Stop guessing: This smart camera ear cleaner shows you exactly how to remove wax safely
The Smart Visual Ear Cleaner's camera gives you a clear view of what’s happening in your ear. It's a high-tech earwax removal method. (via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)

Read more »

Morgan Stanley bumps Apple stock price target, but maintains Overweight rating
The new price target reflects a higher revenue forecast, despite a recent spike in memory costs. Here are the details. more…

Read more »

Morgan Stanley sees Apple moving from AI laggard to leader in 2026
Morgan Stanley analyst Erik Woodring on Wednesday, reiterated an overweight rating on AAPL stock while hiking the price target to $315… The post Morgan Stanley sees Apple moving from AI laggard to leader in 2026 appeared first on MacDailyNews.

Read more »

Apple releases impressive open-source model that instantly turns 2D photos into 3D views
The model, called SHARP, can reconstruct a photorealistic 3D scene from a single image in under a second. Here are some examples. more…

Read more »

Jeff Carlson Reveals How Cell Carriers Handle Disasters and Mega-Events
From the Las Vegas F1 race to the Pacific Northwest's devastating floods, Jeff Carlson's CNET articles reveal the trucks, trailers, drones, and dedicated spectrum that keep first responders connected when it matters most.Read original article

Read more »

Jefferies boosts Apple price target citing resilience to cost pressures
Jefferies has increased its price target for Apple to $283.36 from $246.99, according to a new research note… The post appeared first on MacDailyNews.

Read more »

iOS 26.2 fulfills a five-year-old Apple Music request with new Apple Podcasts features
Five years ago, an Apple Music Radio show tailored to my taste amplified music discovery for me. Discovering new episodes of that show, however, proved difficult. That changed three years later when Apple Podcasts integrated Apple Music Radio shows. While keeping up with new episodes was much easier, listening through the Podcasts app lacked key Apple Music integration. Now in iOS 26.2, Apple has closed the feature gap in an unexpected but effective way. more…

Read more »

Gift Guide: Never lose anything again with these Find My accessories
There’s a robust ecosystem of Find My accessories on the market nowadays. All of these accessories would make great stocking stuffers this holiday season. After all, what’s a better investment than a way to keep track of their most important possessions? more…

Read more »

Gift Guide: Never lose anything again with these Find My accessories
There’s a robust ecosystem of Find My accessories on the market nowadays. All of these accessories would make great stocking stuffers this holiday season. After all, what’s a better investment than a way to keep track of their most important possessions? more…

Read more »

Apple’s AirTag leather key rings are more than half off right now
Macworld Listen, AirTags are absolutely awesome, but they do lack one feature that we see on other Bluetooth trackers, and that’s a way to easily hook them up to keychains on their own. Therefore, you have to buy various accessories to make that work, and some of the ones Apple sells can be as costly as an AirTag itself. That’s where today’s deal comes into play. Amazon’s Woot is selling a pair of Apple’s leather AirTag key rings for just $25, a heavy 64 percent discount on its usual $70 price. You can also grab s single holder for $15. These leather key rings are crafted with care, snuggly fitting over the AirTag, while the stainless steel ring can attach to a zipper in your backpack or to your actual keys. Need more AirTags? It just so happens that a four-pack of AirTags is also on sale for $70 over at Amazon, a savings of $30 a just a few dollars off their all-time low. Once paired with your iPhone, you can use AirTags to easily track lost items in the Find My app, whether they’re close by (by making a sound) or around the world (by using Apple’s global Find My network). Apple stopped making leather accessories when it introduced its FineWoven line of accessories, so once these are gone, they won’t be coming back. So go ahead and grab one (or two) of these Apple AirTag leather key rings for up to 64 percent off before the deal runs out. Buy now at Woot

Read more »

1Password App Zeroed Out by Failed Update
A failed update left 1Password’s app package empty on multiple Macs, rendering it non-functional. The good news: reinstalling 1Password resolved the issue with no data loss.

Read more »

Apple releases first iOS 26.3, iPadOS 26.3, and macOS 26.3 public betas
Apple has rolled out the first public betas of iOS 26.3, iPadOS 26.3, and macOS Tahoe 26.3, making these upcoming updates available to… The post appeared first on MacDailyNews.

Read more »

9to5Mac Daily: December 17, 2025 – Apple’s iPhone roadmap
Listen to a recap of the top stories of the day from 9to5Mac. 9to5Mac Daily is available on iTunes and Apple’s Podcasts app, Stitcher, TuneIn, Google Play, or through our dedicated RSS feed for Overcast and other podcast players. Sponsored by Backblaze: Give yourself the gift of peace of mind. Till the end of the month, 9to5Mac listeners get 30% off with code 9to5Xmas.  more…

Read more »

