will run iOS 27.1. This version builds on the foundation of iOS 27 and introduces features that were purpose-built for the new foldable design.Xcode 27.1 will add development support for iPhone Duo. This includes updated SDKs and a simulator that supports the all-new poses and orientations of iPhone Duo. A beta version will be available later this month.View downloads and release notesLearn about testing a beta OSLearn about sending feedback

Read more »

Updates to App Tracking Transparency in the European Union
As part of agreements with select European competition authorities, Apple is introducing changes to its App Tracking Transparency framework in the European Union. Beginning with iOS 27.2 and iPadOS 27.2, developers will have the option to use an alternative version of the App Tracking Transparency system prompt in the EU. The requirements for when you must seek permission to track users will remain the same. Due to legal requirements, only the alternative version of the system prompt is available for apps distributed in Germany, France, Italy, Poland, and Romania.Learn more

Read more »

Introducing Microsoft 365 G7: Intelligence + Trust for the mission ahead
Microsoft 365 G7 brings AI, Copilot, agent governance, security, and compliance together to help government agencies modernize securely. The post appeared first on Microsoft 365 Blog.

Read more »

ESPC 2026 is coming to Amsterdam: Bringing Microsoft and the community together
Join Microsoft at ESPC 2026 in Amsterdam to explore the latest innovations in Microsoft 365, Copilot, agents, and AI. The post appeared first on Microsoft 365 Blog.

Read more »

ESPC 2026 is coming to Amsterdam: Bringing Microsoft and the community together
Join Microsoft at ESPC 2026 in Amsterdam to explore the latest innovations in Microsoft 365, Copilot, agents, and AI. The post appeared first on Microsoft 365 Blog.

Read more »

ESPC 2026 is coming to Amsterdam: Bringing Microsoft and the community together
Join Microsoft at ESPC 2026 in Amsterdam to explore the latest innovations in Microsoft 365, Copilot, agents, and AI. The post appeared first on Microsoft 365 Blog.

Read more »

ESPC 2026 is coming to Amsterdam: Bringing Microsoft and the community together
Join Microsoft at ESPC 2026 in Amsterdam to explore the latest innovations in Microsoft 365, Copilot, agents, and AI. The post appeared first on Microsoft 365 Blog.

Read more »

ESPC 2026 is coming to Amsterdam: Bringing Microsoft and the community together
Join Microsoft at ESPC 2026 in Amsterdam to explore the latest innovations in Microsoft 365, Copilot, agents, and AI. The post appeared first on Microsoft 365 Blog.

Read more »

ESPC 2026 is coming to Amsterdam: Bringing Microsoft and the community together
Join Microsoft at ESPC 2026 in Amsterdam to explore the latest innovations in Microsoft 365, Copilot, agents, and AI. The post appeared first on Microsoft 365 Blog.

Read more »

ESPC 2026 is coming to Amsterdam: Bringing Microsoft and the community together
Join Microsoft at ESPC 2026 in Amsterdam to explore the latest innovations in Microsoft 365, Copilot, agents, and AI. The post appeared first on Microsoft 365 Blog.

Read more »

ESPC 2026 is coming to Amsterdam: Bringing Microsoft and the community together
Join Microsoft at ESPC 2026 in Amsterdam to explore the latest innovations in Microsoft 365, Copilot, agents, and AI. The post appeared first on Microsoft 365 Blog.

Read more »

ESPC 2026 is coming to Amsterdam: Bringing Microsoft and the community together
Join Microsoft at ESPC 2026 in Amsterdam to explore the latest innovations in Microsoft 365, Copilot, agents, and AI. The post appeared first on Microsoft 365 Blog.

Read more »

ESPC 2026 is coming to Amsterdam: Bringing Microsoft and the community together
Join Microsoft at ESPC 2026 in Amsterdam to explore the latest innovations in Microsoft 365, Copilot, agents, and AI. The post appeared first on Microsoft 365 Blog.

Read more »

ESPC 2026 is coming to Amsterdam: Bringing Microsoft and the community together
Join Microsoft at ESPC 2026 in Amsterdam to explore the latest innovations in Microsoft 365, Copilot, agents, and AI. The post appeared first on Microsoft 365 Blog.

Read more »

ESPC 2026 is coming to Amsterdam: Bringing Microsoft and the community together
Join Microsoft at ESPC 2026 in Amsterdam to explore the latest innovations in Microsoft 365, Copilot, agents, and AI. The post appeared first on Microsoft 365 Blog.

Read more »

ESPC 2026 is coming to Amsterdam: Bringing Microsoft and the community together
Join Microsoft at ESPC 2026 in Amsterdam to explore the latest innovations in Microsoft 365, Copilot, agents, and AI. The post appeared first on Microsoft 365 Blog.

Read more »

ESPC 2026 is coming to Amsterdam: Bringing Microsoft and the community together
Join Microsoft at ESPC 2026 in Amsterdam to explore the latest innovations in Microsoft 365, Copilot, agents, and AI. The post appeared first on Microsoft 365 Blog.

Read more »

How to turn on Stolen Device Protection on iPhone
Stolen Device Protection is a feature that helps ensure that if someone steals your iPhone, even if they have your passcode, they’re unlikely to be able to make changes to your Apple ID account. Here’s how to enable it. The post first appeared on The Mac Security Blog.

Read more »

iPhone passcode security: Why 6 digits may not be enough
Your entire digital life is protected by a six-digit passcode. If a thief gets that passcode, they can access all your passwords. The post first appeared on The Mac Security Blog.

Read more »

Data Broker Radaris Loses Domains in Privacy Fight
The consumer data broker Radaris.com has long had a reputation for ignoring requests to remove personal information from its vast empire of people-search services online. That reputation caught up with the company recently in a lawsuit alleging Radaris violated a New Jersey privacy law that provides for hefty fines against data brokers that publish personal information on state law enforcement officials. In the face of repeated stonewalling and prevarication by attorneys for Radaris, the judge in the case ordered that radaris.com and more than a dozen other data broker domains be transferred to the plaintiffs.

Read more »

Do Macs need antivirus, or is built-in protection enough?
Macs don’t all need the same level of protection. macOS includes strong built-in security that works quietly in the background, and it may be enough if you keep your Mac updated, follow Apple’s warnings, and download only trusted software. However, no security system can recognize every new or modified threat or prevent every unsafe decision. […] The post first appeared on The Mac Security Blog.

Read more »

How to clear RAM on a Mac and reduce memory usage
If your Mac is running slowly or showing a memory warning, you may be looking for a cleanup app or command-line trick to clear RAM. You don’t need either. macOS manages RAM automatically, and forcing it to clear memory can reduce performance instead of improving it. A good first step is to look at Memory […] The post first appeared on The Mac Security Blog.

