Apple's Biggest Summer Deals Drop: AirPods Max 2 Plummet to $429, M4 iPad Air $100 Off
This week, Best Buy kicked off its big 60th anniversary sale that includes great deals on AirPods, TVs, computers, and much more. Alongside this event, we're tracking solid markdowns on portable power stations from Anker and Jackery, plus the best prices of the summer on M4 iPad Air. Note: MacRumors is an affiliate partner with some of these vendors. When you click a link and make a purchase, we may receive a small payment, which helps us keep the site running. Best Buy Anniversary What's the deal? Save sitewide during Best Buy's 60th Anniversary Sale Where can I get it? Best Buy Where can I find the original deal? Right here SITEWIDE SALEBest Buy 60th Anniversary Sale Best Buy is hosting its big 60th Anniversary sale this week, with notable markdowns on Apple devices, TVs, headphones, monitors, and much more. This event is set to last for the rest of this week, and you don't need to be a My Best Buy Plus or Total member to see most of the deals. Portable Power Stations What's the deal? Take up to $1,500 off Anker and Jackery portable power stations Where can I get it? Amazon and Jackery Where can I find the original deal? Right here UP TO 46% OFFAnker SOLIX Sale UP TO $1,500 OFFJackery Home Backup Sale Anker and Jackery have introduced big discounts across their most popular portable power stations this week, including up to $1,500 off select models from each company. We're tracking Anker's best deals over at Amazon, while Jackery's discounts can be found on the retailer's own website. AirPods What's the deal? Take $120 off AirPods Max 2, $59 off AirPods Pro 3, and more Where can I get it? Amazon Where can I find the original deal? Right here $59 OFFAirPods Pro 3 for $189.99 $120 OFFAirPods Max 2 for $429.00 Amazon this week had a big collection of discounts across the AirPods lineup, highlighted by the AirPods Max 2 for $429.00, down from $549.00. This is now the best price we've seen on the AirPods Max 2 since Prime Day, and one of the overall best prices we've tracked so far in 2026, and it's accompanied by a solid deal on the AirPods Pro 3. iPad Air What's the deal? Take $100 off M4 iPad Air Where can I get it? Amazon and Best Buy Where can I find the original deal? Right here $100 OFF11-inch M4 iPad Air for $649.00 $100 OFF13-inch M4 iPad Air for $849.00 Amazon and Best Buy this week have multiple discounts on the M4 iPad Air, providing $100 off these 2026 models. These are the best prices we've seen in the wake of Apple's summer price hikes. AirTag What's the deal? Take up to $10 off AirTag 2 Where can I get it? Amazon Where can I find the original deal? Right here $5 OFFAirTag 2 (1-Pack) for $24.00 $10 OFFAirTag 2 (4-Pack) for $89.00 Apple's AirTag 2 is on sale for $89.00 this week on Amazon, down from $99.00. This deal is on the 4-Pack of the AirTag 2, and it's a match of the record low price first seen during Prime Day. If you're on the hunt for more discounts, be sure to visit our Apple Deals roundup where we recap the best Apple-related bargains of the past week. Deals Newsletter Interested in hearing more about the best deals you can find in 2026? Sign up for our Deals Newsletter and we'll keep you updated so you don't miss the biggest deals of the season! Related Roundup: Apple DealsThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

Top Stories: Apple Leaks – Camera-Equipped AirPods, Beats 360, and More
It was a big week for leaks in the Apple world, with Apple itself revealing information on a bunch of upcoming products within a macOS Tahoe 26.7 build and retailers leaking details on new Beats 360 headphones that could be launching soon. In addition to all of the scoops from Apple's leaks, we also took a look at 30 new things you'll be able to do with iOS 27 when it drops next month (or sooner if you're willing to try the beta), so read on below for all of the details! Top Stories Apple's Camera-Equipped AirPods Confirmed: See Them in Action Apple is working on camera-equipped AirPods that are nearly ready to launch, based on a video MacRumors found in the macOS Tahoe 26.7 release candidate. In a short demo, a man holds a book up so the camera in the AirPods can see the title. "With Visual Intelligence, your world becomes savable. See something you like? Just ask me to save it for later," says the voiceover text. Despite the video, Bloomberg's Mark Gurman now says the AirPods won't be launching until next year. macOS Tahoe 26.7 is Full of References to Unreleased Apple Products The camera-equipped AirPods weren't the only upcoming product to leak in the macOS Tahoe 26.7 release candidate that was seeded this week. Over 20 other devices and several previously unknown details were discovered in the update, including upcoming Mac, iPhone, and iPad models, as well as several products for Apple's home-focused ecosystem that we're expecting to expand now that Siri AI is nearly ready to launch to the public. Next Apple TV Rumored to Have Five New Features, Including Siri AI Among the upcoming products discovered in macOS Tahoe 26.7 is a new Apple TV remote, and while it's unclear what changes we can expect for the accessory, it should arrive alongside an updated Apple TV box. The new Apple TV should come with an A17 Pro chip or newer, and it appears it will support Siri AI. The box should also come with increased RAM for the Siri AI capabilities, and it's likely to feature Apple's N1 wireless networking chip. Apple's Home Hub Will Have a Widget Gallery With iPhone Widget Support One of the more intriguing products leaked in macOS Tahoe 26.7 is the long-rumored home hub device, and code from the update indicates that the device will feature a Widget Gallery to allow users to access content from various apps. All users in the home will be able to see the widgets installed on the home hub, but content in widgets will only be visible when the primary linked device is in the home for privacy protection. The device will also feature a Smart Stack similar to that found on watchOS, which rotates through a variety of widgets and automatically displays the most relevant one at any given time based on time of day, usage habits, and other criteria. 30 New Things Your iPhone Can Do in iOS 27 Apple will release iOS 27 in September, and despite the company's focus this year on refining its flagship operating system and nixing bugs, there are still many additional features on the way, not least of which is Apple's new context-aware Siri, re-tooled for the generative AI era. This year's major iPhone software update isn't all about AI, though, and we've put together an overview of 30 new things you'll be able to do with the upcoming update. Beats 360 Over-Ear Headphones Leak in Retail Listings Apple's Beats brand has been teasing some upcoming over-ear headphones over the past few months, and now retail listings appear to have spilled most of the details. The upcoming Beats 360 headphones will have interchangeable ear cushions and headband cushions with both Performance Knit and UltraPlush materials available, while the headphones will be available in Pink, Black, Cloud, and Sky colors with cushion kits available in additional shades such as Navy and Volt. Beats 360 will be the first sweat- and water-resistant over-ear headphones from Beats, and they feature 1.75× better noise cancellation than the current Beats Studio Pro. MacRumors Newsletter Each week, we publish an email newsletter like this highlighting the top Apple stories, making it a great way to get a bite-sized recap of the week hitting all of the major topics we've covered and tying together related stories for a big-picture view. So if you want to have top stories like the above recap delivered to your email inbox each week, subscribe to our newsletter!Tag: Top StoriesThis article, "Top Stories: Apple Leaks - Camera-Equipped AirPods, Beats 360, and More" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

Apple Vision Pro Was Almost Called 'Reality Pro'
The Vision Pro headset was internally called "Reality Pro" for a significant stretch of its development before Apple settled on the name it ultimately shipped with, according to the prototype collector and leaker known as "Kosutami." In a post on X, Kosutami wrote that the "Apple Vision Pro was originally called Reality Pro" during the early stages of development, pointing to an internal string, "realityprorealityosdev." The Reality Pro name is not new information. Bloomberg's Mark Gurman reported in September 2022 that Apple's first headset would likely launch as "Apple Reality Pro." In August 2022, trademark filings for "Reality One," "Reality Pro," and "Reality Processor" surfaced in the United States and several other countries, filed through a shell company called Immersive Health Solutions LLC, a tactic Apple has used before to keep upcoming product names under wraps. Those filings followed an earlier trademark application for "realityOS" dated December 2021 and filed by another apparent shell company, Realityo Systems LLC, after developers had already spotted realityOS references inside Apple's own software and App Store upload logs. By mid-2023, additional trademark activity surfaced for terms like "xrOS," "xrProOS," "realityproOS," and "realOS." Apple ultimately unveiled the headset as the Vision Pro at WWDC 2023, seemingly dropping the Reality branding entirely for both the device and its operating system, which shipped as visionOS. The switch came late enough in development that traces of the old naming, like the string Kosutami highlights, persisted in internal builds and software. Apple reportedly retains trademark rights to "Reality Pro" and "Reality One," which could matter in China, where Huawei holds a ten year license to the Vision Pro trademark until 2031. Gurman said that Apple could fall back on Reality Pro branding in markets where Vision Pro is unavailable as a trademark. Vision Pro launched in the U.S. in February 2024 at $3,499. Apple this week laid off around 100 members of its Vision Products Group and largely shut down its Vision Pro gaming and immersive video teams. The cuts follow reports that Apple has effectively shelved the product line, having already canceled both a redesigned Vision Pro 2 and the cheaper "Vision Air" as the company's attention shifts to smart glasses instead.Related Roundup: Apple Vision ProTag: KosutamiBuyer's Guide: Vision Pro (Neutral)Related Forum: Apple Vision ProThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

