reporter

Micron's chief business officer has hinted, without calling it out by name, that Apple's tough supplier negotiations contributed to the conditions behind the global memory shortage. In remarks given to The Wall Street Journal on Wednesday, Sumit Sadana explained that Micron was unable to fund capacity expansion during the industry's previous slump, a period when its margins turned negative partly because some buyers pushed relentlessly for lower prices. We told a couple of the customers who were being very aggressive with pricing at that time that this is not constructive. A lot of the industry investments got shut down in 2023 because of really poor pricing and really poor margins. Micron is one of Apple's memory suppliers, providing some of the DRAM and NAND flash chips that go into iPhones, Macs, and iPads. Apple has a reputation for getting favorable terms from suppliers like Micron through long-term purchasing contracts. Sadana's comments came just hours after Apple unveiled a sweeping round of price hikes that touched nearly every part of its hardware lineup. Products across the Mac, iPad, Apple TV, HomePod, and Vision Pro lines all went up in price, with only the iPhone, Apple Watch, and AirPods left untouched. Apple's stock closed down 6% the same day, its worst single-day performance in more than a year, wiping out roughly $265 billion in market value. Apple CEO Tim Cook forewarned about this outcome more than a week earlier in comments to the same publication, warning that price increases had become unavoidable given how the company was being squeezed on memory and storage costs. Cook said Apple had been trying to shield customers from the worst of it but had reached a breaking point, describing the shortage as a "hundred-year flood" unlike anything he had seen in more than four decades. He pointed to the surge in demand for high-bandwidth memory used in AI servers, arguing that consumer products were now competing for a shrinking pool of supply and that pricing needed to come back down to earth before Apple's own prices could follow.Tag: Micron This article, "Micron Suggests Apple Helped Cause Memory Price Crisis" first appeared on MacRumors.com Discuss this article in our forums View the full article

Apple's upcoming high-end MacBook model featuring an OLED touchscreen display will use the company's current M5 Pro and M5 Max chips, according to Bloomberg's Mark Gurman. The new, top-of-the-line device will launch "between late this year and early next year," Gurman said, adopting the existing high-end Apple silicon chips rather than next-generation M6 versions. Like the MacBook Pro, the touchscreen MacBook will be available in 14- and 16-inch display sizes, code-named "K114" and "K116." The device will also feature a new design and an iPhone-style Dynamic Island. It is expected to be more expensive than the M5 Pro ‌MacBook Pro‌, which now starts at $1,999 as of Apple's recent price rises. Yesterday, Gurman revealed that Apple plans to skip what would have been the "M6 Pro" and "M6 Max" for more powerful "M7 Pro" and "M7 Max" chips. The M7 series of chips is said to be focused on intense AI workloads, featuring upgraded neural accelerators, graphics enhancements, and increased memory bandwidth. A new entry-level ‌MacBook Pro‌ with the M6 chip is still expected to launch later this year. Apple is apparently working on a successor to the high-end MacBook model containing the M7 Pro and M7 Max chips, planned for release toward the end of 2027. The company is also planning to refresh the Mac Studio with M7 Max and M7 Ultra chip options in 2028. Tags: Bloomberg, Mark Gurman, OLED This article, "Apple's OLED 'MacBook Ultra' Will Stick With M5 Pro and M5 Max Chips" first appeared on MacRumors.com Discuss this article in our forums View the full article

Amazon's stock on select iPads and Macs has begun dwindling in the face of announced price hikes from Apple yesterday. These price changes are now live on Apple.com, but they have yet to hit third party retailers like Amazon. If you're interested in any of these products, now is the time to buy them on Amazon, before the retailer gets these price hikes as well. Note: MacRumors is an affiliate partner with Amazon. When you click a link and make a purchase, we may receive a small payment, which helps us keep the site running. Below we've listed all of the biggest products available on Amazon that have price hikes on Apple.com. Given that it's still Prime Day, many of these devices are on sale right now. You can read more about the incoming price changes in our lead article. MacBook Neo All of the 256GB MacBook Neo models have sold out on Amazon, but you can still get the 512GB model for $689.99, which is now a $109 discount. If you're looking for the 256GB model, Best Buy has that device for $599.00 right now, which is a $100 discount on the new price. $100 OFFMacBook Neo (256GB) for $599.00 $109 OFFMacBook Neo (512GB) for $689.99 HomePod Best Buy is offering up to $50 off HomePod models, now starting at $99.95 for the HomePod mini and $299.99 for the HomePod. $30 OFFHomePod mini for $99.95 $50 OFFHomePod for $299.99MacBook Pro Starting with the 14-inch MacBook Pro models, you can get the 24GB/1TB M5 Pro MacBook Pro for $2,049.99, now a $449 discount on the new price. $449 OFF14-inch M5 Pro MacBook Pro (24GB/1TB) for $2,049.99 $600 OFF14-inch M5 Pro MacBook Pro (24GB/2TB) for $2,399.00 $799 OFF14-inch M5 Max MacBook Pro (36GB/2TB) for $3,299.99 You can get up to $750 off the 16-inch MacBook Pro right now on Amazon, with the 24GB RAM/1TB M5 Pro model hitting $2,549.99, a $449 discount on the new price. $449 OFF16-inch M5 Pro MacBook Pro (24GB/1TB) for $2,549.99 $750 OFF16-inch M5 Max MacBook Pro (36GB/2TB) for $3,649.00MacBook Air MacBook Air stock is quickly dwindling on Amazon, but there are still a few models seeing discounts of up to $349 off new prices this week. $349 OFF13-inch M5 MacBook Air (512GB) for $949.99 $349 OFF15-inch M5 MacBook Air (512GB) for $1,149.99 iPad Air Amazon has up to $350 off the M4 iPad Air, although stock is quickly dwindling due to Apple's price hikes. $229 OFF11-inch M4 iPad Air (128GB Wi-Fi) for $519.99 $210 OFF11-inch M4 iPad Air (512GB Wi-Fi) for $839.00 $230 OFF13-inch M4 iPad Air (512GB Wi-Fi) for $1,019.00 $350 OFF13-inch M4 iPad Air (1TB Wi-Fi) for $1,199.00iPad Pro Amazon has $299 off a select handful of iPad Pro models, starting at $899.99 for the 256GB Wi-Fi 11-inch iPad Pro. $299 OFF11-inch iPad Pro (256GB Wi-Fi) for $899.99 $299 OFF13-inch iPad Pro (256GB Wi-Fi) for $1,199.99 iPad Amazon is taking $150 off Wi-Fi models of Apple's 11th generation iPad for Prime Day. Prices start at $299.00 for the 128GB Wi-Fi iPad, down from the new price of $449.00. $150 OFF128GB Wi-Fi iPad for $299.00 $150 OFF512GB Wi-Fi iPad for $599.00 If you're on the hunt for more discounts, be sure to visit our Apple Deals roundup where we recap the best Apple-related bargains of the past week. Deals Newsletter Interested in hearing more about the best deals you can find in 2026? Sign up for our Deals Newsletter and we'll keep you updated so you don't miss the biggest deals of the season! Related Roundup: Apple Deals This article, "Amazon and Best Buy Still Offering Pre-Hike Prices on iPads and Macs" first appeared on MacRumors.com Discuss this article in our forums View the full article

Apple's iPhone 18 Pro lineup and its first foldable iPhone will launch at higher prices than originally predicted this September, according to several known Chinese leakers. The leaker known as "Fixed Focus Digital" said on Weibo that while Apple's current iPhone models haven't seen a price increase, the ‌iPhone 18 Pro‌ models launching this fall "will definitely see a price hike," adding that the foldable iPhone in particular could be priced 10% to 20% higher than previously expected. Bloomberg's Mark Gurman reported that the foldable iPhone is expected to "cross the $2,000 threshold" in the U.S., which would make it the most expensive iPhone Apple has ever sold, surpassing even the $1,999 iPhone 17 Pro Max in its 2TB configuration. Analyst Ming-Chi Kuo believes pricing will not be below $2,000, and could even exceed $2,500. Other projections have also fallen within that range. Given that spread of existing estimates, the new Weibo claims about a further 10% to 20% price increase would push even the lowest of those projections well past the $2,099 mark, and could put a higher storage configuration of the device beyond $3,000. "Digital Chat Station" said it is "highly unlikely" that the ‌iPhone 18 Pro‌ series avoids a price increase altogether. The leaker pointed to the ‌iPhone 17 Pro‌'s 8,999 yuan starting price in China and suggested Apple could push the 18 Pro to a 9,999 yuan starting price to protect its margins, which would put the entire September lineup, including the ‌iPhone 18 Pro‌, ‌iPhone 18 Pro‌ Max, and the foldable iPhone, at 10,000 yuan or more. That would amount to an increase of roughly 11% over the ‌iPhone 17 Pro‌'s Chinese price. Apple has historically kept its Chinese and U.S. starting prices roughly proportional across recent iPhone generations, so an 11% increase applied to the ‌iPhone 17 Pro‌'s $1,099 U.S. starting price would put the ‌iPhone 18 Pro‌ at around $1,220. The leaker known as "Instant Digital" floated an even steeper number, suggesting the 256GB ‌iPhone 18 Pro‌ Max could start at 10,999 or even 11,499 yuan, calling that an expensive price point for what is a non-foldable phone. At that level, the ‌iPhone 18 Pro‌ Max would be priced roughly 15% to 20% above the current ‌iPhone 17 Pro‌ Max's 9,999 yuan starting price in China, a jump that, if mirrored in the U.S., could put the 256GB model's starting price somewhere in the $1,300 to $1,400 range, up from $1,199 today. These leaker estimates echo a wave of recent reporting on the rising cost of building the ‌iPhone 18 Pro‌. Research firm TechInsights estimates that Apple paid around $39 for the 12GB of DRAM in the ‌iPhone 17 Pro‌, a figure that could climb to $145 in the ‌iPhone 18 Pro‌, pushing the device's total bill of materials up by roughly 25%. Based on similar cost projections, Apple would need to charge around $1,369 for the ‌iPhone 18 Pro‌ to preserve its current profit margin on the ‌iPhone 17 Pro‌. Once a pricier new camera system is factored in, The Wall Street Journal estimates a starting price of $1,399 or higher. The latest rumors follow Apple's decision to raise prices on most of its devices this week, with the exception of the iPhone, AirPods, and Apple Watch. Apple CEO Tim Cook confirmed last week that the increases were unavoidable, citing the soaring cost of memory and storage chips as a "hundred year flood." Apple has historically absorbed component cost swings rather than passing them on to customers, making this round of increases a notable shift in approach. Related Roundup: iPhone 18 ProTags: Digital Chat Station, Fixed Focus Digital, Foldable iPhone, Instant Digital This article, "iPhone 18 Pro and Foldable iPhone Tipped to Get Price Hikes Too" first appeared on MacRumors.com Discuss this article in our forums View the full article

