iOS 26 leak details multiple unreleased Apple products
An unreleased build of iOS 26 has revealed details about more than a dozen Apple hardware projects currently in development.An iOS 26 code leak confirmed the existence of multiple unreleased iPhone models, including the iPhone 17e.Following a series of reports last week, which provided insight into unreleased products like the next-generation AirTag, iPad Air, and Apple Studio Display, we now have additional information about the source of the leak.A prototype iPhone running an early build of iOS 26 was recently sold, and the operating system on the device has since been made publicly available. This allowed researchers to dig through the code in an effort to uncover more about the devices and projects Apple is currently working on. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

UK government to ‘encourage’ Apple and Google to include nudity-blocking software in OSes
The UK government is set to urge Apple and Google to embed advanced nudity-detection software directly into device operating systems… The post appeared first on MacDailyNews.

Read more »

Apple specialists to participate in White House’s ‘Tech Force’ initiative
The White House announced plans to recruit “an elite group of ~1,000 technology specialists” from companies such as Apple to serve two-year terms across federal agencies. Here are the details. more…

Read more »

Get Microsoft Office 2024 for Mac or PC for less than $150
This discounted Microsoft Office for Mac lifetime license is a great alternative to pricey monthly fees and subscriptions. (via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)

Read more »

Game development diary: Sound, music, and schedule speed bumps
After wrestling with Welsh for my iPhone game "Character Limit," there were two changes of pace in the last month. Both in terms of the work being carried out and when the game will actually ship.A build of my game 'Character Limit' running on an iPhoneIt's fair to say that, in my last development log, my implementation of Welsh was not one that was kind to the development schedule. Retrofitting multiple languages into a game that previously worked in one is hard, but necessary if I want to add more to the game.Indeed, the work on Welsh has taken so long that, while it technically works almost like it did before, there are still small elements that need fixing. There's enough crossover with things I want to change and update that they can be rolled up as part of the same item on the whiteboard to-do list. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

New in iOS 26.3: Android transfer settings, third-party notification forwarding
The first developer beta of iOS 26.3 is here, and with it, settings that make transferring to Android easier and notification forwarding for third-party wearables.iOS 26.3 delivers new settings for notification forwarding, and makes moving to Android easier.On Monday, just days after iOS 26.2 made its way to the general public, Apple started the iOS 26.3 beta testing cycle. The iPhone software update has the build number 23D5089e, up from 23C55 on the public release of iOS 26.2As a whole, iOS 26 and iPadOS 26 brought about a multitude of changes, the most visible being Apple's controversial "Liquid Glass" design language. The following update, iOS 26.1, delivered new toggles for existing system features, along with additional customization settings for Liquid Glass. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

9to5Mac Daily: December 15, 2025 – iOS 26.2 now available
Listen to a recap of the top stories of the day from 9to5Mac. 9to5Mac Daily is available on iTunes and Apple’s Podcasts app, Stitcher, TuneIn, Google Play, or through our dedicated RSS feed for Overcast and other podcast players. Sponsored by Backblaze: Give yourself the gift of peace of mind. Till the end of the month, 9to5Mac listeners get 30% off with code 9to5Xmas.  more…

Read more »

Developers get first look at iOS 26.3 and macOS Tahoe 26.3
There are new iOS 26.3 and macOS 26.3 betas from Apple. Developers can now begin testing and discovering new features. (via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)

Read more »

Telegram finally adds passkeys support
With the latest update, Telegram users can now create a passkey to instantly log in to their accounts without needing an SMS code or password. Here’s how to activate it. more…

Read more »

This hidden iOS feature is my daily go-to when using AirPods Pro 3
I use AirPods Pro 3 all day, every day while I work, and there’s one hidden iOS tool that I’ve found pairs perfectly with the product: it’s a little-known feature called Background Sounds. more…

Read more »

iOS 26.3 beta reveals how Apple plans to handle EU-required notification forwarding
The first iOS 26.3 beta includes a new user interface in preparation for the EU rule that will require Apple to allow third-party devices to access users’ notifications. Here’s how it’s going to work more…

Read more »

Protect your iPhone: Update to iOS 26.2 now for critical security fixes
iOS 26.2 security updates are crucial. Install now to protect your iPhone from newly identified threats and security vulnerabilities. (via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)

Read more »

Apple Music now available natively in all GM vehicles with standard streaming; Cadillac debuts studio-grade Spatial Audio in Dolby Atmos
Apple Music is coming natively to GM vehicles. Starting today, the app begins rolling out to select 2025 and newer Cadillac and Chevrolet… The post appeared first on MacDailyNews.

Read more »

iPhone Fold Touch ID rumor appears again, suggesting Face ID too thick
A new report says Apple's iPhone Fold may skip Face ID in favor of a slimmer side-mounted Touch ID sensor, citing thinness as an issue.iPhone Fold renderApple's long-rumored foldable iPhone, often referred to as the iPhone Fold, is widely expected to debut in 2026 based on repeated analyst and supply chain reports. While Apple hasn't confirmed the device, rumors over several years have consistently pointed to a book-style foldable focused on thinness and durability.Details shared on December 15 by Weibo leaker Digital Chat Station describe a book-style foldable iPhone focused on thinness and durability. The report highlights a side-mounted Touch ID sensor instead of Face ID. Rumor Score: 🤔 Possible Continue Reading on AppleInsider | Discuss on our Forums