10 Ways to Improve Your iPhone's Battery Life
When you're at home or work with regular access to an iPhone charger, you probably don't need to worry much about your iPhone's battery. On days when you're away from home for long stretches, you might want to make some adjustments to extend battery life. We've rounded up 10 tips that can cut down on battery drain. 1. Turn on Adaptive Power The best way to preserve battery life is to make sure you have Adaptive Power turned on. It's an iOS 26 feature that's available on Apple Intelligence iPhones. It uses on-device intelligence to analyze usage patterns and determine when you might need extra power. It saves battery by lowering screen brightness a bit, adjusting performance, and limiting background activity. It also turns on Low Power Mode automatically when your battery hits 20 percent. If you have an iPhone 17, iPhone 17 Pro, ‌iPhone 17 Pro‌ Max, or iPhone Air, Adaptive Power is on by default, but you need to turn it on with other models. Adaptive Power can be activated on eligible iPhones in Settings & Battery & Power Mode. 2. Set Up Automations for Low Power Mode Turning on Low Power Mode is the most obvious way to extend battery life on your iPhone, and you can automate it so it turns on at a set battery percentage. Apple will prompt you to turn on Low Power Mode when your battery is at 20 percent, but it's helpful to turn it on earlier. To set up a Low Power Mode shortcut, open up the Shortcuts app, and create a new Automation. With iOS 27, you can just type in what you want the automation to do, but in ‌iOS 26‌, search for Battery Level, choose a target battery percentage, then add Low Power Mode as the action to turn on when your battery hits that level. 3. Turn Off the Always-On Display Your iPhone's Always-On Display leaves the time, wallpaper, widgets, and Live Activities visible on the Lock Screen even when your iPhone is locked. The setting preserves battery by doing things like turning off the display when a connected Apple Watch is no longer nearby (signaling that the iPhone owner is out of the room) or the iPhone is in a pocket, but Always-On Display still drains battery faster than no Always-On Display. You can turn off the Always-On Display by following these steps: Open up the Settings app. Tap on Display & Brightness. Tap on Always-On Display. Toggle off Always-On Display. You can also customize the Always-On Display if you don't want to turn it off entirely. You can disable wallpapers or turn off notifications. 4. Limit Frame Rate Some iPhones have a 120Hz ProMotion refresh rate, but dropping it down to 60Hz can eke out a bit more battery life. You can adjust frame rate by using an Accessibility setting. Open up the Accessibility section of the Settings app. Tap on Motion. Toggle on Limit Frame Rate. ProMotion is available on all ‌iPhone 17‌ models, the ‌iPhone Air‌, and Pro versions of earlier iPhones dating back to the iPhone 13 Pro. 5. Turn on Dark Mode On OLED iPhone displays, activating Dark Mode preserves battery life because there's less power draw when darker-colored pixels are displayed. Activating ‌Dark Mode‌ when outside on a sunny day can preserve a good amount of battery life. Lower levels of brightness in Light Mode use the same battery as higher levels of brightness in ‌Dark Mode‌, so ‌Dark Mode‌ can save battery even with brightness turned up when you're in a sunny location. When you're somewhere that has dimmer lighting and screen brightness is lower, turning on ‌Dark Mode‌ won't save as much battery life, but it still draws a little less power. 6. Audit Apps With Location Access It's a good idea to regularly check your privacy and access settings to make sure apps and services aren't doing things you don't want them to be doing. Limiting the apps that have access to your location and how often apps can access that data can save battery life. Open up the Settings app. Choose Privacy & Security. Tap Location Services. Review the list and edit settings by tapping on the name of each app in the list. You have four possible choices for location settings for each app, though not all four choices will always be available for every app depending on what it does. You can select the following: Never, Ask Next Time Or When I Share, While Using the App, and Always. Never will prevent an app from ever accessing your location, and unless there's a real need for an app to know where you are, such as a mapping app, setting location access to Never is the best choice. Ask Next Time Or When I Share will prompt an app to ask you with a pop-up the next time that it wants your location, so you can temporarily approve it. With this setting, location access is off until expressly allowed via the pop-up. While Using the App lets an app access your location when the app is open and being actively used. If you close the app or switch over to another app, location access ends. Always allows an app to have access to your location at all times, regardless of whether it's open or closed. This will cause the most battery drain and should be limited to only the apps that you need the most. Many apps that don't need location information will ask for your location information. A banking app may want location access to show nearby ATMs, and a social media app like Facebook may want to serve you location-based features. Clearing the cruft will ensure no apps are accessing your location without express permission, and it'll save battery life at the same time. You can also turn off Location Services entirely, but it's not ideal because it can impact apps you rely on, like Maps. 7. Rein in Background App Refresh Most apps use background refresh to update even when they're not open. Limiting background activity to just the apps that need it is a classic way to cut down on battery usage. It's also another one of the privacy-related options that's just good to check regularly. You can turn off Background App Refresh entirely or choose which apps can refresh in the background. Open the Settings app. Select General. Tap on Background App Refresh. From there, you can tap on the Background App Refresh option to turn it off altogether or choose to have it activate only when connected to Wi-Fi, which doesn't drain battery as much as downloading over cellular. 8. Limit Live Activities and Notifications Incoming notifications wake your screen, and Live Activities keep the Lock Screen updated constantly. Limiting the apps that can send you notifications and Live Activities saves battery life. Under Settings & Notifications, go through the list and turn off notifications for apps you don't need to hear from. After that, you can further refine with Focus modes. Focus modes let you choose which apps and people can send you notifications and when. Open the Settings app. Scroll down to Focus and tap it. Tap on the "+" button. Follow the instructions to choose a Focus mode and the apps you want to use with it. During work hours, you can make sure you're only getting work notifications, and during personal time, you can limit work notifications. You can set up Focus modes for all kinds of situations, from driving to workouts to sleep. You'll still get all of your notifications, but silently. Turning off unwanted notifications from apps is still the best method for saving battery life, but Focus lets you keep your notifications while still cutting down on the number that you receive at any given time. Scheduled Summary is another way to limit your notifications because you can have non-urgent alerts sent at a scheduled time. You can toggle on Scheduled Summary for apps in the Notifications section of the Settings app, where you can choose which apps should have their notifications included in Scheduled Summary and when you want them delivered. 9. Turn Off Keyboard Haptics Haptic feedback on the iPhone's keyboard is satisfying to feel when you tap on the on-screen keys, but it can drain your battery. You can turn it off by going to Settings & Sounds & Haptics & Keyboard Feedback and toggling off Haptic. 10. Monitor Your Battery Usage and Adjust In ‌iOS 26‌, Apple made it easier to see which of your apps are draining the most battery. The top of the Battery interface has an overview of your current battery level and the time that you last charged. If your iPhone is charging, it also lets you know how much time you have left until the battery is full. There is a weekly view of average battery use along with how much battery you're currently using compared to your typical average. The comparison tells you if you're using more, the same, or less battery life than you do on most days. It shows which apps used more battery and by how much, which makes it easier to tell what's draining your battery. It also displays why an app used more battery, such as background app refresh or an excessive number of notifications. Apps draining a lot of battery are shown in orange so they stand out, and that's where it's best to make adjustments.This article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

Apple's Camera-Equipped AirPods: All the New Rumors
Apple is working on AirPods that have cameras for feeding data to Siri. The new earbuds will be Apple's first AI wearable, and they're expected to launch sometime in 2027. Leaked Video Apple accidentally left a demo video featuring its rumored camera-equipped AirPods in macOS Tahoe 26.7 in mid-August. In the demo, a man holds up a book so the cameras in the AirPods can see the title. "With Visual Intelligence, your world becomes savable. See something you like? Just ask me to save it for later," says the voiceover.   Here is your first look at AirPods with Cameras in action using Visual Intelligence. This video file came from macOS 26.7 RC pic.twitter.com/yo7RI4MCeu — Aaron (@aaronp613) August 18, 2026 The cameras on the AirPods will feed information to ‌Visual Intelligence‌, and ‌Siri‌ will be able to answer questions about the wearer's surroundings and log information. There is a direct reference to setting up ‌Visual Intelligence‌ on the AirPods. If hair is covering the AirPods up, you'll receive an alert. "To get the most accurate information about things in your environment, make sure AirPods are not covered," it says. Two Versions Rumors about camera-equipped AirPods have been a little confusing. Most of the rumors about the AirPods with cameras were about a product with the codename B798. In June, Gurman said the camera AirPods had been delayed because of issues with ‌Siri‌ AI, and would not launch until September 2027 alongside the 20th anniversary iPhone. In early August, Gurman revised his launch timing and said Apple was close to debuting camera AirPods with the codename B790. The B790 AirPods had apparently been progressing alongside the B798 model, and Gurman said the company "famously creates competing versions of the same product internally," with B790 closer to launch than B798. Then in mid-August, multiple references to the B790 version were spotted in ‌macOS Tahoe‌ 26.7. After B790 was discovered, Gurman claimed the AirPods were no longer on Apple's release schedule, and Apple has no plans to release camera-equipped AirPods before 2027. Gurman said B790 is a version of the AirPods Pro 3 with cameras, while B798 is a future AirPods Pro model with cameras. Design The AirPods will look similar to the current ‌AirPods Pro 3‌, but with cameras embedded in the stem. Apple may include a light that will come on when visual data from the AirPods is being sent to the cloud. The LED will let people around the wearer know the cameras are in use. Size, design, and fit are expected to remain largely the same for the earbuds and the charging case, with the exception of the changes to the stem. Features The cameras in the AirPods will be used for sending data about the wearer's surroundings to ‌Siri‌, giving ‌Siri‌ more information about where the user is and what's nearby. ‌Siri‌ will be able to answer questions about objects or whatever the wearer happens to be looking at. The camera-equipped AirPods could be useful for more exact turn-by-turn directions when walking, contextual reminders, 3D mapping, and more. The iPhone already has ‌Visual Intelligence‌, which uses AI to identify plants, animals, landmarks, art, books, and more. Camera-equipped AirPods will be able to supply data for ‌Visual Intelligence‌ without the need to use the Camera app. H3 Chip Apple is working on an upgraded H3 chip and it could make its first appearance in the camera-equipped AirPods. The H3 chip is expected to bring latency improvements and better audio quality. Technical Details Code in ‌macOS Tahoe‌ 26.7 shows how the cameras in the AirPods will work. Of note, there's no mention of an infrared sensor, despite rumors suggesting there would be one. Two cameras - There are individual camera sensors in both the left and right earbuds. Paired color images - The cameras take synchronized RGB still images of up to 1 megapixel, each with the same frame ID. The cameras give ‌Visual Intelligence‌ a look at the same scene from two angles. No video - The cameras can take a series of pictures for ‌Visual Intelligence‌, but there is no video recording option. Resolution - There's an "active" mode that's likely triggered when the wearer activates ‌Siri‌ where the AirPods capture a 640x640 image. In a separate passive mode, they capture a 320x320 image. The sensors are capable of higher-quality images, but Apple appears to be capturing a specific image size. Passive image capture - Passive capture mode appears to be for background environmental awareness, triggered by nearby speech, audio changes, posture changes, head rotation, and more. Head movement - The cameras in the AirPods have distortion correction to account for head movement, and can reject images that have excessive movement. On-device processing - Some content is processed directly on the AirPods, such as person detection. Indicator lights - Code suggests the AirPods have a hardware indicator light to let people know when still images are being captured. Naming There were rumors suggesting the new AirPods could be called the "AirPods Ultra" instead of the AirPods Pro, but the ‌macOS Tahoe‌ 26.7 file we found that references the new AirPods is labeled "AirPods Pro" and not AirPods Ultra. It's possible that's a placeholder name, so AirPods Ultra isn't entirely out of the question. Apple may have also planned to use AirPods Pro for a version of the camera-equipped AirPods that won't ultimately make it to release. Bloomberg's Mark Gurman said in March that Apple was considering several devices with the Ultra name, including the foldable iPhone Ultra, AirPods Ultra, and an OLED MacBook Ultra, but that may or may not be a term we see for the new AirPods. Pricing Pricing is unconfirmed, but the current ‌AirPods Pro 3‌ sell for $249. Camera hardware could make the new version more expensive. Compatibility Since the AirPods will feed data to ‌Siri‌, an iPhone that supports Apple Intelligence will be required to use the features. ‌Apple Intelligence‌ is available on the iPhone 15 Pro and later. Release Date Despite showing up in ‌macOS Tahoe‌ 26.7, the camera-equipped AirPods aren't going to come out until 2027. They'll likely launch alongside the 20th-anniversary iPhone in September.Related Roundups: AirPods 4, AirPods Pro 3Buyer's Guide: AirPods (Caution), AirPods Pro (Neutral)Related Forum: AirPodsThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

Apple's New Beats 360 Headphones Spotted in Another Regulatory Filing
Apple's upcoming Beats 360 headphones have been submitted to a regulatory database in the United Arab Emirates, according to a filing viewed by MacRumors. The filing mentions both the name Beats 360 and the model number A3577. To learn more about the Beats 360, read our previous coverage. The headphones have also appeared in U.S. and Brazilian regulatory databases, teaser photos, and retail listings, suggesting that Apple will release them soon.Tags: Beats, Beats 360This article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

Apple Guts Vision Pro Gaming and Immersive Video Teams, Trims Siri Staff
In addition to cutting dozens of Vision Pro employees who worked on features like immersive video and gaming, Apple is laying off people who worked on Siri and AI, reports Bloomberg. Apple is "largely shutting down" the Vision Pro team focused on gaming, and it is paring down the team that makes immersive video content. Approximately 100 employees who were part of the Vision Products Group have been laid off, with Apple also cutting 100 people from its ‌Siri‌ and software groups. Vision Pro employees were told Apple is realigning its priorities based on how customers are using the device, suggesting immersive video has not worked out. Bloomberg says the immersive videos Apple produces can cost millions of dollars to film, and it has not been cost-effective because so few people actively use the device. Apple plans to make a smaller number of videos in-house and rely on third-party 3D content. On the ‌Siri‌ team, Apple is creating new positions for the shift to ‌Siri‌ AI and prioritizing work on AI features. The company told Bloomberg that it is overhauling some of its teams to "evolve" its business and deliver a better experience for customers. Affected employees will be able to apply for other positions at Apple. While we will create new roles as part of this change, it will also impact a limited number of existing roles. We are grateful to these team members for their contributions, and we are committed to supporting them throughout their transition, including opportunities to apply for other roles at Apple. Despite the cuts to the Vision Products Group, employees were told that the Vision Pro and visionOS operating system are not being eliminated. Apple continues to work on AI smart glasses expected in 2027, but that device will not support 3D gaming or video.Related Roundup: Apple Vision ProTag: SiriBuyer's Guide: Vision Pro (Neutral)Related Forum: Apple Vision ProThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