Read more »

Syncing with iCloud paused? What it means and how to fix it
Seeing “Syncing with iCloud paused” can be worrying, especially when your messages, photos, or files stop updating across your Apple devices. Fortunately, this message usually means iCloud has temporarily stopped syncing. It doesn’t normally mean your existing data has disappeared or someone has accessed your Apple Account. The right fix depends on which service has […] The post first appeared on The Mac Security Blog.

Read more »

How to allow pop-ups on a Mac in Safari, Chrome, and Firefox
A blocked pop-up can make a website seem broken. A sign-in page might not appear, a payment window could fail to open, or a form, document viewer, or live chat may stop working. Your browser could be blocking the new window in the background, even when the website itself is legitimate. This guide shows you […] The post first appeared on The Mac Security Blog.

Read more »

Microsoft Plugs Nearly 1,000 Security Holes
Microsoft Corp. today issued updates to plug at least 974 security holes in its Windows operating systems and other software, by far its biggest single patch batch ever. Microsoft says artificial intelligence is helping to speed the discovery of vulnerabilities, but security experts warn that many organizations already are struggling to prioritize the more human-intensive endeavor of testing and deploying so many fixes each month.

Read more »

Vulnerability Summary for the Week of August 31, 2026
High Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info 1Hive--gardens-v2 Gardens v2 is a modular governance framework that enables communities to create and manage multiple governance pools with customizable parameters and voting mechanisms. In 3e595f3 and prior, when a streaming proposal is funded, the cluster of streaming contracts moves real pool funds into the proposal's StreamingEscrow to back the Superfluid constant flow agreement (the CFA deposit, plus a 0.5 percent margin). cancelProposal then zeroes the escrow's GDA member units but never reclaims that parked balance, and the permissionless claim() forwards the escrow's entire balance, including the pool funded buffer, to the beneficiary. The beneficiary is chosen by the proposal submitter and defaults to the submitter. The only path that returns escrow funds to the pool is drainToStrategy, which is onlyStrategy and is reached solely from the dispute reject ruling, never from cancel or natural completion. At time of publication, there are no publicly known patches. 2026-09-03 7.7 CVE-2026-55658 : Shane Bishop--EWWW Image Optimizer Unauthenticated Cross Site Scripting (XSS) in EWWW Image Optimizer = 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify router resolves an absolute-form request target to its path before dispatching. Because the two layers evaluate different strings, a request using an absolute-form target reaches the route handler while the path-scoped middleware, such as authentication or authorization, is skipped. An unauthenticated network attacker can use this to bypass path-based access controls in a Fastify application that relies on middie for those controls. Users should upgrade to @fastify/middie 9.3.4 or later. 2026-09-04 9.1 CVE-2026-85184 aaif-goose--goose goose 1.37.0 executes arbitrary commands from recipe stdio extensions and retry.checks without security inspection. Attackers can distribute malicious recipes that execute shell commands as the user running goose, bypassing the recipe security scan which does not inspect extensions or retry configurations. 2026-09-04 8.8 CVE-2026-85623 Acato--Email Essentials Unauthenticated Cross Site Scripting (XSS) in Email Essentials = 5.0.0-RC1 and < 5.10.11 contain a missing authorization vulnerability in AssetsController::actionReplaceFile. When a request supplies sourceAssetId and targetFilename but omits assetId, the target asset is resolved by folder and filename after the permission checks execute, so the replacePeerFiles permission is never enforced. An authenticated low-privilege author with only the replaceFiles permission on a shared folder can overwrite the content of a peer's asset file (located in the same folder) with attacker-controlled bytes. Fixed in 5.10.11. 2026-09-02 7.1 CVE-2026-84800 crcn--sift.js sift (sift.js) 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any matched operator key including $where. The $where operation compiles a string value into a function using new Function unless CSP_ENABLED is set (not set by default). As a result, if a prototype-pollution primitive elsewhere in the process sets Object.prototype.$where to a malicious string, even benign filter calls such as sift({}) execute arbitrary JavaScript. Additionally, passing an untrusted query object containing a string $where directly to sift results in code execution under the default configuration. 2026-09-04 8.1 CVE-2026-85625 crmeb--CRMEB CRMEB contains an authentication bypass vulnerability in the verifyAuth() method of SystemRoleServices.php that returns true from both conditional branches. Sub-administrators and accounts with no roles can access restricted admin endpoints by exploiting the inert role check that always permits requests. 2026-09-03 8.3 CVE-2026-85212 crystaldba--postgres-mcp Postgres MCP Pro 0.3.0 contains a restricted-mode bypass vulnerability where function-name validation is not applied to RangeFunction nodes in FROM clauses. Attackers can execute file-reading functions like pg_read_file through FROM-clause syntax to read arbitrary files despite restricted-mode protections. 2026-09-04 8.6 CVE-2026-85620 cu--silicon A vulnerability was identified in cu silicon up to 0.1.5. Affected by this vulnerability is the function create_app of the file views.py of the component edit Endpoint. Such manipulation leads to missing authentication. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. 2026-08-31 7.3 CVE-2026-82919 Cua computer-server--Cua computer-server   Cua computer-server versions before 0.3.42 skip authentication when the CONTAINER_NAME environment variable is unset and bind to all interfaces by default, allowing unauthenticated attackers to execute arbitrary commands. Attackers can reach TCP port 8000 to run shell commands via the run_command endpoint, read and write arbitrary files through file operation endpoints, and access interactive PTY shells without authentication. 2026-09-05 9.8 CVE-2026-86121 cyanheads--git-mcp-server git-mcp-server 2.15.1 contains an argument injection vulnerability in the ref and object parameters of git_log, git_diff, and git_show tools that lack leading-dash validation. Attackers can inject git command-line options like --output= to write files outside the repository to arbitrary paths accessible by the process. 2026-09-04 7.5 CVE-2026-85626 cypht-org--cypht Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the back_query GET parameter of the logout handler. Attackers can pass a base64-encoded serialized payload through this parameter, which is decoded and passed directly to unserialize() without an allow-list, signature check, or type restriction, enabling gadget-chain exploitation to achieve remote code execution as the web server process. 