The Oscars are moving from ABC to YouTube — in 2029
The Academy Awards have found a new home, with the award show and all the awards that aren't generally broadcast moving exclusively to YouTube starting in 2029.The Academy Awards will be broadcast exclusively on YouTube in 2029On Wednesday, YouTube and the The Academy of Motion Picture Arts and Sciences announced an upcoming partnership. So upcoming, in fact, that it won't actually happen until 2029.Starting in 2029, the Academy Awards — colloquially known as the Oscars — will relocate from their longtime home on ABC to YouTube. The event will broadcast free globally and available on YouTube TV in the U.S. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Should you buy a cellular Apple Watch? Here’s what to consider
The Apple Watch lineup is available in a number of different options and configurations, ranging from different case materials, colors, sizes, and more. One of the most important things to consider, however, is whether or not you should buy an Apple Watch with cellular connectivity. An Apple Watch with cellular lets you go out in the world without your iPhone while still remaining connected. It’s a useful feature but one that comes at a cost. more…

Read more »

Grab Apple's M4 MacBook Air for $749, laptops start at just $409
Amazon's best M4 MacBook Air deal is back for $749, with delivery by Christmas to select locations. Prices across new and closeout models start at just $409.Save up to $600 across Apple's MacBook Air line - Image credit: AppleThe $250 discount at Amazon applies to the 13-inch MacBook Air with Apple's M4 chip, 16GB of unified memory, and 256GB of storage in your choice of the four colors.Buy M4 MacBook Air from $749 Continue Reading on AppleInsider | Discuss on our Forums

Read more »

After lagging in AI, 2026 will be critical for Apple’s Siri
As 2025 draws to a close, Apple finds itself under mounting pressure to prove its mettle in the generative AI race, having effectively… The post appeared first on MacDailyNews.

Read more »

Apple releases public beta 1 for iPadOS 26.3, tvOS 26.3, more
Earlier this week Apple debuted the first developer betas for iPadOS 26.3, tvOS 26.3, and more. Now today, the first public beta releases are rolling out too. more…

Read more »

Apple releases public beta 1 of macOS Tahoe 26.3
After releasing the first developer beta of macOS Tahoe 26.3 earlier this week, Apple is already rolling out its public counterpart. Here’s what to expect. more…

Read more »

iOS 26.3 public beta now available, here’s what’s new
iOS 26.3 is now available in public beta, arriving not long after the first developer beta debuted. Here’s what’s new. more…

Read more »

Top 10 ways to maximize AirPods Pro 3 for work and play
Beyond great sound, these 10 ways to maximize AirPods Pro 3 boost your entertainment, focus, productivity and more. (via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)

Read more »

Viral account of 'Pluribus' fridge ad causing mental health hospitalization was a lie
Claims surrounding a "Pluribus" ad on a smart fridge sending a woman to the psychiatric hospital fell apart, after the internet traced the origins of the story back to an online joke.A photo that a poster shared on social mediaThe post drew attention by framing a static advertisement as personalized surveillance. Screenshots linked the message to Apple TV's promotion of Pluribus, pulling Apple into a controversy it doesn't appear to control.The claim spread quickly because it tapped into long-running fears about personalized advertising and smart home surveillance. Apple users were pulled in as screenshots tied the message to an Apple TV promotion of Pluribus. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Compromised Apple Gift Card Leads to Apple Account Lockout
After trying to redeem an Apple Gift Card, Apple developer and author Paris Buttfield-Addison was locked out of his Apple Account with no explanation. Despite extensive media coverage and contact from Apple’s Executive Relations, his account remains locked days later, raising concerning questions about what happens to users without high-profile connections—and whether Apple Gift Cards are safe.

Read more »

How to leave a FaceTime voicemail
When you need to video chat and they don’t pick up the phone, you can send a FaceTime voicemail to someone that they can watch later. (via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)

Read more »

Deals: All M4 MacBook Air configs $250 off, M5 MacBook Pro $250 off, M4 iPad Pro $699 off, more
Today’s 9to5Toys Lunch Break deals are now ready to roll starting off with the return of Amazon Black Friday pricing across the M4 MacBook Air lineup. You’ll now once again find all 13- and 15-inch configurations it sells at $250 off the list price alongside the most affordable M5 MacBook Pro at $250 off. Those offers join some gigantic price drops at Costco on M4 iPad Pro at as much as $699 off the list prices as well as some notable accessory deals –  Apple’s latest Ultra Natural Milanese Loop, the new iPhone Crossbody Strap up to 30% off, and the Beats iPhone 17/Pro Kickstand Case at up to 62% off. Scope it all out down below.  more…

Read more »

Apple leads Morgan Stanley’s top IT hardware picks for 2026
As 2026 approaches, Morgan Stanley anticipates a more challenging landscape for the IT hardware sector, but Apple… The post appeared first on MacDailyNews.