The MacRumors Show: Michael Fisher Talks iPhone Ultra
YouTuber Michael Fisher, known as "MrMobile," joins us on this week's episode of The MacRumors Show to talk through key rumors about the "iPhone Ultra" and how the device could compare to rivals. Subscribe to The MacRumors Show YouTube channel for more videos Michael has covered the foldable phone category since 2019 and personally owned or reviewed nearly every major device in it, from the original Galaxy Fold to Samsung's newly redesigned Galaxy Z Fold8. He still carries a Motorola Razr Ultra as his personal phone alongside a rotating stack of review units. Apple's foldable iPhone, rumored to be called the "‌iPhone Ultra‌," is widely expected to be announced alongside the iPhone 18 Pro this fall, featuring a 7.8-inch inner display, a 5.5-inch cover screen, the A20 chip, and a starting price above $2,000. Much of the design speculation centers on Apple adopting a shorter, wider form factor similar to the Z Fold8 and older Pixel devices, rather than the taller, narrower shape most foldables have used for years. To minimize the crease that has plagued the category since the original Galaxy Fold, Apple is reportedly pursuing a layered glass display structure paired with a liquid metal hinge. The foldable is reportedly expected to ship with just two rear lenses and no telephoto camera, despite engineering compromises made elsewhere to fit in a Camera Control button, while Samsung's competing Z Fold8 Ultra ships with a three-lens system that includes a telephoto with 3x optical zoom. The foldable iPhone is also expected to use Touch ID built into the side button rather than Face ID, since there is reportedly no room for the TrueDepth sensor array in such a thin chassis. Pricing has been a recurring point of speculation, with Bloomberg's Mark Gurman saying the foldable will "cross the $2,000 threshold" in the U.S., which would make it Apple's most expensive iPhone ever. Durability is also likely to face scrutiny, given the hinge failures that plagued the original Galaxy Fold and the fact that Samsung's current foldables still lack a full dust resistance rating years into the category's existence. Code strings found in the iOS 27 beta reference a hinge angle, which could hint at foldable-specific software features, and Apple has already introduced new app adaptation protocols, likely as preparation for the device. See more of Michael's work over on his YouTube channel. Fisher is also a co-founder of Clicks, which makes physical keyboard accessories for smartphones. The MacRumors Show has its own YouTube channel, so make sure you're subscribed to keep up with new episodes and clips. Subscribe to The MacRumors Show YouTube channel! You can also listen to ‌The MacRumors Show‌ on Apple Podcasts, Spotify, Overcast, or other podcast apps. You can also copy our RSS feed directly into your player. If you haven't already listened to the previous episode of The MacRumors Show, catch up to hear our discussion about how the Apple Watch is seemingly heading into one of its least eventful new generations, yet the rumors stacking up behind it describe the most radical rethink in the product's history coming later. Subscribe to ‌The MacRumors Show‌ for new episodes every week, where we discuss some of the topical news breaking here on MacRumors, often joined by interesting guests such as Kayci Lacob, Kevin Nether, John Gruber, Mark Gurman, Jon Prosser, Luke Miani, Matthew Cassinelli, Brian Tong, Quinn Nelson, Jared Nelson, Eli Hodapp, Mike Bell, Sara Dietschy, iJustine, Jon Rettinger, Andru Edwards, Arnold Kim, Ben Sullins, Marcus Kane, Christopher Lawley, Frank McShan, David Lewis, Tyler Stalman, Sam Kohl, Federico Viticci, Thomas Frank, Jonathan Morrison, Ross Young, Ian Zelbo, and Rene Ritchie. ‌The MacRumors Show‌ is on X @MacRumorsShow, so be sure to give us a follow to keep up with the podcast. You can also email us at podcast@macrumors.com or head over to The MacRumors Show forum thread. Remember to rate and review the podcast, and let us know what subjects and guests you would like to see in the future.Tags: iPhone Ultra, The MacRumors ShowThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

Apple Pay Supporting U.S. National Park Foundation Over the Next Week
Now through August 28, Apple will donate $10 to the National Park Foundation for every purchase made in the U.S. using Apple Pay on Apple.com, in the Apple Store app, or at an Apple Store, up to a maximum of $1 million. In addition, the annual U.S. national parks Apple Watch Activity Challenge returns on Sunday, August 23 this year.Related Roundup: Apple PayRelated Forum: Apple Music, Apple Pay/Card, iCloud, Fitness+This article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

Apple Pay Supporting U.S. National Park Foundation Over the Next Week
Now through August 28, Apple will donate $10 to the National Park Foundation for every purchase made in the U.S. using Apple Pay on Apple.com, in the Apple Store app, or at an Apple Store, up to a maximum of $1 million. In addition, the annual U.S. national parks Apple Watch Activity Challenge returns on Sunday, August 23 this year.Related Roundup: Apple PayRelated Forum: Apple Music, Apple Pay/Card, iCloud, Fitness+This article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

Apple Pay Supporting U.S. National Park Foundation Over the Next Week
Now through August 28, Apple will donate $10 to the National Park Foundation for every purchase made in the U.S. using Apple Pay on Apple.com, in the Apple Store app, or at an Apple Store, up to a maximum of $1 million. In addition, the annual U.S. national parks Apple Watch Activity Challenge returns on Sunday, August 23 this year.Related Roundup: Apple PayRelated Forum: Apple Music, Apple Pay/Card, iCloud, Fitness+This article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

MG Could Be Next Automaker to Get Apple Car Key Support
Code found in Apple's backend car key system suggests the company is preparing to add support for MG vehicles. The discovery indicates Apple has begun preparing car key support for SAIC Motor's MG brand. With an Apple Car Key, drivers can use their iPhone or Apple Watch to lock, unlock, and start a compatible vehicle instead of relying on a traditional key fob, with support for Express Mode that works without authentication. MG began as a British sports car marque in 1924 before China's SAIC Motor acquired the brand in 2007, and it has since become one of the fastest-growing car brands in Europe. The company recently delivered its one millionth car to a European customer, with roughly 386,000 of those sales coming from the UK alone, where MG now holds more than four percent of the market and ranks among the country's 10 largest car makers by volume. That growth has been driven in large part by MG's electric lineup, including the MG4 and MG Cyberster. As with other backend references to expanded Apple Car Key support, the code does not indicate which MG models will be compatible or provide a timeframe for rollout, and MG has not yet announced support for the feature. Its addition to Apple's backend code does suggest, however, that its release could soon be on the way.Tag: iPhone Car KeysThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

MG Could Be Next Automaker to Get Apple Car Key Support
Code found in Apple's backend car key system suggests the company is preparing to add support for MG vehicles. The discovery indicates Apple has begun preparing car key support for SAIC Motor's MG brand. With an Apple Car Key, drivers can use their iPhone or Apple Watch to lock, unlock, and start a compatible vehicle instead of relying on a traditional key fob, with support for Express Mode that works without authentication. MG began as a British sports car marque in 1924 before China's SAIC Motor acquired the brand in 2007, and it has since become one of the fastest-growing car brands in Europe. The company recently delivered its one millionth car to a European customer, with roughly 386,000 of those sales coming from the UK alone, where MG now holds more than four percent of the market and ranks among the country's 10 largest car makers by volume. That growth has been driven in large part by MG's electric lineup, including the MG4 and MG Cyberster. As with other backend references to expanded Apple Car Key support, the code does not indicate which MG models will be compatible or provide a timeframe for rollout, and MG has not yet announced support for the feature. Its addition to Apple's backend code does suggest, however, that its release could soon be on the way.Tag: iPhone Car KeysThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

MG Could Be Next Automaker to Get Apple Car Key Support
Code found in Apple's backend car key system suggests the company is preparing to add support for MG vehicles. The discovery indicates Apple has begun preparing car key support for SAIC Motor's MG brand. With an Apple Car Key, drivers can use their iPhone or Apple Watch to lock, unlock, and start a compatible vehicle instead of relying on a traditional key fob, with support for Express Mode that works without authentication. MG began as a British sports car marque in 1924 before China's SAIC Motor acquired the brand in 2007, and it has since become one of the fastest-growing car brands in Europe. The company recently delivered its one millionth car to a European customer, with roughly 386,000 of those sales coming from the UK alone, where MG now holds more than four percent of the market and ranks among the country's 10 largest car makers by volume. That growth has been driven in large part by MG's electric lineup, including the MG4 and MG Cyberster. As with other backend references to expanded Apple Car Key support, the code does not indicate which MG models will be compatible or provide a timeframe for rollout, and MG has not yet announced support for the feature. Its addition to Apple's backend code does suggest, however, that its release could soon be on the way.Tag: iPhone Car KeysThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

MG Could Be Next Automaker to Get Apple Car Key Support
Code found in Apple's backend car key system suggests the company is preparing to add support for MG vehicles. The discovery indicates Apple has begun preparing car key support for SAIC Motor's MG brand. With an Apple Car Key, drivers can use their iPhone or Apple Watch to lock, unlock, and start a compatible vehicle instead of relying on a traditional key fob, with support for Express Mode that works without authentication. MG began as a British sports car marque in 1924 before China's SAIC Motor acquired the brand in 2007, and it has since become one of the fastest-growing car brands in Europe. The company recently delivered its one millionth car to a European customer, with roughly 386,000 of those sales coming from the UK alone, where MG now holds more than four percent of the market and ranks among the country's 10 largest car makers by volume. That growth has been driven in large part by MG's electric lineup, including the MG4 and MG Cyberster. As with other backend references to expanded Apple Car Key support, the code does not indicate which MG models will be compatible or provide a timeframe for rollout, and MG has not yet announced support for the feature. Its addition to Apple's backend code does suggest, however, that its release could soon be on the way.Tag: iPhone Car KeysThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

MG Could Be Next Automaker to Get Apple Car Key Support
Code found in Apple's backend car key system suggests the company is preparing to add support for MG vehicles. The discovery indicates Apple has begun preparing car key support for SAIC Motor's MG brand. With an Apple Car Key, drivers can use their iPhone or Apple Watch to lock, unlock, and start a compatible vehicle instead of relying on a traditional key fob, with support for Express Mode that works without authentication. MG began as a British sports car marque in 1924 before China's SAIC Motor acquired the brand in 2007, and it has since become one of the fastest-growing car brands in Europe. The company recently delivered its one millionth car to a European customer, with roughly 386,000 of those sales coming from the UK alone, where MG now holds more than four percent of the market and ranks among the country's 10 largest car makers by volume. That growth has been driven in large part by MG's electric lineup, including the MG4 and MG Cyberster. As with other backend references to expanded Apple Car Key support, the code does not indicate which MG models will be compatible or provide a timeframe for rollout, and MG has not yet announced support for the feature. Its addition to Apple's backend code does suggest, however, that its release could soon be on the way.Tag: iPhone Car KeysThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

MG Could Be Next Automaker to Get Apple Car Key Support
Code found in Apple's backend car key system suggests the company is preparing to add support for MG vehicles. The discovery indicates Apple has begun preparing car key support for SAIC Motor's MG brand. With an Apple Car Key, drivers can use their iPhone or Apple Watch to lock, unlock, and start a compatible vehicle instead of relying on a traditional key fob, with support for Express Mode that works without authentication. MG began as a British sports car marque in 1924 before China's SAIC Motor acquired the brand in 2007, and it has since become one of the fastest-growing car brands in Europe. The company recently delivered its one millionth car to a European customer, with roughly 386,000 of those sales coming from the UK alone, where MG now holds more than four percent of the market and ranks among the country's 10 largest car makers by volume. That growth has been driven in large part by MG's electric lineup, including the MG4 and MG Cyberster. As with other backend references to expanded Apple Car Key support, the code does not indicate which MG models will be compatible or provide a timeframe for rollout, and MG has not yet announced support for the feature. Its addition to Apple's backend code does suggest, however, that its release could soon be on the way.Tag: iPhone Car KeysThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

MG Could Be Next Automaker to Get Apple Car Key Support
Code found in Apple's backend car key system suggests the company is preparing to add support for MG vehicles. The discovery indicates Apple has begun preparing car key support for SAIC Motor's MG brand. With an Apple Car Key, drivers can use their iPhone or Apple Watch to lock, unlock, and start a compatible vehicle instead of relying on a traditional key fob, with support for Express Mode that works without authentication. MG began as a British sports car marque in 1924 before China's SAIC Motor acquired the brand in 2007, and it has since become one of the fastest-growing car brands in Europe. The company recently delivered its one millionth car to a European customer, with roughly 386,000 of those sales coming from the UK alone, where MG now holds more than four percent of the market and ranks among the country's 10 largest car makers by volume. That growth has been driven in large part by MG's electric lineup, including the MG4 and MG Cyberster. As with other backend references to expanded Apple Car Key support, the code does not indicate which MG models will be compatible or provide a timeframe for rollout, and MG has not yet announced support for the feature. Its addition to Apple's backend code does suggest, however, that its release could soon be on the way.Tag: iPhone Car KeysThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

MG Could Be Next Automaker to Get Apple Car Key Support
Code found in Apple's backend car key system suggests the company is preparing to add support for MG vehicles. The discovery indicates Apple has begun preparing car key support for SAIC Motor's MG brand. With an Apple Car Key, drivers can use their iPhone or Apple Watch to lock, unlock, and start a compatible vehicle instead of relying on a traditional key fob, with support for Express Mode that works without authentication. MG began as a British sports car marque in 1924 before China's SAIC Motor acquired the brand in 2007, and it has since become one of the fastest-growing car brands in Europe. The company recently delivered its one millionth car to a European customer, with roughly 386,000 of those sales coming from the UK alone, where MG now holds more than four percent of the market and ranks among the country's 10 largest car makers by volume. That growth has been driven in large part by MG's electric lineup, including the MG4 and MG Cyberster. As with other backend references to expanded Apple Car Key support, the code does not indicate which MG models will be compatible or provide a timeframe for rollout, and MG has not yet announced support for the feature. Its addition to Apple's backend code does suggest, however, that its release could soon be on the way.Tag: iPhone Car KeysThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

MG Could Be Next Automaker to Get Apple Car Key Support
Code found in Apple's backend car key system suggests the company is preparing to add support for MG vehicles. The discovery indicates Apple has begun preparing car key support for SAIC Motor's MG brand. With an Apple Car Key, drivers can use their iPhone or Apple Watch to lock, unlock, and start a compatible vehicle instead of relying on a traditional key fob, with support for Express Mode that works without authentication. MG began as a British sports car marque in 1924 before China's SAIC Motor acquired the brand in 2007, and it has since become one of the fastest-growing car brands in Europe. The company recently delivered its one millionth car to a European customer, with roughly 386,000 of those sales coming from the UK alone, where MG now holds more than four percent of the market and ranks among the country's 10 largest car makers by volume. That growth has been driven in large part by MG's electric lineup, including the MG4 and MG Cyberster. As with other backend references to expanded Apple Car Key support, the code does not indicate which MG models will be compatible or provide a timeframe for rollout, and MG has not yet announced support for the feature. Its addition to Apple's backend code does suggest, however, that its release could soon be on the way.Tag: iPhone Car KeysThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

The next measure of AI momentum is work transformed
In yesterday’s earnings call, we shared that Microsoft 365 Copilot has surpassed 30 million paid seats, with net seat adds more than doubling quarter over quarter. The post appeared first on Microsoft 365 Blog.

