Skip to content
View in the app

A better way to browse. Learn more.
hosang I.T.

A full-screen app on your home screen with push notifications, badges and more.

To install this app on iOS and iPadOS
  1. Tap the Share icon in Safari
  2. Scroll the menu and tap Add to Home Screen.
  3. Tap Add in the top-right corner.
To install this app on Android
  1. Tap the 3-dot menu (⋮) in the top-right corner of the browser.
  2. Tap Add to Home screen or Install app.
  3. Confirm by tapping Install.

Tech

Tech Articles from a wide variety of topics and categories
Show all categories

Apple Releases Second watchOS 26.5, tvOS 26.5 and visionOS 26.5 Betas

Apple today provided developers with the second betas of upcoming watchOS 26.5, tvOS 26.5, and visionOS 26.5 betas for testing purposes. The software comes two weeks after Apple released the first betas for each platform.


The software updates are available through the Settings app on each device, and because these are developer betas, a free developer account is required.

There's no word on what's in the software as of yet. watchOS, tvOS, and visionOS often get few features in each new beta, with updates primarily focusing on bug fixes and performance improvements. Nothing new was found in the first betas.
Related Roundups: Apple TV, Apple Vision Pro, watchOS 26Buyer's Guide: Apple TV (Don't Buy), Vision Pro (Buy Now)Related Forums: Apple TV and Home Theater, Apple Vision Pro, Apple Watch
This article, "Apple Releases Second watchOS 26.5, tvOS 26.5 and visionOS 26.5 Betas" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

How to Analyze Hugging Face for Arm64 Readiness

This post is a collaboration between Docker and Arm, demonstrating how Docker MCP Toolkit and the Arm MCP Server work together to scan Hugging Face Spaces for Arm64 Readiness.
In our previous post, we walked through migrating a legacy C++ application with AVX2 intrinsics to Arm64 using Docker MCP Toolkit and the Arm MCP Server – code conversion, SIMD intrinsic rewrites, compiler flag changes, the full stack. This post is about a different and far more common failure mode.
When we tried to run ACE-Step v1.5, a 3.5B parameter music generation model from Hugging Face, on an Arm64 MacBook, the installation failed not with a cryptic kernel error but with a pip error. The flash-attn wheel in requirements.txt was hardcoded to a linux_x86_64 URL, no Arm64 wheel existed at that address, and the container would not build. It’s a deceptively simple problem that turns out to affect roughly 80% of Hugging Face Docker Spaces: not the code, not the Dockerfile, but a single hardcoded dependency URL that nobody noticed because nobody had tested on Arm.
To diagnose this systematically, we built a 7-tool MCP chain that can analyse any Hugging Face Space for Arm64 readiness in about 15 minutes. By the end of this guide you’ll understand exactly why ACE-Step v1.5 fails on Arm64, what the two specific blockers are, and how the chain surfaces them automatically.
Why Hugging Face Spaces Matter for Arm
Hugging Face hosts over one million Spaces, a significant portion of which use the Docker SDK meaning developers write a Dockerfile and HuggingFace builds and serves the container directly. The problem is that nearly all of those containers were built and tested exclusively on linux/amd64, which creates a deployment wall for three fast-growing Arm64 targets that are increasingly relevant for AI workloads.
Target
Hardware
Why it matters
Cloud
AWS Graviton, Azure Cobalt, Google Axion
20-40% cost reduction vs. x86
Edge/Robotics
NVIDIA Jetson Thor, DGX Spark
GR00T, LeRobot, Isaac all target Arm64
Local dev
Apple Silicon M1-M4
Most popular developer machine, zero cloud cost
The failure mode isn’t always obvious, and it tends to show up in one of two distinct patterns. The first is a missing container manifest – the image has no arm64 layer and Docker refuses to pull it, which is at least straightforward to diagnose. The second is harder to catch: the Dockerfile and base image are perfectly fine, but a dependency in requirements.txt points to a platform-specific wheel URL. The build starts, reaches pip install, and fails with a platform mismatch error that gives no clear indication of where to look. ACE-Step v1.5 is a textbook example of the second pattern, and the MCP chain catches both in minutes.
The 7-Tool MCP Chain
Docker MCP Toolkit orchestrates the analysis through a secure MCP Gateway. Each tool runs in an isolated Docker container. The seven tools in the chain are:
Caption: The 7-tool MCP chain architecture diagram
The tools:
Hugging Face MCP – Discovers the Space, identifies SDK type (Docker vs. Gradio) Skopeo (via Arm MCP Server) – Inspects the container registry, reports supported architectures migrate-ease (via Arm MCP Server) – Scans source code for x86-specific intrinsics, hardcoded paths, arch-locked libraries GitHub MCP – Reads Dockerfile, pyproject.toml, requirements.txt from the repository Arm Knowledge Base (via Arm MCP Server) – Searches learn.arm.com for build strategies and optimization guides Sequential Thinking – Combines findings into a structured migration verdict Docker MCP Gateway – Routes requests, manages container lifecycle The natural question at this point is whether you could simply rebuild your Docker image for Arm64 and be done with it and for many applications, you could. But knowing in advance whether the rebuild will actually succeed is a different problem. Your Dockerfile might depend on a base image that doesn’t publish Arm64 builds. Your Python dependencies might not have aarch64 wheels. Your code might use x86-specific system calls. The MCP chain checks all of this automatically before you invest time in a build that may not work.
Setting Up Visual Studio Code with Docker MCP Toolkit
Prerequisites
Before you begin, make sure you have:
A machine with 8 GB RAM minimum (16GB recommended) The latest Docker Desktop release VS Code with GitHub Copilot extension GitHub account with personal access token Step 1. Enable Docker MCP Toolkit
Open Docker Desktop and enable the MCP Toolkit from Settings.
To enable:
Open Docker Desktop Go to Settings > Beta Features Caption: Enabling Docker MCP Toolkit under Docker Desktop
Toggle Docker MCP Toolkit ON Click Apply Step 2. Add Required MCP Servers from Catalog
Add the following four MCP Servers from the Catalog. You can find them by selecting “Catalog” in the Docker Desktop MCP Toolkit, or by following these links:
Arm MCP Server – Architecture analysis, migrate-ease scanning, skopeo inspection, and Arm knowledge base GitHub MCP Server – Repository analysis, code reading, and pull request creation Sequential Thinking MCP Server – Complex problem decomposition and planning Hugging Face MCP Server – Space discovery and metadata retrieval Caption: Searching for Arm MCP Server in the Docker MCP Catalog
Step 3. Configure the Servers
Configure the Arm MCP Server To access your local code for the migrate-ease scan and MCA tools, the Arm MCP Server needs a directory configured to point to your local code.
Caption: Arm MCP Server configuration
Once you click ‘Save’, the Arm MCP Server will know where to look for your code. If you want to give a different directory access in the future, you’ll need to change this path.
Available Arm Migration Tools
Click Tools to view all six MCP tools available under Arm MCP Server:
Caption: List of MCP tools provided by the Arm MCP Server
knowledge_base_search – Semantic search of Arm learning resources, intrinsics documentation, and software compatibility migrate_ease_scan – Code scanner supporting C++, Python, Go, JavaScript, and Java for Arm compatibility analysis check_image – Docker image architecture verification (checks if images support Arm64) skopeo – Remote container image inspection without downloading mca – Machine Code Analyzer for assembly performance analysis and IPC predictions sysreport_instructions – System architecture information gathering
Configure the GitHub MCP Server The GitHub MCP Server lets GitHub Copilot read repositories, create pull requests, manage issues, and commit changes.
Caption: Steps to configure GitHub Official MCP Server
Configure Authentication:
Select GitHub official Choose your preferred authentication method For Personal Access Token, get the token from GitHub > Settings > Developer Settings Caption: Setting up Personal Access Token in GitHub MCP Server
Configure the Sequential Thinking MCP Server Click “Sequential Thinking” No configuration needed Caption: Sequential MCP Server requires zero configuration
This server helps GitHub Copilot break down complex migration decisions into logical steps.
Configure the Hugging Face MCP Server The Hugging Face MCP Server provides access to Space metadata, model information, and repository contents directly from the Hugging Face Hub.
Click “Hugging Face” No additional configuration needed for public Spaces For private Spaces, add your HuggingFace API token Step 4. Add the Servers to VS Code
The Docker MCP Toolkit makes it incredibly easy to configure MCP servers for clients like VS Code.
To configure, click “Clients” and scroll down to Visual Studio Code. Click the “Connect” button:
Caption: Setting up Visual Studio Code as MCP Client
Now open VS Code and click on the ‘Extensions’ icon in the left toolbar:
Caption: Configuring MCP_DOCKER under VS Code Extensions
Click the MCP_DOCKER gear, and click ‘Start Server’:
Caption: Starting MCP Server under VS Code
Step 5. Verify Connection
Open GitHub Copilot Chat in VS Code and ask:
What Arm migration and Hugging Face tools do you have access to? You should see tools from all four servers listed. If you see them, your connection works. Let’s scan a Hugging Face Space.
Caption: Playing around with GitHub Copilot

Real-World Demo: Scanning ACE-Step v1.5
Now that you’ve connected GitHub Copilot to Docker MCP Toolkit, let’s scan a real Hugging Face Space for Arm64 readiness and uncover the exact Arm64 blocker we hit when trying to run it locally.
Target: ACE-Step v1.5 – a 3.5B parameter music generation model  Time to scan: 15 minutes  Infrastructure cost: $0 (all tools run locally in Docker containers)  The Workflow
Docker MCP Toolkit orchestrates the scan through a secure MCP Gateway that routes requests to specialized tools: the Arm MCP Server inspects images and scans code, Hugging Face MCP discovers the Space, GitHub MCP reads the repository, and Sequential Thinking synthesizes the verdict. 
Step 1. Give GitHub Copilot Scan Instructions
Open your project in VS Code. In GitHub Copilot Chat, paste this prompt:
Your goal is to analyze the Hugging Face Space "ACE-Step/ACE-Step-v1.5" for Arm64 migration readiness. Use the MCP tools to help with this analysis. Steps to follow: 1. Use Hugging Face MCP to discover the Space and identify its SDK type (Docker or Gradio) 2. Use skopeo to inspect the container image - check what architectures are currently supported 3. Use GitHub MCP to read the repository - examine pyproject.toml, Dockerfile, and requirements 4. Run migrate_ease_scan on the source code to find any x86-specific dependencies or intrinsics 5. Use knowledge_base_search to find Arm64 build strategies for any issues discovered 6. Use sequential thinking to synthesize all findings into a migration verdict At the end, provide a clear GO / NO-GO verdict with a summary of required changes. Step 2. Watch Docker MCP Toolkit Execute
GitHub Copilot orchestrates the scan using Docker MCP Toolkit. Here’s what happens:
Phase 1: Space Discovery
GitHub Copilot starts by querying the Hugging Face MCP server to retrieve Space metadata.
Caption: GitHub Copilot uses Hugging Face MCP to discover the Space and identify its SDK type.
The tool returns that ACE-Step v1.5 uses the Docker SDK – meaning Hugging Face serves it as a pre-built container image, not a Gradio app. This is critical: Docker SDK Spaces have Dockerfiles we can analyze and rebuild, while Gradio SDK Spaces are built by Hugging Face’s infrastructure we can’t control.
Phase 2: Container Image Inspection
Next, Copilot uses the Arm MCP Server’s skopeo tool to inspect the container image without downloading it.
Caption: The skopeo tool reports that the container image has no Arm64 build available. The container won’t start on Arm hardware.
Result: the manifest includes only linux/amd64. No Arm64 build exists. This is the first concrete data point  the container will fail on any Arm hardware. But this is not the full story.
Phase 3: Source Code Analysis
Copilot uses GitHub MCP to read the repository’s key files. Here is the actual Dockerfile from the Space:
FROM python:3.11-slim ENV PYTHONDONTWRITEBYTECODE=1 \ PYTHONUNBUFFERED=1 \ DEBIAN_FRONTEND=noninteractive \ TORCHAUDIO_USE_TORCHCODEC=0 RUN apt-get update && \ apt-get install -y --no-install-recommends git libsndfile1 build-essential && \ apt-get install -y ffmpeg libavcodec-dev libavformat-dev libavutil-dev libswresample-dev && \ rm -rf /var/lib/apt/lists/* RUN useradd -m -u 1000 user RUN mkdir -p /data && chown user:user /data && chmod 755 /data ENV HOME=/home/user \ PATH=/home/user/.local/bin:$PATH \ GRADIO_SERVER_NAME=0.0.0.0 \ GRADIO_SERVER_PORT=7860 WORKDIR $HOME/app COPY --chown=user:user requirements.txt . COPY --chown=user:user acestep/third_parts/nano-vllm ./acestep/third_parts/nano-vllm USER user RUN pip install --no-cache-dir --user -r requirements.txt RUN pip install --no-deps ./acestep/third_parts/nano-vllm COPY --chown=user:user . . EXPOSE 7860 CMD ["python", "app.py"] The Dockerfile itself looks clean:
python:3.11-slim already publishes multi-arch builds including arm64 No -mavx2, no -march=x86-64 compiler flags build-essential, ffmpeg, libsndfile1 are all available in Debian’s arm64 repositories But the real problem is in requirements.txt. This is what I hit when I tried to install ACE-Step locally:
# nano-vllm dependencies triton>=3.0.0; sys_platform != 'win32' flash-attn @ https://github.com/mjun0812/flash-attention-prebuild-wheels/releases/ download/v0.7.12/flash_attn-2.8.3+cu128torch2.10-cp311-cp311-linux_x86_64.whl ; sys_platform == 'linux' and python_version == '3.11' Two immediate blockers:
flash-attn is pinned to a hardcoded linux_x86_64 wheel URL. On an aarch64 system, pip downloads this wheel and immediately rejects it: “not a supported wheel on this platform.” This is the exact error I hit. triton>=3.0.0 has no aarch64 wheel on PyPI for Linux. It will fail on Arm hardware. Neither of these is a code problem. The Python source code is architecture-neutral. The fix is in the dependency declarations.
Phase 4: Architecture Compatibility Scan
Copilot runs the migrate_ease_scan tool with the Python scanner on the codebase.
Caption: The migrate_ease_scan tool analyzes the Python source code and finds zero x86-specific dependencies. No intrinsics, no hardcoded paths, no architecture-locked libraries.
The application source code itself returns 0 architecture issues — no x86 intrinsics, no platform-specific system calls. But the scan also flags the dependency manifest. Two blockers in requirements.txt:
Dependency
Issue
Arm64 Fix
flash-attn (linux wheel)
Hardcoded linux_x86_64 URL
Use flash-attn 2.7+ via PyPI — publishes aarch64 wheels natively
triton>=3.0.0
No aarch64 PyPI wheel for Linux
Exclude on aarch64 or use triton-nightly aarch64 build
Phase 5: Arm Knowledge Base Lookup
Copilot queries the Arm MCP Server’s knowledge base for solutions to the discovered issues.
Caption: GitHub Copilot uses the knowledge_base_search tool to find Docker buildx multi-arch strategies from learn.arm.com.
The knowledge base returns documentation on:
flash-attn aarch64 wheel availability from version 2.7+ PyTorch Arm64 optimization guides for Graviton and Apple Silicon Best practices for CUDA 13.0 on aarch64 (Jetson Thor / DGX Spark) triton alternatives for CPU inference paths on Arm Phase 6: Synthesis and Verdict

Sequential Thinking combines all findings into a structured verdict:
Check
Result
Blocks?
Container manifest
amd64 only
Yes, needs rebuild
Base image python:3.11-slim
Multi-arch (arm64 available)
No
System packages (ffmpeg, libsndfile1)
Available in Debian arm64
No
torch==2.9.1
aarch64 wheels published
No
flash-attn linux wheel
Hardcoded linux_x86_64 URL
YES, add arm64 URL alongside
triton>=3.0.0
aarch64 wheels available from 3.5.0+
No, resolves automatically
Source code (migrate-ease)
0 architecture issues
No
Compiler flags in Dockerfile
None x86-specific
No
Verdict: CONDITIONAL GO. Zero code changes. Zero Dockerfile changes. One dependency fix is required.

Here are the exact changes needed in requirements.txt:
# BEFORE — only x86_64 flash-attn @ https://github.com/mjun0812/flash-attention-prebuild-wheels/releases/download/v0.7.12/flash_attn-2.8.3+cu128torch2.10-cp311-cp311-linux_aarch64.whl ; sys_platform == 'linux' and python_version == '3.11' and platform_machine == 'aarch64' # AFTER — add arm64 line alongside x86_64 flash-attn @ https://github.com/mjun0812/flash-attention-prebuild-wheels/releases/download/v0.7.12/flash_attn-2.8.3+cu128torch2.10-cp311-cp311-linux_aarch64.whl ; sys_platform == 'linux' and python_version == '3.11' and platform_machine == 'aarch64' flash-attn @ https://github.com/mjun0812/flash-attention-prebuild-wheels/releases/download/v0.7.12/flash_attn-2.8.3+cu128torch2.10-cp311-cp311-linux_x86_64.whl ; sys_platform == 'linux' and python_version == '3.11' and platform_machine != 'aarch64' # triton — no change needed, 3.5.0+ has aarch64 wheels, resolves automatically triton>=3.0.0; sys_platform != 'win32' After those two fixes, the build command is:
docker buildx build --platform linux/arm64 -t ace-step:arm64 . That single command unlocks three deployment paths:
NVIDIA Arm64 — Jetson Thor, DGX Spark (aarch64 + CUDA 13.0) Cloud Arm64 — AWS Graviton, Azure Cobalt, Google Axion (20-40% cost savings) Apple Silicon — M1-M4 Macs with MPS acceleration (local inference, $0 cloud cost)
Phase 7: Create the Pull Request
After completing the scan, Copilot uses GitHub MCP to propose the fix. Since the only blocker is the hardcoded linux_x86_64 wheel URL on line 32 of requirements.txt, the change is surgical: one line added, nothing removed.
The fix adds the equivalent linux_aarch64 wheel from the same release alongside the existing x86_64 entry, conditioned on platform_machine == 'aarch64':
# BEFORE — only x86_64, fails silently on Arm flash-attn @ https://github.com/mjun0812/flash-attention-prebuild-wheels/releases/ download/v0.7.12/flash_attn-2.8.3+cu128torch2.10-cp311-cp311-linux_x86_64.whl ; sys_platform == 'linux' and python_version == '3.11' # AFTER — add arm64 line alongside, conditioned by platform_machine flash-attn @ https://github.com/mjun0812/flash-attention-prebuild-wheels/releases/ download/v0.7.12/flash_attn-2.8.3+cu128torch2.10-cp311-cp311-linux_x86_64.whl ; sys_platform == 'linux' and python_version == '3.11' flash-attn @ https://github.com/mjun0812/flash-attention-prebuild-wheels/releases/ download/v0.7.12/flash_attn-2.8.3+cu128torch2.10-cp311-cp311-linux_aarch64.whl ; sys_platform == 'linux' and python_version == '3.11' and platform_machine == 'aarch64' Caption: PR #14 on Hugging Face – Ready to merge
The key insight: the upstream maintainer already published the arm64 wheel in the same release. The fix wasn’t a rebuild or a code change – it was adding one line that references an artifact that already existed. The MCP chain found it in 15 minutes. Without it, a developer hitting this pip error would spend hours tracking it down.
PR: https://huggingface.co/spaces/ACE-Step/Ace-Step-v1.5/discussions/14
Without Arm MCP vs. With Arm MCP
Let’s be clear about what changes when you add the Arm MCP Server to Docker MCP Toolkit.
Without Arm MCP: You ask GitHub Copilot to check your Hugging Face Space for Arm64 compatibility. Copilot responds with general advice: “Check if your base image supports arm64”, “Look for x86-specific code”, “Try rebuilding with buildx”. You manually inspect Docker Hub, grep through the codebase, check each dependency on PyPI, and hit a pip install failure you cannot easily diagnose. The flash-attn URL issue alone can take an hour to track down. With Arm MCP + Docker MCP Toolkit: You ask the same question. Within minutes, it uses skopeo to verify the base image, runs migrate_ease_scan on your actual codebase, flags the hardcoded linux_x86_64 wheel URLs in requirements.txt, queries knowledge_base_search for the correct fix, and synthesizes a structured CONDITIONAL GO verdict with every check documented. Real images get inspected. Real code gets scanned. Real dependency files get analyzed. The difference is Docker MCP Toolkit gives GitHub Copilot access to actual Arm migration tooling, not just general knowledge.
Manual Process vs. MCP Chain
Manual process:
Clone the Hugging Face Space repository (10 minutes) Inspect the container manifest for architecture support (5 minutes) Read through pyproject.toml and requirements.txt (20 minutes) Check PyPI for Arm64 wheel availability across all dependencies (30 minutes) Analyze the Dockerfile for hardcoded architecture assumptions (10 minutes) Research CUDA/cuDNN Arm64 support for the required versions (20 minutes) Write up findings and recommended changes (15 minutes) Total: 2-3 hours per Space
With Docker MCP Toolkit:
Give GitHub Copilot the scan instructions (5 minutes) Review the migration report (5 minutes) Submit a PR with changes (5 minutes) Total: 15 minutes per Space
What This Suggests at Scale
ACE-Step is a standard Python AI application: PyTorch, Gradio, pip dependencies, a slim Dockerfile. This pattern covers the majority of Docker SDK Spaces on Hugging Face.
The Arm64 wall for these apps is not always visible. The Dockerfile looks clean. The base image supports arm64. The Python code has no intrinsics. But buried in requirements.txt is a hardcoded wheel URL pointing at a linux_x86_64 binary, and nobody finds it until they actually try to run the container on Arm hardware.
That is the 80% problem: 80% of Hugging Face Docker Spaces have never been tested on Arm. Not because the code will not work. but because nobody checked. The MCP chain is a systematic check that takes 15 minutes instead of an afternoon of debugging pip errors.
That has real cost implications:
Graviton inference runs 20-40% cheaper for the same workloads. Every amd64-only Space leaves that savings untouched. NVIDIA Physical AI (GR00T, LeRobot, Isaac) deploys on Jetson Thor. Developers find models on Hugging Face, but the containers fail to build on target hardware. Apple Silicon is the most common developer laptop. Local inference means faster iteration and no cloud bill. How Docker MCP Toolkit Changes Development
Docker MCP Toolkit changes how developers interact with specialized knowledge and capabilities. Rather than learning new tools, installing dependencies, or managing credentials, developers connect their AI assistant once and immediately access containerized expertise.
The benefits extend beyond Hugging Face scanning:
Consistency — Same 7-tool chain produces the same structured analysis for any container Security — Each tool runs in an isolated Docker container, preventing tool interference Reproducibility — Scans behave identically across environments Composability — Add or swap tools as the ecosystem evolves Discoverability — Docker MCP Catalog makes finding the right server straightforward Most importantly, developers remain in their existing workflow. VS Code. GitHub Copilot. Git. No context switching to external tools or dashboards.
Wrapping Up
You have just scanned a real Hugging Face Space for Arm64 readiness using Docker MCP Toolkit, the Arm MCP Server, and GitHub Copilot. What we found with ACE-Step v1.5 is representative of what you will find across Hugging Face: code that is architecture-neutral, a Dockerfile that is already clean, but a requirements.txt with hardcoded x86_64 wheel URLs that silently break Arm64 builds.
The MCP chain surfaces this in 15 minutes. Without it, you are staring at a pip error with no clear path to the cause.
Ready to try it? Open Docker Desktop and explore the MCP Catalog. Start with the Arm MCP Server, add GitHub,Sequential Thinking, and Hugging Face MCP. Point the chain at any Hugging Face Space you’re working with and see what comes back.
Learn More
New to Docker? Download Docker Desktop Explore the MCP Catalog: Discover containerized, security-hardened MCP servers Get Started with MCP Toolkit: Official Documentation Arm MCP Server: Developer Documentation Hugging Face MCP Server:Hub Documentation ACE-Step v1.5: Hugging Face Space Migration PR: GitHub Pull Request
View the full article
reporter

FBI and Indonesian Police Dismantle W3LL Phishing Network Behind $20M Fraud Attempts

The U.S. Federal Bureau of Investigation (FBI), in partnership with the Indonesian National Police, has dismantled the infrastructure associated with a global phishing operation that leveraged an off-the-shelf toolkit called W3LL to steal thousands of victims' account credentials and attempt more than $20 million in fraud. In tandem, authorities detained the alleged developer, who has&View the full article
Hacker News

Check Who's Using Your iPhone Hotspot Data

If you regularly share your iPhone's data connection with your laptop or iPad, or let family members piggyback on your device's data, you'll be glad to learn that Apple recently made it a lot easier to keep tabs on who's burning through your monthly allowance.


In a welcome change with the release of iOS 26.4, Apple has moved Personal Hotspot data usage info out of its previous hiding spot and put it in a much more convenient location.

Before the latest update, Personal Hotspot's per-device breakdown was secreted away inside cellular settings, where it was easy to miss. Now it sits right inside the Personal Hotspot menu, making it way more practical for anyone on a capped data plan who's keen to keep an eye on usage.

Here's how to check it in iOS 26.4 (you can make sure your device is up-to-date via Settings ➝ General ➝ Software Update).

How to Check iPhone Hotspot Data Usage


Open Settings on your iPhone.
Tap Personal Hotspot.
Below the "Maximize Compatibility" toggle, tap Data Usage.


Here you'll see a list of connected devices along with how much data each one has consumed, as well as a total figure across all devices. Note that Apple devices running iOS 26.4 or macOS 26.4 appear individually by name, whereas Android phones, Windows PCs, and anything running older Apple software are grouped together under "Other Devices."

Bear in mind that the Data Usage option only appears if you've used Personal Hotspot recently. If you want, you can clear the figures and start tracking anew by heading to Settings ➝ Cellular/Mobile Service and resetting your overall cellular usage statistics (the option at the bottom). This wipes your hotspot numbers at the same time.
This article, "Check Who's Using Your iPhone Hotspot Data" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

Smart Adhesive Is Key to Crease-Free Foldable iPhone Display

Advances in optically clear adhesive (OCA) will be a key factor in achieving a near-invisible crease in Apple's first foldable iPhone expected later this year, according to TrendForce.


The supply chain intelligence firm outlined the key technologies in a new report on foldable display innovation, explaining that creases form when layers within the display panel fall out of alignment, concentrating stress at the fold and causing micro-cracks or permanent deformation over time.

Ultra-thin glass (UTG) also plays a role in the optimal design. Apple's patents have described a design where the glass is thinner at the fold for flexibility and thicker elsewhere for durability, which is an approach consistent with reports last year that Apple was testing uneven-thickness panels, and more recently that it may use a dual-layer glass structure to spread stress across multiple layers.

The single most important factor, TrendForce says, is OCA. Modern formulations go well beyond simple bonding, staying pliable during gradual bending to reduce fatigue while temporarily stiffening under sudden impact to provide structural support. Over time, the adhesive's ability to flow into microscopic irregularities also reduces light scattering and keeps the crease less visible.

Hinge and structural engineering still matter too. Samsung Display uses laser drilling in the metal support plate behind the display to balance rigidity and flexibility, a technique analyst Ming-Chi Kuo reported last July that Apple's foldable would also use via supplier Fine M-Tec. Samsung briefly showcased a crease-free panel at CES 2026, though it later clarified this was an R&D concept rather than a production-ready design.

Apple has reportedly pursued eliminating the crease "regardless of cost", and leaker "Fixed Focus Digital" reported in February that production orders had been placed with a crease depth under 0.15mm and a crease angle under 2.5 degrees. TrendForce estimates Apple could capture close to 20% of the foldable smartphone market this year, which it says would compress Samsung and Huawei to roughly 30% each.

The foldable iPhone is expected to be unveiled alongside the iPhone 18 Pro models in September. Foxconn began trial production last week, and Samsung Display is reportedly on track to begin mass production of OLED panels for the device in May. Related Roundup: iPhone FoldTags: Foldable iPhone, TrendForce
This article, "Smart Adhesive Is Key to Crease-Free Foldable iPhone Display" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

Get Up to $200 Off 2026 MacBook Pro With Record Low Prices on Amazon

Amazon is offering a few all-time low prices on Apple's M5 Pro/M5 Max MacBook Pro, with up to $200 off select models without the need of a membership or clipping a coupon. These deals join Amazon's discounts on the M5 MacBook Air from over the weekend, which are seeing $150 in savings on every model.

Note: MacRumors is an affiliate partner with Amazon. When you click a link and make a purchase, we may receive a small payment, which helps us keep the site running.

Starting with the 14-inch models, you can get the 24GB/1TB M5 Pro MacBook Pro for $2,048.00, down from $2,199.00. This deal, along with all of the others we're tracking in this article, represent best-ever prices on the brand new M5 Pro and M5 Max MacBook Pro.

$151 OFF14-inch M5 Pro MacBook Pro (24GB/1TB) for $2,048.00
$150 OFF14-inch M5 Pro MacBook Pro (24GB/2TB) for $2,449.00
$150 OFF14-inch M5 Max MacBook Pro (36GB/2TB) for $3,449.00

We're also tracking similar steep discounts on the 16-inch models, including a few M5 Max options. These discounts reach up to $200 off original prices, and as of writing we're only tracking these deals on Amazon.

$150 OFF16-inch M5 Pro MacBook Pro (24GB/1TB) for $2,549.00
$200 OFF16-inch M5 Pro MacBook Pro (48GB/1TB) for $2,899.00
$200 OFF16-inch M5 Max MacBook Pro (36GB/2TB) for $3,699.00

If you're on the hunt for more discounts, be sure to visit our Apple Deals roundup where we recap the best Apple-related bargains of the past week.



Deals Newsletter

Interested in hearing more about the best deals you can find in 2026? Sign up for our Deals Newsletter and we'll keep you updated so you don't miss the biggest deals of the season!




Related Roundup: Apple Deals
This article, "Get Up to $200 Off 2026 MacBook Pro With Record Low Prices on Amazon" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

Valve's Steam Link App Is Coming to Apple Vision Pro

Valve's Steam Link app, which is designed to let you stream games from your main gaming computer to another device, is coming to Apple Vision Pro.


The upcoming app for visionOS means users will be able to wirelessly stream games from Steam running on their Mac or PC to their Vision Pro headset, assuming the devices are on the same local network.

Prior to its official release, Valve is offering access to a beta of the app via TestFlight. The latest version improves network performance, allows streaming up to 4K resolutions, and allows users to dynamically adjust the curve of the display in panoramic mode.