Read more »

iOS 26.3 beta arrives launch of new Siri nears
Macworld Following the release of iOS 16.2 on Friday, December 12, the first beta release of iOS 26.3 was made available to developers a few days later, on December 15. We expect a final release to the public sometime in late January or early February. This is reportedly the last minor refresh before iOS 26.4 brings the revamped Siri upgrade we’ve waited over a year to get. iOS 26.3 beta: What’s new We don’t yet know what new features and changes to expect in iOS 26.3. We’ll update this section as we learn more. Easier switching between Android and iPhone: We expect iOS 26.3 will ship with support for an easier iOS/Android switching system made in collaboration with Google, and at the behest of the European Union. You can about that here. iOS 26.3 beta: How to install the public beta If you want to test the iOS 26 beta releases but are not a registered developer, follow these steps: Click Sign Up on the Apple Beta page and register with your Apple ID. Log in to the Beta Software Program. Click Enroll your iOS device. Open the Settings app, tap General, then Software Update. In the Beta Updates section, select the iOS Public Beta. It may take a few moments after registering for the beta option to appear in Software Update. iOS 26.3 beta: How to install the developer beta You’ll need to be registered as an Apple developer, but a free developer account will do. You can get one via Xcode or the Apple Developer app in iOS. Here’s how to do it via the Apple Developer app: Download the Apple Developer App from the App Store. Open the app. Tap on Account. Sign in using your usual Apple ID. Find out everything you need to know about iOS 26 in our iOS 26 superguide.

Read more »

Apple's 2026 executive shuffle is only the beginning as Cook nears retirement
Multiple retirements and a surprise departure has caused quite the change to Apple's leadership page. Here's how Apple's executive structure is expected to look in early 2026.CEO Tim Cook will see more changes to the Apple org chart than usual heading into 2026The body of people who run a company isn't static, as people join and leave organizations, and change their roles within them, all the time. With about 164,000 people in its ranks, Apple isn't immune to this phenomenon at all.That said, while most changes will be at low and mid-tier levels of the organizational chart, alterations at the top can have a big impact on everyone else below. Changes at a senior level are certainly impactful, C-level especially so. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Apple TV app update brings Google Cast support on Android
An update to the Apple TV app on Android phones and tablets today finally introduces Google Cast support, thus closing a big functionality gap since the launch earlier this year. more…

Read more »

Today in Apple history: AirPods Max supersize Apple’s audio magic
December 15, 2020, Apple released AirPods Max, its first over-ear headphones, touting the device's design and advanced computational audio. (via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)

Read more »

First developer betas of iOS 26.3, macOS Tahoe 26.3 now available
Apple has restarted the beta-testing process once again, with developer builds of iOS 26.3, iPadOS 26.3, watchOS 26.3, tvOS 26.3, visionOS 26.3, and macOS Tahoe 26.3 now available.Apple's hardware that works with the 26-generation operating systems - Image Credit: AppleAfter the public release of the 26.2 generation, which includes iOS 26.2 and others with the same version number, Apple is now working on the next set of updates.iOS 26.3 beta 1 is build 23D5089e Continue Reading on AppleInsider | Discuss on our Forums

Read more »

UK to “encourage” Apple and Google to put nudity-blocking systems on phones
Government seeks "nudity-detection algorithms" in iOS and Android, report says.

Read more »

MagSafe Monday: ESR delivers near wired charging speeds with its new Qi 2.2 3-in-1 charging station
For me, Qi 2.2 is quietly becoming one of the biggest upgrades to MagSafe we have seen since it launched with the iPhone 12. Faster charging speeds, better heat management, and stronger magnets make wireless charging feel a lot closer to a wired experience. ESR is already out front with hardware that takes full advantage of it, and their new 3-in-1 charging station is one of the best examples yet. more…

Read more »

Beta 1 for watchOS 26.3, tvOS 26.3, and more available now
Apple has just kicked off a new software cycle, with beta 1 now available for watchOS 26.3, tvOS 26.3, HomePod 26.3, and more. more…

Read more »

Apple releases macOS 26.3 beta 1, here’s what to expect
Just a few days after releasing macOS 26.2, Apple is now rolling out the first developer beta for macOS 26.3. Here’s what’s coming. more…

Read more »

Apple releases first iOS 26.3 beta for iPhone
Apple has released the first iOS 26.3 developer beta for iPhone. more…

Read more »

Computer Virus Protection Tips and How to Remove a Virus from Your Computer
Computer viruses continue to be a widespread and costly problem, affecting everyone from casual computer users to major organizations. Some of the most damaging incidents in history started with small actions that could have happened to anyone. The Melissa virus spread in 1999 because thousands of people opened what looked like a normal email attachment. […] The post appeared first on The Mac Security Blog.

Read more »

Microsoft Patch Tuesday, December 2025 Edition
Microsoft today pushed updates to fix at least 56 security flaws in its Windows operating systems and supported software. This final Patch Tuesday of 2025 tackles one zero-day bug that is already being exploited, as well as two publicly disclosed vulnerabilities.

Read more »

Drones to Diplomas: How Russia’s Largest Private University is Linked to a $25M Essay Mill
A sprawling academic cheating network turbocharged by Google Ads that has generated nearly $25 million in revenue has curious connections to a Kremlin-connected oligarch whose Russian university builds drones for Russia's war against Ukraine.

