Claude, Gemini & GPT are all included in this $99.99 lifetime AI toolbox
Macworld TL;DR: Get 1min.AI Advanced Business Plan for life for just $99.99 (reg. $540), including access to AI models from OpenAI, Anthropic, Google AI, Meta AI, Mistral AI, and Cohere. AI tools are multiplying faster than browser tabs during a research session. 1min.AI Advanced Business Plan is currently on sale for just $99.99 for lifetime access, putting a wide range of AI models and creative tools into one platform instead of making you jump between services. The model lineup includes GPT-5.5 Pro and GPT-5.4 Pro, along with Claude 4.1 Opus, Claude 4.5 Sonnet, Claude 4.6 Sonnet, multiple Gemini models, Llama 3, Mistral models, and Command R. But chatting is only part of the package. Writers can research keywords, generate blog articles, rewrite, summarize, paraphrase, and check grammar. Image tools cover generation, upscaling, background removal, object removal, editing, and more. You can also chat with multiple documents, translate documents, generate presentations, and use AI to summarize, translate, or answer questions about PDFs. Then there are the audio and video tools. Voice cloning, speech-to-text, music generation, audio translation, text-to-video, image-to-video, captions, and YouTube tools are all included. The Advanced Business Plan provides 4 million credits per month, plus the opportunity to generate up to 450,000 additional credits monthly for free. Codes aren’t stackable. Get lifetime access to the 1min.AI Advanced Business Plan for a one-time $99.99 (reg. $540). 1min.AI Advanced Business Plan Lifetime SubscriptionSee Deal StackSocial prices subject to change.

Read more »

Opera’s free built-in VPN can now turn on automatically when using public Wi-Fi
Opera announced today that its free, built-in VPN for desktop can now automatically activate when users connect to public or unsecured Wi-Fi networks. Here are the details. more…

Read more »

Macworld Podcast: iOS 27 and macOS 27 reviews
Macworld Apple released iOS 27 and macOS 27, and on this episode of the Macworld Podcast, we talk about the new operating systems and what you should know. This is episode 1001 with Michael Simon, Jason Cross, and Roman Loyola.  Watch episode 1001 on YouTube Listen to episode 1001 on Apple Podcasts Tune in to episode 1001 on Spotify Get info Click on the links below to learn more about what was discussed on the show. iOS 27: Major features, compatible iPhones, updates, and more iOS 27 is here and you shouldn’t wait to get it on your iPhone Apple Watch Series 4 (2018) review  Comment Corner I am one of those few who have been listening to your podcast for longer than my children have been alive. I still have fond memories of trying to sync it to my iPod. Part of me kind of hoped that you would do the same thing that Chris Breen did around episode 500 and bring Cyrus back to do the intro. It was still nice to hear his voice.  Andrew G. via email I wanted to comment on the aspect ratio of the Duo’s outer and inner screens – both about 1.4 : 1. As an ex-graphic designer, this ratio (known as the silver ratio, 1 to the square root of 2) is very well known to me. That is because in the UK and Europe all our paper sizes are based on this ratio.  A4 is 297 x 210mm which when folded exactly in half results in A5, which has the same ratio. This continues with smaller sizes of A6, etc. Going the other way, A3 is double A4, etc, until you get to A0, which has a surface area of 1 metre squared. Neat eh?  The iPhone Duo therefore is like an A5 sheet of paper, folded in half when closed, and is something that will have been very familiar with Molly Anderson who (like Jony Ive) is from the UK.   Stuart G. via email Subscribe to the Macworld Podcast You can subscribe to the Macworld Podcast—or leave us a review!—right here in the Podcasts app. The Macworld Podcast is also available on Spotify and on the Macworld Podcast YouTube channel.  Or you can point your favorite podcast-savvy RSS reader at: https://feeds.megaphone.fm/macworld To find previous episodes, visit Macworld’s podcast page or our home on MegaPhone. Apple

Read more »

Apple says software update to fix iPhone 18 Pro rebooting bug is coming next week
On Monday, we reported on an issue where iPhone 18 Pro and iPhone 18 Pro Max users were seeing their phone freeze and reboot following a failed Face ID attempt. To us, it appeared to be a software glitch rather than an inherent hardware fault. Apple has now confirmed to 9to5Mac that a software update to address this problem is in the works, and should be available early next week. more…

Read more »

Apple's spatial computing strategy was on full display at Meta Connect
Meta VR Glasses are a new spatial computing device that weighs a sixth of the Apple Vision Pro with a third of the cost, half of the specs, and none of the immersion.Meta's new glasses have Alan Dye all over them. Image source: MetaTake the front glass from the Apple Vision Pro, slap it on some thick glasses arms, remove the light seal, compute, and surrounding hardware, and you'll end up with Meta VR Glasses. These are less glasses than goggles, and initial demos show some promise in delivering decent mixed augmented reality results.For a headset people seem ready to claim was a failure, the industry, namely Meta, really leaned into chasing Apple's vision. Though, unlike Apple, Meta couldn't help slapping a logo right on the user's forehead. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

How to change the background in Messages for iOS 27 and iPadOS 27
Bring more life and personalization to your group chats, by adding backgrounds to your conversations in Messages in iOS 27 and iPadOS 27. Here's how to change yours for the better.You can change the backgrounds of conversations in Messages for iOS 27 and iPadOS 27Messages is an essential app for iPhone users, with it used to communicate with your closest relations. However, people may be getting a bit bored of seeing the usual grey and blue (and sometimes green) speech bubbles floating up a plain white page.During WWDC 2025, Apple finally made a change to Messages, allowing users to select the background for conversations. A work chat could be jazzed up with corporate-approved branding, while speaking to parents can be done to a background of favorite pets, for example. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

How to change the background in Messages for iOS 27 and iPadOS 27
Bring more life and personalization to your group chats, by adding backgrounds to your conversations in Messages in iOS 27 and iPadOS 27. Here's how to change yours for the better.You can change the backgrounds of conversations in Messages for iOS 27 and iPadOS 27Messages is an essential app for iPhone users, with it used to communicate with your closest relations. However, people may be getting a bit bored of seeing the usual grey and blue (and sometimes green) speech bubbles floating up a plain white page.During WWDC 2025, Apple finally made a change to Messages, allowing users to select the background for conversations. A work chat could be jazzed up with corporate-approved branding, while speaking to parents can be done to a background of favorite pets, for example. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

How to change the background in Messages for iOS 27 and iPadOS 27
Bring more life and personalization to your group chats, by adding backgrounds to your conversations in Messages in iOS 27 and iPadOS 27. Here's how to change yours for the better.You can change the backgrounds of conversations in Messages for iOS 27 and iPadOS 27Messages is an essential app for iPhone users, with it used to communicate with your closest relations. However, people may be getting a bit bored of seeing the usual grey and blue (and sometimes green) speech bubbles floating up a plain white page.During WWDC 2025, Apple finally made a change to Messages, allowing users to select the background for conversations. A work chat could be jazzed up with corporate-approved branding, while speaking to parents can be done to a background of favorite pets, for example. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

How to change the background in Messages for iOS 27 and iPadOS 27
Bring more life and personalization to your group chats, by adding backgrounds to your conversations in Messages in iOS 27 and iPadOS 27. Here's how to change yours for the better.You can change the backgrounds of conversations in Messages for iOS 27 and iPadOS 27Messages is an essential app for iPhone users, with it used to communicate with your closest relations. However, people may be getting a bit bored of seeing the usual grey and blue (and sometimes green) speech bubbles floating up a plain white page.During WWDC 2025, Apple finally made a change to Messages, allowing users to select the background for conversations. A work chat could be jazzed up with corporate-approved branding, while speaking to parents can be done to a background of favorite pets, for example. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

