M4 Mac users complain about compatibility issues with ultrawide monitors
It’s been a while since Apple launched the new M4 Macs, and as more people get their hands on these computers, reports of unexpected issues surface on the web. Now there’s a group of users complaining about compatibility issues between M4 Macs and ultrawide monitors. more…

Read more »

iPhone 17 may have higher refresh rate displays, but don’t get too excited
Here we go again for another season of rumors. This time, multiple reports suggest that all iPhone 17 models will have ProMotion – as Apple calls the technology for displays with a higher refresh rate. While this seems highly likely, you probably shouldn’t get too excited about it – and here’s why. more…

Read more »

Hands-on: Flexbar brings back the Touch Bar to your Mac – but is it worth it?
We recently reported on Flexbar, a project developed by ENIAC Technology that brings back the Touch Bar – the controversial (and now discontinued) small touch screen implemented by Apple on the MacBook Pro keyboard. Although Apple certainly had its reasons for discontinuing the Touch Bar, some users do miss it. I got my hands on a Flexbar unit to see what it’s like to use something like the Touch Bar again. more…

Read more »

Apple TV Plus Is Free This Weekend
In a press release today, Apple said their TV Plus subscription service will be free this weekend (January 3 through January 5). From the press release: Apple TV+ is ringing in the New Year by offering an all-access pass to customers all around the world. Enjoy Apple TV+ for free the first weekend of 2025 (January 3 through January 5), Apple TV+ will be free on any device where Apple TV+ is available. All you need is an Apple ID to see what all the buzz is about. "A full weekend may be enough to binge some of Apple's top shows, including Severance, which has its hotly anticipated season 2 launching on January 17th," notes The Verge's Umar Shakir. "The free days could also help potential subscribers get a taste of Apple's eclectic mix of sci-fi shows, such as the space race drama For All Mankind, postapocalyptic thriller Silo, and the Godzilla serial Monarch: Legacy of Monsters." Read more of this story at Slashdot.

Read more »

Apple TV Plus Is Free This Weekend
In a press release today, Apple said their TV Plus subscription service will be free this weekend (January 3 through January 5). From the press release: Apple TV+ is ringing in the New Year by offering an all-access pass to customers all around the world. Enjoy Apple TV+ for free the first weekend of 2025 (January 3 through January 5), Apple TV+ will be free on any device where Apple TV+ is available. All you need is an Apple ID to see what all the buzz is about. "A full weekend may be enough to binge some of Apple's top shows, including Severance, which has its hotly anticipated season 2 launching on January 17th," notes The Verge's Umar Shakir. "The free days could also help potential subscribers get a taste of Apple's eclectic mix of sci-fi shows, such as the space race drama For All Mankind, postapocalyptic thriller Silo, and the Godzilla serial Monarch: Legacy of Monsters." Read more of this story at Slashdot.

Read more »

Apple’s next-gen CarPlay MIA in 2024
The “next generation of CarPlay” that Apple first announced in 2022 and that the company continues to say on its CarPlay webpage will… The post appeared first on MacDailyNews.

Read more »

AirPods airplane adapter makes in-flight entertainment sound great
Don't resort to freebie earbuds for airplane movies. Get the Eve II, a Bluetooth adapter that lets you use AirPods on airplanes. (via Cult of Mac - Apple news, rumors, reviews and how-tos)

Read more »

Apple’s new Home products will challenge a long-standing Apple rule, here’s why
Apple is finally getting serious about the smart home, with three new Home products launching in 2025 and several more after that. Excited as I am for this new Home momentum, it also reminds me of a long-standing Apple rule that could be challenged by this lineup of new products. more…

Read more »

Apple rumored to be keeping the iPhone SE 4 price down
A new report claims that Apple's expected iPhone SE 4 will remain the lowest-cost model, but its price could rise anywhere up to $500.iPhone SE 4 could look like iPhone 14Previous reports have said that the iPhone SE 4 will remain a sub-$500 device, but now a regular leaker claims that a Japanese news service has confirmed it."The information about the shipping price of the Apple iPhone SE 4th generation model has come out again [via a] Japanese news agency channel," writes yeux1122 on his or her blog. "It's a Japanese source with Apple's own chip, etc., 500 dollars or less." Rumor Score: 🤔 Possible Continue Reading on AppleInsider | Discuss on our Forums

Read more »

iOS 19 concept imagines Lock Screen stickers, clever ‘Flick’ feature, more [Video]
It sounds impossible, but we’re just over six months away from the first unveiling of iOS 19. While rumors about what to expect from the update have been sparse, a new concept created by designer Oofus offers some clever ideas about what iOS 19 could offer… more…

Read more »

Enjoy award-winning Apple TV+ series and movies free the first weekend of 2025

Apple TV+ is ringing in the New Year by offering an all-access pass to customers all around the world. Enjoy Apple TV+ for free the first… The post appeared first on MacDailyNews.

Read more »

How we Work: Wes Hilliard's Apple Vision Pro & iPad Pro-centric workflows
Wesley is back to being a full-time iPad Pro user, but there's a splash of Apple Vision Pro and a mountain of other tech involved in the day-to-day. Here's how he gets work done at AppleInsider.Wesley's current desk setupIf there's one thing I like writing about, it's my setup and workflows. There's a lot going on here, and unless you're new here, you might already know I'm all in on iPad and a little obsessed with Apple Vision Pro.My setup and workflows don't reflect the rest of my colleagues, and that's fine. I'm happy that I get to figure out new and interesting ways to tackle problems that might otherwise be solved by simply using a Mac. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

These new iOS features are coming to your iPhone in 2025
Apple has shipped an astounding number of new iPhone features in the past few months, with major updates coming in iOS 18, iOS 18.1, and the recent iOS 18.2. But there’s more on the way soon. Here are all the new iOS features that we know are coming in the first four months of 2025. more…

Read more »

MagSafe Money: LISEN delivers the strongest MagSafe magnetic I’ve found for the car
Since it was released with the iPhone 12, MagSafe has completely changed how I charge my iPhone. I want to look at today’s product, the , a great option for drivers seeking stability, convenience, and cutting-edge tech. With support for Qi2 charging and a remarkably strong mount, it’s an impressive addition to any car setup—though it comes with a small trade-off. more…

Read more »

Apple Watch Series 10 sale starts at just $329
Amazon has further reduced prices on Apple Watches this weekend, bringing the Series 10 down to $329 — a $70 discount from its… The post appeared first on MacDailyNews.