Read more »

Price drop: Secure 10TB of cloud storage for life with one-time payment
Get a massive amount of storage for life from Internxt with this discount 10TB cloud storage plan. Make a single payment of less than $300. (via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)

Read more »

iPhone settings & features you didn’t know existed [Video]
It seems that with every update, Apple quietly adds hundreds of features and settings that are very impactful but easy to miss. These are not the big headliner features, but smaller ones that, once you know about them, make your day-to-day life so much easier. Here are 15 features and settings that every iPhone owner should know about, but probably doesn’t. more…

Read more »

Morgan Stanley raises Apple stock target to $315, citing incredible 2026
Morgan Stanley has raised its Apple stock price target to $315, with the stock still a core overweight pick for the analysts heading into 2026.Tim Cook, celebratingAs 2025 comes to an end, analysts take stock of their stock picks from the year and what to expect for the year ahead. For Morgan Stanley, that includes an increase in confidence in Apple.In a note to investors seen by AppleInsider on Wednesday, Morgan Stanley is increasing its price target for Apple from $305 to $315. This is an increase of $10 from the last time it changed the target on October 31. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

iOS 26.3: New features for your iPhone
Apple released the first iOS 26.3 beta this week for iPhone users. The update focues a lot on interoperability between iPhone and Android devices, as well as support for third-party smartwatches. Here are all of the new iOS 26.3 features so far. more…

Read more »

Most Parked Domains Now Serving Malicious Content
Direct navigation -- the act of visiting a website by manually typing a domain name in a web browser -- has never been riskier: A new study finds the vast majority of "parked" domains -- mostly expired or dormant domain names, or common misspellings of popular websites -- are now configured to redirect visitors to sites that foist scams and malware.

Read more »

Computer Virus Protection Tips and How to Remove a Virus from Your Computer
Computer viruses continue to be a widespread and costly problem, affecting everyone from casual computer users to major organizations. Some of the most damaging incidents in history started with small actions that could have happened to anyone. The Melissa virus spread in 1999 because thousands of people opened what looked like a normal email attachment. […] The post appeared first on The Mac Security Blog.

Read more »

Microsoft Patch Tuesday, December 2025 Edition
Microsoft today pushed updates to fix at least 56 security flaws in its Windows operating systems and supported software. This final Patch Tuesday of 2025 tackles one zero-day bug that is already being exploited, as well as two publicly disclosed vulnerabilities.

Read more »

Drones to Diplomas: How Russia’s Largest Private University is Linked to a $25M Essay Mill
A sprawling academic cheating network turbocharged by Google Ads that has generated nearly $25 million in revenue has curious connections to a Kremlin-connected oligarch whose Russian university builds drones for Russia's war against Ukraine.

Read more »

SMS Phishers Pivot to Points, Taxes, Fake Retailers
China-based phishing groups blamed for non-stop scam SMS messages about a supposed wayward package or unpaid toll fee are promoting a new offering, just in time for the holiday shopping season: Phishing kits for mass-creating fake but convincing e-commerce websites that convert customer payment card data into mobile wallets from Apple and Google. Experts say these same phishing groups also are now using SMS lures that promise unclaimed tax refunds and mobile rewards points.

Read more »