Earlier today, we reported that Apple added the MacBook Neo to the refurbished store on its website, and it turns out the new additions go beyond that. The other products added to Apple's refurbished store in the U.S. and Canada for the first time today include the MacBook Air with the M5 chip, MacBook Pro models with M5 Pro and M5 Max chips, and the second-generation Studio Display (2026). The higher-end Studio Display XDR was also briefly available on Apple's refurbished store in Canada. All of the products listed above were originally released in March 2026. Note that the listings incorrectly state that the Studio Display (2026) has an XDR display, which is actually limited to the higher-end Studio Display XDR. Given that Apple just raised prices on select products, including all Macs, the prices for many of these refurbished models are similar to what Apple was charging for the equivalent brand-new models just a day ago. For example, the MacBook Air with the M5 chip now starts at $1,299, up from $1,099, and refurbished models start at $1,099. Given the Studio Display did not receive a price increase, though, there are opportunities for savings on that product. In the U.S., the second-generation model starts at $1,599 brand new, whereas the refurbished equivalent starts at $1,359. Some of these products have also been added to Apple's refurbished store in select European countries, Australia, New Zealand, Singapore, and elsewhere. Apple says it puts refurbished products through "full functionality testing" and a "thorough cleaning process and inspection," and they are covered by Apple's one-year limited warranty and eligible for extended AppleCare+ coverage. In our view, Apple's own refurbished devices are virtually indistinguishable from brand-new devices.Related Roundups: Studio Display, MacBook Pro, MacBook AirTag: Apple Refurbished ProductsBuyer's Guide: Displays (Buy Now), MacBook Pro (Buy Now), MacBook Air (Buy Now)Related Forums: Mac Accessories, MacBook Pro, MacBook Air This article, "Apple Adds More 2026 Macs and Studio Display 2 to Refurbished Store" first appeared on MacRumors.com Discuss this article in our forums View the full article

In a social media post today, Apple CEO Tim Cook said Apple will be donating to relief efforts on the ground in Venezuela after the country was hit by two catastrophic earthquakes this week. Apple has donated to the Red Cross for earthquake and hurricane relief efforts in the past — it does not disclose the amounts. This article, "Apple Donating to Relief Efforts in Venezuela Following Devastating Earthquakes" first appeared on MacRumors.com Discuss this article in our forums View the full article

Apple is developing a smart ring that could potentially rival products like the Oura Ring and Samsung Galaxy Ring, according to the leaker and prototype collector known as "Kosutami." The latest Oura Ring 5 starts at $399 Apple has toyed with the idea of a smart ring for several years, as indicated by several patents, and there have been previous rumors that Apple has investigated a wearable for the finger to track a user's biometrics. Reports dating back to 2024 said Apple was weighing up the idea as a viable expansion of its wearables lineup – something that may appeal to people who would prefer a biometric accessory that's more inconspicuous than an Apple Watch. Rumors have petered out over the last couple of years, but now it seems that the popularity of the latest Oura Ring has caught Apple's attention, if the latest rumor is anything to go by. However, no other details were provided by the leaker. The original Oura Ring was released by Finnish health technology company Oura back in 2015. The device collects activity, heart rate, respiratory rate, and sleep data, and transmits it via Bluetooth to the Oura app. iRing thing under development. What a surprise. — Kosutami (@Kosutami_Ito) June 24, 2026 Now in it's fifth iteration, the latest Oura Ring is a lot smaller than previous versions and boasts new health-monitoring capabilities including blood pressure trend detection, nighttime breathing analysis, and tools for GLP-1 medication tracking. Would you be interested in an "iRing" as an alternative to Apple Watch? Let us know in the comments. This article, "Apple 'iRing' Rumor Re-Emerges Amid Oura Ring Popularity" first appeared on MacRumors.com Discuss this article in our forums View the full article

Apple today began selling refurbished MacBook Neo units through its Certified Refurbished store, a day after raising prices on the laptop and several other products. The refurbished ‌MacBook Neo‌ is available in all four colors, Silver, Citrus, Indigo, and Blush, in both configurations. The base model with 256GB of storage starts at $599, while a higher end version with Touch ID and 512GB storage starts at $679. Both configurations are available across the full color lineup, for eight refurbished SKUs in total. The refurbished pricing undercuts Apple's current new unit pricing for the ‌MacBook Neo‌. Apple yesterday raised prices on many products, including the MacBook Neo, which now starts at $699 in the United States, up from $599 when it launched in March. The higher end configuration with 512GB of storage and a ‌Touch ID‌ button also received a $100 price increase and now starts at $799, up from $699. That means the new refurbished listings are priced at or near to the laptop's original, pre-hike rates. Apple said the broad range of price increases are due to the ongoing memory chip shortage, which has led to skyrocketing prices for the RAM and SSD storage used in products like the ‌MacBook Neo‌, with the company pointing to AI server demand from companies buying up memory chips as a key driver. The changes extended the same day to Apple's Certified Refurbished store, with the company raising prices across refurbished Macs and iPads alongside the hikes on new hardware. The ‌MacBook Neo‌ is powered by the A18 Pro chip with 8GB of RAM and features a 13-inch Liquid Retina display. It is still Apple's most affordable Mac.Related Roundup: MacBook NeoTag: Apple Refurbished ProductsBuyer's Guide: MacBook Neo (Buy Now)Related Forum: MacBook Neo This article, "Refurbished MacBook Neo Models Now Available, a Day After Price Hike" first appeared on MacRumors.com Discuss this article in our forums View the full article

