We may earn a commission from links on this page. Deal pricing and availability subject to change after time of publication.

Apple products are infamously expensive, but that doesn't mean those prices never come down. While Apple doesn't typically offer discounts of its own, retailers frequently cut prices MacBooks, AirPods, and iPads, and such is the case with Amazon's Prime Big Deal Days sale. Even though October Prime Day is officially over, these are the best Apple deals you can still take advantage of.

M5 MacBook Air (13-inch)

The MacBook Air has long been the best choice for most people. While many would likely benefit from the simpler, budget MacBook Neo, there are plenty of perks for those who upgrade to the M5 MacBook Air: a bigger, better display; the M5 chip, which is much more powerful than the Neo's A18 Pro chip; Touch ID by default; and MagSafe charging, to name a few. Right now, Amazon has the 13-inch MacBook Air at $1,099, $200 below its newly inflated list price of $1,299.

M5 MacBook Air (13-inch)

$1,199.00 at Amazon

$1,299.00 Save $100.00

Get Deal

Get Deal

$1,199.00 at Amazon

$1,299.00 Save $100.00

M5 MacBook Air (15-inch)

Apple's 15-inch MacBook Air is a good option for users who want more screen real estate without having to pay "Pro" prices. Following recent price hikes, Apple's 512GB model retails for $1,499, but ahead of October Prime Day, you can save $200 on the laptop when buying through Amazon. According to Keepa, this is the 15-inch MacBook Air's best price in at least the last three months. With this MacBook Air, you get a 15.3-inch display, Apple's M5 chip with a 10-core CPU and 10-core GPU, 512GB of storage, 16GB of RAM, and up to 18 hours of battery life (according to Apple).

M5 MacBook Air (15-inch)

$1,299.00 at Amazon

$1,499.00 Save $200.00

Get Deal

Get Deal

$1,299.00 at Amazon

$1,499.00 Save $200.00

M5 Pro MacBook Pro (14-inch)

Apple's "Pro" MacBook Pro line used to start at $1,999. No longer: Apple's MSRP for the M5 Pro MacBook Pro is now $2,499. Expensive, but for many, worth it, since you get a powerful Mac chip with Apple's most feature-filled MacBook design. If you've been eyeing this model, good news: Amazon is currently taking $160 off. For $2,339, you can get a 14.2-inch MacBook Pro with a mini-LED display, the M5 Pro chip with 15-core CPU and 16-core GPU, 24GB of RAM, and a 1TB SSD. If you're looking for even more power, Amazon has a number of M5 Pro configurations discounted, including the 18-core CPU/20-core GPU model with a 2TB SSD ($2,699, down from $3,199).

M5 Pro MacBook Pro (14-inch)

$2,339.00 at Amazon

$2,499.00 Save $160.00

Get Deal

Get Deal

$2,339.00 at Amazon

$2,499.00 Save $160.00

M5 Max MacBook Pro (14-inch)

While the M5 chip in the MacBook Air is more than enough to handle most computing tasks, Apple's M5 Max is on a whole other level. For users who do intense graphics work or AI processing, there are few chips better than the one found in this 14-inch MacBook Pro. Of course, all that power comes at a cost: Apple's MSRP for this particular configuration is $4,099. But right now, Amazon has it discounted by $600. For $3,499, you get a 14.2-inch mini-LED display, the M5 Max chip with an 18-core CPU and 32-core GPU, 36GB of RAM, and a 2TB SSD.

M5 Max MacBook Pro (14-inch)

$3,499.99 at Amazon

$4,099.00 Save $599.01

Get Deal

Get Deal

$3,499.99 at Amazon

$4,099.00 Save $599.01

Mac mini

Apple's Mac mini is a favorite among AI agent fans, as well as users who want the best possible value in a powerful Mac. You'll need to provide your own keyboard, mouse, and monitor, but Apple's latest Mac mini is currently 13% off during the last hours of Prime Day, $779.99 instead of $899. It comes with Apple's latest M6 chip, 16GB of RAM, and a 256GB SSD. You'll find a 14% discount if you upgrade to the 512GB SSD, and an 11% discount on the M6 Pro model with 24GB of RAM.

Mac mini (M6)

$779.99 at Amazon

$899.00 Save $119.01

Get Deal

Get Deal

$779.99 at Amazon

$899.00 Save $119.01

AirPods Max (USB-C)

As much as I love my AirPods Max, I have a hard time recommending them because of the price—$549 is expensive for wireless headphones, and it's tough to ignore other excellent options that cost hundreds of dollars less than Apple's. However, they become easier to recommend when they're on sale. Right now, you can pick up Apple's AirPods Max 2 for $429—still expensive, but a bit more reasonable. These are Apple's latest AirPods Max, with "new" features like Live Translation and Adaptive Audio.