Vulnerability Summary for the Week of November 24, 2025
High Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info Patch Info 0x4m4--HexStrike AI By providing a command-line argument starting with a semi-colon ; to an API endpoint created by the EnhancedCommandExecutor class of the HexStrike AI MCP server, the resultant composed command is executed directly in the context of the MCP server's normal privilege; typically, this is root. There is no attempt to sanitize these arguments in the default configuration of this MCP server at the affected version (as of commit 2f3a5512 in September of 2025). 2025-11-30 9.1 CVE-2025-35028 https://takeonme.org/gcves/GCVE-1337-2025-00000000000000000000000000000000000000000000000000111111111111111111111111000000000000000000000000000000000000000000000000000000011  AMD--AMD Prof Improper return value within AMD uProf can allow a local attacker to bypass KSLR, potentially resulting in loss of confidentiality or availability. 2025-11-24 7.1 CVE-2025-48510 https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-9019.html  AMD--Xilinx Run Time (XRT) Improper input validation within the XOCL driver may allow a local attacker to generate an integer overflow condition, potentially resulting in loss of confidentiality or availability. 2025-11-24 8 CVE-2025-52538 https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8014.html  AMD--Xilinx Run Time (XRT) Inadequate lock protection within Xilinx Run time may allow a local attacker to trigger a Use-After-Free condition potentially resulting in loss of confidentiality or availability 2025-11-24 7.3 CVE-2025-0003 https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8014.html  AMD--Xilinx Run Time (XRT) Improper input validation within the XOCL driver may allow a local attacker to generate an integer overflow condition, potentially resulting in crash or denial of service. 2025-11-24 7.3 CVE-2025-0005 https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8014.html  AMD--Xilinx Run Time (XRT) A buffer overflow with Xilinx Run Time Environment may allow a local attacker to read or corrupt data from the advanced extensible interface (AXI), potentially resulting in loss of confidentiality, integrity, and/or availability. 2025-11-24 7.3 CVE-2025-52539 https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8014.html  ASR--Lapwing_Linux Out-of-bounds Read vulnerability in ASR1903ASR3901 in ASR Lapwing_Linux on Linux (nr_fw modules). This vulnerability is associated with program files Code/nr_fw/DLP/src/NrCgi.C. This issue affects Lapwing_Linux: before 2025/11/26. 2025-11-26 7.4 CVE-2025-13735 https://www.asrmicro.com/en/goods/psirt?cid=41  blubrry--PowerPress Podcasting plugin by Blubrry The Blubrry PowerPress plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in all versions up to, and including, 11.15.2. This is due to the plugin validating file extensions but not halting execution when validation fails in the 'powerpress_edit_post' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. 2025-11-27 8.8 CVE-2025-13536 https://www.wordfence.com/threat-intel/vulnerabilities/id/d420ee49-e7b3-43d8-a263-8a93abd1133c?source=cvehttps://plugins.trac.wordpress.org/browser/powerpress/tags/11.14.1/powerpressadmin.php#L3068https://plugins.trac.wordpress.org/browser/powerpress/tags/11.14.1/powerpressadmin.php#L3012https://plugins.trac.wordpress.org/browser/powerpress/tags/11.14.1/powerpressadmin.php#L2368https://plugins.trac.wordpress.org/changeset/3402635/  Chanjet--CRM A vulnerability has been found in Chanjet CRM up to 20251106. The impacted element is an unknown function of the file /tools/upgradeattribute.php. The manipulation of the argument gblOrgID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. 2025-11-30 7.3 CVE-2025-13788 VDB-333792 | Chanjet CRM upgradeattribute.php sql injectionVDB-333792 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #690084 | Chanjet CRM V1.0 SQL Injectionhttps://github.com/Bellingham-max/CVE/issues/1  code-projects--COVID Tracking System A vulnerability was detected in code-projects COVID Tracking System 1.0. This issue affects some unknown processing of the file /login.php. The manipulation of the argument code results in sql injection. The attack may be performed from remote. The exploit is now public and may be used. 2025-11-24 7.3 CVE-2025-13585 VDB-333349 | code-projects COVID Tracking System login.php sql injectionVDB-333349 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #699840 | code-projects COVID Tracking System V1.0 SQL Injectionhttps://github.com/beamyou/CVE/issues/4https://code-projects.org/  code-projects--Jonnys Liquor A security flaw has been discovered in code-projects Jonnys Liquor 1.0. Affected by this issue is some unknown functionality of the file /detail.php of the component GET Parameter Handler. Performing manipulation of the argument Product results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited. 2025-11-24 7.3 CVE-2025-13582 VDB-333346 | code-projects Jonnys Liquor GET Parameter detail.php sql injectionVDB-333346 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #699554 | code-projects Jonnys Liquor 1.0 /detail.php SQL injectionhttps://github.com/rassec2/dbcve/issues/5https://code-projects.org/  code-projects--Library System A vulnerability has been found in code-projects Library System 1.0. This affects an unknown function of the file /index.php of the component Login. The manipulation of the argument Username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. 2025-11-24 7.3 CVE-2025-13578 VDB-333342 | code-projects Library System Login index.php sql injectionVDB-333342 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #699536 | code-projects Library System 1.0 index.php SQL Injectionhttps://github.com/rassec2/dbcve/issues/4https://code-projects.org/  code-projects--Question Paper Generator A weakness has been identified in code-projects Question Paper Generator 1.0. This affects an unknown part of the file /signupscript.php of the component POST Parameter Handler. Executing manipulation of the argument Fname can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be exploited. 2025-11-24 7.3 CVE-2025-13583 VDB-333347 | code-projects Question Paper Generator POST Parameter signupscript.php sql injectionVDB-333347 | CTI Indicators (IOB, IOC, TTP, IOA)Submit #699591 | code-projects question paper 1.0 /signupscript.php SQL Injectionhttps://github.com/rassec2/dbcve/issues/6https://code-projects.org/  cursor--cursor Improper neutralization of special elements used in an OS command ('command injection') in Cursor allows an unauthorized attacker to execute commands that are outside of those specified in the allowlist, resulting in arbitrary code execution. 2025-11-26 9.8 CVE-2025-62354 https://hiddenlayer.com/sai_security_advisor/2025-11-cursor/  Dassault Systmes--DELMIA Service Process Engineer A stored Cross-site Scripting (XSS) vulnerability affecting Service Items Management in DELMIA Service Process Engineer on Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session. 2025-11-24 8.7 CVE-2025-10555 https://www.3ds.com/trust-center/security/security-advisories/cve-2025-10555  Dassault Systmes--ENOVIA Product Manager A stored Cross-site Scripting (XSS) vulnerability affecting Requirements in ENOVIA Product Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session. 2025-11-24 8.7 CVE-2025-10554 https://www.3ds.com/trust-center/security/security-advisories/cve-2025-10554  DirectoryThemes--Tiger The Tiger theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 101.2.1. This is due to the 'paypal-submit.php' file not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site. 2025-11-27 9.8 CVE-2025-13675 https://www.wordfence.com/threat-intel/vulnerabilities/id/4750b57e-7d8d-49d7-bbbf-46483eb97bd9?source=cvehttps://themeforest.net/item/tiger-social-network-theme-for-companies-professionals/16203995  DirectoryThemes--Tiger The Tiger theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 101.2.1. This is due to the plugin allowing a user to update the user role through the $user- >set_role() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator. 2025-11-27 8.8 CVE-2025-13680 https://www.wordfence.com/threat-intel/vulnerabilities/id/645f60ad-c8e5-47ec-94f1-960de4ef7838?source=cvehttps://themeforest.net/item/tiger-social-network-theme-for-companies-professionals/16203995  Eaton--Eaton Galileo Software Improper input sanitization in the file archives upload functionality of Eaton Galileo software allows traversing paths which could lead into an attacker with local access to execute unauthorized code or commands. This security issue has been fixed in the latest version of Galileo which is available on the Eaton download center. 