2026-09-01 8.8 CVE-2026-71981 D-Link--DIR-825M A flaw has been found in D-Link DIR-825M 1.1.8. This impacts the function sub_41802C of the file /boafrm/formLtefotaUpgradeFibocom of the component LTE Module Firmware Upgrade. This manipulation of the argument fota_url causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been published and may be used. 2026-08-31 9.9 CVE-2026-82593 D-Link--DIR-825M A vulnerability was found in D-Link DIR-825M 1.1.8. Affected by this vulnerability is the function sub_456CF4 of the file /boafrm/formSysCmd of the component System Command Execution. Performing a manipulation of the argument sysCmd results in command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. 2026-08-31 7.4 CVE-2026-82595 D-Link--DNS-320 ShareCenter A vulnerability was determined in D-Link DNS-320 ShareCenter 2.06B01. This affects an unknown part of the file /cgi/file_sharing.cgi of the component File Sharing. Executing a manipulation of the argument fileurl can lead to os command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. 2026-09-03 9.1 CVE-2026-85224 D-Link--DNS-320L A vulnerability was detected in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to 20260717. Affected is an unknown function of the file /cgi-bin/isomount_mgr.cgi of the component ISO Image Handler. The manipulation of the argument upIsoRootPath results in os command injection. The attack can be executed remotely. The exploit is now public and may be used. 2026-08-31 9.9 CVE-2026-82689 D-Link--DNS-320L A vulnerability has been found in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to 20260717. Affected by this issue is some unknown functionality of the file /cgi-bin/usb_device.cgi of the component CGI Handler. Such manipulation of the argument f_ups_ip leads to os command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. 2026-08-31 9.1 CVE-2026-82691 D-Link--DNS-327L A flaw has been found in D-Link DNS-327L and DNS-340L up to 20260717. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/ve_mgr.cgi. This manipulation of the argument f_dev causes os command injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. 2026-08-31 9.1 CVE-2026-82690 D-Link--DNS-340L A security vulnerability has been detected in D-Link DNS-340L and DNS-345 1.01B04/1.03B06/1.04.B02/1.05b04. This impacts an unknown function of the file /cgi-bin/virtual_vol.cgi of the component Virtual Volume Handler. The manipulation of the argument f_sharename/f_target/f_name leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. 2026-08-31 9.1 CVE-2026-82688 D-Link--DNS-340L A vulnerability was found in D-Link DNS-340L and DNS-345 up to 20260717. This affects an unknown part of the file /cgi-bin/iscsi_mgr.cgi. Performing a manipulation of the argument alias/username/password/volume_location results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. 2026-08-31 9.9 CVE-2026-82692 D-Link--DNS-340L A vulnerability has been found in D-Link DNS-340L 1.01B04. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/addon_center.cgi of the component Add-On Center. Such manipulation of the argument f_name/f_url/f_flag/f_login_user leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. 2026-09-03 9.1 CVE-2026-85222 D-Link--DNS-340L A vulnerability was found in D-Link DNS-340L 1.01B04. Affected by this issue is some unknown functionality of the file /cgi-bin/dropbox.cgi of the component CGI Handler. Performing a manipulation of the argument callback_url/sync_interval results in os command injection. The attack can be initiated remotely. The exploit has been made public and could be used. 2026-09-03 9.9 CVE-2026-85223 D-Link--DSM-G600 A weakness has been identified in D-Link DSM-G600 1.01. This affects an unknown function of the file /load_file.cgi of the component Multipart Handler. Executing a manipulation can lead to out-of-bounds write. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. 2026-08-31 8.8 CVE-2026-82680 datalab-to--marker marker through 2.0.0 contains a path traversal vulnerability in the FastAPI /marker/upload handler that fails to sanitize the file.filename parameter. Unauthenticated attackers can supply filenames containing directory traversal sequences to write arbitrary files to any location or delete existing files on the system. 2026-09-04 9.1 CVE-2026-85684 datalab-to--surya surya 0.22.1 screenshot server contains an unauthenticated arbitrary file read vulnerability in the /info, /page, and /process routes that accept raw file_path parameters. Attackers can read any image or PDF file on the host by supplying arbitrary file paths to Image.open or pypdfium2.PdfDocument, obtaining rendered contents as base64 and using /info as an existence oracle. 2026-09-04 7.5 CVE-2026-85687 dbgate--dbgate DbGate fails to validate jslid parameters in the jsldata controller, allowing authenticated users to read and write arbitrary files via file:// scheme resolution. Attackers can exploit getJslFileName() to bypass directory containment and access sensitive files including encrypted database credentials stored in connections configuration. 2026-09-03 8.8 CVE-2026-85176 Delinea--Secret Server (On-Prem) Under specific conditions, an attacker can register an attacker-controlled FIDO2 credential against a target account and then authenticate as that user. This issue affects on-premises deployments only. 2026-09-02 9.8 CVE-2026-19117 Dell--PowerProtect Data Manager Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a stack buffer overflow vulnerability in file-level restore agent. A high privileged remote attacker could potentially exploit this vulnerability, leading to Information disclosure. 2026-09-03 7.8 CVE-2026-73600 Dell--PowerStore 500T Dell PowerStore contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with network access to the restricted management interface could potentially exploit this vulnerability to read internal system information from the appliance filesystem. This is a Critical vulnerability as it could expose sensitive information and credentials which allow full administrative access to the array. 2026-08-31 9.8 CVE-2026-58574 Dell--PowerStore 500T Dell PowerStore SDNAS contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Filesystem access. 2026-09-01 9 CVE-2026-79687 Dell--PowerStore 500T Dell PowerStore, an Incorrect Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges. 2026-09-01 8.8 CVE-2026-58566 Dell--PowerStore 500T Dell PowerStore contains an OS Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary commands with root privileges. 2026-09-01 8.8 CVE-2026-58567 Dell--PowerStore 500T Dell PowerStore contains an Inclusion of Functionality from Untrusted Control Sphere vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary code with root privileges.. 2026-09-01 8.8 CVE-2026-58569 Dell--PowerStore 500T Dell PowerStore contains an OS Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary commands with root privileges. 2026-09-01 8.8 CVE-2026-58571 Dell--PowerStore 500T Dell PowerStore contains a Code Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary code with root privileges. 2026-09-01 8.8 CVE-2026-58572 Dell--PowerStore 500T Dell PowerStore contains an Authentication Bypass by Spoofing vulnerability. An authenticated attacker could potentially exploit this vulnerability to escalate privileges to Administrator. 2026-09-01 8.8 CVE-2026-58575 Dell--PowerStore 500T Dell PowerStore contains an Incorrect Authorization vulnerability. An authenticated attacker with low privileges could potentially exploit this vulnerability to invoke administrator-only operations, leading to privilege escalation. 