Read more »

Who’s Tracking You? Use This New Service to Find Out
It can be daunting to determine who's responsible for showing ads on the websites we visit, or who's harvesting data from the mobile apps we use every day. That information is already semi-public, but it is not easily parsed and traditionally much of it has remained walled away in the hands of large advertising platforms. Not anymore: A powerful and free new service called DecryptAds scrapes and correlates this adtech data and makes it simple to quickly learn a great deal about the entities that are tracking you.

Read more »

Microsoft Plugs Nearly 400 Security Holes
Microsoft today released updates to remedy at least 398 security vulnerabilities in its Windows operating systems and supported software, including one weakness that is already being actively exploited and two others that were publicly detailed prior to today.

Read more »

Canadian Man Pleads Guilty in Snowflake Extortions
A 26-year-old Canadian man once described as one of the most consequential cybercrime threat actors of 2024 has pleaded guilty to computer fraud and conspiracy to hack and extort more than 165 organizations that used the cloud data storage provider Snowflake. Connor Riley Moucka, of Kitchener, Ontario, also admitted to stealing call and text history records of more than 100 million AT&T customers.

Read more »

Vulnerability Summary for the Week of July 27, 2026
High Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info @fastify/rate-limit--@fastify/rate-limit @fastify/rate-limit before 11.2.0 keys rate-limit buckets by the verbatim client IP string returned from request.ip. Because a single IPv6 client can control a large address range (a /64 holds 2^64 distinct addresses) and the same address has multiple valid textual representations, an IPv6 capable client can defeat the rate-limit boundary by rotating addresses or by rewriting the same address in different forms. Applications that use @fastify/rate-limit to protect endpoints such as authentication, password reset, OTP delivery, or expensive API calls can be bypassed by IPv6 clients behind a proxy that surfaces IPv6 to the origin when trustProxy is enabled. The issue is fixed in @fastify/rate-limit 11.2.0, where the default key generator normalizes IPv6 addresses to their canonical form, collapses IPv4 mapped IPv6 to IPv4, and applies a configurable prefix mask (default /64) via a new ipv6Subnet option. 2026-07-29 7.3 CVE-2026-15144 acacode--swagger-typescript-api swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, templates/base/http-clients/axios-http-client.ejs interpolates servers[0].url from src/code-gen-process.ts into the HttpClient constructor without escaping, allowing an attacker-controlled OpenAPI spec to inject code that executes when new HttpClient() or new Api() is constructed. This issue is fixed in version 13.12.2. 2026-07-29 8.3 CVE-2026-54661 acacode--swagger-typescript-api swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/code-gen-process.ts createApiConfig copies servers[0].url into apiConfig.baseUrl, and templates/base/http-clients/fetch-http-client.ejs interpolates apiConfig.baseUrl into the generated HttpClient baseUrl field without escaping, allowing an attacker-controlled OpenAPI spec to inject TypeScript static field code that executes when the generated fetch client module is imported. This issue is fixed in version 13.12.2. 2026-07-29 8.3 CVE-2026-54662 acacode--swagger-typescript-api swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-parser/base-schema-parsers/enum.ts passes components.schemas.*.enum[i] values to Ts.StringValue in src/configuration.ts without escaping before templates/base/enum-data-contract.ejs renders TypeScript enum declarations, allowing an attacker-controlled OpenAPI spec to inject code that executes when the generated module is imported. This issue is fixed in version 13.12.2. 2026-07-29 8.3 CVE-2026-54664 acacode--swagger-typescript-api swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-routes/schema-routes.ts passes OpenAPI path keys through parseRouteName to templates/default/procedure-call.ejs and templates/modular/procedure-call.ejs without escaping JavaScript template literal interpolation, allowing an attacker-controlled path containing ${...} to execute when the generated method is called. This issue is fixed in version 13.12.2. 2026-07-29 8.3 CVE-2026-54666 acacode--swagger-typescript-api swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts getRemoteRequestHeaders forwards --authorizationToken to every URL fetched by fetchRemoteSchemaDocument while warmUpRemoteSchemasCache resolves external $ref URLs, allowing an attacker-controlled OpenAPI spec to exfiltrate the developer or CI bearer token to a cross-origin endpoint. This issue is fixed in version 13.12.2. 2026-07-29 7.4 CVE-2026-54660 acowebs--Dynamic Pricing With Discount Rules for WooCommerce Unauthenticated Cross Site Scripting (XSS) in Dynamic Pricing With Discount Rules for WooCommerce = 1.4.0-beta.27 through = 1.7.0-beta.0 through sk) inside smc_cdc_msg_recv(). No reference is held across the lock release. The only reference pinning the socket while the connection is discoverable in the link group is taken in smc_lgr_register_conn() (sock_hold) and dropped in __smc_lgr_unregister_conn() (sock_put), both under conns_lock. Once the handler drops conns_lock, a concurrent close() - > smc_release() - > smc_conn_free() - > smc_lgr_unregister_conn() can drop that reference and free the smc_sock, so the handler's later sock_hold() runs on freed memory: WARNING: lib/refcount.c:25 at refcount_warn_saturate Workqueue: rxe_wq do_work refcount_warn_saturate (lib/refcount.c:25) smc_cdc_msg_recv (net/smc/smc_cdc.c:430) smc_cdc_rx_handler (net/smc/smc_cdc.c:502) smc_wr_rx_tasklet_fn (net/smc/smc_wr.c:445) tasklet_action_common (kernel/softirq.c:938) handle_softirqs (kernel/softirq.c:622) Kernel panic - not syncing: panic_on_warn set Only SMC-R is affected. The SMC-D receive tasklet is stopped by tasklet_kill(&conn- >rx_tsklet) in smc_conn_free() before the connection is unregistered, so it cannot run concurrently with the free. Take the socket reference while still holding conns_lock, so the registration reference can no longer be the last one, and drop it once the handler is done. 2026-07-27 9.8 CVE-2026-64541 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: sctp: validate STALE_COOKIE cause length before reading staleness When an ERROR chunk with a STALE_COOKIE cause is received in the COOKIE_ECHOED state, sctp_sf_do_5_2_6_stale() reads the 4-byte Measure of Staleness that follows the cause header: err = (struct sctp_errhdr *)(chunk- >skb- >data); stale = ntohl(*(__be32 *)((u8 *)err + sizeof(*err))); err is the first cause in the chunk, not the STALE_COOKIE cause that caused the dispatch, and nothing guarantees the staleness field is present. sctp_walk_errors() only requires a cause to be as long as the 4-byte header, so for a STALE_COOKIE cause of length 4 the read runs past the cause, and for a minimal ERROR chunk past skb- >tail. The value is echoed to the peer in the Cookie Preservative of the reply INIT, leaking uninitialized memory. sctp_sf_cookie_echoed_err() already walks to the STALE_COOKIE cause, so check its length there and pass it to sctp_sf_do_5_2_6_stale(), which reads that cause instead of the first one. A STALE_COOKIE cause too short to hold the staleness field is discarded. The read is reachable by any peer that can drive an association into COOKIE_ECHOED, including an unprivileged process using a raw SCTP socket in a user and network namespace. 2026-07-27 9.1 CVE-2026-64551 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop The loop in is_ap_in_tkip() iterates over IEs without verifying that enough bytes remain before dereferencing the IE header or its payload: - pIE- >element_id and pIE- >length are read without checking that i + sizeof(*pIE) data + 12, which requires pIE- >length >= 16. For WLAN_EID_RSN it compares pIE- >data + 8, requiring pIE- >length >= 12. Neither requirement is checked. Add the missing IE header and payload bounds checks and guard each data access with an explicit pIE- >length minimum, matching the pattern established in update_beacon_info(). 2026-07-27 8.1 CVE-2026-64536 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() genelink_rx_fixup() splits an aggregated RX frame into its individual packets, using a per-packet length taken from device-supplied data. That length is only bounded by GL_MAX_PACKET_LEN (1514); it is never compared against how many bytes were actually received. A malicious GeneLink (GL620A) device can therefore send a short URB whose header claims packet_count > 1 and a first packet of up to 1514 bytes. skb_put_data(gl_skb, packet- >packet_data, size); then copies past the end of the receive buffer and hands the adjacent slab contents up the network stack, an out-of-bounds read that leaks kernel heap. No privilege is required: the path runs in the usbnet RX softirq as soon as the interface is up. BUG: KASAN: slab-out-of-bounds in genelink_rx_fixup (drivers/net/usb/gl620a.c:112) Read of size 1514 at addr ffff888011309708 by task ksoftirqd/0/14 Call Trace: ... __asan_memcpy (mm/kasan/shadow.c:105) genelink_rx_fixup (include/linux/skbuff.h:2814 drivers/net/usb/gl620a.c:112) usbnet_bh (drivers/net/usb/usbnet.c:572 drivers/net/usb/usbnet.c:1589) process_one_work (kernel/workqueue.c:3322) bh_worker (kernel/workqueue.c:3405) tasklet_action (kernel/softirq.c:965) handle_softirqs (kernel/softirq.c:622) run_ksoftirqd (kernel/softirq.c:1076) ... skb_pull() already verifies that the requested length fits the buffer and returns NULL otherwise. Move it ahead of the copy and check its result, so a packet that overruns the received data is rejected before it is read. Well-formed frames, whose packets are fully present, are unaffected. 2026-07-27 8.1 CVE-2026-64540 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: net: usb: net1080: validate packet_len before pad-byte access in rx_fixup For an even packet_len, net1080_rx_fixup() reads the pad byte at skb- >data[packet_len] before the skb- >len != packet_len check further down, and packet_len is only bounded against NC_MAX_PACKET. A malicious NetChip 1080 device can send a short frame advertising a large even packet_len (e.g. 0x4000), so the pad-byte read lands past the end of the skb: BUG: KASAN: slab-out-of-bounds in net1080_rx_fixup Read of size 1 at addr ffff8880106c83c6 by task ksoftirqd/0/14 ... net1080_rx_fixup (drivers/net/usb/net1080.c:384) usbnet_bh (drivers/net/usb/usbnet.c:1589) process_one_work (kernel/workqueue.c:3322) bh_worker (kernel/workqueue.c:3708) tasklet_action (kernel/softirq.c:965) handle_softirqs (kernel/softirq.c:622) ... Reject the frame when packet_len >= skb- >len before reading. 2026-07-27 8.1 CVE-2026-64547 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() When the scatterlist ring is full or nearly full, bpf_msg_push_data() enters a copy fallback path and computes copy + len for the page allocation size. Since len comes from BPF with arg3_type = ARG_ANYTHING and both are u32, a crafted len can wrap the sum to a small value, causing an undersized allocation followed by an out-of-bounds memcpy. BUG: unable to handle page fault for address: ffffed104089a402 Oops: Oops: 0000 [#1] SMP KASAN NOPTI Call Trace: __asan_memcpy (mm/kasan/shadow.c:105) bpf_msg_push_data (net/core/filter.c:2852 net/core/filter.c:2788) bpf_prog_9ed8b5711920a7d7+0x2e/0x36 sk_psock_msg_verdict (net/core/skmsg.c:934) tcp_bpf_sendmsg (net/ipv4/tcp_bpf.c:421 net/ipv4/tcp_bpf.c:584) __sys_sendto (net/socket.c:2206) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) Add an overflow check before the allocation. 2026-07-27 8.4 CVE-2026-64548 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: virtio-net: fix len check in receive_big() receive_big() bounds the device-announced length by (big_packets_num_skbfrags + 1) * PAGE_SIZE. That is still too loose: add_recvbuf_big() sets sg[1] to start at offset sizeof(struct padded_vnet_hdr) into the first page, so the chain actually carries hdr_len + (PAGE_SIZE - sizeof(padded_vnet_hdr)) + big_packets_num_skbfrags * PAGE_SIZE bytes -- 20 bytes less than the check allows for the common hdr_len == 12 case. A malicious virtio backend can announce a len in that gap. page_to_skb() then walks one frag past the page chain, storing a NULL page- >private into skb_shinfo()- >frags[MAX_SKB_FRAGS], which is both an out-of-bounds write past the static frag array and a NULL frag handed up the rx path. Bound len by the size add_recvbuf_big() actually advertised. 2026-07-27 8.4 CVE-2026-64552 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() br_ip6_fragment() gets prevhdr, a pointer into the skb head, from ip6_find_1stfragopt(), then calls skb_checksum_help(). For a cloned skb skb_checksum_help() reallocates the head via pskb_expand_head(), leaving prevhdr dangling. It is later dereferenced in ip6_frag_next(), causing a use-after-free write. Save prevhdr's offset before skb_checksum_help() and recompute it after, like commit ef0efcd3bd3f ("ipv6: Fix dangling pointer when ipv6 fragment"). BUG: KASAN: slab-use-after-free in ip6_frag_next (net/ipv6/ip6_output.c:857) Write of size 1 at addr ffff888013ff5016 by task exploit/141 Call Trace: ... kasan_report (mm/kasan/report.c:595) ip6_frag_next (net/ipv6/ip6_output.c:857) br_ip6_fragment (net/ipv6/netfilter.c:212) nf_ct_bridge_post (net/bridge/netfilter/nf_conntrack_bridge.c:407) nf_hook_slow (net/netfilter/core.c:619) br_forward_finish (net/bridge/br_forward.c:66) __br_forward (net/bridge/br_forward.c:115) maybe_deliver (net/bridge/br_forward.c:191) br_flood (net/bridge/br_forward.c:245) br_handle_frame_finish (net/bridge/br_input.c:229) br_handle_frame (net/bridge/br_input.c:442) ... packet_sendmsg (net/packet/af_packet.c:3114) ... do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Kernel panic - not syncing: Fatal exception in interrupt 2026-07-27 8.8 CVE-2026-64554 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops() kvm_hyp_handle_mops() resets the single-step state machine as part of rewinding state for a MOPS exception by modifying vcpu_cpsr() and writing the result directly into hardware. In the case of nested virtualization, vcpu_cpsr() is a synthetic value such that the rest of KVM can deal with vEL2 cleanly. That means the value requires translation before being written into hardware, which is unfortunately missing from the MOPS handler. Fix it by directly modifying SPSR_EL2 and avoiding the synthetic state altogether, which will be resynchronized on the next 'full' exit back to KVM. 2026-07-27 8.8 CVE-2026-64555 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() l2cap_sock_new_connection_cb() returned l2cap_pi(sk)- >chan after release_sock(parent). Once the parent lock is dropped the newly enqueued child socket sk is reachable via the accept queue, so another task can accept and free it before the callback dereferences sk, resulting in a use-after-free. Rework the - >new_connection() op so the core, rather than the callback, owns the child channel's lifetime. The op now receives a pre-allocated new_chan and returns an errno instead of allocating and returning a channel. l2cap_new_connection() allocates the child channel and links it into the conn list via __l2cap_chan_add() before invoking the callback, so the conn-list reference keeps the channel alive once release_sock(parent) exposes the socket to other tasks. Channel configuration that was duplicated in l2cap_sock_init() and the various new_connection callbacks is consolidated into l2cap_chan_set_defaults(), which now inherits from the parent channel when one is supplied. 