The one limitation worth bearing in mind is that the client is for 2D streaming only and does not support VR content. Whether this will change in the future is unclear. Valve announced its intention to release a native Steam Link app for visionOS earlier this month, but the company has yet to share a general release date.Related Roundup: Apple Vision ProTag: ValveBuyer's Guide: Vision Pro (Buy Now)Related Forum: Apple Vision Pro
This article, "Valve's Steam Link App Is Coming to Apple Vision Pro" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

⚡ Weekly Recap: Fiber Optic Spying, Windows Rootkit, AI Vulnerability Hunting and More

Monday is back, and the weekend’s backlog of chaos is officially hitting the fan. We are tracking a critical zero-day that has been quietly living in your PDFs for months, plus some aggressive state-sponsored meddling in infrastructure that is finally coming to light. It is one of those mornings where the gap between a quiet shift and a full-blown incident response is basicallyView the full article
Hacker News

Critical flaw in Marimo Python notebook exploited within 10 hours of disclosure

A critical pre-authentication remote code execution vulnerability in Marimo, an open-source Python notebook platform owned by AI cloud company CoreWeave, was exploited in the wild less than 10 hours after its public disclosure, according to the Sysdig Threat Research Team.
The vulnerability, tracked as CVE-2026-39987 with a severity score of 9.3 out of 10, affects all Marimo versions before 0.23.0.
It requires no login, no stolen credentials, and no complex exploit. An attacker only needs to send a single connection request to a specific endpoint on an exposed Marimo server to gain complete control of the system, the Sysdig team wrote in a blog post.
The flaw allows an unauthenticated attacker to obtain a full interactive shell and execute arbitrary system commands on any exposed Marimo instance through a single connection, with no credentials required, the post said.
“Marimo has a Pre-Auth RCE vulnerability,” the Marimo team wrote in its GitHub security advisory. “The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to obtain a full PTY shell and execute arbitrary system commands.”
Marimo is a Python-based reactive notebook with roughly 20,000 stars on GitHub and was acquired by CoreWeave in October 2025.
How the flaw works
Marimo’s server includes a built-in terminal feature that lets users run commands directly from the browser. That terminal was accessible over the network without any authentication check, while other parts of the same server correctly required users to log in before connecting, the post said.
“The terminal endpoint skips this check entirely, accepting connections from any unauthenticated user and granting a full interactive shell running with the privileges of the Marimo process,” the post added.
In practical terms, anyone who could reach the server over the internet could walk straight into a live command shell, often with administrator-level access, without ever entering a password, the team at Sysdig said.
Credentials stolen in under three minutes
To track real-world exploitation, deployed honeypot servers running vulnerable Marimo instances across multiple cloud providers and observed the first exploitation attempt within 9 hours and 41 minutes of disclosure. No ready-made exploit tool existed at the time. The attacker had built one using only the advisory description, Sysdig researchers wrote.
The attacker worked in stages across four sessions. A brief first session confirmed the vulnerability was exploitable. A second session involved manually browsing the server’s file system. By the third session, the attacker had located and read an environment file containing AWS access keys and other application credentials. The entire operation took under three minutes, the post said.
“This is a complete credential theft operation executed in under 3 minutes,” the Sysdig team wrote.
The attacker then returned over an hour later to re-check the same files. The behavior was consistent with a human operator working through a list of targets rather than an automated scanner, the post said.
Part of a widening pattern
The pace of exploitation aligns with a trend seen across AI and open-source tooling. A critical flaw in Langflow was weaponized within 20 hours of disclosure earlier this year, also tracked by Sysdig. The Marimo case cut that window roughly in half, with no public exploit code in circulation at the time.
“Niche or less popular software is not safer software,” the Sysdig post said. Any internet-facing application with a published critical advisory is a target within hours of disclosure, regardless of its install base, it added.
The Marimo case had no CVE number assigned at the time of the first attack, meaning organizations dependent on CVE-based scanning would not have flagged the advisory at all, Sysdig noted.
The flaw also fits a pattern of critical RCE vulnerabilities in AI-adjacent developer tools — including MLflow, n8n, and Langflow — in which code-execution features built for convenience become dangerous when exposed to the internet without consistent authentication controls.
What organizations should do
Marimo released a patched version, 0.23.0, which closes the authentication gap in the terminal endpoint. Organizations running any earlier version should update immediately, Sysdig said.
Teams that cannot update right away should block external access to Marimo servers using firewall rules or place them behind an authenticated proxy, the post said. Any instance that has been publicly reachable should be treated as potentially compromised.
“Credentials stored on those servers, including cloud access keys and API tokens, should be rotated as a precaution,” Sysdig advised.
CoreWeave did not immediately respond to a request for comment.
View the full article
CSOonline

Seven IBM WebSphere Liberty flaws can be chained into full takeover

Security researchers are warning of a set of flaws affecting IBM WebSphere Liberty, a lightweight, modular Java application server, that can be chained into a full server compromise.
The flaws, a total of seven, that led to the ultimate compromise of the server were initiated by a newly discovered pre-authentication issue in the platform’s SAML Web SSO component that enables low-privilege access.
From there, the chain manipulates authentication, access control, and cryptographic protection to achieve full control. “The 7 flaws we reported to IBM create multiple pathways for attackers to move from network-level exposure or limited access to full server compromise,” Oligo Security researchers said in a blog post.
The chain is basically a privilege-escalation path to a critical compromise, protections against which are now available as patches and configuration guidelines.
Pre-auth RCE sets the tone
The root flaw, also the most recently disclosed, is tracked as CVE-2026-1561, targeting the SAML Web SSO functionality and requires no authentication to exploit. In affected deployments, attackers can reach exposed SAML endpoints and supply crafted serialized payloads, ultimately achieving remote code execution (RCE).
Specifically, the application attempts to validate a serialized cookie by appending a secret value, but fails to store the result of the “String.concat()” operation. In Java, this method is non-mutating, meaning the original string remains unchanged, making the integrity check useless.

As a result, attackers can tamper with the SSO cookie and supply arbitrary serialized Java objects without triggering validation failures. Because the vulnerable endpoint processes this data before authentication, it opens up the pre-auth RCE vector.
SSO endpoints are often internet-facing by design, researchers noted, turning the flaw into a remote entry point and making chaining with additional weaknesses possible.
AdminCenter flaws allow further escalation
Beyond initial access, the research outlined critical issues within WebSphere Liberty’s administrative controls. The AdminCenter component, designed to enforce role-based access, contains multiple flaws that allow low-privileged users to access sensitive files and secrets.

One issue, tracked under CVE-2025-14915, enables “reader”-level users to retrieve critical server files such as authentication keys, which can then be used to forge tokens and impersonate higher privileged users. Another problem (CVE-2025-14917) lies in hardcoded passwords protecting token-signing LTPA keys, alongside encryption utilities that ship with static keys (CVE-2025-14923) across all modes.
The rest of the chain includes an archive extraction flaw (CVE-2025-14914) that can be abused to write files outside intended directories, alongside insecure handling (CVE unassigned) of configuration data where sensitive entries, like credentials “in server.xml,” can be retrieved or reused once access is gained.
The researchers detailed the full chain, noting that a low-privileged “reader” user can extract or recover admin credentials from exposed configuration data, or alternatively forge an admin token using decrypted LTPA keys, gaining full administrative access. From there, the archive extraction flaw allows arbitrary file writes via Zip Slip-style attack, ultimately leading to remote code execution.

IBM did not immediately respond to CSO’s request for comments on the disclosed attack chain.
Other than applying necessary patches, Oligo urged organizations to rotate any secrets ever generated using “SecurityUtility,” as default XOR and AES modes make them effectively reversible, and to move to custom encryption keys going forward. It also recommended using auditing and limiting reader-role assignments, since those users can potentially escalate to full administrative access.
View the full article
CSOonline

Your MTTD Looks Great. Your Post-Alert Gap Doesn't

Anthropic restricted its Mythos Preview model last week after it autonomously found and exploited zero-day vulnerabilities in every major operating system and browser. Palo Alto Networks' Wendi Whitmorewarned that similar capabilities are weeks or months from proliferation. CrowdStrike's 2026 Global Threat Report puts average eCrime breakout time at 29 minutes. Mandiant's M-Trends 2026View the full article
Hacker News

New Huawei Foldable Looks a Lot Like Apple's Rumored iPhone Fold

Apple's upcoming foldable iPhone is expected to feature a book-style form factor that's relatively uncommon in the foldables market, but Huawei's new Pura X Max appears to share a similar wide aspect ratio.


Set to be released in China next week, Huawei's new device actually builds upon a design used by the original, smaller Pura X, which was marketed last year as an extra-wide flip phone. Little is known about the Pura X Max beyond its triple lens rear camera, while Huawei's imagery shows the device being used in both portrait and landscape.

Prior to the Pura X Max's unveiling, Apple's rumored device was said to most resemble Oppo's Find N5. Samsung is also believed to be adopting a similar wide aspect ratio form factor for one of its upcoming foldables.

We've heard plenty of rumors about the foldable iPhone‌'s design, but the first alleged dummy models appeared last week. The device will have a 5.5-inch display when closed, making it Apple's smallest current-generation iPhone. When open, it will be around 7.8 inches, which is around half an inch smaller than the iPad mini.

Apple is expected to debut its first foldable alongside the iPhone 18 Pro models in September, with a launch likely to shortly follow the Pro devices' release. Most rumors have suggested that the ‌foldable iPhone will start at around $2,000 and be available in traditional space gray/black and silver/white finishes.


One rumor claims that Apple will call it the "iPhone Ultra," rather than "iPhone Fold," which is the shorthand the media has largely been using.Related Roundup: iPhone FoldTags: Foldable iPhone, Huawei
This article, "New Huawei Foldable Looks a Lot Like Apple's Rumored iPhone Fold" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

Apple's AI Chief John Giannandrea Departs This Week

John Giannandrea, Apple's former head of artificial intelligence, is set to leave the company this week as his final stock vesting date approaches.


In his "Power On" newsletter, Mark Gurman noted that Giannandrea's exit has been a prolonged one. Apple moved to dramatically reduce his role in March 2025 following the disappointing launch of Apple Intelligence and ongoing delays to the Siri overhaul, stripping him of oversight of ‌Siri‌, robotics, and other AI teams at that time. The company made the departure official at the end of last year, announcing that Giannandrea would be retiring in 2026.

In the intervening months, Giannandrea has been in an advisory role, what Gurman described as "resting and vesting," meaning remaining on the payroll until stock grants vest. With Apple's next vesting date falling on April 15, Gurman says Giannandrea's final days at the company are this week. His remaining responsibilities, which covered Apple's foundation models, AI testing, and various other functions, were divided between software chief Craig Federighi, services head Eddy Cue, and operating chief Sabih Khan.

Giannandrea joined Apple from Google in 2018. Gurman says he is unlikely to join another major technology company and is instead expected to take seats on corporate boards and pursue startup advisory work.

Gurman offered a broader assessment of why Giannandrea's tenure failed to produce results, pushing back on the notion that Cook simply struggles with outside hires: "The truth is that the top of Apple is run like a small family business with few decision-makers. And if you're not in the inner circle — which is nearly impossible to crack — you're simply not empowered enough to drive real change at the company."Tags: John Giannandrea, Mark Gurman
This article, "Apple's AI Chief John Giannandrea Departs This Week" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

iPhone 18 Pro Deep Red Color Likely as Android Rivals Prep Same Shade

Apple's upcoming iPhone 18 Pro is very likely to come in a new deep red color, claims a Chinese leaker, because the color is already being prototyped by Android phone makers.


In February, Bloomberg's Mark Gurman reported that Apple is testing a deep red finish for the iPhone 18 Pro and iPhone 18 Pro Max. Rumors of purple and brown finishes have also circulated, but Gurman believes those are just variants of the same red idea.

Weibo-based leaker Digital Chat Station has now thrown their weight behind the rumor. In a post shared over the weekend, the leaker said there was a high likelihood that Apple is testing the deep red finish, based on the fact that they have seen the same color in prototypes of next-generation Android phones by rival brands.

It's unclear if the leaker is suggesting that Android makers have inside knowledge of Apple's color plans and are aiming to match it, or that the color's appearance is a sign of shared trend forecasting. Both Apple and Android OEMs likely rely on global colour forecasting agencies that track fashion trends, and if deep red is "on trend," several companies could end up adopting it independently. However, Android makers are also well known for copying Apple's design trends.

According to Instant Digital, another Weibo-based leaker, Apple's iPhone 18 Pro models won't come in black this year. If the rumor is true, it will be the second consecutive year Apple has ditched what was arguably its most classic color option for the Pro lineup. The premium devices are expected to arrive this September alongside Apple's first foldable iPhone.Related Roundup: iPhone 18 ProTags: Android, Digital Chat Station
This article, "iPhone 18 Pro Deep Red Color Likely as Android Rivals Prep Same Shade" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

Apple Testing Four Smart Glasses Styles Made of High-End Materials

Apple is developing at least four different styles of smart glasses, and the company is betting that their superior design will set them apart from rival products, according to Bloomberg's Mark Gurman.


Writing in his latest Power On newsletter, Gurman says that Apple's latest designs are made from a high-end material called acetate, which is "more durable and luxurious" than the standard plastic used by most existing brands. In Gurman's words, the designs in testing include:

A large rectangular frame, reminiscent of Ray-Ban Wayfarers
A slimmer rectangular design, similar to the glasses worn by Apple CEO Tim Cook
Larger oval or circular frames
A smaller, more refined oval or circular option
The designs will be instantly recognizable as Apple – what the company refers to internally as the "icon" – and they are set to come in "many" color options, says Gurman, with black, ocean blue, and light brown currently being explored.

The glasses will tightly integrate with the iPhone and Siri, and they will use computer vision to interpret the user's surroundings and feed contextual awareness into Apple Intelligence. Meanwhile, the the camera system currently being considered is described as "vertically oriented oval lenses with surrounding lights," which contrasts with the circular design seen in Meta's Ray-Bans.

Apple is expected to unveil smart glasses as the end of 2026 or early the following year, with the actual release occurring in 2027. The glasses are said to be part of Apple's broader AI wearables strategy that also includes new AirPods with cameras and a camera-equipped pendant.Tags: Apple Smart Glasses, Mark Gurman
This article, "Apple Testing Four Smart Glasses Styles Made of High-End Materials" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

North Korea's APT37 Uses Facebook Social Engineering to Deliver RokRAT Malware

The North Korean hacking group tracked as APT37 (aka ScarCruft) has been attributed to a fresh multi-stage, social engineering campaign in which threat actors approached targets on Facebook and added them as friends on the social media platform, turning the trust-building exercise into a delivery channel for a remote access trojan called RokRAT. "The threat actor used two FacebookView the full article
Hacker News

CISOs tackle the AI visibility gap

Dale Hoak found himself asking a question that has become familiar to CISOs through the decades: What am I missing?
More specifically, Hoak, CISO at software firm RegScale, was wondering what he might be missing around his company’s AI deployments.
“The business was moving so fast in using AI, so initially we had some visibility gaps,” he says.
Hoak believed his monitoring capabilities weren’t strong enough to identify all the risks and threats associated with the company’s newest AI uses. So he repositioned existing tools and invested in new ones, including products that use intelligence to monitor enterprise AI use, to gain the visibility he needed — a process that took about six months.
“Over time I figured out what to look for using logging and SIEM and AI tools, and I feel like we now have the gaps covered,” he notes.
Still, he remains apprehensive.
“I’m always a little wary,” he admits, about what his security operations might not see.
CISOs are right to be concerned. AI is expanding the organization’s attack surface while introducing new types of risk such as those stemming from prompt injection and data poisoning attacks. Security leaders know that. But, as Hoak points out, CISOs are also contending with AI-related security blind spots as their organizations race to implement and scale the technology.
According to the AI Security Exposure Survey 2026 Report from security software maker Pentera, 67% of CISOs report limited visibility into where and how AI is operating across their environments.
Additionally, 48% of CISOs cited limited visibility into AI usage as a top challenge in securing AI systems, making it their second biggest challenge in this space. (Lack of internal expertise, cited by 50%, came in No. 1.)
Myriad blind spots
Nitin Raina, global CISO of consultancy Thoughtworks, highlights multiple scenarios that create such visibility gaps. One is shadow AI.
“Initially about 12 to 18 months back, we saw people using [unsanctioned versions of] ChatGPT or Gemini or buying their own niche AI tool. That has slowed down, but it’s still one of the risks,” Raina says.
Another is the introduction of AI capabilities by software makers whose products are already in use at the company. “The vendors we use are adding AI capabilities and sometimes we don’t have entire visibility into that,” he says, despite his security team’s work to learn how those vendors are handling data and AI-related vulnerabilities.
The models supplied by providers also create blind spots, Raina adds, as CISOs typically can do some level of review but cannot perform deep dives into the models to determine whether there are issues that could skew outcomes to unacceptable levels or send data to places where it shouldn’t go.
Yet another, Raina says, is agentic AI, whose risks include hallucinations or prompt injections as well as failures that due to their speed and autonomous actions can be difficult to detect with conventional security tools.
Many compare the security situation around AI to the early days of cloud, when CISOs similarly experienced shadow deployments, unknown risks, and visibility challenges.
The challenges today are more significant, says Nick Kakolowski, senior research director at IANS Research. Executives are scared of falling behind in the race to use AI for competitive advantage, so they’re willing to take more risks, he says. That has led to rapid-fire AI implementations and deployments outside of normal procurement channels. As a result, “blind spots are kind of everywhere.”
CISOs also often lack full visibility into fourth-party AI systems and the risks that use entails.
Ditto for the accuracy of the outcomes that employees are getting with some AI engines. “No one understands fully how to assess the outcomes of AI and the quality of the content being created by AI,” Kakolowski says. “We’re not going to be able to evaluate the quality and trustworthiness of the outputs of AI, and we don’t know how to equip our people to do so effectively.”
Likewise for AI-generated code, which is increasingly being created outside of development teams thanks to the ease of using AI for such purposes. “They’re using vibe coding, and CISOs may not know where that AI-generated code is being integrated,” Kakolowski says.
CISOs also may not know if AI agents grant access privileges to other agents as they execute workflows, creating yet another blind spot.
And security execs may be in the dark about the ethical implications of their organization’s AI capabilities. “CISOs often get pulled into things that are on the ethical side of risk, and this issue of ethical AI is starting to emerge as one of them,” Kakolowski adds.
Another area where CISOs may not have a clear view: where their organizations draw the line on blind spots introduced by their AI strategies. “Guessing at the organization’s risk tolerance is a high-level blind spot,” Kakolowski says, noting that CISOs wanting to close visibility gaps need to start by defining “what the organization considers reasonable versus unreasonable. That helps CISOs figure out the next step.”
Gaining visibility
CISOs say they’re aware of the consequences of having blind spots, with data leaks and problematic AI outputs being common ones.
They’re now working to gain the needed visibility to prevent such issues, says Aaron Momin, CISO and chief risk officer for Synechron, a digital consulting and technology services firm.
“The business has a mandate to adopt AI, but the trouble with this is that the business has been moving at lightspeed and CISOs are just catching up,” Momin adds.
Like other security chiefs, Momin is leaning on a well-formed security strategy, security and AI frameworks, and a clear understanding of the company’s risk appetite and risk tolerance to do that work. He’s also leaning on people, process, and technology to secure his organization’s AI deployments and improve visibility.
Still, he acknowledges blind spots could remain, explaining that traditional security tools, such as URL filtering and data loss prevention (DLP) solutions, provide a layer of control but don’t deliver the comprehensive view of AI use that CISOs need.
“They’re not necessarily sufficient. They could get to maybe 80% or 90% of what you need, but to get higher visibility, you have to add additional tools,” Momin says.
That, though, presents another challenge for CISOs.
“Those tools have to be matured, have to be extended, have to be broader to get full visibility,” Momin says. “Now some vendors are upgrading the capabilities [offered in their security tools,] and new tools are coming on the market. And they’re starting to give you full visibility.”
Thoughtworks’ Raina has a similar take to improving visibility, endorsing a multiprong approach to ensure his security team has a full picture of the organization’s AI deployments, their vulnerabilities, and their risks. That approach combines administrative, governance, and technology controls — a combination that has a long history of success in security.
But experts say that tried-and-true combination is not enough to gain full visibility when it comes to AI.
According to Pentera’s survey, no CISOs reported full visibility and no shadow AI. One-third said they had good visibility with shadow AI likely, while 66% said they had limited visibility with shadow AI a known issue, and 1% said they had no visibility.
Full visibility may not be possible — at least not at present, says Jared Oluoch, professor and director of Eastern Michigan University’s School of Information Security and Applied Computing. Today’s tools and security strategies limit blind spots but do not eliminate them completely. “They can minimize the negative effects,” he adds.
That’s the goal, says Tal Hornstein, CISO of Cast & Crew, a provider of production software, payroll, and services for the entertainment industry.
Like others, Hornstein relies on longstanding security principles, citing the confidentiality, integrity, and availability (CIA) triad as the foundation for his approach to ensure that AI works within established guardrails and that he can observe its behavior.
Hornstein is also looking to emerging technologies to deliver better observability and enforcement. But he acknowledges that security tech doesn’t enable full visibility at this time. “They are not fully mature yet,” he says.
That has to be enough for now, he adds, saying CISOs can’t let visibility challenges slow down AI adoption.
“AI is the most amazing technology, and whoever doesn’t use it will be left behind,” Hornstein says. “So, it’s important for me as a CISO and as a business leader to not put up barriers and block AI but to build up guardrails that allow the organization to move at the velocity it wants and the amount it wants while providing risk mitigation.”
View the full article
CSOonline

OpenAI Revokes macOS App Certificate After Malicious Axios Supply Chain Incident

OpenAI revealed a GitHub Actions workflow used to sign its macOS apps, which downloaded the malicious Axios library on March 31, but noted that no user data or internal system was compromised. "Out of an abundance of caution, we are taking steps to protect the process that certifies our macOS applications are legitimate OpenAI apps," OpenAI said in a post last week. "We foundView the full article
Hacker News

2nd Annual Cybersecurity Startup Expo 2026

Name :2nd Annual Cybersecurity Startup Expo 2026
Website: https://www.cybersecstartups.com/
Date: October 1, 2026
Location: Hotel Birger Jarl, Stockholm, Sweden
Opening hours: 07:30 – 18:00 CET
The 2nd Annual Cybersecurity Startup Expo is a premier meeting point for the next generation of cybersecurity leaders, investors, and industry stakeholders. This one-day, high-impact conference showcases innovative cybersecurity companies—particularly startups—through dynamic presentations, live demos, practical case studies, and compelling pitch sessions.
Book Now The post 2nd Annual Cybersecurity Startup Expo 2026 appeared first on CISO MAG | Cyber Security Magazine.
View the full article
CISOmag

Was ist Federated Identity Management?

PeachShutterStock | shutterstock.com
Im Kern der Enterprise Security steht die Zerreißprobe zwischen Benutzerkomfort und Security-Anforderungen. Dabei handelt es sich um einen Balanceakt, der regelmäßig auf Authentifizierungsebene ausgetragen wird und sich direkt auf das Onboarding- und Anmeldeerlebnis auswirkt. Geht es darum diesen Konflikt aufzulösen, steht Federated Identity an vorderster Front: Sie kann eine gute User Experience bieten, ohne dabei das Sicherheitsniveau zu beeinträchtigen.
Federated Identity Management – Definition
Identity & Access Management (IAM) ist der übergeordnete Bereich, in dem es um digitale Identitäten und Zugriffsmanagement geht. Federated Identity Management (oder förderiertes Identitätsmanagement) ist eine IAM-Kategorie, die darauf fokussiert, ein einziges Authentifizierungsereignis sicher zu ermöglichen, um mehrere Interaktionen oder den Austausch von Identitätsinformationen abzudecken. Mit anderen Worten: Federated Identity Management (FIM) ermöglicht vielen Diensten, eine einzige digitale Identität gemeinsam zu nutzen. Ein Beispiel für den praktischen Einsatz von FIM wäre, wenn Sie sich bei Twitter mit ihrem Google-Konto anmelden.
Föderiertes Identitätsmanagement kann der Benutzererfahrung, der allgemeinen Sicherheit und der Ausfallsicherheit zuträglich sein. Dafür gilt es, folgende Kompromisse einzugehen:
erhöhte architektonische Komplexität,
Bindung an einen bestimmten Anbieter und
mögliche Servicekosten.
Federated Identity Management wird bisweilen mit Single Sign-On (SSO) in einen Topf geworfen. Genau genommen ist SSO allerdings eine Funktion von FIM – und einer seiner wesentlichen Use Cases, den wir im Folgenden näher betrachten. Zuvor noch ein Hinweis: Das Thema Self-Sovereign Identity (oder dezentrale Identität) ist wieder eine andere Baustelle.
Anwendungsfall (Federated) Single-Sign On
Man unterscheidet zwei Arten von Single Sign-on: Einerseits das, was für Anwendungen innerhalb einer einzelnen Organisation gilt, und andererseits das, was organisationsübergreifend gilt. Ersteres wird in der Regel einfach als Single Sign-on bezeichnet, manchmal auch als “Enterprise Single Sign-on”. Letzteres fällt unter den Begriff Federated Single Sign-on (FSSO).
Die High-Level-Architektur, um beide SSO-Formen abzudecken, sieht folgendermaßen aus:
Der Blick auf eine High-Level-SSO-Architektur.
Foto: Foundry / Matthew Tyson
In jedem Fall erfordert Federated Identity Management eine zentrale Institution, die die gemeinsamen Anmeldeinformationen zwischen den verschiedenen Diensten vermittelt. Dabei kann es sich um einen Identity Manager handeln, der:
von der Organisation selbst erstellt wurde (etwa unter Verwendung von Active Directory).
über einen Identitätsanbieter in unterschiedlichem Umfang bereitgestellt wird.
Enterprise Single Sign-on deckt oft Situationen ab, in denen sich Mitarbeiter mehrfach bei internen Systemen anmelden müssen, beispielsweise an HR-Portal und IT-Ticketsystem. Dieses Konzept birgt offensichtliche UX-, aber auch systemische Probleme, weil Identitätsinformationen über heterogene Systeme verteilt werden. Dieser Umstand beeinträchtigt die Sicherheit und erschwert es, Richtlinien durchzusetzen. So müssen etwa bei On- und Off-Boarding eines Mitarbeiters gleich zwei verschiedene Datenspeicher geändert werden.
Federated Single Sign-on ermöglicht die gemeinsame Nutzung von Anmeldeinformationen über Unternehmensgrenzen hinweg. Als solches stützt es sich in der Regel auf eine große, gut etablierte Einheit mit weitreichendem Trust – beispielsweise Google, Microsoft oder Amazon. Selbst eine kleine Applikation kann relativ einfach um die Option “Anmelden bei Google” ergänzt werden und den Nutzern eine einfache Anmeldemöglichkeit bieten, bei der sensible Informationen in den Händen der großen Organisation bleiben.
Federated SSO implementieren
Der Aufbau einer Federated SSO-Lösung richtet sich nach den jeweils spezifischen Anforderungen. Die allgemeinen Schritte sind dabei jedoch identisch:
Identity Provider einrichten: Entweder, Sie stellen eine zentralisierte Identity Infrastructure bereit oder Sie richten ein Konto bei einem Federated-Identity-Anbieter ein (Google, Microsoft, Okta). Auch eine Möglichkeit: Sie kreieren eine Mischform.
Provider mit Anwendungsinformationen füttern: So konfigurieren Sie den Identity Provider und schaffen die Grundlage, dass sich Applikationen mit dem Anbieter verbinden können.
Provider-Anmeldeinformationen hinzufügen: Diese werden Sie im nächsten Schritt verwenden, um Ihren Anwendungen mitzuteilen, wie sie sich authentifizieren sollen.
Applikationen einrichten: In Ihrem Anwendungscode fügen Sie Abhängigkeiten für die Authentifizierung und Interaktion mit dem Identity-Provider-Service hinzu.
Neue Authentifizierung integrieren: Mit dem konfigurierten SSO-Service haben Ihre Benutzer eine Möglichkeit, sich zu authentifizieren. Das funktioniert auch in “transparent”: Anwendungen erkennen und authentifizieren User mit einer Live-Session bei einem anderen Service automatisch.
Weil es eine einfache Lösung ist, entscheiden sich die meisten Unternehmen heute für einen Cloud Identity Provider im Rahmen eines SaaS-Angebots – sowohl, wenn es um Enterprise als auch wenn es um Federated SSO geht.
SSO-Protokolle implementieren
Für SSO-Interaktionen werden im Wesentlichen drei Protokolle verwendet: SAML, OIDC und OAuth 2.0. Je nachdem, welches Protokoll der von Ihnen verwendete Identity-Anbieter unterstützt, werden Sie eines davon verwenden, um die sicheren Token-Informationen zwischen Ihren Anwendungen zu übermitteln. Jedes der Protokolle stellt einen offenen Standard dar, der auf einen bestimmten Anwendungsfall ausgerichtet ist.
SAML ist ein XML-basiertes Protokoll, das häufig in Unternehmen verwendet wird, um Enterprise SSO zu unterstützen oder um zwischen verschiedenen Business-Service-Anbietern hin- und herzuspringen. Es kann auch für die allgemeine gemeinsame Nutzung von Identitäten verwendet werden, einschließlich Federated SSO (insofern der Identity Provider das unterstützt).
OAuth 2.0 ist ein Authentifizierungsprotokoll, das die gemeinsame Nutzung von Ressourcendaten zwischen Anbietern auf der Grundlage der Zustimmung des Benutzers ermöglicht. Oauth fokussiert auf die gemeinsame Nutzung der Authentifizierung zwischen Diensten ohne die Angabe von Anmeldeinformationen.
OIDC (OpenID Connect) stellt eine auf OAuth 2.0 aufbauende Schicht dar, die in der Regel für Social Logins (etwa “Sign in with GitHub”) verwendet wird. OIDC enthält einige Erweiterungen gegenüber OAuth, einschließlich Identity Assertions, Userinfo API und Standard Discovery – standardisierte Mechanismen für die sichere Bereitstellung und Nutzung von Identitätsinformationen.
Diese Protokolle kommen einzeln oder im Kombination mit anderen Technologien zum Einsatz. So können beispielsweise JSON Web Token verwendet werden, um OAuth 2.0 Credential Token-Informationen in einem sichereren Format zu kapseln.
Glücklicherweise ist der Prozess zur Implementierung dieser Protokolle umfassend dokumentiert und wird von einer Vielzahl von Technologie-Stacks unterstützt. Der größte Teil der Arbeit wird durch Abstraktionen auf höherer Ebene in vielen Sprachen und Frameworks gekapselt. Spring Security bietet beispielsweise SSO-Unterstützung, ebenso wie Passport im NodeJS/Express-Ökosystem. (fm)
View the full article
CSOonline

Amazon Has Every Model of the M5 MacBook Air at $150 Off This Weekend

Amazon this week introduced a few new record low prices on the M5 MacBook Air and they're all still available today. You'll find $150 off every model of the M5 MacBook Air on Amazon, with free delivery around April 17 for most models.

Note: MacRumors is an affiliate partner with Amazon. When you click a link and make a purchase, we may receive a small payment, which helps us keep the site running.

Amazon has the 512GB 13-inch M5 MacBook Air for $949.00, down from $1,099.00, and the 24GB/1TB model for $1,349.00, down from $1,499.00. Both of these represent new record low prices for each configuration.

$150 OFF13-inch M5 MacBook Air (512GB) for $949.00
$150 OFF13-inch M5 MacBook Air (16GB/1TB) for $1,149.00
$150 OFF13-inch M5 MacBook Air (24GB/1TB) for $1,349.00

In terms of the 15-inch models, you'll find up to $150 off the M5 MacBook Air, with multiple color options on sale for each configuration. Prices start at $1,149.00 for the 512GB model, down from $1,299.00, and also include both 1TB models on sale.

$150 OFF15-inch M5 MacBook Air (512GB) for $1,149.00
$150 OFF15-inch M5 MacBook Air (16GB/1TB) for $1,349.00
$150 OFF15-inch M5 MacBook Air (24GB/1TB) for $1,549.00

If you're on the hunt for more discounts, be sure to visit our Apple Deals roundup where we recap the best Apple-related bargains of the past week.