Read more »

SMS Phishers Pivot to Points, Taxes, Fake Retailers
China-based phishing groups blamed for non-stop scam SMS messages about a supposed wayward package or unpaid toll fee are promoting a new offering, just in time for the holiday shopping season: Phishing kits for mass-creating fake but convincing e-commerce websites that convert customer payment card data into mobile wallets from Apple and Google. Experts say these same phishing groups also are now using SMS lures that promise unclaimed tax refunds and mobile rewards points.

Read more »

Vulnerability Summary for the Week of November 24, 2025
High Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info Patch Info 0x4m4--HexStrike AI By providing a command-line argument starting with a semi-colon ; to an API endpoint created by the EnhancedCommandExecutor class of the HexStrike AI MCP server, the resultant composed command is executed directly in the context of the MCP server's normal privilege; typically, this is root. There is no attempt to sanitize these arguments in the default configuration of this MCP server at the affected version (as of commit 2f3a5512 in September of 2025). 2025-11-30 9.1 CVE-2025-35028 https://takeonme.org/gcves/GCVE-1337-2025-00000000000000000000000000000000000000000000000000111111111111111111111111000000000000000000000000000000000000000000000000000000011  AMD--AMD Prof Improper return value within AMD uProf can allow a local attacker to bypass KSLR, potentially resulting in loss of confidentiality or availability. 2025-11-24 7.1 CVE-2025-48510 https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-9019.html  AMD--Xilinx Run Time (XRT) Improper input validation within the XOCL driver may allow a local attacker to generate an integer overflow condition, potentially resulting in loss of confidentiality or availability. 2025-11-24 8 CVE-2025-52538 https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8014.html  AMD--Xilinx Run Time (XRT) Inadequate lock protection within Xilinx Run time may allow a local attacker to trigger a Use-After-Free condition potentially resulting in loss of confidentiality or availability 2025-11-24 7.3 CVE-2025-0003 https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8014.html  AMD--Xilinx Run Time (XRT) Improper input validation within the XOCL driver may allow a local attacker to generate an integer overflow condition, potentially resulting in crash or denial of service. 2025-11-24 7.3 CVE-2025-0005 https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8014.html  AMD--Xilinx Run Time (XRT) A buffer overflow with Xilinx Run Time Environment may allow a local attacker to read or corrupt data from the advanced extensible interface (AXI), potentially resulting in loss of confidentiality, integrity, and/or availability. 2025-11-24 7.3 CVE-2025-52539 https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8014.html  ASR--Lapwing_Linux Out-of-bounds Read vulnerability in ASR1903ASR3901 in ASR Lapwing_Linux on Linux (nr_fw modules). This vulnerability is associated with program files Code/nr_fw/DLP/src/NrCgi.C. This issue affects Lapwing_Linux: before 2025/11/26. 2025-11-26 7.4 CVE-2025-13735 https://www.asrmicro.com/en/goods/psirt?cid=41  blubrry--PowerPress Podcasting plugin by Blubrry The Blubrry PowerPress plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in all versions up to, and including, 11.15.2. This is due to the plugin validating file extensions but not halting execution when validation fails in the 'powerpress_edit_post' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. 2025-11-27 8.8 CVE-2025-13536 https://www.wordfence.com/threat-intel/vulnerabilities/id/d420ee49-e7b3-43d8-a263-8a93abd1133c?source=cvehttps://plugins.trac.wordpress.org/browser/powerpress/tags/11.14.1/powerpressadmin.php#L3068https://plugins.trac.wordpress.org/browser/powerpress/tags/11.14.1/powerpressadmin.php#L3012https://plugins.trac.wordpress.org/browser/powerpress/tags/11.14.1/powerpressadmin.php#L2368https://plugins.trac.wordpress.org/changeset/3402635/  Chanjet--CRM A vulnerability has been found in Chanjet CRM up to 20251106. The impacted element is an unknown function of the file /tools/upgradeattribute.php. The manipulation of the argument gblOrgID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. 2025-11-30 7.3 CVE-2025-13788 VDB-333792 | Chanjet CRM upgradeattribute.php sql injectionVDB-333792 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #690084 | Chanjet CRM V1.0 SQL Injectionhttps://github.com/Bellingham-max/CVE/issues/1  code-projects--COVID Tracking System A vulnerability was detected in code-projects COVID Tracking System 1.0. This issue affects some unknown processing of the file /login.php. The manipulation of the argument code results in sql injection. The attack may be performed from remote. The exploit is now public and may be used. 2025-11-24 7.3 CVE-2025-13585 VDB-333349 | code-projects COVID Tracking System login.php sql injectionVDB-333349 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #699840 | code-projects COVID Tracking System V1.0 SQL Injectionhttps://github.com/beamyou/CVE/issues/4https://code-projects.org/  code-projects--Jonnys Liquor A security flaw has been discovered in code-projects Jonnys Liquor 1.0. Affected by this issue is some unknown functionality of the file /detail.php of the component GET Parameter Handler. Performing manipulation of the argument Product results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited. 2025-11-24 7.3 CVE-2025-13582 VDB-333346 | code-projects Jonnys Liquor GET Parameter detail.php sql injectionVDB-333346 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #699554 | code-projects Jonnys Liquor 1.0 /detail.php SQL injectionhttps://github.com/rassec2/dbcve/issues/5https://code-projects.org/  code-projects--Library System A vulnerability has been found in code-projects Library System 1.0. This affects an unknown function of the file /index.php of the component Login. The manipulation of the argument Username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. 