2026-09-01 8.8 CVE-2026-76111 Dell--PowerStore 500T Dell PowerStore contains a Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary commands with root privileges. 2026-09-01 8.8 CVE-2026-79682 Dell--PowerStore 500T Dell PowerStore contains a Protection Mechanism Failure vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to write attacker-controlled content to arbitrary filesystem paths. 2026-09-01 8.8 CVE-2026-79683 Dell--PowerStore 500T Dell PowerStore contains a Protection Mechanism Failure vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to bypass access restrictions and gain escalated privileges. 2026-09-01 8.8 CVE-2026-79684 Dell--PowerStore 500T Dell PowerStore contains a Protection Mechanism Failure vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to bypass access restrictions and gain escalated privileges. 2026-09-01 8.8 CVE-2026-79686 Developer Tools--Developer Tools The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in the bundled SWFUpload component 2026-09-02 9.8 CVE-2025-9314 devitemsllc--Support Genix Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System The Support Genix - Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 1.4.52 via the `guest_ticket_login()` function and its `p` parameter. This is due to the site-wide AES-256-CBC encryption key being derived from only three two-digit `wp_rand(10, 99)` values and a Unix timestamp via `md5()` - yielding approximately 19.5 bits of entropy - combined with a deterministic IV derived from the password, no authentication tag on the ciphertext, and no capability check, nonce, or session validation on the publicly reachable `/sgnix/?p=` endpoint. This makes it possible for authenticated attackers, with subscriber-level access and above, who can obtain a single legitimate guest ticket token as a known-plaintext oracle and bound the plugin activation timestamp, to exhaust the ~729,000-candidate keyspace entirely offline, recover the site-wide encryption key, and forge a self-consistent `{ticket_id, ticket_user}` token targeting any administrator-owned ticket. Submitting the forged token to the unprotected endpoint causes `wp_set_auth_cookie()` to be called for that administrator, granting the attacker full administrative access to the WordPress site. 2026-09-01 8.8 CVE-2026-19806 devtron-labs--devtron Devtron through 2.2.0 fails to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint, allowing authenticated users to retrieve admin API tokens. Attackers with any authenticated account can query the endpoint with arbitrary project, environment, and application parameters to retrieve plaintext super-admin JWT tokens for full platform control. 2026-08-31 8.8 CVE-2026-82882 dianping--cat CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline. Attackers can set the x-forwarded-for header to bypass IP binding validation and create admin sessions with full configuration access. 2026-09-03 9.8 CVE-2026-85181 digitalbazaar--forge node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS#1 v1.5 signature verification. Attackers can embed garbage bytes inside the DigestAlgorithm sequence to forge valid signatures for arbitrary messages using low-exponent RSA keys. This is an incomplete fix for CVE-2026-33894. 2026-09-03 7.5 CVE-2026-85393 Divi Engine--Divi Ajax Filter The Divi Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.1.2 via the 'custom_loop_template' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. This vulnerability is only exploitable when the loop_templates parameter is set to 'custom-template'. 2026-09-04 9.8 CVE-2026-11613 DocsGPT--DocsGPT In DocsGPT 0.15.0 and below, the application provides a custom prompt feature that allows users to define prompt content used during chatbot interactions. This functionality renders user-supplied prompt data using Jinja templates without input sanitization or sandboxing. An unauthenticated attacker can inject malicious template expressions, leading to a server-side template injection (SSTI) vulnerability that can be exploited to achieve full remote code execution (RCE). 2026-09-04 9.8 CVE-2026-31020 Dokploy--Dokploy A vulnerability was detected in Dokploy up to 0.29.7. This issue affects the function writeTraefikConfigInPath of the file packages/server/src/utils/traefik/application.ts of the component Settings. The manipulation of the argument path results in path traversal. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. 2026-08-31 9.9 CVE-2026-82954 domainaware--parsedmarc parsedmarc before 11.0.1 decompresses gzip and ZIP attachments in a single unbounded read with no limit on decompressed output size. Because parsedmarc automatically processes incoming DMARC report emails without user interaction, an unauthenticated remote attacker can send a crafted email with a highly compressed attachment to the monitored mailbox, causing the parsedmarc process to allocate memory proportional to the uncompressed size and exhaust available RAM. 2026-09-03 7.5 CVE-2026-82520 Dotstore--WooCommerce Product Attachment Unauthenticated Sensitive Data Exposure in WooCommerce Product Attachment = 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a different sibling plugin, and invoke it without the preHandler hook declared for that handler. The internal not-found router for encapsulated handlers dispatches malformed paths through a single shared handler pointer before URL decoding, ignoring the prefix and skipping the selected handler's normal lifecycle. An unauthenticated attacker can therefore reach an authentication-protected private fallback through an unrelated public prefix and read its full response, bypassing the authentication hook and breaking prefix encapsulation. Users should upgrade to fastify 5.12.2 or later. 2026-09-04 7.5 CVE-2026-76169 fastify--fastify fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a route's header schema before compiling it, but the transformation is incomplete: it lowercases the properties keys and the root-level required array, and does not lowercase the trigger and dependent names inside the JSON Schema Draft 7 dependencies keyword. Because Node stores request header names in lowercase, a canonical-case dependency such as requiring an authentication header whenever a privileged-mode header is present never matches, and the presence assertion is silently skipped. An unauthenticated remote client can therefore send the header that activates a privileged branch while omitting the header the dependency was meant to require, bypassing the conditional check. Users should upgrade to fastify 5.12.2 or later. 2026-09-04 7.5 CVE-2026-84428 fastify--fastify fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance. When an application assigns false to a route's body, querystring, params, or headers schema to deny all input, fastify treats it as a missing schema, compiles no validator, and runs the route handler on any request. An unauthenticated remote client can therefore reach a handler that a valid deny-all schema was intended to make unreachable, a complete validation bypass that can lead to unauthorized state changes or execution of disabled operations. Users should upgrade to fastify 5.12.2 or later. 2026-09-04 7.5 CVE-2026-84469 firecrawl--firecrawl-mcp-server firecrawl-mcp-server 3.20.2 contains an arbitrary local file read vulnerability in the firecrawl_parse tool that accepts unconstrained filePath arguments without directory containment validation. Attackers can supply absolute paths or directory traversal sequences to read sensitive files like credentials and environment variables, which are then uploaded and returned to the model context. 