Deals Newsletter

Interested in hearing more about the best deals you can find in 2026? Sign up for our Deals Newsletter and we'll keep you updated so you don't miss the biggest deals of the season!




Related Roundup: Apple Deals
This article, "Amazon Has Every Model of the M5 MacBook Air at $150 Off This Weekend" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

AirPods Weekend Deals Include AirPods Pro 3 for $199.99 and AirPods Max 1 for $399.95

Amazon today has the AirPods Pro 3 available for $199.99, down from $249.00. This is a match of the all-time low price on the AirPods Pro 3, and it's accompanied by a few AirPods Max 1 and AirPods Max 2 deals we're tracking below.

Note: MacRumors is an affiliate partner with some of these vendors. When you click a link and make a purchase, we may receive a small payment, which helps us keep the site running.

This model of the AirPods Pro launched in September 2025 and has 2x better Active Noise Cancellation than the previous generation, better audio quality, a revised fit that's meant to improve comfort and stability, Live Translation for in-person conversations, and heart rate sensing for workouts.

$49 OFFAirPods Pro 3 for $199.99

If you're hunting for AirPods Max deals, the AirPods Max 2 is available for $529.99 on Amazon, a $19 discount on the brand new headphones. If you're willing to invest in an older model in order to save money, B&H Photo is hosting a flash sale today that has the AirPods Max 1 in Starlight for $399.95, down from $549.00, a match of the all-time low price on this generation.

$19 OFFAirPods Max 2 for $529.99
$150 OFFAirPods Max 1 for $399.95

Head to our full Deals Roundup to get caught up with all of the latest deals and discounts that we've been tracking over the past week.



Deals Newsletter

Interested in hearing more about the best deals you can find in 2026? Sign up for our Deals Newsletter and we'll keep you updated so you don't miss the biggest deals of the season!




Related Roundup: Apple Deals
This article, "AirPods Weekend Deals Include AirPods Pro 3 for $199.99 and AirPods Max 1 for $399.95" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

CPUID Breach Distributes STX RAT via Trojanized CPU-Z and HWMonitor Downloads

Unknown threat actors compromised CPUID ("cpuid[.]com"), a website that hosts popular hardware monitoring tools like CPU-Z, HWMonitor, HWMonitor Pro, and PerfMonitor, for less than 24 hours to serve malicious executables for the software and deploy a remote access trojan called STX RAT. The incident lasted from approximately April 9, 15:00 UTC, to about April 10, 10:00 UTC, withView the full article
Hacker News

Adobe Patches Actively Exploited Acrobat Reader Flaw CVE-2026-34621

Adobe has released emergency updates to fix a critical security flaw in Acrobat Reader that has come under active exploitation in the wild. The vulnerability, assigned the CVE identifier CVE-2026-34621, carries a CVSS score of 8.6 out of 10.0. Successful exploitation of the flaw could allow an attacker to run malicious code on affected installations. It has been described asView the full article
Hacker News

Apple Highlights Photos Shot on iPhone During NASA's Mission to Moon

As we previously reported, astronauts aboard NASA's Orion spacecraft used the iPhone 17 Pro Max to take selfies of themselves with the Earth in the background during the Artemis II mission around the far side of the Moon last week.


Now that the crew members have safely returned to Earth, Apple's CEO Tim Cook and marketing chief Greg Joswiak have both turned to social media to congratulate them on their successful mission and highlight the iPhone's involvement.

"You captured the wonders of space and our planet beautifully, taking iPhone photography to new heights, and we're grateful you shared it with the world," wrote Cook. "Your work continues to inspire us all to think different. Welcome home!"


"Honored that NASA astronauts brought iPhone to space with them," said Joswiak. "One small step for iPhone. One giant leap for space selfies."

In February, NASA announced that the iPhone had been fully qualified for extended use in orbit, with reports indicating that each of the four crew members aboard the Orion were equipped with an iPhone 17 Pro Max for personal photos and videos.

The photos show Artemis II's Commander Reid Wiseman and Mission Specialist Christina Koch looking back at Earth through one of the Orion's main cabin windows. Flickr data indicates that these photos were shot with the iPhone 17 Pro Max's front-facing camera on April 2, which was the second day of the mission.

Shot on iPhone 17 Pro Max (Wiseman)Shot on iPhone 17 Pro Max (Koch)
Most other photos from the mission shared so far were captured with other cameras, such as the Nikon D5, Nikon Z 9, and GoPro HERO4 Black.

Shot on Nikon D5Shot on Nikon D5
Artemis II was NASA's first crewed mission to the Moon since 1972. The crew reached the far side of the Moon on Monday, breaking the all-time record for the farthest distance traveled from Earth by humans. However, the Orion does not have landing capabilities, so it was a flyby mission only. The spacecraft returned to Earth on Friday.Related Roundup: iPhone 17 ProTags: Greg Joswiak, NASA, Photos, Shot on iPhone, Tim CookBuyer's Guide: iPhone 17 Pro (Neutral)Related Forum: iPhone
This article, "Apple Highlights Photos Shot on iPhone During NASA's Mission to Moon" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

Apple Stops Accepting Orders for Some Mac Mini and Mac Studio Models

As noted by 9to5Mac, some Mac mini and Mac Studio configurations are now completely out of stock on Apple's online store in the U.S. as of this writing.


Mac mini configurations with an upgraded 32GB or 64GB of RAM and Mac Studio configurations with an upgraded 128GB or 256GB of RAM are listed as "currently unavailable" on the storefront, meaning they can no longer be ordered at all.

Other configurations that remain available continue to face lengthy shipping delays, with estimated delivery timeframes ranging from one to three months.

Last month, Apple entirely removed the Mac Studio's 512GB of RAM option.

While the shipping delays have prompted speculation that Apple may be preparing to update the Mac mini and Mac Studio with M5 chips, the delays are likely the result of a severe global memory chip shortage driven by surging demand from companies building AI servers that require large amounts of RAM. After all, the Mac mini and Mac Studio models that are "currently unavailable" are those configured with higher amounts of RAM.

In addition, the current delivery timeframes are extraordinarily long, which makes it harder to determine if this is the usual sign of an upcoming refresh.

Memory chip prices are reportedly starting to stabilize or slightly decrease, but prices still remain well above historical averages, so Mac mini and Mac Studio shipping estimates might not meaningfully improve any time soon.

It is still possible that the Mac mini and Mac Studio will be updated soon, even if it is purely coincidental. However, our best guess is that Apple will announce Mac Studio models with M5 Max and M5 Ultra chips at WWDC in June and update the Mac mini with M5 and M5 Pro chips at some point in September or October this year.Related Roundups: Mac Studio, Mac miniBuyer's Guide: Mac Studio (Caution), Mac Mini (Caution)Related Forums: Mac Studio, Mac mini
This article, "Apple Stops Accepting Orders for Some Mac Mini and Mac Studio Models" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

Citizen Lab: Law Enforcement Used Webloc to Track 500 Million Devices via Ad Data

Hungarian domestic intelligence, the national police in El Salvador, and several U.S. law enforcement and police departments have been attributed to the use of an advertising-based global geolocation surveillance system called Webloc. The tool was developed by Israeli company Cobwebs Technologies and is now sold by its successor Penlink after the two firms merged in July 2023View the full article
Hacker News

The Latest Foldable iPhone Rumors: What's Changed and What We Know Now

Rumors about Apple's first foldable iPhone are picking up now that the device has entered a new testing stage that precedes mass production. If you've been having trouble keeping up with what's new, we've recapped the latest iPhone Fold rumors that have come out over the last few weeks.


Naming

One rumor claims Apple will call its foldable iPhone the "iPhone Ultra," which doesn't seem out of the question. We've been referring to it as the ‌iPhone Fold‌ during the rumor cycle, but it's unlikely Apple will actually use that name.

Samsung already has the Galaxy Fold, and that would be too similar for Apple's tastes. Apple already uses the Ultra naming for the Apple Watch and for the version of CarPlay that more deeply integrates with in-car systems.

Given the $2,000+ pricing of the foldable iPhone, "Ultra" could make sense.
Design

We've heard plenty of rumors about the ‌iPhone Fold‌'s design, but the first alleged dummy models came out this week. We don't know if these are reflective of the ‌iPhone Fold‌'s actual design, but it has all of the design features that have been rumored, and the right sizing.



The foldable iPhone will have a ~5.5-inch display when closed, making it Apple's smallest current-generation iPhone. When open, it will be around 7.8 inches, so about a half-inch smaller than the iPad mini. It will have a wider 4:3 aspect ratio like an iPad, which is a design that will set it apart from other foldable smartphones on the market. Most foldable smartphones are taller, but Apple is going in a different direction.

There is a raised camera bump that does not span across the entire back of the device, which is expected. It has a two-lens camera system, and a thin chassis. Rumors suggest the ‌iPhone Fold‌ will be as thin as 4.5mm when open, which limits space for the camera. It's so thin that Apple won't be able to use the TrueDepth camera system, and it's going to have Touch ID instead of Face ID.

Release Timing

We've heard a lot of back and forth rumors on release timing over the last two weeks. Some rumors have suggested the ‌iPhone Fold‌ will be delayed past September because of late stage production issues, while others suggest it's on time for a September launch.

In March, a Barclays analyst suggested the ‌iPhone Fold‌ could be introduced in September alongside the iPhone 18 Pro, but launch later, perhaps as late as December.

Japanese site Nikkei said this week that Apple is running into so many issues that the ‌iPhone Fold‌ might be pushed until 2027, but Bloomberg's Mark Gurman said the report is "off base." Gurman believes the ‌iPhone Fold‌ will be available for sale "around the same time" or "soon after" the ‌iPhone 18 Pro‌ models.

If the ‌iPhone Fold‌ does launch in September alongside the ‌iPhone 18 Pro‌ models, it's likely it will be in short supply. Reports agree that the device is complex and manufacturing isn't smooth sailing. In December, Apple analyst Ming-Chi Kuo said production challenges could cause supply shortages into 2027.

Pricing

Apple's foldable iPhone will "cross the $2,000 threshold," according to Gurman. It is not clear if $2,000 will be the starting price point, or if it will come with a lower price tag but have some higher-end configurations that exceed $2,000.

Most rumors have suggested that the ‌iPhone Fold‌ will start around $2,000, though there have been outliers that put the starting price upwards of $2,300.

Read More

There are plenty of other rumors about the foldable iPhone, including details about Apple's work on the hinge, the materials it'll be made of, what camera technology it will use, and more. We have a full iPhone Fold roundup with all of the rumors we've heard so far.Tag: Foldable iPhone
This article, "The Latest Foldable iPhone Rumors: What's Changed and What We Know Now" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

Halfbrick Launches Free 'Jetpack Joyride Racing' Game With Multiplayer Support For Up to Six Players

Mobile game developer Halfbrick today launched a new iOS game in its popular Jetpack Joyride series. Jetpack Joyride Racing is a multiplayer racing game that supports up to six players for real-time racing competitions.


Players can take on the role of Barry Steakfries, Dan, Josie, Professor Brains, Robo Barry, and more, with four circuits and a zone system that changes gameplay on the fly. Purple zones slow you down, red zones cut your engine, and green zones speed you up.

Races feature items to collect for boosts, drift mechanics, and different tactical designs to master in each level. In addition to the competitive racing mode with support for Discord voice chat, players can also team up with friends for collaborative gameplay in Party Mode. The game has easy-to-learn controls, but it will take some time to master drifting and boosting to win.

Players can collect in-game cards for rewards, and the cards are part of the Halfbrick+ collectible card system. Cards unlock ships, characters, and cosmetic items, and will eventually integrate with other Halfbrick+ games similar to Nintendo's Amiibo. With Season Pass rewards, players can make their way through a progression system laden with prizes.

Jetpack Joyride Racing is free to download and play, with no ads included. The optional Halfbrick+ subscription provides access to other Halfbrick games like Fruit Ninja, plus it includes exclusive rewards, premium cosmetics, faster progression, and subscriber-only content. Halfbrick+ starts at $2.99 per month, but there is no need to subscribe to play Jetpack Joyride Racing.

Jetpack Joyride Racing can be downloaded from the App Store for free. [Direct Link]Tag: Halfbrick
This article, "Halfbrick Launches Free 'Jetpack Joyride Racing' Game With Multiplayer Support For Up to Six Players" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

MacRumors Giveaway: Win an iPhone 17 and Astropad Fresh Coat Anti-Reflective Screen Protector

For this week's giveaway, we've teamed up with Astropad to offer MacRumors readers a chance to win one of Apple's iPhone 17 models and a Fresh Coat anti-reflective screen protector from Astropad to use with it.


Fresh Coat is a screen protector with an optical-grade anti-reflective coating to minimize glare and provide a better iPhone viewing experience. The technology reduces reflections by 75 percent, while improving contrast and keeping colors vibrant. Unlike other anti-reflective screen protectors on the market, Fresh Coat adds no haze or distortion to the iPhone's display.


Priced at $30, Fresh Coat is made from a scratch-proof tempered glass that provides protection for the iPhone's display in addition to cutting down on glare and reflections. It's slim and doesn't add bulk to the iPhone even though there are five layers of protective technology at work. From the top down, there's an anti-reflective coating, an oleophobic and hydrophobic coating, a layer of tempered glass, a dust barrier, and an impact-resistant "airbag" bonding.


If you have an ‌iPhone 17‌, it already has an anti-reflective coating from Apple. What you probably don't know is that you can't use just any screen protector with the ‌iPhone 17‌. If you put a regular screen protector without an anti-reflective coating on, it nullifies the anti-reflective properties of that added coating.


Since Fresh Coat has its own anti-reflective coating, it improves on Apple's included anti-reflective layer, cutting glare even further. With Fresh Coat, the iPhone's screen is easy to see in any lighting conditions, there's less eye strain, and if you use Dark Mode, it looks even darker.


If you don't have an ‌iPhone 17‌, Fresh Coat can provide an iPhone 17-style display upgrade, mirroring Apple's own reflection-reducing display coating. Fresh Coat is available for all ‌iPhone 17‌ models, the iPhone 16 Pro and Pro Max, and the iPhone 15 Pro and Pro Max.


Astropad designed an installation process that's impossible to mess up, so you get perfect alignment on your iPhone without the hassle that comes with most screen protectors.

We have an ‌iPhone 17‌ and a Fresh Coat screen protector for one lucky MacRumors reader. To enter to win, use the widget below and enter an email address. Email addresses will be used solely for contact purposes to reach the winner(s) and send the prize(s). You can earn additional entries by subscribing to our weekly newsletter, subscribing to our YouTube channel, following us on Twitter, following us on Instagram, following us on Threads, or visiting the MacRumors Facebook page.

Due to the complexities of international laws regarding giveaways, only U.S. residents who are 18 years or older, UK residents who are 18 years or older, and Canadian residents who have reached the age of majority in their province or territory are eligible to enter. All federal, state, provincial, and/or local taxes, fees, and surcharges are the sole responsibility of the prize winner. To offer feedback or get more information on the giveaway restrictions, please refer to our Site Feedback section, as that is where discussion of the rules will be redirected.


Astropad GiveawayThe contest will run from today (April 10) at 9:00 a.m. Pacific Time through 9:00 a.m. Pacific Time on April 17. The winner will be chosen randomly on or shortly after April 17 and will be contacted by email. The winner will have 48 hours to respond and provide a shipping address before a new winner is chosen.Related Roundup: iPhone 17Tag: GiveawayBuyer's Guide: iPhone 17 (Neutral)Related Forum: iPhone
This article, "MacRumors Giveaway: Win an iPhone 17 and Astropad Fresh Coat Anti-Reflective Screen Protector" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

The MacRumors Show: Apple's Foldable iPhone 'Ultra'

On this week's episode of The MacRumors Show, we discuss all of the rumors surrounding Apple's upcoming foldable iPhone, now said to be called the "iPhone Ultra," which is shaping up to be a comprehensive redesign unlike anything the company has shipped before.

Subscribe to The MacRumors Show YouTube channel for more videos
The ‌iPhone Ultra‌ is expected to launch alongside the iPhone 18 Pro and ‌iPhone 18 Pro‌ Max this fall, though reports suggest it will ship after the Pro models, potentially as late as December. Pricing is expected to start at over $2,000, making it the most expensive iPhone Apple has ever sold.

The device will have a book-style, passport-shaped design with a 4:3 aspect ratio, wider than it is tall and unlike any foldable currently on the market. When closed, it will have a 5.5-inch outer display; when open, a 7.8-inch inner OLED panel takes over, making it just slightly smaller than the 8.3-inch iPad mini. According to design leaks from Instant Digital, the device will measure just 4.5mm thick when unfolded, which would make it Apple's thinnest iPhone to date. The outer frame is said to be made of titanium for durability at that thinness, while the inner frame uses aluminum. The back features a glass finish with a shorter, iPhone Air-style camera plateau housing two horizontally arranged rear cameras.

The same leak revealed that volume buttons are relocated to the top edge of the device, aligned to the right. The inner display features a single punch-hole cutout resulting in a smaller Dynamic Island, while a Touch ID power button and Camera Control remain on the right edge. Reports indicate the ‌iPhone Ultra‌ will support iPad-style multitasking and layouts for running apps side by side when unfolded, befitting its iPad mini-sized inner display. Bloomberg's Mark Gurman has described it as the "most significant overhaul in the iPhone's history."

Achieving that ultra-thin form factor comes with tradeoffs, and the ‌iPhone Ultra‌ will be missing several features that iPhone users have come to expect, in some ways echoing the compromises Apple made with the iPhone Air. The ‌iPhone Air‌ went without stereo speakers, a SIM card slot, and multiple rear cameras to achieve its 5.6mm frame; the ‌iPhone Ultra‌ faces similar constraints at an even more demanding 4.5mm. The ultra-thin chassis leaves no room for a triple-lens camera setup, so the telephoto lens found on iPhone Pro models is absent, leaving just a dual 48-megapixel rear system. More significantly, there is no space for the TrueDepth sensor array required for Face ID, meaning the ‌iPhone Ultra‌ will rely on a side-button ‌Touch ID‌ module instead.

Under the hood, the ‌iPhone Ultra‌ is expected to feature Apple's A20 chip paired with 12GB of RAM. Storage options are said to include 256GB, 512GB, and 1TB, while color options could simply be black and white. Battery capacity is reportedly in the 5,400mAh to 5,800mAh range, which would put it among the largest ever in an iPhone despite its slim dimensions.

The scale of Apple's production ambitions for the ‌iPhone Ultra‌ has already been tempered by manufacturing realities. Kuo initially indicated Apple placed orders for 15 to 20 million total foldable iPhones, though he noted demand would likely be limited due to the device's cost. By December, Kuo warned that early-stage yield and ramp-up challenges could mean smooth shipments may not occur until 2027, with potential shortages lasting through at least the end of 2026.

The high asking price is expected to be a further constraint on volume: IDC projects the device will capture over 22% unit share of the foldables market in its first year, but that market remains a niche segment overall. The ‌iPhone Air‌'s underwhelming sales performance, with Kuo reporting suppliers cut production capacity by more than 80% after demand fell short of expectations, may serve as a cautionary tale for premium iPhone form-factor experiments.

The MacRumors Show has its own YouTube channel, so make sure you're subscribed to keep up with new episodes and clips.

Subscribe to The MacRumors Show YouTube channel!

You can also listen to ‌The MacRumors Show‌ on Apple Podcasts, Spotify, Overcast, or other podcast apps. You can also copy our RSS feed directly into your player.



If you haven't already listened to the previous episode of The MacRumors Show, catch up to hear our discussion about everything the ‌iPhone 18 Pro‌ will feature, according to the latest rumors.

Subscribe to ‌The MacRumors Show‌ for new episodes every week, where we discuss some of the topical news breaking here on MacRumors, often joined by interesting guests such as Kayci Lacob, Kevin Nether, John Gruber, Mark Gurman, Jon Prosser, Luke Miani, Matthew Cassinelli, Brian Tong, Quinn Nelson, Jared Nelson, Eli Hodapp, Mike Bell, Sara Dietschy, iJustine, Jon Rettinger, Andru Edwards, Arnold Kim, Ben Sullins, Marcus Kane, Christopher Lawley, Frank McShan, David Lewis, Tyler Stalman, Sam Kohl, Federico Viticci, Thomas Frank, Jonathan Morrison, Ross Young, Ian Zelbo, and Rene Ritchie.

‌The MacRumors Show‌ is on X @MacRumorsShow, so be sure to give us a follow to keep up with the podcast. You can also email us at [email protected] or head over to The MacRumors Show forum thread. Remember to rate and review the podcast, and let us know what subjects and guests you would like to see in the future.Tags: Foldable iPhone, The MacRumors Show
This article, "The MacRumors Show: Apple's Foldable iPhone 'Ultra'" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

Top Stories: iPhone Rumors, Apple's MacBook Neo Dilemma, and More

Rumors continue to fly about Apple's next flagship iPhone updates coming later this year, while it appears that the popularity of Apple's new MacBook Neo might actually be putting the company into a bit of a dilemma.


This week also saw the release of iOS and macOS 26.4.1, plus several popular apps launched new versions for CarPlay, so read on below for all the details on these stories and more!

Top Stories

iPhone 18 Pro Launching Later This Year With These 12 New Features

While the iPhone 18 Pro and iPhone 18 Pro Max are not expected to launch for another five months, there are already plenty of rumors about the devices, so be sure to check out our updated recap outlining everything we've heard.


It was initially reported that the iPhone 18 Pro models would have fully under-screen Face ID, with only a front camera visible in the top-left corner of the screen. However, the latest rumors indicate that only one Face ID component will be moved under the screen on the devices, which will result in merely a smaller Dynamic Island.

Apple is Reportedly Facing a 'Massive Dilemma' With the MacBook Neo

The all-new MacBook Neo has been such a hit that Apple is facing a "massive dilemma," according to Taiwan-based tech columnist and former Bloomberg reporter Tim Culpan.


The A18 Pro chip in the MacBook Neo has a 5-core GPU and is a "binned" version of the A18 Pro with 6-core GPU used in the iPhone 16 Pro. Chips discovered to have a faulty GPU core in the manufacturing process would normally be discarded, but with binning Apple is able to use some of these chips in other devices like the MacBook Neo. But with the MacBook Neo proving so popular, Apple is quickly running out of A18 Pro chips with the 5-core GPU.

In order to meet demand, Apple may be faced with having to intentionally disable a core on fully functional A18 Pro chips to maintain specs on the machine, impacting profit margins.

The company is likely already stockpiling binned A19 Pro chips from this year's Pro iPhone models to use in an updated MacBook Neo due next year. The iPhone Air already uses binned A19 Pro chips with a 5-core GPU, but it has not been selling well and thus there may still be significant numbers of those chips available for next year's MacBook Neo.

New Apple TV Waiting for Siri: Here's What's Coming When It Launches

We're long overdue for an Apple TV update, and there have been rumors about an imminent refresh since late last year. It's now sounding like we're not going to get a new version for several months because of Siri delays.


If you're holding out for a new model, we've put together a recap of what to expect when it eventually comes out so you can decide whether to continue to wait, or buy now.

Apple CarPlay Just Got Three Popular iPhone Apps

Apple's CarPlay system for accessing iPhone apps on a vehicle's dashboard screen received three popular apps last week: ChatGPT, Google Meet, and Audiomack.

CarPlay Ultra in an Aston Martin
In addition, WhatsApp released a revamped CarPlay app that improves upon the basic Siri-based functionality that was previously available, offering full access to recent chats and call history, favorite contacts, and more.

iOS 26.4.1 Includes These Two Changes for iPhones

After we spotted signs of it in our site analytics earlier this week, Apple released iOS and iPadOS 26.4.1 on Wednesday. The update includes a fix for an iOS 26.4 bug affecting iCloud syncing, and it also turns on Stolen Device Protection by default for additional users.


Apple followed that up with a macOS 26.4.1 update on Thursday that includes a fix for a Wi-Fi issue on the new M5 MacBook Air and M5 Pro and M5 Max MacBook Pro models.

Leaker: Foldable iPhone Won't Be Called iPhone Fold, But 'iPhone Ultra'

The Apple rumor mill has been calling Apple's upcoming foldable iPhone the iPhone Fold, but one prominent leaker claims it will arrive under an "iPhone Ultra" name.


This week also saw our first look at high-quality dummy units of the iPhone Fold or Ultra amid mixed rumors on when the device might actually become available. The latest word from Bloomberg's Mark Gurman is that it should launch alongside or shortly after the iPhone 18 Pro models, although supplies may be tight at first as Apple works out production issues.

Expect pricing to come in at around $2,000 or even higher depending on storage capacity.

MacRumors Newsletter

Each week, we publish an email newsletter like this highlighting the top Apple stories, making it a great way to get a bite-sized recap of the week hitting all of the major topics we've covered and tying together related stories for a big-picture view.

So if you want to have top stories like the above recap delivered to your email inbox each week, subscribe to our newsletter!Tag: Top Stories
This article, "Top Stories: iPhone Rumors, Apple's MacBook Neo Dilemma, and More" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

Best Apple Deals of the Week: M5 MacBook Air Hits New Record Low Prices at $150 Off, Plus MacBook Pro Deals

This week we began tracking one of the best deals of the year so far, with $150 off nearly every model of Apple's new M5 MacBook Air. You'll find these sales below, plus great discounts on the 2026 MacBook Pro, AirPods Max 2, Apple Watch Ultra 3, and a few Samsung markdowns to celebrate the launch of the new Frame Pro.

Note: MacRumors is an affiliate partner with some of these vendors. When you click a link and make a purchase, we may receive a small payment, which helps us keep the site running.

M5 MacBook Air


What's the deal? Take $150 off M5 MacBook Air
Where can I get it? Amazon
Where can I find the original deal? Right here
$150 OFF13-inch M5 MacBook Air (512GB) for $949.00
$150 OFF15-inch M5 MacBook Air (512GB) for $1,149.00

Amazon has a few record low prices on the new M5 MacBook Air this week, with $150 off nearly every model of the brand new notebook. Prices start at $949.00 for the 512GB 13-inch M5 MacBook Air, down from $1,099.00.

M5 Pro/M5 Max MacBook Pro


What's the deal? Take up to $199 off M5 Pro/M5 Max MacBook Pro
Where can I get it? Amazon
Where can I find the original deal? Right here
$149 OFF14-inch M5 Pro MacBook Pro (24GB/1TB) for $2,049.99
$149 OFF16-inch M5 Pro MacBook Pro (24GB/1TB) for $2,549.99

In addition to the M5 MacBook Air deals, Amazon this week introduced record low prices on Apple's M5 Pro/M5 Max MacBook Pro. You can get up to $199 off select models without the need of a membership or clipping a coupon, with prices starting at $2,049.99 for the 14-inch model.

AirPods Max 2


What's the deal? Take $19 off AirPods Max 2
Where can I get it? Amazon
Where can I find the original deal? Right here
$19 OFFAirPods Max 2 for $529.99

Apple's new AirPods Max 2 launched last week, and Amazon is one of the only retailers offering a discount on the headphones. You can get the Midnight and Starlight color options for $529.99 on Amazon, down from $549.00.

Apple Watch Ultra 3


What's the deal? Take $99 off Apple Watch Ultra 3
Where can I get it? Amazon
Where can I find the original deal? Right here
$99 OFFApple Watch Ultra 3 for $699.99

Amazon this week brought back deals on the Apple Watch Ultra 3, providing $99 discounts on select models. It's been months since we last tracked any discounts on the Ultra 3, and these are solid second-best prices on the 2025 smartwatch.

Samsung


What's the deal? Save on Samsung's new The Frame Pro TV and more
Where can I get it? Samsung
Where can I find the original deal? Right here
UP TO $850 SAVINGSThe Frame Pro 'Picture Perfect Bundle'

Samsung this week announced its newest lineup of The Frame TVs with the 2026 The Frame and The Frame Pro, and you can get a bundle deal of up to $850 in savings when purchasing the new models.

If you're on the hunt for more discounts, be sure to visit our Apple Deals roundup where we recap the best Apple-related bargains of the past week.



Deals Newsletter

Interested in hearing more about the best deals you can find in 2026? Sign up for our Deals Newsletter and we'll keep you updated so you don't miss the biggest deals of the season!




Related Roundup: Apple Deals
This article, "Best Apple Deals of the Week: M5 MacBook Air Hits New Record Low Prices at $150 Off, Plus MacBook Pro Deals" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

Best Apple Deals of the Week: M5 MacBook Air Hits New Record Low Prices at $150 Off, Plus MacBook Pro Deals

This week we began tracking one of the best deals of the year so far, with $150 off nearly every model of Apple's new M5 MacBook Air. You'll find these sales below, plus great discounts on the 2026 MacBook Pro, AirPods Max 2, Apple Watch Ultra 3, and a few Samsung markdowns to celebrate the launch of the new Frame Pro.

Note: MacRumors is an affiliate partner with some of these vendors. When you click a link and make a purchase, we may receive a small payment, which helps us keep the site running.

M5 MacBook Air


What's the deal? Take $150 off M5 MacBook Air
Where can I get it? Amazon
Where can I find the original deal? Right here
$150 OFF13-inch M5 MacBook Air (512GB) for $949.00
$150 OFF15-inch M5 MacBook Air (512GB) for $1,149.00

Amazon has a few record low prices on the new M5 MacBook Air this week, with $150 off nearly every model of the brand new notebook. Prices start at $949.00 for the 512GB 13-inch M5 MacBook Air, down from $1,099.00.

M5 Pro/M5 Max MacBook Pro


What's the deal? Take up to $199 off M5 Pro/M5 Max MacBook Pro
Where can I get it? Amazon
Where can I find the original deal? Right here
$149 OFF14-inch M5 Pro MacBook Pro (24GB/1TB) for $2,049.99
$149 OFF16-inch M5 Pro MacBook Pro (24GB/1TB) for $2,549.99

In addition to the M5 MacBook Air deals, Amazon this week introduced record low prices on Apple's M5 Pro/M5 Max MacBook Pro. You can get up to $199 off select models without the need of a membership or clipping a coupon, with prices starting at $2,049.99 for the 14-inch model.

AirPods Max 2


What's the deal? Take $19 off AirPods Max 2
Where can I get it? Amazon
Where can I find the original deal? Right here
$19 OFFAirPods Max 2 for $529.99

Apple's new AirPods Max 2 launched last week, and Amazon is one of the only retailers offering a discount on the headphones. You can get the Midnight and Starlight color options for $529.99 on Amazon, down from $549.00.

Apple Watch Ultra 3


What's the deal? Take $99 off Apple Watch Ultra 3
Where can I get it? Amazon
Where can I find the original deal? Right here
$99 OFFApple Watch Ultra 3 for $699.99

Amazon this week brought back deals on the Apple Watch Ultra 3, providing $99 discounts on select models. It's been months since we last tracked any discounts on the Ultra 3, and these are solid second-best prices on the 2025 smartwatch.

Samsung


What's the deal? Save on Samsung's new The Frame Pro TV and more
Where can I get it? Samsung
Where can I find the original deal? Right here
UP TO $850 SAVINGSThe Frame Pro 'Picture Perfect Bundle'

Samsung this week announced its newest lineup of The Frame TVs with the 2026 The Frame and The Frame Pro, and you can get a bundle deal of up to $850 in savings when purchasing the new models.