AirPods Max 2

$449.00 at Amazon

$549.00 Save $100.00

Get Deal

Get Deal

$449.00 at Amazon

$549.00 Save $100.00

AirPods Pro 3

Apple's third-generation AirPods Pro are excellent, but they're also pricey. For $249, you get Apple's best earbuds, with Active Noise Cancellation, Adaptive Transparency, a built-in heart rate monitor, and interchangeable tips to fit the buds to your ears. While these earbuds are arguably worth their MSRP, they're especially worth it on sale: Right now, you can take $70 off the price of the AirPods Pro 3, as Amazon is currently selling them for $179. Apple also offers cheaper AirPods with similar features, so unless you need the Pros' exclusive perks, you can save even more with the new, full-featured AirPods 5 ($149 for the version with the wireless charging case).

AirPods Pro 3

$199.00 at Amazon

$249.00 Save $50.00

Get Deal

Get Deal

$199.00 at Amazon

$249.00 Save $50.00

AirPods 4

If you're looking for a pair of AirPods at the lowest possible price, look at this deal from Best Buy. The retailer has the Apple AirPods 4 for just $79, down from their original list price of $129.99. These are one generation old at this point, and this model doesn't have Active Noise Cancellation, but for the price, this deal is an excellent way to get the AirPods experience.

Apple AirPods 4

$99.00 at Walmart

$200.29 Save $101.29

Get Deal

Get Deal

$99.00 at Walmart

$200.29 Save $101.29

iPad (A16)

Apple's basic iPad—sometimes called iPad (A16)—is the best iPad for most people. Most of us only need an 11-inch tablet with a chip capable of running iPadOS, with 12MP cameras on the front and back of the tablet. While there are iPads with bigger displays, including some with OLEDs, as well as more powerful chips and better cameras, this iPad will generally be more than enough. Right now, Amazon has the 128GB model discounted by 11%, bringing the price from $449 to $399. If you think you might need more storage, Amazon has smaller discounts on the 256GB and 512GB options, as well as on the 128GB and 256GB cellular models.

iPad (A16)

$399.00 at Amazon

$449.00 Save $50.00

Get Deal

Get Deal

$399.00 at Amazon

$449.00 Save $50.00

iPad mini (A17 Pro)

Apple's latest iPad mini doesn't have the 17% discount it did during October Prime Day, but you can still save 5% right now. This iPad mini comes with Apple's A17 Pro chip, an 8.3-inch display, 128GB of storage, and 12MP cameras on the front and back of the tablet. 128GB isn't much, though it can go a long way if you mostly keep your files in the cloud. If you think you need more storage, Amazon is taking 5% off the 256GB model.

iPad mini (A17 Pro)

$550.05 at Amazon

$599.00 Save $48.95

Get Deal

Get Deal

$550.05 at Amazon

$599.00 Save $48.95

M5 iPad Pro (11-inch)

Apple's 11-inch iPad Pro is powered by the same M5 chip as the MacBook Air—though it still runs iPadOS. Despite missing perks you get with a laptop, like a built-in keyboard, trackpad, and macOS support, this iPad Pro isn't too far off from the MacBook Air's price tag. Typically, this unit retails for $1,199, but Amazon has it listed at $100 off. Not the biggest discount, but you could apply those savings towards an Apple Pencil Pro—currently 23% off—or take a chunk off of Apple's Magic Keyboard. This model comes with an 11-inch OLED display, the M5 chip, and two 12MP cameras—one on the front and one on the back.

M5 iPad Pro (11-inch)

$1,139.00 at Amazon

$1,199.00 Save $60.00

Get Deal

Get Deal

$1,139.00 at Amazon

$1,199.00 Save $60.00

Apple Watch SE 3

The Apple Watch SE 3 is the best Apple Watch for most people. Despite the existence of bigger and "better" Apple Watches, the SE 3 does everything most people want their Apple Watches to do. It tracks your workouts, lets you send and receive texts, keeps tabs on your sleep habits, and checks your heart rate. It may be missing perks like an ECG reader, the latest S11 chip, and Apple's new persistent heart rate monitor, but most of us don't need these extra features. What's more, the SE 3 is currently 20% off on Amazon. You can pick up a new SE 3 for as little as $219 for the 40mm model, or $249 for the 44mm option. You can also save on the 44mm cellular option, which is currently $299.

Apple Watch SE 3

$219.00 at Amazon

$249.00 Save $30.00

Get Deal

Get Deal

$219.00 at Amazon

$249.00 Save $30.00

Apple Watch Series 12

The new Series 12 already has a discount, but unfortunately not for the 42mm option. If you're eyeing the larger model, however, you can spend $399 for the 46mm instead of $449—though it does seem the sales are only for some colors. The Series 12 comes with Apple's latest S12 chip, as well as the new heart rate sensor that takes a reading once every five seconds, or 20 times a minute.