Read more »

Today in Apple history: Microsoft hits the height of its ’90s power
On December 30, 1999, Microsoft hit the height of its 1990s dominance and began its early-2000s decline. It was a major turning point. (via Cult of Mac - Apple news, rumors, reviews and how-tos)

Read more »

B&H has dropped Apple's M3 Pro MacBook Pro to $1,599 for 1 more day
The $1,599 M3 Pro MacBook Pro flash deal reflects the lowest price we've seen in Q4 for the closeout laptop. Upgraded configurations are up to $500 off too, with the deals ending Dec. 31.Save up to $600 with blowout MacBook Pro discounts.The $400 price drop is available at B&H, with limited supply available at the reduced price. This blowout MacBook Pro deal on the last-gen M3 Pro model is valid through Dec. 31 or while supplies last.Buy for $1,599 Continue Reading on AppleInsider | Discuss on our Forums

Read more »

9to5Mac Product of the Year: Apple Vision Pro
Apple fired on all cylinders throughout 2024 with big revamps to the iPad and Mac lineups, the iPhone 16, and the Apple Watch Series 10. None of those products, however, have had and will continue to have the impact of Apple Vision Pro. For that reason, we are crowning the Apple Vision Pro as the 9to5Mac Product of the Year for 2024. more…

Read more »

All iPhone 17 models said to sport ProMotion displays
A recent leak reinforces earlier rumors that the standard iPhone 17 will feature a ProMotion display, enhancing its responsiveness and… The post appeared first on MacDailyNews.

Read more »

New Magic Mouse may listen for voice commands
A shaky rumor claims that Apple is prototyping a new Magic Mouse design for the Mac that's more ergonomic — but which users will also be able to talk to.Magic Mouse with Siri — image credit: mouse Apple, Siri composite: AppleInsiderIt was back in 1986's "Star Trek IV: The Voyage Home" where Scotty picked up a Macintosh mouse and tried speaking into it. In 2026, goes the new rumor, that could happen for real.This new claim follows a previous one that said a more ergonomic Magic Mouse 2 would be released in 2026, probably including moving the USB-C charging port from the bottom. Leaker yeux1122 agrees with all of that, but adds (in translation) that the design will fit "modern computing [needs] with a mixture of touch screen, voice command, and hand movement." Rumor Score: 🤔 Possible Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Inside the secret labs powering iPhone 16's camera magic
Apple's iPhone 16 Pro is a leap forward in video and audio innovation, and the secret lies in its cutting-edge testing labs. Here's how Apple tests new iPhones.The iPhone 15 Pro and iPhone 16 ProThe iPhone 16 Pro elevates Apple's standard for smartphone photography and video to new heights. It's equipped with cutting-edge features such as 4K slow-motion recording and advanced audio tools.At the heart of Apple's iPhone 16 Pro advancements is a meticulously designed testing process. The labs include a long-wave anechoic chamber where microphones are tested for audio clarity and a Dolby Atmos theater dedicated to fine-tuning video playback. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Apple homepage honors memory of Jimmy Carter
Apple honors Jimmy Carter with homepage tribute following 39th U.S. president's death Sunday at 100 years of age. (via Cult of Mac - Apple news, rumors, reviews and how-tos)

Read more »

Apple’s redesigned Magic Mouse 3 coming in late 2026, per rumor
Apple recently updated its trio of Mac accessories—, Magic Trackpad, and —to USB-C versions. Now, a new rumor points to the planned timing for Apple’s big Magic Mouse 3 redesign. more…

Read more »

Deals: Apple Watch Series 10 from $329, M4 iPad Pro $200 off, 25W Apple MagSafe Charger 29% off, more
Amazon has brought back some of its most notable Black Friday deals on Apple gear for one last run in 2024. This includes the $70 price drops across the Apple Watch Series 10 lineup, including both 42mm and 46mm models in various colorways, as well as the straight up $200 price drops on Apple’s most affordable 13-inch M4 iPad Pro models – although we do have deals on the 11-inchers as well. Those join up to 29% off the next-gen 25W Apple MagSafe Charger, loads of accessories, MagSafe chargers, and much more to ready you for the new year.  more…

Read more »

9to5Mac Daily: December 30, 2024 – iOS 19 rumors, Apple smart doorbell
Listen to a recap of the top stories of the day from 9to5Mac. 9to5Mac Daily is available on iTunes and Apple’s Podcasts app, Stitcher, TuneIn, Google Play, or through our dedicated RSS feed for Overcast and other podcast players. Last Chance!: Save 20% on all 9to5Mac Daily Plus, 9to5Mac Happy Hour Plus, and 9to5Mac Pro annual subscriptions with promo code HOLIDAY! Visit 9to5mac.com/join to sign up. more…

Read more »

What's best to watch on Apple TV+ during the upcoming free weekend
Apple TV+ is going free for one weekend because it lacks viewers — but it is far from lacking in absolutely superb shows to watch. Here's what to see first, and just why Apple is doing this.The second season of 'Severance' won't start until late in January 2025, but viewers can catch up on its first season — image credit: AppleApple is cutting down on blockbuster movie theater releases and one impact is that the profile of its Apple TV+ service will be lower. Since the service consistently has only a small fraction of the audience that Netflix and Disney+ get, Apple has been working to get it in front of more people.As recently teased, the latest attempt takes place on the weekend of Saturday 4 January 2025 and Sunday 5 January. For 48 hours, the whole of Apple TV+ will be free to watch without subscription. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Orb-like desktop speakers boost Mac mini’s sound [Setups]
This user finds that distinctively rounded and tilted Creative Pebble Pro speakers pump up Mac mini's sound. (via Cult of Mac - Apple news, rumors, reviews and how-tos)