If you're on the hunt for more discounts, be sure to visit our Apple Deals roundup where we recap the best Apple-related bargains of the past week.



Deals Newsletter

Interested in hearing more about the best deals you can find in 2026? Sign up for our Deals Newsletter and we'll keep you updated so you don't miss the biggest deals of the season!




Related Roundup: Apple Deals
This article, "Best Apple Deals of the Week: M5 MacBook Air Hits New Record Low Prices at $150 Off, Plus MacBook Pro Deals" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

GlassWorm Campaign Uses Zig Dropper to Infect Multiple Developer IDEs

Cybersecurity researchers have flagged yet another evolution of the ongoing GlassWorm campaign, which employs a new Zig dropper that's designed to stealthily infect all integrated development environments (IDEs) on a developer's machine. The technique has been discovered in an Open VSX extension named "specstudio.code-wakatime-activity-tracker," which masquerades as WakaTime, aView the full article
Hacker News

Hungarian government email passwords exposed ahead of election

When voters in the forthcoming Hungarian election assess the current government, its record on internet security will not be one of its proudest achievements.
An analysis by open source investigation organization Bellingcat has revealed that the passwords for almost 800 Hungarian government email accounts are circulating online, many of them associated with national security. These breaches in security are not down to high-tech attacks but rather are the result of poor email hygiene among government employees. The security leaks were widespread: 12 out of 13 government departments were affected.
Hungarian Prime Minister Viktor Orban’s administration likes to present itself as firm protector of Hungarian borders, resisting foreign interference, but this doesn’t seem to apply to its computing prowess. Among those whose details were revealed were an officer responsible for information security and a counter-terrorism expert.
Bellingcat found that government officials have been using weak passwords such as variations of the word “Password” or the number sequence “1234567, while another simply used his surname.
The Hungarian government is not alone in its laxity.  Earlier this year, Specops found that 6 billion logins had been exposed online and found that number sequences and ‘password’ featured highly in the list of the most compromised logins.
The vulnerabilities inherent in the Hungarian example are a warning to all CSOs that they should be reminding their staff to tighten their security credentials. Many choose simple, short memorable passwords because they’re easy to remember but using a password manager or deploying passkeys will immediately strengthen employees’ ability to protect data.
View the full article
CSOonline

Gmail End-to-End Encryption Comes to iOS for Workspace Users

Google has expanded Gmail's end-to-end encryption for Workspace users to iOS and Android, allowing mobile users to compose and read encrypted messages natively within the Gmail app for the first time.


The feature is part of Gmail's client-side encryption (CSE) offering, which until now was limited to desktop. According to Google's Workspace update, users no longer need to download additional apps or use separate mail portals to handle encrypted email on mobile, and the experience is now built directly into the existing Gmail app on both platforms.

Google says encrypted messages can be sent to any recipient regardless of their email provider. If the recipient uses Gmail, the message arrives as a standard email thread. If they use a different provider, they can read and reply via a secure browser interface without needing to install anything.

The feature is available now for both Rapid Release and Scheduled Release domains. Access requires an Enterprise Plus plan with either the Assured Controls or Assured Controls Plus add-on, which is Google's compliance-oriented tier aimed at enterprise and public sector customers. Admins must first enable Android and iOS clients through the CSE admin interface in the Admin Console before users can access the feature.

To encrypt an individual message, users tap the lock icon within a compose window and select "additional encryption" before writing.Tag: Gmail
This article, "Gmail End-to-End Encryption Comes to iOS for Workspace Users" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

Claude uncovers a 13‑year‑old ActiveMQ RCE bug within minutes

Anthropic’s Claude dug up a critical remote code execution (RCE) bug that sat quietly inside Apache ActiveMQ Classic for over a decade.
Researchers at Horizon3.ai say that it only took minutes for their team to work out an exploit chain for the bug with the help of AI. The researcher behind the work, Naveen Sunkavally, described the process as “80% Claude with 20% gift-wrapping by a human.”
The bug, now fixed, could allow an attacker to use ActiveMQ’s Jolokia API to make the server load a malicious configuration file from the internet and execute arbitrary system commands. The issue stems from the integration of multiple components developed independently over time. While each worked efficiently in isolation, together they allowed execution of remote code, a context Sunkavally noted was easier for Claude to spot.
“Something that would have probably taken me a week manually took Claude 10 minutes,” the researcher said in a blog post.
Management API flaw allowed full RCE
The attack chain revolves around ActiveMQ’s management plane. ActiveMQ exposes the Jolokia API at “/api/jolokia/”, allowing authenticated users to invoke broker operations over HTTP. In vulnerable versions, attackers can abuse methods like “addNetworkConnector” to pass a crafted URL that allows the broker to load external configuration data.
By embedding a malicious “brokerConfig” parameter, the attacker forces ActiveMQ to fetch and process a remote Spring XML file. When the file loads, it can create and run any Java code, granting the attacker remote execution inside the broker.
The flaw is tracked as CVE-2026-34197 and carries a high severity rating (CVSS 8.8). It affects ActiveMQ Classic versions prior to 5.19.4 and several 6.x releases.
While, by definition, the exploit requires authentication, Sunkavally pointed out that default credentials like “admin:admin” are still widely deployed in real environments. Worse, in certain ActiveMQ 6.x versions, a separate flaw (CVE-2024-32114) can expose the Jolokia API without any authentication.

“In those versions, CVE-2026-34197 is effectively an unauthenticated RCE,” he said.
AI accelerated discovery
ActiveMQ has been here before. The platform has a track record of high-impact vulnerabilities tied to management surfaces and unsafe assumptions around trusted inputs. From older web console flaws to deserialization bugs and protocol-level RCEs, administrative functionalities have consistently become attack vectors.
But none of the previous flaws were found the way CVE-2026-34197 was. The bug sat there for 13 years, with the first rollout of the affected implementation dating back to around 2012, before Claude could map out a multi-step exploit chain.
The discovery is already teasing the much-buzzed successor to Claude’s flaw-catching capabilities, Claude Mythos. A vulnerability scanner and exploit generator so dangerous in the wrong hands that it has been restricted under early preview to a handful of companies, with big names of the AI and cybersecurity community coming together under “Project Glasswing” to encourage its controlled usage.
CVE-2026-34197 has been addressed in newer ActiveMQ Classic releases (6.2.3 and 5.19.4), and users must upgrade to patched versions to be protected.
View the full article
CSOonline

Apple Car Key Support Coming to Lexus Vehicles

Evidence suggests Apple is preparing to bring Car Key support to Lexus vehicles, MacRumors has discovered.


Code references to Lexus were found in Apple's backend code, indicating the Toyota-owned luxury brand is being added to Apple's Car Key backend. The discovery mirrors how Toyota's own Car Key support was first uncovered, before the feature went live for the 2026 RAV4 in February. It is unclear when the feature will roll out to customers.

Lexus already offers its own app-based Digital Key system, but unlike Apple Car Key, it requires an active connection to Toyota's servers to function and has not historically worked via Apple Wallet. Apple Car Key stores a digital key directly in the Wallet app and uses NFC for unlocking, with an Express Mode that allows access without authentication. On compatible devices, it continues to work for up to five hours after a phone's battery has died.

Toyota confirmed to Carscoops in February that the 2026 Lexus ES will be the first Lexus model to receive the enhanced Digital Key functionality as part of a new-generation infotainment system, with the vehicle expected later this year. It is likely that the code references relate to that upcoming rollout.

Car Key support has been expanding steadily across the industry. Vehicles from BMW, Genesis, Kia, Hyundai, Lotus, Mercedes, Volvo, and more already offer the feature, and a full list is available on MacRumors.Tags: iPhone Car Keys, Lexus
This article, "Apple Car Key Support Coming to Lexus Vehicles" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

Browser Extensions Are the New AI Consumption Channel That No One Is Talking About

While much of the discussion on AI security centers around protecting ‘shadow’ AI and GenAI consumption, there's a wide-open window nobody's guarding: AI browser extensions.  A new report from LayerX exposes just how deep this blind spot goes, and why AI extensions may be the most dangerous AI threat surface in your network that isn't on anyone's View the full article
Hacker News

Why most zero-trust architectures fail at the traffic layer

Zero trust has become one of the most widely adopted security models in enterprise environments. Organizations invest heavily in identity systems, access policies, and modern security tooling. On paper, these environments look well-protected.
Yet during incidents, a different reality often emerges.
I have worked with organizations where zero-trust initiatives were fully implemented from an identity and policy standpoint. Access controls were defined. Authentication flows were strong. Compliance requirements were met. But when something went wrong, the same question kept coming up.
How did the traffic get through in the first place?
The answer is often uncomfortable. The strategy was sound, but enforcement at the traffic layer was inconsistent. That is where most zero-trust architectures fail.
Where zero trust breaks down in practice
Zero trust is built on a simple idea: never trust, always verify. In practice, most implementations focus heavily on identity. Users authenticate. Devices are validated. Policies determine access.
What is often overlooked is how traffic enters and moves through the environment before those controls are applied.
The traffic layer includes ingress paths, load balancers, API gateways, TLS enforcement, request validation, and service-to-service communication. This is where trust is either established or assumed.
In several environments I have worked in, these gaps were not due to a lack of tools. They came from inconsistent ownership between networking, security, and application teams.
One of the most common patterns is strong identity enforcement combined with permissive entry points. Organizations deploy modern identity providers and multi-factor authentication, yet still allow outdated TLS versions or weak cipher configurations at the edge. Guidance from the National Institute of Standards and Technology recommends secure protocol baselines.
Another recurring issue is fragmented ingress. Applications are exposed through different paths such as CDNs, direct load balancers, legacy endpoints, or newly deployed APIs. Each path behaves slightly differently.
Mutual TLS is also frequently implemented only partially. Connections are terminated and re-established internally with weaker assumptions.
East-west traffic introduces another gap. Once inside, traffic is often treated as safe.
Finally, there is the issue of visibility. During incident response, teams often cannot answer which path a request took.
Many of these issues align with patterns described by OWASP.
Why the traffic layer is the real enforcement point
Security programs often succeed at defining policies. They struggle with enforcing them consistently.
The traffic layer is where enforcement becomes real.
From a leadership perspective, this is not a tooling problem. It is an architectural one.
Principles from the Cloud Security Alliance emphasize placing controls at ingress.
What works in real environments
Organizations that succeed treat the traffic layer as a primary enforcement point.
They standardize ingress paths, enforce strict TLS baselines, and eliminate legacy exceptions.
They define clear rules for mutual TLS and ensure trust is continuously validated.
They normalize and validate requests before application logic.
They implement consistent telemetry so security teams can trace requests end-to-end.
Final thought
Zero trust is often described as a shift in mindset. That is true, but mindset alone does not secure systems.
Security is about enforcement. And enforcement begins with how traffic is handled.
That is why most zero-trust architectures fail at the traffic layer.
This article is published as part of the Foundry Expert Contributor Network.
Want to join?
View the full article
CSOonline

Google Rolls Out DBSC in Chrome 146 to Block Session Theft on Windows

Google has made Device Bound Session Credentials (DBSC) generally available to all Windows users of its Chrome web browser, months after it began testing the security feature in open beta. The public availability is currently limited to Windows users on Chrome 146, with macOS expansion planned in an upcoming Chrome release. "This project represents a significantView the full article
Hacker News

Marimo RCE Flaw CVE-2026-39987 Exploited Within 10 Hours of Disclosure

A critical security vulnerability in Marimo, an open-source Python notebook for data science and analysis, has been exploited within 10 hours of public disclosure, according to findings from Sysdig. The vulnerability in question is CVE-2026-39987 (CVSS score: 9.3), a pre-authenticated remote code execution vulnerability impacting all versions of Marimo prior to and includingView the full article
Hacker News

Backdoored Smart Slider 3 Pro Update Distributed via Compromised Nextend Servers

Unknown threat actors have hijacked the update system for the Smart Slider 3 Pro plugin for WordPress and Joomla to push a poisoned version containing a backdoor. The incident impacts Smart Slider 3 Pro version 3.5.1.35 for WordPress, per WordPress security company Patchstack. Smart Slider 3 is a popular WordPress slider plugin with more than 800,000 active installations across its free and Pro View the full article
Hacker News

Was CISOs von Moschusochsen lernen können

Wirestock Creators – shutterstock.com
Drittanbieter-Risikomanagement ist für CISOs und Sicherheitsentscheider eine signifikante Herausforderung. Wird sie nicht (richtig) gestemmt, drohen weitreichende geschäftliche Konsequenzen – bis hin zum Stillstand der Produktion.
Das wurde in den vergangenen Monaten von diversen Cyberattacken auf Drittanbieter unterstrichen. Zum Beispiel, als die russische Hackergruppe APT29 (auch bekannt als “Cozy Bear”) im Juni 2024 die kostenlose Remote-Access-Software TeamViewer ins Visier nahm, die im Unternehmensumfeld weit verbreitet ist. Selbst, wenn Sie TeamViewer nicht einsetzen – ähnliche Tools gibt es auch von diversen, anderen Anbietern. Beispielsweise von Perimeter81, AnyDesk, GoToMyPC oder LogMeIn.
Die entscheidenden Fragen sind dabei:
Welcher Drittanbieter wird als nächstes angegriffen? Und können Sie es sich leisten, diesbezüglich ein Risiko einzugehen? Drittanbieter sind Ihr schwächstes Glied
Leider verlassen sich so gut wie alle Unternehmen in zu hohem Maße auf zu viele verschiedene Drittanbieter, die in ihre Softwarelieferketten und Geschäftsprozesse eingebettet sind. Dabei reden wir nicht über zwei oder drei Third-Party-Partner, sondern mit Blick auf populäre Software-as-a-Service-Angebote eher über Hunderte oder Tausende, auf die sich Unternehmen jeden Tag verlassen.
Das Risiko, das einer Zusammenarbeit mit Drittanbietern inhärent ist, steigt entsprechend drastisch an – und nicht nur, wenn ihre Anzahl überhandnimmt. Weitere Risikofaktoren in diesem Bereich sind beispielsweise:
Eingeschränkte Transparenz. So gut wie alle Anbieter bieten potenziellen Kunden diverse Daten an, um ihre Fähigkeiten anzupreisen. Dabei kommen in einigen Fällen allerdings Informationen zum Einsatz, die nicht aktuell sind und somit die aktuelle Risikolage nicht adäquat widerspiegeln. Mehr Komplexität. Diverse Drittanbieter arbeiten selbst mit Zulieferern und Subunternehmen zusammen, von denen Sie möglicherweise nichts wissen. Unausgereifte Prozesse. Nicht wenige Third-Party-Anbieter arbeiten mit Cybersecurity-Richtlinien und -Standards, die weniger ausgereift sind als Ihre eigenen. Geringere Investitionen. Letztgenannter Punkt hängt oft auch damit zusammen, dass viele Drittanbieter ein begrenztes Budget für Cybersicherheit zur Verfügung haben. Das kann sich auf das Sicherheitsniveau ihrer Tools und Services auswirken. Zwar wurde eine Reihe von Best Practices und Playbooks entwickelt, um diese Lücken zu schließen – diese haben sich in weiten Teilen allerdings nicht bewährt:
Vendor Assessments verkommen regelmäßig zu papierbasierten “Ankreuzübungen”, die nur Zeit fressen, aber nicht dazu beitragen, Risiken zu minimieren. Auch im Rahmen von Vertragsverhandlungen dafür sorgen zu wollen, dass strengere Sicherheitsanforderungen bei Drittanbietern angelegt werden, hat in vielen Fällen nichts bewirkt. Einige Unternehmen setzen auf Continuous Monitoring, um einen Überblick und mehr, datengetriebene Einblicke in das Sicherheitsniveau von Drittanbietern zu erhalten. Andere implementieren mit Blick auf Third-Party-Partner Incident-Response-Pläne, um Strategien zu entwickeln und einzuüben, falls es bei diesen zu einem Sicherheitsvorfall kommt. Insbesondere die letzten beiden Punkte können für Unternehmen hilfreich sein. Allerdings adressieren auch diese Maßnahmen das Risiko in Zusammenhang mit Drittanbietern nicht vollumfänglich. Vielmehr stellen sie ein Mittel dar, um zu überwachen und zu reagieren, falls es zu einer Cyberattacke kommt.
Die Moschusochsen-Strategie
Ich bin stolzes Mitglied des “Financial Services Information Sharing and Analysis Center” (FS-ISAC) und habe zusammen mit anderen CISOs aus der Finanzdienstleistungsbranche den Vorsitz des strategischen Ausschusses in der Asien-Pazifik-Region inne. Das Konsortium bietet Finanzdienstleistern auf der ganzen Welt ein umfassendes Cyber-Intelligence-Netzwerk, um sich untereinander über möglicherweise bevorstehende oder bereits laufende Angriffskampagnen auszutauschen.
Weil viele verschiedene Unternehmen der Branche mit unterschiedlich ausgeprägtem Knowhow und Ressourcen an Bord sind, sind die Mitglieder in der Lage, eine umfassende Perspektive zu erhalten, die sie alleine nicht erreichen könnten. Das FS-ISAC ist insofern ein hervorragendes Beispiel dafür, wie wir als Sicherheitsentscheider zusammenarbeiten können, um uns besser gegen Risiken abzusichern.
Das ist die Essenz dessen, was ich als “Moschusochsenstrategie” bezeichne. Der Hintergrund: Werden Moschusochsen von Wölfen angegriffen, bildet die Herde einen Kreis, in dessen Mitte sich die schwächeren Mitglieder befinden. Die Hörner der “Frontline”-Tiere sind dabei nach außen positioniert. Für die Angreifer ist dieser gemeinschaftliche Verteidigungswall kaum noch zu überwinden. Ich bin der festen Überzeugung, dass sich diese Strategie auch auf das Drittanbieter-Risikomanagement übertragen lässt.
Ähnlich wie bei den Moschusochsen die Kälber sind die Drittanbieter, auf die wir uns verlassen, die schwächsten Herdenmitglieder. Werden Sie in Mitleidenschaft gezogen, wirkt sich das auf unsere kritischen Geschäftsprozesse aus. Der Unterschied zu den Moschusochsen: Wir bilden keinen Kreis, in dessen Mitte sich die Drittanbieter befinden. Stattdessen wäre es angebracht, sich im Kollektiv darüber auszutauschen, wenn die Sorge besteht, dass die Cybersecurity-Maßnahmen bei einem Third-Party-Anbieter zu wünschen übriglassen und verstärkt werden sollten.
Noch wichtiger wäre allerdings eine gemeinsame Übereinkunft darüber, den Drittanbieter bei seinen Bemühungen zu unterstützen. Das würde potenziell Koordinationsarbeit und unter Umständen auch eine Neuverhandlung von Verträgen erfordern – hätte aber den Vorteil, diese Schwachstelle, die uns alle betrifft, besser absichern zu können.
Von der Theorie zur Praxis
Ein solches Zusammenwirken könnte unter Juristen durchaus Bedenken aufwerfen – Stichwort Wettbewerbsrecht. Dennoch hat der Moschusochsenansatz das Potenzial, die Risikolage in Sachen Drittanbieter entscheidend zu verbessern – und Unternehmen dabei zu unterstützen, Third-Party-Risiken besser zu managen.
Das könnte – zum Beispiel – folgendermaßen aussehen:
Bestimmen Sie, welche Drittanbieter Ihnen am meisten Sorgen bereiten und erstellen Sie eine “Hot List”. Tauschen Sie sich mit anderen Unternehmen aus, um diese Liste abzugleichen und die Kandidaten zu ermitteln, die Sie gemeinsam haben. Verhandeln Sie über einen gemeinschaftlichen “Schutzschild” für diese Anbieter. Denselben Ansatz haben wir bei FS-ISAC als möglichen Weg für die Zukunft diskutiert. Die ersten beiden Schritte sind relativ simpel zu bewerkstelligen – der dritte macht hingegen deutlich mehr Aufwand, aber auch den entscheidenden Unterschied. Ein praktischer Ansatz, um diesen umzusetzen, könnte dabei darin bestehen, dass die größten Unternehmen eine Führungsrolle einnehmen und kleinere unter ihre Fittiche nehmen.
Vergessen sollten Sie dabei nicht, dass auch die Moschusochsen-Strategie ihre Grenzen hat: Wenn ein Bär angreift, machen sich auch Moschusochsen aus dem Staub – dann ist jeder auf sich allein gestellt. Das lässt sich ebenfalls auf die Cybersicherheit übertragen: Je mächtiger der Feind, desto wahrscheinlicher ist es, dass der Angriff in einen Kampf ums blanke Überleben ausartet. Aber auch wenn diese Strategie nicht auf jedes Szenario anwendbar ist, könnte sie unser kollektives Risiko erheblich minimieren. (fm)
View the full article
CSOonline

Was CISOs von Moschusochsen lernen können

Wirestock Creators – shutterstock.com
Drittanbieter-Risikomanagement ist für CISOs und Sicherheitsentscheider eine signifikante Herausforderung. Wird sie nicht (richtig) gestemmt, drohen weitreichende geschäftliche Konsequenzen – bis hin zum Stillstand der Produktion.
Das wurde in den vergangenen Monaten von diversen Cyberattacken auf Drittanbieter unterstrichen. Zum Beispiel, als die russische Hackergruppe APT29 (auch bekannt als “Cozy Bear”) im Juni 2024 die kostenlose Remote-Access-Software TeamViewer ins Visier nahm, die im Unternehmensumfeld weit verbreitet ist. Selbst, wenn Sie TeamViewer nicht einsetzen – ähnliche Tools gibt es auch von diversen, anderen Anbietern. Beispielsweise von Perimeter81, AnyDesk, GoToMyPC oder LogMeIn.
Die entscheidenden Fragen sind dabei:
Welcher Drittanbieter wird als nächstes angegriffen? Und können Sie es sich leisten, diesbezüglich ein Risiko einzugehen? Drittanbieter sind Ihr schwächstes Glied
Leider verlassen sich so gut wie alle Unternehmen in zu hohem Maße auf zu viele verschiedene Drittanbieter, die in ihre Softwarelieferketten und Geschäftsprozesse eingebettet sind. Dabei reden wir nicht über zwei oder drei Third-Party-Partner, sondern mit Blick auf populäre Software-as-a-Service-Angebote eher über Hunderte oder Tausende, auf die sich Unternehmen jeden Tag verlassen.
Das Risiko, das einer Zusammenarbeit mit Drittanbietern inhärent ist, steigt entsprechend drastisch an – und nicht nur, wenn ihre Anzahl überhandnimmt. Weitere Risikofaktoren in diesem Bereich sind beispielsweise:
Eingeschränkte Transparenz. So gut wie alle Anbieter bieten potenziellen Kunden diverse Daten an, um ihre Fähigkeiten anzupreisen. Dabei kommen in einigen Fällen allerdings Informationen zum Einsatz, die nicht aktuell sind und somit die aktuelle Risikolage nicht adäquat widerspiegeln. Mehr Komplexität. Diverse Drittanbieter arbeiten selbst mit Zulieferern und Subunternehmen zusammen, von denen Sie möglicherweise nichts wissen. Unausgereifte Prozesse. Nicht wenige Third-Party-Anbieter arbeiten mit Cybersecurity-Richtlinien und -Standards, die weniger ausgereift sind als Ihre eigenen. Geringere Investitionen. Letztgenannter Punkt hängt oft auch damit zusammen, dass viele Drittanbieter ein begrenztes Budget für Cybersicherheit zur Verfügung haben. Das kann sich auf das Sicherheitsniveau ihrer Tools und Services auswirken. Zwar wurde eine Reihe von Best Practices und Playbooks entwickelt, um diese Lücken zu schließen – diese haben sich in weiten Teilen allerdings nicht bewährt:
Vendor Assessments verkommen regelmäßig zu papierbasierten “Ankreuzübungen”, die nur Zeit fressen, aber nicht dazu beitragen, Risiken zu minimieren. Auch im Rahmen von Vertragsverhandlungen dafür sorgen zu wollen, dass strengere Sicherheitsanforderungen bei Drittanbietern angelegt werden, hat in vielen Fällen nichts bewirkt. Einige Unternehmen setzen auf Continuous Monitoring, um einen Überblick und mehr, datengetriebene Einblicke in das Sicherheitsniveau von Drittanbietern zu erhalten. Andere implementieren mit Blick auf Third-Party-Partner Incident-Response-Pläne, um Strategien zu entwickeln und einzuüben, falls es bei diesen zu einem Sicherheitsvorfall kommt. Insbesondere die letzten beiden Punkte können für Unternehmen hilfreich sein. Allerdings adressieren auch diese Maßnahmen das Risiko in Zusammenhang mit Drittanbietern nicht vollumfänglich. Vielmehr stellen sie ein Mittel dar, um zu überwachen und zu reagieren, falls es zu einer Cyberattacke kommt.
Die Moschusochsen-Strategie
Ich bin stolzes Mitglied des “Financial Services Information Sharing and Analysis Center” (FS-ISAC) und habe zusammen mit anderen CISOs aus der Finanzdienstleistungsbranche den Vorsitz des strategischen Ausschusses in der Asien-Pazifik-Region inne. Das Konsortium bietet Finanzdienstleistern auf der ganzen Welt ein umfassendes Cyber-Intelligence-Netzwerk, um sich untereinander über möglicherweise bevorstehende oder bereits laufende Angriffskampagnen auszutauschen.
Weil viele verschiedene Unternehmen der Branche mit unterschiedlich ausgeprägtem Knowhow und Ressourcen an Bord sind, sind die Mitglieder in der Lage, eine umfassende Perspektive zu erhalten, die sie alleine nicht erreichen könnten. Das FS-ISAC ist insofern ein hervorragendes Beispiel dafür, wie wir als Sicherheitsentscheider zusammenarbeiten können, um uns besser gegen Risiken abzusichern.
Das ist die Essenz dessen, was ich als “Moschusochsenstrategie” bezeichne. Der Hintergrund: Werden Moschusochsen von Wölfen angegriffen, bildet die Herde einen Kreis, in dessen Mitte sich die schwächeren Mitglieder befinden. Die Hörner der “Frontline”-Tiere sind dabei nach außen positioniert. Für die Angreifer ist dieser gemeinschaftliche Verteidigungswall kaum noch zu überwinden. Ich bin der festen Überzeugung, dass sich diese Strategie auch auf das Drittanbieter-Risikomanagement übertragen lässt.
Ähnlich wie bei den Moschusochsen die Kälber sind die Drittanbieter, auf die wir uns verlassen, die schwächsten Herdenmitglieder. Werden Sie in Mitleidenschaft gezogen, wirkt sich das auf unsere kritischen Geschäftsprozesse aus. Der Unterschied zu den Moschusochsen: Wir bilden keinen Kreis, in dessen Mitte sich die Drittanbieter befinden. Stattdessen wäre es angebracht, sich im Kollektiv darüber auszutauschen, wenn die Sorge besteht, dass die Cybersecurity-Maßnahmen bei einem Third-Party-Anbieter zu wünschen übriglassen und verstärkt werden sollten.
Noch wichtiger wäre allerdings eine gemeinsame Übereinkunft darüber, den Drittanbieter bei seinen Bemühungen zu unterstützen. Das würde potenziell Koordinationsarbeit und unter Umständen auch eine Neuverhandlung von Verträgen erfordern – hätte aber den Vorteil, diese Schwachstelle, die uns alle betrifft, besser absichern zu können.
Von der Theorie zur Praxis
Ein solches Zusammenwirken könnte unter Juristen durchaus Bedenken aufwerfen – Stichwort Wettbewerbsrecht. Dennoch hat der Moschusochsenansatz das Potenzial, die Risikolage in Sachen Drittanbieter entscheidend zu verbessern – und Unternehmen dabei zu unterstützen, Third-Party-Risiken besser zu managen.
Das könnte – zum Beispiel – folgendermaßen aussehen:
Bestimmen Sie, welche Drittanbieter Ihnen am meisten Sorgen bereiten und erstellen Sie eine “Hot List”. Tauschen Sie sich mit anderen Unternehmen aus, um diese Liste abzugleichen und die Kandidaten zu ermitteln, die Sie gemeinsam haben. Verhandeln Sie über einen gemeinschaftlichen “Schutzschild” für diese Anbieter. Denselben Ansatz haben wir bei FS-ISAC als möglichen Weg für die Zukunft diskutiert. Die ersten beiden Schritte sind relativ simpel zu bewerkstelligen – der dritte macht hingegen deutlich mehr Aufwand, aber auch den entscheidenden Unterschied. Ein praktischer Ansatz, um diesen umzusetzen, könnte dabei darin bestehen, dass die größten Unternehmen eine Führungsrolle einnehmen und kleinere unter ihre Fittiche nehmen.
Vergessen sollten Sie dabei nicht, dass auch die Moschusochsen-Strategie ihre Grenzen hat: Wenn ein Bär angreift, machen sich auch Moschusochsen aus dem Staub – dann ist jeder auf sich allein gestellt. Das lässt sich ebenfalls auf die Cybersicherheit übertragen: Je mächtiger der Feind, desto wahrscheinlicher ist es, dass der Angriff in einen Kampf ums blanke Überleben ausartet. Aber auch wenn diese Strategie nicht auf jedes Szenario anwendbar ist, könnte sie unser kollektives Risiko erheblich minimieren. (fm)
View the full article
CSOonline

OpenAI Adds New $100/Month ChatGPT Subscription Tier for Heavier Codex Use

OpenAI today added a new subscription tier, which the company says is meant to support increasing Codex use. Codex is OpenAI's AI coding agent that's integrated into ChatGPT, and it competes with Anthropic's Claude Code.


The new $100/month Pro tier provides 5x more Codex usage than the $20/month ChatGPT Plus plan. OpenAI says that it is best for longer, high-effort Codex sessions. ChatGPT also has a $200 Pro tier with a 20x higher usage allowance, and the $100/month plan is a new middle-tier option. Both the $100 and $200 plans share the "Pro" name.

Pro subscribers will have access to all Pro features, including the Pro model and unlimited access to Instant and Thinking models.

To celebrate the launch of the new plan, OpenAI is increasing Codex usage for a limited time. Through May 31, customers who subscribe to the $100/month Pro plan will get up to 10x usage of ChatGPT Plus on Codex.

In addition to introducing the new plan, OpenAI is "rebalancing" Codex usage in Plus to support more sessions throughout the week, instead of longer sessions in a single day. OpenAI says the ChatGPT Plus plan is the best offer for steady, day-to-day usage of Codex, while the more expensive $100/month plan is a "more accessible" upgrade path for heavier daily use.

With the $100 plan, OpenAI has pricing tiers similar to Anthropic. Anthropic has a $20/month Pro plan, a Max 5x plan for $100/month, and a Max 20x plan for $200/month.Tags: ChatGPT, OpenAI
This article, "OpenAI Adds New $100/Month ChatGPT Subscription Tier for Heavier Codex Use" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

Mac OS X Cheetah Successfully Ported to Nintendo Wii

Developer Bryan Keller was curious whether an old version of Apple's Mac operating system was capable of running on the Nintendo Wii after seeing Windows NT ported to the gaming device, so he decided to give it a try. He was able to get Mac OS X 10.0 Cheetah to operate on the Nintendo Wii, and he shared a blog post walking through the project.