2025-11-27 7.3 CVE-2025-59890 https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2025-1024.pdf  Elated Themes--FindAll Listing The FindAll Listing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.5. This is due to the 'findall_listing_user_registration_additional_params' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site. Note: The vulnerability can only be exploited if the FindAll Membership plugin is also activated, because user registration is in that plugin. 2025-11-27 9.8 CVE-2025-13538 https://www.wordfence.com/threat-intel/vulnerabilities/id/14981949-271c-4f98-a6a1-b00619f1436d?source=cvehttps://themeforest.net/item/findall-business-directory-theme/24415962  Elated Themes--FindAll Membership The FindAll Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.4. This is due to the plugin not properly logging in a user with the data that was previously verified through the 'findall_membership_check_facebook_user' and the 'findall_membership_check_google_user' functions. This makes it possible for unauthenticated attackers to log in as administrative users, as long as they have an existing account on the site which can easily be created by default through the temp user functionality, and access to the administrative user's email. 2025-11-27 9.8 CVE-2025-13539 https://www.wordfence.com/threat-intel/vulnerabilities/id/a856a96a-68d2-462d-b523-840668980807?source=cvehttps://themeforest.net/item/findall-business-directory-theme/24415962  factionsecurity--faction FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to version 1.7.1, an extension execution path in Faction's extension framework permits untrusted extension code to execute arbitrary system commands on the server when a lifecycle hook is invoked, resulting in remote code execution (RCE) on the host running Faction. Due to a missing authentication check on the /portal/AppStoreDashboard endpoint, an attacker can access the extension management UI and upload a malicious extension without any authentication, making this vulnerability exploitable by unauthenticated users. This issue has been patched in version 1.7.1. 2025-11-26 9.7 CVE-2025-66022 https://github.com/factionsecurity/faction/security/advisories/GHSA-xr72-2g43-586whttps://github.com/factionsecurity/faction/commit/c6389f1c76175b7c1c68d1a87b389311b16c62c3  fugue-project--fugue Fugue is a unified interface for distributed computing that lets users execute Python, Pandas, and SQL code on Spark, Dask, and Ray with minimal rewrites. In version 0.9.2 and prior, there is a remote code execution vulnerability by pickle deserialization via FlaskRPCServer. The Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the _decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC server. The vulnerability exists in the RPC communication mechanism where the client can send arbitrary serialized Python objects that will be deserialized on the server side, allowing attackers to execute arbitrary code on the victim's machine. This issue has been patched via commit 6f25326. 2025-11-25 8.8 CVE-2025-62703 https://github.com/fugue-project/fugue/security/advisories/GHSA-xv5p-fjw5-vrj6https://github.com/fugue-project/fugue/commit/6f25326779fd1f528198098d6287c5a863176fc0  geoserver--geoserver GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.26.2 and before 2.25.6, an XML External Entity (XXE) vulnerability was identified. The application accepts XML input through a specific endpoint /geoserver/wms operation GetMap. However, this input is not sufficiently sanitized or restricted, allowing an attacker to define external entities within the XML request. This issue has been patched in GeoServer 2.25.6, GeoServer 2.26.3, and GeoServer 2.27.0. 2025-11-25 8.2 CVE-2025-58360 https://github.com/geoserver/geoserver/security/advisories/GHSA-fjf5-xgmq-5525https://osgeo-org.atlassian.net/browse/GEOS-11682  GitLab--GitLab GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that could have allowed an unauthenticated user to cause a Denial of Service condition by sending specifically crafted requests containing malicious JSON payloads. 2025-11-26 7.5 CVE-2025-12571 GitLab Issue #579168HackerOne Bug Bounty Report #3362239  GL-Inet--GL-AXT1800 A firmware downgrade vulnerability exists in the OTA Update functionality of GL-Inet GL-AXT1800 4.7.0. A specially crafted .tar file can lead to a firmware downgrade. An attacker can perform a man-in-the-middle attack to trigger this vulnerability. 2025-11-24 8.3 CVE-2025-44018 https://talosintelligence.com/vulnerability_reports/TALOS-2025-2230  HCL Software--iNotes HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input. A remote, unauthenticated attacker can specially craft a URL to execute script in a victim's Web browser within the security context of the hosting Web site and/or steal the victim's cookie-based authentication credentials. 2025-11-25 8.1 CVE-2025-0248 https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0127032  Huawei--HarmonyOS Permission control vulnerability in the memory management module. Impact: Successful exploitation of this vulnerability may affect confidentiality. 2025-11-28 9.3 CVE-2025-64314 https://consumer.huawei.com/cn/support/bulletinlaptops/2025/11/  Huawei--HarmonyOS Permission control vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. 2025-11-28 8.4 CVE-2025-58302 https://consumer.huawei.com/en/support/bulletin/2025/11/  Huawei--HarmonyOS UAF vulnerability in the screen recording framework module. Impact: Successful exploitation of this vulnerability may affect availability. 2025-11-28 8.4 CVE-2025-58303 https://consumer.huawei.com/en/support/bulletin/2025/11/  Huawei--HarmonyOS Permission control vulnerability in the distributed component. Impact: Successful exploitation of this vulnerability may affect service confidentiality. 2025-11-28 8 CVE-2025-58310 https://consumer.huawei.com/en/support/bulletin/2025/11/  Huawei--HarmonyOS Vulnerability of improper criterion security check in the call module. Impact: Successful exploitation of this vulnerability may cause features to perform abnormally. 2025-11-28 7.3 CVE-2025-58308 https://consumer.huawei.com/en/support/bulletin/2025/11/  Huawei--HarmonyOS DoS vulnerability in the video-related system service module. Impact: Successful exploitation of this vulnerability may affect availability. 2025-11-28 7.3 CVE-2025-58316 https://consumer.huawei.com/en/support/bulletin/2025/11/  Janitza--UMG 96-PA An unauthenticated remote attacker can send a specially crafted Modbus read command to the device which leads to a denial of service. 2025-11-24 7.5 CVE-2025-41729 https://certvde.com/de/advisories/VDE-2025-094  kiteworks--security-advisories Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, a bug in Kiteworks MFT could cause under certain circumstances that a user's active session would not properly time out due to inactivity. This issue has been patched in version 9.1.0. 2025-11-29 7.1 CVE-2025-53896 https://github.com/kiteworks/security-advisories/security/advisories/GHSA-23h2-3jj8-58hm  kiteworks--security-advisories Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, the back-end of Kiteworks MFT is vulnerable to an incorrectly specified destination in a communication channel which allows an attacker with administrative privileges on the system under certain circumstances to intercept upstream communication which could lead to an escalation of privileges. This issue has been patched in version 9.1.0. 2025-11-29 7.2 CVE-2025-53899 https://github.com/kiteworks/security-advisories/security/advisories/GHSA-5gx5-vcpp-8cr5  Logpoint--SIEM An issue was discovered in Logpoint before 7.7.0. Insufficient input validation and a lack of output escaping in multiple components leads to a cross-site scripting (XSS) vulnerability. 2025-11-27 8.5 CVE-2025-66359 https://servicedesk.logpoint.com/hc/en-us/articles/29158899698333-XSS-Vulnerability-due-to-insufficient-input-validation  Mattermost--Mattermost Mattermost versions 10.12.x

