Skip to content
View in the app

A better way to browse. Learn more.
hosang I.T.

A full-screen app on your home screen with push notifications, badges and more.

To install this app on iOS and iPadOS
  1. Tap the Share icon in Safari
  2. Scroll the menu and tap Add to Home Screen.
  3. Tap Add in the top-right corner.
To install this app on Android
  1. Tap the 3-dot menu (⋮) in the top-right corner of the browser.
  2. Tap Add to Home screen or Install app.
  3. Confirm by tapping Install.

Tech

Tech Articles from a wide variety of topics and categories
Show all categories

Ending Soon: Samsung's Cyber Week Event With Low Prices on The Frame TV, Gaming Monitors, and More

Samsung's Cyber Week event will come to a close later this weekend, and you can still find great deals on monitors, storage accessories, TVs, Galaxy smartphones, and home appliances for a few more days.

Note: MacRumors is an affiliate partner with Samsung. When you click a link and make a purchase, we may receive a small payment, which helps us keep the site running.

Highlights from this event include quite a few models of The Frame TV on sale, including a new all-time low price on The Frame Pro models. You can get the 65-inch The Frame TV for $999.99 ($1,000 off), as well as The Frame Pro for $1,999.00 ($1,200 off).

SITEWIDE DISCOUNTSSamsung Cyber Week Sale

Other deals include savings on monitors like the 32-inch Smart Monitor M8 for $389.99 ($310 off), the 49-inch Odyssey OLED G9 Gaming Monitor for $899.99 ($900 off), and more. We're also tracking big markdowns on home appliances including refrigerators and washer/dryers, and a few Galaxy device discounts.

Samsung's new Galaxy XR headset also has a few notable offers during this event, including up to $1,140 in savings with the Explorer Pack. This features various content at no extra cost with the purchase of the Galaxy XR, like one year of YouTube Premium, one year of Google AI Pro, and more.

For even more potential savings, eligible shoppers have the chance to get additional discounts through Samsung offer programs. These programs provide extra discounts for students, military, and employees of select businesses, and they provide up to 30 percent extra savings on Samsung's website, so be sure to check whether you're eligible for any of these programs.

TVs

65-inch The Frame - $999.99, down from $1,999.99 (extra $100 off available through offer programs)
75-inch The Frame Pro - $1,999.99, down from $3,199.99
85-inch The Frame Pro - $3,299.99, down from $4,299.99 (extra $660 off available through offer programs)
65-inch OLED S90C TV - $1,699.99, down from $2,699.99
65-inch Neo QLED 4K TV - $1,399.99, down from $2,699.99
77-inch OLED S90F TV - $1,999.99, down from $3,499.99
75-inch Neo QLED QN90D TV - $1,499.99, down from $3,299.99
Monitors and Storage

32-inch Smart Monitor M8 - $389.99, down from $699.99
40-inch Odyssey G7 G75F Curved Monitor - $749.99, down from $1,199.99
49-inch Odyssey OLED G9 Monitor - $899.99, down from $1,799.99
57-inch Odyssey Neo G9 Monitor - $1,499.99, down from $2,299.99 (extra $200 off available through offer programs)
Appliances

Bespoke Smart Dishwasher - $749.99, down from $1,299.00
Large Capacity Side-by-Side Fridge - $999.00, down from $1,666.00
4-Door French Door Fridge - $1,799.00, down from $2,999.00
Bespoke All-in-One Combo Washer/Dryer - $1,849.99, down from $3,299.00
Mega Capacity 3-Door French Door Fridge - $2,399.00, down from $3,499.00
Bespoke 4-Door Flex Fridge - $2,050.00, down from $4,099.00
Bespoke 4-Door Flex Fridge - $3,049.99, down from $4,999.00
Galaxy Products

Galaxy XR - Save up to $1,140 with the Explorer Pack
Galaxy S25 Ultra - Save up to $700 in instant trade-in credit
Galaxy Z Fold7 - Save up to $1,000
Galaxy Ring - Get up to $150 trade-in credit
Galaxy Watch Ultra - Save up to $250
Galaxy Watch 8 - Save up to $200

If you're on the hunt for more discounts, be sure to visit our Apple Deals roundup where we recap the best Apple-related bargains of the past week.



Deals Newsletter

Interested in hearing more about the best deals you can find this holiday season? Sign up for our Deals Newsletter and we'll keep you updated so you don't miss the biggest deals of the season!




Related Roundup: Apple Deals
This article, "Ending Soon: Samsung's Cyber Week Event With Low Prices on The Frame TV, Gaming Monitors, and More" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

Researchers Uncover 30+ Flaws in AI Coding Tools Enabling Data Theft and RCE Attacks

Over 30 security vulnerabilities have been disclosed in various artificial intelligence (AI)-powered Integrated Development Environments (IDEs) that combine prompt injection primitives with legitimate features to achieve data exfiltration and remote code execution. The security shortcomings have been collectively named IDEsaster by security researcher Ari Marzouk (MaccariTA). They affect popularView the full article
reporter

Drones to Diplomas: How Russia’s Largest Private University is Linked to a $25M Essay Mill

A sprawling academic cheating network turbocharged by Google Ads that has generated nearly $25 million in revenue has curious connections to a Kremlin-connected oligarch whose Russian university builds drones for Russia’s war against Ukraine.
The Nerdify homepage.
The link between essay mills and Russian attack drones might seem improbable, but understanding it begins with a simple question: How does a human-intensive academic cheating service stay relevant in an era when students can simply ask AI to write their term papers? The answer – recasting the business as an AI company – is just the latest chapter in a story of many rebrands that link the operation to Russia’s largest private university.
Search in Google for any terms related to academic cheating services — e.g., “help with exam online” or “term paper online” — and you’re likely to encounter websites with the words “nerd” or “geek” in them, such as thenerdify[.]com and geekly-hub[.]com. With a simple request sent via text message, you can hire their tutors to help with any assignment.
These nerdy and geeky-branded websites frequently cite their “honor code,” which emphasizes they do not condone academic cheating, will not write your term papers for you, and will only offer support and advice for customers. But according to This Isn’t Fine, a Substack blog about contract cheating and essay mills, the Nerdify brand of websites will happily ignore that mantra.
“We tested the quick SMS for a price quote,” wrote This Isn’t Fine author Joseph Thibault. “The honor code references and platitudes apparently stop at the website. Within three minutes, we confirmed that a full three-page, plagiarism- and AI-free MLA formatted Argumentative essay could be ours for the low price of $141.”
A screenshot from Joseph Thibault’s Substack post shows him purchasing a 3-page paper with the Nerdify service.
Google prohibits ads that “enable dishonest behavior.” Yet, a sprawling global essay and homework cheating network run under the Nerdy brands has quietly bought its way to the top of Google searches – booking revenues of almost $25 million through a maze of companies in Cyprus, Malta and Hong Kong, while pitching “tutoring” that delivers finished work that students can turn in.
When one Nerdy-related Google Ads account got shut down, the group behind the company would form a new entity with a front-person (typically a young Ukrainian woman), start a new ads account along with a new website and domain name (usually with “nerdy” in the brand), and resume running Google ads for the same set of keywords.
UK companies belonging to the group that have been shut down by Google Ads since Jan 2025 include:
–Proglobal Solutions LTD (advertised nerdifyit[.]com);
–AW Tech Limited (advertised thenerdify[.]com);
–Geekly Solutions Ltd (advertised geekly-hub[.]com).
Currently active Google Ads accounts for the Nerdify brands include:
-OK Marketing LTD (advertising geekly-hub[.]net⁩), formed in the name of the Ukrainian national Alexander (Oleksandr) Korsukov;
–Two Sigma Solutions LTD (advertising litero[.]ai), formed in the name of Olekszij Pokatilo.
Google’s Ads Transparency page for current Nerdify advertiser OK Marketing LTD.
Messrs. Korsukov and Pokatilo have been in the essay-writing business since at least 2009, operating a paper-mill enterprise called Livingston Research. According to a lengthy account from a former employee, Livingston Research mainly farmed its writing tasks out to low-cost workers from Kenya, Philippines, Pakistan, Russia and Ukraine.
In 2011, the two men set up a Cyprus corporation called VLS Research Ltd, which would later change its name to CLS Research Ltd. Pokatilo moved from Ukraine to the United Kingdom in Sept. 2015 and co-founded a company called Awesome Technologies, which pitched itself as a way for people to outsource tasks by sending a text message to the service’s assistants.
The other co-founder of Awesome Technologies is 36-year-old Filip Perkon, a Swedish man living in London who touts himself as a serial entrepreneur and investor. Years before starting Awesome together, Perkon and Pokatilo co-founded a student group called Russian Business Week while the two were classmates at the London School of Economics. According to the Bulgarian investigative journalist Christo Grozev, Perkon’s birth certificate was issued by the Soviet Embassy in Sweden.
Alexey Pokatilo (left) and Filip Perkon at a Facebook event for startups in San Francisco in mid-2015.
Around the time Perkon and Pokatilo launched Awesome Technologies, Perkon was building a social media propaganda tool called the Russian Diplomatic Online Club, which Perkon said would “turbo-charge” Russian messaging online. The club’s newsletter urged subscribers to install in their Twitter accounts a third-party app called Tweetsquad that would retweet Kremlin messaging on the social media platform.
Perkon was praised by the Russian Embassy in London for his efforts: During the contentious Brexit vote that ultimately led to the United Kingdom leaving the European Union, the Russian embassy in London used this spam tweeting tool to auto-retweet the Russian ambassador’s posts from supporters’ accounts.
Neither Mr. Perkon nor Mr. Pokatilo replied to requests for comment.
A review of corporations tied to Mr. Perkon as indexed by the business research service North Data finds he holds or held director positions in several U.K. subsidiaries of Synergy, Russia’s largest private education provider. Synergy has more than 35,000 students, and sells T-shirts with patriotic slogans such as “Crimea is Ours,” and The Russian Empire — Reloaded.”
The president of Synergy is Vadim Lobov, a Kremlin insider whose headquarters on the outskirts of Moscow reportedly features a wall-sized portrait of Russian President Vladimir Putin in the pop-art style of Andy Warhol. For a number of years, Lobov and Perkon co-produced a cross-cultural event in the U.K. called Russian Film Week.
Synergy President Vadim Lobov and Filip Perkon, speaking at a press conference for Russian Film Week, a cross-cultural event in the U.K. co-produced by both men.
Mr. Lobov was one of 11 individuals reportedly hand-picked by the convicted Russian spy Marina Butina to attend the 2017 National Prayer Breakfast held in Washington D.C. just two weeks after President Trump’s first inauguration.
While Synergy University promotes itself as Russia’s largest private educational institution, hundreds of international students tell a different story. Online reviews from students paint a picture of unkept promises: Prospective students from Nigeria, Kenya, Ghana, and other nations paying thousands in advance fees for promised study visas to Russia, only to have their applications denied with no refunds offered.
“My experience with Synergy University has been nothing short of heartbreaking,” reads one such account. “When I first discovered the school, their representative was extremely responsive and eager to assist. He communicated frequently and made me believe I was in safe hands. However, after paying my hard-earned tuition fees, my visa was denied. It’s been over 9 months since that denial, and despite their promises, I have received no refund whatsoever. My messages are now ignored, and the same representative who once replied instantly no longer responds at all. Synergy University, how can an institution in Europe feel comfortable exploiting the hopes of Africans who trust you with their life savings? This is not just unethical — it’s predatory.”
This pattern repeats across reviews by multilingual students from Pakistan, Nepal, India, and various African nations — all describing the same scheme: Attractive online marketing, promises of easy visa approval, upfront payment requirements, and then silence after visa denials.
Reddit discussions in r/Moscow and r/AskARussian are filled with warnings. “It’s a scam, a diploma mill,” writes one user. “They literally sell exams. There was an investigation on Rossiya-1 television showing students paying to pass tests.”
The Nerdify website’s “About Us” page says the company was co-founded by Pokatilo and an American named Brian Mellor. The latter identity seems to have been fabricated, or at least there is no evidence that a person with this name ever worked at Nerdify.
Rather, it appears that the SMS assistance company co-founded by Messrs. Pokatilo and Perkon (Awesome Technologies) fizzled out shortly after its creation, and that Nerdify soon adopted the process of accepting assignment requests via text message and routing them to freelance writers.
A closer look at an early “About Us” page for Nerdify in The Wayback Machine suggests that Mr. Perkon was the real co-founder of the company: The photo at the top of the page shows four people wearing Nerdify T-shirts seated around a table on a rooftop deck in San Francisco, and the man facing the camera is Perkon.
Filip Perkon, top right, is pictured wearing a Nerdify T-shirt in an archived copy of the company’s About Us page. Image: archive.org.
Where are they now? Pokatilo is currently running a startup called Litero.Ai, which appears to be an AI-based essay writing service. In July 2025, Mr. Pokatilo received pre-seed funding of $800,000 for Litero from an investment program backed by the venture capital firms AltaIR Capital, Yellow Rocks, Smart Partnership Capital, and I2BF Global Ventures.
Meanwhile, Filip Perkon is busy setting up toy rubber duck stores in Miami and in at least three locations in the United Kingdom. These “Duck World” shops market themselves as “the world’s largest duck store.”
This past week, Mr. Lobov was in India with Putin’s entourage on a charm tour with India’s Prime Minister Narendra Modi. Although Synergy is billed as an educational institution, a review of the company’s sprawling corporate footprint (via DNS) shows it also is assisting the Russian government in its war against Ukraine.
Synergy University President Vadim Lobov (right) pictured this week in India next to Natalia Popova, a Russian TV presenter known for her close ties to Putin’s family, particularly Putin’s daughter, who works with Popova at the education and culture-focused Innopraktika Foundation.
The website bpla.synergy[.]bot, for instance, says the company is involved in developing combat drones to aid Russian forces and to evade international sanctions on the supply and re-export of high-tech products.
A screenshot from the website of synergy,bot shows the company is actively engaged in building armed drones for the war in Ukraine.
KrebsOnSecurity would like to thank the anonymous researcher NatInfoSec for their assistance in this investigation.
View the full article
reporter

Top Stories: iOS 26.2 Coming Soon, Apple Execs Depart, and More

You'd expect things to be starting to wind down for the holidays by now, but that doesn't seem to be the case yet in the world of Apple news, with Apple just about ready to release iOS 26.2 and other operating system updates to the public.


There was also a flurry of news this week about Apple executive departures, some expected and some not so expected, while we also learned that Apple and Intel may be developing a new chipmaking partnership, so read on below for all the details on these stories and more!