The Wii uses a PowerPC 750CL processor, which is a newer version of the PowerPC 750CXe that Apple used in the G3 iBook and iMac, which is why Keller had a hunch that the process would be successful. Keller wrote a custom bootloader and eventually managed to load OS X, with the multi-step process detailed on his website.

He had to patch the OS X kernel source code and compile a modified kernel binary, then write custom drivers so the kernel was able to read from the Wii SD card slot to boot into the file system. He also had to write a framebuffer driver for the OS X interface, bridge a color incompatibility between the Wii video hardware and OS X graphics code, and seek out decade-old OS X Cheetah USBFamily source code on IRC to get peripherals working.

Keller was able to get the Mac OS X Cheetah installer running with a functional keyboard and mouse, turning the Wii into a usable system running OS X.

Keller was invested enough in the project that he took the Wii with him on vacation to Hawaii so he could work on it. For those curious about how he solved the myriad problems required to get OS X running on a Wii, his website is worth checking out. Anyone who wants to try setting up OS X on a Wii can get the project source code on GitHub.
This article, "Mac OS X Cheetah Successfully Ported to Nintendo Wii" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

Hackers have been exploiting an unpatched Adobe Reader vulnerability for months

Adobe Reader vulnerabilities have been exploited for decades by threat actors taking advantage of the universal use of the utility to fool employees into downloading infected PDF documents through phishing lures.
Now a security researcher says a Reader hole has been quietly exploited by malware for as long as four months, fingerprinting computers to gather information that will allow attackers to steal data and perform further malicious activities.
In a blog this week, Haifei Li said that EXPMON, the publicly-available exploit monitor he runs that scans samples to detect file-based zero-day exploits, had found an initial exploit that abuses the vulnerability in a Reader API.
JavaScript code in the malware that automatically executes when the infected PDF is opened reads files on the compromised computer, collecting information including language settings, the Adobe Reader version number, the exact OS version, and the local path of the PDF file. It then sends the data to a remote server.
This information will be useful to a threat actor planning on launching future attacks, including the installation of remote access tools, Li noted.
Li said in his April 7 report that he tested the malware on what was at the time the latest version of Adobe Reader (26.00121367), and it still worked.
In an update the next day, Li added that a variant dating back to last November had been found by another researcher, which suggests the malware had been in use at least since then.
Adobe was asked for comment on the report, but no reply was received by deadline.
It’s not the first time Adobe Reader has been targeted. Vulnerabilities relating to it date back at least to 2007, when a hole was found in a browser plug-in. Fake Reader updates are another threat actor favorite. User-after-free memory vulnerabilities are also common; researchers at Zeropath last year described one of them, CVE-2025-54257.
Traditional tactics
In addition to applying patches as soon as they are available, infosec leaders need to ensure employees receive regular security awareness training that includes warnings about opening unexpected PDFs, even those seemingly from trusted sources such as co-workers or managers.
Threat actors traditionally use a variety of tactics to trick an employee into opening an email attachment, including using subject lines like “Urgent,” and “Info on bonus.” The attachment itself may be given a name that conveys importance; in this case, the November variant carried the file name “Invoice504.pdf.”
According to a report on this new malware filed with malware scanning site VirusTotal, to which anyone can upload suspicious files for scrutiny, the recipient is to open the attachment specifically with Adobe Acrobat Reader. 
A high risk exploit
Kellman Meghu, chief technology officer at Canadian incident response firm DeepCove Security, called the exploit “a very high risk.”
So far it looks as though this particular malware just exfiltrates data, he said. But it implies there is an ability or capability to turn it into a vehicle for remote code execution. “It is a zero click [vulnerability],” Meghu added, “meaning just viewing in a browser or email is likely enough to trigger it.”
CSOs should meet this threat by disabling Acrobat JavaScript, either by default or until there is a patch, he said. “But to be honest,” he added, “I think JavaScript execution is generally a bad idea in Adobe Reader,” so it should be disabled.
Johannes Ullrich, dean of research at the SANS Institute, noted Adobe Acrobat and Reader have often been the targets of sophisticated exploits. These frequently take advantage of features like JavaScript, or leverage the ability to include, or nest, various document types inside a PDF. Many malware filters will detect and flag these types of documents as malicious, he said.
“CSOs should ensure that web proxies and email gateways have filters enabled to not allow PDFs that are not fully standards compliant, and to eliminate PDFs taking advance of known problematic features like JavaScript,” he said. “Any attachment like this should also prominently note that it was received from a source outside the organization.”
“Sadly,” he added, “PDFs are still very common, and can not be completely eliminated.”
Adam Marrè, CISO at Arctic Wolf, said that what makes this new vulnerability particularly concerning is that it’s being actively exploited and appears to work even on fully patched systems. That immediately raises the risk profile. “Even without full visibility into the entire attack chain, the fact that initial access can be gained through something as routine as opening a PDF means organizations should treat this as a real and present security event,” he said. “From there, the potential impact can range from limited data exposure to follow‑on activity if attackers are able to deliver additional payloads.”
This becomes a matter of managing risk in real time, he pointed out. “When a trusted tool suddenly falls outside an organization’s acceptable risk threshold, the priority shifts to reducing exposure and increasing visibility. That may mean reassessing where the software is truly necessary, tightening how untrusted content is handled, and ensuring monitoring is in place to quickly detect any abnormal behavior,” he said.
“Just as important is what happens after containment,” he added. “Incidents like this are an opportunity to evaluate what controls held up, where gaps surfaced, and how to operationalize those lessons. Threats tied to everyday user behavior aren’t going away, so resilience depends on learning quickly and adapting just as fast.”
View the full article
CSOonline

Apple Mac Shipments Grew 9% in Q1 2026, Outpacing Overall PC Market

Apple's Mac shipments grew 9 percent during the first quarter of 2026, according to estimated shipment data shared this week by IDC.


Apple's growth outpaced overall PC market growth of 2.5 percent thanks to the M5 MacBook Pro that was released late last year. Apple also refreshed the MacBook Air and the higher-end ‌MacBook Pro‌ models, but those were just recently updated and wouldn't have impacted the Q1 2026 numbers much.

Apple was the number four PC vendor in the world with 6.2 million Macs shipped, up from 5.7 million in the year-ago quarter. Lenovo, HP, and Dell were the top three PC vendors with 16.5, 12.1, and 10.3 million PCs shipped, respectively. Most vendors saw an increase in shipments during the quarter according to IDC, with the exception of HP.

Apple had a 9.5 percent share of the global PC market during the quarter, up from 8.9 percent in the first quarter of 2025.

According to IDC, growth during the quarter was fueled by concerns over rising component costs and new product introductions. Vendors that are able to secure access to memory will fare the best as PC shipments start to decline.

IDC counts traditional PCs like desktops, notebooks, and workstations in its numbers, but it does not include tablets like the iPad. IDC's information is only an estimate, and Apple no longer provides details on the specific number of devices that it sells each quarter.

Apple's next earnings report is set to take place on April 30.
This article, "Apple Mac Shipments Grew 9% in Q1 2026, Outpacing Overall PC Market" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

Europe's Largest Apple Museum Opens in the Netherlands With 50 Years of Products on Display

Europe's largest Apple museum to date opened in early April, coinciding with Apple's 50th anniversary. The Apple Museum spans 2,000 square meters and is located at the Wall Utrecht in the Netherlands.


The museum's creator, Ed Bindels, claims that the space features one of the largest Apple collections in the world, and it has several rooms dedicated to Apple's design. There is an eye-catching rainbow wall of iMac G3 machines, a recreation of the garage Steve Jobs and Steve Wozniak worked in, an iPod display, and more.


Everything from classic Macs to modern iPhones is included in the museum, and it showcases almost all of the devices that Apple has released from 1976 to 2026. Bindels says the museum tells a story, featuring different stages in Apple's development timeline.

Bindels teamed up with a group of volunteers to collect and restore devices, accessories, prototypes, manuals, and brand materials. Some of the devices in the museum are functional and are available for guests to use.


Tickets to the Apple Museum are priced at €21.50 for adults, with discounts available for students and children.
This article, "Europe's Largest Apple Museum Opens in the Netherlands With 50 Years of Products on Display" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

Instagram Now Lets You Edit Comments for Up to 15 Minutes

Instagram today implemented a small but useful change, allowing Instagram users to edit their comments for up to 15 minutes after writing the initial comment.


The Meta-owned social media site has long supported editing an Instagram post, but comments have never been able to be updated to correct typos. Editing a comment can be done by tapping on the new "Edit" option that is displayed after a comment is posted.

Comments on Instagram that have been edited will be marked with a gray edited tag, but Instagram does not allow users to see the original comment.Tag: Instagram
This article, "Instagram Now Lets You Edit Comments for Up to 15 Minutes" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

Cloudflare ‘actively adjusting’ quantum priorities in wake of Google warning

Google’s accelerated post-quantum encryption deadline has spurred other leaders in the industry, including Cloudflare, to consider pushing forward their own plans.
The US National Institute of Standards and Technology (NIST) has set a 2030 deadline for depreciating legacy encryption algorithms ahead of their planned retirement in 2035.
Late last month Google brought forward its own post-quantum cryptography (PQC) deadline a year to 2029 because advances in quantum computers mean that legacy encryption and digital signature systems are at greater risk sooner than previously anticipated.
Google is readying its products and services for PQC by adding support to its Chrome browser, Android mobile operating system, and  cloud-based services.
Algorithmic breakthrough
Bas Westerbaan, principal research engineer at Cloudflare, and an expert in post quantum encryption, told CSO that Google’s decision to pull forward its PQC migration timeline to 2029 is a “very big deal.”
“We are starting to see some details of the three breakthroughs that scared Google, but crucial elements are being withheld due to their perceived risk as an aid for adversaries,” says Westerbaan. “Google even went to the effort to publish a state-of-the-art zero-knowledge proof to demonstrate they indeed made an algorithmic breakthrough without spilling the beans.”
Cloudflare is “actively adjusting” its priorities and “will share outcomes soon,” Westerbaan explains.
Preparations for the migration to PQC by Cloudflare are already well advanced.
More than half the traffic on Cloudflare is already secure against the threat of harvest-now/decrypt-later using ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism, a PQC standard ratified in 2024) as browsers roll out support.
To protect browser connections against active attack, Cloudflare is planning to deploy post-quantum certificates in 2027.
Quantum threat
The existing public key cryptographic systems that protect Internet and mobile transactions, Rivest-Shamir-Adelman (RSA) and Elliptic Curve Cryptography (ECC), are aging cryptosystems, developed in the 1970s and 1980s, respectively.
Sufficiently powerful quantum computers pose a threat to legacy cryptographic standards, and specifically to encryption and digital signatures, because they have the capacity to break the mathematical foundations of legacy algorithms.
For example, newer and faster algorithms have already been developed, such as the JVG algorithm, that require less quantum computational power (qubits) to factor large prime numbers, on which some legacy cryptosystems such as RSA are based.
Google argues that advances in quantum computing, including hardware development, quantum error correction, and quantum factoring resource estimates, are bringing forward the time legacy cryptographic algorithms will become vulnerable to quantum computing, a phenomenon known as Q-Day.
“Google’s accelerated 2029 deadline reflects a shift from trying to predict Q-day to managing pre-Q-day risk,” says Mark Pecen, chair of technical committee on quantum technologies at the European Telecommunications Standards Institute (ETSI). “The real concern isn’t when quantum computers arrive; it’s that adversaries are already collecting encrypted data today to decrypt later.”
Data with long-term sensitivity, legal records, intellectual property, medical research, and critical infrastructure communications are most at risk.
“By moving earlier than government timelines, Google is effectively forcing the industry to treat post-quantum migration as an immediate operational priority rather than a future compliance exercise,” says Pecen.
Matt Campagna, chair of the quantum-safe cryptography working group at ETSI, adds:
“Businesses must develop their own PQC migration strategies and actively engage with vendors and suppliers to ensure alignment.”
Michael Klieman, global vice president for project management at Entrust, says that doubts about how close the industry is to a cryptographically relevant quantum computing breakthrough are creating uncertainty.
“Today, there’s no universal way to measure performance across quantum systems, which makes it difficult to separate incremental progress from meaningful milestones toward Q-Day,” according to Klieman.
“What the industry needs next are clear, standardized benchmarks for scale, error correction, and algorithmic performance — so organizations can understand where we are on the path to quantum risk, not just where vendors say we are,” Klieman adds.
Catalyst
Daryl Flack, partner at UK-based managed security service provider Avella Security, argues Google’s accelerated roadmap is likely to act as a catalyst across the industry.
Google’s accelerated roadmap has the potential to disrupt a cycle of inaction driven by misaligned incentives: vendors waiting for customer demand, and organizations waiting for regulation, according to Flack.
“Google’s decision to accelerate its post-quantum cryptography (PQC) migration to 2029 is a clear signal that the industry is moving from theoretical timelines to operational urgency,” Flack says. “While existing UK and EU roadmaps provide direction, they do not compel action, and that distinction is now becoming a material cybersecurity risk.”
Preparations — and in some cases even awareness — about the need to migrate to PQC is lagging amongst many enterprises.
“Many enterprises lack visibility into where cryptography is used, have not identified their most sensitive long-lived data, and do not yet have crypto-agility built into their systems,” Flack warns. “Without addressing these fundamentals, any accelerated timeline, whether driven by regulators or vendors, will be difficult to meet.”
Enterprise CISOs should take ownership of PQC readiness.
“Preparation should start with a structured approach: creating crypto inventories and catalogs, mapping cryptographic dependencies, identifying high-risk systems, and embedding crypto-agility into transformation programmes,” Flack advises. “Just as importantly, organizations must extend this thinking into their supply chains.”
View the full article
CSOonline

Apple is Closing a Unionized Store in the U.S. and the Union is 'Outraged'

Apple on Thursday announced that it will be permanently closing three of its retail stores in the U.S. in June, and one of them was unionized.

Apple Towson Town Center in Maryland
Apple Towson Town Center in Towson, Maryland is one of the three stores being shuttered, with no replacement store planned. The staff at this location became Apple's first retail employees in the U.S. to unionize in 2022. They belong to the International Association of Machinists and Aerospace Workers' Coalition of Organized Retail Employees (IAM CORE), and they signed a collective bargaining agreement with Apple in 2024.

The other two locations that are permanently closing are Apple Trumbull in Trumbull, Connecticut and Apple North County in Escondido, California.

Apple said employees at the Trumbull and North County stores will "continue their roles" at the company's nearby stores in each area, so transfer eligibility is guaranteed. Meanwhile, Apple said employees at the Towson store will be eligible to apply for open roles at Apple in accordance with their collective bargaining agreement, and it is unclear if everyone who applies will successfully secure a new position at the company.

In a statement, Apple said it made the "difficult decision" to close all three stores due to "declining conditions" at the shopping malls in which they are located:Towson Town Center is indeed a struggling shopping mall that has lost many major retailers. Earlier this year, for example, Banana Republic, Madewell, and Tommy Bahama announced they were leaving the mall. In addition, local news outlets have reported that the area surrounding the mall is facing a rising crime rate in recent years.

In a statement, the IAM Union said it is "outraged" by Apple's decision to close the Towson store and raised "serious concerns" of potential union busting:IAM added that it is exploring all legal options and will work with elected officials and allies to hold Apple accountable for this decision.

Apple has yet to respond to our follow-up questions regarding IAM's statement and the accusations of potential union busting.

Apple Towson Town Center closes June 20, according to a source familiar with the matter.Tag: Apple Store
This article, "Apple is Closing a Unionized Store in the U.S. and the Union is 'Outraged'" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

Apple's Pixelmator Pro Update Brings iPhone 17 Mockups, Keyboard Shortcuts, and Expanded Camera Support

Apple today updated Pixelmator Pro, the popular image editing app that it purchased in 2024. Pixelmator Pro includes RAW image support for more cameras, new templates, improved support for SVG file exports, new keyboard shortcuts, and more. Some of the features like the keyboard shortcuts are limited to the Creator Studio version of Pixelmator Pro.


Pixelmator Pro has a template and mockup section, which includes new app screenshot options and devices to use for app mockups on Apple devices. Apple has added support for the latest iPhone 17 models.

SVG files exported from Pixelmator Pro will have fewer issues when opened in Adobe Illustrator, and there is an option to touch and hold an image on the canvas to see before and after edits from Color Adjustments and Effects tools.

The sidebar is customizable using the toolbar setting options, and there are keyboard shortcuts for changing layer opacity, selecting layers when using Select Subject, cycling through blend modes, and swapping between layers. Apple's release notes for the Creator Studio version of Pixelmator Pro are below.


The iPad app was also updated with some of the keyboard shortcuts that were previously available in the Mac version of the app.

The non-Creator Studio version of the app includes the same RAW image support and the new templates, but it lacks the other options that Apple added.

Photomator, a photo editing sister app to Pixelmator Pro, was updated with the new RAW image support.

Apple introduced Creator Studio earlier this year, and it incorporates apps like Final Cut Pro, Logic Pro, Pixelmator Pro, Keynote, Pages, and Numbers. Because many of these apps existed before Creator Studio was developed, Apple offers a Creator Studio version and a standard version, which can be confusing. Unlocking Creator Studio features requires a Creator Studio subscription, priced at $12.99 per month or $129 per year.

For Pixelmator Pro, Creator Studio-exclusive features include a warp tool, apparel mockups, and a dedicated ‌iPad‌ app.Related Roundup: iPhone 17Tags: Apple Creator Studio, PixelmatorBuyer's Guide: iPhone 17 (Neutral)Related Forum: iPhone
This article, "Apple's Pixelmator Pro Update Brings iPhone 17 Mockups, Keyboard Shortcuts, and Expanded Camera Support" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

Logic Pro Updated With Step Reflex Sound Pack, Apple's Other Creator Apps Get Bug Fixes

Apple today updated several apps designed for creators, including Logic Pro, Compressor, MainStage, Motion, Final Cut Pro, Final Cut Camera, Numbers, Keynote, and Pages. Apple has pushed updates for the iOS, iPadOS and macOS versions of the apps where applicable.


Logic Pro includes a Step Reflex: Modern Garage Pack, featuring two-step beats, deep basslines, synths, and more. The update also includes an option to export a shareable file to preview how a spatial audio mix will sound when streamed on Apple Music.

Compressor, Motion, Final Cut Camera, Final Cut Pro, MainStage, Numbers, Keynote, and Pages have no new features, and the release notes only mention stability improvements and bug fixes.

Apple's apps are included as part of the Creator Studio subscription that's priced at $12.99 per month or $129 per year, but apps like Logic Pro and Final Cut Pro can also be purchased standalone. Numbers, Pages, and other apps are free to use, but some features are limited to those who subscribe to Creator Studio.Tag: Logic Pro
This article, "Logic Pro Updated With Step Reflex Sound Pack, Apple's Other Creator Apps Get Bug Fixes" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

EngageLab SDK Flaw Exposed 50M Android Users, Including 30M Crypto Wallets

Details have emerged about a now-patched security vulnerability in a widely used third-party Android software development kit (SDK) called EngageLab SDK that could have put millions of cryptocurrency wallet users at risk. "This flaw allows apps on the same device to bypass Android security sandbox and gain unauthorized access to private data," the Microsoft DefenderView the full article
Hacker News

Apple Releases macOS Tahoe 26.4.1 With Bug Fixes

Apple today released macOS Tahoe 26.4.1, a minor update to the ‌macOS Tahoe‌ operating system that came out last September. ‌macOS Tahoe‌ 26.4.1 comes two weeks after Apple launched macOS Tahoe 26.4.


Mac users can download the new software by opening up the System Settings app and navigating to the Software Update section.

According to Apple's release notes for the update, it includes unspecified bug fixes.Related Roundup: macOS TahoeRelated Forum: macOS Tahoe
This article, "Apple Releases macOS Tahoe 26.4.1 With Bug Fixes" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

Apple is Permanently Closing Three U.S. Stores

Apple today announced it will be permanently closing three retail stores in the U.S. in June, including Apple Trumbull in Trumbull, Connecticut, Apple Towson Town Center in Towson, Maryland, and Apple North County in Escondido, California.

Apple Towson Town Center in Maryland
Apple issued the following statement to MacRumors:All three stores are located in struggling shopping malls.

Notably, employees at Apple Towson Town Center had formed a union.

On the other hand, Apple has opened 11 new stores around the world in the past year or so, including in Miami and Detroit. Apple has also replaced and upgraded 14 store locations, and it plans to open its first stores in Saudi Arabia.Tag: Apple Store
This article, "Apple is Permanently Closing Three U.S. Stores" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

UAT-10362 Targets Taiwanese NGOs with LucidRook Malware in Spear-Phishing Campaigns

A previously undocumented threat cluster dubbed UAT-10362 has been attributed to spear-phishing campaigns targeting Taiwanese non-governmental organizations (NGOs) and suspected universities to deploy a new Lua-based malware called LucidRook. "LucidRook is a sophisticated stager that embeds a Lua interpreter and Rust-compiled libraries within a dynamic-link library (DLL) to download andView the full article
Hacker News

Apple Apparently Still Undecided on iPhone 18 Pro Dynamic Island

Apple is weighing two options for the iPhone 18 Pro's Dynamic Island, and a final decision has yet to be made, according to the Weibo leaker known as Digital Chat Station.



In a new post today, the leaker says that current supply chain feedback points to an A/B scenario: one option retains the existing screen mold from the iPhone 17 Pro, while the other introduces a significantly smaller "Mini ‌Dynamic Island‌" enabled by moving the Face ID receiver and transmitter components beneath the display.



The update is a slight shift from the leaker's previous position. Earlier this year, Digital Chat Station claimed Apple was leaning toward reusing last year's design, which would have left the ‌Dynamic Island‌ largely unchanged.

The report was a dissenting voice against a body of reporting, including from Bloomberg's Mark Gurman, DSCC's Ross Young, and multiple other Weibo leakers, suggesting the ‌iPhone 18 Pro‌ would feature a ‌Dynamic Island‌ roughly 35% smaller than on the ‌iPhone 17 Pro‌.


In a follow-up post, the leaker also addressed the ‌iPhone 18 Pro‌'s rear design. He said that the rectangular plateau design introduced with the ‌iPhone 17 Pro‌ will carry over unchanged, but the back will see "minor adjustments to the body materials and design details.” This is likely a reference to previously rumored changes aimed at achieving a more uniform look between the aluminum unibody frame and glass cutout for wireless charging.

The ‌iPhone 18 Pro‌ and ‌iPhone 18 Pro‌ Max are expected to be announced this fall alongside Apple's first foldable iPhone.Related Roundup: iPhone 18 ProTags: Digital Chat Station, Dynamic Island
This article, "Apple Apparently Still Undecided on iPhone 18 Pro Dynamic Island" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

AirPods Max 2 Available for $529.99 on Amazon

Apple's new AirPods Max 2 launched last week, and Amazon is still one of the only retailers offering a discount on the headphones. You can get the Midnight and Starlight color options for $529.99 on Amazon, down from $549.00.

Note: MacRumors is an affiliate partner with some of these vendors. When you click a link and make a purchase, we may receive a small payment, which helps us keep the site running.

Although this is only a $19 discount on the AirPods Max 2, it's the best markdown you'll find online if you're looking to order the new headphones. Free delivery has the AirPods Max 2 arriving around April 14, but they can be delivered as soon as tomorrow with Prime shipping.

$19 OFFAirPods Max 2 for $529.99

In other new product discounts, Amazon has the M5 MacBook Air for $150 off across nearly every model this week. If you're on the hunt for more discounts, be sure to visit our Apple Deals roundup where we recap the best Apple-related bargains of the past week.



Deals Newsletter

Interested in hearing more about the best deals you can find in 2026? Sign up for our Deals Newsletter and we'll keep you updated so you don't miss the biggest deals of the season!




Related Roundup: Apple Deals
This article, "AirPods Max 2 Available for $529.99 on Amazon" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

2026 Swift Student Challenge: Three Apps Created by Young Developers

In late March, Apple notified the winners of the 2026 Swift Student Challenge, who each received a complimentary one-year Apple Developer Program membership, AirPods Max 2, and a special certificate. A smaller group of Distinguished Winners were also invited to a three-day experience at Apple Park during WWDC 2026 in June.


The annual Swift Student Challenge gives eligible student developers around the world the opportunity to showcase their coding capabilities by using the Swift Playground or Xcode apps to create an interactive "app playground."

Despite receiving many incredible submissions, Apple can only select a limited number of winners due to WWDC space constraints. Below, we have highlighted three young developers who did not quite win, but still deserve attention for their efforts.

Teddy


For the 2026 Swift Student Challenge, UC Santa Cruz student Morris Richman submitted Teddy, a voice-controlled camera app that uses Apple Foundation Models to help those with touch-related accessibility issues take photos.

"There is a strong overlap between those who have touch issues and those who have difficulty learning accessibility focused features such as VoiceOver," said Morris. "Teddy addresses this issue through Apple's Foundation Models and SpeechAnalyzer APIs to take action on behalf of the user through natural language processing and tool calling."

Morris created the app after being inspired by his grandfather, Larry.

Teddy is available in beta via TestFlight and as an open-source project on GitHub.

ActivTimer


MacRumors reader Kate's first-ever Swift Student Challenge submission was ActivTimer, an iPhone app designed to help reduce your screen time and increase your activity. The app was built with SwiftUI and other modern Apple technologies.

Kate describes the app as a "screen time tracker and workout app all in one."

"It keeps track of how long you're on your screen and alerts you with a sound to get up and move, or to do some mindfulness," said Kate.

ActivTimer is not available in the App Store, but the project's source code is available on GitHub.

Write: A Literary Journey


Victoria Ali is a young developer from Argentina who created Write: A Literary Journey, an iPhone app that she describes as a narrative puzzle experience.

The app tasks you with solving puzzles to reconstruct the portraits and legacies of history's most influential female authors.

Victoria said the app both demonstrates her coding skills and serves as a tribute to her late grandmother and writer, Rosa.

When you first open the app, you are presented with a 3D onboarding experience that allows you to explore Rosa's desk.

"Through an immersive 3D onboarding I designed in SceneKit with models I built in Blender—like her vintage Remington typewriter and her yellow tulips—I wanted to create a bridge to feel her close again," she said.Related Roundup: WWDC 2026Tag: Swift Student ChallengeRelated Forum: Apple, Inc and Tech Industry
This article, "2026 Swift Student Challenge: Three Apps Created by Young Developers" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

Weak at the seams

Before I ever held a security title, I was a software engineer implementing vertically integrated automation systems for industrial manufacturing, warehouse-scale conveyor networks, robotic material handling, physical infrastructure controlled by software on increasingly connected networks. I learned early that tightly coupled systems produce tightly coupled failures. When a single software fault could halt a distribution center, you designed for graceful degradation. You assumed components would break and built the system to absorb it.

That instinct followed me into cybersecurity and eventually into CISO roles across healthcare, financial services and global manufacturing. These industries operate under different regulatory regimes, face different threat profiles and define risk in different terms. But in every one of them, I encountered the same structural problem: Cyber risk wasn’t governed as a unified discipline. It was adopted piecemeal by systems that already existed, product markets, regulators, auditors, insurers and boards, each building frameworks on its own timeline, in its own language, toward its own definition of “secure.” The pattern rhymes with early actuarial science, where separate branches of insurance each modeled risk in isolation before discovering that correlated losses were the real threat.

Within any individual silo, the logic was sound. But the seams between them were never reconciled. Where one system’s blind spot becomes another’s unpriced exposure, there was no shared language to name it. And as digital transformation has accelerated the interconnection between industries, supply chains and critical infrastructure, those seams have widened into the actual modern risk surface.
We are spending more and falling further behind

In every security program I’ve led, the budget could have ballooned year over year. My approach was always the opposite: Aggressively reduce tool proliferation and capability overlap, simplify the architecture and tie every dollar to a measurable business outcome. Timing and intent. But even with that discipline, the distance between what we spent and what we were exposed to widened, because technological change was rendering our tools and assumptions obsolete faster than we could replace them. The industry-level numbers confirm this isn’t anecdotal. Gartner projected global security spending would exceed $212 billion in 2025. The economic impact of cybercrime, by most estimates, has surpassed $10 trillion annually. Those curves are diverging, not converging.

I first felt this acutely in healthcare. As CISO at a global benefits administrator processing sensitive health data for millions of members, I operated under HIPAA, state-level privacy mandates and contractual obligations from plan sponsors. We could satisfy every audit and still know the real risk lived in the handoffs, the interfaces between our claims platform and external provider networks, data flowing between systems governed by different standards. The auditors checked their boxes. The seams went unmeasured.

Later, leading global security engineering at a major asset management firm, I saw the same gap in financial services. Different controls, different regulators, identical blind spot. The fragmentation was even more visible internationally. Regional regulatory bodies, data sovereignty requirements that varied by jurisdiction, vendor ecosystems that differed across geographies. Every regulator had its own definition of adequate security. None described the interconnected reality we were defending. Researchers at the Federal Reserve have documented how the financial system’s exposure to correlated cyber events is growing in ways that traditional risk models weren’t built to capture. I lived that gap daily.

What connected these experiences was a pattern in the insurance market that troubled me more than any single threat. I watched premiums soften even as breach frequency and severity climbed. Insurers were underwriting individual, uncorrelated incidents while the actual risk was becoming systemic. Digital transformation had stitched these industries together: Healthcare platforms connected to financial clearinghouses connected to manufacturing supply chains all connected to hyperscalers, but the actuarial models still treated each policyholder as an island. When a single vendor failure can cascade across thousands of organizations simultaneously, that pricing model stops making sense. A black swan is lurking in our digital pond.
The normal choices are the dangerous ones

Consider the stack a typical large enterprise was running in 2024: One vendor for ERP and supply chain, another for perimeter enforcement, another for networking and another for endpoint protection. Standard choices, responsibly made. Within a 12-month window, each of those categories experienced significant disruptions, from zero-day exploits to update failures that disrupted global operations. Any single event was survivable. The accumulation was something else entirely.

I lived this as a Global CISO. My team planned for sequential crises with recovery time between them. What we got was overlapping disruptions across interdependent systems. One week, we were triaging an emergency patch on our perimeter while a second advisory was escalating on a different platform. The assumption that these events would arrive one at a time, that we’d have breathing room, turned out to be a planning fiction. When you are sustaining the operation itself, crises expose the seams in real time.

A firewall vulnerability isn’t just a network issue when the ERP behind it processes every financial transaction. An endpoint agent failure isn’t just a security tool outage when it takes down the operating systems running your logistics. These platforms don’t fail in isolation because they don’t operate in isolation. Increasingly, neither do the industries that depend on them. A disruption to a cloud provider ripples through healthcare systems processing claims, financial institutions settling trades and manufacturers coordinating supply chains on the same platform.

The July 2024 CrowdStrike incident made this impossible to dismiss. A routine content update, no attacker, no exploit, bricked millions of Windows systems worldwide. Airlines grounded flights. Hospitals diverted patients. Financial services went dark. The protective tool itself became the failure vector. That should have ended the debate about whether cybersecurity is a technical problem contained within organizational boundaries or a systemic risk that spans them.