ChatGPT as an extension in Siri dramatically underperformed, says OpenAI
It was already known that the ChatGPT deal went so poorly with Apple that OpenAI considered a lawsuit, but these complaints have finally been put to paper in a SpaceXAI lawsuit filing.The Siri extension for ChatGPT didn't perform as expectedApple and OpenAI were dragged into an antitrust lawsuit thanks to baseless accusations from Elon Musk. The lawsuit is ongoing in spite of Apple being removed from the case.OpenAI didn't get to see what settlement Apple and SpaceXAI reached, but it has shared exactly why the whole lawsuit should be tossed out. The filing details the maddeningly odd lawsuit brought on by Elon Musk, and in it, shared how disappointing its partnership with Apple actually was. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

ChatGPT as an extension in Siri dramatically underperformed, says OpenAI
It was already known that the ChatGPT deal went so poorly with Apple that OpenAI considered a lawsuit, but these complaints have finally been put to paper in a SpaceXAI lawsuit filing.The Siri extension for ChatGPT didn't perform as expectedApple and OpenAI were dragged into an antitrust lawsuit thanks to baseless accusations from Elon Musk. The lawsuit is ongoing in spite of Apple being removed from the case.OpenAI didn't get to see what settlement Apple and SpaceXAI reached, but it has shared exactly why the whole lawsuit should be tossed out. The filing details the maddeningly odd lawsuit brought on by Elon Musk, and in it, shared how disappointing its partnership with Apple actually was. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

ChatGPT as an extension in Siri dramatically underperformed, says OpenAI
It was already known that the ChatGPT deal went so poorly with Apple that OpenAI considered a lawsuit, but these complaints have finally been put to paper in a SpaceXAI lawsuit filing.The Siri extension for ChatGPT didn't perform as expectedApple and OpenAI were dragged into an antitrust lawsuit thanks to baseless accusations from Elon Musk. The lawsuit is ongoing in spite of Apple being removed from the case.OpenAI didn't get to see what settlement Apple and SpaceXAI reached, but it has shared exactly why the whole lawsuit should be tossed out. The filing details the maddeningly odd lawsuit brought on by Elon Musk, and in it, shared how disappointing its partnership with Apple actually was. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

ChatGPT as an extension in Siri dramatically underperformed, says OpenAI
It was already known that the ChatGPT deal went so poorly with Apple that OpenAI considered a lawsuit, but these complaints have finally been put to paper in a SpaceXAI lawsuit filing.The Siri extension for ChatGPT didn't perform as expectedApple and OpenAI were dragged into an antitrust lawsuit thanks to baseless accusations from Elon Musk. The lawsuit is ongoing in spite of Apple being removed from the case.OpenAI didn't get to see what settlement Apple and SpaceXAI reached, but it has shared exactly why the whole lawsuit should be tossed out. The filing details the maddeningly odd lawsuit brought on by Elon Musk, and in it, shared how disappointing its partnership with Apple actually was. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

ChatGPT as an extension in Siri dramatically underperformed, says OpenAI
It was already known that the ChatGPT deal went so poorly with Apple that OpenAI considered a lawsuit, but these complaints have finally been put to paper in a SpaceXAI lawsuit filing.The Siri extension for ChatGPT didn't perform as expectedApple and OpenAI were dragged into an antitrust lawsuit thanks to baseless accusations from Elon Musk. The lawsuit is ongoing in spite of Apple being removed from the case.OpenAI didn't get to see what settlement Apple and SpaceXAI reached, but it has shared exactly why the whole lawsuit should be tossed out. The filing details the maddeningly odd lawsuit brought on by Elon Musk, and in it, shared how disappointing its partnership with Apple actually was. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

ChatGPT as an extension in Siri dramatically underperformed, says OpenAI
It was already known that the ChatGPT deal went so poorly with Apple that OpenAI considered a lawsuit, but these complaints have finally been put to paper in a SpaceXAI lawsuit filing.The Siri extension for ChatGPT didn't perform as expectedApple and OpenAI were dragged into an antitrust lawsuit thanks to baseless accusations from Elon Musk. The lawsuit is ongoing in spite of Apple being removed from the case.OpenAI didn't get to see what settlement Apple and SpaceXAI reached, but it has shared exactly why the whole lawsuit should be tossed out. The filing details the maddeningly odd lawsuit brought on by Elon Musk, and in it, shared how disappointing its partnership with Apple actually was. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

ChatGPT as an extension in Siri dramatically underperformed, says OpenAI
It was already known that the ChatGPT deal went so poorly with Apple that OpenAI considered a lawsuit, but these complaints have finally been put to paper in a SpaceXAI lawsuit filing.The Siri extension for ChatGPT didn't perform as expectedApple and OpenAI were dragged into an antitrust lawsuit thanks to baseless accusations from Elon Musk. The lawsuit is ongoing in spite of Apple being removed from the case.OpenAI didn't get to see what settlement Apple and SpaceXAI reached, but it has shared exactly why the whole lawsuit should be tossed out. The filing details the maddeningly odd lawsuit brought on by Elon Musk, and in it, shared how disappointing its partnership with Apple actually was. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

ChatGPT as an extension in Siri dramatically underperformed, says OpenAI
It was already known that the ChatGPT deal went so poorly with Apple that OpenAI considered a lawsuit, but these complaints have finally been put to paper in a SpaceXAI lawsuit filing.The Siri extension for ChatGPT didn't perform as expectedApple and OpenAI were dragged into an antitrust lawsuit thanks to baseless accusations from Elon Musk. The lawsuit is ongoing in spite of Apple being removed from the case.OpenAI didn't get to see what settlement Apple and SpaceXAI reached, but it has shared exactly why the whole lawsuit should be tossed out. The filing details the maddeningly odd lawsuit brought on by Elon Musk, and in it, shared how disappointing its partnership with Apple actually was. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

ChatGPT as an extension in Siri dramatically underperformed, says OpenAI
It was already known that the ChatGPT deal went so poorly with Apple that OpenAI considered a lawsuit, but these complaints have finally been put to paper in a SpaceXAI lawsuit filing.The Siri extension for ChatGPT didn't perform as expectedApple and OpenAI were dragged into an antitrust lawsuit thanks to baseless accusations from Elon Musk. The lawsuit is ongoing in spite of Apple being removed from the case.OpenAI didn't get to see what settlement Apple and SpaceXAI reached, but it has shared exactly why the whole lawsuit should be tossed out. The filing details the maddeningly odd lawsuit brought on by Elon Musk, and in it, shared how disappointing its partnership with Apple actually was. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

ChatGPT as an extension in Siri dramatically underperformed, says OpenAI
It was already known that the ChatGPT deal went so poorly with Apple that OpenAI considered a lawsuit, but these complaints have finally been put to paper in a SpaceXAI lawsuit filing.The Siri extension for ChatGPT didn't perform as expectedApple and OpenAI were dragged into an antitrust lawsuit thanks to baseless accusations from Elon Musk. The lawsuit is ongoing in spite of Apple being removed from the case.OpenAI didn't get to see what settlement Apple and SpaceXAI reached, but it has shared exactly why the whole lawsuit should be tossed out. The filing details the maddeningly odd lawsuit brought on by Elon Musk, and in it, shared how disappointing its partnership with Apple actually was. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

ChatGPT as an extension in Siri dramatically underperformed, says OpenAI
It was already known that the ChatGPT deal went so poorly with Apple that OpenAI considered a lawsuit, but these complaints have finally been put to paper in a SpaceXAI lawsuit filing.The Siri extension for ChatGPT didn't perform as expectedApple and OpenAI were dragged into an antitrust lawsuit thanks to baseless accusations from Elon Musk. The lawsuit is ongoing in spite of Apple being removed from the case.OpenAI didn't get to see what settlement Apple and SpaceXAI reached, but it has shared exactly why the whole lawsuit should be tossed out. The filing details the maddeningly odd lawsuit brought on by Elon Musk, and in it, shared how disappointing its partnership with Apple actually was. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