Top Stories

Apple Seeds iOS 26.2 Release Candidate Ahead of Public Launch

With the Thanksgiving holiday in the rear-view mirror and the calendar turned to December, Apple is putting the final touches on iOS 26.2, iPadOS 26.2, macOS Tahoe 26.2, and related updates, with several new features and tweaks. Apple this week seeded release candidate versions of the updates to developers and public beta testers, suggesting an official release for everyone will come next week.


The imminent iOS 26.2 update arrives as Apple has started to more aggressively push users still on iOS 18 to upgrade to iOS 26. Since ‌iOS 26‌ launched in September, it has been displayed as an optional upgrade at the bottom of the Software Update interface in the Settings app, with iOS 18 updates displayed more prominently.

Starting this week, that's changed. iOS 18 users who have not upgraded to ‌iOS 26 now see iOS 26.1 (and soon iOS 26.2) as the recommended iOS update in the Settings app. iOS 18 updates are still an option, but are now displayed at the bottom of the app.

Apple UI Design Chief Alan Dye Leaving for Meta

In a move that came as a surprise to most observers, Apple design chief Alan Dye has decided to leave the company after 19 years and take a role as chief design officer at Meta.


Dye oversaw the major Liquid Glass design update that debuted this year, which has not arrived without controversy, and some both inside and outside of Apple are not exactly sorry to see Dye go.

Dye's departure follows closely on the heels of Apple announcing that AI chief John Giannandrea has stepped down from his position and will serve as an advisor until he retires early next year. Giannandrea has been under pressure as Apple has fallen behind in the race to develop and deploy AI capabilities, and some of his responsibilities had already been shifted to other executives.

As if that wasn't enough, Apple also announced this week that general counsel Kate Adams and environment chief Lisa Jackson will both be retiring in 2026, with the company working to transition their responsibilities to other executives.

Apple and Intel Rumored to Partner on Mac and iPhone Chips in a New Way

While all Macs are now powered by Apple's custom-designed chips, a new rumor claims that Apple may rekindle its partnership with Intel, albeit in a new and limited way.


Apple supply chain analyst Ming-Chi Kuo this week said Intel is expected to begin shipping Apple's lowest-end M-series chip as early as mid-2027.

If this rumor proves accurate, Intel could supply Apple with M6 or M7 chips for future MacBook Air, iPad Air, and iPad Pro models at a minimum. However, while previous Intel chips for Macs were designed by Intel and based on x86 architecture, M-series chips are designed by Apple and use Arm architecture. Intel would only assist with manufacturing.

The partnership may also extend to the iPhone with Intel producing future chips for non-pro iPhone models starting in 2028, which could perhaps mean the A22 chip for devices like the iPhone 20 and iPhone 20e.

iPhone Fold: Launch, Pricing, and What to Expect From Apple's Foldable

Apple is expected to launch a new foldable iPhone next year, based on multiple rumors and credible sources. The long-awaited device has been rumored for years now, but signs increasingly suggest that 2026 could indeed be the year that Apple releases its first foldable device.


As rumors continue to surface, we've collated an updated set of key details that have been leaked about Apple's foldable iPhone so far. Apple will allegedly call the device the "‌iPhone‌ Fold," which is the name the media has already adopted when sharing rumors about the product.

Apple Music Replay 2025 Now Fully Available

The full Replay 2025 experience is now available in the Apple Music app, allowing you to reflect on your listening habits over the past year.


There are two main components of the Replay 2025 experience. First, there is a full year-end playlist containing the Apple Music songs that you listened to the most over the past year, and second, there is a Highlight Reel with images and a video that are designed to be shared on social media platforms like Instagram and TikTok.

iPhone 17 Demand Is Breaking Apple's Sales Records

Apple's iPhone 17 lineup is selling well enough that Apple is on track to ship more than 247.4 million total iPhones in 2025, according to a new report from IDC.


Total 2025 shipments are forecast to grow 6.1 percent year over year due to ‌iPhone 17‌ demand and increased sales in China, a major market for Apple.

Overall worldwide smartphone shipments across Android and iOS are forecast to grow 1.5 percent, primarily because of the success of the iPhone.

MacRumors Newsletter

Each week, we publish an email newsletter like this highlighting the top Apple stories, making it a great way to get a bite-sized recap of the week hitting all of the major topics we've covered and tying together related stories for a big-picture view.

So if you want to have top stories like the above recap delivered to your email inbox each week, subscribe to our newsletter!Tag: Top Stories
This article, "Top Stories: iOS 26.2 Coming Soon, Apple Execs Depart, and More" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

After you check out your Spotify Wrapped 2025, explore these copycats 

Spotify’s annual Wrapped feature just dropped, giving listeners a fun, personalized summary of their listening habits. It has gained immense popularity over the years, and as a result, many companies have seized the opportunity to create similar year-in-review experiences, offering users a recap of their habits, preferences, or interactions from the past year. Here are […]View the full article
reporter

Advancing AI Implementation with MLOps in the United States

If you work with artificial intelligence anywhere in the United States—in cities like California, San Francisco, Boston, or Seattle—you understand the challenge: building an impressive AI model is an achievement, but making it work consistently in real-world applications is an entirely different story.
That critical gap between AI development and practical implementation is exactly where MLOps proves essential. To gain mastery of these vital skills, consider exploring MLOps Training in the United States, California, San Francisco, Boston & Seattle.
Understanding MLOps in Simple Terms
MLOps stands for Machine Learning Operations. It is the discipline of applying proven DevOps methodologies to the complete lifecycle of machine learning projects. Imagine it as the essential framework that transforms promising AI prototypes into robust, scalable, and maintainable production systems.
Without MLOps, even the most sophisticated AI models encounter significant hurdles: they may excel in controlled testing environments but fail under real-world conditions, or their performance may degrade silently over time due to data drift, all while manual processes create bottlenecks and hinder team collaboration.
The Growing Need for MLOps Across U.S. Industries
Organizations nationwide, from Silicon Valley startups to established enterprises in Boston and Seattle, are accelerating their AI adoption. A common realization is that model development is merely the first step. The greater challenge lies in operationalization: ensuring reliable daily performance, maintaining models over time, scaling solutions effectively, enforcing governance, and fostering seamless teamwork between data scientists and engineers.
This operational challenge is precisely why comprehensive MLOps training has transitioned from a niche advantage to a business necessity. It provides the methodology and tools to ensure AI investments deliver tangible, sustainable value.
The MLOps Transformation: A Clear Comparison
Adopting MLOps fundamentally reshapes how an organization manages its AI initiatives. The contrast between traditional approaches and the MLOps methodology is stark and telling:
Traditional AI DevelopmentThe MLOps MethodologySiloed work by data scientistsCross-functional MLOps teams in collaborationManual, inconsistent deploymentsAutomated, reproducible CI/CD pipelinesMinimal monitoring post-launchProactive, continuous model monitoringArchitectures difficult to scaleSystems designed for efficient model serving at scaleLimited traceability and governanceComprehensive model versioning and experiment tracking Core Competencies from Quality MLOps Training
A well-structured training program should equip you with both foundational knowledge and hands-on skills. Key learning areas typically include:
Foundations & Lifecycle: Grasping the core principles of MLOps and understanding the end-to-end machine learning lifecycle, from data and experimentation to deployment, monitoring, and retirement. Pipeline Engineering: Learning to build automated, reproducible pipelines for data, training, and validation using modern orchestration tools. Deployment & Serving: Mastering patterns for deploying models as APIs or batch processes, often leveraging containerization and orchestration platforms like Kubernetes. Monitoring, Governance & Ethics: Implementing systems to track model performance, detect data drift, and ensure robust model governance and fairness. Cloud-Native MLOps: Effectively utilizing cloud platforms for scalable, managed infrastructure tailored for machine learning workloads. Accelerating Learning with Expert Guidance
The MLOps landscape is dynamic and complex. Navigating its evolving tools and best practices alone can be inefficient. This is where learning from an established, practical source provides significant advantage.
For those seeking to build these competencies, DevOpsSchool offers a structured, practical approach to mastering in-demand technologies. Their training focuses on real-world application, connecting theoretical concepts directly to workplace scenarios.
The Advantage of Learning from an Industry Veteran
The depth and applicability of any MLOps training are profoundly influenced by the expertise of its instructors. Guidance from a practitioner with extensive real-world experience transforms theoretical knowledge into actionable skill.
The curriculum is guided by Rajesh Kumar, whose expertise is grounded in over two decades of hands-on experience across the spectrum of modern IT practices—from DevOps and DevSecOps to SRE, DataOps, AIOps, and MLOps. His deep practical knowledge of Kubernetes and cloud architectures provides learners with a holistic, strategic understanding of implementing MLOps within a broader technology ecosystem.
Identifying the Right Path for Your Career
For data scientists, ML engineers, DevOps professionals, software developers, and technology leaders in the United States, proficiency in MLOps is a powerful career differentiator. It represents the ability to bridge the gap between AI innovation and production-grade delivery, a skill set in high demand across the competitive markets of California, Boston, Seattle, and beyond.
Taking the First Step
Embarking on the journey to MLOps mastery begins with a commitment to structured learning. Assess your current knowledge, define your learning objectives, and explore training pathways that offer a blend of theory, hands-on practice, and expert mentorship.
Ready to translate AI potential into production reality? Building genuine MLOps competency is an investment that yields substantial returns in capability and career advancement.
To explore how you can develop these critical skills:
Email: [email protected]
Phone & WhatsApp (India): +91 84094 92687
Phone & WhatsApp (USA): +1 (469) 756-6329
Website: https://www.devopsschool.com/


View the full article
reporter

Critical React2Shell Flaw Added to CISA KEV After Confirmed Active Exploitation

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday formally added a critical security flaw impacting React Server Components (RSC) to its Known Exploited Vulnerabilities (KEV) catalog following reports of active exploitation in the wild. The vulnerability, CVE-2025-55182 (CVSS score: 10.0), relates to a case of remote code execution that could be triggered by anView the full article
reporter

Creating Effective MLOps Practices in London and Across the United Kingdom

If you work with AI in the UK, especially in London, you’ve likely felt this pattern:
You build an impressive model in testing, but then struggle to make it work reliably in real business situations. That gap between building and using AI is exactly where MLOps makes all the difference.
MLOps Training in the United Kingdom and London helps you turn experimental AI into dependable, everyday tools. It’s the practical system that makes AI work not just in the lab, but in the real world.
Why UK Companies Need MLOps
The UK, with London at the heart of its tech scene, is full of businesses wanting to use AI. But many face the same issues:
Models that work perfectly in testing but fail in real use AI performance that slowly gets worse over time Slow, manual processes that waste time Confusion over which model version is being used Teams struggling to work together effectively Learning MLOps gives you clear, practical methods to solve these problems and build AI systems that actually work.
MLOps in Practice: Before and After
When companies start using MLOps, their approach to AI changes completely:
Traditional ApproachWith MLOpsTeams work separatelyTeams collaborate betterManual, slow deploymentsAutomated, efficient processesNo monitoring after launchContinuous performance trackingDifficult to scaleEasy to grow successful modelsHard to repeat resultsClear records and reproducibility MLOps treats AI like a product that needs ongoing care, not just a one-time project.
What You’ll Learn in Good MLOps Training
Quality training should give you skills you can use right away:
Core Understanding
What MLOps really means and why it matters How it fits with other technical work The complete AI lifecycle Building Systems
Creating automated workflows that save time Using tools to organize complex projects Making processes repeatable and reliable Deployment Skills
How to safely launch models into use Different methods for making models available Modern tools for reliable service Monitoring and Maintenance
Setting up systems to watch model performance Finding and fixing problems early Knowing when to update models Best Practices
Industry standards that save time Common mistakes to avoid Practical tips from experienced professionals Finding the Right Learning Resources
MLOps changes fast, with new tools appearing regularly. Trying to learn everything yourself can be overwhelming. This is where structured learning helps.
A platform like DevOpsSchool focuses on making complex technical topics practical and accessible. They provide training that connects theory with real workplace situations.
Learning from Real Experience
The best training comes from people who have actually used these tools in real projects. That practical experience makes all the difference.
The MLOps training program is guided by Rajesh Kumar, who brings over twenty years of hands-on experience with technology systems. His background includes practical work with:
DevOps practices Cloud platforms Machine learning systems Learning from experienced professionals means you get:
Real-world knowledge from actual projects Practical methods proven in business environments Clear explanations of complex concepts Current expertise with the latest tools Career Benefits of Learning MLOps
If you work with AI, data, or technology in the UK, learning MLOps offers clear advantages:
For Your Current Role
Makes your work more efficient Helps solve complex problems better Increases your value to your team For Career Growth
Builds skills that are in high demand Opens new job opportunities Prepares you for leadership roles For Your Organization
Enables better AI development Increases project success rates Saves time and reduces errors Getting Started with MLOps
Ready to begin? Here’s a simple path:
Learn the basics of MLOps concepts Try small projects with real applications Connect with others using MLOps Consider formal training to accelerate learning Stay current with new developments Ready to build better AI systems? Developing MLOps skills requires focus, but the investment pays off in better results and career opportunities.
Interested in structured training options?
Get in touch to learn more:
Email: [email protected]
Phone & WhatsApp (India): +91 84094 92687
Phone & WhatsApp (USA): +1 (469) 756-6329
Website: https://www.devopsschool.com/