Apple Watch Series 12

Buy One Apple Watch, and Get a Second Apple Watch $300 off at T-Mobile

Get Deal

Get Deal

Buy One Apple Watch, and Get a Second Apple Watch $300 off at T-Mobile

AirTags

Apple's AirTags are excellent trackers for anyone in the Apple ecosystem. Once set up, you can place AirTags on or in any of your possessions (bags, bikes, keys, etc.) and track those items through Find My. While AirTags cannot connect to the internet themselves, they communicate with other Find My-enabled devices out and about. Those devices then securely and privately update your AirTags' locations. Right now, Amazon is taking $10 off a pack of four, or $5 off an individual AirTag.

AirTag (Four-pack)

$89.00 at Amazon

$99.00 Save $10.00

Get Deal

Get Deal

$89.00 at Amazon

$99.00 Save $10.00

Magic Mouse

People often make fun of Apple's Magic Mouse for its odd charging port location (since it's on the bottom, you can't use the mouse while it's charging) as well as its less-than-ergonomic design. But despite this, it's often the best mouse choice for Mac users, if for no other reason than its easy pairing and compatibility with macOS gestures. If you're looking for a new mouse for your Mac—or even your iPad—you can save 24% on the Magic Mouse at Amazon, bringing the price to $59.99 from $79.

Apple Magic Mouse

$59.99 at Amazon

$79.00 Save $19.01

Get Deal

Get Deal

$59.99 at Amazon

$79.00 Save $19.01

Apple has released updates for iPhones, iPads, and Macs to fix a flaw that could let an attacker run code when a device processes a malicious file. Apple says it may have been used in highly targeted attacks against iPhone users running versions of iOS before iOS 27.

The fix is in iOS and iPadOS 26.7.1, as well as macOS Sequoia 15.8.1 and macOS Tahoe 26.7.1. Check Software Update on each of your Apple devices and install the latest version offered.

Updates for your particular device

The table below shows which relevant updates are available and links to Apple’s security information for each one.

How to update your Apple devices

How to update your iPhone or iPad

To check if you’re using the latest software version, go to Settings > General > Software Update. You’ll see if an update is available and be guided through installing it.

Turn on Automatic Updates if you haven’t already—you’ll find it on the same screen.

How to update macOS on any version

To update macOS on any supported Mac, use Software Update:

• Click the Apple menu in the upper-left corner of your screen.
• Choose System Settings (or System Preferences on older versions).
• Select General in the sidebar, then click Software Update on the right. On older macOS, look for Software Update directly.
• Your Mac will check for updates automatically. If updates are available, click Update Now (or Upgrade Now for major new versions) and follow the on-screen instructions. Before you upgrade to macOS Tahoe 26, read Apple’s instructions.
• Enter your administrator password if prompted, then let your Mac finish the update. It may need to restart.
• Make sure your Mac stays plugged in and connected to the internet until the update is done.

Technical details

The bug, CVE-2026-86950, affects CoreGraphics, an Apple framework used throughout its operating systems and apps to display and process visual content such as images and PDFs.

It’s an out-of-bounds write issue, which Apple addressed with improved bounds checking. This type of bug happens when software writes data beyond the limits of its allocated area of memory. It can overwrite other data in memory, interfere with the normal operation of the program, cause a crash, or even let an attacker take control of the affected process. In this case, processing a maliciously crafted file may lead to an attacker running their own code.

Apple says it is aware of a report that the issue may have been exploited in an “extremely sophisticated attack” against specific people using versions of iOS before iOS 27. Although the reported attack was highly targeted, other attackers could try to exploit the flaw now that it has been disclosed. 

Scammers know more about you than you think. 

Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in. 

Apple releases its yearly cluster of operating system updates today, with the two most prominent of course being macOS and iOS/iPadOS. These new versions focus heavily on Apple’s “AI” stuff, but there are a few actual improvements and changes to the actual operating systems as well.

Across both iOS and macOS, users now have a slider to affect how transparent or opaque the “Liquid Glass” design is across the operating system.

And on the macOS side especially, Apple has made numerous small design tweaks to address user feedback, which has been accumulating since Liquid Glass was introduced. There’s nothing radically new in terms of design here, but this is a much-needed polish pass.

Across all the releases, but in particular macOS and also iOS, there are a bunch of quality-of-life or performance improvements. For example, macOS now supports HDR for all system UI elements and gets more robust support for a wider range of display modes for external monitors.

↫ Samuel Axon at Ars Technica

If you’re not into “AI”, there’s not a lot of meat on these bones, but at least you can turn the “AI” nonsense off through a switch buried deep in the settings applications of Apple’s operating systems (which will probably be flicked back on whenever the next update comes).

Do tech companies ever stop to think about the misery they unleash on people’s lives? The Apple Watch Series 12 uses “Audio Intelligence” that, as well as secretly taking notes, also has a Live Rewind feature that can replay the last 15 seconds of recently detected audio and view a text transcript.

↫ Matt Growcoot at PetaPixel

Another win for us Europeans: this dystopian nightmare will not be available in the EU.