According to Omdia’s 2026 software supply chain security report, 86% of organizations find SBOM generation challenging. A major driver is tool sprawl: teams cobbling together different scanners for different artifact types, getting inconsistent output across pipelines, and spending engineering time reconciling the results rather than acting on them. SBOMs have become important to how security teams respond to vulnerability disclosures, how compliance teams satisfy auditors, and how procurement decisions get made. That makes the generation step load-bearing. If the SBOM your pipeline produces misses transitive dependencies, records declared versions instead of resolved ones, or is not cryptographically bound to the artifact it describes, every downstream decision built on that data inherits the gap. This post covers the decisions that determine SBOM quality: when and where to generate, what separates actionable output from data that just checks a box, and how to keep generation reliable as your image portfolio grows. Key takeaways Build-time SBOM generation produces more complete, accurate output than post-build scanning. Completeness, accuracy, freshness, and verifiability determine whether an SBOM is actionable. Generation tooling runs with elevated build access and may require additional security considerations, for example pinning to immutable references. Images that ship with pre-built SBOMs eliminate the generation burden for your base layer. When to generate: Build-time vs. post-build The single decision that most affects SBOM quality is when you generate it. There are two broad approaches, and they produce meaningfully different results. Build-time generation Build-time generation hooks into the build system itself. The generator has access to the resolved dependency tree, the package manager files, and the full build context. It knows exactly what went into the artifact because it was present when the artifact was assembled. Container build systems with native attestation support can produce an SPDX SBOM during the image build, attach it as an in-toto attestation, and push both the image and the SBOM to the registry in a single operation. Language-specific build plugins take a similar approach for application dependencies, generating SBOMs as part of the standard build lifecycle. The advantage is structural: build-time generation captures the resolved state of every dependency, including transitive dependencies that post-build scanners may miss. Post-build scanning Post-build tools scan a finished artifact and reverse-engineer its contents. They work by identifying package manager metadata, file signatures, and known patterns within the artifact. This approach works on any OCI-compatible image, regardless of how it was built. The trade-off is coverage. Statically linked binaries, vendored dependencies, and OS packages installed in intermediate build stages may commonly be missed by post-build scanners. The scanner can only report what it can detect, and detection is heuristic-based rather than derived from the actual build graph. When you have build system access, generate at build time. Post-build scanning is the right choice for third-party images you consume but did not build, or for legacy artifacts without build system integration. For container images, our documentation covers how to configure build-time SBOM attestation in detail, including the specific flags and generator options for different build workflows. What makes an SBOM useful Generating an SBOM is not the same as generating a useful one. The file format is standard, but the quality of the content varies dramatically depending on how and when the SBOM was produced. Five criteria separate actionable SBOMs from checkbox artifacts. 1. Completeness A complete SBOM accounts for every component in the artifact across all layers and all package types. This includes OS packages from the base image, application dependencies from every package manager in the build, and any tooling or utilities added during the build process. This is where multi-stage and minimal base images create real gaps. A Dockerfile with a Node frontend, a C or C++ component compiled into a static binary, and a distroless final stage presents three distinct challenges: the Node layer has deep transitive dependency trees, the statically linked binary often carries no dependency manifest on disk, and the distroless base has no package manager at all. Post-build scanners can miss the statically linked dependencies and may undercount the Node tree. Build-time generation with access to each stage’s resolved dependency graph is the only way to get a complete picture. 2. Accuracy Accuracy means the SBOM records resolved versions, not declared ranges. A package manifest might declare “^4.17.0” but the resolved version in the lock file is 4.17.21. The SBOM must reflect what was actually installed, not what was requested. 3. Freshness An SBOM is a point-in-time snapshot tied to a specific build. Every time the artifact is rebuilt, the SBOM should be regenerated. Stale SBOMs create a false sense of visibility. 4. Verifiability A verifiable SBOM is one that consumers can confirm was produced by the build system and has not been tampered with. Cryptographic signing and attestation frameworks bind the SBOM to a specific artifact digest, along with build provenance that records where and how the artifact was built. 5. Format compliance Standard formats like SPDX and CycloneDX define required and optional fields. An SBOM that validates against the schema is interoperable across scanning tools, policy engines, and compliance workflows. One that does not may work with your current tools but will break when you change them. Some base images already ship with SBOMs that meet all five criteria, along with SLSA Build Level 3 provenance and exploitability data. These SBOMs were generated at build time on hardened build platforms with non-falsifiable provenance, cryptographically signed, and attached as in-toto attestations bound to the image digest. They are continuously regenerated with every rebuild, so freshness is maintained without manual intervention. For those images, the generation question is answered for the most critical layer of the stack, and your effort shifts to generating a complete SBOM for the application layer you add on top. Your generation toolchain is attack surface The tools you use to generate SBOMs run with elevated access to your build environment. They read your source code, your dependency trees, and your build artifacts. A compromised generator does not just produce bad output; it has the access to exfiltrate or modify what it scans. This is not a theoretical concern. Version tags on GitHub Actions and container images are mutable. A tool you pinned to v2.1 today can silently become something different tomorrow if a maintainer account is compromised or a tag is force-pushed. The exposure window for incidents like these is typically measured in hours, but automated pipelines can pull compromised versions within minutes. Treat your generation tooling with the same rigor you apply to any other build dependency: Pin to immutable references (commit SHAs, not version tags). Verify checksums before execution. Run generation in CI, not on developer machines, for reproducible and auditable output. Monitor for upstream security advisories on your generation tools. This is one dimension of a broader software supply chain security challenge: every tool in your pipeline is a dependency that needs the same scrutiny as your application code. For base images, you can sidestep this risk entirely. Images built on hardened build platforms with non-falsifiable provenance carry their supply chain metadata from the point of origin, cryptographically verified end-to-end. Integrating SBOM generation into CI/CD Manual SBOM generation works for one-off audits. For production workflows, generation needs to be automatic, reproducible, and wired into the rest of your delivery pipeline. The pattern is consistent across CI systems. Generate at build Add SBOM generation as a build stage step, immediately after the image is produced. For container images, BuildKit attestation flags are the most reliable approach. For application dependencies, language-specific plugins (CycloneDX for Maven/Gradle, npm/yarn for Node) produce the highest-quality output because they access the resolved dependency graph. For multi-stage builds, generate from the final stage only. Intermediate stages often install build tools and test frameworks that do not ship in the production image. Generating against intermediate stages inflates the SBOM with components that are not deployed, creating noise in vulnerability scans. Choose an attestation format SPDX is the native output format for BuildKit attestation and the stronger choice if license compliance is a primary concern. CycloneDX has richer vulnerability correlation support and more granular component classification, making it the better fit for security-focused workflows. If your consumption tools (policy engines, vulnerability scanners, compliance dashboards) have a preference, follow it. If they support both, default to SPDX for container images since it requires no additional tooling beyond BuildKit’s built-in generator. Attach to the artifact Store the SBOM alongside the artifact it describes. For container images, this means attaching it as an OCI attestation in the registry rather than saving it as a separate file in an artifact store. Attestation-based storage keeps the SBOM discoverable, versioned, and bound to the specific image digest. When the image is promoted from dev to staging to production, the SBOM travels with it through every registry, rather than requiring a separate copy-and-sync workflow that inevitably drifts. Validate before publishing Add a validation step between generation and registry push. Run the SBOM through a format validator (SPDX and CycloneDX both provide official schema validators), check that the component count is reasonable for the artifact, and verify that the SBOM references the correct image digest. A build that produces 12 components for an image you know contains 200+ packages should fail the pipeline, not ship silently. Scan and enforce continuously SBOM generation at build time captures what’s shipped. Continuous scanning tells you what’s become vulnerable since. New CVEs drop daily, and an SBOM that was clean at build time can have critical exposures within weeks. Continuous analysis against SBOM data matches new disclosures against your inventory without re-pulling images, and surfaces policy violations as they emerge. With SBOMs attached to every image, you can gate deployment: no image ships without a valid SBOM, no image deploys with a known-vulnerable package above your severity threshold. Implementation details vary by CI system. Our documentation covers the specific flags and configuration for generating and attaching SBOM attestations across common container build workflows. Verifying your SBOM output Before relying on your SBOM output for compliance reporting or vulnerability management, verify that it meets the quality criteria below. Component count sanity check: Compare the number of components in your SBOM against what you expect from the Dockerfile, lock files, and base image. A Node.js app with 200 declared dependencies should produce substantially more entries once transitive dependencies are included. Resolved versions, not ranges: Spot-check entries to confirm the SBOM records specific versions (4.17.21) rather than declared ranges (^4.17.0). Transitive dependency depth: Verify that transitive dependencies appear, not just top-level packages. If your app declares 30 direct dependencies but the SBOM contains 32 entries, transitive coverage is likely incomplete. OS package coverage: Confirm that base image OS packages appear alongside application dependencies. Digest binding: Verify the attestation references the correct image digest. An unbound SBOM cannot be trusted to describe its artifact. Format validation: Run the SBOM through a schema validator (SPDX and CycloneDX both provide official tools). Start generating, then start verifying The best time to add SBOM generation to your pipeline is the next time you touch your CI configuration. Start with your highest-traffic production image. Configure build-time generation, attach the SBOM as an attestation, and validate the output against the checklist above. Then expand to the rest of your portfolio. If you want a head start, Docker Hardened Images ship with complete SBOMs, SLSA Build Level 3 provenance, and OpenVEX data already attached, so you can skip the generation step for your base layers entirely. For everything you build on top, Docker Scout provides continuous vulnerability matching against your SBOM data and enforces policies across your image portfolio. Get started with Docker Hardened Images → Explore vulnerability monitoring with Docker Scout → Frequently asked questions What is the best format for an SBOM? For container images, default to SPDX since it is the native BuildKit attestation output and requires no additional tooling. Choose CycloneDX if your primary use case is security scanning and your downstream tools prefer it. Do I need to generate an SBOM if my images already come with one? If you are using base images that ship with pre-built SBOMs, provenance, and exploitability data, you do not need to regenerate for that layer. The included SBOM was generated at build time with full access to the build graph and is cryptographically bound to the image. To verify the pre-built SBOM is trustworthy, check two things: Is the SBOM attached as a signed attestation (not a loose file)? Does the attestation include SLSA provenance? If the provenance traces back to a hardened build platform with non-falsifiable provenance, you can treat the SBOM as authoritative for that layer. You still need to generate an SBOM for the application dependencies you add on top. How often should I regenerate my SBOM? Every time the artifact is rebuilt. If your CI pipeline produces a new image, it should produce a new SBOM to match. Between rebuilds, the existing SBOM is still accurate because the artifact has not changed. Is SBOM generation required for compliance? In the United States, Executive Order 14028 helped set SBOM requirements in motion for software sold to federal agencies. The EU Cyber Resilience Act extends SBOM requirements to all products with digital elements sold in the EU. And as AI workloads come under newer regulations like the EU AI Act with its technical documentation and transparency expectations, component-level inventories are becoming a practical way for teams to show what is inside high-risk systems. Industry frameworks like NIST SSDF and CISA’s SBOM guidance increasingly reference SBOMs as a baseline expectation. Whether legally required today, SBOMs are becoming a procurement prerequisite. Sources Omdia, Securing the Software Supply Chain: Strategic Approaches to Support Scaling Development with AI Adoption, May 2026. View the full article