2025-11-24 7.3 CVE-2025-13578 VDB-333342 | code-projects Library System Login index.php sql injectionVDB-333342 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #699536 | code-projects Library System 1.0 index.php SQL Injectionhttps://github.com/rassec2/dbcve/issues/4https://code-projects.org/  code-projects--Question Paper Generator A weakness has been identified in code-projects Question Paper Generator 1.0. This affects an unknown part of the file /signupscript.php of the component POST Parameter Handler. Executing manipulation of the argument Fname can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be exploited. 2025-11-24 7.3 CVE-2025-13583 VDB-333347 | code-projects Question Paper Generator POST Parameter signupscript.php sql injectionVDB-333347 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #699591 | code-projects question paper 1.0 /signupscript.php SQL Injectionhttps://github.com/rassec2/dbcve/issues/6https://code-projects.org/  cursor--cursor Improper neutralization of special elements used in an OS command ('command injection') in Cursor allows an unauthorized attacker to execute commands that are outside of those specified in the allowlist, resulting in arbitrary code execution. 2025-11-26 9.8 CVE-2025-62354 https://hiddenlayer.com/sai_security_advisor/2025-11-cursor/  Dassault Systmes--DELMIA Service Process Engineer A stored Cross-site Scripting (XSS) vulnerability affecting Service Items Management in DELMIA Service Process Engineer on Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session. 2025-11-24 8.7 CVE-2025-10555 https://www.3ds.com/trust-center/security/security-advisories/cve-2025-10555  Dassault Systmes--ENOVIA Product Manager A stored Cross-site Scripting (XSS) vulnerability affecting Requirements in ENOVIA Product Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session. 2025-11-24 8.7 CVE-2025-10554 https://www.3ds.com/trust-center/security/security-advisories/cve-2025-10554  DirectoryThemes--Tiger The Tiger theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 101.2.1. This is due to the 'paypal-submit.php' file not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site. 2025-11-27 9.8 CVE-2025-13675 https://www.wordfence.com/threat-intel/vulnerabilities/id/4750b57e-7d8d-49d7-bbbf-46483eb97bd9?source=cvehttps://themeforest.net/item/tiger-social-network-theme-for-companies-professionals/16203995  DirectoryThemes--Tiger The Tiger theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 101.2.1. This is due to the plugin allowing a user to update the user role through the $user- >set_role() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator. 2025-11-27 8.8 CVE-2025-13680 https://www.wordfence.com/threat-intel/vulnerabilities/id/645f60ad-c8e5-47ec-94f1-960de4ef7838?source=cvehttps://themeforest.net/item/tiger-social-network-theme-for-companies-professionals/16203995  Eaton--Eaton Galileo Software Improper input sanitization in the file archives upload functionality of Eaton Galileo software allows traversing paths which could lead into an attacker with local access to execute unauthorized code or commands. This security issue has been fixed in the latest version of Galileo which is available on the Eaton download center. 2025-11-27 7.3 CVE-2025-59890 https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2025-1024.pdf  Elated Themes--FindAll Listing The FindAll Listing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.5. This is due to the 'findall_listing_user_registration_additional_params' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site. Note: The vulnerability can only be exploited if the FindAll Membership plugin is also activated, because user registration is in that plugin. 2025-11-27 9.8 CVE-2025-13538 https://www.wordfence.com/threat-intel/vulnerabilities/id/14981949-271c-4f98-a6a1-b00619f1436d?source=cvehttps://themeforest.net/item/findall-business-directory-theme/24415962  Elated Themes--FindAll Membership The FindAll Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.4. This is due to the plugin not properly logging in a user with the data that was previously verified through the 'findall_membership_check_facebook_user' and the 'findall_membership_check_google_user' functions. This makes it possible for unauthenticated attackers to log in as administrative users, as long as they have an existing account on the site which can easily be created by default through the temp user functionality, and access to the administrative user's email. 2025-11-27 9.8 CVE-2025-13539 https://www.wordfence.com/threat-intel/vulnerabilities/id/a856a96a-68d2-462d-b523-840668980807?source=cvehttps://themeforest.net/item/findall-business-directory-theme/24415962  factionsecurity--faction FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to version 1.7.1, an extension execution path in Faction's extension framework permits untrusted extension code to execute arbitrary system commands on the server when a lifecycle hook is invoked, resulting in remote code execution (RCE) on the host running Faction. Due to a missing authentication check on the /portal/AppStoreDashboard endpoint, an attacker can access the extension management UI and upload a malicious extension without any authentication, making this vulnerability exploitable by unauthenticated users. This issue has been patched in version 1.7.1. 