2026-09-04 7.5 CVE-2026-85606 FreeIPMI--FreeIPMI FreeIPMI before 1.6.19 has a stack-based buffer overflow in _ipmi_sel_oem_fujitsu_get_sel_entry_long_text in libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c via malformed Fujitsu SEL long-text responses. 2026-09-04 9.8 CVE-2026-85504 FreeIPMI--FreeIPMI ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _get_dell_system_info_idrac_info in ipmi-oem/ipmi-oem-dell.c (idrac-info subcommand to dell get-system-info). 2026-09-04 9.8 CVE-2026-85506 FreeIPMI--FreeIPMI ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_info in ipmi-oem/ipmi-oem-dell.c (cmc-info subcommand to dell get-system-info). 2026-09-04 9.8 CVE-2026-85507 FreeIPMI--FreeIPMI ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_ipv6_info in ipmi-oem/ipmi-oem-dell.c (cmc-ipv6-info subcommand to dell get-system-info). 2026-09-04 9.8 CVE-2026-85508 FreeIPMI--FreeIPMI FreeIPMI before 1.6.19 has a stack-based buffer overflow in _read_fru_data in libfreeipmi/fru/ipmi-fru.c when a BMC returns more bytes than requested. 2026-09-04 9.8 CVE-2026-85509 FreeIPMI--FreeIPMI ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer over-read in ipmi_oem_fujitsu_get_sel_entry_long_text in ipmi-oem/ipmi-oem-fujitsu.c when a BMC provides a short response, a different vulnerability than CVE-2026-50031 (which has different affected versions). 2026-09-04 7.5 CVE-2026-85505 fs-code--FS Poster - WordPress Social media Auto Poster & Scheduler [Facebook, Instagram, Twitter, Pinterest] The FS-Poster plugin for WordPress is vulnerable to Remote Code Execution in versions up to and including 8.0.1. This is due to insufficient input sanitization of the FFmpeg path parameter before passing it to the exec() function, combined with missing authorization checks on the REST API endpoints. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary commands on the underlying server. 2026-09-01 8.8 CVE-2026-10195 GastroMenum--GastroMenum Web Panel Observable response discrepancy vulnerability in GastroMenum GastroMenum Web Panel allows Account Footprinting. This issue affects GastroMenum Web Panel: before 31.08.2026. 2026-09-04 7.5 CVE-2026-19205 geonetwork--core-geonetwork GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the Saxon XSLT processor used to render formatters is configured without secure processing (`FEATURE_SECURE_PROCESSING`) and without disabling Java extension functions (`ALLOW_EXTERNAL_FUNCTIONS`). Any stylesheet loaded by GeoNetwork can therefore invoke `java.lang.Runtime.exec()` or `java.lang.ProcessBuilder` directly, achieving arbitrary command execution as the GeoNetwork process user. A user with sufficient privileges to upload a formatter can deliver a `.xsl` file containing Java extension call that execute arbitrary OS commands with the privileges of the GeoNetwork process. The issue is patched in GeoNetwork versions 4.4.12 and 4.2.17. 2026-09-03 9.1 CVE-2026-58400 geonetwork--core-geonetwork GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the API endpoint for creating a new formatter via file upload is unprotected and allows the upload of external uncontrolled files. An unauthenticated attacker can upload arbitrary `.xsl` or `.zip` formatter files to the server. An unauthenticated attacker can write arbitrary files into the GeoNetwork formatter directory. On its own this constitutes unauthorized write access to server storage. The issue is patched in GeoNetwork versions 4.4.12 and 4.2.17. 2026-09-03 8.6 CVE-2026-63219 getgrav--grav Grav before 2.0.18 (affected versions sk_protocol without validating whether 'sk' represents a full socket. Fix this issue by checking sk- >sk_state != TCP_LISTEN before inspecting sk- >sk_protocol in both bpf_tcp_gen_syncookie and bpf_tcp_check_syncookie. Since mini-sockets are never in the TCP_LISTEN state, the condition short-circuits and prevents dereferencing fullsock-specific fields. 2026-09-03 7.3 CVE-2026-80738 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: drm/log: Fix out-of-bounds read on empty message length drm_log_draw_kmsg_record() accesses s[len - 1] to strip the trailing newline, but len is unsigned int. If len is 0, the subtraction wraps to UINT_MAX, causing an out-of-bounds read. Add an early return when len is 0. 2026-09-03 7.1 CVE-2026-80741 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: mmc: loongson2: Fix sg iteration in data reorder functions In ls2k0500_mmc_reorder_cmd_data() and ls2k2000_mmc_reorder_cmd_data(), the for_each_sg() macro already iterates over the scatterlist entries, with 'sg' pointing to the current entry. However, the code incorrectly uses '&sg[i]' and 'sg_dma_len(&sg[i])' inside the loop, which treats 'sg' as an array base and indexes it again, leading to access of wrong sg entries (or out-of-bounds if the list is not an array). 2026-09-03 7.8 CVE-2026-80748 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: drm/connector/hdmi: Fix out of bounds memory read A helper function was copying a given audio infoframe into the connector's copy but using the size of the destination (a generic target, sized to accept many different data blocks) not the source (a very specific type of data block). Thus, it was copying 60 bytes of data from a 28 byte allocation. Fix that by using the source size instead, together with a build bug on the source size actually being smaller than the destination. I hit this running KUnit tests under KASAN (while debugging something else entirely). In the real world, it seems unlikely to cause an actual problem. It is a read not a write so it can't corrupt any memory. However, it could potentially fall off the end of a page and cause an accvio bug. 2026-09-03 7.1 CVE-2026-80749 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: mfg: initialize prev_o in mtk_mfg_attach_dev() mtk_mfg_attach_dev() reads prev_o on the first iteration of its loop, in "if (prev_o && prev_o- >freq == o- >freq)", before prev_o is assigned at the end of the loop body. On that first iteration, evaluating prev_o reads an indeterminate value. If it is non-NULL, the condition dereferences a stale or invalid pointer, potentially faulting or incorrectly skipping the first OPP. Initialize prev_o to NULL. This matches the intent as well: there is no previous OPP to compare against on the first iteration. Found with Clang's -Wconditional-uninitialized. 2026-09-03 7.8 CVE-2026-80751 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - fix F55 transmitter electrode count typo During F55 sensor detection, the transmitter (TX) electrode count was incorrectly assigned the value of the receiver (RX) electrode count due to copy-paste typos. This incorrect value was then propagated to the driver data and used by F54 to determine the diagnostics report size. On devices with more RX than TX electrodes, this inflated the perceived TX count, leading to incorrect report size calculations and potential out-of-bounds buffer accesses. Fix the typos by correctly assigning the TX electrode counts. 2026-09-03 7.8 CVE-2026-80754 LiquidThemes--Booking Hub Incorrect Privilege Assignment vulnerability in LiquidThemes Booking Hub allows Privilege Escalation. This issue affects Booking Hub: from n/a through 1.3.1. 2026-09-02 8.8 CVE-2026-81769 LiteSpeed Technologies--LiteSpeed Cache Unauthenticated Server Side Request Forgery (SSRF) in LiteSpeed Cache