Read more »

Orb-like desktop speakers boost Mac mini’s sound [Setups]
This user finds that distinctively rounded and tilted Creative Pebble Pro speakers pump up Mac mini's sound. (via Cult of Mac - Apple news, rumors, reviews and how-tos)

Read more »

Apple honors Jimmy Carter
Jimmy Carter, the 30th president of the United States, died on Sunday at 100. Apple has now updated its homepage to pay tribute to President Carter, the longest-living president in American history. more…

Read more »

MacBook Air prices drop to as low as $749 with these New Year's deals
Save up to $300 on Apple's MacBook Air as retailers launch New Year's sales early to compete for your year-end shopping dollars.Snag New Year's deals on Apple's MacBook Air this week.Both Amazon and Best Buy are competing for your business through a MacBook Air price war that has deals as low as $749 this Monday. Many closeout models are limited to stock on hand and could sell out at any time. Apple's latest M3 models with 16GB of unified memory are also marked down to as low as $899, making it a great time to pick up a new laptop at a discount. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Happy 15th Anniversary, KrebsOnSecurity!
KrebsOnSecurity.com turns 15 years old today! Maybe it's indelicate to celebrate the birthday of a cybercrime blog that mostly publishes bad news, but happily many of 2024's most engrossing security stories were about bad things happening to bad guys. It's also an occasion to note that despite my publishing fewer stories than ever this past year, we somehow managed to attract near record levels of readership (thank you!).

Read more »

Web Hacking Service ‘Araneida’ Tied to Turkish IT Firm
Cybercriminals are selling hundreds of thousands of credential sets stolen with the help of a cracked version of Acunetix, a powerful commercial web app vulnerability scanner, new research finds. The cracked software is being resold as a cloud-based attack tool by at least two different services, one of which KrebsOnSecurity traced to an information technology firm based in Turkey.

Read more »

How to Lose a Fortune with Just One Bad Click
Adam Griffin is still in disbelief over how quickly he was robbed of nearly $500,000 in cryptocurrencies. A scammer called using a real Google phone number to warn his Gmail account was being hacked, sent email security alerts directly from google.com, and ultimately seized control over the account by convincing him to click "yes" to a Google prompt on his mobile device.

Read more »

How Cryptocurrency Turns to Cash in Russian Banks
A financial firm registered in Canada has emerged as the payment processor for dozens of Russian cryptocurrency exchanges and websites hawking cybercrime services aimed at Russian-speaking customers, new research finds. Meanwhile, an investigation into the Vancouver street address used by this company shows it is home to dozens of foreign currency dealers, money transfer businesses, and cryptocurrency exchanges -- none of which are physically located there.

Read more »

Patch Tuesday, December 2024 Edition
Microsoft today released updates to plug at least 70 security holes in Windows and Windows software, including one vulnerability that is already being exploited in active attacks. The zero-day seeing exploitation involves CVE-2024-49138, a security weakness in the Windows Common… Read More »

Read more »

U.S. Offered $10M for Hacker Just Arrested by Russia
In January 2022, KrebsOnSecurity identified a Russian man named Mikhail Matveev as "Wazawaka," a cybercriminal who was deeply involved in the formation and operation of multiple ransomware groups. The U.S. government indicted Matveev as a top ransomware purveyor a year later, offering $10 million for information leading to his arrest. Last week, the Russian government reportedly arrested Matveev and charged him with creating malware used to extort companies.

Read more »

Why Phishers Love New TLDs Like .shop, .top and .xyz
Phishing attacks increased nearly 40 percent in the year ending August 2024, with much of that growth concentrated at a small number of new generic top-level domains (gTLDs) -- such as .shop, .top, .xyz -- that attract scammers with rock-bottom prices and no meaningful registration requirements, new research finds. Meanwhile, the nonprofit entity that oversees the domain name industry is moving forward with plans to introduce a slew of new gTLDs.

Read more »