2025-11-26 9.7 CVE-2025-66022 https://github.com/factionsecurity/faction/security/advisories/GHSA-xr72-2g43-586whttps://github.com/factionsecurity/faction/commit/c6389f1c76175b7c1c68d1a87b389311b16c62c3  fugue-project--fugue Fugue is a unified interface for distributed computing that lets users execute Python, Pandas, and SQL code on Spark, Dask, and Ray with minimal rewrites. In version 0.9.2 and prior, there is a remote code execution vulnerability by pickle deserialization via FlaskRPCServer. The Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the _decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC server. The vulnerability exists in the RPC communication mechanism where the client can send arbitrary serialized Python objects that will be deserialized on the server side, allowing attackers to execute arbitrary code on the victim's machine. This issue has been patched via commit 6f25326. 2025-11-25 8.8 CVE-2025-62703 https://github.com/fugue-project/fugue/security/advisories/GHSA-xv5p-fjw5-vrj6https://github.com/fugue-project/fugue/commit/6f25326779fd1f528198098d6287c5a863176fc0  geoserver--geoserver GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.26.2 and before 2.25.6, an XML External Entity (XXE) vulnerability was identified. The application accepts XML input through a specific endpoint /geoserver/wms operation GetMap. However, this input is not sufficiently sanitized or restricted, allowing an attacker to define external entities within the XML request. This issue has been patched in GeoServer 2.25.6, GeoServer 2.26.3, and GeoServer 2.27.0. 2025-11-25 8.2 CVE-2025-58360 https://github.com/geoserver/geoserver/security/advisories/GHSA-fjf5-xgmq-5525https://osgeo-org.atlassian.net/browse/GEOS-11682  GitLab--GitLab GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that could have allowed an unauthenticated user to cause a Denial of Service condition by sending specifically crafted requests containing malicious JSON payloads. 2025-11-26 7.5 CVE-2025-12571 GitLab Issue #579168HackerOne Bug Bounty Report #3362239  GL-Inet--GL-AXT1800 A firmware downgrade vulnerability exists in the OTA Update functionality of GL-Inet GL-AXT1800 4.7.0. A specially crafted .tar file can lead to a firmware downgrade. An attacker can perform a man-in-the-middle attack to trigger this vulnerability. 2025-11-24 8.3 CVE-2025-44018 https://talosintelligence.com/vulnerability_reports/TALOS-2025-2230  HCL Software--iNotes HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input. A remote, unauthenticated attacker can specially craft a URL to execute script in a victim's Web browser within the security context of the hosting Web site and/or steal the victim's cookie-based authentication credentials. 2025-11-25 8.1 CVE-2025-0248 https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0127032  Huawei--HarmonyOS Permission control vulnerability in the memory management module. Impact: Successful exploitation of this vulnerability may affect confidentiality. 2025-11-28 9.3 CVE-2025-64314 https://consumer.huawei.com/cn/support/bulletinlaptops/2025/11/  Huawei--HarmonyOS Permission control vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. 2025-11-28 8.4 CVE-2025-58302 https://consumer.huawei.com/en/support/bulletin/2025/11/  Huawei--HarmonyOS UAF vulnerability in the screen recording framework module. Impact: Successful exploitation of this vulnerability may affect availability. 2025-11-28 8.4 CVE-2025-58303 https://consumer.huawei.com/en/support/bulletin/2025/11/  Huawei--HarmonyOS Permission control vulnerability in the distributed component. Impact: Successful exploitation of this vulnerability may affect service confidentiality. 2025-11-28 8 CVE-2025-58310 https://consumer.huawei.com/en/support/bulletin/2025/11/  Huawei--HarmonyOS Vulnerability of improper criterion security check in the call module. Impact: Successful exploitation of this vulnerability may cause features to perform abnormally. 2025-11-28 7.3 CVE-2025-58308 https://consumer.huawei.com/en/support/bulletin/2025/11/  Huawei--HarmonyOS DoS vulnerability in the video-related system service module. Impact: Successful exploitation of this vulnerability may affect availability. 2025-11-28 7.3 CVE-2025-58316 https://consumer.huawei.com/en/support/bulletin/2025/11/  Janitza--UMG 96-PA An unauthenticated remote attacker can send a specially crafted Modbus read command to the device which leads to a denial of service. 2025-11-24 7.5 CVE-2025-41729 https://certvde.com/de/advisories/VDE-2025-094  kiteworks--security-advisories Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, a bug in Kiteworks MFT could cause under certain circumstances that a user's active session would not properly time out due to inactivity. This issue has been patched in version 9.1.0. 2025-11-29 7.1 CVE-2025-53896 https://github.com/kiteworks/security-advisories/security/advisories/GHSA-23h2-3jj8-58hm  kiteworks--security-advisories Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, the back-end of Kiteworks MFT is vulnerable to an incorrectly specified destination in a communication channel which allows an attacker with administrative privileges on the system under certain circumstances to intercept upstream communication which could lead to an escalation of privileges. This issue has been patched in version 9.1.0. 2025-11-29 7.2 CVE-2025-53899 https://github.com/kiteworks/security-advisories/security/advisories/GHSA-5gx5-vcpp-8cr5  Logpoint--SIEM An issue was discovered in Logpoint before 7.7.0. Insufficient input validation and a lack of output escaping in multiple components leads to a cross-site scripting (XSS) vulnerability. 2025-11-27 8.5 CVE-2025-66359 https://servicedesk.logpoint.com/hc/en-us/articles/29158899698333-XSS-Vulnerability-due-to-insufficient-input-validation  Mattermost--Mattermost Mattermost versions 10.12.x