Read more »

How to recognize and avoid phishing attacks on your Mac
Phishing attacks don’t usually try to hack your Mac. They try to trick you into giving away passwords, verification codes, payment details, or other sensitive information. A message might look like it’s from Apple, your bank, a delivery company, or even someone you know, making it difficult to tell what’s real and what’s a scam. […] The post first appeared on The Mac Security Blog.

Read more »

FBI Probes Service Selling 153M+ Drivers Licenses
A new identity theft service launched on the dark web this week is selling digital scans of more than 153 million drivers licenses from people in the United States and Canada. Based on interviews with individuals whose licenses are available for purchase on this service, it appears to be siphoning images collected by a widely-used identity verification company based in Louisiana. KrebsOnSecurity also has learned that the New Orleans field office of the Federal Bureau of Investigation (FBI) today launched an official inquiry into the source of the images.

Read more »

Two Alleged ‘TeamPCP’ Hackers Arrested in Australia
Authorities in Australia have arrested two men believed to be members of TeamPCP, a prolific cybercrime and data extortion group blamed for perpetrating the longest running spree of software supply chain attacks ever. In a statement released today, the Australian Federal Police (AFP) said two unnamed suspects from Western Australia, aged 21 and 23, were arrested in connection with a "sophisticated cybercrime syndicate that allegedly created malicious open-source software to rob thousands of global businesses." The AFP did not name the defendants, but KrebsOnSecurity learned the 21-year-old suspect's real identity in June, and has been communicating with him ever since. This story includes interviews with TeamPCP's self-described spokesperson, and examines clues left behind by the TeamPCP leader that likely led to his undoing.

Read more »

Two Alleged ‘TeamPCP’ Hackers Arrested in Australia
Authorities in Australia have arrested two men believed to be members of TeamPCP, a prolific cybercrime and data extortion group blamed for perpetrating the longest running spree of software supply chain attacks ever. In a statement released today, the Australian Federal Police (AFP) said two unnamed suspects from Western Australia, aged 21 and 23, were arrested in connection with a "sophisticated cybercrime syndicate that allegedly created malicious open-source software to rob thousands of global businesses." The AFP did not name the defendants, but KrebsOnSecurity learned the 21-year-old suspect's real identity in June, and has been communicating with him ever since. This story includes interviews with TeamPCP's self-described spokesperson, and examines clues left behind by the TeamPCP leader that likely led to his undoing.

Read more »

Who’s Tracking You? Use This New Service to Find Out
It can be daunting to determine who's responsible for showing ads on the websites we visit, or who's harvesting data from the mobile apps we use every day. That information is already semi-public, but it is not easily parsed and traditionally much of it has remained walled away in the hands of large advertising platforms. Not anymore: A powerful and free new service called DecryptAds scrapes and correlates this adtech data and makes it simple to quickly learn a great deal about the entities that are tracking you.

Read more »

Microsoft Plugs Nearly 400 Security Holes
Microsoft today released updates to remedy at least 398 security vulnerabilities in its Windows operating systems and supported software, including one weakness that is already being actively exploited and two others that were publicly detailed prior to today.

Read more »

DAC (Dhaka) on 2026-10-28
Oct 27, 15:51 UTCScheduled - We will be performing scheduled maintenance in DAC (Dhaka) datacenter between 2026-10-28 20:00 and 2026-10-29 00:00 UTC. Traffic might be re-routed from this location, hence there is a possibility of a slight increase in latency during this maintenance window for end-users in the affected region. For PNI / CNI customers connecting with us in this location, please make sure you are expecting this traffic to fail over elsewhere during this maintenance window as network interfaces in this datacentre may become temporarily unavailable. You can now subscribe to these notifications via Cloudflare dashboard and receive these updates directly via email, PagerDuty and webhooks (based on your plan): https://developers.cloudflare.com/notifications/notification-available/#cloudflare-status.

Read more »

MNL (Manila) on 2026-10-28
Oct 27, 15:51 UTCScheduled - We will be performing scheduled maintenance in MNL (Manila) datacenter on 2026-10-28 between 18:00 and 22:00 UTC. Traffic might be re-routed from this location, hence there is a possibility of a slight increase in latency during this maintenance window for end-users in the affected region. For PNI / CNI customers connecting with us in this location, please make sure you are expecting this traffic to fail over elsewhere during this maintenance window as network interfaces in this datacentre may become temporarily unavailable. You can now subscribe to these notifications via Cloudflare dashboard and receive these updates directly via email, PagerDuty and webhooks (based on your plan): https://developers.cloudflare.com/notifications/notification-available/#cloudflare-status.

Read more »

HKG (Hong Kong) on 2026-10-28
Oct 27, 15:51 UTCScheduled - We will be performing scheduled maintenance in HKG (Hong Kong) datacenter on 2026-10-28 between 18:00 and 22:00 UTC. Traffic might be re-routed from this location, hence there is a possibility of a slight increase in latency during this maintenance window for end-users in the affected region. For PNI / CNI customers connecting with us in this location, please make sure you are expecting this traffic to fail over elsewhere during this maintenance window as network interfaces in this datacentre may become temporarily unavailable. You can now subscribe to these notifications via Cloudflare dashboard and receive these updates directly via email, PagerDuty and webhooks (based on your plan): https://developers.cloudflare.com/notifications/notification-available/#cloudflare-status.

Read more »

MSP (Minneapolis) on 2026-10-30
Oct 27, 14:20 UTCScheduled - We will be performing scheduled maintenance in MSP (Minneapolis) datacenter on 2026-10-30 between 07:30 and 09:30 UTC. Traffic might be re-routed from this location, hence there is a possibility of a slight increase in latency during this maintenance window for end-users in the affected region. For PNI / CNI customers connecting with us in this location, please make sure you are expecting this traffic to fail over elsewhere during this maintenance window as network interfaces in this datacentre may become temporarily unavailable. You can now subscribe to these notifications via Cloudflare dashboard and receive these updates directly via email, PagerDuty and webhooks (based on your plan): https://developers.cloudflare.com/notifications/notification-available/#cloudflare-status.

Read more »

Russia SMS Carrier Maintenance – Beeline
THIS IS A SCHEDULED EVENT Oct 28, 13:00 - 17:00 PDT Oct 27, 05:14 PDT Scheduled - The Beeline network in Russia is conducting a planned maintenance from 28 October 2026 at 13:00 PDT until 28 October 2026 at 17:00 PDT. During the maintenance window, there could be intermittent delays delivering SMS to Beeline Russia handsets.

Read more »

Russia SMS Carrier Maintenance – Sberbank Mobile
THIS IS A SCHEDULED EVENT Oct 28, 14:00 - 18:00 PDT Oct 26, 23:42 PDT Scheduled - The Sberbank Mobile network in Russia is conducting a planned maintenance from 28 October 2026 at 14:00 PDT until 28 October 2026 at 18:00 PDT. During the maintenance window, there could be intermittent delays delivering SMS to Sberbank Mobile Russia handsets.