Vulnerability Summary for the Week of November 25, 2024
High Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info 1000 Projects--Portfolio Management System MCA  A vulnerability has been found in 1000 Projects Portfolio Management System MCA 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /register.php. The manipulation of the argument name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. 2024-11-26 7.3 CVE-2024-11744 1000 Projects--Portfolio Management System MCA  A vulnerability classified as critical was found in 1000 Projects Portfolio Management System MCA 1.0. This vulnerability affects unknown code of the file /forgot_password_process.php. The manipulation of the argument username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. 2024-11-27 7.3 CVE-2024-11819 1000projects -- beauty_parlour_management_system  A vulnerability classified as critical was found in 1000 Projects Beauty Parlour Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/edit-services.php. The manipulation of the argument sername leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. 2024-11-25 7.3 CVE-2024-11646 1000projects -- beauty_parlour_management_system  A vulnerability, which was classified as critical, has been found in 1000 Projects Beauty Parlour Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/view-appointment.php. The manipulation of the argument viewid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. 2024-11-25 7.3 CVE-2024-11647 1000projects -- beauty_parlour_management_system  A vulnerability, which was classified as critical, was found in 1000 Projects Beauty Parlour Management System 1.0. This affects an unknown part of the file /admin/add-customer.php. The manipulation of the argument name leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. 2024-11-25 7.3 CVE-2024-11648 1000projects -- beauty_parlour_management_system  A vulnerability has been found in 1000 Projects Beauty Parlour Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/search-appointment.php. The manipulation of the argument searchdata leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. 2024-11-25 7.3 CVE-2024-11649 AbsolutePlugins--Absolute Addons For Elementor  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AbsolutePlugins Absolute Addons For Elementor allows Local Code Inclusion.This issue affects Absolute Addons For Elementor: from n/a through 1.0.14. 2024-11-28 7.5 CVE-2024-52496 Advantech--EKI-6333AC-2G  A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (securityEngineID to local_record.engineid without proper bounds checking. 2024-11-27 3 CVE-2024-36468 Zabbix--Zabbix  When the webdriver for the Browser object downloads data from a HTTP server, the data pointer is set to NULL and is allocated only in curl_write_cb when receiving data. If the server's response is an empty document, then wd- >data in the code below will remain NULL and an attempt to read from it will result in a crash. 2024-11-27 3.3 CVE-2024-42328 Zabbix--Zabbix  The webdriver for the Browser object expects an error object to be initialized when the webdriver_session_query function fails. But this function can fail for various reasons without an error description and then the wd- >error will be NULL and trying to read from it will result in a crash. 2024-11-27 3.3 CVE-2024-42329 Zabbix--Zabbix  In the src/libs/zbxembed/browser.c file, the es_browser_ctor method retrieves a heap pointer from the Duktape JavaScript engine. This heap pointer is subsequently utilized by the browser_push_error method in the src/libs/zbxembed/browser_error.c file. A use-after-free bug can occur at this stage if the wd- >browser heap pointer is freed by garbage collection. 2024-11-27 3.3 CVE-2024-42331 Zabbix--Zabbix  The researcher is showing that due to the way the SNMP trap log is parsed, an attacker can craft an SNMP trap with additional lines of information and have forged data show in the Zabbix UI. This attack requires SNMP auth to be off and/or the attacker to know the community/auth details. The attack requires an SNMP item to be configured as text on the target host. 2024-11-27 3.7 CVE-2024-42332 Zabbix--Zabbix  When a URL is added to the map element, it is recorded in the database with sequential IDs. Upon adding a new URL, the system retrieves the last sysmapelementurlid value and increments it by one. However, an issue arises when a user manually changes the sysmapelementurlid value by adding sysmapelementurlid + 1. This action prevents others from adding URLs to the map element. 2024-11-26 2.2 CVE-2024-22117 Zabbix--Zabbix  When exporting media types, the password is exported in the YAML in plain text. This appears to be a best practices type issue and may have no actual impact. The user would need to have permissions to access the media types and therefore would be expected to have access to these passwords. 2024-11-27 2.7 CVE-2024-36464 Zabbix--Zabbix  The researcher is showing that it is possible to leak a small amount of Zabbix Server memory using an out of bounds read in src/libs/zbxmedia/email.c 2024-11-27 2.7 CVE-2024-42333 Back to top Severity Not Yet Assigned PrimaryVendor -- Product Description Published CVSS Score Source Info autolab--Autolab  Autolab is a course management service that enables auto-graded programming assignments. From Autolab versions v.3.0.0 onward students can download all assignments from another student, as long as they are logged in, using the download_all_submissions feature. This can allow for leakage of submissions to unauthorized users, such as downloading submissions from other students in the class, or even instructor test submissions, given they know their user IDs. This issue has been patched in commit `1aa4c769` which is not yet in a release version, but is expected to be included in version 3.0.3. Users are advised to either manually patch or to wait for version 3.0.3. As a workaround administrators can disable the feature. 2024-11-25 not yet calculated CVE-2024-53258 BoidCMS--BoidCMS  BoidCMS is a free and open-source flat file CMS for building simple websites and blogs, developed using PHP and uses JSON as a database. In affected versions a reflected Cross-site Scripting (XSS) vulnerability exists in the /admin?page=media endpoint in the file parameter, allowing an attacker to inject arbitrary JavaScript code. This code could be used to steal the user's session cookie, perform phishing attacks, or deface the website. This issue has been addressed in version 2.1.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability. 2024-11-25 not yet calculated CVE-2024-53255 bunkerity--bunkerweb  bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). A open redirect vulnerability exists in the loading endpoint, allowing attackers to redirect authenticated users to arbitrary external URLs via the "next" parameter. The loading endpoint accepts and uses an unvalidated "next" parameter for redirects. Ex. visiting: `/loading?next=https://google.com` while authenticated will cause the page will redirect to google.com. This vulnerability could be used in phishing attacks by redirecting users from a legitimate application URL to malicious sites. This issue has been addressed in version 1.5.11. Users are advised to upgrade. There are no known workarounds for this vulnerability. 