ChatGPT as an extension in Siri dramatically underperformed, says OpenAI
It was already known that the ChatGPT deal went so poorly with Apple that OpenAI considered a lawsuit, but these complaints have finally been put to paper in a SpaceXAI lawsuit filing.The Siri extension for ChatGPT didn't perform as expectedApple and OpenAI were dragged into an antitrust lawsuit thanks to baseless accusations from Elon Musk. The lawsuit is ongoing in spite of Apple being removed from the case.OpenAI didn't get to see what settlement Apple and SpaceXAI reached, but it has shared exactly why the whole lawsuit should be tossed out. The filing details the maddeningly odd lawsuit brought on by Elon Musk, and in it, shared how disappointing its partnership with Apple actually was. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

ChatGPT as an extension in Siri dramatically underperformed, says OpenAI
It was already known that the ChatGPT deal went so poorly with Apple that OpenAI considered a lawsuit, but these complaints have finally been put to paper in a SpaceXAI lawsuit filing.The Siri extension for ChatGPT didn't perform as expectedApple and OpenAI were dragged into an antitrust lawsuit thanks to baseless accusations from Elon Musk. The lawsuit is ongoing in spite of Apple being removed from the case.OpenAI didn't get to see what settlement Apple and SpaceXAI reached, but it has shared exactly why the whole lawsuit should be tossed out. The filing details the maddeningly odd lawsuit brought on by Elon Musk, and in it, shared how disappointing its partnership with Apple actually was. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

From Static to Adaptive: Why This Fall Is the Right Time to Rethink How You Sit
Macworld Sit Smarter. Save Bigger. Up to 37% Off LiberNovo's Ergonomic Chairs VIEW SALE (function () { document.querySelector("#sticky-promo-block a").addEventListener("click", function(e) { const debug = document.location.host.search(/lndo.site|go-vip.net/) !== -1; const text = this.closest("#sticky-promo-block").querySelector("p.promo-title").textContent; const data = { event: "stickyConversionUnitClick", eventCategory: "Sticky Conversion", eventAction: "Click", eventLabel: text }; if(debug)console.log("Sticky Conversion CLick - pushing to dataLayer: ", data); dataLayer.push(data); return true; }); })(); Most people don’t notice discomfort building up. It arrives gradually—a tight lower back by mid-afternoon at your MacBook, a stiff neck after a long session color-grading in Final Cut Pro, restlessness that no amount of adjusting a static chair seems to fix. The problem isn’t willpower or posture discipline. It’s that traditional chairs are built to hold one position, while the human body is built to move. That’s the premise behind LiberNovo’s Omni and Maxis ranges, two lines of dynamic ergonomic chairs designed around a simple idea: support should adjust to you, continuously, not the other way around. And this fall, as National Ergonomics Month puts a spotlight on healthier sitting habits, LiberNovo is running its Fall Prime Sale — offering up to 37% off selected chairs and accessories for anyone ready to make that upgrade. LiberNovo Why Dynamic Support Matters Sitting for eight or more hours a day—the reality for most developers building in Xcode, creatives rendering timelines in Final Cut Pro or Logic Pro, and hybrid professionals running their whole workday off a MacBook—puts sustained pressure on the same muscles and joints hour after hour. A static chair, no matter how well-cushioned, locks the body into one shape. Over weeks and months, that compounds into fatigue, tightness, and reduced focus, whether you’re compiling code or scrubbing through 4K footage. LiberNovo’s answer is a dynamic engineering approach: Adaptive Lumbar Support that shifts with your movement, a OmniStretch Recovery Mode that introduces gentle relief during the workday, and a 105° to 160° recline range that lets users transition fluidly between focused, upright work at a standing desk and full relaxation. The goal isn’t just comfort in the moment—it’s converting hours of sedentary strain into ongoing postural relief. The design idea is what LiberNovo calls a Dynamic Support System: headrest, backrest, armrests and seat move in sync, so support follows the body rather than holding it in one posture. LiberNovo What to Look for in a Premium Ergonomic Chair Before buying, it’s worth understanding what actually separates a premium ergonomic chair from a standard one: adjustability that matches your body (not a one-size-fits-all frame), lumbar support that moves with you rather than staying fixed, and a recline mechanism engineered for smooth, controlled transitions rather than an abrupt drop. For Mac users who’ve already invested in a considered desk setup—a Studio Display, a mechanical keyboard, a well-placed Mac mini or Mac Studio—the chair is often the last piece to get the same attention. Maxis is this fall’s campaign hero—a larger-size dynamic chair series purpose-built for Big & Tall users, available in Basic, Standard, and Premium configurations across Manual, Electric, and Airflow versions. It features a 52 cm ultra-deep seat for extended thigh support, a wider back frame (430 mm shoulder span, 520 mm waist width), an extended-reach U-shaped headrest, curved arc armrests that reduce waist compression, and a six-spring progressive recline system for stability at scale. The Maxis frame is rated to 399 lb (181 kg) and sized for users from 5’10” to 6’7″ (178–200cm). Maxis Airflow adds Active AirFlow Ventilation, a sensor-driven seat ventilation system powered by a rechargeable battery—a feature otherwise available only on the Omni Pro. Omni rounds out the lineup for a broader range of needs and budgets: Omni Pro for a fully loaded electric experience, Omni GEN for balanced everyday versatility, and Omni SE as an accessible entry point for a first ergonomic upgrade. A core engineering feature shared by the Omni and Maxis is the Bionic FlexFit backrest, which uses eight adaptive panels and 16 pivot points to contour along the spine’s natural S-curve. LiberNovo A Rare Window to Invest Ergonomic seating is a long-term investment, and this sale is structured accordingly. Shoppers who buy early get 30-day price protection, along with gifts and automatic savings on qualifying orders—so there’s no pressure to rush a decision to catch the best price. Teams of five or more—think a Mac-based creative studio or dev team outfitting a new office—can also access special bulk pricing across eligible Maxis and Omni configurations, making this a practical moment for standardizing on better seating. Whether the goal is powering through long Xcode builds, editing for hours in Final Cut Pro without stiffness, or simply sitting better at your home office Mac setup, the LiberNovo Fall Prime Sale is a chance to treat your chair as what it actually is: infrastructure for how you work, create, and feel every day. LiberNovo LiberNovo View LiberNovo Fall Prime Sale Deals

Read more »

Meta announces camera-free glasses, dedicated Muse AI gadget, more
Meta announced today a series of AI-powered devices, including the Muse Charm, a palm-sized gadget designed specifically for its new Muse AI assistant. Here are the details. more…

Read more »

Apple Watch Series 12 and Ultra 4 get emergency fix for reboot problem
A watchOS 27.0.1 update fixes a bug that caused some Apple Watch Series 12 and Ultra 4 models to unexpectedly restart over and over. (via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)

Read more »

uGreen Revodok Maxidok 17-in-1 review: Best in class price to features balance
The Thunderbolt 5 docking station market is very crowded, but at a street price of about $350, the uGreen Revodok Maxidok 17-in-1 stands out, with an excellent price to features balance.uGreen Revodok Maxidok 17-in-1A laptop is a compromise between power and portability. The trade-off is usually ports, with thin notebooks like the MacBook Pro offering only a handful of connections.A Thunderbolt dock solves that by turning one port into many. The Revodok Maxidok pushes that idea about as far as it currently goes, with Thunderbolt 5 speeds and a built-in SSD slot. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

OpenAI says Apple Intelligence users showed little interest in ChatGPT integration
As reported by The Financial Times, new court filings show that OpenAI was disappointed by the adoption of ChatGPT through Apple Intelligence, which it says “dramatically underperformed” after launching in 2024. Here are the details. more…

Read more »

See the Behind-the-Scenes Prompts That Power Siri AI 
You can export an Apple Intelligence Report that reveals how Apple formulates requests on your behalf to perform tasks and take actions with Siri AI and Apple Intelligence in OS 27. It requires an intelligent agent to understand the full picture.