So that is the whole pipeline exercised end-to-end. GrandSlam authenticates the Apple Account and obtains the IDS delegate. authenticateDS and id-register turn the Linux process into a registered Apple messaging identity. The Friends sequence attaches that identity to the existing accepted relationship. A missing-key SubscribeAndFetch makes the sharing device deliver its current P-224 key over APNs/IDS, inside a sender-verified P-256 NGM envelope. A second SearchParty fetch returns the encrypted report, and the P-224 key opens it locally.

So yeah, in one sentence: authenticate to Apple’s private services, register the Linux machine as an IDS client, receive the existing Find My share key, and use it to fetch and decrypt a consented friend’s latest location.

↫ Zerotistic

I wonder if it would be possible to build a proper third-party client for Apple’s Find My network like this, or if it would be trivial for the company to block it. I’m fairly sure quite a few people would love to be able to keep using Find My when moving away from Apple’s operating systems.

If you thought pervert glasses weren’t bad enough, Apple is taking it up a notch by adding cameras to its AirPods.

Apple is working on camera-equipped AirPods that appear to be nearly ready to launch, based on a video MacRumors found in the macOS Tahoe 26.7 release candidate.

In a short demo, a man holds a book up so the camera in the AirPods can see the title. “With Visual Intelligence, your world becomes savable. See something you like? Just ask me to save it for later,” says the voiceover text.

↫ Juli Clover at MacRumors

AirPods are tiny. I’ve seen people use them at the gym. I’ve seen them on playgrounds. I’ve seen them around swimming pools. People use them at the beach. They’re used at schools. In locker rooms. Tiny cameras in tiny AirPods that can photograph anything in front of the user are a pervert’s wet dream. Abusers are going to love this. Why wear bulky glasses anyone can see and try to demand you take off, when you can wear tiny AirPods that have already been fully normalised in society? Was there not a single woman or parent on the team that made this?

All over the United States, people are destroying Flock surveillance cameras. More and more communities are rising up and demanding these things removed from their streets and neighbourhoods. The awareness of just how pervasive mass government surveillance has become is growing, and Silicon Valley’s complicity is not exactly a secret. And in this climate of rapidly growing concern and anger, Apple is going to add tiny cameras to its tiny AirPods. Was there not a single person of colour or protester on the team that made this?

How detached from reality do you have to be to greenlight something like this? Does anyone – regardless of skin colour, gender, or political leaning – want even more cameras around them?

The Touch Bar arrived in 2016 seemingly already pre-doomed, on a generation of machines that had a “we’ve run out of ideas” smell all around them. The arrow keys were reshaped, the keyboard got a slimming down, and even the beloved MagSafe wasn’t, in fact, safe. All of these changes would prove unpopular and get reverted in time, and the axe would eventually come for the Touch Bar, too.

With an enormous benefit of hindsight, a decade after its arrival, and on the (rumored) eve of fully multitouch MacBooks, I wanted to look critically at the Touch Bar in more detail. I put a spicy title above this post, and while I’m not sure I can answer it in the affirmative, I feel I got surprisingly close to that.

↫ Marcin Wichary

I have never spent this much reading about and pondering a technology seemingly nobody liked and that I never really used. I still think there’s merit to the idea of screen on a keyboard, but only if the screens are integrated into the individual keys (as some products have tried over the years). Of course, this would also be astronomically expensive, delicate, and virtually impossible to repair, so I’m not sure something like that can be reasonably made at an affordable price.

The Dutch National Cyber Security Centre (NCSC) issued a warning after being notified of several incidents where a vulnerability in Apple’s Screen Sharing feature was exploited to install Monero cryptominers.

The vulnerability, tracked as CVE-2026-65400, was patched by Apple on August 6. It is an authentication-bypass flaw in macOS Screen Sharing that can let an attacker on the network connect without valid credentials.

macOS’s built-in Screen Sharing service is a remote-control feature commonly associated with port 5900. Successful exploitation can allow a remote attacker on a reachable network to authenticate to the service without legitimate credentials.

Apple said the bug was fixed through “improved state management,” which suggests an authentication-flow or session-state validation failure rather than a cryptographic break.

The patch was issued for macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9. Practical exposure requires Screen Sharing to be enabled, so the highest-risk systems are those where port 5900 is internet-accessible, typically through a router port-forward, public IP assignment, or hosting-provider setup. Hosts reachable only from an internal network are still potentially exposed, but attackers would have to gain a position on that network.

An attacker could view and control the Mac remotely because that is the function Screen Sharing provides. NCSC says active cases involved attackers gaining root access and installing cryptomining software, specifically for Monero mining.

The criminals likely chose Monero mining because it does not depend on heavily specialized, application-specific integrated circuits (ASICs), but can be done with any CPU or GPU.

Cryptomining isn’t necessarily the worst an attacker could do. With a root-level compromise an attacker could enable persistence, data theft, credential and key harvesting, deployment of additional malware, and lateral movement.

How to stay safe

Install the update

The best way to protect your Mac is to install the update.