2024-11-27 not yet calculated CVE-2024-53264 Century Systems Co., Ltd.--FutureNet NXR-G110 series  FutureNet NXR series routers provided by Century Systems Co., Ltd. have REST-APIs, which are configured as disabled in the initial (factory default) configuration. But, REST-APIs are unexpectedly enabled when the affected product is powered up, provided either http-server (GUI) or Web authentication is enabled. The factory default configuration makes http-server (GUI) enabled, which means REST-APIs are also enabled. The username and the password for REST-APIs are configured in the factory default configuration. As a result, an attacker may obtain and/or alter the affected product's settings via REST-APIs. 2024-11-29 not yet calculated CVE-2024-50357 Checkmk GmbH--Checkmk  Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions type] may result in an out-of-bounds access. To spot such missed invocations early in the future, checking the validity of link- >type in bpf_link_show_fdinfo() and emitting a warning when such invocations are missed. 2024-11-25 not yet calculated CVE-2024-53099 Linux--Linux  In the Linux kernel, the following vulnerability has been resolved: nvme: tcp: avoid race between queue_lock lock and destroy Commit 76d54bf20cdc ("nvme-tcp: don't access released socket during error recovery") added a mutex_lock() call for the queue- >queue_lock in nvme_tcp_get_address(). However, the mutex_lock() races with mutex_destroy() in nvme_tcp_free_queue(), and causes the WARN below. DEBUG_LOCKS_WARN_ON(lock- >magic != lock) WARNING: CPU: 3 PID: 34077 at kernel/locking/mutex.c:587 __mutex_lock+0xcf0/0x1220 Modules linked in: nvmet_tcp nvmet nvme_tcp nvme_fabrics iw_cm ib_cm ib_core pktcdvd nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables qrtr sunrpc ppdev 9pnet_virtio 9pnet pcspkr netfs parport_pc parport e1000 i2c_piix4 i2c_smbus loop fuse nfnetlink zram bochs drm_vram_helper drm_ttm_helper ttm drm_kms_helper xfs drm sym53c8xx floppy nvme scsi_transport_spi nvme_core nvme_auth serio_raw ata_generic pata_acpi dm_multipath qemu_fw_cfg [last unloaded: ib_uverbs] CPU: 3 UID: 0 PID: 34077 Comm: udisksd Not tainted 6.11.0-rc7 #319 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014 RIP: 0010:__mutex_lock+0xcf0/0x1220 Code: 08 84 d2 0f 85 c8 04 00 00 8b 15 ef b6 c8 01 85 d2 0f 85 78 f4 ff ff 48 c7 c6 20 93 ee af 48 c7 c7 60 91 ee af e8 f0 a7 6d fd 0b e9 5e f4 ff ff 48 b8 00 00 00 00 00 fc ff df 4c 89 f2 48 c1 RSP: 0018:ffff88811305f760 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffff88812c652058 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000001 RBP: ffff88811305f8b0 R08: 0000000000000001 R09: ffffed1075c36341 R10: ffff8883ae1b1a0b R11: 0000000000010498 R12: 0000000000000000 R13: 0000000000000000 R14: dffffc0000000000 R15: ffff88812c652058 FS: 00007f9713ae4980(0000) GS:ffff8883ae180000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fcd78483c7c CR3: 0000000122c38000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ? __warn.cold+0x5b/0x1af ? __mutex_lock+0xcf0/0x1220 ? report_bug+0x1ec/0x390 ? handle_bug+0x3c/0x80 ? exc_invalid_op+0x13/0x40 ? asm_exc_invalid_op+0x16/0x20 ? __mutex_lock+0xcf0/0x1220 ? nvme_tcp_get_address+0xc2/0x1e0 [nvme_tcp] ? __pfx___mutex_lock+0x10/0x10 ? __lock_acquire+0xd6a/0x59e0 ? nvme_tcp_get_address+0xc2/0x1e0 [nvme_tcp] nvme_tcp_get_address+0xc2/0x1e0 [nvme_tcp] ? __pfx_nvme_tcp_get_address+0x10/0x10 [nvme_tcp] nvme_sysfs_show_address+0x81/0xc0 [nvme_core] dev_attr_show+0x42/0x80 ? __asan_memset+0x1f/0x40 sysfs_kf_seq_show+0x1f0/0x370 seq_read_iter+0x2cb/0x1130 ? rw_verify_area+0x3b1/0x590 ? __mutex_lock+0x433/0x1220 vfs_read+0x6a6/0xa20 ? lockdep_hardirqs_on+0x78/0x100 ? __pfx_vfs_read+0x10/0x10 ksys_read+0xf7/0x1d0 ? __pfx_ksys_read+0x10/0x10 ? __x64_sys_openat+0x105/0x1d0 do_syscall_64+0x93/0x180 ? lockdep_hardirqs_on_prepare+0x16d/0x400 ? do_syscall_64+0x9f/0x180 ? lockdep_hardirqs_on+0x78/0x100 ? do_syscall_64+0x9f/0x180 ? __pfx_ksys_read+0x10/0x10 ? lockdep_hardirqs_on_prepare+0x16d/0x400 ? do_syscall_64+0x9f/0x180 ? lockdep_hardirqs_on+0x78/0x100 ? do_syscall_64+0x9f/0x180 ? lockdep_hardirqs_on_prepare+0x16d/0x400 ? do_syscall_64+0x9f/0x180 ? lockdep_hardirqs_on+0x78/0x100 ? do_syscall_64+0x9f/0x180 ? lockdep_hardirqs_on_prepare+0x16d/0x400 ? do_syscall_64+0x9f/0x180 ? lockdep_hardirqs_on+0x78/0x100 ? do_syscall_64+0x9f/0x180 ? lockdep_hardirqs_on_prepare+0x16d/0x400 ? do_syscall_64+0x9f/0x180 ? lockdep_hardirqs_on+0x78/0x100 ? do_syscall_64+0x9f/0x180 ? do_syscall_64+0x9f/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f9713f55cfa Code: 55 48 89 e5 48 83 ec 20 48 89 55 e8 48 89 75 f0 89 7d f8 e8 e8 74 f8 ff 48 8b 55 e8 48 8b 75 f0 4 ---truncated--- 2024-11-25 not yet calculated CVE-2024-53100 Linux--Linux  In the Linux kernel, the following vulnerability has been resolved: fs: Fix uninitialized value issue in from_kuid and from_kgid ocfs2_setattr() uses attr- >ia_mode, attr- >ia_uid and attr- >ia_gid in a trace point even though ATTR_MODE, ATTR_UID and ATTR_GID aren't set. Initialize all fields of newattrs to avoid uninitialized variables, by checking if ATTR_MODE, ATTR_UID, ATTR_GID are initialized, otherwise 0. 2024-11-25 not yet calculated CVE-2024-53101 Linux--Linux  In the Linux kernel, the following vulnerability has been resolved: nvme: make keep-alive synchronous operation The nvme keep-alive operation, which executes at a periodic interval, could potentially sneak in while shutting down a fabric controller. This may lead to a race between the fabric controller admin queue destroy code path (invoked while shutting down controller) and hw/hctx queue dispatcher called from the nvme keep-alive async request queuing operation. This race could lead to the kernel crash shown below: Call Trace: autoremove_wake_function+0x0/0xbc (unreliable) __blk_mq_sched_dispatch_requests+0x114/0x24c blk_mq_sched_dispatch_requests+0x44/0x84 blk_mq_run_hw_queue+0x140/0x220 nvme_keep_alive_work+0xc8/0x19c [nvme_core] process_one_work+0x200/0x4e0 worker_thread+0x340/0x504 kthread+0x138/0x140 start_kernel_thread+0x14/0x18 While shutting down fabric controller, if nvme keep-alive request sneaks in then it would be flushed off. The nvme_keep_alive_end_io function is then invoked to handle the end of the keep-alive operation which decrements the admin- >q_usage_counter and assuming this is the last/only request in the admin queue then the admin- >q_usage_counter becomes zero. If that happens then blk-mq destroy queue operation (blk_mq_destroy_ queue()) which could be potentially running simultaneously on another cpu (as this is the controller shutdown code path) would forward progress and deletes the admin queue. So, now from this point onward we are not supposed to access the admin queue resources. However the issue here's that the nvme keep-alive thread running hw/hctx queue dispatch operation hasn't yet finished its work and so it could still potentially access the admin queue resource while the admin queue had been already deleted and that causes the above crash. This fix helps avoid the observed crash by implementing keep-alive as a synchronous operation so that we decrement admin- >q_usage_counter only after keep-alive command finished its execution and returns the command status back up to its caller (blk_execute_rq()). This would ensure that fabric shutdown code path doesn't destroy the fabric admin queue until keep-alive request finished execution and also keep-alive thread is not running hw/hctx queue dispatch operation. 