Read more »

The iPhone 4 ‘Antennagate’ Press Conference Q&A — Finally
I don’t know what truck this video fell off the back of, why it took 16 years, or how it came into the hands of “Sir Mix-A-Lot Rare Music”, but I’m sure glad it did.

Read more »

How to use public Wi-Fi safely on your Mac
Learn about the security and privacy risks associated with public networks, and how you can keep your Mac safe when using free Wi-Fi hotspots. The post first appeared on The Mac Security Blog.

Read more »

Think your Mac has been hacked? How to tell and what to do
If you suspect your Mac has been hacked, don’t assume the worst. While Macs can be compromised, a pop-up, slow performance, or an unfamiliar app doesn’t automatically mean someone has gained access to your Mac. The problem could be malware, a compromised online account, a fake security warning, or even a normal software issue. If […] The post first appeared on The Mac Security Blog.

Read more »

How to turn on Stolen Device Protection on iPhone
Stolen Device Protection is a feature that helps ensure that if someone steals your iPhone, even if they have your passcode, they’re unlikely to be able to make changes to your Apple ID account. Here’s how to enable it. The post first appeared on The Mac Security Blog.

Read more »

iPhone passcode security: Why 6 digits may not be enough
Your entire digital life is protected by a six-digit passcode. If a thief gets that passcode, they can access all your passwords. The post first appeared on The Mac Security Blog.

Read more »

Data Broker Radaris Loses Domains in Privacy Fight
The consumer data broker Radaris.com has long had a reputation for ignoring requests to remove personal information from its vast empire of people-search services online. That reputation caught up with the company recently in a lawsuit alleging Radaris violated a New Jersey privacy law that provides for hefty fines against data brokers that publish personal information on state law enforcement officials. In the face of repeated stonewalling and prevarication by attorneys for Radaris, the judge in the case ordered that radaris.com and more than a dozen other data broker domains be transferred to the plaintiffs.

Read more »

Do Macs need antivirus, or is built-in protection enough?
Macs don’t all need the same level of protection. macOS includes strong built-in security that works quietly in the background, and it may be enough if you keep your Mac updated, follow Apple’s warnings, and download only trusted software. However, no security system can recognize every new or modified threat or prevent every unsafe decision. […] The post first appeared on The Mac Security Blog.

Read more »

How to clear RAM on a Mac and reduce memory usage
If your Mac is running slowly or showing a memory warning, you may be looking for a cleanup app or command-line trick to clear RAM. You don’t need either. macOS manages RAM automatically, and forcing it to clear memory can reduce performance instead of improving it. A good first step is to look at Memory […] The post first appeared on The Mac Security Blog.

Read more »

Syncing with iCloud paused? What it means and how to fix it
Seeing “Syncing with iCloud paused” can be worrying, especially when your messages, photos, or files stop updating across your Apple devices. Fortunately, this message usually means iCloud has temporarily stopped syncing. It doesn’t normally mean your existing data has disappeared or someone has accessed your Apple Account. The right fix depends on which service has […] The post first appeared on The Mac Security Blog.

Read more »

How to allow pop-ups on a Mac in Safari, Chrome, and Firefox
A blocked pop-up can make a website seem broken. A sign-in page might not appear, a payment window could fail to open, or a form, document viewer, or live chat may stop working. Your browser could be blocking the new window in the background, even when the website itself is legitimate. This guide shows you […] The post first appeared on The Mac Security Blog.

Read more »

Microsoft Plugs Nearly 1,000 Security Holes
Microsoft Corp. today issued updates to plug at least 974 security holes in its Windows operating systems and other software, by far its biggest single patch batch ever. Microsoft says artificial intelligence is helping to speed the discovery of vulnerabilities, but security experts warn that many organizations already are struggling to prioritize the more human-intensive endeavor of testing and deploying so many fixes each month.

Read more »