To update macOS on any supported Mac, use the Software Update feature, which Apple designed to work consistently across all recent versions. Here are the steps:

• Click the Apple menu in the upper-left corner of your screen.
• Choose System Settings (or System Preferences on older versions).
• Select General in the sidebar, then click Software Update on the right. On older macOS, just look for Software Update directly.
• Your Mac will check for updates automatically. If updates are available, click Update Now (or Upgrade Now for major new versions) and follow the on-screen instructions. Before you upgrade to macOS Tahoe 26, please read these instructions.
• Enter your administrator password if prompted, then let your Mac finish the update (it might need to restart during this process).
• Make sure your Mac stays plugged in and connected to the internet until the update is done.

Make sure Screen Sharing is disabled

If you can’t update immediately, check whether Screen Sharing is enabled and turn it off if you don’t use it.

1.  Click the Apple menu in the top-left corner of the screen.
2. Select System Settings.
3. In the left sidebar, click General.
4. Click Sharing on the right; you may need to scroll down.
5. Find Screen Sharing:
   • If the switch is off/grey, it is disabled.
   • If the switch is on/colored, click it to switch it off.

Also check Remote Management on that same Sharing page. It provides another remote-control route and should be off unless the owner knowingly uses it for work or IT support.

Macs need protection too

Malwarebytes Premium Security for Mac stops threats and protects your Mac and personal files from hackers and cybercriminals.

Apple has expanded its threat-notification system for targets of mercenary spyware.

Apple now shows a warning directly on an iPhone’s Lock Screen and in Settings when it believes the device owner has been targeted by mercenary spyware. The new on-device alert is meant to make a high-risk warning harder to overlook and complements notifications by email and through the user’s Apple Account page.

In the explanation, Apple states:

“Apple threat notifications are high-confidence alerts that a user has been individually targeted by a mercenary spyware attack, and should be taken very seriously.”

“Apple Threat Notification
Apple detected a mercenary spyware attack targeted at your iPhone. There are actions you can take now to help protect your data and device.”

Apple says its threat notifications are intended for people individually targeted by mercenary spyware attacks, which are highly sophisticated campaigns usually associated with commercial surveillance vendors and their government customers. Apple says it has notified targets in over 150 countries since the launch of the program in 2021, while the latest round of notifications reached people in 110 countries.

Mercenary spyware campaigns are usually not aimed at the average iPhone owner—at least at first. The initial targets are often people selected for who they are, what they know, or the work they do. But it would be a mistake to view this as someone else’s problem.

Attack techniques developed for narrowly targeted operations have a habit of spreading. Exploits can be reused, sold onward, reverse engineered, copied by other surveillance vendors, or adapted by criminal groups. A vulnerability initially valuable because it compromises a small number of carefully chosen devices may become much more dangerous once public disclosure, patch analysis, or exploit sharing makes them available for more widespread campaigns.

How to stay safe

Apple advises users to:

• Update your devices to the latest software, which includes the latest security fixes.
• Protect your devices with a passcode, Touch ID, or Face ID.
• Use two-factor authentication and a strong password for your Apple Account.
• Turn on Stolen Device Protection.
• Install apps from the App Store.
• Use strong and unique passwords, and passkeys where available.
• Don’t open links or attachments from unknown senders.

We’d like to add:

• Potential targets of mercenary spyware should consider applying Apple’s Lockdown Mode.
• Check if an Apple Threat Notification is real. Scammers will undoubtedly try and mimic them. You can verify a notification by signing in to your Apple account. A genuine Threat Notification will always be clearly listed there.
• If you receive an Apple Threat Notification, Apple recommends seeking expert help, such as the Digital Security Helpline from Access Now.

Scammers know more about you than you think. 

Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in. 

Download for iOS → Download for Android → 

The European Union’s Digital Markets Act keeps delivering for EU citizens.

Apple is working on a new feature that will support cross-device copy and paste between iOS devices and Windows PCs.

Microsoft asked for the feature using Apple’s EU interoperability request system for developers, which Apple implemented to comply with the Digital Markets Act. Apple began evaluating the request in March, and on June 26, proposed a project plan.

↫ Juli Clover at MacRumors

According to Apple, this minor feature is going to cost Apple “significant engineering effort”; I’d estimate it’ll cost them about one to two golden statues.

If you’ve spent any time browsing lately, you may have run into a full-screen popup warning you that your Apple ID or Amazon account was just used for a mysterious $149.99 purchase. It looks urgent. It looks official. And if you look at two examples side by side, it becomes obvious that it’s neither.

Below are two popups pulled from real pages—one dressed up as Apple Support, one as Amazon.

Same con, two costumes

Below, one popup is skinned as Apple Support, the other as Amazon. Swap the logo and color palette and the structure is identical: a warning icon, a claim that a $149.99 purchase was just made “via Pre-Authorization,” and a phone number to call immediately. That phone number is exactly the same in both.