Apple had its worst day on the stock market in more than a year today, according to CNBC, after it raised prices on Macs, iPads, HomePods, the Apple TV, and the Vision Pro. Apple's stock price dropped 6% on the day — its largest single-day loss since April 2025. AAPL closed at $275.15. This article, "Apple's Stock Has Worst Day in More Than a Year After Price Increases" first appeared on MacRumors.com Discuss this article in our forums View the full article

Apple could launch an updated base model 14-inch MacBook Pro with an M6 chip as soon as this year, reports Bloomberg. There could also be M6 chip updates for the Mac mini, iMac, and MacBook Air, but Apple is testing an M6 ‌MacBook Pro‌. Apple plans to introduce the M6 in late 2026, and for the first time, it will be a standalone chip. Apple is not working on M6 Pro or M6 Max chips, and will hold off on higher-end chip options until the M7 series launches in 2027. The M6 chip will be the first built on a 2-nanometer process instead of the 3-nanometer process that Apple has used for the last several chip generations. Rumors suggest Apple will use TSMC's N2 process. Compared to the 3nm process, the 2nm process cuts down on transistor size so more can be packaged on a chip. Decreases in node size typically bring improved processor speeds and better power efficiency. TSMC's new chips also transition from InFo (Integrated Fan-Out) packaging to WMCM (Wafer-Level Multi-Chip Module). WMCM integrates individual chip components like the CPU, GPU, DRAM, and Neural Engine more closely together, improving communication between the components. According to Bloomberg, the M6 will be the most powerful in the industry for its class. The chip will have higher memory bandwidth at approximately 200GB/s (up from 153GB/s in the M5). Increased memory bandwidth will improve graphics performance and speed up on-device AI tasks. The M6 will have an updated memory architecture, an upgraded Neural Engine for AI processing, and improvements to video encoding and decoding. Performance will improve for all of the processing cores, and the GPU will also get an update to optimize it for AI. Apple is testing versions of the chip with a 12-core GPU. The M5 chip is limited to a 10-core GPU. Apple last updated the base 14-inch ‌MacBook Pro‌ with an M5 chip in October 2025, so an M6 update around the one-year mark would make sense. The base ‌Mac mini‌ and ‌iMac‌ have not been updated since October 2024, but Bloomberg recently said those machines would get M5 chips, not M6 chips, so Apple's plans are unclear. Bloomberg's newest report on the M6 mentions plural entry-level Macs getting the M6, but it only specifically references the ‌MacBook Pro‌. Apple added the M5 chip to the iPad Pro in October 2025, but it is not known if the device will get an M6 chip this year because prior rumors have said no 2026 refresh is planned. The ‌MacBook Air‌ was refreshed in March 2026, so it may not get a new chip until 2027.Related Roundup: MacBook ProBuyer's Guide: MacBook Pro (Buy Now)Related Forum: MacBook Pro This article, "M6 MacBook Pro Expected This Year With Apple's First 2nm Chip" first appeared on MacRumors.com Discuss this article in our forums View the full article

Despite price increases across the Mac line, Apple is still planning to release a new Mac Studio as soon as this year, reports Bloomberg. Apple plans to introduce a new M5 Ultra chip as the final option in the M5 family before it transitions to the M6, M7, M7 Pro, and M7 Max. The M5 Ultra will come in a new version of the ‌Mac Studio‌, which hasn't been updated since March 2025. The ‌Mac Studio‌ refresh was supposed to come earlier in 2026, but Apple reportedly postponed the launch because of memory chip supply issues and price increases. In April, Bloomberg said the ‌Mac Studio‌ would launch sometime around October 2026. It's not clear if Apple will make an October launch. The current M3 Ultra ‌Mac Studio‌ already has delivery estimates ranging into October. The M5 Ultra chip is expected to have around 36 CPU cores and 80 GPU cores, which is not too far off from the M3 Ultra. The M3 Ultra has up to a 32-core CPU and up to an 80-core GPU. Apple has tested support for up to 768GB of unified memory, but supply constraints could prevent it from launching with an option for that much memory. Apple was selling the M3 Ultra ‌Mac Studio‌ with up to 512GB RAM, but the 512GB model was removed back in March. Apple has been temporarily cutting higher-tier Macs, and the current M3 Ultra ‌Mac Studio‌ can only be purchased with 96GB RAM. Even if Apple does plan to release a ‌Mac Studio‌ with an M5 Ultra chip and 768GB RAM, it would be astronomically expensive. When Apple raised Mac prices today, the 96GB ‌Mac Studio‌ went from $3,999 to $5,299, an increase of $1,300. 8x more RAM during the memory crisis could see the ‌Mac Studio‌ priced at over $10,000.Related Roundup: Mac StudioBuyer's Guide: Mac Studio (Don't Buy)Related Forum: Mac Studio This article, "M5 Ultra Mac Studio Could Launch in 2026 With Up to 768GB of RAM" first appeared on MacRumors.com Discuss this article in our forums View the full article

Apple today seeded a new beta of watchOS 27 for the Apple Watch Ultra 3, with the update coming over two weeks after the launch of the first beta. This beta is only available for the ‌Apple Watch Ultra 3‌, which did not get the second beta update that came out earlier this week. The beta can be downloaded through the Watch app on the iPhone with a free developer account. The Apple Watch will need to be on the charger, connected to Wi-Fi, and have a battery level of 50 percent or above for new software to be installed. ‌watchOS 27‌ will include Siri AI, the smarter, more capable version of ‌Siri‌. ‌Siri‌ can hold back-and-forth conversations, plus it has access to general world knowledge and your personal data to answer questions and find information. ‌Siri‌ AI on Apple Watch requires an iPhone that supports Apple Intelligence, including the iPhone 15 Pro and later. There's a new Dynamic app grid that highlights ‌Siri‌ suggested apps, and more intuitive Smart Stack Suggestions. You can find your parked car, see pinned messages, get noise alerts, and view identity and transit cards. Liquid Glass has been updated to improve legibility, and Workout Buddy works on the Apple Watch even when an iPhone isn't nearby. Workout Buddy also gains new metrics like progressive increases to distance, pace, or duration. Apple added a new all-in-one Find My app with support for Precision Finding, and there are performance optimizations that improve battery life. More on what's new in ‌watchOS 27‌ is available in our watchOS 27 roundup.Related Roundups: Apple Watch Ultra 3, watchOS 26, watchOS 27Buyer's Guide: Apple Watch Ultra (Neutral)Related Forum: Apple Watch This article, "Apple Seeds New watchOS 27 Beta for Apple Watch Ultra 3" first appeared on MacRumors.com Discuss this article in our forums View the full article

Apple today raised prices on many of its products, including all Macs and iPads, as well as the Apple TV, HomePod, HomePod mini, and Vision Pro. We shared a list of the price increases, which range from $30 for the HomePod mini to up to $1,300 for the Mac Studio. iPhone, Apple Watch, and AirPods prices have not changed, at least for now. In a statement shared with MacRumors, Apple said it raised prices because of the ongoing memory chip shortage, resulting from companies like OpenAI and Nvidia building out data centers with powerful AI servers. The supply-demand imbalance has led to skyrocketing prices for RAM and SSD storage chips used in a wide range of Apple products. Apple's full statement:The consumer electronics industry is facing an unprecedented challenge. The rapid expansion of AI data centers has created an extraordinary surge in demand for memory and storage. We have never seen a component price increase this much, this quickly. We have shielded our customers from these increases so far, but we have now reached a point where we need to begin raising prices on a number of products, including today's increases for iPad and Mac. We know this is not welcome news, and we are working tirelessly to find solutions.Apple indicating that it needs to "begin" raising prices suggests that additional price increases might occur later. On the other hand, Apple noting that it is "working tirelessly to find solutions" suggests that prices might eventually come down again. Apple is far from the only tech company that has raised prices in response to the memory chip shortage, with others including Microsoft, Samsung, Lenovo, HP, Dell, and more. Memory chip supplier Micron expects the shortage to last through 2027, so elevated prices could be the norm for another year and a half or longer. This article, "Apple Explains Why It Raised Prices on These 14 Products Today" first appeared on MacRumors.com Discuss this article in our forums View the full article