2026-07-29 8.8 CVE-2026-64557 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff ("net: openvswitch: remove misbehaving actions length check") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure. 2026-07-27 7.8 CVE-2026-64531 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation} In do_action()'s UpdateRecordDataRoot (fslog.c:3489) and UpdateRecordDataAllocation (fslog.c:3697) cases, the memmove destination is `Add2Ptr(e, le16_to_cpu(e- >view.data_off))`, where e- >view.data_off comes from an on-disk NTFS_DE inside an INDEX_ROOT or INDEX_BUFFER. Neither case validates view.data_off + dlen against e- >size; the existing check_if_index_root / check_if_alloc_index helpers walk the entry chain and validate the entry's offset, but not its internal view fields. The neighbouring read sites (e.g., fs/ntfs3/index.c when iterating view entries) check view.data_off + view.data_size size. Apply the same bound at the two memmove sites. Reproduced under UML+KASAN on mainline 8d90b09e6741 via pr_warn-only probe instrumentation: with view.data_off forced to 0xFFFC, the memmove writes 32 bytes past the end of the NTFS_DE. This is similar in shape to Pavitra Jha's 2026-05-02 patch "fs/ntfs3: prevent oob in case UpdateRecordDataRoot" () which proposes calling ntfs3_bad_de_range(); that helper does not exist in mainline. This patch uses inline checks. 2026-07-27 7.8 CVE-2026-64532 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate lcns_follow in log_replay conversion log_replay() converts DIR_PAGE_ENTRY_32 records into DIR_PAGE_ENTRY records when replaying version 0 restart tables. During this conversion, the memmove() length is derived directly from the on-disk lcns_follow field: memmove(&dp- >vcn, &dp0- >vcn_low, 2 * sizeof(u64) + le32_to_cpu(dp- >lcns_follow) * sizeof(u64)); check_rstbl() validates restart table structure, but does not constrain per-entry lcns_follow values relative to the entry size. A malformed filesystem image can provide an oversized lcns_follow value, causing the conversion memmove() to access memory beyond the bounds of the allocated restart table buffer. The same field is later used to bound iteration over page_lcns[], so validating lcns_follow during conversion also prevents downstream out-of-bounds access from the same malformed metadata. Compute the maximum valid lcns_follow from the already-validated restart table entry size and reject entries that exceed this bound. Reuse the existing t16/t32 scratch variables already declared in log_replay() to avoid introducing new declarations. [almaz.alexandrovich@paragon-software.com: fixed the conflicts] 2026-07-27 7.8 CVE-2026-64533 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix stack OOB write when prepending the Flags AD eir_create_adv_data() builds the advertising data into a fixed-size buffer ("size", 31 for the legacy path). It may prepend a 3-byte "Flags" AD structure (LE_AD_NO_BREDR on an LE-only controller) and then copies the per-instance data without checking that it still fits: memcpy(ptr, adv- >adv_data, adv- >adv_data_len); tlv_data_max_len() only reserves those 3 bytes when the user-supplied flags carry a managed-flags bit, so an instance added with flags == 0 is accepted with adv_data_len up to the full buffer. At advertise time the flags are still prepended, and the memcpy() writes 3 + adv_data_len bytes into the size-byte buffer: BUG: KASAN: stack-out-of-bounds in eir_create_adv_data (net/bluetooth/eir.c:301) Write of size 31 at addr ffff88800a547bdc by task kworker/u9:0/65 Workqueue: hci0 hci_cmd_sync_work __asan_memcpy (mm/kasan/shadow.c:106) eir_create_adv_data (net/bluetooth/eir.c:301) hci_update_adv_data_sync (net/bluetooth/hci_sync.c:1310) hci_schedule_adv_instance_sync (net/bluetooth/hci_sync.c:1817) hci_cmd_sync_work (net/bluetooth/hci_sync.c:332) This frame has 1 object: [32, 64) 'cp' The "Flags" structure is added by the kernel, not requested by userspace, so only prepend it when it fits together with the instance advertising data; when there is no room for both, drop the flags rather than the user-provided data. Reachable by a local user with CAP_NET_ADMIN owning an LE-only controller on the legacy advertising path. 2026-07-27 7.8 CVE-2026-64539 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: tipc: fix use-after-free of the discoverer in tipc_disc_rcv() bearer_disable() frees b- >disc with tipc_disc_delete()'s plain kfree(), but tipc_disc_rcv() still dereferences b- >disc in RX softirq under rcu_read_lock() (tipc_udp_recv - > tipc_rcv - > tipc_disc_rcv). L2 bearers are safe thanks to the synchronize_net() in tipc_disable_l2_media(), but the UDP bearer defers that call to the cleanup_bearer() workqueue, so the discoverer is freed with no grace period: BUG: KASAN: slab-use-after-free in tipc_disc_rcv (net/tipc/discover.c:149) Read of size 8 at addr ffff88802348b728 by task poc_tipc/184 tipc_disc_rcv (net/tipc/discover.c:149) tipc_rcv (net/tipc/node.c:2126) tipc_udp_recv (net/tipc/udp_media.c:391) udp_rcv (net/ipv4/udp.c:2643) ip_local_deliver_finish (net/ipv4/ip_input.c:241) Freed by task 181: kfree (mm/slub.c:6565) bearer_disable (net/tipc/bearer.c:418) tipc_nl_bearer_disable (net/tipc/bearer.c:1001) The bearer is freed with kfree_rcu(); free the discoverer the same way. Add an rcu_head to struct tipc_discoverer and free it and its skb from an RCU callback. Because the RCU callback (tipc_disc_free_rcu) lives in module text, a call_rcu() that is still pending when the tipc module is unloaded would invoke a freed function. Add an rcu_barrier() to tipc_exit() after the bearer subsystem has been torn down, so all pending discoverer callbacks have run before the module text goes away. Reachable from an unprivileged user namespace: the TIPCv2 genl family is netnsok and its bearer commands have no GENL_ADMIN_PERM. Needs CONFIG_TIPC and CONFIG_TIPC_MEDIA_UDP. 2026-07-27 7.8 CVE-2026-64543 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: net, bpf: check master for NULL in xdp_master_redirect() xdp_master_redirect() dereferences the result of netdev_master_upper_dev_get_rcu() without a NULL check, but that helper returns NULL when the receiving device has no upper-master adjacency. The reach guard only checks netif_is_bond_slave(). On bond slave release bond_upper_dev_unlink() drops the upper-master adjacency before clearing IFF_SLAVE, so an XDP_TX reaching xdp_master_redirect() in that window still passes netif_is_bond_slave() while master is already NULL, and faults on master- >flags at offset 0xb0: BUG: kernel NULL pointer dereference, address: 00000000000000b0 RIP: 0010:xdp_master_redirect (net/core/filter.c:4432) Call Trace: xdp_master_redirect (net/core/filter.c:4432) bpf_prog_run_generic_xdp (include/net/xdp.h:700) do_xdp_generic (net/core/dev.c:5608) __netif_receive_skb_one_core (net/core/dev.c:6204) process_backlog (net/core/dev.c:6319) __napi_poll (net/core/dev.c:7729) net_rx_action (net/core/dev.c:7792) handle_softirqs (kernel/softirq.c:622) __dev_queue_xmit (include/linux/bottom_half.h:33) packet_sendmsg (net/packet/af_packet.c:3082) __sys_sendto (net/socket.c:2252) Kernel panic - not syncing: Fatal exception in interrupt The missing check dates back to the original code; commit 1921f91298d1 ("net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master") later added the master- >flags read where the fault now lands but kept the unconditional deref. Check master for NULL before use; a NULL master is treated the same as one that is not up. 2026-07-27 7.5 CVE-2026-64545 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: drm/edid: fix OOB read in drm_parse_tiled_block() drm_parse_tiled_block() casts the DisplayID block to a struct displayid_tiled_block and reads the full fixed layout up to tile- >topology_id[7] without checking block- >num_bytes. The DisplayID iterator only validates the declared payload length, so a crafted EDID can advertise a tiled-display block (tag DATA_BLOCK_TILED_DISPLAY, or DATA_BLOCK_2_TILED_DISPLAY_TOPOLOGY for v2.0) with a small num_bytes at the end of a DisplayID extension. The read then runs past the end of the exact-sized kmemdup()'d EDID allocation, a heap out-of-bounds read. Reject blocks shorter than the spec's 22-byte tiled payload before reading the fixed struct, as drm_parse_vesa_mso_data() already does. BUG: KASAN: slab-out-of-bounds in drm_edid_connector_update Read of size 2 at addr ffff888010077700 by task exploit/147 dump_stack_lvl (lib/dump_stack.c:94 ...) print_report (mm/kasan/report.c:378 ...) kasan_report (mm/kasan/report.c:595) drm_edid_connector_update (drivers/gpu/drm/drm_edid.c:7581) bochs_connector_helper_get_modes (drivers/gpu/drm/tiny/bochs.c:574) drm_helper_probe_single_connector_modes (drivers/gpu/drm/drm_probe_helper.c:426) status_store (drivers/gpu/drm/drm_sysfs.c:219) ... vfs_write (fs/read_write.c:595 fs/read_write.c:688) ksys_write (fs/read_write.c:740) 2026-07-27 7.1 CVE-2026-64546 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: validate MAP frame length before ingress parsing When ingress deaggregation is disabled, rmnet_map_ingress_handler() passes the skb straight to __rmnet_map_ingress_handler(), skipping the length validation that rmnet_map_deaggregate() performs on the aggregated path. The parser then dereferences the MAP header and csum header/trailer based on the on-wire pkt_len without checking skb- >len, so a short frame is read out of bounds: BUG: KASAN: slab-out-of-bounds in rmnet_map_checksum_downlink_packet Read of size 1 at addr ffff88801118ed00 by task exploit/147 Call Trace: ... rmnet_map_checksum_downlink_packet (drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c:413) __rmnet_map_ingress_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:96) rmnet_rx_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:129) __netif_receive_skb_core.constprop.0 (net/core/dev.c:6089) netif_receive_skb (net/core/dev.c:6460) tun_get_user (drivers/net/tun.c:1955) tun_chr_write_iter (drivers/net/tun.c:2001) vfs_write (fs/read_write.c:688) ksys_write (fs/read_write.c:740) do_syscall_64 (arch/x86/entry/syscall_64.c:94) ... Factor that validation out of rmnet_map_deaggregate() into rmnet_map_validate_packet_len() and run it on the no-aggregation path too. The MAP header is bounds-checked first, since this path can receive a frame shorter than the header. 2026-07-27 7.3 CVE-2026-64550 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: perf/core: Detach event groups during remove_on_exec perf_event_remove_on_exec() removes events by calling perf_event_exit_event(). For top-level events, this removes the event from the context with DETACH_EXIT only. This can leave inconsistent group state when a removed event is a group leader and the group contains siblings without remove_on_exec. If the group was active, the surviving siblings can remain active and attached to the removed leader's sibling list, but are no longer represented by a valid group leader on the PMU context active lists. A later close of the removed leader uses DETACH_GROUP and can promote the still-active siblings from this stale group state. The next schedule-in can then add an already-linked active_list entry again, corrupting the PMU context active list. With DEBUG_LIST enabled, this is caught as a list_add double-add in merge_sched_in(). Fix this by detaching group relationships when remove_on_exec removes an event. This preserves the existing task-exit and revoke behavior, while ensuring surviving siblings are ungrouped before the removed event leaves the context. 2026-07-29 7.8 CVE-2026-64556 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in pkey_pckmo handler implementation Explicitly check the length of the target buffer in the pkey_pckmo implementation of the key_to_protkey() handler function. The handler function fails, if the generated output data exceeds the length of the provided target buffer. 2026-07-29 7.8 CVE-2026-64558 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in PKEY_VERIFYPROTK ioctl Explicitly check the buffer length request structure provided by user-space and fail, if it exceeds the buffer size. 2026-07-29 7.8 CVE-2026-64559 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by non-leader exec() race Wongi and Jungwoo decoded and reported a non-leader exec() related race which can result in an UAF: sys_timer_delete() exec() posix_cpu_timer_del() // Observes old leader p = pid_task(pid, pid_type); de_thread() switch_leader(); release_task(old_leader) __exit_signal(old_leader) sighand = lock(old_leader, sighand); posix_cpu_timers*_exit(); sighand = lock_task_sighand(p) unhash_task(old_leader); sh = lock(p, sighand) old_leader- >sighand = NULL; unlock(sighand); (p- >sighand == NULL) unlock(sh) return NULL; // Returns without action if(!sighand) return 0; free_posix_timer(); This is "harmless" unless the deleted timer was armed and enqueued in p- >signal because on exec() a TGID targeted timer is inherited. As sys_timer_delete() freed the underlying posix timer object run_posix_cpu_timers() or any timerqueue related add/delete operations on other timers will access the freed object's timerqueue node, which results in an UAF. There is a similar problem vs. posix_cpu_timer_set(). For regular posix timers it just transiently returns -ESRCH to user space, but for the use case in do_cpu_nanosleep() it's the same UAF just that the k_itimer is allocated on the stack. Also posix_cpu_timer_rearm() fails to rearm the timer, which means it stops to expire. While debating solutions Frederic pointed out another problem: posix_cpu_timer_del(tmr) __exit_signal(p) posix_cpu_timers*_exit(p); unhash_task(p); p- >sighand = NULL; sh = lock_task_sighand(p) sighand = p- >sighand; if (!sighand) return NULL; lock(sighand); if (!sh) WARN_ON_ONCE(timer_queued(tmr)); On weakly ordered architectures it is not guaranteed that posix_cpu_timer_del() will observe the stores in posix_cpu_timers*_exit() when p- >sighand is observed as NULL, which means the WARN() can be a false positive. Solve these issues by: 1) Changing the store in __exit_signal() to smp_store_release(). 2) Adding a smp_acquire__after_ctrl_dep() into the !sighand path of lock_task_sighand(). 3) Creating a helper function for looking up the task and locking sighand which does not return when sighand == NULL. Instead it retries the task lookup and only if that fails it gives up. 4) Using that helper in the three affected functions. #1/#2 ensures that the reader side which observes sighand == NULL also observes all preceeding stores, i.e. the stores in posix_cpu_timers*_exit() and the ones in unhash_task(). #3 ensures that the above described non-leader exec() situation is handled gracefully. When the task lookup returns the old leader, but sighand == NULL then it retries. In the non-leader exec() case the subsequent task lookup will observe the new leader due to #1/#2. In normal exit() scenarios the subsequent lookup fails. When the task lookup fails, the function also checks whether the timer is still enqueued and issues a warning if that's the case. Unfortunately there is nothing which can be done about it, but as the task is already not longer visible the timer should not be accessed anymore. This check also requires memory ordering, which is not provided when the first lookup fails. To achieve that the check is preceeded by a smp_rmb() which pairs with the smp_wmb() in write_seqlock() in __exit_signal(). That ensures that the stores in posix_cpu_timers*_exit() are visible. The history of the non-leader exec() issue goes back to the early days of posix CPU timers, which stored a pointer to the group leader task in the timer. That obviously fails when a non-leader exec() switches the leader. commit e0a70217107e ("posix-cpu-timers: workaround to suppress the problems with mt exec") added a temporary workaround for that in 2010 which surv ---truncated--- 2026-07-29 7.8 CVE-2026-64560 litestar-org--litestar Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie being excluded from automatic escaping by the template engine when configured inline with documentation recommendations. This issue has been patched in version 2.20.0. 2026-07-28 8.1 CVE-2026-48060 magepeopleteam--Booking and Rental Manager Unauthenticated Other Vulnerability Type in Booking and Rental Manager by(), so Laravel derived a constant cache key (md5('authentication')) shared by every request. An unauthenticated attacker sending roughly ten requests per minute from a single IP, most cheaply against the checkpoint endpoint (which has no reCAPTCHA), exhausts the shared counter and causes HTTP 429 for every user attempting to log in or complete two-factor authentication, a panel-wide authentication denial of service that also locks out administrators. This issue is fixed in version 1.13.0. 2026-07-28 7.5 CVE-2026-61609 pterodactyl--wings Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, {{config.