View the full article
reporter

Creating MLOps Solutions in Amsterdam and Across the Netherlands

If you work with machine learning or artificial intelligence in the Netherlands, especially in places like Amsterdam, you might have noticed a common problem. It’s easy to build a smart model in a testing environment, but much harder to get it working reliably in a real business. This gap between creating a model and using it in practice is exactly where MLOps Training in the Netherlands and Amsterdam becomes important.
MLOps, or Machine Learning Operations, is a set of practices that helps manage machine learning projects from start to finish. Think of it as a system that turns AI experiments into reliable, working tools that businesses can use every day.
Why MLOps Matters for Companies in the Netherlands
The Netherlands has a growing tech industry, with Amsterdam at its center. Many companies here want to use AI to improve their work. But without a good system in place, they often run into problems:
Models that work in testing but fail in real use AI performance that gets worse over time Manual processes that take too long and make errors Difficulty keeping track of different model versions This is where learning about MLOps can help. It provides clear methods to build better, more reliable AI systems.
What Changes When You Use MLOps
When companies start using MLOps practices, their approach to AI changes significantly:
Traditional ApproachWith MLOpsTeams work separatelyTeams collaborate betterManual deploymentAutomated processesNo monitoring after launchContinuous performance trackingHard to scaleEasier to grow successful modelsDifficult to repeat resultsClear tracking of all work Using MLOps means treating AI projects like products that need regular care and improvement, rather than one-time experiments.
What Good MLOps Training Should Teach You
If you’re thinking about learning MLOps, look for training that covers practical skills you can use right away:
Basic Concepts: Understanding what MLOps is and why it matters Building Workflows: Learning to create smooth, automated processes Deployment Skills: Knowing how to launch models reliably Monitoring Methods: Setting up systems to watch model performance Best Practices: Learning industry standards and common solutions This knowledge helps everyone involved in AI projects—from data scientists to IT managers—work together more effectively.
Finding the Right Learning Resources
The field of MLOps changes often, with new tools and methods appearing regularly. Finding your way through all this information can be challenging. This is where good learning resources make a big difference.
A platform like DevOpsSchool focuses on making complex technical topics easier to understand and use. They provide practical training that connects theory with real workplace situations.
Learning from Experienced Teachers
The quality of any training depends greatly on who’s teaching it. Having instructors with real-world experience can help you understand not just what to do, but why certain approaches work best.
The MLOps training program is guided by Rajesh Kumar, who has over twenty years of experience working with technology systems. His background includes practical work with DevOps, cloud technologies, and machine learning systems. Learning from someone with this experience provides valuable insights into how to implement solutions that work in real business situations.
Is MLOps Training Right for Your Career?
If you work with AI, data, or technology systems in the Netherlands, learning about MLOps could be a smart career move. These skills help you build AI solutions that aren’t just clever, but also reliable and practical—exactly what companies need.
Ready to learn how to make AI systems work better in practice? Developing MLOps skills requires focused learning and practice.
If you’re interested in learning more about structured training options:
Email: [email protected]
Phone & WhatsApp (India): +91 84094 92687
Phone & WhatsApp (USA): +1 (469) 756-6329
Website: https://www.devopsschool.com/


View the full article
reporter

Constructing MLOps Frameworks for Machine Learning in India

If you work with machine learning in cities like Bangalore, Hyderabad, or Chennai, you know it’s not just about building smart models. The real challenge starts when you try to use those models in real business situations. That moment—when a great model moves from the lab to the real world—is where MLOps Training in India, Bangalore, Hyderabad, and Chennai becomes essential.
Think of MLOps (Machine Learning Operations) as the bridge between data science and real-world use. It’s like taking a brilliant idea and turning it into something that works reliably day after day. Without proper MLOps, even the smartest AI models can fail in practice. They might work perfectly in testing but struggle when people actually use them.
The Real Problem MLOps Solves
Across India’s tech centers—from the startups in Bangalore to the IT parks in Hyderabad and the growing tech scene in Chennai—teams face similar challenges:
Models that work in the lab but fail in real use “Model drift” where AI performance gets worse over time Teams spending more time fixing problems than creating new solutions Difficulty scaling successful models across an organization MLOps addresses these issues by creating systems that manage the entire lifecycle of machine learning models. It’s what turns experimental AI into reliable business tools.
Why Indian Companies Need MLOps Now
India’s technology sector is growing fast, and AI is becoming crucial across industries. Whether you’re working at a tech company in Bangalore, a financial firm in Chennai, or a startup in Hyderabad, the pressure to deliver working AI solutions is real.
Here’s what changes when you implement MLOps:
Traditional ApproachWith MLOpsModels built in isolationComplete workflow automationManual deployment processesAutomated model deploymentNo system to track performanceContinuous model monitoringTeams work separatelyBetter team collaborationDifficult to scaleEfficient model scaling What Good MLOps Training Should Cover
Learning MLOps isn’t just about understanding concepts—it’s about gaining practical skills you can use immediately. A comprehensive program for MLOps Training in India, Bangalore, Hyderabad, and Chennai should include:
Core Concepts: Understanding what MLOps really means and why it matters Workflow Management: Learning to create smooth, automated processes Version Control: Mastering how to track and reproduce your work Deployment Skills: Learning to deploy models reliably and at scale Monitoring Systems: Setting up ways to watch model performance continuously Best Practices: Understanding industry standards and avoiding common mistakes For professionals in India, especially in tech hubs like Bangalore, Hyderabad, and Chennai, this training provides the fastest path to turning AI projects into real business value.
Finding the Right Learning Path
The field of MLOps is constantly evolving with new tools and techniques emerging regularly. Navigating this landscape alone can be challenging. This is where having the right guidance makes all the difference.
Learning with DevOpsSchool
For those seeking practical, effective MLOps training in India, there are structured programs designed specifically for Indian tech professionals. DevOpsSchool has established itself as a trusted platform for technology education, particularly for in-demand skills like MLOps. Their approach focuses on practical, hands-on learning that translates directly to workplace success.
What makes DevOpsSchool particularly effective is their commitment to current industry practices. They regularly update their curriculum to reflect the latest tools and methodologies used in Indian tech companies, ensuring that what you learn is immediately applicable in your job. Their programs are designed with flexibility in mind, accommodating working professionals across different cities in India.
Guidance from an Experienced Professional
The value of any educational program depends greatly on the experience of those leading it. In the case of MLOps training, learning from someone with extensive real-world experience can make a significant difference in how well you understand and apply the concepts.
The MLOps training is guided by Rajesh Kumar, a professional with over 20 years of experience across various technology domains. His background encompasses practical work with DevOps, DevSecOps, Kubernetes, and cloud technologies, giving him a comprehensive understanding of how MLOps fits within the broader technology landscape. Learning from Rajesh Kumar means gaining insights not just from theoretical knowledge, but from real implementation experience that has been tested and proven in actual business environments.
Is MLOps Training Right for Your Career?
If you’re a data scientist, machine learning engineer, DevOps professional, or technology leader in India looking to bridge the gap between AI development and practical implementation, MLOps Training in India, Bangalore, Hyderabad, and Chennai represents a valuable investment in your career.
It equips you with the skills to build systems that are not just intelligent but also reliable, scalable, and manageable—exactly what businesses need as they adopt AI technologies.
Taking the Next Step
Moving from understanding AI concepts to implementing successful AI systems requires specific knowledge and skills. For professionals in Bangalore, Hyderabad, Chennai, and across India, acquiring these skills through structured learning can accelerate career growth and increase your value to employers.
For those interested in exploring MLOps training options suitable for the Indian market:
Email: [email protected]
Phone & WhatsApp (India): +91 84094 92687
Phone & WhatsApp (USA): +1 (469) 756-6329
Website: https://www.devopsschool.com/


View the full article
reporter

Creating MLOps Workflows for Machine Learning in Canada

If you are working with machine learning anywhere in Canada, you have probably faced a common challenge. Your data scientists create great models in the lab, but getting them to work well in the real world is much harder. This is exactly where MLOps becomes important.
Think of MLOps, or Machine Learning Operations, as the key link between creating a model and running it well for real users. It brings together ideas from DevOps with the special needs of machine learning to build a smooth and dependable system for your AI projects.
Without MLOps, even the best model can struggle. Teams deal with “model drift” where performance gets worse over time, have trouble recreating good results, and spend too much time on manual tasks instead of creating new things. For professionals in Canada’s competitive AI field, using MLOps practices is no longer just an option—it is necessary for delivering AI solutions that last, grow, and earn trust.
Why Is MLOps Important for Success in Canada?
Canada is a world leader in artificial intelligence, with strong communities in its major cities. Whether you work at a startup in Toronto, a financial company in Montreal, or a tech firm in Vancouver, the need to make AI work in practice is huge. MLOps gives you the structure to turn research projects into reliable, production-ready tools.
Here is a simple look at what MLOps helps fix:
Without MLOpsWith MLOpsModels work alone and are hard to track or recreateComplete pipeline automation for consistent, repeatable workManual processes that often lead to mistakesAutomated model deployment and watchingNo good way to notice when performance dropsContinuous model monitoring and scheduled retrainingTeams do not collaborate wellOne system that helps team collaborationGrowing models is difficult and expensiveEfficient model scaling and resource use Using MLOps means your team can put models to work faster, make sure they keep working well, and handle their entire life cycle smoothly. It is the key to moving from experimental AI to AI that works reliably every day.
What Does Good MLOps Training Include?
Good MLOps training needs to give you practical skills, not just ideas. A strong program should cover everything you need to build and manage these systems:
Basics & Workflow Management: Learning core MLOps principles and using tools to organize your work. Tracking & Recreating Work: Mastering model versioning and data versioning so you can always find and repeat your results. Automated Launching: Learning how to automatically model deployment using modern tools for reliable, growing service. Watching & Rules: Setting up continuous model monitoring for performance and fairness, plus model governance for following rules. Continuous Processes for ML: Using continuous integration and delivery practices made for machine learning. For professionals all across Canada, from Toronto to Calgary, this training is the quickest way to build the skills needed to make AI investments pay off.
Finding Your Way in MLOps with Helpful Guidance
The world of MLOps changes fast, with new tools and methods appearing often. Figuring this out by yourself can be tough. This is where learning from a trusted, practical source really helps.
DevOpsSchool has made a name for itself by turning complicated technology ideas into useful, career-building skills. Their method for MLOps training is carefully built to be hands-on. They focus on the tools and frameworks you will actually use at work, making sure learners from Vancouver to Montreal can use what they learn right away.
Learning from an Expert: The Benefit of Rajesh Kumar
How good and relevant any training is depends greatly on who is teaching it. The MLOps training program at DevOpsSchool is led by Rajesh Kumar, someone with over twenty years of experience where development, operations, and advanced data work meet.
Rajesh’s teaching comes from real experience. He shares practical knowledge from building strong, growing systems, having worked deeply with Kubernetes, cloud platforms, and everything from DevOps to DataOps to MLOps. Learning from him gives you not just technical skills but also smart insights into building ML pipelines that are strong, efficient, and meet business needs—a valuable view for any Canadian tech worker.
Is MLOps Training the Right Move for You?
If you are a Data Scientist, ML Engineer, DevOps Engineer, or IT leader in Canada who wants to connect AI development with real-world use, MLOps training is a key step. It helps you build systems that are not just smart, but also reliable, scalable, and easy to manage.
Ready to change how your organization uses AI? Building this knowledge needs a clear path from understanding to doing.
To learn how you can master MLOps and lead AI implementation, get in touch with DevOpsSchool:
Email: [email protected]
Phone & WhatsApp (India): +91 84094 92687
Phone & WhatsApp (USA): +1 (469) 756-6329
Website: https://www.devopsschool.com/


View the full article
reporter

Application Development Using Microservices Patterns in Bangalore

Hello! If you’re working in tech in Bangalore, you’ve likely heard people talk about microservices. Maybe your team is discussing this new approach, or you’ve seen it mentioned in job descriptions and wondered what it really means.
Let’s talk about what microservices are and why they matter for your work, without using complicated terms.
What Are Microservices? A Simple Explanation
Think about how we used to build software. In the old way (called a “monolith”), everything was built together in one big application. It was like having your kitchen, living room, and bedroom all in one room without walls. If you wanted to change something in the kitchen, you might accidentally mess up the living room too!
Microservices change this completely. Instead of one big application, you build many smaller, independent services. Each service handles one specific job really well. For example, an online store might have:
A User Service for logins and profiles A Product Service for the catalog A Payment Service for transactions A Shipping Service for delivery These services talk to each other but are developed and managed separately. This approach makes your software:
Easier to update: You can fix the payment service without touching anything else More reliable: If the product service has a problem, users can still log in Simpler to scale: If many people are searching products, you just add power to the search service Faster to build: Different teams can work on different services at once For Bangalore’s growing tech scene, understanding microservices architecture is becoming very important.
Why Bangalore Companies Are Switching to Microservices
From startups to large companies, everyone seems to be exploring this approach. Here’s why it makes sense:
Traditional Apps (Monoliths)Modern Apps (Microservices)One big, connected codebaseMany small, focused servicesHard to make changesEasy to update parts separatelyEverything uses same technologyDifferent services can use different toolsSlow, risky updatesFast, safe updatesOne team manages everythingMultiple teams can work independently This way of building software supports modern application development and fits well with cloud approaches and DevOps practices.
What Good Microservices Training Should Cover
Learning about microservices isn’t just about definitions. It’s about understanding how to build and manage them properly. Good Microservices training should teach you:
The Basics: How to break down a big app into the right services Communication: How services talk to each other (often using APIs) Data Handling: How each service manages its own information Deployment: How to launch and manage many services Monitoring: How to keep track of everything running Security: How to keep all communication safe This is where having the right learning path makes all the difference.
Finding the Right Learning Help in Bangalore
Bangalore has many learning options, but for hands-on skills like microservices design patterns, you need more than just videos. You need structured learning with expert support.
This kind of practical education is what DevOpsSchool specializes in. They’re known for making complex topics understandable. Their courses focus on real skills—teaching you about containerization, API gateways, and service meshes through exercises that feel like real work.
What makes DevOpsSchool special is their focus on helping students succeed. They create clear learning paths with practical projects and ongoing support. Their courses help you not just understand ideas, but actually use them in your job.
Learning from Real Experience
The Microservices training program is guided by Rajesh Kumar, whose knowledge comes from over 20 years of solving real technology problems. Rajesh doesn’t just teach theory—he shares practical solutions from actual work with cloud platforms and DevOps practices.
Learning from someone with Rajesh’s experience gives you more than technical knowledge. You get insights into how decisions are made in real projects and how to avoid common mistakes.
Is This the Right Time to Learn Microservices?
If you work in software development or DevOps in Bangalore, understanding microservices architecture could help your career. This knowledge helps you build applications that are more flexible and reliable—qualities companies value.
Ready to learn how microservices can improve your work? If you want to move from understanding ideas to building skills, structured training can help you get there faster.
Interested in learning more? Contact DevOpsSchool:
Email: [email protected]
Phone & WhatsApp (India): +91 84094 92687
Phone & WhatsApp (USA): +1 (469) 756-6329
Website: https://www.devopsschool.com/