Read more »

Cybersecurity Best Practices: Essential Tips for Modern Mac Security
Cybersecurity affects every person who uses a device, connects to the internet, pays bills online, or stores important files digitally. The rise of cloud services, mobile apps, and complex online accounts has created new opportunities for criminals to target individuals. Mac users benefit from strong built-in protections, but threats now focus less on operating systems […] The post appeared first on The Mac Security Blog.

Read more »

What Is a Network Security Key? How to Find Your Wi-Fi Password on Any Device
If you have ever tried connecting a new phone, laptop, tablet, or smart home device to your Wi-Fi network, you have likely been asked for something called a network security key. The name sounds technical, but it simply refers to the password that protects your wireless network. Understanding what a network security key is, how […] The post appeared first on The Mac Security Blog.

Read more »

Meet Rey, the Admin of ‘Scattered Lapsus$ Hunters’
A prolific cybercriminal group that calls itself "Scattered LAPSUS$ Hunters" made headlines regularly this year by stealing data from and publicly mass extorting dozens of major corporations. But the tables seem to have turned somewhat for "Rey," the moniker chosen by the technical operator and public face of the hacker group: Earlier this week, Rey confirmed his real life identity and agreed to an interview after KrebsOnSecurity tracked him down and contacted his father.

Read more »

Is Your Android TV Streaming Box Part of a Botnet?
On the surface, the Superbox media streaming devices for sale at retailers like BestBuy and Walmart may seem like a steal: They offer unlimited access to more than 2,200 pay-per-view and streaming services like Netflix, ESPN and Hulu, all for a one-time fee of around $400. But security experts warn these TV boxes require intrusive software that forces the user's network to relay Internet traffic for others, traffic that is often tied to cybercrime activity such as advertising fraud and account takeovers.