Read more »

ATL (Atlanta) on 2026-10-30
Oct 27, 04:41 UTCScheduled - We will be performing scheduled maintenance in ATL (Atlanta) datacenter on 2026-10-30 between 05:00 and 10:00 UTC. Traffic might be re-routed from this location, hence there is a possibility of a slight increase in latency during this maintenance window for end-users in the affected region. For PNI / CNI customers connecting with us in this location, please make sure you are expecting this traffic to fail over elsewhere during this maintenance window as network interfaces in this datacentre may become temporarily unavailable. You can now subscribe to these notifications via Cloudflare dashboard and receive these updates directly via email, PagerDuty and webhooks (based on your plan): https://developers.cloudflare.com/notifications/notification-available/#cloudflare-status.

Read more »

Mexico SMS Carrier Partner Maintenance
THIS IS A SCHEDULED EVENT Oct 27, 23:00 PDT  -  Oct 28, 01:00 PDT Oct 26, 18:50 PDT Scheduled - Our SMS carrier partner in Mexico is conducting a planned maintenance from 27 October 2026 at 23:00 PDT until 28 October 2026 at 01:00 PDT. During the maintenance window, there could be intermittent delays delivering SMS to and from Mexico handsets.

Read more »

Mail Settings Maintenance
THIS IS A SCHEDULED EVENT Nov 4, 14:00 - 16:00 PST Oct 26, 16:45 PDT Scheduled - In order to increase the stability and scalability of our systems, we are performing maintenance on our infrastructure on November 4, 2026 from 14:00 until 16:00 PST. During this time customers may be temporarily unable to manage Mail Settings (Address Allow List, Bounce Purge, Event Notification, Footer, Forward Bounce, Forward Spam or Legacy Email Template) or related Tracking Settings, Event Webhook and Inbound Parse settings. Reading existing settings will function as normally. This maintenance does not impact mail send. Thank you for your patience through this maintenance.

Read more »

AUS (Austin) on 2026-10-28
Oct 26, 23:20 UTCScheduled - We will be performing scheduled maintenance in AUS (Austin) datacenter on 2026-10-28 between 15:00 and 19:00 UTC. Traffic might be re-routed from this location, hence there is a possibility of a slight increase in latency during this maintenance window for end-users in the affected region. For PNI / CNI customers connecting with us in this location, please make sure you are expecting this traffic to fail over elsewhere during this maintenance window as network interfaces in this datacentre may become temporarily unavailable. You can now subscribe to these notifications via Cloudflare dashboard and receive these updates directly via email, PagerDuty and webhooks (based on your plan): https://developers.cloudflare.com/notifications/notification-available/#cloudflare-status.

Read more »

United States SMS and MMS Carrier Partner Maintenance
THIS IS A SCHEDULED EVENT Oct 28, 21:00 PDT  -  Oct 29, 01:00 PDT Oct 26, 16:08 PDT Scheduled - Our SMS and MMS carrier partner in the United States is conducting a planned maintenance from 28 October 2026 at 21:00 PDT until 29 October 2026 at 01:00 PDT. During the maintenance window, there could be intermittent delays delivering SMS and MMS to and from United States handsets via subset of United States short codes.

Read more »

Russia SMS Carrier Maintenance – MTS
THIS IS A SCHEDULED EVENT Oct 27, 20:00 - 21:30 PDT Oct 26, 11:41 PDT Scheduled - The MTS network in Russia is conducting a planned maintenance from 27 October 2026 at 20:00 PDT until 27 October 2026 at 21:30 PDT. During the maintenance window, there could be intermittent delays delivering SMS to MTS Russia handsets.

Read more »

South Sudan SMS Carrier Maintenance – MTN
THIS IS A SCHEDULED EVENT Oct 27, 15:00 - 20:00 PDT Oct 26, 10:12 PDT Scheduled - The MTN network in South Sudan is conducting a planned maintenance from 27 October 2026 at 15:00 PDT until 27 October 2026 at 20:00 PDT. During the maintenance window, there could be intermittent delays delivering SMS to MTN South Sudan handsets.

Read more »

AMS (Amsterdam) on 2026-10-30
Oct 26, 16:59 UTCScheduled - We will be performing scheduled maintenance in AMS (Amsterdam) datacenter on 2026-10-30 between 01:00 and 03:45 UTC. Traffic might be re-routed from this location, hence there is a possibility of a slight increase in latency during this maintenance window for end-users in the affected region. For PNI / CNI customers connecting with us in this location, please make sure you are expecting this traffic to fail over elsewhere during this maintenance window as network interfaces in this datacentre may become temporarily unavailable. You can now subscribe to these notifications via Cloudflare dashboard and receive these updates directly via email, PagerDuty and webhooks (based on your plan): https://developers.cloudflare.com/notifications/notification-available/#cloudflare-status.

Read more »

ATH (Athens) on 2026-10-28
Oct 26, 13:00 UTCScheduled - We will be performing scheduled maintenance in ATH (Athens) datacenter on 2026-10-28 between 01:00 and 03:45 UTC. Traffic might be re-routed from this location, hence there is a possibility of a slight increase in latency during this maintenance window for end-users in the affected region. For PNI / CNI customers connecting with us in this location, please make sure you are expecting this traffic to fail over elsewhere during this maintenance window as network interfaces in this datacentre may become temporarily unavailable. You can now subscribe to these notifications via Cloudflare dashboard and receive these updates directly via email, PagerDuty and webhooks (based on your plan): https://developers.cloudflare.com/notifications/notification-available/#cloudflare-status.

Read more »

Refurbished 24-inch iMac Apple M4 Chip with 10-Core CPU and 10-Core GPU, Gigabit Ethernet, Nano-texture glass – Blue – G1K57LL/A – $1,949.00
Refurbished 24-inch iMac Apple M4 Chip with 10-Core CPU and 10-Core GPU, Gigabit Ethernet, Nano-texture glass - Blue – G1K57LL/A $1,949.00 Originally released October 2024 24-inch 4.5K Retina display 24GB unified memory 512GB SSD 12MP Center Stage camera with support for Desk View Four Thunderbolt 4 ports Gigabit Ethernet Product page on the Apple Store…

Read more »

Refurbished 24-inch iMac Apple M4 Chip with 10-Core CPU and 10-Core GPU, Gigabit Ethernet, Nano-texture glass – Green – G1EN2LL/A – $1,779.00
Refurbished 24-inch iMac Apple M4 Chip with 10-Core CPU and 10-Core GPU, Gigabit Ethernet, Nano-texture glass - Green – G1EN2LL/A $1,779.00 Originally released October 2024 24-inch 4.5K Retina display 16GB unified memory 512GB SSD 12MP Center Stage camera with support for Desk View Four Thunderbolt 4 ports Gigabit Ethernet Product page on the Apple Store…

Read more »