Apple is changing its Apple silicon launch timeline to speed up the debut of chips designed for artificial intelligence workloads, reports Bloomberg. Apple plans to release an M6 chip for entry-level Macs as soon as this year, but it has canceled plans for higher-end M6 Pro and M6 Max chips. Instead, Apple's next Pro and Max chips will be part of its M7 chip lineup, with the first M7 chips launching in 2027. An M5 Ultra chip could also come as soon as this year. M5 Ultra - Late 2026 M6 - Late 2026 M7 - First half of 2027 M7 Pro - End of 2027 M7 Max - End of 2027 M7 Ultra - 2028 Apple is speeding up development on M7 chips because they have technologies supporting on-device AI and GPU-intensive software. Since the launch of the first Apple silicon chips, Apple has always had at least three variants, including the base M-series chip, a Pro version, and a Max version. The M6 will mark the first time that Apple is not coming out with a Pro or Max chip for the line. Apple could update the entry-level MacBook Pro with an M6 chip as soon as this year. It is expected to have around 200GB/s memory bandwidth for better graphics and faster AI processing and video editing. The base M5 chip has 153GB/s memory bandwidth, and the base M7 chip could have 240GB/s bandwidth. Bloomberg says the M6 will also include an updated memory architecture and an upgraded Neural Engine, along with performance improvements across all of the processor cores and a redesigned GPU with up to 12 cores. Prior rumors have suggested the M6 will be the first built on Apple's new 2-nanometer process. The base M6 could also be used in the entry-level Mac mini and iMac, along with upcoming iPad Pro and iPad Air models. The higher-end ‌MacBook Pro‌ models and higher-end ‌Mac mini‌ will use the M7 Pro and M7 Max. The Mac Studio will use the M7 Max and M7 Ultra. Bloomberg says Apple still plans to release an M5 Ultra for a refreshed version of the ‌Mac Studio‌ as soon as this year. The M5 Ultra will have approximately 36 CPU cores and 80 GPU cores. An M5 Ultra ‌Mac Studio‌ could have as much as 768GB of unified memory. Apple is working on a high-end "MacBook Ultra" with an OLED display and a touchscreen, and rumors suggested it could come as soon as late 2026. That seems unlikely now with the M7 Pro and M7 Max chips slated for late 2027, unless Apple equips the high-end ‌MacBook Pro‌ with an M6, the M5 Max, or the M5 Ultra chip. News of Apple's updated chip launch timeline comes just after the company raised prices across all of its Macs and iPads.Related Roundups: Mac Studio, MacBook ProBuyer's Guide: Mac Studio (Don't Buy), MacBook Pro (Buy Now)Related Forums: Mac Studio, MacBook Pro This article, "2027 Macs to Get AI-Focused M7 Chips as Apple Skips High-End M6" first appeared on MacRumors.com Discuss this article in our forums View the full article

Apple's annual Back to School promotion will return by next week, according to Bloomberg's Mark Gurman. Last year, college students and educational staff could receive a free accessory like AirPods 4 or an Apple Pencil Pro with the purchase of a qualifying Mac or iPad model. It is unclear what Apple plans to offer this year, but given the company has just raised prices on all Macs and iPads, this year's Back to School promotion will be rather bittersweet. This article, "Apple's 2026 Back to School Offer Expected to Begin by Next Week" first appeared on MacRumors.com Discuss this article in our forums View the full article