Read more »

Vulnerability Summary for the Week of November 17, 2025
High Vulnerabilities PrimaryVendor — Product Description Published CVSS Score Source Info Patch Info ABB–ABB Ability Edgenius Authentication Bypass Using an Alternate Path or Channel vulnerability in ABB ABB Ability Edgenius.This issue affects ABB Ability Edgenius: 3.2.0.0, 3.2.1.1. 2025-11-20 9.6 CVE-2025-10571 https://search.abb.com/library/Download.aspx?DocumentID=7PAA022088&LanguageCode=en&DocumentPartId=&Action=Launch  AMD–AMD StoreMI A DLL hijacking vulnerability in AMD StoreMIâ„¢ could allow an attacker to […]

Read more »

Apple’s 15-inch M4 MacBook Airs are back on Holiday sale again for $250 off MSRP, prices start at $949
Amazon has all 15" M4 MacBook Airs on Holiday sale again for $250 off Apple's MSRP, starting at only $949. Delivery is still available in time for Christmas. Be sure to select Amazon as the seller, rather than a third-party: - 15" M4 MacBook Air (16GB/256GB): $949, $250 off - 15" M4 MacBook Air (16GB/512GB): $1149, $250 off - 15" M4 MacBook Air (24GB/512GB/): $1349, $250 off These are the best Holiday sale prices currently available for 15" M4 MacBook Airs. For the latest sales & prices, see our 15" MacBook Air Price Tracker, updated daily.

Read more »

Holiday Sale: $70 off Apple’s 11-inch A16 iPad, now only $279
Walmart is offering a $70 Holiday discount on Apple's 11" A16 WiFi 128GB iPad, now priced at only $279. Sale price for online orders only, in-store price may vary. Order online and choose free shipping or free local store pickup (if available): - 11" 128GB WiFi A16 iPad: $279, $70 off MSRP For the latest prices & deals, keep an eye on our iPad Price Tracker, updated daily.

Read more »

Take $440 off Apple’s 16-inch MacBook Pros with the latest Holiday sale prices
Amazon has 16-inch M4 Pro and M4 Max MacBook Pros (Silver and Black colors) on sale for up to $440 off Apple's MSRP as part of their Holiday sales. Shipping is free. Be sure to select Amazon as the seller, rather than a third-party seller: - 16" M4 Pro MacBook Pro (24GB/512GB/Black): $2199, $300 off MSRP - 16" M4 Pro MacBook Pro (24GB/512GB/Silver): $2190.08, $309 off MSRP - 16" M4 Pro MacBook Pro (48GB/512GB/Black): $2529, $370 off MSRP - 16" M4 Pro MacBook Pro (48GB/512GB/Silver): $2549, $350 off MSRP - 16" M4 Max MacBook Pro (36GB/1TB/Black): $3063.84, $436 off MSRP - 16" M4 Max MacBook Pro (36GB/1TB/Silver): $3059.76, $440 off MSRP - 16" M4 Max MacBook Pro (48GB/1TB/Black): $3599, $400 off MSRP - 16" M4 Max MacBook Pro (48GB/1TB/Silver): $3599, $400 off MSRP These are the lowest Holiday sale prices on new 16" Apple MacBook Pros right now. For the latest sales and prices, keep an eye on our 16-inch MacBook Pro Price Tracker, updated daily.

Read more »

Sunday Holiday Sale: Take $200-$250 off M4 MacBook Airs, prices start at only $749
Amazon has all 13" M4 MacBook Airs and 15" M4 MacBook Airs on Holiday sale for $200-$250 off Apple's MSRP, starting at only $749. Be sure to select Amazon as the seller, rather than a third-party: - 13" M4 MacBook Air (16GB/256GB): $749, $250 off - 13" M4 MacBook Air (16GB/512GB): $949, $250 off - 13" M4 MacBook Air (24GB/512GB): $1149, $250 off - 15" M4 MacBook Air (16GB/256GB): $999, $200 off - 15" M4 MacBook Air (16GB/512GB): $1199, $200 off - 15" M4 MacBook Air (24GB/512GB/): $1399, $200 off Their prices are the lowest available for new M4 MacBook Airs anywhere and represent one of the best Holiday deals on Apple products available right now. For the latest sales & prices, see our 13" MacBook Air Price Tracker and 15" MacBook Air Price Tracker, both updated daily.

Read more »

Holiday Sale: M4 Mac minis available starting at only $479
Amazon has M4 and M4 Pro Mac minis on Holiday sale starting at only $479 and ranging up to $120 off MSRP. Shipping is free: - Mac mini M4 (16GB/256GB): $479, $120 off MSRP - Mac mini M4 (16GB/512GB): $699, $100 off MSRP - Mac mini M4 (24GB/512GB): $923, $26 off MSRP - Mac mini M4 Pro (24GB/512GB): $1287, $112 off MSRP These are the lowest Holiday sale prices currently available on Mac minis. For the latest prices and sales, keep an eye on our Mac mini Price Tracker, updated daily.