}} placeholders in egg configuration-file templates allow a low-privileged user to read {{config.token}}, {{config.token_id}}, and {{config.docker.registries}} from the full daemon configuration. This issue is fixed in version 1.12.3. 2026-07-31 9.9 CVE-2026-52855 pterodactyl--wings Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a malformed packet received during the SFTP connection handshake causes a Go panic. This issue is fixed in version 1.13.0. 2026-07-31 7.5 CVE-2026-52856 QuantumCloud--Simple Link Directory Pro Unauthenticated Server Side Request Forgery (SSRF) in Simple Link Directory Pro 'post'`, any author-level user who has authored a `wwp_requests` post - such as one created via the wholesale registration form - can access this nonce and submit the role-assignment request. 2026-07-29 8.8 CVE-2026-12144 savonrb--savon Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all_operations interpolates attacker-controlled WSDL operation names into Ruby source passed to module_eval, allowing Ruby code execution in the application process. This issue is fixed in version 2.17.2. 2026-07-31 8.1 CVE-2026-53510 Sender--Sender Newsletter, SMS and Email Marketing Automation for WooCommerce Administrator SQL Injection in Sender - Newsletter, SMS and Email Marketing Automation for WooCommerce subscribe() callback after it had already called params- >notify(conn, params, NULL, 0). Per the public GATT API, a notify callback with NULL data is the documented signal that the subscription has terminated and the bt_gatt_subscribe_params struct may be freed or reused by the application; calling subscribe() on the struct afterwards is a use-after-free, including an indirect call through the freed params- >subscribe function pointer. The error branch is remotely (adjacent) reachable: a Zephyr device acting as a GATT client that calls bt_gatt_subscribe() can be driven into this ordering when a connected GATT server peer answers the CCC write with an ATT Error Response (the peer-supplied error code flows through att_error_rsp - > att_handle_rsp into gatt_write_ccc_rsp). For applications that free or recycle subscription parameters in their notification-termination handler, this results in memory corruption, a crash (denial of service), or potentially attacker-influenced control flow. The fix reorders the handler so the subscribe() callback runs before the terminating notify(NULL) in both the error and unsubscribe paths. 2026-07-31 7.6 CVE-2026-10685 zephyrproject--zephyr The OCPP 1.6 client in subsys/net/lib/ocpp parsed inbound WAMP RPC frames in parse_rpc_msg() (subsys/net/lib/ocpp/ocpp_j.c) using a hand-rolled helper, extract_string_field(), that copied the message's uid and action fields with strncpy(out_buf, token + 1, outlen - 1) and then scanned the result with strchr(out_buf, '"'). Because strncpy does not NUL-terminate the destination when the source is at least outlen - 1 (127) bytes long, the subsequent strchr reads past the 128-byte destination buffer into adjacent stack memory; if a " byte is found beyond the buffer, a one-byte out-of-bounds NUL write also occurs. A related defect in extract_payload() runs strchr/strrchr over the receive buffer, which may not be NUL-terminated when a maximal-length frame fills it. The parsed bytes come directly from the OCPP central-system server over a websocket: the reader thread fills recv_buf via websocket_recv_msg() and calls parse_rpc_msg() on each inbound DATA frame (subsys/net/lib/ocpp/ocpp.c). A malicious or compromised central server, or an on-path attacker (OCPP is commonly deployed over plain ws://), can send an RPC frame whose uid or action field is 127+ bytes with no closing quote, triggering the out-of-bounds access. The primary impact is a remotely triggerable denial of service: the unbounded scan can fault on an unmapped page, and the stray NUL write can corrupt adjacent stack state. The over-read data is not reflected to the peer, so disclosure is limited. The feature is EXPERIMENTAL and must be explicitly enabled (CONFIG_OCPP). The fix replaces the manual parser with the bounds-respecting json_mixed_arr_parse() and copies the extracted uid with an explicitly NUL-terminated buffer, eliminating both over-reads. 2026-08-02 7 CVE-2026-10848 zip-lib--zip-lib Versions of the package zip-lib before 1.1.0 are vulnerable to Directory Traversal via the caching mechanism for path validation during the extraction process. An attacker can bypass security checks designed to prevent directory traversal. The intended security function, isOutsideTargetFolder, only checks and caches the path status when the initial directory symlink is created during the first extraction. 2026-07-28 7.5 CVE-2026-17524 Back to top Medium Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info 100plugins--Open User Map Contributor Cross Site Scripting (XSS) in Open User Map prepare() or any integer casting. Additionally, the nonce verification check is performed after the SQL query has already executed, providing no protection against the injection. This makes it possible for authenticated attackers with subscriber-level access and above to inject arbitrary SQL commands, potentially leading to unauthorized extraction of sensitive database contents including user credentials and configuration data. 2026-07-28 6.5 CVE-2026-6251 chrisvrichardson--MapPress Maps for WordPress Unauthenticated Sensitive Data Exposure in MapPress Maps for WordPress prepare(). The wp_unslash() call explicitly removes the backslash escaping that WordPress's wp_magic_quotes() adds to all $_POST data, neutralizing the only layer of SQL injection protection. The sanitize_text_field() function applied afterward offers no SQL protection. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries to the existing query. 2026-08-01 6.5 CVE-2026-6453 CyberTimon--RapidRAW RapidRAW before 1.6.0 does not validate the lutPath field in preset files before passing it to File::open() in lut_processing.rs. On Windows, a UNC path in lutPath causes an outbound SMB connection to an attacker-controlled host, leaking the victim's NTLMv2 credentials. The vulnerable code path is reachable through two vectors: community presets fetched automatically from the remote preset repository when the victim opens the Community tab, and individual preset files imported directly by the victim via the preset import feature (handle_import_presets_from_file in file_management.rs). The second vector does not require control of the community preset repository and is triggered when a user imports a preset file shared through Discord, forums, or similar channels. 2026-07-30 6.5 CVE-2026-64816 DaveGamble--cJSON cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSON_Compare(). When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested document of a few hundred bytes (depth around 40) compared for equality consumes hours of CPU, and the cost roughly doubles with each additional level of nesting. An application that calls cJSON_Compare() on attacker-influenced JSON that is structurally equal to a reference document is exposed to a denial-of-service condition. 2026-07-29 5.9 CVE-2026-67216 DaveGamble--cJSON cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in apply_patch() in cJSON_Utils.c. For a replace operation that is missing its value member, or a move operation whose destination path cannot be resolved, the existing target member is detached and deleted before the operation is fully validated, so the target document is mutated while cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() returns a failure status. An attacker who can supply the patch document can destroy addressable members of the target document even though the API reports that the patch failed, defeating the all-or-nothing behavior callers rely on to reject bad patches. 2026-07-29 5.3 CVE-2026-67217 davejesch--Database Collation Fix The Database Collation Fix plugin for WordPress is vulnerable to time-based SQL Injection via the 'force-collation-algorithm' parameter in all versions up to, and including, 1.2.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires a trigger.txt file to be present in the plugin's directory (/wp-content/plugins/database-collation-fix/trigger.txt), a condition created by DesktopServer integration events such as site creation, copy, import, move, export, or deploy. 2026-08-01 5.3 CVE-2026-15018 decidim--decidim Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the normal download_your_data flow requires the requester to be logged in as the export owner, but the resulting Active Storage blob redirect URL can be replayed without authentication by anyone who obtains it. This is because Decidim::DownloadYourDataController#download_file authenticates the export owner but redirects to a signed Active Storage blob URL that is no longer bound to the owner session. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2. 2026-07-31 6.5 CVE-2026-45377 decidim--decidim Decidim is a participatory democracy framework. From 0.31.1 before 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, a participant can directly load /admin/demographics/questions/edit_questions and reach the demographics questionnaire editor without the required administrator authorization. The demographics questionnaire editor should require admin access, but the route under /admin/demographics/questions renders the editor interface without checking whether the caller is an admin. A normal participant can load the page and see the live update form action, which proves the protected interface is reachable. This issue is fixed in versions 0.31.5 and 0.32.0.rc2. 2026-07-31 5.4 CVE-2026-45086 decidim--decidim Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the GET /admin/organization/users search interpolates params[:term] into raw Arel.sql ORDER BY similarity expressions before sanitization, allowing an authenticated organization administrator to execute blind PostgreSQL expressions and infer data through timing differences. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2. 2026-07-31 5.5 CVE-2026-45376 decidim--decidim Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verification admin controllers load pending Authorization records by raw identifier without confirming current_organization ownership, allowing an administrator from one tenant to view, approve, or reject another tenant's ID-document request. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2. 2026-07-31 4.9 CVE-2026-45330 deveasel--Demi One Click Demo Import, Backup & Site Migration The Demi - One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Copy in all versions up to, and including, 0.0.8 via the handle_restore_step function. This is due to missing HTTP access controls on the wp-content/uploads/demi-backup-state/ directory, which exposes the cryptographic restore key used to both authenticate the unauthenticated AJAX handler and forge signed restore-state envelopes. This makes it possible for unauthenticated attackers to copy arbitrary files to attacker-controlled destinations on the server. An active restore operation must have been initiated, which writes the .restore_key and .restore_step_token files to the public upload directory, before the exposed secrets can be harvested and chained to achieve unauthenticated arbitrary file copy. 2026-07-28 5.3 CVE-2026-15012 devitemsllc--ShopLentor All-in-One WooCommerce Growth & Store Enhancement Plugin The ShopLentor - All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.5 via the 'optionSection' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to read arbitrary wp_options rows - including internal plugin news feed data, WooCommerce block pattern transients, and third-party configuration records - whose values are stored as arrays-of-arrays containing 'title' keys, enabling cross-plugin data leakage. 2026-07-28 4.3 CVE-2026-16797 devitemsllc--ShopLentor All-in-One WooCommerce Growth & Store Enhancement Plugin The ShopLentor - All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. 2026-07-28 4.9 CVE-2026-16811 dfir-iris--iris-web The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks. 2026-07-30 5.9 CVE-2026-16971 dfir-iris--iris-web The IRIS web application in version 2.4.26 and possibly others does not protect its user authentication against brute-force attacks. 2026-07-30 5.9 CVE-2026-18362 dfir-iris--iris-web The IRIS web application in version 2.4.26 and possibly others contains a logout functionality which is ineffective. Stolen session cookies can therefore be misused for a long time. 2026-07-30 4.2 CVE-2026-16970 dotonpaper--Pinpoint Booking System Version 2 The Pinpoint Booking System - Version 2 plugin for WordPress is vulnerable to blind SQL Injection via the 'field' parameter in all versions up to, and including, 2.9.9.6.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The nonce required to reach the vulnerable endpoint is emitted on all plugin admin pages loaded under manage_options, making it trivially obtainable by any authenticated administrator. 2026-08-01 4.9 CVE-2026-15403 drakkan--SFTPGo SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in a permitted directory that point to files in directories where download, upload, or overwrite permissions are denied. Attackers can exploit the create_symlinks permission combined with read and write access in one directory to read or modify files in restricted directories, as operations are authorized against the link's directory permissions rather than the dereferenced target's directory permissions. 2026-07-30 4.2 CVE-2026-10031 edge22--GenerateBlocks The GenerateBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Dynamic Tag Injection in HTML Attributes in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A Contributor-level attacker can store the malicious payload by placing a dynamic tag such as {{post_meta key:...}} in a non-URL HTML attribute (e.g., title, aria-label, alt, or data-* attributes) of a GenerateBlocks element block, then setting the corresponding unprotected post meta key via the Custom Fields metabox to a value containing a closing quote and an injected event-handler attribute. 2026-08-01 6.4 CVE-2026-13458 eLyiN--gemini-bridge gemini-bridge is a lightweight MCP server bridging AI agents to Google's Gemini AI via the official CLI. From 1.0.0 until 1.3.1, consult_gemini_with_files in inline mode read any file path supplied in the files argument without confining it to the working directory, then forwarded the contents to the Gemini CLI. Because the caller also controls query, the file contents are echoed back through the Gemini round-trip (and sent to Google), making this an arbitrary local file read. This issue is fixed in version 1.3.1. 2026-07-31 6.2 CVE-2026-54785 facturadorvirtual--Facturacin Electrnica Costa Rica The Facturación Electrónica Costa Rica plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on the (global scope, included by fvcr_admin_page_html) function. This makes it possible for unauthenticated attackers to modify the plugin's configuration, including API tokens, access tokens, economic activity, Hacienda environment mode, invoice and ticket emission flags, exchange rate, and branch settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. 2026-07-29 4.3 CVE-2026-9720 Flipper Code--WP Maps Insertion of Sensitive Information Into Sent Data vulnerability in Flipper Code WP Maps allows Retrieve Embedded Sensitive Data. This issue affects WP Maps: from n/a through 4.9.6. 2026-07-31 4.3 CVE-2026-28144 foomagoo--Plugin Organizer The Plugin Organizer plugin for WordPress is vulnerable to SQL Injection via the 'PO_plugin_path' parameter in versions up to, and including, 10.2.4. This is due to insufficient escaping on the user-supplied parameter in the perform_plugin_search() function, where esc_sql() output is passed as the replacement string to preg_replace(), which collapses backslash escapes and defeats the quoting protection; additionally, the AJAX handler lacks both nonce verification and capability checks. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. 2026-07-28 6.5 CVE-2026-15304 Franky--Events Made Easy Unauthenticated Broken Access Control in Events Made Easy prepare() format string, bypassing parameterization entirely. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. 2026-07-28 6.5 CVE-2026-15267 Themeisle--Feedzy Contributor Server Side Request Forgery (SSRF) in Feedzy