Read more »

Cybersecurity Best Practices: Essential Tips for Modern Mac Security
Cybersecurity affects every person who uses a device, connects to the internet, pays bills online, or stores important files digitally. The rise of cloud services, mobile apps, and complex online accounts has created new opportunities for criminals to target individuals. Mac users benefit from strong built-in protections, but threats now focus less on operating systems […] The post appeared first on The Mac Security Blog.

Read more »

What Is a Network Security Key? How to Find Your Wi-Fi Password on Any Device
If you have ever tried connecting a new phone, laptop, tablet, or smart home device to your Wi-Fi network, you have likely been asked for something called a network security key. The name sounds technical, but it simply refers to the password that protects your wireless network. Understanding what a network security key is, how […] The post appeared first on The Mac Security Blog.

Read more »

Meet Rey, the Admin of ‘Scattered Lapsus$ Hunters’
A prolific cybercriminal group that calls itself "Scattered LAPSUS$ Hunters" made headlines regularly this year by stealing data from and publicly mass extorting dozens of major corporations. But the tables seem to have turned somewhat for "Rey," the moniker chosen by the technical operator and public face of the hacker group: Earlier this week, Rey confirmed his real life identity and agreed to an interview after KrebsOnSecurity tracked him down and contacted his father.

Read more »

Is Your Android TV Streaming Box Part of a Botnet?
On the surface, the Superbox media streaming devices for sale at retailers like BestBuy and Walmart may seem like a steal: They offer unlimited access to more than 2,200 pay-per-view and streaming services like Netflix, ESPN and Hulu, all for a one-time fee of around $400. But security experts warn these TV boxes require intrusive software that forces the user's network to relay Internet traffic for others, traffic that is often tied to cybercrime activity such as advertising fraud and account takeovers.

Read more »

Vulnerability Summary for the Week of November 17, 2025
High Vulnerabilities PrimaryVendor — Product Description Published CVSS Score Source Info Patch Info ABB–ABB Ability Edgenius Authentication Bypass Using an Alternate Path or Channel vulnerability in ABB ABB Ability Edgenius.This issue affects ABB Ability Edgenius: 3.2.0.0, 3.2.1.1. 2025-11-20 9.6 CVE-2025-10571 https://search.abb.com/library/Download.aspx?DocumentID=7PAA022088&LanguageCode=en&DocumentPartId=&Action=Launch  AMD–AMD StoreMI A DLL hijacking vulnerability in AMD StoreMIâ„¢ could allow an attacker to […]

Read more »

Cloud Security Tips: How to Protect Your Data in the Cloud
Cloud storage has become woven into the way people save, share, and collaborate on files. From personal photos to business documents, the cloud makes information easy to access from nearly any device. Yet this convenience can also create security risks. If an attacker gains access to a cloud account, they may be able to view […] The post appeared first on The Mac Security Blog.

Read more »

Mozilla Says It’s Finally Done With Two-Faced Onerep
In March 2024, Mozilla said it was winding down its collaboration with Onerep -- an identity protection service offered with the Firefox web browser that promises to remove users from hundreds of people-search sites -- after KrebsOnSecurity revealed Onerep's founder had created dozens of people-search services and was continuing to operate at least one of them. Sixteen months later, however, Mozilla is still promoting Onerep. This week, Mozilla announced their partnership with Onerep will officially end next month.

Read more »

The Cloudflare Outage May Be a Security Roadmap
An intermittent outage at Cloudflare on Tuesday briefly knocked many of the Internet's top destinations offline. Some affected Cloudflare customers were able to pivot away from the platform temporarily so that visitors could still access their websites. But security experts say doing so may have also triggered an impromptu network penetration test for organizations that have come to rely on Cloudflare to block many types of abusive and malicious traffic.

Read more »

Microsoft Patch Tuesday, November 2025 Edition
Microsoft this week pushed security updates to fix more than 60 vulnerabilities in its Windows operating systems and supported software, including at least one zero-day bug that is already being exploited. Microsoft also fixed a glitch that prevented some Windows 10 users from taking advantage of an extra year of security updates, which is nice because the zero-day flaw and other critical weaknesses patched today affect all versions of Windows, including Windows 10.

Read more »

Google Sues to Disrupt Chinese SMS Phishing Triad
Google is suing more than two dozen unnamed individuals allegedly involved in peddling a popular China-based mobile phishing service that helps scammers impersonate hundreds of trusted brands, blast out text message lures, and convert phished payment card data into mobile wallets from Apple and Google.

Read more »

Take $440 off Apple’s 16-inch MacBook Pros with the latest Holiday sale prices
Amazon has 16-inch M4 Pro and M4 Max MacBook Pros (Silver and Black colors) on sale for up to $440 off Apple's MSRP as part of their Holiday sales. Shipping is free. Be sure to select Amazon as the seller, rather than a third-party seller: - 16" M4 Pro MacBook Pro (24GB/512GB/Black): $2199, $300 off MSRP - 16" M4 Pro MacBook Pro (24GB/512GB/Silver): $2190.08, $309 off MSRP - 16" M4 Pro MacBook Pro (48GB/512GB/Black): $2529, $370 off MSRP - 16" M4 Pro MacBook Pro (48GB/512GB/Silver): $2549, $350 off MSRP - 16" M4 Max MacBook Pro (36GB/1TB/Black): $3063.84, $436 off MSRP - 16" M4 Max MacBook Pro (36GB/1TB/Silver): $3059.76, $440 off MSRP - 16" M4 Max MacBook Pro (48GB/1TB/Black): $3599, $400 off MSRP - 16" M4 Max MacBook Pro (48GB/1TB/Silver): $3599, $400 off MSRP These are the lowest Holiday sale prices on new 16" Apple MacBook Pros right now. For the latest sales and prices, keep an eye on our 16-inch MacBook Pro Price Tracker, updated daily.