The EU Cyber Resilience Act (CRA) was officially introduced on December 10th 2024, to protect foundational EU values in the face of rising cyberattack threats. As cyberattacks targeting products with digital elements have grown more frequent and costly, the regulation establishes the first horizontal cybersecurity baseline for all hardware and software products sold in Europe. The urgency is real given that in Omdia’s 2026 software supply chain security report, 77% of organizations reported experiencing a supply chain incident in the last year. The regulation will take full effect on December 11, 2027, but mandatory vulnerability reporting obligations take effect on September 11, 2026. For teams building and shipping containerized software, the CRA turns practices like SBOM generation, vulnerability disclosure, and image hardening from voluntary best practices into legal requirements. This guide covers what the EU CRA requires, who it applies to, how its SBOM mandate connects to container build workflows, and what teams need to do before the compliance deadlines arrive. Key takeaways The CRA requires all products with digital elements sold in the EU to meet cybersecurity standards by December 2027. Manufacturers must include a machine-readable SBOM in technical documentation for every product. Actively exploited vulnerabilities and severe incidents having an impact on the security of a product with digital elements must be reported to authorities within 24 hours starting September 2026. Container runtimes distributed commercially into the EU qualify as products with digital elements under the CRA. What is the EU Cyber Resilience Act (CRA)? Before the CRA, the EU had no single, cross-sector regulation setting cybersecurity baselines for products with digital elements. A smart thermostat, an enterprise database, and a container runtime were all subject to different (or no) cybersecurity obligations. There was no general obligation to patch vulnerabilities, disclose security incidents, or document the software of products with digital elements launched in the EU market. The CRA closes that gap with a horizontal regulation that applies across several industries, placing the primary burden on manufacturers. The regulation defines a product with digital elements as any software or hardware product, including its remote data processing solutions and any components placed on the market separately. That scope is intentionally broad: it covers everything from consumer IoT devices to enterprise software platforms to container images distributed through registries. Manufacturers must design products securely, handle vulnerabilities throughout the product lifecycle, and provide transparency about software composition. How the CRA relates to NIS2 The CRA is one part of the broader EU cybersecurity strategy that includes other regulatory frameworks, like NIS2 and DORA. Since the CRA and NIS2 both deal with cybersecurity obligations, they’re easy to conflate, but they target different things. The CRA applies to cybersecurity of products with digital elements, while NIS2 applies to the cybersecurity of essential and important entities. Recital 12 of CRA even affirms that SaaS, PaaS, or IaaS solutions are subject to NIS2, in principle carving them out of its own scope. However, the line is blurry for products depending on cloud infrastructure. The European Commission’s March 2026 draft guidance introduced a three-part test for determining when a cloud component falls under CRA scope: Does the processing happen remotely? Would the product lose a core function without it? Did the manufacturer design, develop, or is control of that remote component under its responsibility? If the answer to all three is yes, the cloud component is part of the product for CRA purposes. Where that test pulls a cloud component into scope and the component processes personal data, the GDPR applies on top of the CRA rather than in place of it, so you still need to assign controller and processor roles and confirm a lawful basis. Who the CRA applies to The CRA assigns obligations based on your role in bringing a product to market. Role Obligations Manufacturers The heaviest set of obligations. The manufacturer has assessment obligations before placing the product on the market, in order to ensure compliance with the cybersecurity requirements set out in the CRA. After this process, the manufacturer can affix the CE marking and attach a declaration of conformity to its products. After placement on the market, the manufacturer is required to handle vulnerabilities in the products throughout their lifetime and to report actively exploited vulnerabilities and severe incidents. Importers and distributors Fewer obligations. Both must ensure that the manufacturer complied with a set of obligations, but also retain documentation and act upon becoming aware of non-conformity of the product with the CRA or a vulnerability. Open-source software stewards A new CRA category. Mainly for micro-enterprises and small and medium-sized enterprises, including start-ups, individuals, non-profit organizations and academic research organizations, that systematically support open-source used in commercial activity. Scaled-down obligations covering, in particular, putting in place a cybersecurity policy and vulnerability handling, but also cooperation with market surveillance authorities and certain reporting obligations. Key requirements for the EU CRA The CRA organizes its requirements into two main areas, both defined in Annex I of the regulation: essential cybersecurity requirements for product properties, and vulnerability handling obligations for the product lifecycle. Security by design Products must be designed, developed, and produced to ensure an appropriate level of cybersecurity based on a risk assessment. In practice, this means shipping with secure default configurations, minimizing the attack surface by removing unnecessary components, protecting the confidentiality and integrity of stored and transmitted data, and providing mechanisms for secure updates. For container images, the security-by-design requirement maps directly to image hardening: minimal base layers no unnecessary shells or package managers secure defaults out of the box. The essential requirements also include data minimization: a product should process only personal or other data that is adequate, relevant, and limited to what is necessary for its intended purpose. Vulnerability handling Manufacturers must maintain processes for identifying, documenting, and remediating vulnerabilities throughout the support period they define for each product. This includes coordinated vulnerability disclosure policies, timely security updates, and public disclosure of fixed vulnerabilities with enough detail for users to assess impact and apply remediation. Security updates must be provided free of charge for the duration of the support period. Public disclosures should be limited to the technical detail users need and must not expose personal data, such as the identity of a reporter or of affected users, consistent with the CRA’s expectation that disclosures avoid increasing risk and with GDPR limits on publishing personal data. Transparency and SBOMs The CRA also requires manufacturers to include a software bill of materials in the technical documentation for every product with digital elements. The SBOM must be in a commonly used, machine-readable format and must include, at minimum, the top-level dependencies of the product. However, the regulation does not mandate a specific format, but in practice that typically means SPDX or CycloneDX. Scope the generated SBOM to package and dependency metadata and keep embedded secrets and personal data out of the artifact. An important nuance: The CRA does not require manufacturers to publish SBOMs publicly. SBOMs must be included in technical documentation and provided to market surveillance authorities on request. Also, the documentation must be retained for ten years after the product is placed on the market, or for the duration of the support period, whichever is longer. Incident and vulnerability reporting Manufacturers must report actively exploited vulnerabilities and severe security incidents to the relevant national Computer Security Incident Response Team (CSIRT) and to ENISA through a single reporting platform. The reporting timelines are: Reporting timelines: – 24 hours: early warning notification – 72 hours: full notification with technical details – 14 days: final report after a corrective measure is available (for actively exploited vulnerabilities) – 1 month: final report from the 72-hour submission (for severe incidents) Note for Privacy: These reports can contain personal data, such as a reporter’s identity or affected-user details, so limit each report to the technical information the CSIRT and ENISA actually need and handle any personal data in line with the GDPR. Notifications should also avoid disclosing information that would increase risk to users. Conformity assessment Before placing a product on the EU market, manufacturers must complete a conformity assessment to verify compliance with the essential cybersecurity requirements. The type of assessment depends on how the product is classified under the CRA. Product categories and conformity assessment The CRA classifies products into three tiers based on their cybersecurity risk, with each tier subject to increasingly rigorous conformity assessment procedures. If you’re shipping container runtimes, you likely fall into the Important Class II category and will need a third-party assessment. Products that pass their conformity assessment receive the CE marking, which indicates compliance with the CRA and allows them to be sold on the EU market. Products that fail, or that are found to be non-compliant after placement, can be ordered withdrawn or recalled by national market surveillance authorities. CRA timeline: 3 Deadlines that matter The CRA entered into force on December 10, 2024, but its obligations phase in over three years. Each milestone introduces a distinct set of requirements. Date Milestone What takes effect June 11, 2026 Conformity assessment bodies Member states must designate notifying authorities. Conformity assessment bodies begin formal notification and can start conducting assessments. September 11, 2026 Reporting obligations Manufacturers must report actively exploited vulnerabilities and severe security incidents to CSIRTs and ENISA. This retroactively applies to all products already on the EU market, not just new ones. December 11, 2027 Full enforcement All essential cybersecurity requirements take effect: security by design, SBOM in technical documentation, vulnerability handling, conformity assessment, CE marking. Non-compliance triggers fines. The key detail most teams miss: the September 2026 reporting obligation is applicable to products that are already in the market. It retroactively applies to products already on the EU market, not just new releases. If you are selling container images to EU customers today, your 24-hour reporting clock starts in months, not years. Penalties for non-compliance Article 64 of the CRA establishes three penalty tiers for non-compliance, with fines set at the member-state level but capped by the regulation: Up to €15 million or 2.5% of global annual turnover (whichever is higher) for failure to comply with essential cybersecurity requirements and other core obligations (Art. 64 (2)) Up to €10 million or 2% of global annual turnover (whichever is higher) or failure to comply with other CRA obligations (Art. 64 (3)) Up to €5 million or 1% of global annual turnover (whichever is higher) for supplying incorrect, incomplete, or misleading information to authorities (Art. 64 (4)) Beyond fines, market surveillance authorities can order product withdrawals, recalls, or outright bans from the EU market. For organizations selling software products into the EU, losing market access is often a more significant consequence than the fine itself. Microenterprises and small enterprises are generally exempt from fines for missing the 24-hour early warning deadline on vulnerability and incident reporting. Open-source software stewards are not subject to fines for any CRA infringement. Open-source software and the CRA The CRA’s treatment of open source was one of the most debated aspects during the legislative process. The final text draws a clear line based on commercial activity. Free and open-source software that’s not used in the course of a commercial activity, either directly or through support, is outside the CRA’s scope. Individual developers and volunteer maintainers are not classified as manufacturers under the regulation, as long as they operate outside a commercial activity. And the CRA explicitly does not apply to open-source software supplied for distribution outside the scope of a commercial activity. However, the regulation introduces a new role: the open-source software steward. A “steward” is a legal person (a company or foundation, not an individual) that systematically supports the development of open source software intended for commercial activities. The CRA applies a light-touch regime for stewards with limited obligations. They must mainly: Maintain a cybersecurity policy. Report actively exploited vulnerabilities. Cooperate with market surveillance authorities. Critically, stewards are not subject to financial penalties for CRA infringements. Organizations that distribute open-source software under a commercial model, whether through paid support or commercial container image registries, are classified as manufacturers, not stewards. The distinction matters because manufacturers carry the full weight of CRA obligations, including conformity assessment and CE marking. What the CRA means for container teams Everything above applies to the full universe of digital products. Here’s where it gets specific. Container images and runtimes distributed commercially into the EU qualify as products with digital elements under the CRA. If your organization publishes container images in a registry that EU customers can pull from, and those images are part of a commercial offering, the CRA applies and you may be considered a manufacturer. This is true regardless of where your organization is headquartered. The practical implications span the entire container lifecycle: Image composition transparency: Every image needs a machine-readable SBOM that documents at least the top-level dependencies. Image-layer SBOMs generated at build time, which capture OS packages, runtime libraries, and transitive dependencies, go further than the CRA’s minimum. Vulnerability management: Organizations must have processes to track, remediate, and report vulnerabilities in the components their images contain. Starting September 2026, all vulnerability and incident reporting obligations listed in Article 14 come into effect. Security by design: Images should ship with minimal attack surfaces, secure default configurations, and no unnecessary components. Hardened base images with shells, package managers, and debug tools removed satisfy this requirement more directly than standard community images. Provenance and integrity: The CRA’s essential requirements include protecting the integrity of the product and verifying that components have not been tampered with. Cryptographic signatures and provenance attestations address this directly. Support periods: Manufacturers must define and communicate a support period during which they will handle vulnerabilities. For container images, that means committing to a patch and rebuild cadence for the lifecycle of each supported image tag. Compliance starts at the image layer The CRA raises the bar for every organization that ships software into the EU. For container teams, the requirements map directly to practices the industry has been moving toward: hardened images, build-time SBOMs, provenance attestations, vulnerability monitoring, and defined support lifecycles. The difference is that these practices are no longer optional. Thankfully, Docker Hardened Images ship with the artifacts the CRA demands: complete SBOMs, SLSA Build Level 3 provenance with non-falsifiable attestations, OpenVEX exploitability data, and cryptographic signatures. The images are minimal by default, continuously rebuilt against upstream fixes, and backed by defined support periods. Pair that with continuous vulnerability monitoring against SBOM data limited to package and component metadata and excluding personal data and embedded secrets, and the CRA’s 24-hour reporting clock starts with a known blast radius rather than a manual triage. Get started with Docker Hardened Images → Explore vulnerability monitoring with Docker Scout → Frequently asked questions Does the CRA apply to container images? Yes, generally. Container images distributed commercially into the EU qualify as products with digital elements under the CRA. This applies whether the images are distributed as part of a software product, sold as managed services, or published in a commercial registry. The regulation applies based on commercial availability in the EU market, not on where the manufacturer is headquartered. What SBOM format does the CRA require? The CRA requires a commonly used, machine-readable format but does not name a specific standard. In practice, that usually means SPDX or CycloneDX. For container workflows, SPDX is the format BuildKit generates natively as an image attestation. Whichever format you use, scope the SBOM to package and dependency metadata and exclude embedded secrets and personal data from the generated artifact. Do I have to publish my SBOM publicly? No. The CRA requires SBOMs to be included in technical documentation and provided to market surveillance authorities upon request. There is no obligation to make them publicly available. However, organizations that do publish SBOMs as attestations attached to their images make it easier for downstream consumers to verify compliance and assess risk. If you do publish, scrub the SBOM and attestations of secrets, internal hostnames, and any personal data first, because a published artifact is difficult to retract. Are open-source projects exempt? Open-source software is outside the CRA’s scope as far as they are not made available on the market, and therefore supplied for distribution or use in the course of a commercial activity. Individual volunteer maintainers are not classified as manufacturers as far as they operate outside a commercial activity. However, organizations that distribute open-source software commercially (through paid support, managed services, or commercial registries) may be classified as manufacturers and subject to the full set of CRA obligations. When do the CRA’s SBOM requirements take effect? The SBOM requirement is part of the essential cybersecurity requirements in Annex I, which take full effect on December 11, 2027. However, the vulnerability reporting obligations that begin on September 11, 2026 are operationally much harder to meet without SBOM data, so the practical imperative to have SBOMs in place arrives well before the formal deadline. Source Omdia, Securing the Software Supply Chain: Strategic Approaches to Support Scaling Development with AI Adoption, May 2026. View the full article

Apple has raised the prices of Macs and iPads across its Certified Refurbished online store, following the sweeping new product price hikes introduced earlier today. Across the affected products in Apple's refurb inventory, prices went up by around $160 to $180 on average, but it was the Mac increases that were generally more eye-watering than the iPad increases. The Mac increases averaged about $204 at the low end and $330 at the high end. Some of the smaller Mac changes included the 14-inch MacBook Pro with an M4 Pro chip rising from $1,699 to $1,779 – the Nano-texture version of the same model rose from $1,829 to $1,909. Elsewhere, a 16-inch MacBook Pro with an M4 Pro chip and Nano-texture display increased from $2,249 to $2,339. But it was the higher end of the Mac lineup that saw the biggest price increases. A refurbished 14-inch MacBook Pro with the M5 chip rose from $1,359 to $1,439, while the highest-priced configuration in that group increased from $2,629 to $3,309. A 14-inch MacBook Pro with the M2 Max chip also jumped from $4,249 to $4,839. As for the iPad, the increases were more consistent. Many refurbished iPad models went up by around $120 to $150. In terms of lower-end models, examples include the 10th-generation iPad Wi-Fi 256GB models rising from $339 to $409, while iPad mini 6 models increased from $379 to $459 or from $449 to $529. Some higher-end iPad Pro configurations also saw larger increases of around $230 to $250. The refurbished price changes are in line with Apple's broader pricing reset for new products, which are said to be due to the company having to grapple with the impact of rising memory and storage chip costs owing to the ongoing AI data center buildout. In other words, if new Macs and iPads become more expensive, refurbished versions also need to rise so that they remain discounted by roughly the same amount. That said, many of Apple's refurbished units likely contain original memory, storage, and logic boards, or service parts purchased before the latest component cost spike. So this appears to be more a case of increased prices based on Apple's updated pricing structure, rather than the actual cost of each device.Tag: Apple Refurbished Products This article, "Apple Raises Refurbished Mac and iPad Prices After New Product Hikes" first appeared on MacRumors.com Discuss this article in our forums View the full article