Read more »

Read This Before You Buy That TV Streaming Stick
Security experts have been sounding the alarm for years about the risks of using generic TV boxes that promise unlimited content streaming for a one-time fee, warning that they secretly rent the user's Internet connection out to strangers. But a groundbreaking new analysis finds these devices also routinely spoof themselves as mobile phones clicking ads on AI-generated websites as part of sprawling operation that seeks to defraud online merchants and advertising networks.

Read more »

Elevated network errors for traffic routed between North America origins and SIN (Singapore) colo
Aug 23, 02:00 UTCResolved - Between 23rd August 2026, 01:06 UTC - 01:54 UTC, some customers may have experienced elevated 5xx errors and timeouts for traffic between North American origins and our Singapore data centre. This issue is now resolved.

Read more »

Australia Voice Carrier Partner Maintenance
THIS IS A SCHEDULED EVENT Aug 31, 05:00 - 06:00 PDT Aug 21, 23:43 PDT Scheduled - Our Voice carrier partner in Australia is conducting a planned maintenance from 31 August 2026 at 05:00 PDT until 31 August 2026 at 06:00 PDT. During the maintenance window, there could be intermittent call disconnects or call failures from and to Twilio Australia phone numbers.

Read more »

Australia Voice Carrier Partner Maintenance
THIS IS A SCHEDULED EVENT Aug 27, 05:00 - 06:00 PDT Aug 21, 23:43 PDT Scheduled - Our Voice carrier partner in Australia is conducting a planned maintenance from 27 August 2026 at 05:00 PDT until 27 August 2026 at 06:00 PDT. During the maintenance window, there could be intermittent call disconnects or call failures from and to Twilio Australia phone numbers.

Read more »

Elevated R2 errors in Dubai (DXB)
Aug 22, 02:57 UTCResolved - This incident has been resolved.Aug 22, 02:31 UTCInvestigating - Customers in Dubai may see increased error rates for R2 requests.

Read more »

403 errors when trying to connect or reconnect to ActiveCampaign
Status: InvestigatingWe have reports that users who try to create new app connections or reconnect existing ones for ActiveCampaign receive a 403 error. This causes the connection to fail. Our Engineering team is looking into the issue and will follow up as soon as we learn more. If you're unable to log in, please open a case with our Support team at https://zapier.com/app/get-help so we can continue to keep you up-to-date.

Read more »

Zero Trust Client Posture Failures
Aug 21, 20:49 UTCIdentified - We have identified a customer configured provider that is timing out when sent posture check requests.Aug 21, 20:43 UTCInvestigating - We are investigating an issue where posture checks are failing for some customer service provider configurations. This is resulting in delays when accessing resources protected by WARP posture rules.

Read more »

SIN (Singapore) on 2026-08-25
Aug 21, 20:20 UTCScheduled - We will be performing scheduled maintenance in SIN (Singapore) datacenter on 2026-08-25 between 18:00 and 22:00 UTC. Traffic might be re-routed from this location, hence there is a possibility of a slight increase in latency during this maintenance window for end-users in the affected region. For PNI / CNI customers connecting with us in this location, please make sure you are expecting this traffic to fail over elsewhere during this maintenance window as network interfaces in this datacentre may become temporarily unavailable. You can now subscribe to these notifications via Cloudflare dashboard and receive these updates directly via email, PagerDuty and webhooks (based on your plan): https://developers.cloudflare.com/notifications/notification-available/#cloudflare-status.