Read more »

Sunday Holiday Sale: Take $200-$250 off M4 MacBook Airs, prices start at only $749
Amazon has all 13" M4 MacBook Airs and 15" M4 MacBook Airs on Holiday sale for $200-$250 off Apple's MSRP, starting at only $749. Be sure to select Amazon as the seller, rather than a third-party: - 13" M4 MacBook Air (16GB/256GB): $749, $250 off - 13" M4 MacBook Air (16GB/512GB): $949, $250 off - 13" M4 MacBook Air (24GB/512GB): $1149, $250 off - 15" M4 MacBook Air (16GB/256GB): $999, $200 off - 15" M4 MacBook Air (16GB/512GB): $1199, $200 off - 15" M4 MacBook Air (24GB/512GB/): $1399, $200 off Their prices are the lowest available for new M4 MacBook Airs anywhere and represent one of the best Holiday deals on Apple products available right now. For the latest sales & prices, see our 13" MacBook Air Price Tracker and 15" MacBook Air Price Tracker, both updated daily.

Read more »

Holiday Sale: M4 Mac minis available starting at only $479
Amazon has M4 and M4 Pro Mac minis on Holiday sale starting at only $479 and ranging up to $120 off MSRP. Shipping is free: - Mac mini M4 (16GB/256GB): $479, $120 off MSRP - Mac mini M4 (16GB/512GB): $699, $100 off MSRP - Mac mini M4 (24GB/512GB): $923, $26 off MSRP - Mac mini M4 Pro (24GB/512GB): $1287, $112 off MSRP These are the lowest Holiday sale prices currently available on Mac minis. For the latest prices and sales, keep an eye on our Mac mini Price Tracker, updated daily.

Read more »

Walmart if offering a $100 Apple Watch Series 11 Holiday discount this weekend
Walmart is now offering a $100 online discount on new Apple Watch Series 11 models as part of their Holiday sales. Sale prices for online orders only, in-store prices may vary. Order online and choose free shipping or free local store pickup (if available): - 42mm Apple Watch Series 11 GPS: $299, save $100 - 46mm Apple Watch Series 11 GPS: $329, save $100 - 42mm Apple Watch Series 11 GPS + 5G: $399, save $100 - 46mm Apple Watch Series 11 GPS + 5G: $429, save $100 These are the lowest Holiday sale prices available for Apple Watch Series 11 models. For the latest prices & sales, keep an eye on our Apple Watch Price Tracker, updated daily.

Read more »

Apple Watch SE 3 on sale this weekend for $50 off MSRP, prices start at $199
Walmart has Apple Watch SE 3 models on sale on their online store for $50 off MSRP as part of their ongoing Holiday savings. Sale prices for online orders only, in-store prices may vary. Order online and choose free shipping or free local store pickup (if available): - 40mm Apple Watch SE GPS: $199, $50 off MSRP - 44mm Apple Watch SE GPS: $229, $50 off MSRP - 40mm Apple Watch SE GPS + 5G: $249, $50 off MSRP - 44mm Apple Watch SE GPS + 5G: $279, $50 off MSRP These are the lowest Holiday prices available for Apple Watch SE 3 models. For the latest prices & deals, keep an eye on our Apple Watch Price Tracker, updated daily.

Read more »

AirPods Pro 3 on Holiday Sale for $50 off Apple’s MSRP, now only $199
Amazon has Apple AirPods Pro 3 on Holiday sale for $50 off MSRP, including free shipping: - AirPods Pro 3: $199, $50 off Their price is the lowest we've seen so far for these new AirPods Pro models. Keep an eye on our AirPods Price Tracker for the latest prices and deals, updated daily.

Read more »

Holiday Sale: 24-inch iMacs for $150-$170 off MSRP
Amazon has Apple's 24-inch M4 iMacs on Holiday sale for $150-$170 off MSRP, starting at $1149, each including free shipping: - 24-inch M4 iMac (8-Core CPU, 16GB RAM, 256GB SSD): $1149, $150 off MSRP - 24-inch M4 iMac (10-Core CPU, 16GB RAM, 256GB SSD): $1349, $150 off MSRP - 24-inch M4 iMac (10-Core CPU, 16GB RAM, 512GB SSD): $1549, $150 off MSRP - 24-inch M4 iMac (8-Core CPU, 24GB RAM, 512GB SSD): $1729-1749, $150-$170 off MSRP Amazon's prices are the lowest available for one of these new iMacs. Note that stock can vary. Price posted above is the lowest price available for each standard configuration, regardless of color. For the latest prices and deals, see our iMac Price Tracker, updated daily.

Read more »

Holiday Sale: Apple 11-inch M3 iPads for $100-$50 off MSRP
Take $100-$50 off 11-inch M3 iPad Airs at Amazon as part of their ongoing Holiday sale. Shipping is free: - 11" 128GB WiFi M3 iPad Air: $499, $100 off MSRP - 11" 256GB WiFi M3 iPad Air: $599, $100 off MSRP - 11" 512GB WiFi M3 iPad Air: $824.99, $75 off MSRP - 11" 1TB WiFi M3 iPad Air: $1049, $50 off MSRP Be sure to order from Amazon itself rather than a third-party seller. These are the lowest prices currently available for new 11" M3-powered iPad Airs. For the latest prices & sales, keep an eye on our iPad Air Price Tracker, updated daily.

Read more »

27-inch 5K Studio Displays back in stock and on Holiday sale starting at $1368, up to $231 off MSRP
Amazon has Apple Studio Displays (Standard Glass) back in stock and on Holiday sale starting at $1368, up to $231 off MSRP. Shipping is free: - Studio Display (Tilt Adjustable): $1368 $231 off MSRP - Studio Display (Tilt & Height Adjustable): $1849 $150 off MSRP Their prices are the lowest available for Studio Displays among the retailers we track, and $1368 is the lowest price we've seen for a new Studio Display for the past few months. For the latest prices and sales, see our Studio Display Price Tracker, updated daily.