2024-11-25 not yet calculated CVE-2024-53102 Mozilla--Firefox  The application failed to account for exceptions thrown by the `loadManifestFromFile` method during add-on signature verification. This flaw, triggered by an invalid or unsupported extension manifest, could have caused runtime errors that disrupted the signature validation process. As a result, the enforcement of signature validation for unrelated add-ons may have been bypassed. Signature validation in this context is used to ensure that third-party applications on the user's computer have not tampered with the user's extensions, limiting the impact of this issue. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5. 2024-11-26 not yet calculated CVE-2024-11696 Mozilla--Firefox  On Android, Firefox may have inadvertently allowed viewing saved passwords without the required device PIN authentication. This vulnerability affects Firefox < 133. 2024-11-26 not yet calculated CVE-2024-11703 msg Suisse AG--EasyTax  A XML External Entity (XXE) vulnerability has been identified in Easy Tax Client Software 2023 1.2 and earlier across multiple platforms, including Windows, Linux, and macOS. 2024-11-29 not yet calculated CVE-2024-9044 n/a--n/a  FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse_options function of sbgdec.c within the libavformat module. When parsing certain options, the software does not adequately validate the input. This allows for negative duration values to be accepted without proper bounds checking. 2024-11-29 not yet calculated CVE-2024-35366 n/a--n/a  FFmpeg n6.1.1 has an Out-of-bounds Read via libavcodec/ppc/vp8dsp_altivec.c, static const vec_s8 h_subpel_filters_outer 2024-11-29 not yet calculated CVE-2024-35367 n/a--n/a  FFmpeg n7.0 is affected by a Double Free via the rkmpp_retrieve_frame function within libavcodec/rkmppdec.c. 2024-11-29 not yet calculated CVE-2024-35368 n/a--n/a  Ant-Media-Serverv2.8.2 is affected by Improper Output Neutralization for Logs. The vulnerability stems from insufficient input sanitization in the logging mechanism. Without proper filtering or validation, user-controllable data, such as identifiers or other sensitive information, can be included in log entries without restrictions. 2024-11-29 not yet calculated CVE-2024-35371 n/a--n/a  LinkStack 2.7.9 through 4.7.7 allows resourcesviewscomponentsfavicon.blade.php link SSRF. 2024-11-29 not yet calculated CVE-2024-35451 n/a--n/a  A deserialization vulnerability exists in the Stub class of the VarDumper module in Symfony v7.0.3. The vulnerability stems from deficiencies in the original implementation when handling properties with null or uninitialized values. An attacker could construct specific serialized data and use this vulnerability to execute unauthorized code. 2024-11-29 not yet calculated CVE-2024-36610 n/a--n/a  In Symfony v7.07, a security vulnerability was identified in the FormLoginAuthenticator component, where it failed to adequately handle cases where the username or password field of a login request is empty. This flaw could lead to various security risks, including improper authentication logic handling or denial of service. 2024-11-29 not yet calculated CVE-2024-36611 n/a--n/a  Zulip from 8.0 to 8.3 contains a memory leak vulnerability in the handling of popovers. 2024-11-29 not yet calculated CVE-2024-36612 n/a--n/a  FFmpeg n7.0 has a race condition vulnerability in the VP9 decoder. This could lead to a data race if video encoding parameters were being exported, as the side data would be attached in the decoder thread while being read in the output thread. 2024-11-29 not yet calculated CVE-2024-36615 n/a--n/a  An integer overflow in the component /libavformat/westwood_vqa.c of FFmpeg n6.1.1 allows attackers to cause a denial of service in the application via a crafted VQA file. 2024-11-29 not yet calculated CVE-2024-36616 n/a--n/a  FFmpeg n6.1.1 has an integer overflow vulnerability in the FFmpeg CAF decoder. 2024-11-29 not yet calculated CVE-2024-36617 n/a--n/a  FFmpeg n6.1.1 has a vulnerability in the AVI demuxer of the libavformat library which allows for an integer overflow, potentially resulting in a denial-of-service (DoS) condition. 2024-11-29 not yet calculated CVE-2024-36618 n/a--n/a  moby v25.0.0 - v26.0.2 is vulnerable to NULL Pointer Dereference via daemon/images/image_history.go. 2024-11-29 not yet calculated CVE-2024-36620 n/a--n/a  moby v25.0.5 is affected by a Race Condition in builder/builder-next/adapters/snapshot/layer.go. The vulnerability could be used to trigger concurrent builds that call the EnsureLayer function resulting in resource leaks/exhaustion. 2024-11-29 not yet calculated CVE-2024-36621 n/a--n/a  In RaspAP raspap-webgui 3.0.9 and earlier, a command injection vulnerability exists in the clearlog.php script. The vulnerability is due to improper sanitization of user input passed via the logfile parameter. 2024-11-29 not yet calculated CVE-2024-36622 n/a--n/a  moby v25.0.3 has a Race Condition vulnerability in the streamformatter package which can be used to trigger multiple concurrent write operations resulting in data corruption or application crashes. 2024-11-29 not yet calculated CVE-2024-36623 n/a--n/a  nodemcu before v3.0.0-release_20240225 was discovered to contain an integer overflow via the getnum function at /modules/struct.c. 2024-11-29 not yet calculated CVE-2024-36671 n/a--n/a  MSA FieldServer Gateway 5.0.0 through 6.5.2 allows cross-origin WebSocket hijacking. 2024-11-29 not yet calculated CVE-2024-45495 n/a--n/a  WithSecure Atlant (formerly F-Secure Atlant) 1.0.35-1 allows a remote Denial of Service because of memory corruption during scanning of a PE32 file. 2024-12-01 not yet calculated CVE-2024-45520 n/a--n/a  OpenVidReview 1.0 is vulnerable to Incorrect Access Control. The /upload route is accessible without authentication, allowing any user to upload files. 2024-11-27 not yet calculated CVE-2024-46054 n/a--n/a  Buffer Overflow vulnerability in SunBK201 umicat through v.0.3.2 and fixed in v.0.3.3 allows an attacker to execute arbitrary code via the power(uct_int_t x, uct_int_t n) in src/uct_upstream.c. 2024-11-29 not yet calculated CVE-2024-48406 n/a--n/a  Incorrect access control in Adapt Learning Adapt Authoring Tool