Vulnerability Summary for the Week of August 31, 2026
High Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info 1Hive--gardens-v2 Gardens v2 is a modular governance framework that enables communities to create and manage multiple governance pools with customizable parameters and voting mechanisms. In 3e595f3 and prior, when a streaming proposal is funded, the cluster of streaming contracts moves real pool funds into the proposal's StreamingEscrow to back the Superfluid constant flow agreement (the CFA deposit, plus a 0.5 percent margin). cancelProposal then zeroes the escrow's GDA member units but never reclaims that parked balance, and the permissionless claim() forwards the escrow's entire balance, including the pool funded buffer, to the beneficiary. The beneficiary is chosen by the proposal submitter and defaults to the submitter. The only path that returns escrow funds to the pool is drainToStrategy, which is onlyStrategy and is reached solely from the dispute reject ruling, never from cancel or natural completion. At time of publication, there are no publicly known patches. 2026-09-03 7.7 CVE-2026-55658 : Shane Bishop--EWWW Image Optimizer Unauthenticated Cross Site Scripting (XSS) in EWWW Image Optimizer = 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify router resolves an absolute-form request target to its path before dispatching. Because the two layers evaluate different strings, a request using an absolute-form target reaches the route handler while the path-scoped middleware, such as authentication or authorization, is skipped. An unauthenticated network attacker can use this to bypass path-based access controls in a Fastify application that relies on middie for those controls. Users should upgrade to @fastify/middie 9.3.4 or later. 2026-09-04 9.1 CVE-2026-85184 aaif-goose--goose goose 1.37.0 executes arbitrary commands from recipe stdio extensions and retry.checks without security inspection. Attackers can distribute malicious recipes that execute shell commands as the user running goose, bypassing the recipe security scan which does not inspect extensions or retry configurations. 2026-09-04 8.8 CVE-2026-85623 Acato--Email Essentials Unauthenticated Cross Site Scripting (XSS) in Email Essentials = 5.0.0-RC1 and < 5.10.11 contain a missing authorization vulnerability in AssetsController::actionReplaceFile. When a request supplies sourceAssetId and targetFilename but omits assetId, the target asset is resolved by folder and filename after the permission checks execute, so the replacePeerFiles permission is never enforced. An authenticated low-privilege author with only the replaceFiles permission on a shared folder can overwrite the content of a peer's asset file (located in the same folder) with attacker-controlled bytes. Fixed in 5.10.11. 2026-09-02 7.1 CVE-2026-84800 crcn--sift.js sift (sift.js) 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any matched operator key including $where. The $where operation compiles a string value into a function using new Function unless CSP_ENABLED is set (not set by default). As a result, if a prototype-pollution primitive elsewhere in the process sets Object.prototype.$where to a malicious string, even benign filter calls such as sift({}) execute arbitrary JavaScript. Additionally, passing an untrusted query object containing a string $where directly to sift results in code execution under the default configuration. 2026-09-04 8.1 CVE-2026-85625 crmeb--CRMEB CRMEB contains an authentication bypass vulnerability in the verifyAuth() method of SystemRoleServices.php that returns true from both conditional branches. Sub-administrators and accounts with no roles can access restricted admin endpoints by exploiting the inert role check that always permits requests. 2026-09-03 8.3 CVE-2026-85212 crystaldba--postgres-mcp Postgres MCP Pro 0.3.0 contains a restricted-mode bypass vulnerability where function-name validation is not applied to RangeFunction nodes in FROM clauses. Attackers can execute file-reading functions like pg_read_file through FROM-clause syntax to read arbitrary files despite restricted-mode protections. 2026-09-04 8.6 CVE-2026-85620 cu--silicon A vulnerability was identified in cu silicon up to 0.1.5. Affected by this vulnerability is the function create_app of the file views.py of the component edit Endpoint. Such manipulation leads to missing authentication. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. 2026-08-31 7.3 CVE-2026-82919 Cua computer-server--Cua computer-server   Cua computer-server versions before 0.3.42 skip authentication when the CONTAINER_NAME environment variable is unset and bind to all interfaces by default, allowing unauthenticated attackers to execute arbitrary commands. Attackers can reach TCP port 8000 to run shell commands via the run_command endpoint, read and write arbitrary files through file operation endpoints, and access interactive PTY shells without authentication. 2026-09-05 9.8 CVE-2026-86121 cyanheads--git-mcp-server git-mcp-server 2.15.1 contains an argument injection vulnerability in the ref and object parameters of git_log, git_diff, and git_show tools that lack leading-dash validation. Attackers can inject git command-line options like --output= to write files outside the repository to arbitrary paths accessible by the process. 2026-09-04 7.5 CVE-2026-85626 cypht-org--cypht Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the back_query GET parameter of the logout handler. Attackers can pass a base64-encoded serialized payload through this parameter, which is decoded and passed directly to unserialize() without an allow-list, signature check, or type restriction, enabling gadget-chain exploitation to achieve remote code execution as the web server process. 2026-09-01 8.8 CVE-2026-71981 D-Link--DIR-825M A flaw has been found in D-Link DIR-825M 1.1.8. This impacts the function sub_41802C of the file /boafrm/formLtefotaUpgradeFibocom of the component LTE Module Firmware Upgrade. This manipulation of the argument fota_url causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been published and may be used. 2026-08-31 9.9 CVE-2026-82593 D-Link--DIR-825M A vulnerability was found in D-Link DIR-825M 1.1.8. Affected by this vulnerability is the function sub_456CF4 of the file /boafrm/formSysCmd of the component System Command Execution. Performing a manipulation of the argument sysCmd results in command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. 2026-08-31 7.4 CVE-2026-82595 D-Link--DNS-320 ShareCenter A vulnerability was determined in D-Link DNS-320 ShareCenter 2.06B01. This affects an unknown part of the file /cgi/file_sharing.cgi of the component File Sharing. Executing a manipulation of the argument fileurl can lead to os command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. 2026-09-03 9.1 CVE-2026-85224 D-Link--DNS-320L A vulnerability was detected in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to 20260717. Affected is an unknown function of the file /cgi-bin/isomount_mgr.cgi of the component ISO Image Handler. The manipulation of the argument upIsoRootPath results in os command injection. The attack can be executed remotely. The exploit is now public and may be used. 2026-08-31 9.9 CVE-2026-82689 D-Link--DNS-320L A vulnerability has been found in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to 20260717. Affected by this issue is some unknown functionality of the file /cgi-bin/usb_device.cgi of the component CGI Handler. Such manipulation of the argument f_ups_ip leads to os command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. 2026-08-31 9.1 CVE-2026-82691 D-Link--DNS-327L A flaw has been found in D-Link DNS-327L and DNS-340L up to 20260717. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/ve_mgr.cgi. This manipulation of the argument f_dev causes os command injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. 2026-08-31 9.1 CVE-2026-82690 D-Link--DNS-340L A security vulnerability has been detected in D-Link DNS-340L and DNS-345 1.01B04/1.03B06/1.04.B02/1.05b04. This impacts an unknown function of the file /cgi-bin/virtual_vol.cgi of the component Virtual Volume Handler. The manipulation of the argument f_sharename/f_target/f_name leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. 2026-08-31 9.1 CVE-2026-82688 D-Link--DNS-340L A vulnerability was found in D-Link DNS-340L and DNS-345 up to 20260717. This affects an unknown part of the file /cgi-bin/iscsi_mgr.cgi. Performing a manipulation of the argument alias/username/password/volume_location results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. 2026-08-31 9.9 CVE-2026-82692 D-Link--DNS-340L A vulnerability has been found in D-Link DNS-340L 1.01B04. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/addon_center.cgi of the component Add-On Center. Such manipulation of the argument f_name/f_url/f_flag/f_login_user leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. 2026-09-03 9.1 CVE-2026-85222 D-Link--DNS-340L A vulnerability was found in D-Link DNS-340L 1.01B04. Affected by this issue is some unknown functionality of the file /cgi-bin/dropbox.cgi of the component CGI Handler. Performing a manipulation of the argument callback_url/sync_interval results in os command injection. The attack can be initiated remotely. The exploit has been made public and could be used. 2026-09-03 9.9 CVE-2026-85223 D-Link--DSM-G600 A weakness has been identified in D-Link DSM-G600 1.01. This affects an unknown function of the file /load_file.cgi of the component Multipart Handler. Executing a manipulation can lead to out-of-bounds write. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. 2026-08-31 8.8 CVE-2026-82680 datalab-to--marker marker through 2.0.0 contains a path traversal vulnerability in the FastAPI /marker/upload handler that fails to sanitize the file.filename parameter. Unauthenticated attackers can supply filenames containing directory traversal sequences to write arbitrary files to any location or delete existing files on the system. 2026-09-04 9.1 CVE-2026-85684 datalab-to--surya surya 0.22.1 screenshot server contains an unauthenticated arbitrary file read vulnerability in the /info, /page, and /process routes that accept raw file_path parameters. Attackers can read any image or PDF file on the host by supplying arbitrary file paths to Image.open or pypdfium2.PdfDocument, obtaining rendered contents as base64 and using /info as an existence oracle. 2026-09-04 7.5 CVE-2026-85687 dbgate--dbgate DbGate fails to validate jslid parameters in the jsldata controller, allowing authenticated users to read and write arbitrary files via file:// scheme resolution. Attackers can exploit getJslFileName() to bypass directory containment and access sensitive files including encrypted database credentials stored in connections configuration. 2026-09-03 8.8 CVE-2026-85176 Delinea--Secret Server (On-Prem) Under specific conditions, an attacker can register an attacker-controlled FIDO2 credential against a target account and then authenticate as that user. This issue affects on-premises deployments only. 2026-09-02 9.8 CVE-2026-19117 Dell--PowerProtect Data Manager Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a stack buffer overflow vulnerability in file-level restore agent. A high privileged remote attacker could potentially exploit this vulnerability, leading to Information disclosure. 2026-09-03 7.8 CVE-2026-73600 Dell--PowerStore 500T Dell PowerStore contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with network access to the restricted management interface could potentially exploit this vulnerability to read internal system information from the appliance filesystem. This is a Critical vulnerability as it could expose sensitive information and credentials which allow full administrative access to the array. 2026-08-31 9.8 CVE-2026-58574 Dell--PowerStore 500T Dell PowerStore SDNAS contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Filesystem access. 2026-09-01 9 CVE-2026-79687 Dell--PowerStore 500T Dell PowerStore, an Incorrect Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges. 2026-09-01 8.8 CVE-2026-58566 Dell--PowerStore 500T Dell PowerStore contains an OS Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary commands with root privileges. 2026-09-01 8.8 CVE-2026-58567 Dell--PowerStore 500T Dell PowerStore contains an Inclusion of Functionality from Untrusted Control Sphere vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary code with root privileges.. 2026-09-01 8.8 CVE-2026-58569 Dell--PowerStore 500T Dell PowerStore contains an OS Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary commands with root privileges. 2026-09-01 8.8 CVE-2026-58571 Dell--PowerStore 500T Dell PowerStore contains a Code Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary code with root privileges. 2026-09-01 8.8 CVE-2026-58572 Dell--PowerStore 500T Dell PowerStore contains an Authentication Bypass by Spoofing vulnerability. An authenticated attacker could potentially exploit this vulnerability to escalate privileges to Administrator. 2026-09-01 8.8 CVE-2026-58575 Dell--PowerStore 500T Dell PowerStore contains an Incorrect Authorization vulnerability. An authenticated attacker with low privileges could potentially exploit this vulnerability to invoke administrator-only operations, leading to privilege escalation. 2026-09-01 8.8 CVE-2026-76111 Dell--PowerStore 500T Dell PowerStore contains a Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary commands with root privileges. 2026-09-01 8.8 CVE-2026-79682 Dell--PowerStore 500T Dell PowerStore contains a Protection Mechanism Failure vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to write attacker-controlled content to arbitrary filesystem paths. 2026-09-01 8.8 CVE-2026-79683 Dell--PowerStore 500T Dell PowerStore contains a Protection Mechanism Failure vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to bypass access restrictions and gain escalated privileges. 2026-09-01 8.8 CVE-2026-79684 Dell--PowerStore 500T Dell PowerStore contains a Protection Mechanism Failure vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to bypass access restrictions and gain escalated privileges. 