View the full article
reporter

Hands-On Maven Program for Tech Professionals in Bangalore

Ever feel like working on software projects could be simpler? Maybe you’ve written good code, but then spent hours trying to make it work on a different computer. Or perhaps you’ve searched forever for a missing file. You’re not alone!
What if I told you there’s a way to make your coding projects more organized and less stressful? That’s what Apache Maven does. Think of it as your personal helper for coding projects. It keeps things tidy, finds what you need, and makes building software feel much simpler.
If you’re in Bangalore and want to learn Maven in a way that actually helps your daily work, you’re in the right place. Let’s talk about why Maven matters and how you can learn it in a straightforward way.
Understanding Maven: It’s Simpler Than You Think
Maven is a tool that helps developers manage their projects more easily. Let me explain what it does in everyday words:
It creates order: Maven gives every project the same clear folder structure. This means when you start a new project, you’ll know where everything goes right away. It finds tools for you: When your project needs certain libraries or tools, you just tell Maven what you need. It automatically finds and downloads them for you. No more manual searching! It simplifies building: With just one command, Maven can compile your code, run tests to check for problems, and package everything neatly. This is helpful for developers who want to write code more efficiently, and it’s also great for DevOps professionals who set up automated workflows. Basically, Maven helps teams work together better with fewer headaches.
Who Should Consider Learning Maven?
Developers who want to spend more time coding and less time fixing setup issues DevOps Engineers who create automated systems for their teams Team members who collaborate on software projects Students or career-changers building practical tech skills Anyone who works with code and wants their workday to go more smoothly What Makes Good Maven Training?
A helpful course should teach you both the basics and how to apply them in real work. Here’s what to look for in good training:
Getting started properly: Learning how to set up Maven and understanding its approach Managing project parts: Handling all the components your project needs without getting overwhelmed Working with real examples: Practicing with projects that feel like actual work tasks Team collaboration: Learning how Maven works with other tools your team uses Here’s a simple breakdown of what good training offers:
What You’ll LearnHow This Helps YouSetting up new projectsStart coding faster instead of spending hours on setupManaging project componentsAvoid wasting time looking for missing filesRunning automated testsCatch problems before they become seriousTeam collaboration methodsWork effectively with your teammates Why Consider Learning with DevOpsSchool?
When choosing where to learn, you want guidance from people who actually use these tools daily. That’s where DevOpsSchool truly stands out. They focus on teaching practical skills you can use immediately in your job.
Their approach to Maven training is hands-on and relevant. You’ll practice with examples that resemble real work tasks, and they provide support that continues even after your course ends.
Learn from an Experienced Guide
The course is led by Rajesh Kumar, who brings over 20 years of practical experience. He doesn’t just teach theory—he shares real solutions from actual work situations. Learning from someone with his background means you gain insights that are valuable in today’s workplaces.
How This Improves Your Daily Work
Learning Maven isn’t just about adding another skill to your resume—it’s about making your daily work simpler and more enjoyable. Imagine:
Setting up projects in minutes instead of hours Never searching for missing files again Helping your team solve build problems more efficiently Feeling more confident in your technical abilities These practical skills make you more effective at work and can create new career opportunities.
Ready to Enhance Your Skills?
If you’re ready to organize your projects better and work more efficiently, learning Maven is a great next step. Having the right guidance makes all the difference in how quickly you learn and how well you can apply what you’ve learned.
Interested in learning more? Contact DevOpsSchool today!
📧 Email: [email protected]
📞 Phone/WhatsApp (India): +91 84094 92687
📞 Phone/WhatsApp (USA): +1 (469) 756-6329
🌐 Website: https://www.devopsschool.com/


View the full article
reporter

How to block websites with screentime

We as parents find ourselves with the requirement of blocking certain websites from our children. If your child is lucky enough to have an iPhone, Apple has made this easy to do for us parents.
On your childs cell phone, click Settings and scroll down to Screen Time as shown below

Now click on Content & Privacy Restrictions

Find Web Content and click on that as shown below

You should see a screen similar to the one below. Make sure Limit Adult Websites is checked and below under the Never Allow click Add Website and enter the URL of the website you do not want your child to access.

Simply enter the URL and click done and then you can repeat the process as many times as you want.

Why this is so great is no matter if they are using WiFi or Cell Service.. this configured iPhone will never be able to reach the configured sites using a Browser
Now there is a catch… You kid can download a VPN app which will allow them to still connect to the apps. Search the phone for VPN and see if anything comes up. If it does, delete it!
Porn
Gambling
eChat Rooms
Omegle.com
PalTalk.com
TalkWithStranger.com
ChatRoulette.com
chat-Avenue.com
Chatango.com
Teenchat.com
Wireclub.com
ChatHour.com
Chatzy.com
Chatib.us
E-chat.co
Dating Sites

Tinder
Tinder | Dating, Make Friends & Meet New People
With 55 billion matches to date, Tinder® is the world’s most popular dating app, making it the place to meet new people. Match.com
Bumble.com
MeetMe.com
OKCupid.com
Plenty of Fish (POF.com)
eHarmony.com
Zoosk.com
Hinge.co
Grindr.com
AshleyMadison.com

Cowboy Denny

Warning: React2Shell vulnerability already being exploited by threat actors

Plugging the React2Shell vulnerability in the open source React server and Next.js in IT environments has just become even more urgent with reports that exploits are already in the wild.
Researchers at Greynoise said today they are seeing “opportunistic, largely automated exploitation attempts” trying to take advantage of the unsafe deserialization vulnerability in React Server Components (RSC).
There’s an early focus on attacking just this vulnerability, the report adds, “but we’ve already detected a slow migration of this CVE being added to Mirai and other botnet exploitation kits.”
The initial access attempts are using publicly disclosed proof of concept (PoC) code as a base, Greynoise says, with stage 1 payloads performing proof of execution (PoE) probes (for example, PowerShell arithmetic) to validate RCE cheaply, and using coded PowerShell download-and-execute stagers. Then a stage 2 payload that uses reflection to set System.Management.Automation.AmsiUtils.amsiInitFailed = true (a standard AMSI bypass), and iex executes the next stage.
JFrog’s security research team also today reported finding a working proof of concept that leads to code execution, and they and others have also reported finding fake PoCs containing malicious code on GitHub. “Security teams must verify sources before testing [these PoCs],” warns JFrog.
Amitai Cohen, attack vector intel lead at Wiz, also said today that the firm has seen both proof of concept exploits being published and active exploitation attempts in the wild. “Our threat teams have detected these attempts across customer environments, including deployments of cryptojacking malware and efforts to steal cloud credentials from compromised machines,” he said in an email.
The Greynoise report follows one by New Zealand researcher Lachlan Davidson, who discovered the holes and found that a real proof of concept began circulating about 30 hours after those maintaining React revealed the holes.
Separately, Amazon said its threat intelligence teams have seen active exploitation attempts by multiple China state-nexus threat groups, including Earth Lamia and Jackpot Panda.
AWS has deployed multiple layers of automated protection, including the AWS WAF (web application firewall). But the company stresses these protections aren’t substitutes for patching, even for IT departments running React or Next.js in an Amazon environment.
Related content: Cloudflare firewall reacts badly to React exploit mitigation
If exploited, the vulnerability, tracked as CVE-2025-55182 in React RCS and CVE-2025-66478 specifically for the Next.js framework, allows a threat actor to remotely run malicious code.
Maintained by Meta, React is an open source library for building application interfaces. There are several frameworks that build on top of it, with Next.js being highly popular among developers, so exploiting the vulnerability in RCS can spread to these frameworks.
The critical vulnerability in React Server Components has a maximum Common Vulnerability Scoring System (CVSS) score of 10. Affected are React versions 19.x and Next.js versions 15.x and 16.x when using App Router.
The problem specifically is in RCS’s Flight protocol, used for communications with clients such as browsers. RCS, notes Greynoise, is a high value target since it sits in front of application logic that often runs with production permissions.
“Thanks to services such as BuiltWith/Wappalyzer, the exposed services are easy to find and exploit at scale,” Greynoise warned.
However, there are some nuances in these early reports of proofs of concept.
Davidson noted that the day-0 protections from some application security providers are actually runtime-level, and not just web application firewall rules. That means many customers with theoretically vulnerable versions are still protected, he wrote.
Amazon added that analysis of data from its honeypot shows the persistent nature of some exploitation attempts. In one notable example, an unattributed threat cluster associated with IP address 183[.]6.80.214 spent nearly an hour on Thursday systematically troubleshooting exploitation attempts.
This included 116 total requests directed at a target over 52 minutes, attempts at placing multiple exploit payloads, attempts at executing Linux commands, attempts to write files to /tmp/pwned.txt, and attempts to read /etcpasswd.
“This behavior demonstrates that threat actors aren’t just running automated scans,” Amazon said, “but are actively debugging and refining their exploitation techniques against live targets.
Edgar Kussberg, project lead for AI and development tools at Sonar, said to blunt attacks, developers or infosec teams should:
run an analysis: Deploy tests to find vulnerable code and misconfigurations before an attacker can; get a clean signal: Focus on finding and fixing true positives and the most severe vulnerabilities; verify code against updated rules: Ensure all defensive software is updated with the latest rules designed to detect and flag the specific React2Shell pattern, not just generic parameters.
View the full article
reporter

Warning: React2Shell vulnerability already being exploited by threat actors

Plugging the React2Shell vulnerability in the open source React server and Next.js in IT environments has just become even more urgent with reports that exploits are already in the wild.
Researchers at Greynoise said today they are seeing “opportunistic, largely automated exploitation attempts” trying to take advantage of the unsafe deserialization vulnerability in React Server Components (RSC).
There’s an early focus on attacking just this vulnerability, the report adds, “but we’ve already detected a slow migration of this CVE being added to Mirai and other botnet exploitation kits.”
The initial access attempts are using publicly disclosed proof of concept (PoC) code as a base, Greynoise says, with stage 1 payloads performing proof of execution (PoE) probes (for example, PowerShell arithmetic) to validate RCE cheaply, and using coded PowerShell download-and-execute stagers. Then a stage 2 payload that uses reflection to set System.Management.Automation.AmsiUtils.amsiInitFailed = true (a standard AMSI bypass), and iex executes the next stage.
JFrog’s security research team also today reported finding a working proof of concept that leads to code execution, and they and others have also reported finding fake PoCs containing malicious code on GitHub. “Security teams must verify sources before testing [these PoCs],” warns JFrog.
Amitai Cohen, attack vector intel lead at Wiz, also said today that the firm has seen both proof of concept exploits being published and active exploitation attempts in the wild. “Our threat teams have detected these attempts across customer environments, including deployments of cryptojacking malware and efforts to steal cloud credentials from compromised machines,” he said in an email.
The Greynoise report follows one by New Zealand researcher Lachlan Davidson, who discovered the holes and found that a real proof of concept began circulating about 30 hours after those maintaining React revealed the holes.
Separately, Amazon said its threat intelligence teams have seen active exploitation attempts by multiple China state-nexus threat groups, including Earth Lamia and Jackpot Panda.
AWS has deployed multiple layers of automated protection, including the AWS WAF (web application firewall). But the company stresses these protections aren’t substitutes for patching, even for IT departments running React or Next.js in an Amazon environment.
Related content: Cloudflare firewall reacts badly to React exploit mitigation
If exploited, the vulnerability, tracked as CVE-2025-55182 in React RCS and CVE-2025-66478 specifically for the Next.js framework, allows a threat actor to remotely run malicious code.
Maintained by Meta, React is an open source library for building application interfaces. There are several frameworks that build on top of it, with Next.js being highly popular among developers, so exploiting the vulnerability in RCS can spread to these frameworks.
The critical vulnerability in React Server Components has a maximum Common Vulnerability Scoring System (CVSS) score of 10. Affected are React versions 19.x and Next.js versions 15.x and 16.x when using App Router.
The problem specifically is in RCS’s Flight protocol, used for communications with clients such as browsers. RCS, notes Greynoise, is a high value target since it sits in front of application logic that often runs with production permissions.
“Thanks to services such as BuiltWith/Wappalyzer, the exposed services are easy to find and exploit at scale,” Greynoise warned.
However, there are some nuances in these early reports of proofs of concept.
Davidson noted that the day-0 protections from some application security providers are actually runtime-level, and not just web application firewall rules. That means many customers with theoretically vulnerable versions are still protected, he wrote.
Amazon added that analysis of data from its honeypot shows the persistent nature of some exploitation attempts. In one notable example, an unattributed threat cluster associated with IP address 183[.]6.80.214 spent nearly an hour on Thursday systematically troubleshooting exploitation attempts.
This included 116 total requests directed at a target over 52 minutes, attempts at placing multiple exploit payloads, attempts at executing Linux commands, attempts to write files to /tmp/pwned.txt, and attempts to read /etcpasswd.
“This behavior demonstrates that threat actors aren’t just running automated scans,” Amazon said, “but are actively debugging and refining their exploitation techniques against live targets.
Edgar Kussberg, product lead for AI and development tools at Sonar, said to blunt attacks, developers or infosec teams should:
run an analysis: Deploy tests to find vulnerable code and misconfigurations before an attacker can; get a clean signal: Focus on finding and fixing true positives and the most severe vulnerabilities; verify code against updated rules: Ensure all defensive software is updated with the latest rules designed to detect and flag the specific React2Shell pattern, not just generic parameters.
View the full article
reporter

MacRumors 2025 Holiday Gift Guide

If you're looking for the perfect tech or tech-adjacent present for someone who loves Apple products or just uses them daily, I have a few suggestions that might be helpful to you this holiday season.


These are some of our favorite products, many of which I use personally or have gifted to our friends and family members in the past. If you're still looking for a present for someone that's hard to shop for, check out the list.

Maclock

For Apple fans or fans of classic PCs, the Maclock is a tiny Macintosh 128K that works as an alarm clock. It is super detailed and has all of the design touches of the original, and there's even a tiny floppy disk that turns it on when you put it in.


There are multiple display modes, and it can tell you the time, day of the week, and temperature, plus it is a functional alarm clock. There's also a classic Mac face you can set it to. I haven't gifted it yet, but I bought one of these a few weeks ago. It does ship from China, so order ASAP.

I've seen a few different versions of this product, but this variant has no third-party logo on the front, and it's just $30.

If you want to spend a bit more, RayCue has some retro-style Macs that are actually designed to be docks. I haven't used one, but it looks like a fun desktop accessory.


Pico-Mac-Nano

While I'm on the subject of mini Macs, I don't want to leave out the Pico-Mac-Nano from Nick Gillard. The Maclock is palm-sized, but the nano is even smaller at just under 2.5 inches, plus it has an actual Mac operating system. Gillard did sell these fully assembled at one point, but Apple asked him to stop.


You can still get the parts to make one, and Gillard has instructions. There's a full kit for GBP62.00 (around $100 shipped to the U.S.), and it would be a great gift for someone who likes retro items and a project.

Aura Frames

Priced starting at $149, Aura digital frames make a good gift for anyone who has digital photos, which is most of us these days. You can load photos on the frame using the Aura iPhone app, and since images are stored in the cloud, there's no limit.


Multiple people can upload images to a single frame, so it's a great way to share photos with friends and family members. If you know someone that's not technically savvy, like a grandparent, it's still the perfect gift because you can load photos for them remotely. The $149 10.1-inch Carver is Aura's most affordable option, but there are sizes up to 15 inches, like the $299 Walden. Aura also makes higher resolution options, including the $199 Mason, and all the frames come in multiple colors to match any decor.