Read more »

Hacker in Snowflake Extortions May Be a U.S. Soldier
Two men have been arrested for allegedly stealing data from and extorting dozens of companies that used the cloud data storage company Snowflake, but a third suspect -- a prolific hacker known as Kiberphant0m -- remains at large and continues to publicly extort victims. However, this person's identity may not remain a secret for long: A careful review of Kiberphant0m's daily chats across multiple cybercrime personas suggests they are a U.S. Army soldier who is or was recently stationed in South Korea.

Read more »

Feds Charge Five Men in ‘Scattered Spider’ Roundup
Federal prosecutors in Los Angeles this week unsealed criminal charges against five men alleged to be members of a hacking group responsible for dozens of cyber intrusions at major U.S. technology companies between 2021 and 2023, including LastPass, MailChimp, Okta, T-Mobile and Twilio.

Read more »

Fintech Giant Finastra Investigating Data Breach
The financial technology firm Finastra is investigating the alleged large-scale theft of information from its internal file transfer platform, KrebsOnSecurity has learned. Finastra, which provides software and services to 45 of the world's top 50 banks, notified customers of a potential breach after a cybercriminal began selling more than 400 gigabytes of data purportedly stolen from the company. 

Read more »

13-inch M3 MacBook Airs with 16GB of RAM on New Years sale for $200 off MSRP, prices start at $899
Amazon and Best have Apple's 13-inch M3 MacBook Airs with 16GB of memory on New Years sale right now for the same prices they had posted over Black Friday. Save $200 on each MacBook Air right now, with prices available starting at only $899. Sale prices below apply to all colors. (1): Amazon has new 13" 16GB M3 MacBook Airs on sale for $200 off MSRP, each including free shipping: - 13" M3 MacBook Air (16GB/256GB): $899, $200 off MSRP - 13" M3 MacBook Air (16GB/512GB): $1099, $200 off MSRP - 13" M3 MacBook Air (24GB/512GB): $1299, $200 off MSRP Note that stock at Amazon varies, and be sure to select Amazon as the seller rather than choosing a third-party retailer. (2): Best Buy has new 13" 16GB M3 MacBook Airs on sale for $200 off MSRP as well. Sale prices for online orders only, in-store prices may vary. Order online, and choose free shipping or free local store pickup (if available): - 13" M3 MacBook Air (16GB/256GB): $899, $200 off MSRP - 13" M3 MacBook Air (16GB/512GB): $1099, $200 off MSRP - 13" M3 MacBook Air (24GB/512GB): $1299, $200 off MSRP For the latest sales & prices, see our 13" MacBook Air Price Tracker, updated daily.

Read more »

Apple Watch Series 10 models on New Years sale for $70 off MSRP
Retailers have with prices available starting at $329. These are the lowest prices available for Series 10 Watches right now: Apple Watch Series 10 (aluminum cases): - Amazon: $70 off MSRP, prices start at $329 - Best Buy: $70 off MSRP, prices start at $329 - Walmart: $70 off MSRP, prices start at $329 Sale prices at Best Buy and Walmart are for online orders only, in-store prices may vary. Order online, and choose free shipping or free local store pickup (if available). For the latest prices & sales, keep an eye on our Apple Watch Price Tracker, updated daily.

Read more »

13-inch M2 MacBook Air (16GB RAM/256GB SSD) on New Years sale for $799, $200 off MSRP, with free store pickup
Best Buy has Apple's 13" MacBook Airs with M2 CPUs and 16GB of RAM on New Years sale for $200 off MSRP, only $799. Their price equals that of Amazon's. It's the lowest price out there for a new MacBook with 16GB of memory and a great deal: - 13" M2 MacBook Air (16GB RAM/256GB SSD): $799, $200 off MSRP Sale price for online orders only, in-store prices may vary. Order online and choose free shipping or free local store pickup (if available). For the latest sales & prices, see our 13" MacBook Air Price Tracker.