Read more »

Walmart if offering a $100 Apple Watch Series 11 Holiday discount this weekend
Walmart is now offering a $100 online discount on new Apple Watch Series 11 models as part of their Holiday sales. Sale prices for online orders only, in-store prices may vary. Order online and choose free shipping or free local store pickup (if available): - 42mm Apple Watch Series 11 GPS: $299, save $100 - 46mm Apple Watch Series 11 GPS: $329, save $100 - 42mm Apple Watch Series 11 GPS + 5G: $399, save $100 - 46mm Apple Watch Series 11 GPS + 5G: $429, save $100 These are the lowest Holiday sale prices available for Apple Watch Series 11 models. For the latest prices & sales, keep an eye on our Apple Watch Price Tracker, updated daily.

Read more »

Apple Watch SE 3 on sale this weekend for $50 off MSRP, prices start at $199
Walmart has Apple Watch SE 3 models on sale on their online store for $50 off MSRP as part of their ongoing Holiday savings. Sale prices for online orders only, in-store prices may vary. Order online and choose free shipping or free local store pickup (if available): - 40mm Apple Watch SE GPS: $199, $50 off MSRP - 44mm Apple Watch SE GPS: $229, $50 off MSRP - 40mm Apple Watch SE GPS + 5G: $249, $50 off MSRP - 44mm Apple Watch SE GPS + 5G: $279, $50 off MSRP These are the lowest Holiday prices available for Apple Watch SE 3 models. For the latest prices & deals, keep an eye on our Apple Watch Price Tracker, updated daily.

Read more »

AirPods Pro 3 on Holiday Sale for $50 off Apple’s MSRP, now only $199
Amazon has Apple AirPods Pro 3 on Holiday sale for $50 off MSRP, including free shipping: - AirPods Pro 3: $199, $50 off Their price is the lowest we've seen so far for these new AirPods Pro models. Keep an eye on our AirPods Price Tracker for the latest prices and deals, updated daily.

Read more »

Holiday Sale: 24-inch iMacs for $150-$170 off MSRP
Amazon has Apple's 24-inch M4 iMacs on Holiday sale for $150-$170 off MSRP, starting at $1149, each including free shipping: - 24-inch M4 iMac (8-Core CPU, 16GB RAM, 256GB SSD): $1149, $150 off MSRP - 24-inch M4 iMac (10-Core CPU, 16GB RAM, 256GB SSD): $1349, $150 off MSRP - 24-inch M4 iMac (10-Core CPU, 16GB RAM, 512GB SSD): $1549, $150 off MSRP - 24-inch M4 iMac (8-Core CPU, 24GB RAM, 512GB SSD): $1729-1749, $150-$170 off MSRP Amazon's prices are the lowest available for one of these new iMacs. Note that stock can vary. Price posted above is the lowest price available for each standard configuration, regardless of color. For the latest prices and deals, see our iMac Price Tracker, updated daily.

Read more »

Holiday Sale: Apple 11-inch M3 iPads for $100-$50 off MSRP
Take $100-$50 off 11-inch M3 iPad Airs at Amazon as part of their ongoing Holiday sale. Shipping is free: - 11" 128GB WiFi M3 iPad Air: $499, $100 off MSRP - 11" 256GB WiFi M3 iPad Air: $599, $100 off MSRP - 11" 512GB WiFi M3 iPad Air: $824.99, $75 off MSRP - 11" 1TB WiFi M3 iPad Air: $1049, $50 off MSRP Be sure to order from Amazon itself rather than a third-party seller. These are the lowest prices currently available for new 11" M3-powered iPad Airs. For the latest prices & sales, keep an eye on our iPad Air Price Tracker, updated daily.

Read more »

27-inch 5K Studio Displays back in stock and on Holiday sale starting at $1368, up to $231 off MSRP
Amazon has Apple Studio Displays (Standard Glass) back in stock and on Holiday sale starting at $1368, up to $231 off MSRP. Shipping is free: - Studio Display (Tilt Adjustable): $1368 $231 off MSRP - Studio Display (Tilt & Height Adjustable): $1849 $150 off MSRP Their prices are the lowest available for Studio Displays among the retailers we track, and $1368 is the lowest price we've seen for a new Studio Display for the past few months. For the latest prices and sales, see our Studio Display Price Tracker, updated daily.

Read more »

2nd generation Apple HomePods on sale for $20 off MSRP with free 1-2 day shipping
B&H Photo has Apple's 2nd generation full-size HomePods (White or Midnight) on sale for $20 off MSRP. This is the steepest discount available on 2nd-gen HomePods among the Apple retailers we track. In addition, B&H offers free 1-2 day shipping on these models to most US addresses: - HomePod (White): $279, save $20 - HomePod (Midnight): $279, save $20 See our HomePod Price Tracker for the latest prices and deals from Apple and its resellers.

Read more »