2026-09-01 8.8 CVE-2026-79686 Developer Tools--Developer Tools The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in the bundled SWFUpload component 2026-09-02 9.8 CVE-2025-9314 devitemsllc--Support Genix Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System The Support Genix - Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 1.4.52 via the `guest_ticket_login()` function and its `p` parameter. This is due to the site-wide AES-256-CBC encryption key being derived from only three two-digit `wp_rand(10, 99)` values and a Unix timestamp via `md5()` - yielding approximately 19.5 bits of entropy - combined with a deterministic IV derived from the password, no authentication tag on the ciphertext, and no capability check, nonce, or session validation on the publicly reachable `/sgnix/?p=` endpoint. This makes it possible for authenticated attackers, with subscriber-level access and above, who can obtain a single legitimate guest ticket token as a known-plaintext oracle and bound the plugin activation timestamp, to exhaust the ~729,000-candidate keyspace entirely offline, recover the site-wide encryption key, and forge a self-consistent `{ticket_id, ticket_user}` token targeting any administrator-owned ticket. Submitting the forged token to the unprotected endpoint causes `wp_set_auth_cookie()` to be called for that administrator, granting the attacker full administrative access to the WordPress site. 2026-09-01 8.8 CVE-2026-19806 devtron-labs--devtron Devtron through 2.2.0 fails to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint, allowing authenticated users to retrieve admin API tokens. Attackers with any authenticated account can query the endpoint with arbitrary project, environment, and application parameters to retrieve plaintext super-admin JWT tokens for full platform control. 2026-08-31 8.8 CVE-2026-82882 dianping--cat CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline. Attackers can set the x-forwarded-for header to bypass IP binding validation and create admin sessions with full configuration access. 2026-09-03 9.8 CVE-2026-85181 digitalbazaar--forge node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS#1 v1.5 signature verification. Attackers can embed garbage bytes inside the DigestAlgorithm sequence to forge valid signatures for arbitrary messages using low-exponent RSA keys. This is an incomplete fix for CVE-2026-33894. 2026-09-03 7.5 CVE-2026-85393 Divi Engine--Divi Ajax Filter The Divi Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.1.2 via the 'custom_loop_template' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. This vulnerability is only exploitable when the loop_templates parameter is set to 'custom-template'. 2026-09-04 9.8 CVE-2026-11613 DocsGPT--DocsGPT In DocsGPT 0.15.0 and below, the application provides a custom prompt feature that allows users to define prompt content used during chatbot interactions. This functionality renders user-supplied prompt data using Jinja templates without input sanitization or sandboxing. An unauthenticated attacker can inject malicious template expressions, leading to a server-side template injection (SSTI) vulnerability that can be exploited to achieve full remote code execution (RCE). 2026-09-04 9.8 CVE-2026-31020 Dokploy--Dokploy A vulnerability was detected in Dokploy up to 0.29.7. This issue affects the function writeTraefikConfigInPath of the file packages/server/src/utils/traefik/application.ts of the component Settings. The manipulation of the argument path results in path traversal. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. 2026-08-31 9.9 CVE-2026-82954 domainaware--parsedmarc parsedmarc before 11.0.1 decompresses gzip and ZIP attachments in a single unbounded read with no limit on decompressed output size. Because parsedmarc automatically processes incoming DMARC report emails without user interaction, an unauthenticated remote attacker can send a crafted email with a highly compressed attachment to the monitored mailbox, causing the parsedmarc process to allocate memory proportional to the uncompressed size and exhaust available RAM. 2026-09-03 7.5 CVE-2026-82520 Dotstore--WooCommerce Product Attachment Unauthenticated Sensitive Data Exposure in WooCommerce Product Attachment = 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a different sibling plugin, and invoke it without the preHandler hook declared for that handler. The internal not-found router for encapsulated handlers dispatches malformed paths through a single shared handler pointer before URL decoding, ignoring the prefix and skipping the selected handler's normal lifecycle. An unauthenticated attacker can therefore reach an authentication-protected private fallback through an unrelated public prefix and read its full response, bypassing the authentication hook and breaking prefix encapsulation. Users should upgrade to fastify 5.12.2 or later. 2026-09-04 7.5 CVE-2026-76169 fastify--fastify fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a route's header schema before compiling it, but the transformation is incomplete: it lowercases the properties keys and the root-level required array, and does not lowercase the trigger and dependent names inside the JSON Schema Draft 7 dependencies keyword. Because Node stores request header names in lowercase, a canonical-case dependency such as requiring an authentication header whenever a privileged-mode header is present never matches, and the presence assertion is silently skipped. An unauthenticated remote client can therefore send the header that activates a privileged branch while omitting the header the dependency was meant to require, bypassing the conditional check. Users should upgrade to fastify 5.12.2 or later. 2026-09-04 7.5 CVE-2026-84428 fastify--fastify fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance. When an application assigns false to a route's body, querystring, params, or headers schema to deny all input, fastify treats it as a missing schema, compiles no validator, and runs the route handler on any request. An unauthenticated remote client can therefore reach a handler that a valid deny-all schema was intended to make unreachable, a complete validation bypass that can lead to unauthorized state changes or execution of disabled operations. Users should upgrade to fastify 5.12.2 or later. 2026-09-04 7.5 CVE-2026-84469 firecrawl--firecrawl-mcp-server firecrawl-mcp-server 3.20.2 contains an arbitrary local file read vulnerability in the firecrawl_parse tool that accepts unconstrained filePath arguments without directory containment validation. Attackers can supply absolute paths or directory traversal sequences to read sensitive files like credentials and environment variables, which are then uploaded and returned to the model context. 2026-09-04 7.5 CVE-2026-85606 FreeIPMI--FreeIPMI FreeIPMI before 1.6.19 has a stack-based buffer overflow in _ipmi_sel_oem_fujitsu_get_sel_entry_long_text in libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c via malformed Fujitsu SEL long-text responses. 2026-09-04 9.8 CVE-2026-85504 FreeIPMI--FreeIPMI ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _get_dell_system_info_idrac_info in ipmi-oem/ipmi-oem-dell.c (idrac-info subcommand to dell get-system-info). 2026-09-04 9.8 CVE-2026-85506 FreeIPMI--FreeIPMI ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_info in ipmi-oem/ipmi-oem-dell.c (cmc-info subcommand to dell get-system-info). 2026-09-04 9.8 CVE-2026-85507 FreeIPMI--FreeIPMI ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_ipv6_info in ipmi-oem/ipmi-oem-dell.c (cmc-ipv6-info subcommand to dell get-system-info). 2026-09-04 9.8 CVE-2026-85508 FreeIPMI--FreeIPMI FreeIPMI before 1.6.19 has a stack-based buffer overflow in _read_fru_data in libfreeipmi/fru/ipmi-fru.c when a BMC returns more bytes than requested. 2026-09-04 9.8 CVE-2026-85509 FreeIPMI--FreeIPMI ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer over-read in ipmi_oem_fujitsu_get_sel_entry_long_text in ipmi-oem/ipmi-oem-fujitsu.c when a BMC provides a short response, a different vulnerability than CVE-2026-50031 (which has different affected versions). 2026-09-04 7.5 CVE-2026-85505 fs-code--FS Poster - WordPress Social media Auto Poster & Scheduler [Facebook, Instagram, Twitter, Pinterest] The FS-Poster plugin for WordPress is vulnerable to Remote Code Execution in versions up to and including 8.0.1. This is due to insufficient input sanitization of the FFmpeg path parameter before passing it to the exec() function, combined with missing authorization checks on the REST API endpoints. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary commands on the underlying server. 2026-09-01 8.8 CVE-2026-10195 GastroMenum--GastroMenum Web Panel Observable response discrepancy vulnerability in GastroMenum GastroMenum Web Panel allows Account Footprinting. This issue affects GastroMenum Web Panel: before 31.08.2026. 2026-09-04 7.5 CVE-2026-19205 geonetwork--core-geonetwork GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the Saxon XSLT processor used to render formatters is configured without secure processing (`FEATURE_SECURE_PROCESSING`) and without disabling Java extension functions (`ALLOW_EXTERNAL_FUNCTIONS`). Any stylesheet loaded by GeoNetwork can therefore invoke `java.lang.Runtime.exec()` or `java.lang.ProcessBuilder` directly, achieving arbitrary command execution as the GeoNetwork process user. A user with sufficient privileges to upload a formatter can deliver a `.xsl` file containing Java extension call that execute arbitrary OS commands with the privileges of the GeoNetwork process. The issue is patched in GeoNetwork versions 4.4.12 and 4.2.17. 2026-09-03 9.1 CVE-2026-58400 geonetwork--core-geonetwork GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the API endpoint for creating a new formatter via file upload is unprotected and allows the upload of external uncontrolled files. An unauthenticated attacker can upload arbitrary `.xsl` or `.zip` formatter files to the server. An unauthenticated attacker can write arbitrary files into the GeoNetwork formatter directory. On its own this constitutes unauthorized write access to server storage. The issue is patched in GeoNetwork versions 4.4.12 and 4.2.17. 2026-09-03 8.6 CVE-2026-63219 getgrav--grav Grav before 2.0.18 (affected versions sk_protocol without validating whether 'sk' represents a full socket. Fix this issue by checking sk- >sk_state != TCP_LISTEN before inspecting sk- >sk_protocol in both bpf_tcp_gen_syncookie and bpf_tcp_check_syncookie. Since mini-sockets are never in the TCP_LISTEN state, the condition short-circuits and prevents dereferencing fullsock-specific fields. 2026-09-03 7.3 CVE-2026-80738 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: drm/log: Fix out-of-bounds read on empty message length drm_log_draw_kmsg_record() accesses s[len - 1] to strip the trailing newline, but len is unsigned int. If len is 0, the subtraction wraps to UINT_MAX, causing an out-of-bounds read. Add an early return when len is 0. 2026-09-03 7.1 CVE-2026-80741 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: mmc: loongson2: Fix sg iteration in data reorder functions In ls2k0500_mmc_reorder_cmd_data() and ls2k2000_mmc_reorder_cmd_data(), the for_each_sg() macro already iterates over the scatterlist entries, with 'sg' pointing to the current entry. However, the code incorrectly uses '&sg[i]' and 'sg_dma_len(&sg[i])' inside the loop, which treats 'sg' as an array base and indexes it again, leading to access of wrong sg entries (or out-of-bounds if the list is not an array). 2026-09-03 7.8 CVE-2026-80748 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: drm/connector/hdmi: Fix out of bounds memory read A helper function was copying a given audio infoframe into the connector's copy but using the size of the destination (a generic target, sized to accept many different data blocks) not the source (a very specific type of data block). Thus, it was copying 60 bytes of data from a 28 byte allocation. Fix that by using the source size instead, together with a build bug on the source size actually being smaller than the destination. I hit this running KUnit tests under KASAN (while debugging something else entirely). In the real world, it seems unlikely to cause an actual problem. It is a read not a write so it can't corrupt any memory. However, it could potentially fall off the end of a page and cause an accvio bug. 2026-09-03 7.1 CVE-2026-80749 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: mfg: initialize prev_o in mtk_mfg_attach_dev() mtk_mfg_attach_dev() reads prev_o on the first iteration of its loop, in "if (prev_o && prev_o- >freq == o- >freq)", before prev_o is assigned at the end of the loop body. On that first iteration, evaluating prev_o reads an indeterminate value. If it is non-NULL, the condition dereferences a stale or invalid pointer, potentially faulting or incorrectly skipping the first OPP. Initialize prev_o to NULL. This matches the intent as well: there is no previous OPP to compare against on the first iteration. Found with Clang's -Wconditional-uninitialized. 2026-09-03 7.8 CVE-2026-80751 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - fix F55 transmitter electrode count typo During F55 sensor detection, the transmitter (TX) electrode count was incorrectly assigned the value of the receiver (RX) electrode count due to copy-paste typos. This incorrect value was then propagated to the driver data and used by F54 to determine the diagnostics report size. On devices with more RX than TX electrodes, this inflated the perceived TX count, leading to incorrect report size calculations and potential out-of-bounds buffer accesses. Fix the typos by correctly assigning the TX electrode counts. 2026-09-03 7.8 CVE-2026-80754 LiquidThemes--Booking Hub Incorrect Privilege Assignment vulnerability in LiquidThemes Booking Hub allows Privilege Escalation. This issue affects Booking Hub: from n/a through 1.3.1. 2026-09-02 8.8 CVE-2026-81769 LiteSpeed Technologies--LiteSpeed Cache Unauthenticated Server Side Request Forgery (SSRF) in LiteSpeed Cache