Read more »

2nd generation Apple HomePods on sale for $20 off MSRP with free 1-2 day shipping
B&H Photo has Apple's 2nd generation full-size HomePods (White or Midnight) on sale for $20 off MSRP. This is the steepest discount available on 2nd-gen HomePods among the Apple retailers we track. In addition, B&H offers free 1-2 day shipping on these models to most US addresses: - HomePod (White): $279, save $20 - HomePod (Midnight): $279, save $20 See our HomePod Price Tracker for the latest prices and deals from Apple and its resellers.

Read more »

Update: Apple’s new 14-inch M5 MacBook Pros on Holiday sale again for $250 off MSRP, prices start at $1349
Amazon is now offering $250 discounts on new 14" M5 MacBook Pros as part of their Holiday sales, each including free shipping: - 14" M5 MacBook Pro (16GB/512GB/Black): $1349, MSRP $1599 - 14" M5 MacBook Pro (16GB/512GB/Silver): $1349, MSRP $1599 - 14" M5 MacBook Pro (16GB/1TB/Black): $1549, MSRP $1799 - 14" M5 MacBook Pro (16GB/1TB/Silver): $1599.00, MSRP $1799 - 14" M5 MacBook Pro (24GB/1TB/Black): $1749, MSRP $1999 - 14" M5 MacBook Pro (24GB/1TB/Silver): $1749, MSRP $1999 These are the lowest prices available for new M5 MacBook Pros right now. For the latest sales and prices, keep an eye on our 14-inch MacBook Pro Price Tracker, updated daily.

Read more »

The latest AirPods Holiday sales: Take $80 off AirPods 4 w/ANC, $30 off AirPods Pro 3
Amazon has Apple AirPods 4 with ANC and AirPods Pro 3 on Holiday sale for up to $80 off MSRP, including free shipping: - AirPods 4 with ANC: $99.99, $80 off - AirPods Pro 3: $219.99, $30 off These are currently the lowest Holiday sale prices available for these AirPods models. Keep an eye on our AirPods Price Tracker for the latest prices and deals, updated daily.

Read more »

Lowest Holiday Sale Price Alert! Apple Watch Series 11 models for $100 off MSRP
Amazon is now offering a $100 discount on new Apple Watch Series 11 models as part of their Holiday sales. Shipping is free: - 42mm Apple Watch Series 11 GPS: $299, save $100 - 46mm Apple Watch Series 11 GPS: $329, save $100 - 42mm Apple Watch Series 11 GPS + 5G: $399, save $100 - 46mm Apple Watch Series 11 GPS + 5G: $429, save $100 These are the lowest prices available for Apple Watch Series 11 models. For the latest prices & sales, keep an eye on our Apple Watch Price Tracker, updated daily.

Read more »

Holiday Sale: Take $200-$100 off Apple’s new 14-inch M5 MacBook Pros, prices start at only $1399
Amazon is offering $200-$100 discounts on new 14" M5 MacBook Pros as part of their Holiday sales this weekend, each including free shipping: - 14" M5 MacBook Pro (16GB/512GB/Black): $1399, MSRP $1599 - 14" M5 MacBook Pro (16GB/512GB/Silver): $1399, MSRP $1599 - 14" M5 MacBook Pro (16GB/1TB/Black): $1599, MSRP $1799 - 14" M5 MacBook Pro (16GB/1TB/Silver): $1599, MSRP $1799 - 14" M5 MacBook Pro (24GB/1TB/Black): $1849, MSRP $1999 - 14" M5 MacBook Pro (24GB/1TB/Silver): $1899, MSRP $1999 These are the lowest prices available for new M5 MacBook Pros right now. For the latest sales and prices, keep an eye on our 14-inch MacBook Pro Price Tracker, updated daily.

Read more »

Here are this weekend’s lowest Holiday sale prices on Apple 14-inch M4 Pro and M4 Max MacBook Pros
Apple retailers are offering Holiday sale prices on 14" M4 Pro and M4 Max MacBook Pros ranging up to $400 off Apple's MSRP. Here at the lowest prices currently available: (1): Amazon has Apple's 14-inch M4 Pro and M4 Max MacBook Pros (Silver and Black colors) on Holiday sale for up to $400 off MSRP. Shipping is free. Be sure to select Amazon as the seller, rather than a third-party seller: - 14" M4 Pro MacBook Pro (24GB/512GB): $1749, $250 off MSRP - 14" M4 Pro MacBook Pro (24GB/1TB): $2099, $300 off MSRP - 14" M4 Max MacBook Pro (36GB/1TB): $2799, $400 off MSRP (2): B&H Photo is offering 14-inch MacBook Pros with M4 Pro or M4 Max CPUs for up to $400 off Apple's MSRP. B&H offers free 1-2 day shipping to most US addresses: - 14" M4 Pro MacBook Pro (24GB/512GB): $1749, $250 off MSRP - 14" M4 Pro MacBook Pro (24GB/1TB): $2099, $300 off MSRP - 14" M4 Max MacBook Pro (36GB/1TB): $2799, $400 off MSRP For the latest sales and prices, keep an eye on our 14-inch MacBook Pro Price Tracker, updated daily.

Read more »