Refurbished 24-inch iMac Apple M4 Chip with 10-Core CPU and 10-Core GPU, Gigabit Ethernet- Green – G1K34LL/A – $1,949.00
Refurbished 24-inch iMac Apple M4 Chip with 10-Core CPU and 10-Core GPU, Gigabit Ethernet- Green – G1K34LL/A $1,949.00 Originally released October 2024 24-inch 4.5K Retina display 32GB unified memory 512GB SSD 12MP Center Stage camera with support for Desk View Four Thunderbolt 4 ports Gigabit Ethernet Product page on the Apple Store…

Read more »

Refurbished 24-inch iMac Apple M4 Chip with 10-Core CPU and 10-Core GPU, Gigabit Ethernet- Green – G1EN0LL/A – $1,859.00
Refurbished 24-inch iMac Apple M4 Chip with 10-Core CPU and 10-Core GPU, Gigabit Ethernet- Green – G1EN0LL/A $1,859.00 Originally released October 2024 24-inch 4.5K Retina display 16GB unified memory 1TB SSD 12MP Center Stage camera with support for Desk View Four Thunderbolt 4 ports Gigabit Ethernet Product page on the Apple Store…

Read more »

Apple Mac Studio M5 Max Desktop Computer (2026) for $2,299 + free shipping
This Mac Studio with the M5 Max chip is $200 off its regular price of $2,499 at Amazon, and it matches the lowest price it has tracked there. Buy Now at Amazon Features Apple M5 Max chip with next-generation CPU and GPU 36GB unified memory Four Thunderbolt 5 ports, two USB-C, two USB-A, HDMI, SDXC card slot, and headphone jack Supports up to five external displays Wi-Fi 7 and Bluetooth 6 connectivity

Read more »

Apple Mac mini w/ M6 (2026) for $779 + free shipping
This Mac mini with the new M6 chip is $120 off and the best price we've seen for it. Buy Now at Amazon

Read more »

Apple MacBook M5 Deals at Best Buy: U to $500 off + free shipping
Best Buy takes up to $500 off several Apple MacBook M5 models, including the MacBook Air 13" at $1,149, down from $1,299, and the MacBook Pro 16" with M5 Max chip at $3,499, down from $4,399. The lineup spans MacBook Air and MacBook Pro configurations with a range of memory and storage options. My Best Buy members get free shipping on all orders, and it's free to join. Shop Now at Best Buy

Read more »

Refurb Apple Outlet at Best Buy: Up to 81% off + free shipping
Best Buy’s refurbished outlet includes a range of graded, refurbished Apple devices, from iPads and iPhones to AirPods and MacBooks. A refurbished 10.2″ iPad is priced at $184.97, down from its $299.99, while refurbished iPhones span multiple generations and condition levels. Pricing varies by device, storage, and condition grade. Shipping is free on all of […]

Read more »

Apple iPad Magic Keyboard Cases at Woot for From $129, extra $15 off for new users + free shipping w/ Prime
Woot is discounting Apple Magic Keyboard cases for several iPad Pro and iPad Air models, with prices starting at $129. If you're a new customer, you can use the promo code "WELCOME15" to cut an extra $15 off these prices. The lineup includes cases for the 11" and 13" iPad Pro with prices down from as much as $349. Each case is built for a specific iPad model and adds a trackpad and backlit keyboard to the tablet. This deal ends November 13. The new customer coupon ends on October 25. Buy Now at Woot! An Amazon Company

Read more »

MightySkins Apple Magic Keyboard for iPad Pro 11-inch (M4) Vinyl Skin for $25 + free shipping w/ Prime
Anyone who's tired of their keyboard case looking like every other one on the market will appreciate the quick personalization this vinyl skin offers, and it's thin enough that it won't interfere with the keys or trackpad function. Buy Now at Amazon Features Customizable designs for personalized device style Refined matte finish aesthetic Durable stain-resistant 3M vinyl protection Residue-free application and removal Proudly manufactured in the USA

Read more »

Apple Outlet Deals at Best Buy: Up to 65% off + free shipping
Best Buy's Outlet section includes a wide range of Apple products across refurbished, open-box, clearance, and pre-owned conditions. Deals include a Geek Squad Certified Refurbished iPads start at just $125, while MacBook Air laptops, iPhones, AirPods, and other accessories are highly-discounted. Shipping is free on everything for My Best Buy members, too (it's free to join). Shop Now at Best Buy Features Includes Geek Squad Certified Refurbished iPads, MacBooks, Apple Watches, and AirPods Open-box, clearance, refurbished, and pre-owned condition options available iPad mini models available with 64GB to 256GB storage MacBook Air options with Apple M1 or M2 chip and 256GB SSD Apple Watch Series 6 and Watch Ultra models included

Read more »

Apple iPad 6th Generation 32GB Wi-Fi for $78 + free shipping
Students and casual users looking for a basic tablet for browsing, streaming, and note-taking will get solid mileage out of this one, especially since it still supports the Apple Pencil for jotting things down. Walmart's pricing on this older model makes it a budget-friendly way into Apple's ecosystem without paying for features you may not need. Buy Now at Walmart Features Space Gray finish Wireless Wi-Fi connectivity Integrated Touch ID security

Read more »

Logitech Flip Folio Keyboard Case for iPad Pro and iPad Air for $180
Worth a look if you type a lot on your iPad, since the case doubles as a keyboard and stand so you're not propping the tablet up separately. Newegg has it for a good deal less than you'd typically pay for a combined case-and-keyboard setup. Buy Now at Newegg Features Compatible with iPad Pro M4, M5, Air M2, M3, M4 Stowable keyboard design for portability Protective case for tablet security Multi-device wireless connectivity Model: 920-013367

Read more »

Logitech Flip Folio Keyboard Case for iPad Pro and iPad Air for $180
Worth a look if you type a lot on your iPad, since the case doubles as a keyboard and stand so you're not propping the tablet up separately. Newegg has it for a good deal less than you'd typically pay for a combined case-and-keyboard setup. Buy Now at Newegg Features Compatible with iPad Pro M4, M5, Air M2, M3, M4 Stowable keyboard design for portability Protective case for tablet security Multi-device wireless connectivity Model: 920-013367

Read more »

Logitech Flip Folio Keyboard Case for iPad Pro and iPad Air for $180
Worth a look if you type a lot on your iPad, since the case doubles as a keyboard and stand so you're not propping the tablet up separately. Newegg has it for a good deal less than you'd typically pay for a combined case-and-keyboard setup. Buy Now at Newegg Features Compatible with iPad Pro M4, M5, Air M2, M3, M4 Stowable keyboard design for portability Protective case for tablet security Multi-device wireless connectivity Model: 920-013367

Read more »