Read more »

New Years Sale: 15-inch M3 MacBook Pros with 16GB of RAM for $200 off MSRP at these Apple retailers
Amazon and Best have Apple's 15-inch M3 MacBook Airs with 16GB of memory...the newest models recently upgraded by Apple..on New Years sale for $200 off MSRP, with prices available starting at $1099. Sale prices below apply to all colors. (1): Amazon has 15" 16GB M3 MacBook Airs on sale for $200 off MSRP, each including free shipping: - 15" M3 MacBook Air (16GB/256GB): $1099, $200 off MSRP - 15" M3 MacBook Air (16GB/512GB): $1299, $200 off MSRP - 15" M3 MacBook Air (24GB/512GB): $1499, $200 off MSRP (2): Best Buy has 15" 16GB M3 MacBook Airs on sale for $200 off MSRP as well. Sale prices for online orders only, in-store prices may vary. Order online, and choose free shipping or free local store pickup (if available): - 15" M3 MacBook Air (16GB/256GB): $1099, $200 off MSRP - 15" M3 MacBook Air (16GB/512GB): $1299, $200 off MSRP - 15" M3 MacBook Air (24GB/512GB): $1499, $200 off MSRP For the latest sales & prices, see our 15" MacBook Air Price Tracker, updated daily.

Read more »

After-Christmas Sale: Apple Watch Series 10 for $50 off MSRP
After-Christmas sale prices on Apple Watch Series 10 models are available on Walmart's online store right now. Take $50 off every Apple Watch Series 10 (Aluminum cases). Sale prices available for online orders only, in-store prices may vary. Order online, and choose free shipping or free local store pickup (if available): - 42mm Apple Watch Series 10 GPS: $349, save $50 - 46mm Apple Watch Series 10 GPS: $379, save $50 - 42mm Apple Watch Series 10 GPS + 5G: $449, save $50 - 46mm Apple Watch Series 10 GPS + 5G: $479, save $50 For the latest prices & sales, keep an eye on our Apple Watch Price Tracker, updated daily.

Read more »

After-Christmas Sale: Apple Watch Series 10 for $50 off MSRP
After-Christmas sale prices on Apple Watch Series 10 models are available on Walmart's online store right now. Take $50 off every Apple Watch Series 10 (Aluminum cases). Sale prices available for online orders only, in-store prices may vary. Order online, and choose free shipping or free local store pickup (if available): - 42mm Apple Watch Series 10 GPS: $349, save $50 - 46mm Apple Watch Series 10 GPS: $379, save $50 - 42mm Apple Watch Series 10 GPS + 5G: $449, save $50 - 46mm Apple Watch Series 10 GPS + 5G: $479, save $50 For the latest prices & sales, keep an eye on our Apple Watch Price Tracker, updated daily.

Read more »

After-Christmas Sale: Apple Watch Series 10 for $50 off MSRP
After-Christmas sale prices on Apple Watch Series 10 models are available on Walmart's online store right now. Take $50 off every Apple Watch Series 10 (Aluminum cases). Sale prices available for online orders only, in-store prices may vary. Order online, and choose free shipping or free local store pickup (if available): - 42mm Apple Watch Series 10 GPS: $349, save $50 - 46mm Apple Watch Series 10 GPS: $379, save $50 - 42mm Apple Watch Series 10 GPS + 5G: $449, save $50 - 46mm Apple Watch Series 10 GPS + 5G: $479, save $50 For the latest prices & sales, keep an eye on our Apple Watch Price Tracker, updated daily.

Read more »

Clearance 13-inch M3 MacBook Airs with 8GB of RAM on sale for $799
B&H Photo has 13-inch M3 MacBook Airs with 8GB of memory on clearance sale right now for only $799, or $300 off original MSRP. Space Gray, Silver, and Midnight colors were available at the time of this post: - 13" M3 MacBook Air Midnight (8GB RAM/256GB SSD): $799 ($300 off original MSRP) B&H offers free 1-2 day shipping to most US addresses. For the latest sales & prices, see our 13" MacBook Air Price Tracker.

Read more »

Clearance 14-inch M3 Pro/M3 Max MacBook Pros on sale for $400 off original MSRP, prices start at $1599
B&H Photo has clearance 14" M3 Pro and M3 Max MacBook Pros on sale for $400 off original MSRP with prices available starting at $1599. B&H offers free 1-2 day delivery to most US addresses: - 14" 11-Core M3 Pro MacBook Pro (18GB RAM/512GB SSD): $1599 $400 off MSRP - 14" 12-Core M3 Pro MacBook Pro (18GB RAM/1TB SSD): $1999 $400 off MSRP - 14" 14-Core M3 Max MacBook Pro (36GB RAM/1TB SSD): $2799 $400 off MSRP These are the lowest available prices for last-generation 14" MacBook Pros. For the latest prices and sales, see our 14" MacBook Pro Price Tracker, updated daily.

Read more »

Holiday Sale: 16-inch M4 Max MacBook Pro for $400 off MSRP at B&H
B&H Photo is offering a $400 discount on new 16-inch MacBook Pros with an M4 Max CPU as part of their ongoing Holiday sales. B&H offers free 1-2 day shipping to most US addresses: - 16" M4 Max MacBook Pro (48GB/1TB/Black): $3599, $400 off MSRP This is the steepest discount we've seen on a new 16" M4 Max MacBook Pro this Holiday shopping season. For the latest sales and prices, keep an eye on our 16-inch MacBook Pro Price Tracker, updated daily.

Read more »

Holiday Sale: 16-inch M4 Max MacBook Pro for $400 off MSRP at B&H
B&H Photo is offering a $400 discount on new 16-inch MacBook Pros with an M4 Max CPU as part of their ongoing Holiday sales. B&H offers free 1-2 day shipping to most US addresses: - 16" M4 Max MacBook Pro (48GB/1TB/Black): $3599, $400 off MSRP This is the steepest discount we've seen on a new 16" M4 Max MacBook Pro this Holiday shopping season. For the latest sales and prices, keep an eye on our 16-inch MacBook Pro Price Tracker, updated daily.

Read more »

Apple’s M4 Mac mini with 16GB of RAM and 512GB of storage is $100 off MSRP right now
B&H Photo has the Mac mini with an M4 CPU, 16GB of memory, and 512GB of SSD storage on Holiday sale for $699 including free 1-2 day shipping to most US addresses. Their price is $100 off MSRP for this configuration...the lowest price available. For the latest prices and sales, keep an eye on our Mac mini Price Tracker, updated daily.

Read more »