That reused phone number is the tell. If you only see one popup, running the number through a lookup tool like Malwarebytes Scam Number Check is usually enough to expose it—a real Apple or Amazon line won’t come back flagged, but a scam number typically does, often tied to complaints about several unrelated companies at once.

Why the copy is built the way it is

Every element in these popups is doing specific psychological work:

• A believable, moderate dollar amount. $149.99 is high enough to alarm you, low enough to sound like a real subscription or product charge rather than an obvious lie.
• “Pre-Authorization” jargon. This is real payment terminology (used for things like hotel holds or gas station charges), borrowed here to sound technically credible to someone who doesn’t handle payments professionally.
• Manufactured urgency. “Call immediately,” “Immediate Action Required,” “no hold times”—all are designed to get you dialing before you stop to verify anything.
• Visual authority. Red warning triangles, brand-matching fonts and layouts, and a full-screen modal that blocks the rest of the page all borrow the visual language of legitimate security alerts.
• A single, frictionless call to action. One button, one phone number. The popup wants exactly one thing from you: to pick up the phone.

If you do call, the number connects to a live scammer posing as support staff, whose actual goal is to get remote access to your device, walk you through “verifying” your identity in a way that hands over real account or payment info, or push you toward paying a fake fee—often via gift cards or a wire transfer.

How to tell if it’s fake

A few checks work regardless of which brand is being impersonated:

1. Real companies don’t alert you this way. Apple and Amazon notify you about account activity through email, in-app notifications, or your account’s activity log—never through an unexpected popup while you’re browsing.
2. No legitimate company tells you to call a phone number to stop a charge. Disputing a charge happens through your bank, your card issuer, or the company’s actual account dashboard—not a hotline dictated by a popup.
3. Check where the popup is actually served from. These often ride in on malicious ads, compromised sites, or browser redirects—the underlying page may be spoofed or injected, not the real apple.com or amazon.com support page it appears to sit on top of.
4. A popup you can’t easily close is a red flag on its own. Legitimate sites don’t need to trap you behind a full-screen modal to relay account information.
5. If in doubt, go direct. Close the tab (force-close via task manager if needed) and navigate to the company’s site yourself, or call the number printed on your card or official account page—never the one in the popup.
6. Check the number before you dial it. Run it through Malwarebytes Scam Number Check to see if it’s already been flagged as a scam line.
7. Block it before it loads. A browser extension like Malwarebytes Browser Guard catches both known malicious pages and unknown ones showing scam-like behavior, so these popups often get stopped before they ever render.

Don’t judge a scam by its logo

The brand on screen—Apple, Amazon, or whoever’s next—is the least important part of this scam. What actually matters is the pattern underneath: an unexpected popup, a suspiciously specific dollar amount, urgent language, and a phone number that wants you to call before you think. Once you recognize that pattern, it doesn’t matter which company’s name is stamped on top of it.

The UK Home Office has once again demanded Apple allows it access to encrypted iCloud data.

The Guardian reports that the Home Office issued a Technical Capability Notice to Apple, this time targeting only British users. A Technical Capability Notice is a formal government order that compels tech and telecommunications companies to build or maintain specific technical functions—such as intercepting data or removing encryption protections—so law enforcement can access communications.

In the last round of this ongoing battle, the UK secretly ordered Apple to provide blanket access to protected iCloud backups around the world. Advanced Data Protection (ADP) is Apple’s opt‑in end‑to‑end encryption for iCloud backups, which even Apple itself cannot read. Apple argued that weakening or removing ADP would expose users to data breaches and other threats, and instead chose in January 2025 to withdraw ADP for UK customers rather than build a backdoor, while leaving it available elsewhere.

So, instead of working to keep citizens safe and secure, the Home Office just ended up removing an option for them.

Apple has responded by lodging a complaint with the Investigatory Powers Tribunal (IPT), seeking to challenge the scope and lawfulness of the government’s powers to issue such notices under the Investigatory Powers Act. The Tribunal is an independent court that has the power to investigate claims that the UK intelligence services have acted unlawfully.

Privacy International and Liberty have parallel complaints at the IPT challenging Technical Capability Notices more broadly, including their secrecy and necessity, and have asked for Apple’s claim to be heard in public given its wide public-interest implications.

I feel the fear of leaving an intentional backdoor is justified. If it exists, there is a chance that (AI-assisted) criminals will find and exploit it.

Weighing the importance of the right to privacy and the ability to investigate cases including terrorism and child sexual abuse is not easy. Apple’s ADP is used by many and as soon as criminals would know it’s no longer safe for them to use, they’d move to other platforms. Platforms where no legislative power will be able to gain access.

Reddit r/privacy users have been discussing alternatives for a year.

But, given the danger of a backdoor becoming available for criminals, we think in this case privacy should prevail. Let us know how you feel in the comments.

Browse like no one’s watching. 

Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next story you read doesn’t have to feel personal. Try it free → 

Cameron Kaiser’s articles are always a right treat, and this one’s no different. It’s about running MkLinux on the Apple Workgroup Server, the regular Mac rebadged into a server product and predecessor to Apple’s first real server product, the Apple Network Server running AIX. The Workgroup Servers were originally marketed with Apple’s UNIX variant, A/UX, but with this operating system not surviving the transition to PowerPC processors, Apple started offering other options.

A/UX ultimately didn’t survive the 1994 68K transition to PowerPC, but in 1996 Apple publicly offered another option: run Linux, using the Mach microkernel. Although MkLinux emerged after the 9150’s discontinuation, it’s still just an overgrown NuBus Power Mac, so between more RAM, a beefier CPU upgrade and various video cards, by the end of this article we ought to have a configuration that gives us the best of two worlds — classic MacOS and MkLinux — in one server.

↫ Cameron Kaiser

I never really stopped to think that MkLinux really was, but it’s a lot more interesting than just an early Linux port to PowerPC Macs. In fact, it ran the monolithic Linux kernel as a userspace process on top of the Mach microkernel, which made it a valuable testing ground for Apple’s later XNU efforts. It’s wild that Apple had an official, blessed Linux operating system as early as the mid ’90s, even if its performance was apparently not particularly great – due to the overhead of running it atop Mach – and Jobs canned it as soon as he came back to the company.

Last week on Malwarebytes Labs:

• Fake Fortnite rewards are stealing players’ accounts
• Fake Flash Player installs AtlasRAT
• Malwarebytes for Windows, now available on the Microsoft Store
• Hims & Hers sued over alleged health data privacy failures
• Hidden prompt turns Microsoft Copilot into an AI worm
• Apple accused of letting fake crypto app steal $1.8 million
• Buying TikTok views or followers? Here’s what you’re really getting
• AI robocalls: Why caller ID is still lying to you
• OpenAI explains how its AI agent breached Hugging Face
• We found 120 fake Walmart stores trying to steal your credit card
• We rebuilt Malwarebytes Mobile Security for the scams of today
• Shared Claude chats were searchable on Google
• Update your iPhone, iPad and Mac to fix Apple security holes
• Vatican’s Click To Pray app exposed personal data from 700,000 users
• Aftercall ads are driving Android users crazy
• Sextortion scammers are exploiting ShinyHunters data leaks
• What’s your data worth on the dark web? (Lock and Code S07E15)

Stay safe!

Scammers know more about you than you think. 

Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in. 

Download for iOS → Download for Android → 

Apple has shipped a hefty round of July security patches, headlined by iOS/iPadOS 26.6, macOS Tahoe 26.6, and Safari 26.6, with dozens of vulnerabilities squashed across kernel, WebKit, media frameworks, and core apps. These updates are primarily about improving security rather than adding new features, and users should install them as soon as possible.

Updates for your particular device

The table below shows which updates are available and points you to the relevant security content for that subject.

How to update your Apple devices

How to update your iPhone or iPad

For iOS and iPadOS users, here’s how to check if you’re using the latest software version:

Go to Settings > General > Software Update. You will see if there are updates available and be guided through installing them.

Turn on Automatic Updates if you haven’t already—you’ll find it on the same screen.

How to update macOS on any version

To update macOS on any supported Mac, use the Software Update feature, which Apple designed to work consistently across all recent versions. Here are the steps:

• Click the Apple menu in the upper-left corner of your screen.
• Choose System Settings (or System Preferences on older versions).
• Select General in the sidebar, then click Software Update on the right. On older macOS, just look for Software Update directly.
• Your Mac will check for updates automatically. If updates are available, click Update Now (or Upgrade Now for major new versions) and follow the on-screen instructions. Before you upgrade to macOS Tahoe 26, please read these instructions.
• Enter your administrator password if prompted, then let your Mac finish the update (it might need to restart during this process).
• Make sure your Mac stays plugged in and connected to the internet until the update is done.

How to update your Safari browser

Safari updates are included with macOS updates, so installing the latest version of macOS will also update Safari. To check manually:

• Open the Apple menu > System Settings > General > Software Update.
• If you see a Safari update listed separately, click Update Now to install it.
• Restart your device when prompted.

If you’re on an older macOS version that’s still supported (like Sonoma or Sequoia), Apple may offer Safari updates independently through Software Update.

Technical details

Among the more interesting vulnerabilities patched in this update are CVE-2026-43818 in ImageIO,  CVE-2026-43776 in AppleDouble, and CVE-2026-64763 to 64766 in SceneKit.

Although found in different applications, these vulnerabilities have one thing in common. Their descriptions say:

“Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution.”

The identical “processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution” language is not a coincidence. It’s Apple’s standard impact boilerplate for file‑parsing bugs across multiple frameworks, including ImageIO, AppleDouble, and SceneKit. The similarities reflect shared exploitation patterns (untrusted file input hitting native parsers), while the differences lie in what each framework does and which file types/contexts are affected.