While the Apple TV, HomePod, and HomePod mini have not been updated in several years, all three products received price increases worldwide today. Here is a summary of the price changes for these products in the United States:Apple TV (Wi-Fi): $129 → $199 Apple TV (Wi-Fi + Ethernet): $149 → $249 HomePod: $299 → $349 HomePod mini: $99 → $129Apple also raised prices on Macs, iPads, and more, with the company blaming the ongoing memory chip shortage, which has resulted in skyrocketing prices for RAM and SSD storage used in its products. "We have never seen a component price increase this much, this quickly," said Apple, in a statement shared with the media. The price increases come amid a long wait for new Apple TV, HomePod, and HomePod mini models. All three devices are expected to be updated later this year with support for the more personal and intelligent version of Siri, which is currently available to test across the iOS 27, iPadOS 27, macOS 27, and visionOS 27 developer betas. The trio of devices are between three and six years old. Apple unveiled the HomePod mini all the way back in October 2020, while the current Apple TV and HomePod models debuted in October 2022 and January 2023, respectively. The current Apple TV 4K has an A15 Bionic chip from the iPhone 13 series, while the HomePod mini uses the S5 chip from the Apple Watch Series 5, and the second-generation full-sized HomePod uses the S7 chip from the Apple Watch Series 7. Earlier rumors claimed the next Apple TV would be equipped with the A17 Pro chip, which is the oldest chip that supports Apple Intelligence. The device is also expected to feature Apple's N1 chip for Wi-Fi 7, Bluetooth 6, and Thread. No major design changes have been rumored for the next Apple TV. Bloomberg's Mark Gurman was told that the Apple TV's Siri Remote may be "refreshed" in some form, but he did not provide any specific details or guarantee that there will be any outward-facing design changes to the accessory. As for the HomePod mini, it is expected to use an Apple Watch's S9 chip or newer. Other previously-rumored features for the speaker include the N1 chip, improved sound quality, a newer Ultra Wideband chip, and a red color option. Apple is also expected to release an all-new smart home hub as early as this year.Related Roundups: Apple TV, HomePod, HomePod miniBuyer's Guide: Apple TV (Don't Buy), HomePod (Caution), HomePod Mini (Don't Buy)Related Forums: Apple TV and Home Theater, HomePod, HomeKit, CarPlay, Home & Auto Technology This article, "Apple TV and HomePod Just Went Up in Price Amid Wait for New Models" first appeared on MacRumors.com Discuss this article in our forums View the full article

Amazon Prime Day has reached its third day, and is set to end tomorrow, June 26. Many of the year's best deals are still available to purchase today, including record low prices on AirPods Max 2, AirTag 2, Apple Watch Series 11, iPad Air, and more. Note: MacRumors is an affiliate partner with Amazon. When you click a link and make a purchase, we may receive a small payment, which helps us keep the site running. Apple threw a wrinkle into Prime Day prices today, announcing a price hike on a huge selection of its most popular products. These new price increases are already live on Apple.com, but third party retailers like Amazon have not yet received the updated prices. This means many of the Prime Day deals we're sharing below could be your last chance to get these devices at their current best-ever prices. Shoppers should note that many sales during Amazon Prime Day require you to have an Amazon Prime membership to take advantage of the discounts. Amazon Prime costs $14.99 per month or $139.00 per year, and it comes with a 30-day free trial for new subscribers. Special for 2026, Amazon is also offering 50% off Prime memberships for Young Adults. Prime for Young Adults is a discounted Prime membership for anyone age 18-24 that offers all of the Prime benefits at $69.00 per year, half of the price of regular Prime. AirPods Amazon has the AirPods Max 2 on sale for $399.00 in Midnight, down from $549.00. This is an all-time low price on the headphones. This is accompanied by a great discount on the AirPods 4 for Prime Day, available for $99.00, down from $129.00. $30 OFFAirPods 4 for $99.00 $70 OFFAirPods Pro 3 for $179.00 $150 OFFAirPods Max 2 for $399.00 AirTag 2 Apple's AirTag 2 has hit the new low price of $24.00 for the 1-Pack and $89.00 for the 4-Pack. $5 OFFAirTag 2 (1-Pack) for $24.00 $10 OFFAirTag 2 (4-Pack) for $89.00 This is the first major discount we've ever seen on the AirTag 2 at Amazon since the device launched earlier in 2026. The new AirTag is equipped with a second-generation Ultra Wideband chip, enabling the Precision Finding feature to work up to 50% farther away from an item compared to the previous-generation model. Apple Watch Ultra 3 Amazon is discounting a wide array of Apple Watch Ultra 3 models down to $649.00 for Prime Day, from $799.00. This is a new all-time low price on the 2025 smartwatch, beating the previous record low price by about $50, and it's available in both Natural and Black Titanium color options. $150 OFFApple Watch Ultra 3 for $649.00 Apple Watch Series 11 Amazon this week has all-time low prices on the Apple Watch Series 11, with $120 discounts across numerous models of the smartwatch. This sale includes a handful of GPS aluminum models on sale at record low prices. $120 OFFApple Watch Series 11 (42mm GPS) for $279.00 $120 OFFApple Watch Series 11 (46mm GPS) for $309.00 You can get the 42mm GPS Apple Watch Series 11 for $279.00, down from $399.00, and the 46mm GPS model for $309.00, down from $429.00. On Amazon, you'll find three of the 42mm GPS models and three of the 46mm GPS models on sale at these all-time low prices. Apple Watch SE 3 Amazon is also taking $50 off the Apple Watch SE 3, starting at $199.00 for the 40mm GPS model. These are matches of all-time low prices on the SE 3, and it's been over four months since we last tracked these prices on the wearable. $50 OFF40mm GPS Apple Watch SE 3 for $199.00 $50 OFF44mm GPS Apple Watch SE 3 for $229.00 You can also get the 44mm GPS Apple Watch SE 3 on sale for $229.00, down from $279.00. Both the 40mm and 44mm GPS models are available in Midnight and Starlight Aluminum at these prices. MacBook Air You'll find $150 off a few models of the 13-inch M5 MacBook Air on Amazon this week, starting at $949.00 for the 512GB model, down from $1,099.00. $150 OFF13-inch M5 MacBook Air (512GB) for $949.00 $150 OFF13-inch M5 MacBook Air (16GB/1TB) for $1,149.00 MacBook Pro Amazon has a few low prices on Apple's M5 Pro/M5 Max MacBook Pro for Prime Day, with up to $299 off select models. Starting with the 14-inch models, you can get the 24GB/1TB M5 Pro MacBook Pro for $2,034.00, down from $2,199.00. The biggest overall savings this time around is on the 36GB/2TB model, available for $3,299.99, which is a $299 discount and all-time low price. $165 OFF14-inch M5 Pro MacBook Pro (24GB/1TB) for $2,034.00 $200 OFF14-inch M5 Pro MacBook Pro (24GB/2TB) for $2,399.00 $299 OFF14-inch M5 Max MacBook Pro (36GB/2TB) for $3,299.99 You can get up to $250 off the 16-inch MacBook Pro right now on Amazon, with the 24GB RAM/1TB M5 Pro model hitting a new all-time low price of $2,494.00, down from $2,699.00. Most of the MacBook Pro devices in this sale have an estimated delivery date of June 29 with free shipping. $205 OFF16-inch M5 Pro MacBook Pro (24GB/1TB) for $2,494.00 $242 OFF16-inch M5 Pro MacBook Pro (48GB/1TB) for $2,857.00 $250 OFF16-inch M5 Max MacBook Pro (36GB/2TB) for $3,649.00 iPad Air Amazon has brought back all-time low prices on a handful of M4 iPad Air tablets for Prime Day. This includes both 11-inch and 13-inch models of the brand new 2026 M4 iPad Air. $80 OFF11-inch M4 iPad Air (128GB Wi-Fi) for $519.00 Specifically, the 128GB Wi-Fi 11-inch M4 iPad Air has dropped to $519.00, down from $599.00, beating the previous low price by about $40. iPad Amazon is taking up to $52 off Wi-Fi and cellular models of Apple's 11th generation iPad for Prime Day. Prices start at $299.00 for the 128GB Wi-Fi iPad, down from $349.00, a second-best price on this model. $50 OFF128GB Wi-Fi iPad for $299.00 $52 OFF512GB Wi-Fi iPad for $597.00 If you're on the hunt for more discounts, be sure to visit our Apple Deals roundup where we recap the best Apple-related bargains of the past week. Deals Newsletter Interested in hearing more about the best deals you can find in 2026? Sign up for our Deals Newsletter and we'll keep you updated so you don't miss the biggest deals of the season! Related Roundup: Apple DealsTag: Prime Day This article, "Prime Day Deals Still Going Strong on AirPods, AirTag, and More" first appeared on MacRumors.com Discuss this article in our forums View the full article