Everyone I've gifted an Aura frame to has loved it, and it's my go-to for people that are hard to shop for. This year, Aura launched a frame that uses e-ink for a softer, more art-like look. It changes images less often and it's expensive at $449, but it has a different vibe than your standard photo frame.



LEGO Retro Radio

Priced at $100, the Retro Radio from LEGO has a sweet, nostalgic design, complete with a tuner, knobs, and speaker grille. It's actually functional, because you can remove the back plate from the set and place an ‌iPhone‌ inside so that the radio plays music.


There's a built-in smartphone stand that holds the ‌iPhone‌ in place, but if you don't want to use an ‌iPhone‌, there's also a little sound brick that plays different sounds when you turn the knob. I have one of these, and it was a fun build.


There are other LEGO sets that make for good gifts, even for people who aren't LEGO collectors. Anyone that likes a puzzle would probably like a LEGO set, and some have wide appeal. Here are a few I've gotten this year that would make for good gifts:

LEGO Super Mario Game Boy ($60) - This isn't a working Game Boy, unfortunately, but it does come with swappable screens and LEGO game cartridges. It is possible to make a working version if you're so inclined.
LEGO Botanicals Happy Plants ($19) - I'm a fan of the LEGO botanicals, and this set is small, inexpensive, and fun for the desktop.
LEGO Botanicals Hibiscus ($70) - All of the LEGO botanicals make good gifts (I'm gifting a set of flowers and a bonsai this year), but the hibiscus is a newer set that has a unique flower shape and it comes with a pot so it matches sets like the orchid. Other great botanical options include the mini bonsais and the tiny plants set (a personal favorite).
LEGO Kingfisher ($40) - This set was a lot of fun to put together, and it makes a great desk display because of its bright colors. It would be nice for a bird lover.
LEGO Insects ($63) - This set has a butterfly, a Hercules beetle, and a praying mantis, and it's another excellent display piece. This one is delicate and can be a little frustrating, but it's one of my favorites in the ideas series.

I do buy LEGO set gifts for people who aren't into LEGO and who haven't done one before, and it tends to go over well.

Nanoleaf Display Boxes

Earlier this year, I reviewed the Nanoleaf LED Expo Display Cases, and they're one of my favorite Nanoleaf products to date. They're far from cheap at $270, but they would make an excellent gift for someone that collects high-end sneakers, anime figures, or anything in that vein. The boxes can be set to 16 million colors or shades of white, and colors can change in time with music.


I think Nanoleaf designed these for sneaker collectors, but anything can be put inside. Like a lot of Nanoleaf devices, these aren't going to go with every decor choice, but collectors and gamers will love them.


AirPods

You'll never go wrong with AirPods as a gift, and there are two really good options to choose from this year. The AirPods Pro were just refreshed with a third-generation version, and for $249, you get excellent Active Noise Cancellation and sound quality.


The AirPods Pro 3 have a new design that's more ergonomic and foam-infused silicone tips that fit snugly in the ears to drown out sound. With hearing aid support, ‌AirPods Pro 3‌ could be useful for a family member that has mild hearing loss but doesn't wear hearing aids.

If you're purchasing for someone who doesn't like silicone ear tips, the AirPods 4 are an option. You can get them with or without Active Noise Cancellation. The ANC version doesn't cut out as much noise as the ‌AirPods Pro 3‌, but it's enough to make a difference.


The AirPods 4 with ANC are a steal at $99 from Amazon right now, so it's not even worth getting the non-ANC version.

I prefer the AirPods Pro fit and ANC over the ‌AirPods 4‌ because I have smaller ears and the ‌AirPods 4‌ can be painful. The AirPods Pro can drown out the sound of the heater, leaf blowing outside, the TV in the next room, road noise, and other sounds that sometimes drive me nuts. The ‌AirPods 4‌ are so inexpensive, though, that they're a great option on a budget.

Philips Hue Lights

I think I've tried every HomeKit smart bulb and light available at this point, and Philips Hue lights are the best you can get. I have no patience for lights that constantly disconnect or have connectivity issues, and the Hue bulbs don't. There is a $65 to $100 Bridge, but it's worth it. I mostly use Hue lights, and I've invested hundreds of dollars in my setup over time. Bulbs I have from almost 10 years ago are still functional.


The $143 White and Color Starter Kit comes with two Hue bulbs that can go in any lamp that supports E26 bulbs, and it comes with the hub. It's one of the best bets if you're buying a gift for someone who is new to smart home products. The bulbs can be controlled with the Home app or the Hue app, and they can be set to 16 million colors. Hue has great light effects and scenes that really shine when you have multiple bulbs.



For a cheaper option, there's the $99 Essentials Starter Kit that comes with a hub and four lower-power E26 multi-color bulbs. Hue Essentials bulbs don't dim quite as low and the color isn't as precise.



Lightguide bulbs ($99) - These are perfect paired with a simple lamp base, because the bulb is meant to be the star. I have two of the ellipse bulbs, and they're enormous and look great.
String lights ($132) - For holiday fans or those with patio setups crying out for lighting, the Hue Festavia String Lights would make a good gift.
Signe floor lamp ($363) - The Signe floor lamp isn't the most practical light because it doesn't have a wide radius and is meant to face the wall, but it makes for great accent lighting.
Hue Go ($99) - The Hue Go is a portable lamp that you can use plugged in or with the built-in battery, and it supports all of the same features as Hue bulbs. It's a nice accent light and good to have around for power outages.
Hue Go Portable Table Lamp - This is a lot like the Hue Go, but it's a more traditional looking lamp. It's water resistant, so it can go outdoors, too. I haven't tried this one yet, but it's on the wishlist.
Downlights ($66) - If you know someone that has those old can style downlights, a Hue upgrade would make a good gift. Downlights are super simple to swap out, and switching from the older models to Hue saves money and adds new lighting options. I switched all the downlights in my house to Hue and have no regrets.
Outdoor Lights ($176+) - I swapped my porch lights and the lights in the back to Hue lights this year. It's more involved than downlight swaps, but provides fun lighting options for the holidays. I installed two of the Appear and three of the Econic, all of which have been working flawlessly. I use these with motion detectors. Hue also has some Festavia globe outdoor lights that look amazing, but I haven't tried them.


Bambu Lab 3D Printer

Bambu Lab makes a range of 3D printers that you can print to using just an app on your ‌iPhone‌ or your Mac. The A1 Mini is just $219, or $329 with the AMS Lite that lets you print with up to four filament colors. Bambu's printers are sort of the ‌iPhone‌ of 3D printers in that they're relatively easy to operate and have a lot of bells and whistles to streamline printing and cut down on issues. Models like the H2S and P2S come with an enclosure, and there are now several machines like the H2D that also have a laser cutting module.


I've had a Bambu X1C for over two years now and do not hesitate to recommend Bambu printers for those interested in getting into 3D printing. It's easy to use, there are thousands of STLs out there for making everything you can think of, and you can even make your own using software like Tinkercad, Fusion 360, or even Nomad Sculpt on the iPad. I use my 3D printer weekly, if not daily, and Bambu printers get better all the time with new print options from Makerworld.


I haven't personally used the A1 Mini, but it's a much more affordable way to try 3D printing, and it could make a great gift for an older child or a partner who likes to tinker. They're not entirely problem free, but I've been able to solve every issue I've run into, and there are endless settings to optimize.

Portable Anker Chargers

I reviewed portable power banks from several different brands this year, and I have two favorites that I keep coming back to from Anker.


I love the $54 MagGo Nano Power Bank for wireless charging. It's the slimmest MagSafe power bank that I've tried, and it's so much better than thicker, bulkier models. I have a 17 Pro Max and it doesn't bother me to use it with the power bank attached because it doesn't add too much extra weight. It's only a 5,000 mAh battery so I don't get a full charge, but it's more than enough to get me through a day of heavy phone usage.

My other favorite is the $60 Nano Power Bank with Retractable Cable. I didn't love this one right when I tried it because it's thick and rectangular, but it's turned out to be the power bank that I reach for most often. I like the lanyard, and the retractable USB-C cable is useful because I never need to hunt one down. I tend to prefer this power bank even over the magnetic model because the wired charging is much faster. Next time there's a sale, I plan to pick up another in teal.



Ugreen Uno Chargers

Ugreen's "Uno" line features chargers with fun little faces, and I think they're great.


There's a $35 65W charger with four ports, which has legs and a digital panel with face emoji that change based on charging state. When a device is fast charging, for example, there's a face that looks like it has its mouth full, and when charging is finished, there's a little face with sunglasses. I've used this one on my desktop power strip for the last year.


There are also two power banks that have the little emoji faces, one that's 5,000 mAh with Qi2 for $35, and one that's 10,000 mAh with USB-C for $50. They come with built-in stands that look like little headphones, which is a nice touch because you can use the stand for watching videos or FaceTiming. When I want to charge and need a stand, I use these.

Nimble's Wall Chargers

Nimble has $42 65W Wally Wall Chargers that come with a retractable 2-foot USB-C cable, and I love them. The prongs fold down and the cable retracts inside the enclosure, so they're ideal for travel. I have a cat that likes to nibble cables, and these keep the cable out of the way unless I'm charging. There's an extra USB-C port at the bottom so you can actually charge two devices at once.


If you buy them from Apple, you can get fun colors that include deep purple or teal, though they're more expensive at $60. Nimble also has power banks in colors you don't often see, and I am a fan, but I don't love having to supply my own USB-C cable.

Bird Buddy

Available starting at $99, the Bird Buddy is the kind of gift that almost anyone will like, which makes it great for the person that has everything. It's a Wi-Fi connected smart bird feeder that sends you pictures of the birds that come to visit.


You'll need to fill it with seed regularly and charge it up when necessary, but other than that, it operates on its own. To do away with charging, I recommend the solar version, which starts at $149.


I've gifted the Bird Buddy and it's been a huge hit, with adults and kids too.

Birdfy Bird Feeders

Birdfy is a lot like Bird Buddy, but it has product options that Bird Buddy doesn't offer. You can get a standard Bird Feeder for the same $99 price as Bird Buddy, but if you're willing to spend a little more, there's a bigger version with multiple cameras.


The $330 Birdfy Feeder 2 Duo has a triple-lens camera, including a dual-lens front camera and a second side camera to capture birds from every angle. It holds more seed than a standard version and comes with a solar panel. If you've gifted someone a Bird Buddy and they love it, this is the next upgrade option.

Birdfy also sells the Bath Pro, which is a solar-powered smart birdbath with a camera. It's priced starting at $200 and lets you get photos of birds bathing and drinking. In some areas of the U.S., people in apartments and condos aren't able to put out bird feeders because of rats and pigeons. This is an excellent gift for someone that wants to attract birds but isn't able to have a feeder, but it's also great for avid birders.


With bird feeders, you often need a specific kind of food to attract the birds you want, but a bird bath has more universal appeal.

Govee Light Projectors

Govee came out with some Matter-enabled projectors this year that can project stars or ocean scenes onto the walls and ceiling. I've been testing these for a month or so and have a review coming soon, but I think the lower-priced models would make a good gift.


The $56 Star Light Projector has different night sky light effects paired with laser stars, while the $50 Ocean version has more of an under-the-sea vibe. There's a $180 Pro model with swappable galaxy scenes and laser stars, but it's really best for the real space projector enthusiast.

Robot Vacuums

I tested several Matter-enabled robot vacuums this year, and I am sold. These are excellent at vacuuming and mopping, and can be real time savers. I particularly liked the Deebot X11 Omnicyclone, the Deebot X9 Pro, and the Roborock Saros 10R. Some of these are over $1,100, but you get what you pay for.


I've tested some lower-cost versions and have a review in the works, but the lower-end models I've used lack the navigation capabilities of the more expensive versions and add a lot more frustration to the cleaning process. Not all brands are the same, though, so it's worth some research on the best option.

Epson EcoTank Photo ET-8550

For printing photos, Epson's printers are some of the best, though Canon has its fans too. I recently got the EcoTank Photo ET-8550, and I think it's a great option if you want to get your images off of your phone.


It's normally $800, but Best Buy has it for $500 right now. EcoTank printers are more expensive than your standard printer because the ink is cheap. These use refillable liquid ink rather than printer cartridges, and that is the main reason why I chose this model.

Epson has to make its on the printer upfront because the ink lasts so much longer and is so much more affordable. There are other EcoTank printers that aren't as expensive, but this one is optimized for images and prints at up to 13"x19".

Plant Grow Lights

An iPhone-connected light is a great gift for someone that's into plants, and you will never go wrong with a light for an indoor plant collector.


I like Modern Sprout light options for the clean aesthetic. There's a $90 light bar, a $200 grow house ideal for the kitchen counter, and a $270 Growframe that goes on the wall. The app lets you set the brightness and the schedule for the lights, which is essential.

Aerogarden is also a good option, with prices that start at $16. I have the $50 AeroGarden Tabletop Grow Light that I've been using for a few years, and it works well. The lights are programmable with the Aerogarden app.

$349 iPad and Apple Pencil

For someone who is creative or wants to get into drawing, 3D sculpting, modeling, or similar, an ‌iPad‌ with an Apple Pencil is the best possible gift. Apps like ProCreate and Nomad Sculpt are powerful, and the ‌Apple Pencil‌ gives you a level of control that's hard to get on a Mac or PC.


The ‌iPad‌ does a lot and it's an ideal gift for anyone, but it could really spark the creativity of an artistic child, or provide a new medium for an adult that already likes to sketch and draw. I have an iPad Pro with an ‌Apple Pencil‌ Pro, but all of Apple's iPads can be used with an ‌Apple Pencil‌, even the $349 model.

The $499 iPad mini is the best for something to use on the go, and the $899 13-inch iPad Air is a good option if you want the biggest screen without paying ‌iPad Pro‌ prices.

Gift Suggestions

Have a great product suggestion we don't have in our list? Let us know in the comments below.