ImageIO is the system framework responsible for reading and displaying image formats such as JPEG, PNG, TIFF, RAW, GIF, and other formats. It’s used throughout iOS and macOS by apps including Photos, Safari, Messages, Mail, and Preview.

SceneKit is a 3D graphics and scene graph framework used for rendering models, animations, and complex 3D scenes in apps and games on Apple platforms. It parses scene description files and 3D assets and turns them into renderable content.

AppleDouble is something macOS uses behind the scenes to keep extra file information like icons and other Finder details in cases where your files live on certain types of disks or servers. When Apple mentions “AppleDouble” in security notes, it’s talking about the code that reads and writes that hidden metadata, particularly when files are stored on network drives or shared with non‑Apple systems.

Apple’s advisories reuse a standard warning for any memory‑corruption bug in a file parser: the best‑case outcome is just a crash, the worst case is someone running their malicious code on your device. ImageIO, AppleDouble, and SceneKit all sit in that same danger zone. Although the file types are different, they all present the same underlying risk.

Until you’ve installed this update, it’s an even worse idea than usual to open unsolicited messages and emails with images in them.

Scammers know more about you than you think. 

Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in. 

Download for iOS → Download for Android → 

KARR Security System Vulnerability Affects Dealer-installed Hardware 

iPhone App Update Fixes KARR Alarm Flaw 

Hidden KARR Security System Complicates Updates 

Shared Bluetooth Key Exposes KARR Alarm Devices

Privacy Concerns and Recommended Action

Artificial intelligence platforms may be just as susceptible to social engineering as human beings, but they are proving remarkably good at finding security vulnerabilities in human-made computer code. That reality is on full display this month with some of the more widely-used software makers — including Apple, Google, Microsoft, Mozilla and Oracle — fixing near record volumes of security bugs, and/or quickening the tempo of their patch releases.

As it does on the second Tuesday of every month, Microsoft today released software updates to address at least 118 security vulnerabilities in its various Windows operating systems and other products. Remarkably, this is the first Patch Tuesday in nearly two years that Microsoft is not shipping any fixes to deal with emergency zero-day flaws that are already being exploited. Nor have any of the flaws fixed today been previously disclosed (potentially giving attackers a heads up in how to exploit the weakness).

Sixteen of the vulnerabilities earned Microsoft’s most-dire “critical” label, meaning malware or miscreants could abuse these bugs to seize remote control over a vulnerable Windows device with little or no help from the user. Rapid7 has done much of the heavy lifting in identifying some of the more concerning critical weaknesses this month, including:

• CVE-2026-41089: A critical stack-based buffer overflow in Windows Netlogon that offers an attacker SYSTEM privileges on the domain controller. No privileges or user interaction are required, and attack complexity is low. Patches are available for all versions of Windows Server from 2012 onwards.
• CVE-2026-41096: A critical RCE in the Windows DNS client implementation worthy of attention despite Microsoft assessing exploitation as less likely.
• CVE-2026-41103: A critical elevation of privilege vulnerability that allows an unauthorized attacker to impersonate an existing user by presenting forged credentials, thus bypassing Entra ID. Microsoft expects that exploitation is more likely.

May’s Patch Tuesday is a welcome respite from April, which saw Microsoft fix a near-record 167 security flaws. Microsoft was among a few dozen tech giants given access to a “Project Glasswing,” a much-hyped AI capability developed by Anthropic that appears quite effective at unearthing security vulnerabilities in code.

Apple, another early participant in Project Glasswing, typically fixes an average of 20 vulnerabilities each time it ships a security update for iOS devices, said Chris Goettl, vice president of product management at Ivanti. On May 11, Apple shipped updates to address at least 52 vulnerabilities and backported the changes all the way to iPhone 6s and iOS 15.

Last month, Mozilla released Firefox 150, which resolved a whopping 271 vulnerabilities that were reportedly discovered during the Glasswing evaluation.

“Since Firefox 150.0.0 released, they have been on a more aggressive weekly cadence for security updates including the release of Firefox 150.0.3 on May Patch Tuesday resolving between three to five CVEs in each release,” Goettl said.

The software giant Oracle likewise recently increased its patch pace in response to their work with Glasswing. In its most recent quarterly patch update, Oracle addressed at least 450 flaws, including more than 300 fixes for remotely exploitable, unauthenticated flaws. But at the end of April, Oracle announced it was switching to a monthly update cycle for critical security issues.

On May 8, Google started rolling out updates to its Chrome browser that fixed an astonishing 127 security flaws (up from just 30 the previous month). Chrome automagically downloads available security updates, but installing them requires fully restarting the browser.

If you encounter any weirdness applying the updates from Microsoft or any other vendor mentioned here, feel free to sound off in the comments below. Meantime, if you haven’t backed up your data and/or drive lately, doing that before updating is generally sound advice. For a more granular look at the Microsoft updates released today, checkout this inventory by the SANS Internet Storm Center.