Read more »

SIN (Singapore) on 2026-08-24
Aug 21, 20:20 UTCScheduled - We will be performing scheduled maintenance in SIN (Singapore) datacenter on 2026-08-24 between 18:00 and 22:00 UTC. Traffic might be re-routed from this location, hence there is a possibility of a slight increase in latency during this maintenance window for end-users in the affected region. For PNI / CNI customers connecting with us in this location, please make sure you are expecting this traffic to fail over elsewhere during this maintenance window as network interfaces in this datacentre may become temporarily unavailable. You can now subscribe to these notifications via Cloudflare dashboard and receive these updates directly via email, PagerDuty and webhooks (based on your plan): https://developers.cloudflare.com/notifications/notification-available/#cloudflare-status.

Read more »

Network Performance Issues in Asia Pacific Region
Aug 21, 17:47 UTCMonitoring - A fix has been implemented and we are monitoring the results.Aug 21, 17:39 UTCInvestigating - Cloudflare is investigating issues with Network Performance in Asia Pacific region. We are working to analyze and mitigate this problem. More updates to follow shortly.

Read more »

Emerging Service Issue – us-sea (Seattle, WA)
Aug 21, 17:23 UTC Investigating - Our team is investigating an emerging service issue affecting us-sea (Seattle, WA). We will share additional updates as we have more information.

Read more »

NQZ (Astana) on 2026-08-21
Aug 21, 16:50 UTCScheduled - We will be performing scheduled maintenance in NQZ (Astana) datacenter between 2026-08-21 19:00 and 2026-08-24 22:00 UTC. Traffic might be re-routed from this location, hence there is a possibility of a slight increase in latency during this maintenance window for end-users in the affected region. For PNI / CNI customers connecting with us in this location, please make sure you are expecting this traffic to fail over elsewhere during this maintenance window as network interfaces in this datacentre may become temporarily unavailable. You can now subscribe to these notifications via Cloudflare dashboard and receive these updates directly via email, PagerDuty and webhooks (based on your plan): https://developers.cloudflare.com/notifications/notification-available/#cloudflare-status.

Read more »

IAD (Ashburn) on 2026-08-24
Aug 21, 16:30 UTCScheduled - We will be performing scheduled maintenance in IAD (Ashburn) datacenter between 2026-08-24 08:00 and 2026-08-25 07:00 UTC. Traffic might be re-routed from this location, hence there is a possibility of a slight increase in latency during this maintenance window for end-users in the affected region. For PNI / CNI customers connecting with us in this location, please make sure you are expecting this traffic to fail over elsewhere during this maintenance window as network interfaces in this datacentre may become temporarily unavailable. You can now subscribe to these notifications via Cloudflare dashboard and receive these updates directly via email, PagerDuty and webhooks (based on your plan): https://developers.cloudflare.com/notifications/notification-available/#cloudflare-status.

Read more »

IAD (Ashburn) on 2026-08-24
Aug 21, 16:30 UTCScheduled - We will be performing scheduled maintenance in IAD (Ashburn) datacenter between 2026-08-24 08:00 and 2026-08-25 07:00 UTC. Traffic might be re-routed from this location, hence there is a possibility of a slight increase in latency during this maintenance window for end-users in the affected region. For PNI / CNI customers connecting with us in this location, please make sure you are expecting this traffic to fail over elsewhere during this maintenance window as network interfaces in this datacentre may become temporarily unavailable. You can now subscribe to these notifications via Cloudflare dashboard and receive these updates directly via email, PagerDuty and webhooks (based on your plan): https://developers.cloudflare.com/notifications/notification-available/#cloudflare-status.

Read more »

IAD (Ashburn) on 2026-08-24
Aug 21, 16:30 UTCScheduled - We will be performing scheduled maintenance in IAD (Ashburn) datacenter between 2026-08-24 08:00 and 2026-08-25 07:00 UTC. Traffic might be re-routed from this location, hence there is a possibility of a slight increase in latency during this maintenance window for end-users in the affected region. For PNI / CNI customers connecting with us in this location, please make sure you are expecting this traffic to fail over elsewhere during this maintenance window as network interfaces in this datacentre may become temporarily unavailable. You can now subscribe to these notifications via Cloudflare dashboard and receive these updates directly via email, PagerDuty and webhooks (based on your plan): https://developers.cloudflare.com/notifications/notification-available/#cloudflare-status.

Read more »

IAD (Ashburn) on 2026-08-24
Aug 21, 16:30 UTCScheduled - We will be performing scheduled maintenance in IAD (Ashburn) datacenter between 2026-08-24 08:00 and 2026-08-25 07:00 UTC. Traffic might be re-routed from this location, hence there is a possibility of a slight increase in latency during this maintenance window for end-users in the affected region. For PNI / CNI customers connecting with us in this location, please make sure you are expecting this traffic to fail over elsewhere during this maintenance window as network interfaces in this datacentre may become temporarily unavailable. You can now subscribe to these notifications via Cloudflare dashboard and receive these updates directly via email, PagerDuty and webhooks (based on your plan): https://developers.cloudflare.com/notifications/notification-available/#cloudflare-status.

Read more »

Aoub iPad 11th/10th Generation Keyboard Case for $21 + free shipping w/ $35
Anyone using their iPad for typing-heavy tasks like notes or emails will get more use out of it with a built-in keyboard than juggling a separate Bluetooth accessory. It suits students and remote workers who want their 11th or 10th generation iPad to double as a laptop replacement without extra bulk in the bag. Buy Now at Walmart Features Magnetic detachable keyboard for flexible use Built-in Apple Pencil holder for secure storage Three adjustable viewing angles for laptop-style use Auto wake/sleep function to extend battery life Model: A3354, A3355, A3356, A2696, A2757, A2777

Read more »

Magnetic Detachable Touchpad Keyboard Case for iPad 10th and 11th Generation for $50
Anyone who uses an iPad for actual work will appreciate having a real trackpad and keys without carrying a separate keyboard, and the detachable magnetic design means you can pop it off for tablet-only use in seconds. Buy Now at Newegg Features Magnetic detachable keyboard for iPad 10th and 11th Gen Integrated responsive touchpad Wireless connectivity for versatile use USB Type-C charging interface Modern, portable slim design

Read more »

Arteck iPad 10th Gen 10.9-inch Keyboard Case with Trackpad for $90
Turning your iPad 10th Gen into more of a laptop replacement, this case adds a trackpad and keyboard for anyone who does real typing or navigating instead of just tapping the screen. Newegg's version keeps the device protected while you work, which suits students and travelers who want one slim setup instead of packing a separate keyboard. Buy Now at Newegg Features 130-degree swivel rotating screen for flexible viewing Integrated precision trackpad for laptop-like navigation Bluetooth keyboard for comfortable wireless typing Full protection folio case design Model: iPad 10 Gen 10.9-inch

Read more »

Stylus Pen for iPad for $13 + free shipping w/ $35
Anyone using an iPad for note-taking or sketching can pair this with their tablet for palm-rejection and pressure-sensitive input without buying an Apple Pencil. Walmart has it marked down to $13 from the $100 list price, an 87% discount. Buy Now at Walmart Features Tilt and pressure sensitive precision Anti-touch palm rejection technology Magnetic side adsorption Three-month standby battery life USB-C charging with level display

Read more »

Kenke Keyboard Case for iPad 11th Gen 11-inch 2025 and 10th Gen 10.9-inch 2022 for $20 + free shipping w/ $35
This case suits anyone using their iPad 10th or 11th gen for typing-heavy work who wants keyboard functionality without carrying a separate accessory, and Walmart has it marked down to $20, a $10 (33%) cut off the $30 list price. Buy Now at Walmart Features Rechargeable battery for extended usage Integrated keyboard for iPad

Read more »

Vicvol Kids iPad 9.7-inch Case for $17 + free shipping w/ $35
Handy for parents whose kids toss tablets around, since the reinforced corners and grippy exterior are built to absorb drops without you having to hover nearby. Buy Now at Walmart Features Shock-absorbing EVA material protects against drops Built-in screen protector prevents scratches Easy-grip handle for children Multi-angle stand for landscape or portrait viewing Precise cutouts for full device access

Read more »

Fast Charging Stylus Pen for iPad for $13 + free shipping w/ $35
Anyone tired of hunting for AAA batteries will appreciate the fast-charging design, which juices up quickly via USB-C instead. Walmart has it for $12.88, roughly half off the $25 list price. Buy Now at Walmart Features Tilt sensitivity for precise shading and line control Palm rejection technology for comfortable writing Magnetic attachment for easy storage Pixel-perfect precision with low latency 20-hour battery life with quick charge

Read more »

Stylus Pen for iPad for $13 + free shipping w/ $35
Anyone who sketches, takes notes, or marks up PDFs on an iPad will get the most use out of this, and Walmart has it for $12.88, about $2 off the usual price. Buy Now at Walmart Features Precise tip prevents fingerprints on screen Ergonomic slim and lightweight pen design Instant one-button operation with no Bluetooth required Universal compatibility with all capacitive touch screens Ten hours of battery life with USB charging

Read more »

Xuduo iPad 10.2-inch Case (7th/8th/9th Gen) for $11 + free shipping w/ $35
Anyone who's cracked a screen from a drop knows the drill, and this case's built-in stand makes it a solid pick for propping up your iPad during video calls or movie nights without buying a separate stand. Buy Now at Walmart Features Premium PU leather exterior Hard-wearing durable construction Fingerprint-proof PC back cover Soft interior lining for protection Designed for iPad 10th Gen 10.9-inch

Read more »

Logitech Rugged Combo 4 Protective Keyboard Case for iPad 10th Gen for $120
Anyone who uses their iPad for schoolwork or typing-heavy tasks will appreciate the built-in keyboard and drop protection in one attached case, no separate keyboard or Bluetooth pairing needed. Buy Now at Newegg Features Protective case for iPad 10th gen Integrated physical keyboard Durable rugged design Model: 920-011133

Read more »

Kenke iPad Keyboard Case for $19 + free shipping w/ $35
Turns your iPad into a makeshift laptop for typing out emails or notes, which suits students or anyone tired of tapping on glass all day. Walmart has it for $18.89, about $5 off the $23.99 list price. Buy Now at Walmart Features Convert iPad into a fully functional laptop Enhance productivity for typing and editing tasks Improve efficiency for writing and note-taking Optimize viewing experience for watching videos Enable fast workflow for daily professional tasks

Read more »

KenKe Detachable Bluetooth Keyboard Case for iPad 10.2-inch for $19 + free shipping w/ $35
This case suits anyone who wants their 10.2-inch iPad to double as a laptop without carrying extra accessories, since the keyboard detaches when you just want the tablet. The price is essentially at list, with only a 10-cent reduction from $18.99 to $18.89. Buy Now at Walmart Features Compatible with iPad 7th, 8th, and 9th Gen Magnetic detachable keyboard for laptop-like typing Integrated Apple Pencil holder for easy storage Long-lasting battery with 70-hour runtime Auto sleep/wake function saves battery life

Read more »

KenKe iPad Pro 11-inch Case for $10 + free shipping w/ $35
Slim protection for an 11-inch iPad Pro if you want basic drop and scratch coverage without adding much bulk, and Walmart has it $4 off the list price. Buy Now at Walmart Features Compatible with iPad Pro 11 2nd and 3rd Gen Magnetic storage and wireless charging for Apple Pencil Airbag bumpers provide military-grade drop protection Auto sleep and wake function extends battery life Tri-fold stand for ergonomic typing and viewing angles

Read more »

KenKe iPad 9.7-Inch 5th/6th Generation Case for $10 + free shipping w/ $35
Walmart has the KenKe iPad 9.7-Inch Case for $9.89, about $4 off the $13.99 list price, a solid pick if you've got an older 5th or 6th generation iPad still in daily use and want basic drop protection without spending much on it. Buy Now at Walmart Features Model: A1822, A1893 Integrated Apple Pencil holder Auto wake and sleep magnetic cover Scratch-resistant soft shell back Dual-position folding viewing and typing stand

Read more »

ZAGG Pro Keys Connect iPad Air 11-inch Keyboard Case for $104 + free shipping
Anyone typing long documents or emails on an iPad will appreciate having a real keyboard and protective case combined into one accessory instead of juggling separate pieces, and it suits people who want their tablet to function more like a laptop. Buy Now at Amazon Features Plug-and-play USB-C connectivity with trackpad 6.6 ft military-grade drop protection Detachable keyboard and adjustable kickstand Seven-color backlit keys for low-light typing Dual USB-C ports for charging and accessory connectivity

Read more »