Read more »

Shopping for a New iPhone? Compare Prices, Deals and Wireless Plans on One Page
Shopping for a new iPhone can get complicated quickly. The price of the phone is only part of the equation, with carriers offering different discounts, trade-in deals, bill credits, port-in promotions and wireless plans. Our iPhone Price Tracker brings all of that information together on one page. The tracker covers Apple's newest iPhones as well as previous-generation models, comparing current prices across major carriers and lower-cost wireless providers. Dedicated model tabs make it easy to compare prices by storage capacity, while our Deals section highlights some of the better promotions currently available. We also explain the details behind carrier offers, including whether a deal requires a trade-in, new line, number transfer, AutoPay, specific service plan or monthly bill credits. And once you've compared iPhone prices, the Plans section lets you compare wireless service options without leaving the page. Whether you're looking for the lowest upfront iPhone price, a free-phone promotion, a no-trade-in deal or simply a less expensive wireless plan, visit our iPhone Price Tracker, updated regularly as prices and promotions change.

Read more »

Amazon Drops Prices on Entire New Mac mini Lineup, M6 Models Start at $879.99
Amazon has dropped prices across Apple's new Mac mini lineup, with discounts now available on all three standard M6 configurations as well as the M5 Pro model. Prices start at just $879.99 for the M6 Mac mini with 16GB RAM and a 256GB SSD, about $20 below Apple's $899 MSRP. The 16GB/512GB model is down to $1069.99, while the upgraded 24GB/512GB configuration is now $1269.99. View these sale prices at Amazon here. Amazon is also discounting the M5 Pro Mac mini with 24GB RAM and a 512GB SSD to $1669.99, about $30 below Apple's $1699 MSRP. While the discounts are still relatively modest, these are Apple's newest Mac minis and Amazon now has every standard configuration priced below MSRP. For the latest prices and deals, see our Mac mini Price Tracker, updated daily.