Note: MacRumors is an affiliate partner with some of these companies and may earn commissions on purchases made through links in this article.
This article, "MacRumors 2025 Holiday Gift Guide" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

Insecure use of Signal app part of wider Department of Defense problem, suggests Senate report

The Signalgate scandal that enveloped US Secretary of Defense Pete Hegseth in March appears to be symptomatic of a wider lax attitude towards the use of non-approved messaging apps by officials and employees, a Senate Committee has concluded.
In March, the US Senate Committee on Armed Services set out to examine issues raised by the Signalgate incident: the need to clarify the existing rules on using “non-controlled” apps, and looking at whether Defense Secretary Hegseth adhered to them in his use of Signal, and whether his actions were evidence of a wider culture of insecure app usage within the Department of Defense (DoD).
This week’s dual reports have come back with a mixed assessment of these points. Broadly, what Hegseth was accused of doing – communicating sensitive information using a third-party messaging app – appears to have been happening at the DoD in less serious contexts since at least 2020.
This mirrors issues familiar to enterprises: unsanctioned or unmanaged messaging apps, including ones touting end-to-end encryption (E2EE) security, quickly become an IT backchannel that can invisibly undermine carefully-assembled security, compliance, and data retention policies.
Shadow communications
The first report, an assessment of the Defense Secretary’s use of the Signal app to communicate with senior colleagues in advance of a military operation against Yemen on March 15, is used to illustrate the point. It confirms the widely reported fact that two hours before the raid, Hegseth revealed details of the operation to a Signal group of 19 people, including a journalist who had been added to it in error.
In doing so, the report agrees he violated security policies by sending sensitive information from a personal device, and using the non-approved Signal app in a way that revealed important operational details in advance of the strike. The report ducks the issue of whether this information was classified at the time it was sent, noting that Hegseth was senior enough to determine this for himself.
The second background report has uncovered evidence of a more general culture of shadow communications in the DoD, including widespread use of video-conferencing apps during the Covid 19 pandemic.  
The evidence gathered is sparse and partly redacted, making it difficult to assess the seriousness of any breaches. Because the scope of its remit was limited to the evidence from previous audits, one of the committee’s recommendations is to undertake a more comprehensive assessment of unsanctioned app usage inside the DoD. There’s also a question mark around how old audits analyzed by a Senate committee could accurately measure something that, by its nature, is hidden and only recorded on personal devices.
Nevertheless, the report says it is certain that Hegseth’s actions were not an isolated example, noting that staff had “used non-DoD-controlled electronic messaging systems for a variety of reasons. For example, some personnel used them because of the systems’ perceived appearance of security. As a result, DoD personnel increased the risk of exposing sensitive DoD information to our adversaries and did not comply with the legal obligation to retain and preserve official records.”
In short, while there was no evidence that unsanctioned app use is routine or normalized, it is likely that enough staff are using them to make a serious breach possible at some point. The report concludes that one of the reasons staff have taken to these messaging apps was that they lack convenient alternatives. It recommends developing approved apps to remove this need, implementing a training program to ensure existing communication regulations are complied with, and limiting the authority to use messaging apps to senior staff, in specific circumstances.
What’s surprising about this is that it has taken a major political row at government level to raise an issue that enterprise CISOs have been grappling with for years: the effects of BYOD, shadow IT (and now shadow AI), and unsanctioned apps that creep into organizations without anyone realizing it.
Over the last two decades, the rise of mobile devices, the cloud, and apps has radically de-centralized IT in ways that top-down management models struggle to control. Meanwhile, nothing has changed; the Signal app at the center of this scandal remains hugely popular on both sides of the political divide, despite the appearance of additional issues with the technology. 

View the full article
reporter

Chinese cyberspies target VMware vSphere for long-term persistence

Chinese state-sponsored threat actors are backdooring VMware vCenter and VMware ESXi servers with a malware program written in Go, allowing them to maintain long-term persistence in victim networks. According to a joint report by the US Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), and Canadian Centre for Cyber Security (Cyber Centre) organizations from the government services and facilities and IT sectors have been the primary targets.
The malware program, known in the security industry as BRICKSTORM, was first reported by researchers from Mandiant and Google’s Threat Intelligence Group in September. At the time, Google said the backdoor remained undetected for 369 days on average and was found inside the networks of US legal services firms, SaaS providers, business process outsourcers, and technology companies.
For its part, CISA has thus far analyzed eight separate BRICKSTORM samples, including one collected from a VMware vCenter server of an organization where the infection went undetected for over a year and a half allowing attackers to move laterally through the network.
From web shell to domain control
In the incident investigated by CISA, the attackers originally compromised a public-facing web server, though it’s unclear through what method. This was followed up by the deployment of a web shell — essentially a web script that serves as a backdoor to enable the attackers to remotely execute commands on the server.
From the web server, the attackers were able to extract credentials for a service account and used it to access a domain controller from where they copied the Active Directory database. Credentials for a second service account were used to access another domain controller on the internal network and copy the AD database, which included credentials used by a managed service provider (MSP).
Using the MSP credentials, the attackers were able to access a VMware vCenter server and deployed the BRICKSTORM malware in the /etc/sysconfig/ directory.
Designed to work in virtualized environments
The CISA, NSA, and Canadian Cyber Center analysts note that some of the BRICKSTORM samples are virtualization-aware and they create a virtual socket (VSOCK) interface that enables inter-VM communication and data exfiltration.
The malware also checks the environment upon execution to ensure it’s running as a child process and from a specific path. This is part of a set of self-monitoring capabilities that ensure its persistence by reinstalling and executing itself if it detects something is not running correctly.
The malware mimics web server functionality for its command-and-control (C2) communication to blend in with legitimate traffic. It also provides a SOCKS5 proxy for attackers to tunnel traffic during lateral movement operations.
In terms of features, BRICKSTORM allows threat actors to browse the file system and execute shell commands, providing them with complete control over the compromised system.
“Once the secure connection to the C2 domain is established, Sample 1 uses a custom Go package wssoft2 to manage incoming network connections and to process commands it receives,” the CISA analysts said. “Commands are directed to one of three handlers based on the function it needs: SOCKS Handler, Web Service Handler, and Command Handler.”
Mitigations
The joint advisory includes indicators of compromise for the analyzed samples as well as YARA and Sigma detection rules. The agencies also make the following recommendations:
Upgrade VMware vSphere servers to the latest version. Harden your VMware vSphere environments by applying VMware’s guidance. Take inventory of all network edge devices and monitor for any suspicious network connectivity originating from these devices. Ensure proper network segmentation restricts network traffic from the DMZ to the internal network. Disable RDP and SMB from the DMZ to the internal network. Apply the principle of least privilege and restrict service accounts to only needed permissions. Increase monitoring for service accounts, which are highly privileged and have a predictable pattern of behavior (e.g., scans that reliably run at a certain hour of the day). Block unauthorized DNS-over-HTTPS (DoH) providers and external DoH network traffic to reduce unmonitored communications. View the full article
reporter

MacRumors Giveaway: Win an iPhone 17 From GRID Studio

For this week's giveaway, we've teamed up with GRID Studio to offer MacRumors readers a chance to win a new iPhone 17 from Apple. GRID Studio is a company that takes discarded Apple devices and turns them into collectible art for Apple fans.


If you're still looking for holiday gifts, GRID Studio has a Christmas sale going on this week. You can get 20 percent off site wide with promo code CM20, and there are also deeper discounts on select items.

The iPhone 2G is available for $299, down from $399. The GRID 2G is one of the most popular devices that GRID Studio sells, because it showcases the first iPhone that Apple made. It highlights all of the components that were in the original 2007 ‌iPhone‌, including the curved shell, power button, headphone socket, speaker, logic board, and ear piece.


Apple's original ‌iPhone‌ was made well before Apple started manufacturing its own chips, so there are some unique components to reminisce about.

The iPhone 4s is available for $99, down from $139. The ‌iPhone‌ 4S was the last ‌iPhone‌ introduced during Apple co-founder Steve Jobs' lifetime, and it was the first ‌iPhone‌ Apple CEO Tim Cook released without Jobs. It was the fifth ‌iPhone‌ that Apple came out with, and in the name, the "S" stood for Siri. The ‌iPhone‌ 4S was the first ‌iPhone‌ that included Apple's personal assistant.


Compared to the ‌iPhone‌ 4, the ‌iPhone‌ 4S included an upgraded A5 chip, an 8-megapixel camera, and up to 64GB of storage. It ran iOS 5, a major operating system update that brought features like iCloud and iMessage. All of the internal components from the ‌iPhone‌ 4S are thoughtfully arranged in GRID Studio's piece, and there's even a look at the default app arrangement that was available at the time.

GRID has the iPhone 5 available for $109, down from $139. The GRID 5 highlights the 2012 ‌iPhone‌ 5, which was the first ‌iPhone‌ that was developed under Apple CEO ‌Tim Cook‌ and the last ‌iPhone‌ that Apple CEO Steve Jobs was involved with. The ‌iPhone‌ 5 is an important part of Apple's history because it included a taller 4-inch display, and it was the first ‌iPhone‌ to use the Lightning port rather than the 30-pin port.


GRID also makes art from other Apple products, like Apple Watches. The GRID Watch 1st Gen is available for $149, and it features Apple's first-ever Apple Watch. Components include the heart rate sensor, flex cable, display, main board, S1 chip, speaker, power button, battery, and Taptic Engine, along with the casing and band. It's a fun piece of Apple history for Apple Watch fans.


We have an ‌iPhone 17‌ to give away to one lucky MacRumors reader. To enter to win, use the widget below and enter an email address. Email addresses will be used solely for contact purposes to reach the winner(s) and send the prize(s). You can earn additional entries by subscribing to our weekly newsletter, subscribing to our YouTube channel, following us on Twitter, following us on Instagram, following us on Threads, or visiting the MacRumors Facebook page.

Due to the complexities of international laws regarding giveaways, only U.S. residents who are 18 years or older, UK residents who are 18 years or older, and Canadian residents who have reached the age of majority in their province or territory are eligible to enter. All federal, state, provincial, and/or local taxes, fees, and surcharges are the sole responsibility of the prize winner. To offer feedback or get more information on the giveaway restrictions, please refer to our Site Feedback section, as that is where discussion of the rules will be redirected.


GRID Studio Giveaway
The contest will run from today (December 5) at 10:00 a.m. Pacific Time through 10:00 a.m. Pacific Time on December 12. The winner will be chosen randomly on or shortly after December 12 and will be contacted by email. The winner will have 48 hours to respond and provide a shipping address before a new winner is chosen.Tag: Giveaway
This article, "MacRumors Giveaway: Win an iPhone 17 From GRID Studio" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

Apple's Return to Intel Rumored to Extend to iPhone

Intel is expected to begin supplying some Mac and iPad chips in a few years, and the latest rumor claims the partnership might extend to the iPhone.


In a research note with investment firm GF Securities this week, obtained by MacRumors, analyst Jeff Pu said he and his colleagues "now expect" Intel to reach a supply deal with Apple for at least some non-pro iPhone chips starting in 2028.

The non-pro iPhone chips would be manufactured with Intel's future 14A process, according to Pu.

The research note did not provide any other details about these potential plans, but based on the stated timeframe, Intel could start supplying Apple with the A22 chip for devices like the "iPhone 20" and "iPhone 20e" in around three years from now.

Importantly, there is no indication that Intel would play a role in designing the iPhone chips, with its involvement expected to be strictly limited to fabrication. Apple would continue to design iPhone chips, and Intel would start to handle a smaller percentage of manufacturing alongside Apple's primary chipmaker TSMC.

Last month, Apple supply chain analyst Ming-Chi Kuo said he expects Intel to begin shipping Apple's lowest-end M-series chip for select Mac and iPad models as early as mid-2027. For this, Kuo said Apple plans to utilize Intel's 18A process, which is the "earliest available sub-2nm advanced node manufactured in North America."

Intel supplying Apple-designed, Arm-based chips would differ from the era of Intel-based Macs, which used Intel-designed processors with x86 architecture.

Apple reaching a chip supply deal with Intel would boost its reliance on an American manufacturing company and help to diversify its supply chain.

Intel previously supplied Apple with cellular modems for some iPhone 7 to iPhone 11 models.Tags: Intel, Jeff Pu
This article, "Apple's Return to Intel Rumored to Extend to iPhone" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

CVE-2025-55182: Critical Vulnerability, React2Shell, Allows for Unauthenticated RCE

Cybereason is continuing to investigate. Check the Cybereason blog for additional updates.      KEY TAKEAWAYS
Critical vulnerability discovered on December 3, 2025 in React that could allow for unauthenticated remote code execution.  Cybereason experts have dubbed this vulnerability as trivial to exploit.  Issue allows the server to incorrectly trust user-supplied identifiers and fails to verify.  Initial working proof of concept is public and attributed to Chinese threat actors.  If server was exposed to public internet prior to patch release date (December 3, 2025), investigate for signs of compromise.  Update to latest patched versions of React, and review advisory for additional recommendations.   View the full article
reporter

Zero-Click Agentic Browser Attack Can Delete Entire Google Drive Using Crafted Emails

A new agentic browser attack targeting Perplexity's Comet browser that's capable of turning a seemingly innocuous email into a destructive action that wipes a user's entire Google Drive contents, findings from Straiker STAR Labs show. The zero-click Google Drive Wiper technique hinges on connecting the browser to services like Gmail and Google Drive to automate routine tasks by granting themView the full article
reporter

15 New Things Your iPhone Can Do in iOS 26.2

Apple is about to release iOS 26.2, the second major point update for iPhones since iOS 26 was rolled out in September, and there are at least 15 notable changes and improvements worth checking out. We've rounded them up below.


Apple is expected to roll out iOS 26.2 to compatible devices sometime between December 8 and December 16. When the update drops, you can check Apple's servers for the download by going to Settings ➝ General ➝ Software Update on your iPhone.

Set a Reminder Alarm


iOS 26.2 brings a new alarm capability to the Reminders app. When you create a reminder, you can toggle on an "Urgent" option so that, at the due time, your iPhone sounds an alarm rather than simply showing a notification.

Adjust Liquid Glass Clock


Apple's latest update adds a new slider under the "Liquid Glass" Lock Screen settings that gives much finer control over the clock's appearance. You can choose to make the time display nearly fully transparent, or more frosted and opaque, rather than being limited to the previous fixed presets.

AirDrop Files to People Not in Contacts


iOS 26.2 introduces a one-time AirDrop code system, letting you share files with someone even if they're not in your contacts. Once generated, the code remains valid for 30 days. Apple also includes a "Manage Known AirDrop Contacts" pane so that you can see and manage the people you've shared codes with.

View Apple Music Lyrics Offline


Apple Music is gaining offline lyrics support, so you can now view song lyrics in the app even when your iPhone isn't connected to Wi-Fi or mobile data.

Get a Better Sleep Score


If you wear your Apple Watch in bed, it's worth knowing that Apple has reworked its Sleep Score scoring tiers, with the aim of better matching typical sleep-quality experiences. Now, "Very Low" runs 0–40 (previously 0–29), "Low" 41–60, "OK" 61–80, "High" 81–95, and "Very High" 96–100 (previously labelled "Excellent").

Automatically Create Podcast Chapters


The Podcasts app can now automatically generate chapters for individual episodes. This means that rather than fixed chapter markers, the app will create them for you – and episode transcriptions now let you tap on mentions of other podcasts or links.

Manage Websites Where Passwords Aren't Saved


In the Passwords app's main settings menu, there's a new section allowing you to review and manage websites where you have deliberately avoided saving credentials. It gives you finer control over which domains are excluded from password storage.