My background in industrial automation made this grimly familiar. In material handling, we knew the integration layer was the highest-risk surface. We designed systems assuming any component could fail and built degradation paths so the operation didn’t stop. Enterprise cybersecurity had somehow convinced itself that assembling best-of-breed tools was the same as building a resilient system. It isn’t. And as digital transformation pushes more critical infrastructure, from energy grids and water systems to transportation networks and medical devices, onto the same interconnected platforms, the consequences of that confusion multiply.
Resilience is a design problem, not a compliance problem

Across healthcare, financial services and manufacturing, I watched the same pattern. The compliance apparatus measured whether controls existed. It rarely measured whether the organization, or the broader infrastructure it depended on, could survive its failure. In healthcare, we demonstrate compliance while knowing our resilience to a coordinated supply-chain attack is largely untested. In financial services, we pass examinations while the insurers underwriting our risk price off the same compliance signals the examiners accept — and neither captures the systemic interdependencies between our platforms and our counterparties. In manufacturing, we secure the IT network while operational technology controlling physical processes is increasingly exposed through the same digital transformation the business is accelerating. We are weak at the seams.

The question that followed me from role to role was simple: If a critical platform failed tomorrow, not breached, just failed, could the business keep operating? Could the critical services it provides keep functioning? The paper processes and theoretical exercises always existed, but never in a way that could forecast the cascading impacts.

The internet itself offers a better model. It was engineered to survive the loss of any individual node. Routes break and traffic finds another path. Organizations need that same architectural quality, and so does the interconnected infrastructure that sits on top of them. The goal can’t be preventing every compromise. It has to ensure that no single failure cascades into systemic disruption that takes critical services offline across industries. This sets the priority. You can’t audit your way to that. You have to build it.

The external pressures are converging on this conclusion. Insurance is becoming harder to buy at meaningful coverage levels and carriers are grappling with correlated risk they can’t yet price. Regulators are pushing accountability to the C-suite. Boards want evidence of survivability, not maturity scores. And the scope of what “cybersecurity” is expected to protect keeps expanding, from AI and enterprise data to operational technology to the critical infrastructure communities depend on.

The industry built an economy around demonstrating that organizations are secure. It is optimized for audits, certifications and framework alignment. What it never solved for was proving that an organization, and the infrastructure around it, can absorb serious disruption and keep running. That is the seam that matters most.

Digital transformation didn’t just increase each organization’s attack surface. It wove those surfaces together into an emergent network of interdependency that spans sectors and borders. The question every security and risk leader should be asking themselves is no longer whether their controls are sufficient. It’s whether they are, along with their programs or offerings, aligned to a sustainable future, or holding together an increasingly heavy past.
This article is published as part of the Foundry Expert Contributor Network.
Want to join?


View the full article
CSOonline

New ClickFix variant bypasses Apple safeguards with one‑click script execution

ClickFix malware campaigns are evolving again, with threat actors removing one of their most obvious and user‑dependent steps: convincing victims to paste malicious commands into Terminal. Instead, the latest variant uses a single browser click to trigger script execution, streamlining the infection chain and reducing user hesitation.
Researchers at Jamf Threat Labs have identified a new macOS campaign that launches Apple’s native Script Editor directly from the browser, preloaded with malicious code. The technique abuses the applescript:// URL scheme to open Script Editor automatically, sidestepping Terminal entirely and delivering Atomic Stealer payloads with far less friction.
“Script Editor has a well-documented history as a malware delivery mechanism, so its presence here isn’t
surprising,” the researchers said in a blog post. “What is notable is its role in this ClickFix campaign and the fact that it was invoked via a URL scheme.”
The payload isn’t new. It’s Atomic Stealer, a credential-harvesting strain commonly deployed in macOS-focused campaigns.
Apple drops protection, attackers go around it
Conventionally, ClickFix chains relied on social engineering to get users to paste obfuscated commands into Terminal. Apple’s recent protections introduced scanning and prompts around pasted commands, adding restrictions to disrupt that flow.
This campaign routes around it.
Victims are directed to an Apple-themed page posing as a system fix or cleanup guide. Instead of copying anything, they click a button that invokes an applescript:// URL. That action opens Script Editor with a pre-populated script, ready to execute.
By not directing the user to interact with the Terminal, the attacker has removed a decision point that Apple enforced with macOS Tahoe 26.4. “Apple took direct aim at this in macOS 26.4, introducing a security feature that scans commands pasted into Terminal before they’re executed,” the researchers added. “It’s a meaningful friction point, but as this campaign illustrates, when one door closes, attackers find another.”
Script Editor is a native macOS utility and doesn’t carry the same immediate suspicion as Terminal for non-experienced users. However, there is still some non-targeted resistance to this technique.
The researchers pointed out that the behavior of the Script Editor may vary depending on the macOS version. “On recent versions of macOS Tahoe, an additional warning prompt is presented, requiring the user to allow the script to be saved to disk before execution,” they said.
Lightweight staging for Atomic Stealer
Once executed, the AppleScript resolves to an obfuscated shell command. That command decodes a hidden URL, retrieves a remote payload using ‘curl’, and executes it via ‘zsh’. From here, standard info-stealing takes over with a ‘Mach-O’ binary written to a temporary location, its attributes adjusted, permissions set, and execution triggered.

This binary is a new variant of the Atomic Stealer.
The researchers noted that the staging approach keeps the initial script minimal and less detectable, while the actual malicious logic arrives separately. It is modular, quick to update, and harder to catch at the first stage.
Atomic Stealer’s objectives are consistent with earlier macOS infostealer campaigns, which focused on harvesting browser credentials, saved passwords, crypto wallet data, and developer artifacts. Previous reporting has shown that such stealers rarely operate in isolation, as exfiltrated data is almost always funneled into credential reuse attacks and account takeovers.
View the full article
CSOonline

What Is an Autonomous SOC? A Practical Guide for IT Leaders

Security operations is changing because the volume, velocity, and complexity of modern threats are outpacing what manual workflows can sustain. An autonomous SOC gives IT and security leaders a new operating model where AI-driven triage, investigation, and orchestration reduce repetitive work while preserving human oversight. In this blog, we break down what an autonomous SOC really means, where most organizations are today, and how to evaluate the shift with clarity.
View the full article
compuquip

The Hidden Security Risks of Shadow AI in Enterprises

As AI tools become more accessible, employees are adopting them without formal approval from IT and security teams. While these tools may boost productivity, automate tasks, or fill gaps in existing workflows, they also operate outside the visibility of security teams, bypassing controls and creating new blind spots in what is known as shadow AI. While similar to the phenomenon ofView the full article
Hacker News

Apple Subpoenas Samsung in South Korea Over DOJ Antitrust Case

Apple has asked a U.S. court to formally request internal Samsung documents from South Korea as part of discovery in the DOJ's ongoing antitrust lawsuit against the company.


The DOJ filed suit against Apple in March 2024, alongside a number of governments, alleging the company used App Store rules, developer restrictions, and control over key iPhone features to stifle competition. After Apple's bid to have the case dismissed failed, the litigation moved into discovery.

Samsung is central to the case. All four complaints identify Samsung as Apple's "closest smartphone competitor," and plaintiffs allege that Apple's conduct caused Samsung to stop making smartwatches that connect to iPhone in 2021. Apple subpoenaed Samsung's U.S. subsidiary, Samsung Electronics America, for documents, but the subsidiary declined to produce any records, arguing the materials are held solely by its South Korean parent. Apple says Samsung America lodged that objection 65 times across its responses.

In a memorandum filed on April 7, Apple asked the court to issue a formal letter of request under the Hague Evidence Convention, an international mechanism that allows civil proceedings to seek documents from foreign entities. The request targets market research, sales data, financial statements, and consumer switching analyses from Samsung's smartphone and wearables divisions, as well as Galaxy Store developer agreements and documents relating to Samsung Pay, messaging apps, and super apps.

Apple pointed specifically to Smart Switch, Samsung's tool for transferring content from iPhone to a Samsung device, as evidence that the company holds directly relevant data on consumer switching behavior. The filing also seeks Samsung's own documents on its digital wallet fees, after plaintiffs alleged Apple charges banks 0.15% per Apple Pay transaction while Samsung charges nothing comparable.

Even if the court grants the motion, South Korean authorities would independently decide whether to comply, and Samsung Electronics could raise objections under Korean law.Tags: Apple Antitrust, Apple Lawsuits, Samsung, South Korea, United States
This article, "Apple Subpoenas Samsung in South Korea Over DOJ Antitrust Case" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

Adobe Reader Zero-Day Exploited via Malicious PDFs Since December 2025

Threat actors have been exploiting a previously unknown zero-day vulnerability in Adobe Reader using maliciously crafted PDF documents since at least December 2025. The finding, detailed by EXPMON's Haifei Li, has been described as a highly-sophisticated PDF exploit. The artifact ("Invoice540.pdf") first appeared on the VirusTotal platform on November 28, 2025. A second View the full article
Hacker News

Bitter-Linked Hack-for-Hire Campaign Targets Journalists Across MENA Region

An apparent hack-for-hire campaign likely orchestrated by a threat actor with suspected ties to the Indian government targeted journalists, activists, and government officials across the Middle East and North Africa (MENA), according to findings from Access Now, Lookout, and SMEX. Two of the targets included prominent Egyptian journalists and government critics, MostafaView the full article
Hacker News

Patch windows collapse as time-to-exploit accelerates

The gap between vulnerability disclosure and exploitation is drastically decreasing, putting security teams’ patching practices on notice.
According to Rapid7’s latest Cyber Threat Landscape Report, confirmed exploitation of newly disclosed high- and critical-severity vulnerabilities (CVSS 7-10) increased 105% year to 146 in 2025, up from 71 in 2024.
Moreover, the median time from vulnerability publication to CISA Known Exploited Vulnerabilities (KEV) inclusion dropped from 8.5 days to 5.0 days, with mean time-to-exploit dropping from 61.0 days to 28.5 days. Zero-day exploits have also been hitting enterprises faster and harder, according to a recent report from Google Threat Intelligence Group.
The result is a threat ecosystem that sees twice as many high-impact flaws exploited in half the time — a troubling development for cyber defense.
Cybercrime industrial complex
Industrialization of the cybercrime ecosystem and increased abuse of AI tools to find and exploit vulnerabilities are key drivers of the increased pace of vulnerability exploitation, according to Rapid7 and other industry observers quizzed by CSO.
“Initial access brokers now sell directly to ransomware groups, creating a clear incentive to weaponize new vulnerabilities, harvest credentials, and monetize access,” says Stephen Fewer, senior principal researcher at Rapid7, the firm behind the popular Metasploit penetration-testing tool. “This has accelerated both the pace and sophistication of their operations.”
For attackers, familiarity with the target and the technologies involved can greatly reduce the challenge of developing exploits — a factor that is driving repeated exploitation of many enterprise software targets.
AI adoption is another important factor in the increased pace of vulnerability discovery and exploitation because it facilitates the process of uncovering software bugs.
“It [AI] enables threat actors to close skill gaps and significantly increases operational throughput,” Fewer says. “In practice, AI provides a tactical advantage in analyzing newly disclosed vulnerabilities and generating exploit code at speed.”
N-day exploitation
Rapid7 Labs validated its findings about a more febrile threat environment by producing both n-day and zero-day exploits using AI-assisted research, substantially reducing development time.
In practice, n-day bugs — or the development of exploits against patched software — are a bigger problem than headline-grabbing zero-day vulnerabilities, adds Leeann Nicolo, incident response lead at Coalition, a technology firm that specializes in cyber insurance and cybersecurity tools.
“Our incident response team hasn’t seen a lot of zero-day vulnerabilities exploited lately. Instead, threat actors are hitting known issues that already have patches,” Nicolo says.
Other industry experts confirmed that Rapid7’s findings reflect what they too are seeing on the ground.
“The patch window has effectively collapsed,” says Chris Wysopal, co-founder and chief security evangelist at application security firm Veracode. “That is not a gradual trend; it’s a structural break.”
One driver for the increased pace of exploitation is that every patch now acts like a roadmap for attackers, Wysopal says.
“Once a fix ships, attackers can differentiate the patch, isolate the vulnerable code path, and use automation and AI to generate working exploit paths far faster than enterprises can test and deploy the fix,” says Wysopal. “In other words, disclosure increasingly starts the race, and defenders are already behind when the starting gun fires.”
In addition, AppSec debt widens the exposure window even when a patch exists.
“Enterprises are still carrying too much legacy code, too many internet-facing dependencies, and too many fragile change processes to remediate at machine speed,” Wysopal says. “If the organization needs days or weeks to inventory exposure, assess blast radius, test, get approvals, and deploy, then it is operating on a calendar while attackers are operating on a clock.”
Another big issue is the industrialization of vulnerability exploitation.
AI compresses exploit development and lowers the skill barrier, while the cybercrime market removes friction by creating a well-oiled production line that incorporates researchers, brokers, access sellers, botnet operators, and ransomware affiliates.
“[This] assembly-line model means more vulnerabilities move from disclosure to usable attack paths almost immediately,” according to Wysopal.
Secure-by-design imperative
The real response to these challenges ought to be in reducing the amount of exploitable software reaching production in the first place rather than encouraging CISOs to “patch faster.”
Secure-by-design engineering, aggressive pre-release testing by top-tier bug hunters, architectural mitigations that shrink whole bug classes, and the ability to rebuild or isolate exposed systems quickly are all necessary but perhaps insufficient.
The old assumption that defenders get a grace period after disclosure is no longer credible, according to Wysopal.
“We are watching the collapse of the traditional patch window in real-time,” Wysopal emphasizes. “Secure by design is the only sustainable response, because once disclosure happens, the attacker’s clock is already ticking.”
View the full article
CSOonline

Weak at the seams

Before I ever held a security title, I was a software engineer implementing vertically integrated automation systems for industrial manufacturing, warehouse-scale conveyor networks, robotic material handling, physical infrastructure controlled by software on increasingly connected networks. I learned early that tightly coupled systems produce tightly coupled failures. When a single software fault could halt a distribution center, you designed for graceful degradation. You assumed components would break and built the system to absorb it.
That instinct followed me into cybersecurity and eventually into CISO roles across healthcare, financial services and global manufacturing. These industries operate under different regulatory regimes, face different threat profiles and define risk in different terms. But in every one of them, I encountered the same structural problem: Cyber risk wasn’t governed as a unified discipline. It was adopted piecemeal by systems that already existed, product markets, regulators, auditors, insurers and boards, each building frameworks on its own timeline, in its own language, toward its own definition of “secure.” The pattern rhymes with early actuarial science, where separate branches of insurance each modeled risk in isolation before discovering that correlated losses were the real threat.
Within any individual silo, the logic was sound. But the seams between them were never reconciled. Where one system’s blind spot becomes another’s unpriced exposure, there was no shared language to name it. And as digital transformation has accelerated the interconnection between industries, supply chains and critical infrastructure, those seams have widened into the actual modern risk surface.
We are spending more and falling further behind
In every security program I’ve led, the budget could have ballooned year over year. My approach was always the opposite: Aggressively reduce tool proliferation and capability overlap, simplify the architecture and tie every dollar to a measurable business outcome. Timing and intent. But even with that discipline, the distance between what we spent and what we were exposed to widened, because technological change was rendering our tools and assumptions obsolete faster than we could replace them. The industry-level numbers confirm this isn’t anecdotal. Gartner projected global security spending would exceed $212 billion in 2025. The economic impact of cybercrime, by most estimates, has surpassed $10 trillion annually. Those curves are diverging, not converging.
I first felt this acutely in healthcare. As CISO at a global benefits administrator processing sensitive health data for millions of members, I operated under HIPAA, state-level privacy mandates and contractual obligations from plan sponsors. We could satisfy every audit and still know the real risk lived in the handoffs, the interfaces between our claims platform and external provider networks, data flowing between systems governed by different standards. The auditors checked their boxes. The seams went unmeasured.
Later, leading global security engineering at a major asset management firm, I saw the same gap in financial services. Different controls, different regulators, identical blind spot. The fragmentation was even more visible internationally. Regional regulatory bodies, data sovereignty requirements that varied by jurisdiction, vendor ecosystems that differed across geographies. Every regulator had its own definition of adequate security. None described the interconnected reality we were defending. Researchers at the Federal Reserve have documented how the financial system’s exposure to correlated cyber events is growing in ways that traditional risk models weren’t built to capture. I lived that gap daily.
What connected these experiences was a pattern in the insurance market that troubled me more than any single threat. I watched premiums soften even as breach frequency and severity climbed. Insurers were underwriting individual, uncorrelated incidents while the actual risk was becoming systemic. Digital transformation had stitched these industries together: Healthcare platforms connected to financial clearinghouses connected to manufacturing supply chains all connected to hyperscalers, but the actuarial models still treated each policyholder as an island. When a single vendor failure can cascade across thousands of organizations simultaneously, that pricing model stops making sense. A black swan is lurking in our digital pond.
The normal choices are the dangerous ones
Consider the stack a typical large enterprise was running in 2024: One vendor for ERP and supply chain, another for perimeter enforcement, another for networking and another for endpoint protection. Standard choices, responsibly made. Within a twelve-month window, each of those categories experienced significant disruptions, from zero-day exploits to update failures that disrupted global operations. Any single event was survivable. The accumulation was something else entirely.
I lived this as a Global CISO. My team planned for sequential crises with recovery time between them. What we got was overlapping disruptions across interdependent systems. One week, we were triaging an emergency patch on our perimeter while a second advisory was escalating on a different platform. The assumption that these events would arrive one at a time, that we’d have breathing room, turned out to be a planning fiction. When you are sustaining the operation itself, crises expose the seams in real time.
A firewall vulnerability isn’t just a network issue when the ERP behind it processes every financial transaction. An endpoint agent failure isn’t just a security tool outage when it takes down the operating systems running your logistics. These platforms don’t fail in isolation because they don’t operate in isolation. Increasingly, neither do the industries that depend on them. A disruption to a cloud provider ripples through healthcare systems processing claims, financial institutions settling trades and manufacturers coordinating supply chains on the same platform.
The July 2024 CrowdStrike incident made this impossible to dismiss. A routine content update, no attacker, no exploit, bricked millions of Windows systems worldwide. Airlines grounded flights. Hospitals diverted patients. Financial services went dark. The protective tool itself became the failure vector. That should have ended the debate about whether cybersecurity is a technical problem contained within organizational boundaries or a systemic risk that spans them.
My background in industrial automation made this grimly familiar. In material handling, we knew the integration layer was the highest-risk surface. We designed systems assuming any component could fail and built degradation paths so the operation didn’t stop. Enterprise cybersecurity had somehow convinced itself that assembling best-of-breed tools was the same as building a resilient system. It isn’t. And as digital transformation pushes more critical infrastructure, from energy grids and water systems to transportation networks and medical devices, onto the same interconnected platforms, the consequences of that confusion multiply.
Resilience is a design problem, not a compliance problem
Across healthcare, financial services and manufacturing, I watched the same pattern. The compliance apparatus measured whether controls existed. It rarely measured whether the organization, or the broader infrastructure it depended on, could survive its failure. In healthcare, we demonstrate compliance while knowing our resilience to a coordinated supply-chain attack is largely untested. In financial services, we pass examinations while the insurers underwriting our risk price off the same compliance signals the examiners accept — and neither captures the systemic interdependencies between our platforms and our counterparties. In manufacturing, we secure the IT network while operational technology controlling physical processes is increasingly exposed through the same digital transformation the business is accelerating. We are weak at the seams.
The question that followed me from role to role was simple: If a critical platform failed tomorrow, not breached, just failed, could the business keep operating? Could the critical services it provides keep functioning? The paper processes and theoretical exercises always existed, but never in a way that could forecast the cascading impacts.
The internet itself offers a better model. It was engineered to survive the loss of any individual node. Routes break and traffic finds another path. Organizations need that same architectural quality, and so does the interconnected infrastructure that sits on top of them. The goal can’t be preventing every compromise. It has to ensure that no single failure cascades into systemic disruption that takes critical services offline across industries. This sets the priority. You can’t audit your way to that. You have to build it.
The external pressures are converging on this conclusion. Insurance is becoming harder to buy at meaningful coverage levels and carriers are grappling with correlated risk they can’t yet price. Regulators are pushing accountability to the C-suite. Boards want evidence of survivability, not maturity scores. And the scope of what “cybersecurity” is expected to protect keeps expanding, from AI and enterprise data to operational technology to the critical infrastructure communities depend on.
The industry built an economy around demonstrating that organizations are secure. It is optimized for audits, certifications and framework alignment. What it never solved for was proving that an organization, and the infrastructure around it, can absorb serious disruption and keep running. That is the seam that matters most.
Digital transformation didn’t just increase each organization’s attack surface. It wove those surfaces together into an emergent network of interdependency that spans sectors and borders. The question every security and risk leader should be asking themselves is no longer whether their controls are sufficient. It’s whether they are, along with their programs or offerings, aligned to a sustainable future, or holding together an increasingly heavy past.
This article is published as part of the Foundry Expert Contributor Network.
Want to join?
View the full article
CSOonline

So geht Post-Incident Review

dotshock | shutterstock.com
Angenommen, Ihr Unternehmen wird von Cyberkriminellen angegriffen, kommt dabei aber mit einem blauen Auge davon, weil die Attacke zwar spät, aber noch rechtzeitig entdeckt und abgewehrt werden konnte – ohne größeren Business Impact. Jetzt einfach wie bisher weiterzumachen und die Sache zu vergessen, wäre allerdings kontraproduktiv. Schließlich haben die Angreifer einen Weg gefunden, Ihre Systeme zu kompromittieren und dabei Abwehrmaßnahmen zu umgehen.
Deshalb ist an dieser Stelle ein Post-Incident Review essenziell: Ein strukturierter Prozess, in dessen Rahmen das Unternehmen analysiert,  
was gut gelaufen ist, was nicht, und wie die Performance in Zukunft verbessert werden kann. Das klingt erst einmal simpel – allerdings gilt es einige wichtige Dinge zu beachten, um eine robuste Post-Incident-Review-Strategie zu entwickeln. Welche das sind, haben wir im Gespräch mit verschiedenen Sicherheitsexperten herausgearbeitet.
1. Zeitnah handeln
Nicht nur wenn es um die Analyse geht, ist Timing bei Security Incidents von entscheidender Bedeutung. Lassen Sie erst einmal Wochen oder Monate ins Land ziehen, bevor Sie ein Post-Incident Review anberaumen, steigt das Risiko, dass wichtige Elemente in Vergessenheit geraten – und Sicherheitsentscheider und ihre Teams sich kein vollständiges Bild von dem Angriff mehr machen können.  
David Taylor, Managing Director bei der IT-Beratung Protiviti, rät deshalb dazu, möglichst zeitnah tätig zu werden: “Ein Review kurz nach einem Incident gewährleistet, dass alle Details noch frisch in den Köpfen sind und vermittelt zudem ein Gefühl von Dringlichkeit”. Zudem könnten die Review-Beteiligten auf diese Weise auch eine akkurate Timeline der Ereignisse erarbeiten, so der Chefberater.   
Wie diese Timeline ausgestaltet werden sollte, weiß Heather Clauson Haughian, Mitbegründerin und geschäftsführende Partnerin der auf Datenschutz spezialisierten Anwaltskanzlei CM Law: “Zunächst gilt es, festzuhalten, was genau passiert ist – von den ersten Anzeichen eines Problems bis hin zu seiner Bewältigung.”
Das unterstütze alle Beteiligten dabei, nachzuvollziehen, an welchen Stellen es zu Verzögerungen oder Fehlern gekommen ist – und an welchen nicht. “Es geht im Grunde darum, den Vorfall in eine verständliche ‚Story‘ zu gießen und daraus entsprechende Lehren zu ziehen”, erklärt die Rechtsexpertin.
2. Ursachenanalyse fahren
Pflichtbestandteil eines Post-Incident Reviews ist zudem eine Ursachenanalyse (auch Root Cause Analysis) – zumindest wenn Ihnen daran gelegen ist, künftige Incidents zu verhindern.
Dieser Überzeugung ist auch Michael Brown, Field CISO beim IT-Dienstleister Presidio: “Die Grundursache eines Vorfalls zu identifizieren, ist essenziell. Die Teams müssen herausfinden, ob es sich dabei um eine technische Schwachstelle, menschliches Versagen oder Prozess- beziehungsweise Technologielücken handelt. Nur so lässt sich sicherstellen, dass nicht nur Symptome behandelt werden.”
3. Lücken identifizieren
Ein Post-Incident Review sollte darüber hinaus auch beinhalten, die Performance des Sicherheitsteams mit Blick auf etablierte Prozesse (etwa den Incident-Response-Plan) zu evaluieren. Das ist laut Protiviti-Manager Taylor unerlässlich, um die Team-Fähigkeiten sukzessive zu verbessern: “Es kann wertvolle Informationen für innovative Optimierungen liefern, Schulungslücken identifizieren und Ineffizienzen in der Reaktionsphase beseitigen.”
Presidio geht diesbezüglich mit gutem Beispiel voran, wie Field CISO Brown verrät: “Im Rahmen unserer Post-Incident Reviews bewerten wir die Leistung unseres Incident-Response-Teams in unterschiedlichen Bereichen – etwa Detection, Reaktionszeit, Kommunikation, Koordination oder Prozesstreue.”
4. Business Impact analysieren
Die Auswirkungen eines Sicherheitsvorfalls vollumfänglich zu durchdringen, ist eine vielschichtige Angelegenheit, die sowohl quantitative als auch qualitative Analysen umfassen sollte. Ersteres sollte laut Sicherheitsentscheider Brown beispielsweise Aspekte wie finanzielle Einbußen, verlorene Marktanteile oder Kundenaufträge beinhalten.
Zweiteres sich hingegen mit Fragen befassen wie:
Wurde die Business Continuity nachhaltig beeinträchtigt? Wurden die zuständigen Behörden rechtzeitig informiert? Sind Reputationsschäden entstanden? 5. Kontext erfassen
Ein weiterer Schlüsselfaktor für Post-Incident-Analysen ist außerdem der Kontext des Sicherheitsvorfalls. Ihn zu erfassen, ist entscheidend, wenn es darum geht, eine Timeline für den Incident aufzusetzen, aus der alle Beteiligten lernen können.
“Allzu oft wird bei Nachbesprechungen der Kontext, in dem Entscheidungen getroffen wurden, übersprungen”, kritisiert Security-Forscher Eireann Leverett und ergänzt: “Dokumentieren Sie den Vorfall so, wie er sich entwickelt hat – nicht nur das Ergebnis. Incidents entwickeln sich im Zeitverlauf – und das Team, das diesen bearbeitet, kann selten vorab auf sämtliche Fakten zugreifen.”
Jede neue Entdeckung – etwa mit Blick auf das Einfallstor für den Angriff, seinen Scope oder die von den Angreifern verwendeten Tools, könnten die Untersuchungsziele des Teams verändern, so Leverett: “Was als Containment-Vorhaben beginnt, kann schnell zum umfänglichen Recovery-Projekt ausarten. Nur wenn Sie tracken, wann und warum Veränderungen stattgefunden haben, ist später auch nachvollziehbar, welche Maßnahmen ergriffen wurden.”
6. Abteilungsübergreifend kollaborieren
Ein Post-Incident Review zu leiten, ist Sache des CISO – oder anderer Security- oder IT-Führungskräfte. Allerdings ist es empfehlenswert, auch Personen aus anderen Abteilungen einzubinden, die potenziell Insights beitragen können. So empfiehlt etwa Sicherheitsexperte Leverett, das Post-Incident-Team um Kollegen aus den Bereichen Governance, Recht und Risikomanagement zu erweitern: “Diese können die Grundursache des Incidents möglicherweise mit allgemeinen, breiter angelegten Richtlinienlücken in Verbindung bringen.”
Sinnvoll ist nach Meinung von Leverett außerdem, die Finanz- und Personalabteilung einzubinden, sowie – je nach Art und Schwere des Vorfalls – auch Vorstandsmitglieder. Letzteres signalisiere eine strategische Priorisierung und unterstütze dabei, technische Erkenntnisse mit Risiko-Diskussionen auf Governance-Ebene zu verknüpfen, ist der Experte überzeugt.
“Wichtig ist dabei, dass alle Beteiligten gleichberechtigt zu Wort kommen – unabhängig von ihrer Position oder Rolle”, ergänzt Protiviti-Mann Taylor. Das trage nicht nur dazu bei, Security-Vorfälle besser zu durchdringen, sondern etabliere auch ein kooperatives Umfeld.
7. Schuldzuweisungen vermeiden
Im Rahmen eines Post-Incident Reviews “Fingerpointing” zu betreiben, ist mit hoher Wahrscheinlichkeit nicht produktiv. Deshalb empfiehlt auch IT-Anwältin Haughian, den Fokus darauf zu legen, zu lernen und zu optimieren: “Schuldzuweisungen bringen Sie nicht weiter. Es gilt, den tatsächlichen Ablauf der Ereignisse aufzudecken, Entscheidungsprozesse zu verstehen und alle Faktoren zu identifizieren, die zu Fehlern beigetragen haben. Dieser Ansatz kann dabei helfen, künftige strategische Entscheidungen in Zusammenhang mit Tools, Schulungen und Richtlinien zu treffen.”
Auch Leverett hält nichts von einer Kultur der Schuldzuweisung: “Es geht nicht darum, ob ein bestimmtes Individuum die richtige Entscheidung getroffen hat oder nicht. Vielmehr gilt es Fragen zu klären wie: ‚War das Team unter den gegebenen Umständen in der Lage, gute Entscheidungen zu treffen?‘ Oder: ‚Hätten eine bessere Dokumentation, andere Tools oder mehr Budget für schnellere und bessere Ergebnisse gesorgt?‘”
8. Aktiv werden
Sämtliche Erkenntnisse, die im Rahmen eines Post-Incident Reviews gewonnen werden, sind relativ nutzlos, wenn im Nachgang nichts passiert. Soll heißen: Den Erkenntnissen müssen konkrete Maßnahmen folgen.  
Um das bestmöglich umzusetzen, empfiehlt Rechtsexpertin Haughian, schriftlich genau festzuhalten, an welchen Stellen optimiert werden muss, wann das geschehen soll und wer dafür verantwortlich zeichnet: “Diese Verbesserungen können etwa Softwareaktualisierungen, Richtlinienänderungen oder neue Schulungsinitiativen sein. Unabhängig davon macht diese Nachbereitung ein Post-Incident Review erst wirklich nützlich. Bleibt sie aus, entfallen damit auch umsetzbare Empfehlungen – und das Ganze ist nicht mehr als eine akademische Übung”, hält die Datenschutzexpertin fest. (fm)
Sie wollen weitere interessante Beiträge rund um das Thema IT-Sicherheit lesen? Unser kostenloser Newsletter liefert Ihnen alles, was Sicherheitsentscheider und -experten wissen sollten, direkt in Ihre Inbox.
View the full article
CSOonline