Apple today raised the price of the Vision Pro to $3,699, up from $3,499, as part of a sweeping round of price increases across its lineup. The change came after Apple's online store was briefly taken offline earlier today and brought back up with new pricing across the HomePod mini, HomePod, Apple TV, iPad, iPad mini, iPad Air, iPad Pro, MacBook Neo, MacBook Air, MacBook Pro, iMac, Mac mini, both Mac Studio configurations, and Vision Pro. The iPhone, AirPods, Studio Display, and accessories such as the Apple Pencil were seemingly the only product lines left untouched. No Apple product carries more baggage around its price tag than Vision Pro. The headset launched in February 2024 at $3,499 for the base 256GB configuration, a figure that was widely flagged at the time as a major barrier to mainstream adoption. Today's increase pushes the entry price to $3,699, with the 512GB and 1TB configurations similarly rising in step to $3,899 and $4,199. A product like the ‌MacBook Air‌ going up by $200 is naturally an unwelcome change for consumers, but it's a shift on a product with an enormous addressable market. The Vision Pro was already priced roughly seven times higher than Meta's $499.99 Quest 3, and reviewers and analysts have repeatedly pointed to that gap as the headset's defining weakness. the Vision Pro's share of the XR market is estimated to be around 5%, against roughly 75% for ‌Meta‌, a split that reflects just how badly the price has limited Vision Pro's reach relative to its technical ambitions. When the company refreshed Vision Pro with an M5 chip and a new Dual Knit Band in October 2025, it kept the $3,499 starting price exactly where it was. The increase is tied to a broader cost problem for the technology industry. Apple CEO Tim Cook told The Wall Street Journal last week that price increases across Apple's lineup had become "unavoidable" because of the soaring cost of memory and storage chips.Related Roundup: Apple Vision ProBuyer's Guide: Vision Pro (Neutral)Related Forum: Apple Vision Pro This article, "Apple Vision Pro Just Got Even More Expensive" first appeared on MacRumors.com Discuss this article in our forums View the full article

Apple today announced price hikes across a wide array of its biggest products, including iPads, Macs, HomePod, and Vision Pro. Note: MacRumors is an affiliate partner with Amazon. When you click a link and make a purchase, we may receive a small payment, which helps us keep the site running. These price changes are now live on Apple.com, but they have yet to hit third party retailers like Amazon. If you're interested in any of these products, now is the time to buy them on Amazon, before the retailer gets these price hikes as well. Below we've listed all of the biggest products available on Amazon that will be getting price hikes soon. Given that it's still Prime Day, many of these devices are on sale right now. You can read more about the incoming price changes in our lead article. iPads iPad - $299.00 (now $449.00 at Apple) M4 iPad Air - $519.00 (now $749.00 at Apple) M5 iPad Pro - $899.00 (now $1,199.00 at Apple) Macs MacBook Neo - $589.99 (now $699.00 at Apple) M5 MacBook Air - $949.00 (now $1,299.00 at Apple) M5 MacBook Pro - $1,549.00 (now $1,999.00 at Apple) Miscellaneous HomePod - $299.00 (now $349.00 at Apple) With these changes, some products that weren't considered steeply discounted before are now much more enticing. For example, the M5 MacBook Air discount to $949.00 was originally a $150 discount, and is now technically a $350 discount on the new price. If you're on the hunt for more discounts, be sure to visit our Apple Deals roundup where we recap the best Apple-related bargains of the past week. Deals Newsletter Interested in hearing more about the best deals you can find in 2026? Sign up for our Deals Newsletter and we'll keep you updated so you don't miss the biggest deals of the season! Related Roundup: Apple Deals This article, "Beat Apple's Price Hike: Last Chance to Score Cheap iPads and Macs for Prime Day" first appeared on MacRumors.com Discuss this article in our forums View the full article

Apple today increased the starting price of the Mac mini with M4 Pro chip by $200, taking the higher-tier model up to $1,599 on its online store. When the M4 Pro model launched in October 2024, the starting price was $1,399, but Apple has been hit by the rapid expansion of AI data centres, which has driven up the demand for memory and storage chips across the tech industry. Apple had already raised the Mac mini's effective starting price in May by discontinuing the $599 configuration with 16GB of RAM and a 256GB SSD, leaving the $799 model with a 512GB SSD as the new entry-level option. Interestingly, the 16GB RAM / 256GB storage option has now been reinstated, but the $799 starting price remains. "We have now reached a point where we need to begin raising prices," Apple said in a statement given to The Wall Street Journal. "We have never seen a component price increase this much, this quickly," it added. Apple briefly took down its online store earlier today as it typically does when announcing new products. But when it came back online, the price tags for Mac computers rose approximately 15 percent to 20 percent and iPad prices rose 15 percent to 25 percent. Apart from the price hikes, there were no other changes to the site.Related Roundup: Mac miniBuyer's Guide: Mac Mini (Caution)Related Forum: Mac mini This article, "Apple Hikes M4 Pro Mac Mini Starting Price Amid Rising Memory Costs" first appeared on MacRumors.com Discuss this article in our forums View the full article

Apple today announced that it is raising prices on many products, including the MacBook Neo, which now starts at $699 in the United States. The price increases are due to the ongoing memory chip shortage, which has led to skyrocketing prices for the RAM used in products like the MacBook Neo. Tech giants such as OpenAI and Nvidia have been purchasing large amounts of memory chips for AI servers, resulting in a supply-demand imbalance that is driving up prices. "We have never seen a component price increase this much, this quickly," said Apple. When it was released in March, the MacBook Neo started at $599 in the U.S. with 256GB of storage, so the colorful laptop has received a $100 price increase. The higher-end configuration with 512GB of storage and a Touch ID button also received a $100 price increase and now starts at $799, up from $699. The price increases extend to Apple's education store, with the MacBook Neo now starting at $599 for college students in the U.S., up from $499. Here is a summary of the MacBook Neo pricing changes in the U.S. today:MacBook Neo (256GB): $599 → $699 MacBook Neo (512GB/Touch ID): $699 → $799 MacBook Neo (256GB/Education Store): $499 → $599 MacBook Neo (512GB/Touch ID/Education Store): $599 → $699The increases also apply to other countries around the world, with the exact price changes varying based on local currencies. In Canada, for example, the MacBook Neo now starts at $949 with 256GB of storage, up from $799 when it launched. Powered by an iPhone-class A18 Pro chip and 8GB of RAM, the MacBook Neo remains Apple's most affordable MacBook available right now. The colorful laptop is positioned below the MacBook Air, which now starts at $1,299 in the U.S., up from $1,099.Related Roundup: MacBook NeoBuyer's Guide: MacBook Neo (Buy Now)Related Forum: MacBook Neo This article, "Apple Just Raised the Price of the MacBook Neo" first appeared on MacRumors.com Discuss this article in our forums View the full article

Apple today dramatically increased device prices across multiple product lines. After temporarily taking it down earlier today, Apple's online store is back up with a series of product price increases. The changes are as follows: HomePod mini: $129, up from $99 (+$30) HomePod: $349, up from $299 (+$50) Apple TV: $199, up from $129 (+$70) iPad Air: $749, up from $599 (+$150) iPad Pro: $1,199, up from $999 (+$200) MacBook Neo: $699, up from $599 (+$100) MacBook Air: $1,299, up from $1,099 (+$200) MacBook Pro: $1,999 up from $1,699 (+$300) iMac: $1,499, up from $1,299 (+$200) Mac mini (M4 Pro): $1,599, up from $1,399 (+$200) Mac Studio (M4 Max): $2,499, up from $1,999 (+$500) Mac Studio (M3 Ultra): $5,299, up from $3,999 (+$1,300) Vision Pro: $3,699, up from $3,499 (+$200) The average price increase is $269.23. The iPhone, AirPods, Studio Display, and accessories such as the Apple Pencil are seemingly the only unaffected product lines. Last week, Apple announced that it was preparing to raise prices across its product lineup, with CEO Tim Cook confirming that that the move was inevitable. Cook made the announcement in an interview with The Wall Street Journal, citing the soaring cost of memory and storage chips. "Unfortunately, price increases are unavoidable," he said. "We're doing our best to mitigate the huge increases that are being passed to us, and we've been trying to shield our customers from the increases, but the situation has become unsustainable." Cook described the scale of the memory shortage as a "hundred-year flood," adding, "I've never seen anything like it in any area in over 40 years." Apple has historically absorbed component cost swings rather than passing them on to customers, so this marks a notable shift in approach. Tag: Apple Store This article, "Apple Just Increased Prices: Here's What's Changed" first appeared on MacRumors.com Discuss this article in our forums View the full article