Get AirPods Live Translation in EU


Apple's latest update expands the reach of AirPods Live Translation to countries in the European Union. The feature was previously unavailable in the EU due to Apple's ongoing regulatory compliance work.

Flash iPhone Screen for Alerts


In the Accessibility settings, under "Flash for Alerts," you can now choose to have your iPhone screen flash when a notification arrives, rather than just the rear camera's LED flash. You can configure it to use the screen flash alone, the LED flash, or both simultaneously, giving you more flexibility for alert styles.

Quicker Access to Apple News Sections


The Apple News app gets a refreshed interface. The top-of-feed buttons now let you jump quickly into categories (e.g. sports, business, food, puzzles) instead of scrolling or tapping through menus.

Manage Safety Alerts


iOS 26.2 introduces an "Enhanced Safety Alerts" section in Notifications settings that centralizes earthquake alerts, imminent-threat alerts, and also includes a new location-based "improved alert delivery" option, helping ensure the reliability of alerts.

Sort Games by Size


In the Games app library, there's now an option to sort games by size (in addition to name or recent). It should prove useful if you want to clear storage or identify large games quickly. Beyond sorting, the update also brings support for controller-based navigation and real-time challenge-score updates while playing.

Disable Pinned Messages in CarPlay


For CarPlay users, iOS 26.2 lets you disable the new "pinned messages" view in the Messages app – restoring the older, classic messages interface if you prefer that simpler look while driving.

Replace Siri Side Button Functionality (in Japan)


For iPhone users registered in Japan, iOS 26.2 lays the foundation for replacing the default voice assistant triggered by the Side button from Siri to a third-party voice assistant (for example, Gemini or Alexa), giving users a choice at the system level for the first time.

Multitask More on iPad


For iPad users, iPadOS 26.2 restores some multitasking flexibility, and allows you to drag and drop apps from the App Library, Dock, or Spotlight into Split View or Slide Over. The change should make window and multitask management on iPad more fluid.
This article, "15 New Things Your iPhone Can Do in iOS 26.2" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

eSIM adoption is on the rise thanks to travel and device compatibility

eSIM as a technology has been around for a decade now. However, global eSIM adoption was around 3% last year and will only cross 5% this year. Despite these figures, analysts, eSIM-providing startups, and investors are bullish about eSIM’s upward trajectory, largely thanks to travel. Device compatibility One of the key factors for that is […]View the full article
reporter

The MacRumors Show: Galaxy Z TriFold vs. Apple's Foldable iPhone

On this week's episode of The MacRumors Show, we discuss Samsung's new Galaxy Z TriFold smartphone and how it could compare to Apple's upcoming foldable iPhone.

Subscribe to The MacRumors Show YouTube channel for more videos
Samsung this week introduced the Galaxy Z TriFold, its first smartphone with two folding sections instead of one. When unfolded, the device presents a 10-inch screen, while the cover display measures 6.5 inches. Samsung says it has minimized visible creasing across the panels.

The Galaxy Z TriFold uses an inward-folding design intended to protect the main display. The folding mechanism has been engineered with an alert system that notifies users if the device is being folded incorrectly. Samsung is using a titanium Armor FlexHinge with two differently sized hinges joined by a dual-rail structure. According to the company, this enables a smoother and more stable fold despite uneven panel weight distribution, and increases durability thanks to a thin metal reinforcement that protects the hinge assembly.

A third of the unfolded display measures 3.9mm thick, increasing slightly around the triple-lens camera module. The center display section is 4.2mm thick, while the segment containing the side button is 4mm. The device includes a reinforced overcoat atop a shock-absorbing display layer for impact resistance, and an aluminum frame prevents the screens from coming into contact when closed.

Samsung has equipped the Galaxy Z TriFold with a 5,600 mAh three-cell battery, with one cell behind each display panel. The company says this is the largest battery it has ever used in a smartphone. The rear camera system includes a 200-megapixel wide camera, a 12-megapixel ultra wide camera, and a 10-megapixel telephoto camera with 3x optical zoom. Two 10-megapixel selfie cameras are integrated into the cover display and the main display.

The Galaxy Z TriFold supports three portrait-layout apps running side-by-side, multi-window resizing, full-screen video viewing, and a vertical reading mode. Samsung has also added standalone Samsung DeX, enabling up to four workspaces with five apps active simultaneously. Samsung apps have been optimized for the triple-panel layout, and Google's Gemini Live has been optimized as well.

The Galaxy Z TriFold launches in Korea on December 12, followed by China, Taiwan, Singapore, and the UAE. It will arrive in the United States in the first quarter of 2026. Pricing has not yet been announced.

Meanwhile, recent rumors suggest that Apple's first foldable ‌iPhone‌ will feature an industry-first 24-megapixel under-display camera for the inner display, as well as a Samsung-supplied OLED panel, virtually no crease, a hybrid titanium and aluminum frame, and a 5,400–5,800 mAh battery. Analyst estimates currently place pricing at around $2,400.

The device is only expected to include two rear cameras, unlike the TriFold and all of Samsung's book-style foldables. Apple will likely use a wide and an ultra-wide camera, similar to the iPhone 17, while reserving a telephoto camera for the iPhone 18 Pro and Pro Max. Early information also suggests it will also not be as thin as Samsung's Galaxy Fold 7.

We discuss the importance of rear camera setups on foldables, the rumored price point of Apple's version, and the risk of it falling victim to some of the same pitfalls as the iPhone Air. The MacRumors Show has its own YouTube channel, so make sure you're subscribed to keep up with new episodes and clips.

Subscribe to The MacRumors Show YouTube channel!

You can also listen to ‌The MacRumors Show‌ on Apple Podcasts, Spotify, Overcast, or your preferred podcasts app. You can also copy our RSS feed directly into your podcast player.



If you haven't already listened to the previous episode of The MacRumors Show, catch up to hear our discussion about we talk through the latest rumors about Apple's upcoming iPad mini 8.

Subscribe to ‌The MacRumors Show‌ for new episodes every week, where we discuss some of the topical news breaking here on MacRumors, often joined by interesting guests such as Kayci Lacob, Kevin Nether, John Gruber, Mark Gurman, Jon Prosser, Luke Miani, Matthew Cassinelli, Brian Tong, Quinn Nelson, Jared Nelson, Eli Hodapp, Mike Bell, Sara Dietschy, iJustine, Jon Rettinger, Andru Edwards, Arnold Kim, Ben Sullins, Marcus Kane, Christopher Lawley, Frank McShan, David Lewis, Tyler Stalman, Sam Kohl, Federico Viticci, Thomas Frank, Jonathan Morrison, Ross Young, Ian Zelbo, and Rene Ritchie.

‌The MacRumors Show‌ is on X @MacRumorsShow, so be sure to give us a follow to keep up with the podcast. You can also head over to The MacRumors Show forum thread to engage with us directly. Remember to rate and review the podcast, and let us know what subjects and guests you would like to see in the future.Tag: The MacRumors Show
This article, "The MacRumors Show: Galaxy Z TriFold vs. Apple's Foldable iPhone" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

Will John Ternus Really Be Apple's Next CEO?

There is uncertainty about Apple's head of hardware engineering John Ternus succeeding Tim Cook as CEO, The Information reports. Some former Apple executives apparently hope that a new "dark-horse" candidate will emerge.


Ternus is considered to be the most likely candidate to succeed Cook as CEO. The report notes that he is more likely to become CEO than software head chief Craig Federighi, Chief Operating Officer Sabih Khan, or marketing head Greg Joswiak.

Ternus is 50 and has worked at Apple since 2001. He is known for being dependable and good at following orders with an obsessive attention to detail. Colleagues describe him as calm, emotionally intelligent, logical, and conservative. He purportedly took the fall for Apple's butterfly keyboard internally, which earned him respect. He also led the transition of the Mac to Apple silicon to much success. These situations are said to have helped Ternus earn Cook's trust.

However, some voices in the company believe that Ternus is not ready to take on the role, which could delay a succession announcement. Some skeptics inside the company say that Ternus is too risk averse, leading to frustrations within his group. For example, some in Apple's hardware engineering department were disappointed that Ternus declined to fund more ambitious projects.

One of these individuals was vice president Tang Tan, who now leads OpenAI's project to build an AI hardware device designed by Apple's former chief designer, Jony Ive. Tan and Ive have since poached a large number of hardware engineers from Ternus' team to work on the unreleased device. Other critics say that Ternus "isn't a charismatic leader" and has had little involvement in the geopolitical affairs that have dominated the attention of Cook in recent years.

While Craig Federighi could succeed Cook due to his high profile, there are concerns that his focus on software may make him a poor fit for the role. He apparently prefers tackling technical problems rather than dealing with the kind of broader issues that the role of CEO demands.

Federighi is also risk-averse and voiced disproval over the Apple's spending on the Vision Pro and its now-canceled self-driving car project. He was also initially skeptical about AI, believing that the technology was overhyped and too unpredictable.

Cook has said publicly that he wants Apple's next CEO to come from within the company, but it is possible that the company could opt for a former employee. One such individual is said to be former Apple hardware executive Tony Fadell, who co-created the iPod.

Fadell reportedly told associates recently that he would be open to replacing Cook as CEO. Some former Apple executives believe that Fadell would help "shake up" the company from the perspective of a brash product leader.

Other individuals within Apple see the prospect as "unlikely," since Fadell was a "polarizing figure" when he worked at the company. Apple passed on acquiring Fadell's smart home company Nest in 2014 because some staff did not want him to return to the company.

Regardless of who succeeds him, Cook is now thought to be highly likely to retire in the not-too-distant future. Some analysts believe that ‌Tim Cook‌ "hasn't moved fast enough" or with the urgency of executives at Meta and Google to respond to the growing challenge of AI.

There are reportedly growing signs in Cook's personal life that he could be planning to move on soon. He apparently no longer routinely rises at 4 a.m. as he once did to go to the gym. Individuals around Cook have begun to notice a slight tremor in his hands, which was also visible during a recent visit to the White House.

In addition, Cook surprised colleagues when he purchased a luxury home outside Palm Springs, California. The report notes that he used to be noticeably more frugal, such as when he chose to rent a home in Silicon Valley rather than buying one to save money.

Senior Apple employees are said to be so sure of the likelihood of major management changes at the company, which could open up new opportunities, that they have raised the situation to many who have tried to recruit them. Tags: Craig Federighi, John Ternus, The Information, Tim Cook, Tony Fadell
This article, "Will John Ternus Really Be Apple's Next CEO?" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

Critical XXE Bug CVE-2025-66516 (CVSS 10.0) Hits Apache Tika, Requires Urgent Patch

A critical security flaw has been disclosed in Apache Tika that could result in an XML external entity (XXE) injection attack. The vulnerability, tracked as CVE-2025-66516, is rated 10.0 on the CVSS scoring scale, indicating maximum severity. "Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows anView the full article
reporter