Read more »

Amazon Drops 16″ M5 Max MacBook Pro to $3799, Save a Record $600
Amazon has dropped the 16-inch M5 Max MacBook Pro with 36GB RAM and a 2TB SSD to a new low price of $3799, taking a full $600 off Apple’s $4399 MSRP. That’s also another $100 below Amazon’s $3899 sale price from earlier this month, making this a genuinely new price drop rather than a repeat of the previous promotion. Both Space Black and Silver are currently available at the $3799 price. Get the Space Black 16-inch M5 Max MacBook Pro for $3799 at Amazon or get the Silver model for $3799. See our 16-inch MacBook Pro Price Tracker for the latest prices and sales.

Read more »

Amazon Drops New Apple Watch Ultra 4 to $779.99
Amazon has already dropped select Apple Watch Ultra 4 models to $779.99, taking about $19 off Apple’s $799 MSRP just days after the new watch arrived in stores. The sale includes the 49mm Black Titanium model with Translucent Black Ocean Band, which Amazon currently lists at $779.99 with free shipping. Other case and band combinations have also been rotating through the $779.99 sale price. A $19 discount isn’t huge by normal Apple Watch standards, but it’s noteworthy this soon after launch — especially since Ultra 4 was just released on September 18. Get the Apple Watch Ultra 4 for $779.99 at Amazon. For the latest prices and sales, see our Apple Watch Price Tracker, updated daily.

Read more »

Visible Offers $480 in Savings with iPhone 18 Pro and Visible+ Pro
Visible has launched a new iPhone 18 Pro promotion offering $480 in savings when customers purchase the phone at full retail price and activate it on the carrier's $45/month Visible+ Pro plan. Check out the iPhone 18 Pro deal at Visible. Unlike many carrier iPhone promotions, there's no trade-in involved. Visible sells the 256GB iPhone 18 Pro for $1199, and the $480 savings is delivered through monthly service credits over 24 months. That works out to $20 per month in credits while the promotion remains active. The offer is available to both new and existing Visible members who purchase an eligible device at full retail price and maintain qualifying Visible+ Pro service. Visible says the iPhone 18 Pro promotion is scheduled to run through October 31. Visible also continues to offer unlimited service on Verizon's network, with Visible+ Pro normally priced at $45/month. For the latest iPhone prices and carrier promotions, see our iPhone Price Tracker, updated regularly.

Read more »

B&H Takes Up to $450 Off 14″ M5 and M5 Pro MacBook Pros
B&H has launched another round of MacBook Pro discounts, this time taking as much as $450 off select 14-inch M5 and M5 Pro MacBook Pros. Shop B&H's 14-inch MacBook Pro sale. One of the standout deals is a Space Black 14-inch MacBook Pro with an 18-Core M5 Pro CPU, 20-Core GPU, 24GB RAM, and a 1TB SSD for just $2349, a substantial $450 savings from B&H's $2799 regular price. B&H is also taking $400 off the 18-Core M5 Pro model with 48GB RAM and a 1TB SSD, dropping its price to $2899. A Nano-Texture version of that 48GB/1TB configuration is down to $2999, another $450 savings. Other configurations are discounted by $150-$300, and B&H is even taking $300 off a high-end M5 Max model with 64GB RAM and a 2TB SSD. Several of the best-priced configurations are listed as having limited supply at their current prices. For the latest prices and deals across Apple's lineup, see our 14" MacBook Pro Price Tracker, updated daily.

Read more »

B&H Takes Up to $500 Off 16″ M5 Pro and M5 Max MacBook Pros
B&H has launched a new sale on Apple's 16-inch M5 Pro and M5 Max MacBook Pros, with discounts reaching $500 off on select configurations. Shop B&H's 16-inch MacBook Pro sale. Prices start at $2759 for the 16-inch M5 Pro MacBook Pro with 24GB RAM and a 1TB SSD, a $240 savings. B&H also has the 48GB/1TB M5 Pro configuration for $3299, saving $300, while a higher-end 64GB/1TB configuration is $400 off at $3599. The biggest discount is on the Space Black 16-inch M5 Max MacBook Pro with an 18-Core CPU, 40-Core GPU, 48GB RAM, and a 2TB SSD. B&H has that configuration for $4499, a substantial $500 savings from its regular $4999 price. B&H is also discounting upgraded M5 Pro and M5 Max configurations with additional memory, storage, and Nano-Texture displays. Supplies are listed as limited on several of the best deals, and B&H includes free shipping. For the latest prices and deals, see our 16" MacBook Pro Price Tracker, updated daily.

Read more »

Amazon Launches Fresh M4 iPad Air Sale, Prices Start at $649
Amazon has refreshed its sale on Apple’s M4 iPad Air lineup, with prices now starting at just $649 for 11-inch models and $849 for 13-inch models. The 11-inch M4 iPad Air with 128GB of storage is $100 off Apple’s $749 price, while the 13-inch 128GB model is also $100 off at $849. Amazon is offering discounts across several other configurations as well, including up to about $150 off higher-capacity models. Shop 11-inch M4 iPad Airs at Amazon or shop 13-inch M4 iPad Airs at Amazon. For the latest prices across Apple retailers, see our iPad Air Price Tracker.

Read more »

Amazon Takes Up to $150 Off 13″ M5 MacBook Airs, Prices Start at $1199
Amazon has launched a new round of discounts on Apple's 13-inch M5 MacBook Air lineup, with the base 512GB model now $100 off and higher configurations discounted by as much as $150. The 13-inch M5 MacBook Air with 16GB RAM and a 512GB SSD is now available for as little as $1199, a $100 savings from Apple's $1299 MSRP. Buyers who want more storage can step up to the 16GB/1TB model for as little as $1449, saving $150 from Apple's $1599 price. Amazon is also taking $150 off the higher-end 24GB/1TB configuration, dropping its price from $1799 to just $1649 in select colors. That gives buyers a straightforward choice depending on how much memory and storage they need, with meaningful discounts now available across all three standard 13-inch MacBook Air configurations. For the latest sales and deals, see our 13" MacBook Air Price Tracker, updated daily.

Read more »

7 Ways to Save on Apple’s iPhone 17e Right Now, Including Two $0/Month Deals
Apple's 256GB iPhone 17e normally sells for $599, but wireless carriers are competing aggressively for iPhone buyers right now. AT&T and Total Wireless both have $0/month offers, while Boost Mobile, Cricket, Metro, Straight Talk, and Red Pocket are offering their own discounts and rebates. AT&T: $0/month with qualifying new line Total Wireless: $0/month with Edge financing Boost Mobile: $200 off with qualifying service Cricket: $299.99 with qualifying port-in Metro: $349.99 with qualifying port-in Straight Talk: $299.99 upfront + $300 in service credits Red Pocket: $150 rebate with qualifying service For the latest iPhone prices and carrier promotions, see our iPhone Price Tracker.

Read more »

Save Up to $300 on Apple’s iPhone Air at Metro, Total Wireless, and Boost Mobile
Apple's 256GB iPhone Air normally sells for $999, but three wireless carriers have dropped prices as low as $699.99. Metro by T-Mobile leads the pack with a $300 discount for customers who bring their number, while Total Wireless is $250 off and Boost Mobile is $200 off. Metro: $699.99 ($300 off) Total Wireless: $749.99 ($250 off) Boost Mobile: $799.99 ($200 off) For the latest iPhone prices and carrier deals, see our iPhone Price Tracker.

Read more »

Total Wireless Drops the iPhone 16 to $479.99, Save $349
Total Wireless has dropped the 128GB iPhone 16 to just $479.99 when purchased with a qualifying Total ALL ACCESS three-month plan. That's a $349 discount from the phone's $829 regular price, and no trade-in is required. Total Wireless also offers monthly payments through its Edge financing program for qualified customers. Total Wireless service runs on Verizon's 5G network. Shop Total Wireless iPhone deals For the latest iPhone prices and carrier promotions, see our iPhone Price Tracker.

Read more »