So geht Post-Incident Review

dotshock | shutterstock.com
Angenommen, Ihr Unternehmen wird von Cyberkriminellen angegriffen, kommt dabei aber mit einem blauen Auge davon, weil die Attacke zwar spät, aber noch rechtzeitig entdeckt und abgewehrt werden konnte – ohne größeren Business Impact. Jetzt einfach wie bisher weiterzumachen und die Sache zu vergessen, wäre allerdings kontraproduktiv. Schließlich haben die Angreifer einen Weg gefunden, Ihre Systeme zu kompromittieren und dabei Abwehrmaßnahmen zu umgehen.
Deshalb ist an dieser Stelle ein Post-Incident Review essenziell: Ein strukturierter Prozess, in dessen Rahmen das Unternehmen analysiert,  
was gut gelaufen ist, was nicht, und wie die Performance in Zukunft verbessert werden kann. Das klingt erst einmal simpel – allerdings gilt es einige wichtige Dinge zu beachten, um eine robuste Post-Incident-Review-Strategie zu entwickeln. Welche das sind, haben wir im Gespräch mit verschiedenen Sicherheitsexperten herausgearbeitet.
1. Zeitnah handeln
Nicht nur wenn es um die Analyse geht, ist Timing bei Security Incidents von entscheidender Bedeutung. Lassen Sie erst einmal Wochen oder Monate ins Land ziehen, bevor Sie ein Post-Incident Review anberaumen, steigt das Risiko, dass wichtige Elemente in Vergessenheit geraten – und Sicherheitsentscheider und ihre Teams sich kein vollständiges Bild von dem Angriff mehr machen können.  
David Taylor, Managing Director bei der IT-Beratung Protiviti, rät deshalb dazu, möglichst zeitnah tätig zu werden: “Ein Review kurz nach einem Incident gewährleistet, dass alle Details noch frisch in den Köpfen sind und vermittelt zudem ein Gefühl von Dringlichkeit”. Zudem könnten die Review-Beteiligten auf diese Weise auch eine akkurate Timeline der Ereignisse erarbeiten, so der Chefberater.   
Wie diese Timeline ausgestaltet werden sollte, weiß Heather Clauson Haughian, Mitbegründerin und geschäftsführende Partnerin der auf Datenschutz spezialisierten Anwaltskanzlei CM Law: “Zunächst gilt es, festzuhalten, was genau passiert ist – von den ersten Anzeichen eines Problems bis hin zu seiner Bewältigung.”
Das unterstütze alle Beteiligten dabei, nachzuvollziehen, an welchen Stellen es zu Verzögerungen oder Fehlern gekommen ist – und an welchen nicht. “Es geht im Grunde darum, den Vorfall in eine verständliche ‚Story‘ zu gießen und daraus entsprechende Lehren zu ziehen”, erklärt die Rechtsexpertin.
2. Ursachenanalyse fahren
Pflichtbestandteil eines Post-Incident Reviews ist zudem eine Ursachenanalyse (auch Root Cause Analysis) – zumindest wenn Ihnen daran gelegen ist, künftige Incidents zu verhindern.
Dieser Überzeugung ist auch Michael Brown, Field CISO beim IT-Dienstleister Presidio: “Die Grundursache eines Vorfalls zu identifizieren, ist essenziell. Die Teams müssen herausfinden, ob es sich dabei um eine technische Schwachstelle, menschliches Versagen oder Prozess- beziehungsweise Technologielücken handelt. Nur so lässt sich sicherstellen, dass nicht nur Symptome behandelt werden.”
3. Lücken identifizieren
Ein Post-Incident Review sollte darüber hinaus auch beinhalten, die Performance des Sicherheitsteams mit Blick auf etablierte Prozesse (etwa den Incident-Response-Plan) zu evaluieren. Das ist laut Protiviti-Manager Taylor unerlässlich, um die Team-Fähigkeiten sukzessive zu verbessern: “Es kann wertvolle Informationen für innovative Optimierungen liefern, Schulungslücken identifizieren und Ineffizienzen in der Reaktionsphase beseitigen.”
Presidio geht diesbezüglich mit gutem Beispiel voran, wie Field CISO Brown verrät: “Im Rahmen unserer Post-Incident Reviews bewerten wir die Leistung unseres Incident-Response-Teams in unterschiedlichen Bereichen – etwa Detection, Reaktionszeit, Kommunikation, Koordination oder Prozesstreue.”
4. Business Impact analysieren
Die Auswirkungen eines Sicherheitsvorfalls vollumfänglich zu durchdringen, ist eine vielschichtige Angelegenheit, die sowohl quantitative als auch qualitative Analysen umfassen sollte. Ersteres sollte laut Sicherheitsentscheider Brown beispielsweise Aspekte wie finanzielle Einbußen, verlorene Marktanteile oder Kundenaufträge beinhalten.
Zweiteres sich hingegen mit Fragen befassen wie:
Wurde die Business Continuity nachhaltig beeinträchtigt? Wurden die zuständigen Behörden rechtzeitig informiert? Sind Reputationsschäden entstanden? 5. Kontext erfassen
Ein weiterer Schlüsselfaktor für Post-Incident-Analysen ist außerdem der Kontext des Sicherheitsvorfalls. Ihn zu erfassen, ist entscheidend, wenn es darum geht, eine Timeline für den Incident aufzusetzen, aus der alle Beteiligten lernen können.
“Allzu oft wird bei Nachbesprechungen der Kontext, in dem Entscheidungen getroffen wurden, übersprungen”, kritisiert Security-Forscher Eireann Leverett und ergänzt: “Dokumentieren Sie den Vorfall so, wie er sich entwickelt hat – nicht nur das Ergebnis. Incidents entwickeln sich im Zeitverlauf – und das Team, das diesen bearbeitet, kann selten vorab auf sämtliche Fakten zugreifen.”
Jede neue Entdeckung – etwa mit Blick auf das Einfallstor für den Angriff, seinen Scope oder die von den Angreifern verwendeten Tools, könnten die Untersuchungsziele des Teams verändern, so Leverett: “Was als Containment-Vorhaben beginnt, kann schnell zum umfänglichen Recovery-Projekt ausarten. Nur wenn Sie tracken, wann und warum Veränderungen stattgefunden haben, ist später auch nachvollziehbar, welche Maßnahmen ergriffen wurden.”
6. Abteilungsübergreifend kollaborieren
Ein Post-Incident Review zu leiten, ist Sache des CISO – oder anderer Security- oder IT-Führungskräfte. Allerdings ist es empfehlenswert, auch Personen aus anderen Abteilungen einzubinden, die potenziell Insights beitragen können. So empfiehlt etwa Sicherheitsexperte Leverett, das Post-Incident-Team um Kollegen aus den Bereichen Governance, Recht und Risikomanagement zu erweitern: “Diese können die Grundursache des Incidents möglicherweise mit allgemeinen, breiter angelegten Richtlinienlücken in Verbindung bringen.”
Sinnvoll ist nach Meinung von Leverett außerdem, die Finanz- und Personalabteilung einzubinden, sowie – je nach Art und Schwere des Vorfalls – auch Vorstandsmitglieder. Letzteres signalisiere eine strategische Priorisierung und unterstütze dabei, technische Erkenntnisse mit Risiko-Diskussionen auf Governance-Ebene zu verknüpfen, ist der Experte überzeugt.
“Wichtig ist dabei, dass alle Beteiligten gleichberechtigt zu Wort kommen – unabhängig von ihrer Position oder Rolle”, ergänzt Protiviti-Mann Taylor. Das trage nicht nur dazu bei, Security-Vorfälle besser zu durchdringen, sondern etabliere auch ein kooperatives Umfeld.
7. Schuldzuweisungen vermeiden
Im Rahmen eines Post-Incident Reviews “Fingerpointing” zu betreiben, ist mit hoher Wahrscheinlichkeit nicht produktiv. Deshalb empfiehlt auch IT-Anwältin Haughian, den Fokus darauf zu legen, zu lernen und zu optimieren: “Schuldzuweisungen bringen Sie nicht weiter. Es gilt, den tatsächlichen Ablauf der Ereignisse aufzudecken, Entscheidungsprozesse zu verstehen und alle Faktoren zu identifizieren, die zu Fehlern beigetragen haben. Dieser Ansatz kann dabei helfen, künftige strategische Entscheidungen in Zusammenhang mit Tools, Schulungen und Richtlinien zu treffen.”
Auch Leverett hält nichts von einer Kultur der Schuldzuweisung: “Es geht nicht darum, ob ein bestimmtes Individuum die richtige Entscheidung getroffen hat oder nicht. Vielmehr gilt es Fragen zu klären wie: ‚War das Team unter den gegebenen Umständen in der Lage, gute Entscheidungen zu treffen?‘ Oder: ‚Hätten eine bessere Dokumentation, andere Tools oder mehr Budget für schnellere und bessere Ergebnisse gesorgt?‘”
8. Aktiv werden
Sämtliche Erkenntnisse, die im Rahmen eines Post-Incident Reviews gewonnen werden, sind relativ nutzlos, wenn im Nachgang nichts passiert. Soll heißen: Den Erkenntnissen müssen konkrete Maßnahmen folgen.  
Um das bestmöglich umzusetzen, empfiehlt Rechtsexpertin Haughian, schriftlich genau festzuhalten, an welchen Stellen optimiert werden muss, wann das geschehen soll und wer dafür verantwortlich zeichnet: “Diese Verbesserungen können etwa Softwareaktualisierungen, Richtlinienänderungen oder neue Schulungsinitiativen sein. Unabhängig davon macht diese Nachbereitung ein Post-Incident Review erst wirklich nützlich. Bleibt sie aus, entfallen damit auch umsetzbare Empfehlungen – und das Ganze ist nicht mehr als eine akademische Übung”, hält die Datenschutzexpertin fest. (fm)
Sie wollen weitere interessante Beiträge rund um das Thema IT-Sicherheit lesen? Unser kostenloser Newsletter liefert Ihnen alles, was Sicherheitsentscheider und -experten wissen sollten, direkt in Ihre Inbox.
View the full article
CSOonline

iOS 26.4.1 Includes These Two Changes for iPhones

Apple today released a minor iOS 26.4.1 update for the iPhone 11 and newer. While the release notes for the update only mention unspecified "bug fixes," we have since learned about two specific changes that are included in it.


First, 9to5Mac spotted an Apple Developer Forums thread suggesting that iOS 26.4.1 fixes an iOS 26.4 bug that affected iCloud syncing in some apps.

Second, an enterprise-focused Apple support document indicates that Stolen Device Protection will be automatically enabled on iPhones that update from iOS 26.4 to iOS 26.4.1. This likely applies to devices that are managed by a workplace/organization, as iOS 26.4 already turned on the feature by default for regular users.

Introduced in iOS 17.3, Stolen Device Protection adds an additional layer of security in the event someone has stolen your iPhone and also knows the device's passcode. The feature is designed to reduce instances of thieves spying on an iPhone user's passcode before stealing the device, often in public places like bars.

When the feature is turned on, Face ID or Touch ID authentication is required for more actions than usual on an iPhone, including viewing passwords or passkeys stored in iCloud Keychain, applying for a new Apple Card, turning off Lost Mode, erasing all content and settings, using payment methods saved in Safari, and more. No passcode fallback is available in the event that the user is unable to complete Face ID or Touch ID authentication.

For especially sensitive actions, including changing the password of the Apple ID account associated with the iPhone, the feature adds a security delay on top of biometric authentication. In these cases, the user must authenticate with Face ID or Touch ID, wait one hour, and authenticate with Face ID or Touch ID again. However, there is no delay when the iPhone is in familiar locations, such as at home or work.

Prior to iOS 26.4, Stolen Device Protection was turned off by default on all iPhones. It can be turned on in the Settings app under Face ID & Passcode.Related Roundups: iOS 26, iPadOS 26Tag: iCloudRelated Forums: iOS 26, Apple Music, Apple Pay/Card, iCloud, Fitness+
This article, "iOS 26.4.1 Includes These Two Changes for iPhones" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

Apple Now Selling Parts for Seven New Devices Unveiled Last Month

Launched in 2022, Apple's self-service repair program provides customers with access to genuine parts, tools, and manuals to repair select iPhones, iPads, Macs, Studio Displays, and Beats Pill speakers. Apple says the program is "intended for individuals who are experienced with the complexities of repairing electronic devices."


Apple today started selling parts and tools for seven new devices through its self-service repair store in the U.S., Canada, and many European countries.

As reported by 9to5Mac, genuine Apple parts are now available for these devices:iPhone 17e
iPad Air with M4 chip
MacBook Neo
MacBook Air with M5 chip
MacBook Pro with M5 Pro and M5 Max chips
Studio Display (2026)
Studio Display XDRAfter ordering parts and tools, you can follow the steps in Apple's repair manuals for each device.

There is a notable piece of news related to this. As we reported last month, the MacBook Neo's keyboard can be replaced individually.


For years, replacing the keyboard in other MacBooks has required replacing the entire Top Case, which refers to the top half of the aluminum shell surrounding the keyboard. For example, the latest MacBook Air has a "Top Case with Keyboard" part, and the latest MacBook Pro models have a "Top Case with Battery and Keyboard" part.

For the MacBook Neo, there are separate Keyboard, Keyboard with Touch ID, and Top Case parts, and Apple shows how to replace the keyboard individually. While there are still more than 40 screws involved to replace the keyboard on its own, the process is much easier than replacing an entire Top Case, which requires lots of disassembly.

Best of all, the MacBook Neo's individual keyboard part starts at just $140 on Apple's self-service repair store in the U.S., whereas the Top Case with Keyboard for MacBook Air and MacBook Pro models costs around $400 to $600.Related Roundups: iPhone 17e, Studio Display, MacBook Neo, MacBook Pro, MacBook AirTag: Self Service RepairBuyer's Guide: iPhone 17e (Buy Now), Displays (Buy Now), MacBook Neo (Buy Now), MacBook Pro (Buy Now), MacBook Air (Buy Now)Related Forums: Mac Accessories, MacBook Neo, MacBook Pro, MacBook Air
This article, "Apple Now Selling Parts for Seven New Devices Unveiled Last Month" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

Questions raised about how LinkedIn uses the petabytes of data it collects

Through LinkedIn’s more than one billion business users, the Microsoft unit has access to a vast array of personally-identifiable information, including data that could identify religious and political positions. What is less clear is what LinkedIn does with all of that data.
A small European company that sells a browser extension to leverage different aspects of LinkedIn data is running a campaign, which it calls BrowserGate, that accuses LinkedIn of “illegally searching your computer” and “running one of the largest corporate espionage operations in modern history.” 
“Every time any of LinkedIn’s one billion users visits linkedin.com, hidden code searches their computer for installed software, collects the results, and transmits them to LinkedIn’s servers and to third-party companies including an American-Israeli cybersecurity firm,” the company claimed.
“The user is never asked. Never told. LinkedIn’s privacy policy does not mention it,” the BrowserGate site said. “Because LinkedIn knows each user’s real name, employer, and job title, it is not searching for anonymous visitors. It is searching identified people at identified companies.”
LinkedIn denies some of those accusations, and avoids addressing the remainder. 
“This [accusation] is a house of cards built entirely upon a fabrication,” said a LinkedIn statement emailed to CSOonline. “We do disclose that we scan for browser extensions in our privacy policy, in order to detect abuse and provide defense for site stability.” 
When asked whether it uses that data solely to do those things, LinkedIn did not reply.
Possible misuse
The key person behind the allegations calls himself Steven Morrell (not his legal name, which he asked CsoOnline to not publish). The company he represents also has different names, including Teamfluence and Fairlinked. 
Morrell said that LinkedIn is gathering data that includes sensitive details, including information that he argued could be used to determine religious and political leanings. Gathering such data, Morrell said, could violate European privacy rules.
But Morrell is not saying that LinkedIn is in fact using the data to determine those preferences, but merely that they could. Much the same could be said for almost all large companies.
Morell isn’t exactly unbiased, however. He and LinkedIn are also involved in a legal dispute in Germany, in which Morrell said that LinkedIn violated EU rules and that it improperly kicked him, and others, off the service.
LinkedIn countered that Morell and the other plaintiffs had violated its terms of service with their plugins. Last month, a judge in Munich sided with LinkedIn, dismissing the motion for a preliminary injunction.
Might cause compliance issues
Safayat Moahamad, research director at Info-Tech Research Group, said that compliance approaches throughout the European Union and the UK could indeed have some issues with this deep a level of data collection. 
“European courts are likely to support platforms that restrict automated data harvesting, when they can plausibly link organization-level policy enforcement actions to consumer protection and regulatory compliance,” Moahamad said.
Advice for CIOs
Cybersecurity consultant Brian Levine, executive director of FormerGov, said enterprise CIOs should use these allegations, even if they prove to be untrue, to help them tweak their data strategy and privacy policies for 2026.
“Assuming the BrowserGate allegations are true, LinkedIn users should consider reducing the amount of identifiable, trackable, or sensitive data their browser exposes, and organizations should treat LinkedIn as a potentially hostile web environment until facts are verified,” Levine said. “Even if BrowserGate is exaggerated, browser fingerprinting is a real, widespread practice across the web. Treat LinkedIn like any other third-party data collector. LinkedIn has historically been treated as safe, [but] that assumption may need to be revisited.”
Levine said IT executives should “assume that LinkedIn can map your tech stack” and that, if the claims are accurate, LinkedIn could infer “which SaaS tools your employees use, which competitors you rely on, which job search tools your staff is using and which political/religious extensions appear inside your workforce.”
He added that IT should consider blocking LinkedIn on sensitive networks, or require it to only be accessed through VDI, as well as employing browser isolation techniques. Some companies might even want to use a separate isolated browser solely for LinkedIn, or, he said, “use a sandboxed browser session, such as Browserling or other cloud-isolated browsers.”
View the full article
CSOonline

Apple Releases Safari Technology Preview 241 With Bug Fixes and Performance Improvements

Apple today released a new update for Safari Technology Preview, the experimental browser that was first introduced in March 2016 and just marked its tenth anniversary. Apple designed ‌Safari Technology Preview‌ to allow users to test features that are planned for future release versions of the Safari browser.


‌Safari Technology Preview‌ 241 includes fixes and updates for Accessibility, Animations, CSS, Canvas, Forms, HTML, Images, JavaScript, MathML, Media, Networking, Printing, Rendering, SVG, Storage, Web API, Web Inspector, and WebRTC.

The current ‌Safari Technology Preview‌ release is compatible with machines running macOS Sequoia and macOS Tahoe, the newest version of macOS.

The ‌Safari Technology Preview‌ update is available through the Software Update mechanism in System Preferences or System Settings to anyone who has downloaded the browser from Apple's website. Complete release notes for the update are available on the Safari Technology Preview website.

Apple's aim with ‌Safari Technology Preview‌ is to gather feedback from developers and users on its browser development process. ‌Safari Technology Preview‌ can run side-by-side with the existing Safari browser and while it is designed for developers, it does not require a developer account to download and use.

Tag: Safari Technology Preview
This article, "Apple Releases Safari Technology Preview 241 With Bug Fixes and Performance Improvements" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

Two Apple Stores in U.S. and Australia Will Soon Be Temporarily Closed

Apple Victoria Gardens in Rancho Cucamonga, California will be temporarily closed for renovations starting the evening of Saturday, April 11.

Apple Victoria Gardens in Rancho Cucamonga, California
The store will reopen in the fall, according to a notice on Apple's website spotted by MacRumors reader Kate. No specific date was provided, but Apple will likely aim to resume business ahead of iPhone 18 Pro launch day in September.

In the meantime, Apple will be opening a temporary store elsewhere at Victoria Gardens, in a unit that was most recently occupied by activewear retailer Athleta. The address for the temporary store is 12501 N Mainstreet, Suite 3610.

Apple Victoria Gardens first opened in September 2004.

Apple Chermside outside of Brisbane, Australia will also be temporarily closed starting Wednesday, April 29, with Apple inviting customers to visit nearby stores in the meantime. Apple has not provided a specific reason for this store's closure, but it is likely another renovation project. The location first opened in November 2009.

In addition, Apple Trumbull in Connecticut and Apple Towson Town Center in Maryland will be opening at 12:30 p.m. Eastern Time this Thursday, April 9. It is unclear exactly why these locations are opening a few hours later than usual, but it is our understanding that at least one of the stores might simply be holding an employee meeting.Tag: Apple Store
This article, "Two Apple Stores in U.S. and Australia Will Soon Be Temporarily Closed" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

Anthropic's AI to Help Apple Find iOS, macOS, and Safari Vulnerabilities

Anthropic on Tuesday announced Project Glasswing, a new initiative that will enable tech companies to use its new AI model Mythos Preview to find and fix security vulnerabilities or weaknesses across operating systems and web browsers.


Mythos Preview has already found thousands of zero-day vulnerabilities, including some in every major operating system and web browser, according to Anthropic.

"AI models have reached a level of coding capability where they can surpass all but the most skilled humans at finding and exploiting software vulnerabilities," said Anthropic. "Given the rate of AI progress, it will not be long before such capabilities proliferate, potentially beyond actors who are committed to deploying them safely."

"Project Glasswing is an urgent attempt to put these capabilities to work for defensive purposes," added the company.

Mythos Preview will not be available to the public. Instead, Anthropic said use of the model will be limited to selected partners, with the initial group beyond Anthropic itself including Apple, Amazon Web Services, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA, and Palo Alto Networks.


Anthropic is committing up to $100 million in usage credits for Mythos Preview. Beyond that, partners will have to pay to use the AI model.

Launch partners like Apple will use Mythos Preview as part of their defensive security work, according to Anthropic. This means Apple may use the AI model to help find and fix security vulnerabilities across its Safari web browser and operating systems, which includes iOS, iPadOS, macOS, watchOS, tvOS, and visionOS. Apple is also rumored to be developing a homeOS operating system for a new smart home hub.Tags: Anthropic, Apple Security
This article, "Anthropic's AI to Help Apple Find iOS, macOS, and Safari Vulnerabilities" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

Apple Releases iOS 26.4.1 and iPadOS 26.4.1 With Bug Fixes

Apple today released iOS 26.4.1 and iPadOS 26.4.1, minor updates to the iOS 26 and iPadOS 26 operating systems.


The new software can be downloaded on eligible iPhones and iPads over-the-air by going to Settings > General > Software Update.

According to Apple's release notes, the software updates contain unspecified "bug fixes."

Apple is already beta testing iOS 26.5 and iPadOS 26.5, the next versions of ‌iOS 26‌ that will likely launch later in April or in May.Related Roundups: iOS 26, iPadOS 26Related Forum: iOS 26
This article, "Apple Releases iOS 26.4.1 and iPadOS 26.4.1 With Bug Fixes" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

iPhone Ultra's Price Range Revealed

Apple reportedly plans to unveil its long-awaited foldable iPhone in September, and Bloomberg's Mark Gurman has revealed the device's supposed price range.

Apple's foldable iPhone is rumored to be named iPhone Ultra
In a report this week, Gurman said the foldable iPhone is expected to "cross the $2,000 threshold" in the U.S., although it is unclear if he is referring to the starting price or if only some configurations will surpass that price point.

In any case, the foldable iPhone will undoubtedly be the most expensive iPhone ever. Currently, Apple's most expensive iPhone model is the iPhone 17 Pro Max, which costs $1,999 in the U.S. when configured with a maximum 2TB of storage.

If the foldable iPhone does start at $1,999, the device might cost as much as $2,799 with 2TB of storage, based on iPhone 17 Pro Max price tiers.

It was recently rumored that the foldable iPhone will be named iPhone Ultra. Apple already uses Ultra branding for the Apple Watch Ultra, CarPlay Ultra, and the M1 Ultra, M2 Ultra, and M3 Ultra series of chips for the Mac Studio.

The foldable iPhone is expected to open up like a book, providing users with a large screen for watching videos, playing games, and multitasking. The device will reportedly have a 7.7-inch inner display and a 5.3-inch outer display, two rear cameras, one front camera, and a Touch ID power button instead of Face ID. It was initially rumored that the device would have a virtually "crease-free" inner display, but it was later reported that Apple is using technology that "reduces the crease without eliminating it entirely."
Related Roundup: iPhone FoldTags: Bloomberg, iPhone Ultra, Mark Gurman
This article, "iPhone Ultra's Price Range Revealed" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

Reclaim Developer Hours through Smarter Vulnerability Prioritization with Docker and Mend.io

We recently announced the integration between Mend.io and Docker Hardened Images (DHI) provides a seamless framework for managing container security. By automatically distinguishing between base image vulnerabilities and application-layer risks, it uses VEX statements to differentiate between exploitable vulnerabilities and non-exploitable vulnerabilities, allowing your team to prioritize what really matters.
TL;DR: The Developer Value Proposition
The hallmark of this integration is its zero-configuration setup.
Automatic Detection: Mend.io identifies DHI base images automatically upon scanning. No manual tagging or configuration is required by the developer. Visual Indicators: Within the Mend UI, DHI-protected packages are marked with a dedicated Docker icon and informative tooltips, providing immediate transparency into which components are managed by Docker’s hardened foundation. Transparent Layers: Users can inspect findings by package, layer, and risk factor, ensuring a clear audit trail from the base OS to the custom application binaries.
Dynamic Risk Triage: VEX + Reachability
Standard scanners flag thousands of vulnerabilities that are present in the file system but never executed. This integration uses two layers of intelligence to filter the noise:
Risk Factor Integration: Mend.io incorporates Docker’s VEX (Vulnerability Exploitability eXchange) data as a primary source of “Risk Factor” identification. The “Not Affected” Filter: If a CVE is marked as not_affected by Docker’s VEX data or determined to be Unreachable by Mend’s analysis, it is deprioritized. Bulk Suppression: Developers can suppress non-functional risks in bulk—potentially clearing thousands of non-exploitable vulnerabilities with a single click—allowing teams to focus on the 1% of reachable, exploitable risks in their custom layers.
Operationalizing Security with Workflows
Mend.io allows organizations to move beyond simple scanning into automated governance:
SLA & Violation Management: Automatically trigger violations and set remediation deadlines (SLAs) based on vulnerability severity. Custom Alerts: Configure workflows to receive instant notifications (via email or Jira) whenever a new DHI is added to the environment. Pipeline Gating: Use Mend’s workflow engine to fail builds only when high-risk, reachable vulnerabilities are introduced in custom code, keeping the CI/CD pipeline moving.
Continuous Patching & AI-Assisted Migration
Automated Synchronization: For Enterprise DHI users, patched base images are automatically mirrored to Docker Hub private repositories. Mend.io verifies these updates, confirming that base-level risks have been mitigated without requiring a manual Pull Request. Ask Gordon: Leverage Docker’s AI agent to analyze existing Dockerfiles and recommend the most suitable DHI foundation, reducing the friction of migrating legacy applications to a secure environment. The Mend.io and Docker integration operationalizes this by providing an auditable trail of security declarations, ensuring compliance is a byproduct of the standard development workflow rather than a separate, manual task.
Learn more
Learn more about the integration and Docker’s VEX statements in the following links:
Check Docker Hardened Images documentation: https://docs.docker.com/dhi/  Start your free Docker Hardened Image trial: https://hub.docker.com/hardened-images/start-free-trial Read Mend’s point of view on the benefits of VEX: https://www.mend.io/blog/benefits-of-vex-for-sboms/

View the full article
reporter

Arelion employs NETSCOUT Arbor DDoS protection products

Arelion operates the world’s best-connected IP fiber backbone, providing high-capacity transit services to a variety of the globe’s leading ISPs as well as many large enterprises. They provide an award-winning customer experience to clients in 129 countries worldwide, and their global Internet services connect more than 700 cloud, security, and content providers with low-latency transit. Furthermore, Arelion’s private Cloud Connect service connects directly to Amazon Web Services, Microsoft Azure, Google Cloud, IBM Cloud, and Oracle Cloud across North America, Europe, and Asia.
The challenge
To get a clearer picture of their current DDoS protection infrastructure, Arelion reached out to NETSCOUT®, which had been providing DDoS protection with NETSCOUT Arbor Sightline and the Threat Mitigation System (TMS) for over 16 years. Arelion wanted a better understanding of the efficiency of the system and how it was bringing value to their internal security strategy as well as the protection services for their customers.
Once NETSCOUT provided the required information regarding the infrastructure and configuration of their current product portfolio, the project manager initiated a research activity to gain clarity on what new developments and solutions in the DDoS space could be implemented to enhance the DDoS protection of internal systems as well as the offering they provide to their customers. The goal for this action was to increase the efficiency of the DDoS protection both internally and for their customer base.
“As a Tier-1 Internet carrier supporting the majority of global Internet traffic, this continued collaboration reflects our ongoing investment in best-of-breed network security solutions to protect the technology ecosystem. Our partnership combines Arelion’s global network performance and NETSCOUT’s leading Arbor DDoS attack protection solutions to provide world-class experiences for our customers.” – Scott Nichols, Chief Commercial Officer at Arelion
The solution
Once Arelion completed its due diligence in the effort to gain more clarity around the current DDoS protection landscape, the NETSCOUT team initiated conversations regarding improvements in the NETSCOUT DDoS defense capabilities, including threat intelligence, mitigation orchestration, automation and reporting. The team also helped Arelion see the value that these capabilities could provide to their internal security teams, but more importantly, to their protection services customers. The NETSCOUT team introduced Arelion to three new offerings that provided the emphasized capabilities that they had identified during the discovery process to improve the DDoS protection for them and their customers.
The first product introduced was an add-on to Sightline called Sentinel. Sightline with Sentinel understands the capabilities of the routers and other security devices in the security stack within Arelion’s multi-vendor infrastructure and uses the capabilities of those devices (i.e., flowspec and other technologies) in combination with TMS to orchestrate defenses to automatically mitigate any DDoS attack, regardless of size and complexity, stopping them nearer to their source. This feature spreads the mitigation load of large volumetric attacks over all potential system mitigation capabilities, lightening the load across the entire system.
The second offering NETSCOUT suggested was the ATLAS Intelligence Feed (AIF) for TMS. AIF taps into the best threat intelligence offered in the DDoS space, which provides deterministically accurate and actionable Threat Intelligence to enhance DDoS detection at every level of Arelion’s network. As cyber threats continue to increase in frequency and sophistication, mature security teams will not only rely on the latest cybersecurity technology but also on the highly curated threat intelligence that arms these products. NETSCOUT’s unmatched monitoring of over 50% of all internet traffic, our AI-powered analysis processes, and the expertise of NETSCOUT’s ASERT Team have enabled NETSCOUT to automatically arm all NETSCOUT Arbor DDoS attack protection products with the latest DDoS attack tactics and methodologies, known sources of DDoS attacks, and Indicators of Compromise so organizations, such as Arelion, can protect themselves and their customers from DDoS attacks and other cyber threats and automatically adapt protections as those attacks change vectors.
The third offering NETSCOUT suggested, Adaptive DDoS protection (ADP), adds significant automation and targets newly detected attacks that require changes to configurations to mitigate. Once an attack is detected and classified, AI-driven intelligence determines the optimal mitigation strategy—whether via RTBH, BGP, Flowspec, ACLs, or TMS. The attack is continually monitored, and mitigations are adapted in real-time as the attack evolves, ensuring that mitigation strategies remain effective even as attackers shift tactics. This combination of intelligence, detection, and automation provides significantly improved protection against carpet bombing attacks. The faster aggregate detection, as well as automation of mitigations on selected subnets and hosts within the targeted network, keeps external services and internal protections active while not over-mitigating. This intelligent, automated, and adaptive approach ensures that Arelion’s team stays ahead of increasingly sophisticated DDoS threats with minimal manual effort and maximum efficiency.
This expanded partnership enables Arelion to support the network security requirements of its customers amid rising attacks on critical infrastructure. By enhancing its capabilities with NETSCOUT, Arelion improves network security across its #1-ranked global Internet backbone, empowering enterprise customers with resilient, high-performance connectivity services.