Hardening browser security with zero-trust controls

The shift from perimeter-based security to zero trust is now indispensable for combating modern threats. The obsolete “castle-and-moat” model, granting implicit trust to any device or user inside the network, collapsed with the rise of cloud, remote work and BYOD. Attackers now bypass traditional controls by targeting identity, exploiting AI-driven phishing, supply chain intrusions and advanced session hijacking.
The browser is at this frontline, serving as the universal access point for SaaS, developer tools and sensitive AI resources. As data from diverse trust domains converge, each access request demands rigorous, real-time validation of identity, device posture and behavior.
NIST SP 800-207 provides the model: decouple access from network location by using a policy engine, policy administrator and browser-based policy enforcement point to enforce dynamic, context-aware authorization. NIST SP 800-207A extends this to runtime control across multi-cloud and microservices. Simultaneously, CISA’s Zero Trust Maturity Model v2 maps a clear implementation path spanning five pillars and emphasizing automation, analytics and governance as essential enablers.
This journal unites these leading standards with current enterprise practices, delivering a comprehensive browser-first ZTA framework that balances least-privileged access, SSO/MFA, device compliance and session isolation for secure, adaptable operations.
The imperative for browser-centric zero trust
As remote work and cloud adoption become the default operating model, the inability of implicit network trust and legacy VPNs to address the modern attack surface is undeniable. Adversaries now target the browser directly with attacks like cross-site scripting (XSS), session hijacking via stolen tokens and advanced phishing that bypasses traditional MFA. A browser-centric ZTA framework is the necessary response, built on the following six principles.
1. Identity-first access control
Network proximity is now an inferior trust signal. Only federated, cryptographically verifiable identity tokens issued by centralized enterprise IdPs using OIDC or SAML are permitted as gates to corporate resources. This transition, well-documented by FIDO Alliance and Microsoft research, transfers the very concept of “inside” the organization from the network to the user’s validated persona. No session proceeds without a signed, short-lived identity claim.
2. Least-privileged access (LPA)
Legacy roles that confer standing privileges are antithetical to zero trust. LPA decrees that entitlements are minimized, time-bounded and context-aware. The application of just-in-time access, JWT token scoping and dynamic risk assessment ensures users receive only what is necessary for their current task, never more. Device state, resource value and behavior all adjust privilege in flight: a noncompliant device or anomalous login instantly narrows the access window.
3. Continuous verification and adaptive policy
Zero trust is not “authenticate once, trust forever.” It is a continuous cycle of verification. Adaptive policy rules, executed by the policy engine, must re-evaluate access in real-time based on new telemetry. This “posture drift” can be triggered by numerous signals:
Behavioral: If a user typically logs in from Texas at 9 am but suddenly authenticates from Eastern Europe at 3 am (“impossible travel”), adaptive rules flag the anomaly and restrict access. Device: An EDR agent detects a malicious process, changing the device’s health state from “compliant” to “at-risk.” Network: A user moves from a trusted corporate network to an untrusted public Wi-Fi hotspot. In response, the PE can automatically initiate a session revocation, force a step-up MFA challenge or reduce the session to read-only. 4. Integrated phishing-resistant authentication
To secure the identity-first gate, the authentication method itself must be robust. Traditional MFA (like SMS or one-time passcodes) is phishable. The ZTA browser model mandates the adoption of phishing-resistant MFA, primarily through FIDO2/WebAuthn passkeys. As detailed by the FIDO Alliance, passkeys are a W3C standard that replaces passwords with cryptographic key pairs. The private key never leaves the user’s device (e.g., a YubiKey, a phone’s secure enclave or a Windows Hello TPM), making it impossible to phish. The user authenticates with a simple biometric or PIN, providing unparalleled security with a superior user experience. By 2025, passkey adoption will have moved from emerging to mainstream, with deployments showing authentication times under two seconds and proven reductions in phishing-related losses.
5. Device health gating
A trusted user on a compromised device is a critical threat. The ZTA model must validate the endpoint before issuing an access token. This “device health gating” is a cornerstone of modern IdP solutions. The conditional access policy engine queries the device for posture signals collected by an MDM (mobile device management) or EDR (endpoint detection and response) agent. As documented in Microsoft’s conditional access framework, policies enforce compliance before token issuance. Key signals include:
Patch level: Is the OS fully patched? EDR status: Is the EDR agent (e.g., CrowdStrike, Defender) running and reporting no active threats? Disk encryption: Is the primary drive encrypted (e.g., BitLocker, FileVault)? Device state: Is the device jailbroken or rooted? Only devices that meet this baseline are considered “compliant” and eligible for access. 6. Remote browser isolation (RBI)
For the highest-risk activities, we must assume the endpoint cannot be fully trusted and that web content is malicious. Remote browser isolation (RBI) addresses this by executing risky or privileged web sessions in isolated, disposable cloud containers. The user’s endpoint never interacts with active web code; it only receives a stream of pixels (pixel-streaming RBI) or a sanitized, reconstructed version of the page (DOM-reconstruction RBI). As demonstrated by zero trust solutions like Cloudflare RBI, this neutralizes all browser-based exploits, prevents malware from reaching the endpoint and can enforce data loss prevention (DLP) by disabling copy/paste or uploads from the isolated session.
Modern workflows and policy patterns: A blueprint
A modern ZTA browser architecture is not a single product but an integrated system that operates on a continuous, per-request verification loop.
This is the foundational user-facing workflow for all access.
Request: A user on a managed browser (e.g., Chrome Enterprise) attempts to access a protected app (e.g., test.company.com). Intercept & redirect: An access proxy (ZTNA/PEP), like Cloudflare Access or Zscaler Private Access, intercepts the request. Seeing no valid session token, it redirects the browser to the enterprise IdP (e.g., Okta, Entra ID) to initiate an OIDC or SAML authentication flow. Authentication: The IdP authenticates the user. Based on policy, it requires a phishing-resistant MFA step using a FIDO2/WebAuthn passkey. The user taps their YubiKey or uses Windows Hello. Contextual evaluation: The IdP’s Conditional Access Policy Engine (PE) evaluates the request. It queries the Microsoft Intune or CrowdStrike ZTA integration for device posture. The policy is: ALLOW IF (user_group == ‘Sales’) AND (device_status == ‘Compliant’) AND (auth_method == ‘FIDO2’). Token issuance: Upon success, the IdP mints a signed JSON Web Token (JWT). This token contains critical claims: the user’s ID (sub), their roles (groups), the authentication method (amr) and a short-lived expiration (exp). Access granted: Browser supplies JWT to proxy, proxy grants direct, secure application access. B. Adaptive session management and least privilege
This workflow demonstrates the “continuous verification” principle.
Scenario 1 — Posture drift: The user is authenticated and working. Midway through the session, their EDR agent detects a high-priority threat (e.g., malware execution). The EDR agent instantly updates the device’s health state. The IdP’s conditional access, which leverages a continuous access evaluation protocol (CAEP), receives this signal and immediately revokes all active session tokens for that device, forcing a logout and remediation. Scenario 2 — Step-up authentication: A user with a valid session for a low-risk app (like a wiki) clicks a link to a high-risk app (like the SAP admin console). The ZTNA proxy (PEP) intercepts this new request, recognizes the “Tier 0” sensitivity of the application and re-challenges the user, forcing a new step-up authentication with a hardware passkey before proceeding, even though they already have an active SSO session. C. Privileged and sensitive operations via isolation
This workflow is for protecting “Tier 0” assets like administrator consoles.
Request: An administrator attempts to access the Okta admin console or an internal Kubernetes dashboard. Policy enforcement: After successful FIDO2 authentication, the ZTNA policy (PEP) for this “Tier 0” application is configured not with an “Allow” action, but with an “Isolate” action. Isolation: The user is transparently routed to an RBI service. The entire admin session is executed in a secure, disposable container in the cloud. Only benign pixels are streamed to the end-user’s browser. DLP & threat neutralization: This mitigates two critical risks: Endpoint Malware: If the admin’s workstation is compromised, keyloggers or token-stealing malware cannot access the privileged session, as it’s not running locally. Data Exfiltration: Granular RBI policies are applied: copy/paste, file downloads and printing are disabled for this session, preventing accidental or malicious credential or data leakage. D. Forward-thinking SCIM provisioning
This workflow is the automation backbone that makes LPA viable at scale.
System for cross-domain identity management (SCIM) is an open standard (RFC 7643) for automating the exchange of user identity information between systems. The SCIM protocol (RFC 7643) defines a REST API and schema for managing user and group resources. The Workflow (Joiner/Mover/Leaver): Source event: A manager in the HRIS (e.g., Workday) changes an employee’s role from “Sales Rep” to “Sales Manager.” SCIM push: The HRIS (or an integration layer) automatically triggers a SCIM PATCH request to the IdP (Okta, Entra ID). IdP update: The IdP updates the user’s attributes, removing them from the group:sales-rep and adding them to the group:sales-manager. Policy propagation: The IdP’s Policy Engine (PE) immediately uses this new attribute data. Re-evaluation: The next time the user authenticates (or their token expires), their access is re-evaluated. Their old access to rep-level tools is gone, and their new access to manager dashboards is automatically granted. This “Just-in-Time” provisioning prevents “privilege creep” and ensures all access decisions are based on accurate, real-time identity data. Maturity pathways: Roadmap to optimal state
This roadmap, aligned with the CISA ZTMM v2, allows organizations to make measurable, incremental progress.
Initial: At this stage, the organization moves beyond the “Traditional” perimeter. All browser-accessed applications are federated with a central IdP and protected by an access proxy (ZTNA). SSO and passkey-based FIDO2/WebAuthn MFA are mandatory for all users. All access logs are centralized in a SIEM. This achieves the Identity and Network pillar foundations. Advanced: The organization builds on the initial foundation with richer context. Device compliance (via Intune/CrowdStrike integration) is enforced for all sessions. Policy decisions become adaptive, leveraging real-time telemetry from EDR and user behavior analytics (UBA). SCIM is fully implemented for automated provisioning from an identity source of truth (e.g., HRIS). This demonstrates maturity in the Devices and Automation capabilities. Optimal: At the highest level of maturity, access is determined on a per-request, least-privilege basis, fully aligning with NIST 800-207A. RBI is automatically and transparently enforced for all privileged, unmanaged or high-risk web sessions. The entire ecosystem is automated, with post-authentication security (like token theft detection and CAEP) fully integrated. This represents an optimal state across all CISA pillars, driven by robust automation and governance. Operationalizing ZTA browser security
Implementing this architecture requires a shift in operational thinking.
Policy design: Move from network rules to a “who, what, where, when, why” logic model. Policies should be readable statements: GRANT access IF (user_group == ‘Finance’) AND (app == ‘SAP’) AND (device_status == ‘Compliant’) AND (auth_method == ‘FIDO2’). Start with a default “deny” and create explicit “allow” rules, creating a policy matrix that maps user personas to data and applications. Dynamic access: Token claims must be context-bound and short-lived. A token issued for a read-only wiki should not be valid for accessing a finance application. True phishing resistance requires eliminating all phishable recovery methods. This means deprecating SMS, email links and security questions in favor of passkey-based recovery or in-person identity verification. Risk automation: Session adaptation (step-up, revocation) must be triggered by automated analytics. Integrate the IdP and ZTNA solution with your SIEM/SOAR platform. An EDR alert (e.g., “high-severity malware”) or a UBA alert (e.g., “impossible travel”) should automatically trigger a SOAR playbook that calls the IdP’s API to revoke the user’s session tokens. Governance-as-code: Policies must not be managed via manual “click-ops” in a GUI. All ZTNA access rules, IdP Conditional Access policies and RBI configurations should be defined as code (e.g., using Terraform, HCL or JSON). This enables version control, peer review (via pull requests) and automated CI/CD pipelines, aligning with CISA’s cross-cutting controls for governance and automation. Configuration patterns (Latest, 2025)
Chrome Enterprise: Use Chrome Browser Cloud Management to enforce a secure baseline on all corporate browsers. Enforce policies like BrowserSignin (to force login to a managed profile), PasswordManagerEnabled (set to false to mandate use of an enterprise password manager), SafeBrowsingProtectionLevel (set to Enhanced) and BuiltInDnsClientEnabled (to enforce secure DNS). Google’s Chrome Enterprise policies provide the full list of controls to manage extensions, data leakage and security settings. Intune/conditional access: Create a non-negotiable “baseline” policy: Require compliant device and Require phishing-resistant MFA for all users accessing all cloud apps. Then, create more granular policies. For example, block access entirely from high-risk countries or require a “Compliant + Hybrid Joined” device for access to legacy on-prem apps. FIDO2/WebAuthn passkeys: Deploy passkeys (platform-based like Windows Hello and hardware-bound like YubiKeys) as the primary authenticator. Start with privileged users (admins) and high-value targets (executives, finance) first, then roll out to the general population. Cloudflare RBI/ZTNA: Configure clientless ZTNA to secure third-party and BYOD access without requiring an agent. Use Service Auth policies (based on mTLS certificates or service tokens) to secure non-human (RPA bot) access to web applications. Configure a “default-isolate” policy that automatically sends all traffic to unclassified or high-risk domains through the RBI service. SCIM automation: Connect your IdP (Okta, Entra ID) to your source of truth (e.g., Workday) via a pre-built SCIM connector. Map HR attributes (e.g., Department, Role, EmploymentStatus) to IdP attributes. Use these attributes to drive dynamic group membership, which in turn drives all application access and ZTNA policies. The browser is now both sword and shield
Browser security is the linchpin for zero trust and organizational resilience. By converging validated identity, rigorous device posture, adaptive access policies, automated provisioning and session isolation, we not only defend against the sophisticated threats of 2025 but also set a foundation for scalable, measurable governance.
In moving from static perimeters to live, session-level policy enforcement, every click and credential is scrutinized, every privilege time-boxed, every access revocable by context and behavior not convenience or legacy. Teams must treat the browser not as an exposed window, but as the policy stronghold of the modern enterprise. 
Building toward this architecture is a journey: Begin with SSO and robust MFA, enforce device compliance, automate provisioning and integrate RBI where risk justifies isolation. Codify policy, automate telemetry and develop governance as code. Refuse the ‘trusted network’ myth. Zero trust is here, and the browser is now both sword and shield.
This article is published as part of the Foundry Expert Contributor Network.
Want to join?
View the full article
reporter

Best Apple Deals of the Week: Last Call on Cyber Week Deals for AirPods 4, iPhone 17 Cases, and More

Most of Black Friday and Cyber Monday's biggest discounts have expired, but today we're keeping track of the best leftover holiday discounts at various retailers. Below you'll find great deals on AirPods 4, iPhone 17 cases, portable power stations from Jackery and Anker, and The Frame TV at Samsung.

Note: MacRumors is an affiliate partner with some of these vendors. When you click a link and make a purchase, we may receive a small payment, which helps us keep the site running.

AirPods 4


What's the deal? Take $80 off AirPods 4
Where can I get it? Amazon
Where can I find the original deal? Right here
$80 OFFAirPods 4 (ANC) for $99.00

This week Amazon still has a record low price on the AirPods 4 with Active Noise Cancellation, available for $99.00, down from $179.00. All other Black Friday/Cyber Monday AirPods deals have expired.

Jackery and Anker


What's the deal? Save sitewide on portable power stations
Where can I get it? Jackery and Anker
Where can I find the original deal? Right here
UP TO 65% OFFJackery Black Friday Encore Sale
UP TO 65% OFFAnker SOLIX Cyber Monday Last Call

Black Friday and Cyber Monday may be over, but you can still find up to 65 percent off Anker and Jackery's best portable power stations this week. Each retailer is hosting a last call sale for its most popular charging accessories, with major savings on these high-priced power stations.

Jackery
Explorer 500 - $359.00, down from $499.00
Explorer 2000 v2 - $749.00, down from $1,499.00
Battery Pack 2000 Plus - $799.00, down from $1,399.00
Battery Pack 3600 - $999.00, down from $2,099.00
HomePower 3000 Solar Generator - $1,199.00, down from $2,499.00
Anker
Anker 521 PowerHouse (300W) - $149.99, down from $249.99
Anker 535 PowerHouse (500W) - $249.00, down from $649.99
SOLIX C1000 Gen 2 Portable Power Station - $429.00, down from $799.00
SOLIX C1000 Gen 2 + Solar Panel - $609.00, down from $1,298.00
SOLIX C2000 Gen 2 Portable Power Station - $739.00, down from $1,498.00

Samsung


What's the deal? Save sitewide on Samsung TVs, monitors, and more
Where can I get it? Samsung
Where can I find the original deal? Right here
SITEWIDE DISCOUNTSSamsung Cyber Monday Sale

Samsung's Cyber Week sale is still going on today, and it has great deals on monitors, storage accessories, TVs, Galaxy smartphones, home appliances, and more.

Highlights from this event include quite a few models of The Frame TV on sale, including a new all-time low price on The Frame Pro models. You can get the 65-inch The Frame TV for $999.99 ($1,000 off), as well as The Frame Pro for $1,999.00 ($1,200 off).

iPhone 17 Cases


What's the deal? Take up to 50% off iPhone 17 cases
Where can I get it? Amazon
Where can I find the original deal? Right here
UP TO 50% OFFiPhone 17 Cases at Amazon

Amazon this week has big discounts across Apple's Clear, Silicone, and TechWoven Cases for the iPhone 17 and iPhone Air lineup. Items on sale include Clear, Silicone, and TechWoven Cases for the iPhone 17, iPhone 17 Pro, iPhone 17 Pro Max, and iPhone Air.

If you're on the hunt for more discounts, be sure to visit our Apple Deals roundup where we recap the best Apple-related bargains of the past week.



Deals Newsletter

Interested in hearing more about the best deals you can find this holiday season? Sign up for our Deals Newsletter and we'll keep you updated so you don't miss the biggest deals of the season!




Related Roundup: Apple Deals
This article, "Best Apple Deals of the Week: Last Call on Cyber Week Deals for AirPods 4, iPhone 17 Cases, and More" first appeared on MacRumors.com

Discuss this article in our forums

View the full article
reporter

Account

Navigation

Search

Search

Configure browser push notifications
Chrome (Android)
  1. Tap the lock icon next to the address bar.
  2. Tap Permissions → Notifications.
  3. Adjust your preference.
Chrome (Desktop)
  1. Click the padlock icon in the address bar.
  2. Select Site settings.
  3. Find Notifications and adjust your preference.