“Financial services, government, utilities, and other vital sectors are experiencing increased risk from more sophisticated and frequent DDoS attacks, reinforcing the need
for comprehensive DDoS protection,” stated Darren Anstee, chief security technologist,
NETSCOUT. “Our latest DDoS Threat Intelligence Report echoes Arelion’s experience
of increasing numbers of application-layer and volumetric attacks, as well as greater
attack sophistication. This partnership will help Arelion enhance the protection it can
provide to enterprises facing more frequent cyberattacks on their businesses.”
The results
Arelion has experienced an increase in visibility into their network, meaning they can protect their internal systems and their customers’ critical business applications and services against all types of attacks. This also gives them confidence in adopting all types of customers, no matter if it is the largest service providers or a multi-homed enterprise.

Overarching benefit
Arelion believes that to provide proven and trusted DDoS protection to their customers, they needed to do two things. First was to partner with a world-class DDoS defense organization, and second was to project confidence in the chosen solution and strategy by employing it internally to protect their systems. The partnership with NETSCOUT and its proven DDoS protection products and threat intelligence provides Arelion and its customers with the confidence that their systems are protected by a best-of-breed DDoS-specific solution. Arelion customers value their services more because of the trust they have in the collaboration between Arelion and NETSCOUT.
Learn more
For more information about NETSCOUT’s Arbor DDoS Protection Solutions visit: https://www.netscout.com/arbor

View the full article
CSOonline

6 Winter 2026 G2 Leader Badges prove this DDoS protection stands out

NETSCOUT’s Arbor Threat Mitigation System (TMS) was honored with five badges, while Arbor Sightline earned one badge on G2 for the winter 2026 quarter. These badges span multiple categories. Arbor TMS was awarded badges in the following categories for winter 2026:
Leader – Enterprise DDoS Protection Momentum Leader – DDoS Protection Regional Leader (Asia) – DDoS Protection Leader – DDoS Protection Leader – Web Security Arbor Sightline was also recognized as a leader in enterprise network management.
NETSCOUT
What NETSCOUT Customers Are Saying About TMS
“The Arbor Threat Mitigation System allows us to defend not only our internal systems, but our customers.— Darren G.”
“NETSCOUT delivers unmatched network visibility and carrier-grade DDoS protection, ideal for large enterprises and service providers that need real-time insights, forensic analysis, and hybrid/cloud coverage. — Bruno O.”
“The constant evolution of the Arbor Threat Mitigation System in conjunction with the cybersecurity market would also make me consider it again in the future. — Mauro L.”
Evaluation criteria
These badges were earned from a criteria that relies heavily on positive user reviews from real, verified NETSCOUT customers. The experience users have had with TMS and Sightline, paired with the market presence of NETSCOUT, have led to further recognition as leading solutions in the DDoS protection and network management marketplace.
Validating NETSCOUT’s experience in the industry
The decades of experience NETSCOUT Arbor DDoS solutions have in the industry is validated by our customer feedback. The industry-leading DDoS protection solutions, powered by artificial intelligence/machine learning (AI/ML), take the guesswork out of mitigating DDoS attacks. With automated defenses and unparalleled threat intelligence from its ATLAS Intelligence Feed (AIF), NETSCOUT protects the largest, most complex networks from the latest advanced DDoS threats.
Learn more:
Read customer reviews for Arbor Threat Mitigation System on G2. Read customer reviews for Arbor Sightline on G2. See how Arbor Threat Mitigation System and Arbor Sightline can protect you from DDoS attacks.
View the full article
CSOonline

New Chaos Variant Targets Misconfigured Cloud Deployments, Adds SOCKS Proxy

Cybersecurity researchers have flagged a new variant ofmalware called Chaosthat'scapable of hitting misconfigured cloud deployments, marking an expansion of the botnet's targeting infrastructure. "Chaos malware is increasingly targeting misconfigured cloud deployments, expanding beyond its traditional focus on routers and edge devices," Darktrace said in a new report.View the full article
Hacker News

How botnet-driven DDoS attacks evolved in 2H 2025

The second half of 2025 marked a pivotal shift in the world of distributed denial-of-service (DDoS) attacks. Organizations across the globe faced a perfect storm: Artificial intelligence (AI) matured as an offensive weapon, botnet infrastructure reached new heights with multiterabit attack capacity, and DDoS-for-hire services became more accessible—even to nontechnical adversaries.
NETSCOUT’s ATLAS global threat intelligence platform, which monitored more than 8 million DDoS attacks in 203 countries and territories during this period, reveals a threat landscape where the line between intent and capability has all but disappeared. Attacks reaching up to 30 terabits per second are now possible, and conversational AI interfaces are guiding even unskilled attackers through complex operations.
Executive summary
Between July and December 2025, the number of DDoS attacks remained steady compared to the first half of the year—but the nature of these attacks changed dramatically:
Massive attack capacity: Demonstration attacks peaked at 30Tbps and 4 gigapackets per second, primarily launched by Internet of Things (IoT) botnets such as Aisuru and TurboMirai variants. AI integration: The use of AI, including dark-web large language models (LLMs), moved from emerging trend to operational reality, making sophisticated attacks accessible to a wider range of threat actors. Persistent threat actors: Despite international law enforcement efforts, hacktivist groups and commodity botnets maintained high pressure. For example, NoName057(16) claimed more than 200 attacks in July alone, showing resilience even after infrastructure seizures.
Critical infrastructure under pressure: DNS root servers and Network Time Protocol (NTP) services faced relentless attacks, with more than 45,000 NTP-related alerts. Well-architected systems proved resilient, but the persistence of threats was clear. Targeted sectors and regions: Government, finance, telecom, transportation, and hospitality were the most targeted sectors. Regionally, EMEA led with 3.3 million attacks, followed by APAC, North America, and Latin America. The latter half of 2025 was not just an evolutionary step, but a fundamental shift in who can launch sophisticated DDoS attacks, how quickly they adapt, and the scale of impact they can achieve.
Key findings
1. Global scale and attack volume
More than 8 million DDoS attacks were recorded across 203 countries and territories, highlighting the persistent and growing operational risk for digitally connected organizations worldwide. The attack count remained stable compared to the first half of the year, but the nature and sophistication of attacks changed dramatically. 2. Rise of IoT botnets and outbound risk
Massive direct-path attacks in 2025 demonstrated that compromised customer-premises equipment (CPE) can generate outbound floods exceeding 1Tbps, creating significant liability and service-availability risks for broadband providers. The TurboMirai class of IoT botnets, including Aisuru and Eleven11 (RapperBot), emerged as a major force, capable of launching attacks up to 30Tbps and 4Gpps. Eleven11 alone was linked to more than 3,600 DDoS events between 2021 and mid-2025. 3. AI-enhanced DDoS-for-hire services
DDoS-for-hire platforms are now integrating dark-web LLMs and conversational AI, lowering the technical barrier for launching complex, multivector attacks.
Even unskilled threat actors can now orchestrate sophisticated campaigns using natural-language prompts, increasing risk for all industries. 4. Threat actor collaboration and scale
July 2025 saw a surge of more than 20,000 botnet-driven attacks, with coordinated threat activity overwhelming defenses and disrupting essential services in government, finance, and transportation. Groups such as Keymous+ demonstrated how partnerships between threat actors can amplify attack power, with collaborative events reaching up to 44Gbps. 5. Critical infrastructure under sustained pressure
High-value services such as DNS root servers and NTP faced continuous attack pressure. At least 38 significant DNS root events were recorded, including a 21Gbps flood against the A root server. More than 45,000 NTP-related attack alerts were generated, underscoring the need for resilient, globally distributed architectures and robust mitigation strategies. 6. Geographic and sectoral targeting
The most targeted sectors were government agencies, financial services, telecommunications, transportation, and hospitality. Regionally, EMEA led with 3.3 million attacks, followed by APAC (1.9 million), North America (1.27 million), and Latin America (1.01 million). 7. Multivector and carpet-bombing attacks
More than half of all attacks were multivector, with 42 percent using two to five vectors. Carpet-bombing attacks increased, averaging between 750 and 830 per day in the latter half of 2025. Attackers frequently blended methods such as DNS amplification, SSDP, SNMP, mDNS, memcached, CLDAP, and mixed TCP floods to maximize disruption. 8. Defensive successes and ongoing challenges
Well-architected systems, especially those using anycast-based defenses, demonstrated resilience and maintained high availability despite continuous attack pressure. However, the persistence of vulnerable devices and the rapid adaptation of threat actors mean that organizations must remain vigilant and proactive in their defense strategies. Conclusion
The DDoS threat landscape in late 2025 was defined by sustained global attack volume, increasingly capable IoT botnets, sophisticated threat-actor campaigns, and a decisive move toward AI-enhanced DDoS-for-hire operations. Although the largest attacks remain rare, they continue to shape defensive strategies. The average attack is now short, intense, and multisector, targeting a wide range of industries and geographies.
Organizations must recognize that the democratization of attack tools, especially with AI integration, has lowered the barrier to entry for cybercriminals. Defending against these threats requires not just robust infrastructure, but also adaptive, intelligence-driven strategies that can keep pace with the evolving tactics of adversaries.
To learn more, read NETSCOUT’s 2H 2025 DDoS Threat Intelligence Report
View the full article
CSOonline

Get Massive Discounts on Apple Watch Solo/Braided Loops at Woot

Woot this week is back with a massive sale on Solo Loop and Braided Solo Loop bands for Apple Watch, with prices that match the previous record low Woot deals on these bands.

Note: MacRumors is an affiliate partner with Woot. When you click a link and make a purchase, we may receive a small payment, which helps us keep the site running.

You can get the Solo Loop for just $14.99 ($34 off) and the Braided Solo Loop for $29.99 ($69 off). All bands in this sale are in brand new condition and come with a one-year Apple limited warranty.

UP TO 70% OFFApple Watch Bands at Woot

Woot has reorganized the sale for 2026, with shoppers choosing their size before color this time around. Woot has size 1-12 of the Solo Loop and Braided Solo Loop available, but color and style availability varies within each size category.

Shoppers should note that this sale is focused on colors of the Braided Solo Loop and Solo Loop that Apple has stopped selling, and it doesn't include any of the new band colors. That being said, all of the bands in this sale are in new condition.

The sale is mainly focused on Solo Loop and Braided Solo Loop Apple Watch bands, so you'll need to know the size that works best for you before you buy. Apple has a measurement tool on its website that you can use to determine your exact size.

If you're on the hunt for more discounts, be sure to visit our Apple Deals roundup where we recap the best Apple-related bargains of the past week.



Deals Newsletter

Interested in hearing more about the best deals you can find in 2026? Sign up for our Deals Newsletter and we'll keep you updated so you don't miss the biggest deals of the season!




Related Roundup: Apple Deals
This article, "Get Massive Discounts on Apple Watch Solo/Braided Loops at Woot" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

Astropad Workbench Lets You Remotely Control Your Mac and AI Agents From iPhone and iPad

Astropad, the company behind the popular Astropad Studio software for turning the iPad into a drawing tablet, today launched a new app called Astropad Workbench. Astropad Workbench is a remote desktop app designed for the Mac, and more specifically, built for use with AI.


With Astropad Workbench, you can control your AI agents remotely, which makes it useful for people who have set up a Mac mini as a personal server for use with OpenClaw and other AI agent features.

Astropad says that it created Workbench to help users monitor their AI agents from anywhere, without being tied to a desk. There are native apps for Mac, ‌iPad‌, and iPhone, so the iPhone and ‌iPad‌ are able to interface with the Mac desktop wherever you are.

It's simple to check logs and output to verify agent work, restart failed tasks, or reconnect to long-running jobs. There are also tools for switching between multiple Macs connected to a Workbench account.

Workbench offers high-fidelity streaming with a unified virtual display, low latency, speech-to-text input, and multiple control options from gestures to keyboard, mouse, and Apple Pencil. Setup is quick and easy without the need for network configurations, and AES-256 encryption is included. No display recordings are captured and saved.

New users are able to connect to Workbench for free for 20 minutes of daily access. Unlimited paid plans are priced at $10 per month or $50 per year. More information on Workbench can be found on Astropad's website.Tag: Astropad
This article, "Astropad Workbench Lets You Remotely Control Your Mac and AI Agents From iPhone and iPad" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

Cybersec Europe

Name : National Cyber Security Show
Website: https://shorturl.at/61nXS /
Date: May 21-22, 2025
Location: Brussels Expo, Hall 5, Brussels, Belgium
Opening hours: 09:00 – 18:00 CET
Cybersec Europe 2026 brings together cybersecurity professionals, innovators, and decision-makers for two days of knowledge sharing, networking, and business opportunities. The event highlights the latest developments in cybersecurity, from emerging threats and AI-driven defense to supply chain security and resilience in an increasingly connected world.
Visitors can explore a diverse exhibition floor featuring leading cybersecurity companies and solution providers. Through live demos, expert-led sessions, and real-world use cases, exhibitors showcase how organizations can strengthen their security posture and prepare for tomorrow’s challenges.
In addition to the exhibition, the conference program offers insights from industry experts, thought leaders, and practitioners. Topics range from risk management and compliance to cloud security, OT security, and the human factor in cybersecurity. These sessions provide practical takeaways and strategic perspectives for organizations of all sizes.
Cybersec Europe 2026 will take place on 20–21 May at Brussels Expo. The event serves as a key meeting place for the cybersecurity community to connect, exchange ideas, and discover solutions that help secure the digital future. Register for free!
Book Now The post Cybersec Europe appeared first on CISO MAG | Cyber Security Magazine.
View the full article
CISOmag

iPhone Air 2 and iPhone 18e Reportedly Launching Early Next Year

Apple plans to release an updated iPhone Air and a lower-end iPhone 18e early next year, according to the latest word from Bloomberg's Mark Gurman.


In a report this week, he said Apple plans to unveil the two devices in spring 2027, alongside a standard iPhone 18. If so, Apple will likely announce the trio of devices in March or April next year. It is unclear if there will be a live-streamed event.

Given the iPhone 16e and the iPhone 17e were unveiled in the first quarter of 2025 and 2026, respectively, it is no surprise that an iPhone 18e will follow around the first quarter of next year. However, it is notable that a new iPhone Air and the standard iPhone 18 will apparently be introduced at the same time.

The current iPhone Air and the standard iPhone 17 debuted in September last year, but several reports have indicated that Apple is moving to more of a split launch going forward, with multiple iPhone models arriving in spring and fall.

Here is when each new iPhone model is expected to launch:September 2026: iPhone 18 Pro, iPhone 18 Pro Max, and iPhone Ultra
March 2027: iPhone 18e, iPhone 18, and iPhone Air 2Apple's plans for a split launch have been reported on for many months, so this is nothing new. However, there have been conflicting reports about exactly when the iPhone Air 2 will be released, so Gurman's spring 2027 timeframe provides clarity.

The iPhone 18e and the iPhone 18 will likely receive an A20 chip and little else, while the next iPhone Air is rumored to feature an A20 chip, a second rear camera, a larger battery, and the iPhone 17 Pro's vapor chamber cooling system.

According to a leaker on the Chinese social media platform Weibo, Apple even plans to release an iPhone Air 3 eventually, even though sales of the current iPhone Air have reportedly been low relative to the iPhone 17 and iPhone 17 Pro.Related Roundups: iPhone 18, iPhone Air, iPhone FoldTags: Bloomberg, iPhone 18e, Mark GurmanBuyer's Guide: iPhone Air (Buy Now)Related Forum: iPhone
This article, "iPhone Air 2 and iPhone 18e Reportedly Launching Early Next Year" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

Masjesu Botnet Emerges as DDoS-for-Hire Service Targeting Global IoT Devices

Cybersecurity researchers have lifted the curtain on a stealthy botnet that's designed for distributed denial-of-service (DDoS) attacks. Called Masjesu, the botnet has been advertised via Telegram as a DDoS-for-hire service since it first surfaced in 2023. It's capable of targeting a wide range of IoT devices, such as routers and gateways, spanning multiple architectures. "Built forView the full article
Hacker News

2024 iPad Mini vs. 2026 iPad Air Buyer's Guide: 20+ Differences Compared

Earlier this year, Apple debuted the eighth-generation iPad Air, featuring the M4 chip. Today's iPad mini is approaching two years old, but with just $100 between them, which should you choose?


The new ‌iPad Air‌ is a minor iteration on last year's M3 model, adding more unified memory, Apple's N1 wireless chip, Wi-Fi 7, Bluetooth 6, and an Apple C1X modem. In 2024, Apple introduced the seventh-generation ‌iPad mini‌, offering the A17 Pro chip, Apple Intelligence support, 8GB of memory, Apple Pencil Pro and ‌Apple Pencil‌ hover support, and more.

The ‌iPad mini‌ effectively shares the design of the ‌iPad Air‌, with both devices possessing many of the same features such as an all-screen design with no Home button, Touch ID in the top button, and stereo speakers. Despite theoretically being different product lines, the ‌iPad mini‌ and ‌iPad Air‌ are almost identical in terms of specifications and are even available in the same color options. There are still some differences between the devices, such as their display sizes and chips, that set the devices apart.

Should you buy the more expensive, larger ‌iPad Air‌, or opt for the smaller and more affordable ‌iPad mini‌? Our guide helps to answer the question of how to decide which of these two iPads is best for you. All of the differences between the two devices are listed below:



‌iPad mini‌ (seventh generation, 2024)
‌iPad Air‌ (eighth generation, 2026)


8.3-inch display with 326 ppi
11-inch or 13-inch display with 264 ppi


500 nits max SDR brightness
11-inch: 500 nits max SDR brightness
13-inch: 600 nits max SDR brightness


Smaller, compact design for maximum portability
Larger design, better for productivity


Weighs 0.66 pounds (297 grams)
11-inch: Weighs 1.02 pounds (462 grams)
13-inch: Weighs 1.36 pounds (617 grams)


A17 Pro chip (introduced with iPhone 15 Pro in 2023, made with TSMC's 3nm N3 process)
M4 chip (introduced with the iPad Pro in 2024, made with TSMC's enhanced ‌3nm‌ N3E process)


6-core CPU
8-core CPU


4.05 GHz CPU clock speed
4.4 GHz CPU clock speed


5-core GPU
9-core GPU


16-core Neural Engine, 35 trillion operations per second
16-core Neural Engine, 38 trillion operations per second


8GB unified memory
12GB unified memory


68 GB/s memory bandwidth
120 GB/s memory bandwidth



Dedicated media engine
Hardware-accelerated H.264 and HEVC
Video decode engine
Video encode engine


Volume buttons on top
Volume buttons on right side


Portrait 12MP Ultra Wide front camera
Landscape 12MP Ultra Wide front camera


True Tone flash



Compatible with Bluetooth keyboards only
Smart Connector to support Apple's Magic Keyboard and Smart Keyboard Folio


Wi-Fi 6E connectivity
Wi-Fi 7 connectivity


Bluetooth 5.3
Bluetooth 6


Qualcomm SDX70M 5G modem
Apple C1X modem


128GB, 256GB, or 512GB of storage
128GB, 256GB, 512GB, or 1TB of storage


Starts at $499
11-inch: Starts at $599
13-inch: Starts at $799


Released October 2024
Released March 2026




Overall, the ‌iPad Air‌ is the best all-around option for the majority of users, providing a large screen for productivity and consuming entertainment in a slim, portable design. The additional $100 needed to buy the 11-inch ‌iPad Air‌ over the ‌iPad mini‌ is more than justified for the benefits that come with its larger display and M4 chip, not least the ability to practically use it as a laptop replacement with the Magic Keyboard and multitasking. The Air also brings more unified memory, newer wireless connectivity, and Apple's own C1X modem, advantages that are unlikely to matter for most users day-to-day but give the device more headroom over a longer ownership period.

Yet, most customers who choose the ‌iPad mini‌ will do so because of its screen size rather than in spite of it. The ‌iPad mini‌ is ideal for comfortably reading ebooks, playing handheld games, and easy transport and storage. Those who buy the ‌iPad mini‌ will likely have a specific use case in mind for how they will use the device, such as for note-taking on the go with the ‌Apple Pencil‌, throwing into a small bag to use on public transport, or giving it to a kid as their first tablet.

If you do not see the ‌iPad mini‌'s smaller display, easy one-handed grip, lightweight design, and portable form factor as an advantage for your use case and are focused on a more versatile display size, you will likely prefer the ‌iPad Air‌, especially as it is now available with a 13-inch size option. The ‌iPad Air‌ is more of an all-around device that works as a potential laptop replacement, with the added bonuses that come with a bigger screen for productivity and entertainment.

A next-generation iPad mini is expected to launch in the second half of 2026, so it may be worth holding off a purchase for that device. It is likely to feature the A19 Pro chip with a 5-core GPU, a slightly larger 8.7-inch display with an OLED panel, a vibration-based speaker, and water resistance. The upgrades could push the starting price up by as much as $100.Related Roundups: iPad Air , iPad miniBuyer's Guide: iPad Air (Buy Now), iPad Mini (Caution)Related Forum: iPad
This article, "2024 iPad Mini vs. 2026 iPad Air Buyer's Guide: 20+ Differences Compared" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

Yael Nardi joins Minimus as Chief Business Officer to drive hyper-growth

New York, NY: Minimus, a provider of hardened container images and secure container images designed to reduce CVE risk, today announced the appointment of Yael Nardi as Chief Business Officer (CBO). In this newly created role, Nardi will lead the company’s next phase of operations, overseeing top-of-funnel growth strategy, strategic operations, and future corporate development.
As the market landscape evolves and AI affects customer acquisition, Minimus is implementing an operational model to scale marketing and strategic alliances, which will be managed by Nardi.
“We are entering a phase of aggressive expansion that requires rigorous execution and a completely new playbook. Traditional marketing strategies are no longer enough in today’s fast-moving environment. We need an operational powerhouse at the helm. Yael is a world-class operator accustomed to zero-error environments and high-stakes execution. We are choosing intelligence, speed, and strategic alignment, and there is no one I trust more to run this machine.” – Ben Bernstein, CEO at Minimus
Nardi brings a multidisciplinary background to Minimus, with over 15 years of experience advising high-growth startups, global investors, and technology corporations. Most recently, she served as Director at Meitar NY Inc. and Partner at Meitar Law Offices. Yael was leading the significant M&A transaction of Twistlock’s acquisition by Palo Alto Networks and others, (PANW)—a foundational deal in the container image hardening and runtime security space—as well as transactions involving Wiz, JFrog, Salesforce, and others.
“I have worked with the Minimus team through some of their most critical milestones, and I know firsthand the massive potential of their technology. The demand for near-zero CVE container images and minimal container images with built-in security is only accelerating. Scaling a company in today’s environment requires the same 24/7 rigor, vendor accountability, and strategic precision as closing a major M&A deal. I am thrilled to step into this operational role and build the growth engine that will drive Minimus’s next chapter.” – Yael Nardi, Chief Business Officer, Minimus
Nardi holds a Bachelor of Laws (LLB) from Tel Aviv University and will be based in Minimus’s New York City office. She will work with the executive leadership team to execute the company’s growth targets.
About Minimus
Minimus provides hardened container images and hardened Docker images engineered to achieve near-zero CVE exposure. Built continuously from source with the latest patches and security updates, Minimus images undergo rigorous container image hardening and attack surface reduction, delivering secure container imageswith seamless supply chain security and built-in compliance for FedRAMP, FIPS 140-3, CIS, and STIG standards. Through automatically generated SBOMs and real-time threat intelligence, Minimus empowers teams to prioritize remediation and avoid over 97% of container vulnerabilities – making it a compelling Chainguard alternative for teams seeking production-hardened, distroless container images at scale. 
For more information, visit minimus.io.
Minimus Public Relations
[email protected]
View the full article
CSOonline

Apple's Three-Year Plan to 'Reinvent' the iPhone is Underway

Apple is in the middle of a three-year plan to "reinvent" the look and feel of the iPhone, according to Bloomberg's Mark Gurman.


In a report this week, Gurman said the plan is as follows:September 2025: The redesigned iPhone 17 Pro models and an all-new iPhone Air (✅)
September 2026: A foldable iPhone
September 2027: A special 20th-anniversary iPhoneThe report said this iPhone roadmap has been a "priority" for Apple's leadership, including hardware engineering chief John Ternus, who is widely considered to be the leading candidate to succeed Tim Cook as Apple's CEO in the future.

The plan began last September with the iPhone 17 Pro and iPhone 17 Pro Max, which ushered in a new aluminum design with a so-called "plateau" housing the three rear cameras and a rear Ceramic Shield glass area for MagSafe charging and accessories. At the same time, Apple released the iPhone Air, which is the thinnest iPhone ever.

This year, Apple is expected to release its long-awaited foldable iPhone.

Like Samsung's Galaxy Z Fold 7, the foldable iPhone will reportedly open up like a book, providing users with a large screen for watching videos, playing games, and multitasking. iOS 27 is expected to have some changes that are exclusive to the foldable iPhone, including side-by-side apps and other iPadOS-like multitasking functionality.


Late last year, a report said the foldable iPhone will be equipped with a 7.7-inch inner display, and a 5.3-inch outer display. It was initially rumored that the device would have a virtually "crease-free" inner display, but it was later reported that Apple is using technology that "reduces the crease without eliminating it entirely."

Apple supply chain analyst Ming-Chi Kuo expects the foldable iPhone to have two rear cameras, one front camera, and a Touch ID power button instead of Face ID.

As for the 20th-anniversary iPhone, previous reports have indicated that the device will have a seamless design, with a curved glass enclosure and no cutouts in the display. To achieve this, the front camera would be located under the screen. However, it remains to be seen if Apple actually achieves such an ambitious design by next year.


Apple reported record-breaking revenue of $143.8 billion last quarter. iPhone revenue in the quarter was $85.2 billion, a new all-time high.

"iPhone had its best-ever quarter driven by unprecedented demand, with all-time records across every geographic segment," said Apple CEO Tim Cook, in Apple's press release earlier this year. He later commented that iPhone demand during the quarter was "simply staggering" and topped Apple's internal expectations. The upcoming foldable iPhone and 20th-anniversary iPhone models could help Apple to sustain this momentum.Related Roundup: iPhone FoldTags: 20th-Anniversary iPhone, Bloomberg, Mark Gurman
This article, "Apple's Three-Year Plan to 'Reinvent' the iPhone is Underway" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

Leaker: Apple Will Release iPhone Air 2 No Matter How Badly May Sell

Despite the iPhone Air's struggling sales, a known leaker claims Apple will push ahead with at least two generations of the device, while also suggesting the standard iPhone 18 will see virtually no exterior design changes.


In a recent post on Weibo, the leaker known as "Fixed Focus Digital" said that the standard ‌iPhone 18‌ will not have substantial changes to its design, reinforcing rumors about an incremental upgrade:



In another post, the leaker claimed that Apple still plans to release a second-generation ‌iPhone Air‌ model:



Sales of the ‌iPhone Air‌ have reportedly struggled badly since its launch in September 2025. A KeyBanc Capital Markets survey for investors found "virtually no demand" for the device. Supply chain analyst Ming-Chi Kuo reported that suppliers were expected to reduce capacity by more than 80% between launch and the first quarter of 2026. Luxshare stopped making the ‌iPhone Air‌ in October, and Foxconn was expected to end production by the end of December, leaving the device believed to be entirely out of production. The iPhone 12 mini, iPhone 13 mini, iPhone 14 Plus, and iPhone 15 Plus performed similarly poorly and saw only two generations each.

According to The Information, Apple is now considering a redesign of the ‌iPhone Air‌ to add a second rear camera to address one of the main criticisms of the current model. One report suggested the second camera could be a 48-megapixel Fusion Ultra Wide lens. Previous reports have also said Apple's work on the second-generation model is aimed at reducing the weight, adding vapor chamber cooling, and improving the battery capacity, along with a thinner Face ID module, and adding the A20 and C2 chips.

The standard ‌iPhone 18‌ is expected to be an incremental update, adding Apple's A20 and C2 chips, 12GB of memory, a 24-megapixel front-facing camera, and a simplified Camera Control button.

Apple is widely believed to be planning a break from its long-established annual September release cycle with the ‌iPhone 18‌ lineup, splitting the lineup across two windows: The iPhone 18 Pro, ‌iPhone 18 Pro‌ Max, and foldable iPhone are expected in fall 2026, while the standard ‌iPhone 18‌, iPhone 18e, and ‌iPhone Air‌ 2 will likely follow in spring 2027. A Nikkei Asia report corroborating the strategy noted it aims to both optimize resources and maximize revenue from premium models.Related Roundups: iPhone 18, iPhone AirTag: Fixed Focus DigitalBuyer's Guide: iPhone Air (Buy Now)Related Forum: iPhone
This article, "Leaker: Apple Will Release iPhone Air 2 No Matter How Badly May Sell" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

APT28 Deploys PRISMEX Malware in Campaign Targeting Ukraine and NATO Allies

The Russian threat actor known as APT28 (aka Forest Blizzard and Pawn Storm) has been linked to a fresh spear-phishing campaign targeting Ukraine and its allies to deploy a previously undocumented malware suite codenamed PRISMEX. "PRISMEX combines advanced steganography, component object model (COM) hijacking, and legitimate cloud service abuse for command-and-control," Trend MicroView the full article
Hacker News

Apple's New M5 MacBook Air Hits $949 Record Low Price on Amazon

Amazon has introduced a few new record low prices on the M5 MacBook Air this week, with up to $150 off these notebooks. We started tracking these deals over the weekend, and the selection of color options at best-ever prices has only expanded since then.

Note: MacRumors is an affiliate partner with Amazon. When you click a link and make a purchase, we may receive a small payment, which helps us keep the site running.

Amazon has the 512GB 13-inch M5 MacBook Air for $949.00, down from $1,099.00, and the 24GB/1TB model for $1,349.00, down from $1,499.00. Both of these represent new record low prices for each configuration.

$150 OFF13-inch M5 MacBook Air (512GB) for $949.00
$150 OFF13-inch M5 MacBook Air (16GB/1TB) for $1,149.00
$150 OFF13-inch M5 MacBook Air (24GB/1TB) for $1,349.00

In terms of the 15-inch models, you'll find up to $150 off the M5 MacBook Air, with multiple color options on sale for each configuration. Prices start at $1,149.00 for the 512GB model, down from $1,299.00, and also include both 1TB models on sale.

$150 OFF15-inch M5 MacBook Air (512GB) for $1,149.00
$150 OFF15-inch M5 MacBook Air (16GB/1TB) for $1,349.00
$150 OFF15-inch M5 MacBook Air (24GB/1TB) for $1,549.00

If you're on the hunt for more discounts, be sure to visit our Apple Deals roundup where we recap the best Apple-related bargains of the past week.



Deals Newsletter

Interested in hearing more about the best deals you can find in 2026? Sign up for our Deals Newsletter and we'll keep you updated so you don't miss the biggest deals of the season!




Related Roundup: Apple Deals
This article, "Apple's New M5 MacBook Air Hits $949 Record Low Price on Amazon" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter
OHC_logo_transparent_01.jpeg flags-medium.png OHC_logo_blue_square_small.jpeg

 

Account

Navigation

Search

Search

Configure browser push notifications
Chrome (Android)
  1. Tap the lock icon next to the address bar.
  2. Tap Permissions → Notifications.
  3. Adjust your preference.
Chrome (Desktop)
  1. Click the padlock icon in the address bar.
  2. Select Site settings.
  3. Find Notifications and adjust your preference.